Singapore’s Parliament passed the Scams (Countermeasures) and Other Matters Act 2026 on 9 September, creating statutory authority for police to freeze bank and platform accounts before a scam completes, and permitting AI systems to issue binding enforcement directions at scale. The law raises platform penalties from S$1 million to S$10 million per breach and criminalises the trade of online accounts used by scammers. It will not take effect until a commencement date is published in the Government Gazette — a step not yet scheduled.
The AI enforcement mechanism is a governance first: no other national law enforcement agency has granted software such statutory power. Yet key safeguards, including confidence thresholds and appeal procedures, remain undefined, leaving the tool untested and the law uncommenced.
On 9 September 2026, Singapore’s Parliament passed a law that would give AI systems the power to order platforms to take down scam content — without a human officer reviewing every case first. The vote was unanimous. The law will not come into force until a minister publishes a commencement notice in the Government Gazette. That date has not been set.
The bill — the Scams (Countermeasures) and Other Matters Act 2026 — equips the police with three new orders. Account Disabling Orders can freeze an account for 30 days, extendable once by another 30, based on suspicion it is being used or prepared for a scam. Disclosure Orders compel banks and platforms to hand over account information and transaction data. Service Limitation Orders can cut off a suspected money mule from digital banking, payment cards, and even Singpass for up to three years. The legislation also amends the Online Criminal Harms Act to allow AI or machine-learning programs to issue anti-scam directions without per‑action human review, with the agency head remaining legally responsible.
None of these powers are live yet. The Gazette notice is the missing piece. And the most novel piece — AI‑driven enforcement — arrives with only the barest outline of how it will be supervised, audited, or challenged.
A statute that hands police the keys — but not the ignition
Singaporeans lost S$410.6 million to scams in the first half of 2026, down 17.9% from the same period last year, yet still averaging S$2 million a day. The Singapore Police Force’s mid-year brief recorded 16,821 cases, while a recent joint operation with crypto exchanges prevented over S$8.94 million in potential losses. The numbers show a threat that is shrinking but stubborn.
The new Act layers police intervention on top of existing bank safeguards. Chee Hong Tat, deputy chairman of the Monetary Authority of Singapore, told Parliament on 9 September that “bank safeguards alone will not fully prevent scams.” He argued for a multi-layered approach.
Nine designated platforms — among them Facebook, Instagram, WhatsApp, Telegram, WeChat, TikTok, Carousell, Google, and Apple — will face fines of up to S$10 million per breach, a tenfold jump from the previous S$1 million. For TikTok’s parent ByteDance and WeChat’s owner Tencent, the law creates a sharp dual obligation: Singapore’s Disclosure Orders compel them to share user data with police, while China’s National Intelligence Law obliges them to cooperate with Chinese intelligence on demand.
Your data can be touched. Under the new law, Disclosure Orders will be able to reach account identifiers, contact details, and transaction-linked metadata. That information feeds the National Scams List, an intelligence platform developed by police and the Home Team Science and Technology Agency. For a Western expat, a frozen WhatsApp or bank account could block access to money and messaging with no officer to explain the freeze and no published route to challenge it.
During parliamentary debate, MP He Ting Ru for Sengkang GRC pressed the government to explain how it will distinguish between a genuine criminal and an innocent user flagged by an automated scan. The Ministry of Home Affairs has not disclosed the specific confidence threshold that triggers an AI-issued direction. That gap — more than any penalty number — will determine whether the system earns trust.
The real measure of this law will not be the penalty figures. It will be how the AI enforcement performs under audit. No other jurisdiction has given software this kind of legal trigger. The first post-mortem — likely a year after commencement — will either validate Singapore’s model or show that scale without transparency creates its own harms.
A governance model that bets on speed, not breadth
Singapore has chosen a statute-led, police-driven model. Parliament has empowered officers to issue disclosure, account-disabling, and service-limitation orders. The amended Online Criminal Harms Act raises fines for non-compliance and allows software to act. By contrast, the EU relies on horizontal platform duties under the Digital Services Act. Australia’s Online Safety Act gives a regulator takedown powers. Singapore’s approach is narrower and faster: intervene at the transaction level, not redesign the platform’s governance.
That speed comes with new burden. The law criminalises the supply of online accounts used for scams, with penalties of up to three years in prison and 12 strokes of the cane for those who misuse them. First-time offenders who sell or provide personal data for account creation face fines up to S$10,000 and up to three years in prison.
The law addresses a symptom of a much bigger regional problem. Scam syndicates across Southeast Asia operate at industrial scale, generating billions in annual losses and relying on networks of money mules and account traders. The new Act is Singapore’s attempted firewall.
Watch for the Gazette notice, likely before the end of 2026. Once it appears, the clock starts on the first AI-issued directions. If the government delays the operational guidance on appeals and confidence thresholds, expect a longer bedding-in period before the most aggressive tools are used. Singapore’s law is a live experiment in whether statutory speed can outrun an industrial scam machine. The answer will not be in the statute. It will be in the first thousand AI-issued directions, the first audit report, and the first time an innocent user’s account is frozen — and returned.
Beyond the headline
The power behind it
The legislation moves the decisive lever from courts to administrative enforcement. Police can freeze accounts first and argue later, making scam disruption a question of operational tempo and internal agency discretion rather than criminal conviction.
The timing
Lawmakers voted just after a fresh mid-year scam report showed daily losses still running at about S$2 million. The bill was a direct response to a live, continuing drain — not a theoretical risk or a one-off incident.
What isn’t being said
Beyond the headline penalty figures, the operational details remain opaque. Who decides when an AI-generated direction is confident enough? What audit trail exists? How quickly can an innocent user regain access? Those unanswered questions matter more than the fines because they determine whether the system is scalable or arbitrary.
With the law set to take effect later this year, four groups face distinct decisions
The new Act will reshape compliance, personal access, policy debate, and investment risk. Here is what each audience needs to do now, while the Gazette notice is still pending.
- Western digital platform compliance officer in Singapore
Review your Singapore incident-response protocols and legal-request workflows immediately. Ensure your team can handle a 30-day account freeze or a disclosure order that arrives with no prior notice, and check whether your backend can segment Singapore-specific data without breaking global processes. The Singapore Parliament’s bills page is the place to track commencement — not a news alert.
- Western expat or long-term resident in Singapore
Make sure every critical online account has up-to-date recovery information and a backup access method you control. When the Ministry of Home Affairs publishes the appeal mechanism, read it carefully: the first freeze could be automated, and the helpdesk may not exist yet. Keep a trusted offline contact who can verify your identity if your primary messaging or banking account is locked.
- Global AI governance researcher or policy analyst
Monitor the subsidiary legislation that will set confidence thresholds, audit requirements, and appeal procedures for AI-issued directions. Singapore’s model will feed directly into debates on the EU AI Act and automated administrative action. Bookmark the Ministry of Home Affairs press page and the Singapore Police Force’s operational guidance section — the details will appear there, not in the statute.
- Western investor in APAC digital platform companies
Map your portfolio’s exposure to Singapore’s nine designated platforms. A single S$10 million fine is no longer a rounding error; repeated breaches could become material. Ask your companies whether they have built the compliance infrastructure to segment Singapore operations, and factor the cost of a redesign into your risk model before the Gazette notice triggers the law.
FAQ
When does the law take effect?
The bill passed on 9 September 2026, but it does not take effect automatically. The statute says commencement happens only on a date appointed by the Minister in the Gazette. Users and firms should treat the law as not yet operational until that notice appears.
How can I appeal an account freeze?
The parliamentary reporting indicates that affected users can appeal account-disabling and service-limitation orders, with more detail expected before commencement. The outstanding question is whether temporary access to funds or services will be available while an appeal is being reviewed.
Which services are covered?
The law reaches banks, telcos, digital payment services, and nine designated online platforms, including Facebook, WhatsApp, Telegram, WeChat, TikTok, and Google. A freeze or disclosure request may involve a social account, a payment channel, phone service, or identity-linked service such as Singpass.
Explainer
- Scams (Countermeasures) and Other Matters Act 2026
- The newly passed Singapore law that gives police preemptive account-freezing powers and permits AI systems to issue binding enforcement directions. It amends the Protection from Scams Act and Online Criminal Harms Act, raising platform penalties to S$10 million per breach. The Act will not come into force until the Minister publishes a commencement date in the Government Gazette.
- Online Criminal Harms Act (OCHA)
- Enacted in 2023, OCHA is Singapore’s framework for combating online scams, malicious cyber activities, and other digital harms. It allows the government to designate online services and impose codes of practice. The 2026 amendment extends OCHA to cover AI-issued anti-scam directions and raises the penalty for non-compliance.
- Account Disabling Order (ADO)
- A police order under the new law that can suspend a bank or platform account for 30 days, extendable once by another 30. It can be issued based on suspicion that the account is being used or prepared for a scam. Affected users may appeal to the Commissioner of Police, whose decision is final under the current bill.
- Government Gazette
- The official publication of the Singapore government where new laws, regulations, and commencement notices are legally announced. A statute passed by Parliament typically requires a notification in the Gazette to become operative. The e-Gazette is freely accessible online and is the sole authoritative record of when a law takes effect.
- AI or machine‑learning programs
- Computer software that uses artificial intelligence or machine learning to identify scam‑related patterns. Under the new Act, such programs can generate legally binding anti‑scam directions without per‑action human review, provided the agency head remains responsible. The law does not require public disclosure of the algorithm’s design or training data.
RELATED STORIES
