Singapore has directed Facebook, Instagram and TikTok to block financial-services advertisements from providers that lack local authorization, setting a compliance deadline of Jan. 31, 2027. The requirements, announced by the Singapore Police Force (SPF) under the Online Criminal Harms Act (OCHA), impose new conditions on brokers, crypto firms and trading promoters seeking paid access to users in Singapore.
Under the Code of Practice for Social Media Services, social-media platforms must reject advertisements offering financial services or products to Singapore users unless the advertiser is licensed by the Monetary Authority of Singapore (MAS), another applicable Singapore authority, or is acting with the authority of a licensed entity. Overseas incorporation is not the deciding factor; the determining criterion is whether the advertiser holds the relevant local license or is authorized by a licensed entity.
The SPF said social-media platforms, including Facebook, Instagram and TikTok, accounted for about 30% of reported scam cases in 2025, with Facebook alone representing about 18%. The new code seeks to reduce scam exposure by tightening controls on financial promotions accessible to users in Singapore.
Broad definition of advertisers
The definition of an advertiser extends beyond the company named in a promotion. It covers brand owners, merchants, advertising agencies and public-relations agencies. Content creators, influencers, affiliate marketers and other intermediaries are also treated as advertisers when they help create, target, fund or distribute an advertisement.
As a result, an offshore broker without Singapore authority would lose access to paid promotional channels when its advertisements are accessible to users in the country. The rule applies regardless of where the entity is incorporated, focusing instead on licensing or authorization status in Singapore.
Pre-publication review and enforcement duties
Facebook, Instagram and TikTok must review all advertisements intended to be accessible to Singapore users before publication. They are required to prevent an advertisement from going live when there is reason to suspect that it supports a scam or malicious cyber activity.
The screening process must include checks for URL cloaking and continuous monitoring of embedded links for changes during an advertisement's lifecycle. Platforms must verify advertisers against government-issued records to confirm licensing or authorization status. Suspected scam advertisements that are already online must be removed promptly.
Additional obligations include acting on user reports within 24 hours, retaining specified account data for at least 90 days and filing an annual implementation report. Singapore has proposed a financial penalty of as much as S$10 million (about $7.83 million) for each instance of noncompliance with a code or implementation directive.
