New and enhanced Codes of Practice issued under the Online Criminal Harms Act 2023

DISCLAIMER: This update is intended for your general information only. It is not intended to be, nor should it be, regarded as or relied upon as legal advice. Court decisions referred to herein may be subject to further appeal at the time of publication, and subsequent developments in the law, including new legislation, amendments, court decisions or practice directions, may affect the accuracy or relevance of the matters discussed. We are under no duty to update this publication to reflect any such changes in the law. You should consult a qualified legal professional before taking any action or omitting to take action in relation to matters discussed herein.

WongPartnership LLP (UEN: T08LL0003B) is a limited liability law partnership registered in Singapore under the Limited Liability

Partnerships Act 2005.

New and Enhanced Codes of Practice Issued Under the Online Criminal Harms Act 2023

The Singapore Police Force (SPF), in a news release, announced the issuance of three Codes of

Practice (COPs) for designated online services under the Online Criminal Harms Act 2023 (OCHA) on 17 August 2026:



A new COP for Online Messaging and Conferencing Services (2026) (Messaging Code);



A new COP for Social Media Services (2026) (Social Media Code) which, together with the

Messaging Code, will replace the COP for Online Communication Services (2024); and



An enhanced COP for E-Commerce Services (2026) (E-Commerce Code), which will replace the COP for E-Commerce Services (2024).

Each COP states that it comes into operation on 31 July 2026.

SPF’s OCHA Office, the Competent Authority under the OCHA, developed the new and enhanced

COPs following engagements with the designated online services. The COPs strengthen safeguards against scams by requiring providers of designated online services to put in place measures to proactively disrupt scams and malicious cyber activities.

These requirements will be applied to designated online services in a calibrated manner, based on the assessed scam risk of each service. Designated online services may receive full or partial waivers from certain requirements where appropriate.

At a glance



The Messaging Code applies to seven designated online messaging and conferencing services, requiring measures to make it more difficult for unknown contacts to engage users and to prevent spoofing of the Singapore Government.



The Social Media Code applies to Facebook, Instagram and TikTok, with requirements to prevent scam advertisements and verify advertisers’ identities.



The enhanced E-Commerce Code introduces stronger consent measures for logins from new or unrecognised devices and adopts advertisement safeguards from the Social Media Code.



Designated online services must comply by 31 January 2027, except for requirements relating to spoofing of the Singapore Government, which must be complied with by 30 September 2026.

Online Criminal Harms Act 2023 | Codes of Practice

© WongPartnership LLP

DISCLAIMER: This update is intended for your general information only. It is not intended to be, nor should it be, regarded as or relied upon as legal advice. Court decisions referred to herein may be subject to further appeal at the time of publication, and subsequent developments in the law, including new legislation, amendments, court decisions or practice directions, may affect the accuracy or relevance of the matters discussed. We are under no duty to update this publication to reflect any such changes in the law. You should consult a qualified legal professional before taking any action or omitting to take action in relation to matters discussed herein.

WongPartnership LLP (UEN: T08LL0003B) is a limited liability law partnership registered in Singapore under the Limited Liability

Partnerships Act 2005.

We highlight below the key features of the COPs as set out in the news release.

Messaging Code

In 2025, online messaging platforms such as WhatsApp and Telegram alone accounted for about 23%

of total scam cases. The Messaging Code will be applied to the following seven designated online messaging and conferencing services: WhatsApp, Telegram, WeChat, Apple iMessage, Apple

FaceTime, Google Messages and Google Meet.

Investment scams are a key concern on online messaging platforms. Scammers approach victims using accounts not previously known to the victim (unknown contact) to offer lucrative investment products. The Messaging Code will require online messaging platforms to implement measures to make it more difficult for unknown contacts to engage users, or alert users to potential scam risks posed by unknown contacts. Key requirements include:

(a)

Consent for group chats: Require the end-user’s consent before the end-user can be added into a chat group or channel by an unknown contact.

(b)

Contextual warnings or risk indicators: Display contextual warnings or risk indicators when receiving messages or calls from an unknown or suspicious account. For example, showing the account creation date and country of origin of an unknown or suspicious account to the end-user, so that they can make informed decisions on whether to engage or continue communication with such accounts.

(c)

Silencing, filtering or blocking options: Provide end-users with the option to silence, filter or block messages or calls originating from accounts or telephone numbers that are not present in the end-user’s contact list.

Government Officials Impersonation Scams (GOIS) are another key concern. In 2025, about 18% of

GOIS cases took place on WhatsApp. SPF has also observed other messaging platforms such as

Google Meet being used to perpetrate phishing scams involving the impersonation of police officers.

The Messaging Code will introduce requirements to prevent the spoofing of the Singapore Government through profile names or pictures.

The seven designated online messaging and conferencing services will be required to implement the necessary systems, processes and measures to comply with the Messaging Code by 31 January 2027, with the exception of requirements relating to spoofing of the Singapore Government, which must be complied with by 30 September 2026.

Social Media Code

In 2025, social media platforms such as Facebook, Instagram and TikTok accounted for about 30% of total scam cases, with Facebook alone accounting for about 18% of them. The Social Media Code will be applied to these three social media services.

© WongPartnership LLP

DISCLAIMER: This update is intended for your general information only. It is not intended to be, nor should it be, regarded as or relied upon as legal advice. Court decisions referred to herein may be subject to further appeal at the time of publication, and subsequent developments in the law, including new legislation, amendments, court decisions or practice directions, may affect the accuracy or relevance of the matters discussed. We are under no duty to update this publication to reflect any such changes in the law. You should consult a qualified legal professional before taking any action or omitting to take action in relation to matters discussed herein.

WongPartnership LLP (UEN: T08LL0003B) is a limited liability law partnership registered in Singapore under the Limited Liability

Partnerships Act 2005.

A key concern is the use of advertisements to target potential victims. Social media platforms profit from the publication of advertisements and must ensure that the content in the advertisement is not in furtherance of a crime. The Social Media Code will include requirements to:

(a)

Prevent scam advertisements: Prevent the publication of any advertisement that is accessible to Singapore users if there is reason to suspect that the advertisement is in furtherance of a scam. This includes assessing whether the advertisement has adopted uniform resource locator (URL) cloaking to hide a destination website’s URL, or otherwise has suspicious content.

(b)

Remove suspected scam advertisements: Promptly remove suspected scam advertisements that are accessible to Singapore users, including those reported by users.

(c)

Verify advertisers’ identities: Verify advertisers’ identities by conducting checks against

Government-issued records before advertisers targeting Singapore users are permitted to publish any advertisement on their platforms.

(d)

Disallow financial services and/or products advertisements: Disallow the publication of advertisements offering financial services and/or products to Singapore users unless the advertisers are licensed by the Monetary Authority of Singapore (MAS) or other applicable

Singapore authorities or are authorised by a licensed entity, to do so in Singapore.

Facebook, Instagram and TikTok will be required to implement the appropriate systems, processes or measures to comply with the Social Media Code by 31 January 2027.

E-Commerce Code

The designated e-commerce platforms under the E-Commerce Code remain unchanged: Carousell,

Facebook Marketplace and Facebook Business Pages. Building upon existing requirements for seller verification and payment protection, these three e-commerce platforms will be required to introduce stronger consent measures before permitting logins from new or unrecognised devices.

The enhanced E-Commerce Code also adopts the safeguards introduced in the Social Media Code to protect end-users against the exploitation of online advertisements by scam actors.

The designated e-commerce platforms will be required to implement the appropriate systems, processes or measures to comply with the E-Commerce Code by 31 January 2027.

Enforcement and Proposed Legislative Amendments

Where the OCHA Office assesses that a provider of a designated online service has not complied with an applicable requirement, it may issue a Rectification Notice (RN) requiring the designated online service to remedy the non-compliance within a specified period. Under the current OCHA penalty framework, failure to comply with an RN without reasonable excuse is an offence under section 51(3) of the OCHA, which carries a maximum fine of S$1 million. In the case of a continuing offence, the

© WongPartnership LLP

DISCLAIMER: This update is intended for your general information only. It is not intended to be, nor should it be, regarded as or relied upon as legal advice. Court decisions referred to herein may be subject to further appeal at the time of publication, and subsequent developments in the law, including new legislation, amendments, court decisions or practice directions, may affect the accuracy or relevance of the matters discussed. We are under no duty to update this publication to reflect any such changes in the law. You should consult a qualified legal professional before taking any action or omitting to take action in relation to matters discussed herein.

WongPartnership LLP (UEN: T08LL0003B) is a limited liability law partnership registered in Singapore under the Limited Liability

Partnerships Act 2005.

designated online service may be liable for a further fine not exceeding S$100,000 for every day or part of a day during which the offence continues after conviction.

The Ministry of Home Affairs (MHA) has proposed legislative amendments in Parliament in August 2026 to strengthen the OCHA penalty framework. For each instance of non-compliance with a COP or

Implementation Directive, the OCHA Office may: (a) issue a financial penalty not exceeding S$10

million; or (b) direct the online platform to rectify the non-compliance through an RN or a Compliance

Order (CO).

Failure to comply with an RN or CO without reasonable excuse is a criminal offence, punishable with a fine not exceeding S$10 million and, in the case of a continuing offence, to a further fine not exceeding

S$300,000 for every day or part of a day during which the offence continues after conviction.

More details will be shared at the Second Reading of the Scams (Countermeasures) and Other Matters

Bill in September 2026.

If you would like information and/or assistance on the above or any other area of law, you may wish to contact the Partner at WongPartnership whom you normally work with or any of the following Partners:

LAM Chung Nian

Head – Intellectual Property,

Technology & Data

Kylie PEH

Partner – Intellectual Property,

Technology & Data

WPG MEMBERS AND OFFICES

- contactus@wongpartnership.com

SINGAPORE

-

WongPartnership LLP

12 Marina Boulevard Level 28

Marina Bay Financial Centre Tower 3

Singapore 018982

t +65 6416 8000

f +65 6532 5711/5722

CHINA

-

WongPartnership LLP

Shanghai Representative Office

Unit 1015 Link Square 1 222 Hubin Road

Shanghai 200021, PRC t +86 21 6340 3131

f +86 21 6340 3315

INDONESIA

-

Makes & Partners Law Firm

Menara Batavia, 7th Floor

Jl. KH. Mas Mansyur Kav.

Jakarta 10220, Indonesia t +62 21 574 7181

f +62 21 574 7180

w makeslaw.com

MALAYSIA

-

Cheang & Ariff

Advocates & Solicitors

Loke Mansion 273A, Jalan Medan Tuanku 50300 Kuala Lumpur t +60 3 2691 0803

f +60 3 2693 4475

w cheangariff.com

-

Foong & Partners

Advocates & Solicitors 13-1, Menara 1MK, Kompleks 1 Mont' Kiara

No 1 Jalan Kiara, Mont' Kiara 50480 Kuala Lumpur, Malaysia t +60 3 6419 0822

f +60 3 6419 0823

w foongpartners.com

MIDDLE EAST

-

Al Aidarous Advocates and Legal Consultants

Abdullah Al Mulla Building, Mezzanine Suite 02 39 Hameem Street (side street of Al Murroor Street)

Al Nahyan Camp Area

P.O. Box No. 71284

Abu Dhabi, UAE t +971 2 6439 222

f +971 2 6349 229

w aidarous.com

-

Al Aidarous Advocates and Legal Consultants

Oberoi Centre, 13th Floor, Marasi Drive, Business Bay

P.O. Box No. 33299

Dubai, UAE t +971 4 2828 000

f +971 4 2828 011

PHILIPPINES

-

Gruba Law 27/F 88 Corporate Center 141 Valero St., Salcedo Village

Makati City 1227, Philippines t +63 2 889 6060

f +63 2 889 6066

w grubalaw.com wongpartnership.com