Online Criminal Harms Act Codes of Practice 2026

The Singapore Police Force (SPF) issued three Codes of Practice under the Online Criminal Harms Act (OCHA) on 17 August 2026: a new Code for Online Messaging and Conferencing Services (Messaging Code), a new Code for Social Media Services (Social Media Code) replacing the Online Communication Services Code, and an enhanced Code for E-Commerce Services (E-Commerce Code). The Codes require designated online services to put measures in place to proactively disrupt scams and malicious cyber activities affecting people in Singapore (SPF, 18 August 2026).

Messaging Code

The Messaging Code applies to seven designated services assessed as posing the highest scam risk in Singapore: WhatsApp, Telegram, WeChat, Apple iMessage, Apple FaceTime, Google Message and Google Meet. Measures include consent before an unknown contact adds an end-user to a group or channel, contextual warnings or risk indicators for unknown or suspicious accounts, and options to silence, filter or block messages or calls from contacts outside the end-user's contact list. The Code also addresses impersonation of the Singapore Government through profile names or pictures (SPF, 18 August 2026).

Social Media and E-Commerce Codes

The Social Media Code applies to Facebook, Instagram and TikTok. It requires measures against suspected scam advertisements, including preventing or promptly removing advertisements accessible to Singapore users, verifying advertiser identity against Government-issued records, and restricting advertisements for financial services or products to appropriately licensed advertisers. The enhanced E-Commerce Code continues to apply to Carousell, Facebook Marketplace and Facebook Business Pages, and adds stronger consent measures for logins from new or unrecognised devices while adopting relevant advertisement safeguards (SPF, 18 August 2026).

Implementation dates and legal status

The seven designated messaging and conferencing services must implement the Codes by 31 January 2027, except for Singapore-Government-impersonation safeguards, which must be implemented by 30 September 2026. The designated social-media and e-commerce services have a 31 January 2027 implementation deadline. SPF says the requirements will be applied in a calibrated manner based on each service's assessed scam risk, and full or partial waivers may be available where appropriate. The Codes are operational instruments for designated services; they do not impose identical obligations on every online platform or user in Singapore (SPF, 18 August 2026).

Enforcement context

Under the current OCHA penalty framework, failure to comply with a Rectification Notice without reasonable excuse is an offence carrying a maximum fine of S$1 million, with a further maximum S$100,000 per day for a continuing offence after conviction. SPF separately notes that MHA's August 2026 Bill proposes a stronger penalty framework of up to S$10 million per non-compliance instance and up to S$300,000 per day for continuing offences; those proposed penalties should not be treated as the current OCHA maximums until the Bill is enacted and commenced (SPF, 18 August 2026; MHA, 4 August 2026).