The Shared Responsibility Framework has applied since 16 December 2024, and the Protection from Scams Act since 1 July 2025. Three dated rules are mapped here, each with its status and public source, to the controls they call for and the DeepID modules that support them. DeepID supports compliance and never guarantees it.
Named for orientation. Which routes are live with which operator is confirmed with you before a pilot.
Phone numbers, payees and amounts are the illustrative values this site uses for Singapore.
Each rule with its date, its status, what it asks of a bank and the controls it calls for. A proposal is listed for what it would touch, and never marks the map.
A 12-hour cooling-off after a new device login or digital token activation, real-time alerts, a reporting channel that is always open with a kill switch, and real-time surveillance for accounts being drained fast. A bank that misses a duty bears the phishing loss.
Calls for: Cool-off and holds, Risk-based checks, Bank liability.
Source: MAS and IMDA (Response to consultation on the Shared Responsibility Framework, opens in a new tab), Oct 2024
Customers with a digital token moved off one-time passwords for account login, so a phished code no longer opens the account.
Calls for: Beyond SMS OTP.
Source: BleepingComputer (Banks in Singapore to phase out one-time passwords in 3 months, opens in a new tab), 2024, press report
The police may issue a restriction order directing a bank to restrict the transfers of someone they believe is about to send money to a scammer. The bank carries the order out.
Calls for: Cool-off and holds.
Source: MHA Singapore (Restriction orders issued under the Protection from Scams Act 2025, opens in a new tab), 2026
Each control the rule map tracks, whether a rule in Singapore calls for it, and the DeepID modules that support it.
| Control | In Singapore | DeepID modules and how they support it |
|---|---|---|
| Bind the customer to the phone | Not mapped yet | SIM and device binding, Device intelligenceSIM and device binding at onboarding and re-binding on change, with the number confirmed by the network and device integrity read every session. |
| Move beyond SMS OTP | Rule mapped | Silent network verification, Liveness and face matchOne-tap login that tries the network check and the SIM check before any one-time code, and face checks with injection defence where identity is in doubt. |
| Check risk at every key event | Rule mapped | Device intelligence, Behavioural biometrics, Scam signals, Payee and mule graph, One decision, with reasonsDevice, behaviour, scam and payee signals read at login, new payee and payment, returned as one decision with its reasons. |
| Cool off and hold | Rule mapped | SIM and device binding, One decision, with reasonsCool-off and hold decisions after a new device, SIM or payee, or when a payment looks coerced, set per market and journey. |
| Find and stop mule accounts | Not mapped yet | Payee and mule graphA payee and mule graph across accounts and devices, with recipient risk scored before the payment is sent. |
| The bank pays when controls fail | Rule mapped | One decision, with reasonsDecision logs with their reasons and the message shown to the customer, and versioned policies, as evidence of what the bank did. |
Not mapped yet means no rule is mapped to that control here, not that no rule exists. DeepID supports compliance and never guarantees it, and it claims no regulator approval.
Under the Shared Responsibility Framework, in force since 16 December 2024, banks bear phishing losses when they miss their duties.
MAS and IMDA (Response to consultation on the Shared Responsibility Framework, opens in a new tab), Oct 2024
The attacks whose pages name a rule or advisory in Singapore, each told step by step.
By industry: Banks, Digital banks, Lenders, Payments, Insurance, Capital markets.
We show your fraud, security and engineering leads how DeepID would run your sign-up, login or payment journey, then plan a pilot on your own traffic.