Last updated 11 September 2026 — by Adrian Tan, SDM. Marketing guidance, not legal advice. The Codes of Practice discussed here bind the platforms rather than advertisers directly, but they change what advertisers must do; if a direction or an account restriction lands on your business, take it to a Singapore lawyer.
On 17 August 2026, the Singapore Police Force’s Online Criminal Harms Act Office issued three Codes of Practice: a new Code for Social Media Services covering Facebook, Instagram and TikTok; a new Code for Online Messaging and Conferencing Services covering WhatsApp, Telegram, WeChat, Apple iMessage and FaceTime, Google Messages and Google Meet; and an enhanced E-Commerce Code covering Carousell, Facebook Marketplace and Facebook Business Pages.
Buried in the first of those is a deadline every Singapore advertiser needs in the diary. By 31 January 2027, Facebook, Instagram and TikTok must verify an advertiser’s identity against government-issued records before that advertiser is permitted to run ads targeting Singapore users. Not a payment method. Not a business page. Identity, checked against a government record.
Most coverage has treated this as a platform-compliance story. It is not. It is an operational deadline for every business that buys paid social in Singapore, and it sits on top of a statute — the Online Criminal Harms Act 2023 — that already lets an officer switch off your ad, your landing page or your whole ad account on a suspicion, without hearing from you first.
Why the Codes exist, in numbers
The Singapore Police Force’s Annual Scams and Cybercrime Brief for 2025 recorded 41,974 cases and $913.1 million lost — a fall of nearly a quarter in case volume, and roughly $200 million less than 2024’s $1.1 billion. Encouraging, until you look at the composition. The median loss per case rose, from $1,389 to $1,644. Scams perpetrated on TikTok were up 37.8% year on year. Government official impersonation losses rose 60.5% to about $242.9 million. And the primary contact channels were social media, messaging platforms and online shopping platforms.
That is the policy logic in one paragraph: fewer victims, each losing more, reached through exactly the three surfaces the three Codes now cover. It also explains why the response targets the advertising layer rather than the content layer. A scam advertisement is the one piece of the funnel that is paid for, targeted, and attributable to an account — which makes advertiser identity the highest-leverage control available.
The advertiser verification requirement, and what it will actually feel like
The Social Media Services Code requires designated services to verify an advertiser’s identity against government-issued records before that advertiser may publish ads targeting Singapore users. Three consequences follow for a Singapore marketing team.
It is a different check from the one you have already done. Meta introduced its own Singapore requirement in 2025: advertisers running ads to Singapore audiences had to verify beneficiary and payer details and have that information disclosed on the ad, with the rollout starting in early April 2025 and a completion deadline of 30 June 2025. That is a “who pays for and benefits from this ad” disclosure, surfaced on the ad’s infosheet and in the Ad Library. The 2027 requirement is a “who are you, checked against a government record” identity check. Teams that completed the 2025 process should not assume they are done.
The friction lands on whoever holds the ad account. If your agency runs ads from its own business manager, the verified identity is the agency’s. If the client owns the account and grants partner access, it is the client’s. Neither is wrong, but the answer determines whose SingPass or Corppass credentials, and whose director, sits in the verification queue in January 2027 — and that is not a conversation to have in the last fortnight. Decide it now, and record it in the account-ownership section of your scope of work.
Regional and offshore structures are where this bites hardest. An advertiser whose Singapore campaigns are trafficked from a regional hub, or paid for by an overseas parent, has an identity question to answer that a purely local advertiser does not. If your Singapore spend runs through an entity that cannot readily produce a Singapore government-issued record, start the internal work now rather than in Q4.
The unlicensed-financial-services ban, and who it catches by accident
The Social Media Code also requires designated services to disallow advertisements for financial products or services unless the advertiser is licensed by the Monetary Authority of Singapore or another relevant Singapore authority.
Read narrowly, that targets the obvious problem: fake investment schemes, which remain the largest single category of scam losses in Singapore. Read as a platform will implement it, it is a classifier — and classifiers over-catch. Any business whose ad copy talks about returns, yields, capital, insurance, credit, savings, portfolios or “financial freedom” should expect to be asked to evidence a licence, whether or not it is offering a regulated product. That includes property investment marketers, financial coaching and course businesses, accounting and bookkeeping firms whose copy strays into advisory language, and fintech companies operating under an exemption rather than a licence.
The practical step is unglamorous and effective: assemble a licence-evidence pack before the enforcement date — the licence or exemption reference, the regulator, the entity name exactly as registered, and the name on the ad account — and make sure the advertising entity and the licensed entity match. Where they do not, an appeal will be a paperwork exercise rather than an argument. Our guide to crypto and digital payment token marketing in Singapore covers the equivalent problem in the category where it is already acute.
The part of the Act that can switch your campaign off today
The Codes are the headline, but the operational risk to a legitimate advertiser sits in Part 2 of the Online Criminal Harms Act 2023, which has been in force since 2024 and needs no Code to work.
Section 6(1) sets two thresholds, and the difference between them is the whole story. Under limb (a), a designated officer may issue a direction where they reasonably suspect that a specified offence has been committed and that online activity is in furtherance of it. Under limb (b) — which applies to scams and malicious cyber activity — the officer need only suspect or have reason to believe that online activity is “preparatory to, or in furtherance of,” such an offence.
Two words do enormous work there. “Preparatory to” means the direction can precede the offence: nothing need have happened to anyone yet. And limb (b) drops “reasonably” from the standard applied to everything else. For the scam category specifically, Singapore has deliberately set the lowest evidentiary threshold in the Act, because the harm is fast-moving and the money leaves in hours.
The directions themselves are listed in section 7, and three of them can land on a marketing operation:
- A disabling direction (s 9) goes to an online service and requires it to disable access by Singapore persons to the material, to identical copies of it, or to a location on the service. Your ad creative, or the page it points at, goes dark for Singapore.
- An account restriction direction (s 11) requires the service to disallow or restrict interaction between an account and Singapore persons — and section 11(2) says reasonable steps “may include the termination, suspension or restriction of one or more functionalities” of the service for that account. That is the provision under which an advertising account stops working.
- A stop communication direction (s 8) goes to whoever controls the material or is the proprietor of the location, requiring removal, and requiring you to stop posting material similar to it. Note the word: not identical, similar. Re-running a variant of the creative is non-compliance.
Section 6(2) and (3) make all of this extraterritorial: a direction may be given to any individual or entity, wherever resident, incorporated or operating, and may require an act or omission inside or outside Singapore. And section 13(3) is the sentence to sit with: “It is not necessary to give any person who may be affected by a Part 2 direction a chance to be heard before the direction is given.“
If it happens to you: 30 days, and the direction keeps running
The good news is that an advertiser has standing. The section 15 table lists who may seek reconsideration of each direction, and it is not limited to the platform that received it. For a disabling direction, the proprietor of the relevant location and the originator of the relevant material may apply — that is the business whose landing page or creative it is. For an account restriction direction, the proprietor of the relevant account may apply. You do not have to persuade Meta or ByteDance to appeal on your behalf.
The bad news is the timetable and the effect.
| Step | Provision | What it means operationally |
|---|---|---|
| Direction given | ss 6–12 | Effective immediately. No prior hearing (s 13(3)). Binding on the recipient and on successors and assignees (s 13(2)). |
| Apply for reconsideration | s 16(2) | Prescribed manner, not later than 30 days after the direction is given. Miss it and the internal route closes. |
| Direction while you apply | s 16(3) | The application does not affect the operation of the direction. The campaign stays down. |
| Decision | s 17(1) | A designated officer must, within a reasonable time, affirm, cancel or substitute the direction, and notify you (s 17(2)). |
| Appeal to a Reviewing Tribunal | s 18(1) | Available if the direction is affirmed or substituted, on payment of the prescribed fee, under Part 8. |
| Direction while you appeal | s 18(2) | Again, the appeal does not affect the operation of the direction. |
Two provisions in that table decide how you should prepare. Because sections 16(3) and 18(2) both preserve the direction pending challenge, the cost of a wrong direction is measured in weeks of dark campaign, not in a legal outcome. And because the 30-day clock in section 16(2) runs from when the direction is given — to the platform, which may not tell you promptly — the practical control is monitoring: someone has to notice that Singapore delivery has stopped, and treat that as a possible legal event rather than a delivery anomaly.
URL cloaking, and why your redirect chain is now a compliance question
One requirement in the Social Media Code deserves a section of its own because it touches ordinary marketing infrastructure: services must proactively block advertisements suspected of furthering a scam, including by checking for URL cloaking.
Cloaking — showing the review system one destination and real users another — is already against every major platform’s policies and is the standard technique for getting a scam ad approved. The difficulty is that the detection signal is divergence between what the crawler sees and what the user sees, and legitimate marketing stacks produce that divergence all the time: geo-based redirects, device-based routing, consent-gated content, A/B testing frameworks that serve variants, bot-filtering services that show reviewers a different response, affiliate and click-tracking domains that add hops, and interstitial pages between the ad and the offer.
None of that is cloaking in intent. All of it can look like cloaking to a classifier. As the Codes come into force, the sensible move is to simplify: point ads at a destination on your own domain, keep redirect chains short and stable, avoid serving materially different content to crawler user-agents, and make sure the domain in the ad matches the domain the user lands on. If you use a click-tracking intermediary, be able to explain it. The same discipline improves landing page performance anyway, which is covered in our complete guide to Meta Ads in Singapore.
What the messaging Code changes for outbound
The Messaging and Conferencing Code is not aimed at advertisers, but two of its requirements remove tactics that are still in active use in Singapore.
Consent before group-add. Designated services must require the end-user’s consent before that user can be added to a chat group by an unknown contact. The cold broadcast group — adding a list of numbers to a WhatsApp or Telegram group and marketing to it — stops working as a mechanic, independently of whether it was ever lawful. It generally was not: our guide to WhatsApp marketing rules in Singapore works through why the PDPA’s Do Not Call provisions reach a WhatsApp message addressed to a Singapore telephone number.
New-account warnings and non-contact filtering. Services must display warnings showing an account’s creation date and origin for suspicious accounts, and let users silence, filter or block messages from non-contacts. For a legitimate brand, the consequence is that a freshly created business messaging account starts life with a visible trust deficit and reduced reach to people who have not saved the number. If you are launching a messaging channel, the sequence matters: establish the account, get it verified, and build an opted-in list before you need it — the same argument our guide to SMS marketing and the Sender ID Registry makes about sender registration.
Government spoofing. Services must prevent spoofing of Singapore Government profile names and pictures, with an earlier deadline of 30 September 2026. That is the direct response to the 60.5% rise in government-impersonation losses. If your brand works with a public agency, expect stricter naming and profile-image checks on any co-branded messaging presence. The broader problem of someone else using your identity is covered in our guide to brand impersonation in Singapore.
What non-compliance costs the platforms — and why that matters to you
Failing to comply with a Code is a criminal offence for the designated service. The current framework carries a maximum fine of $1 million, with an additional $100,000 per day for a continuing offence. At the time of writing, an enhanced framework was pending parliamentary approval that would allow financial penalties of up to $10 million per instance, or a rectification or compliance order backed by a fine of up to $10 million plus $300,000 daily.
This is the part advertisers consistently underestimate. When a platform faces a seven- or eight-figure exposure for under-blocking and no exposure at all for over-blocking, its classifier will be tuned to over-block. False positives are free to the platform and expensive to you. Every additional enforcement duty in these Codes therefore translates, predictably, into more legitimate advertisers being caught by automated review — which is why the preparation below is worth doing even if nothing you run is remotely near a scam.
A pre-January-2027 checklist
- Decide who the verified advertiser is. Agency-owned or client-owned ad account, named entity, named individual. Write it into the scope of work.
- Start verification early. Assume a queue in January 2027 and a document mismatch you did not expect. Verify in Q4 2026.
- Reconcile entity names. The name on the ad account, the name on the payment method, the registered entity name and the name on any licence should match. Mismatches are the commonest cause of a failed automated check.
- Assemble a licence pack if you are anywhere near financial language. Licence or exemption reference, regulator, entity name, and a short note explaining why your product is or is not a regulated financial service.
- Simplify redirect chains. Short, stable, on your own domain, with the displayed domain matching the destination.
- Monitor Singapore delivery as a compliance signal. An unexplained stop is a possible direction. Log the date you noticed it — the 30-day reconsideration clock is short.
- Know who appeals. Under section 15 you may have standing as proprietor of the account or location, or as originator of the material. Do not assume the platform will act for you.
- Keep the underlying data compliance in order. None of this displaces the PDPA obligations set out in our guide to marketing, consent and tracking under the PDPA, or the audience-side duties in our guide to age assurance and advertising to under-18s.
Frequently asked questions
Do Singapore advertisers have to verify their identity to run Facebook, Instagram or TikTok ads?
Yes, from 31 January 2027. The Code of Practice for Social Media Services issued by the Singapore Police Force’s OCHA Office on 17 August 2026 requires designated services — Facebook, Instagram and TikTok — to verify an advertiser’s identity against government-issued records before permitting ads targeting Singapore users. It is a separate requirement from Meta’s own payer and beneficiary verification, which had a deadline of 30 June 2025.
What is the deadline for the new Singapore online advertising rules?
31 January 2027 for the substantive requirements across all three Codes, with an earlier deadline of 30 September 2026 for the Government-spoofing prevention requirement in the Messaging and Conferencing Code.
Can the Singapore authorities take down an advertisement without going to court?
Yes. Part 2 of the Online Criminal Harms Act 2023 lets a designated officer issue directions — including a disabling direction and an account restriction direction — without a court order. Section 13(3) provides that it is not necessary to give any person who may be affected a chance to be heard beforehand, and for scams and malicious cyber activity section 6(1)(b) requires only that the officer suspects or has reason to believe the activity is preparatory to, or in furtherance of, the offence.
If my ad account is restricted, can I appeal, and does the restriction lift while I do?
You can apply for reconsideration within 30 days under section 16(2), and the section 15 table gives standing to the proprietor of the relevant account or location and the originator of the material, not only to the platform. But section 16(3) provides that the application does not affect the operation of the direction, and section 18(2) says the same about an appeal to a Reviewing Tribunal. The restriction stays in place throughout.
Will the financial services rule affect businesses that are not financial firms?
It can. The Code requires designated services to disallow financial product and service advertisements unless the advertiser is licensed by MAS or another relevant Singapore authority, and platforms implement that through automated classification. Businesses using investment, returns, credit, insurance or savings language in ad copy should expect to be asked for licence evidence, and should be able to produce it or adjust the copy.
The takeaway
Two things changed in Singapore’s online advertising environment, and they operate on different timescales. The one with a date on it is advertiser identity verification against government records for Facebook, Instagram and TikTok by 31 January 2027 — an administrative task that is straightforward if you start in Q4 2026 and genuinely disruptive if you leave it to the last fortnight, particularly where a regional or offshore entity holds the ad account.
The one without a date is already live. Since 2024, a Part 2 direction under the Online Criminal Harms Act has been able to disable your creative, your landing page or your ad account on a suspicion, with no prior hearing, no court, and no suspension of effect while you challenge it. Nothing in the Codes changes that; the Codes simply add duties that make platforms more likely to act pre-emptively, because their downside for under-blocking is measured in millions and their downside for over-blocking is measured in your campaign.
The honest conclusion is that the compliance work here is not really about scams. It is about being legible: an identity that matches your registration, a destination that matches your domain, a licence you can produce on request, and someone watching delivery closely enough to notice a stop within days rather than weeks. That is a low bar, and most Singapore advertisers currently clear it by accident rather than by design. From January 2027, design is the safer option.
If you buy paid social in Singapore and want the account structure, verification and landing-page setup handled before the deadline rather than after an outage, that is what our Meta Ads team in Singapore does; see our client case studies. Start with our complete guide to Meta Ads in Singapore and our guide to TikTok advertising, then the adjacent regimes: data breach notification for marketing databases and the legal requirements for a Singapore website.
