Singapore’s Online Criminal Harms Act gave the authorities power to direct online services to act against criminal content. What has happened in 2026 is a change of kind rather than degree: the unit administering that power has become a standing regulator issuing binding codes to named platforms, with penalties large enough to change global product decisions.

What was issued

On 17 and 18 August 2026, the Singapore Police Force’s OCHA Office issued three instruments: a new Code of Practice for Online Messaging and Conferencing Services, a new Social Media Code, and an enhanced E-Commerce Code.

WhatsApp, Telegram, Facebook, Instagram, TikTok and four other designated services must comply by January 2027.

The messaging code is the notable addition. Regulating social feeds and marketplaces is now common internationally. Imposing design obligations on private messaging and conferencing services is considerably rarer, and it reaches the channel where a large share of the relevant activity actually occurs.

The penalty change

A revised penalty framework is expected at the Second Reading of the Scams (Countermeasures) and Other Matters Bill in September 2026. Under it, the OCHA Office could impose financial penalties of up to S$10 million for each instance of non-compliance.

Per-instance exposure at that level changes the internal economics of compliance. A one-off penalty can be provisioned for. A per-instance penalty attached to a code obligation cannot easily be, because the number of instances is a function of platform scale.

From directives to design obligations

The structural shift matters more than any single provision. The earlier operating model was reactive: authorities identified content or accounts and issued directives requiring action, as in the implementation directive issued to Meta in January 2026. Codes of practice work differently. They require services to build and maintain capabilities in advance, covering detection, user controls and verification, regardless of whether any particular incident has occurred.

That converts a legal risk into a product roadmap item. Platform governance teams must now treat Singapore’s requirements as design inputs, and because product architecture is rarely built per-jurisdiction, features developed for Singapore tend to appear elsewhere.

For advisers and platform operators

A few practical points for anyone advising on this. The January 2027 deadline is short for anything requiring engineering work. Second, designation is the trigger. The obligations attach to named services, so monitoring whether a service is likely to be designated matters as much as reading the codes. Third, the codes place responsibility for earlier disruption on platforms while giving users more control over interactions, which means both technical measures and interface changes.

Summary

Singapore’s OCHA Office issued three codes of practice in August 2026 covering messaging and conferencing services, social media and e-commerce, binding on nine named services from January 2027, with a revised penalty framework of up to S$10 million per instance of non-compliance expected in September. The shift from case-by-case directives to standing design obligations turns compliance into a product engineering commitment, and the inclusion of private messaging services extends platform regulation into territory few jurisdictions have entered.