Key implementation actions

Overall feedback on the SRF from the public was supportive. In response to the feedback received, the MAS will include an additional FI duty in the area of fraud surveillance, which is to require FIs to have in place real-time fraud surveillance to identify unauthorised transactions linked to phishing scam. If a customer's account is being rapidly drained of a significant sum by scammers, FIs must either block the transaction until it is able to reach the customer for positive confirmation or send a notification to the customer and block or hold the transaction for 24 hours. For this new fraud surveillance duty, there will be an additional six-month transition period, as this was not part of the original FI duties. For the other duties, they will come into force on 16 December 2024, and compliance will be expected from then.

We recap the SRF duties of responsible FIs and responsible telcos below:

Duties of responsible FIs

• FI Duty #1: Impose a 12-hour cooling-off period upon activation of a digital security token, during which "high-risk" activities cannot be performed. The equivalent duty applies in the context of accounts issued by relevant payment service providers when a new device is used to log in.
• FI Duty #2: Provide notification alerts on a real-time basis for the activation of a digital security token to alert consumers to high-risk activity that may not have been authorised by the consumer. The equivalent duty applies in the context of accounts issued by relevant payment service providers when there is a login on a new device, or during the conduct of high-risk activities.
• FI Duty #3: Provide outgoing transaction notification alerts on a real-time basis, which are essential in prompting consumers to react when there are unauthorised transactions (e.g., immediately reporting to the FI), and enables the FI to take timely remedial action.
• FI Duty #4: Provide a 24/7 reporting channel and self-service feature (kill switch) to report and block unauthorised access to their accounts. FIs should also provide a kill switch that consumers can self-activate to immediately block their account and prevent further unauthorised transactions.
• [New] FI Duty #5: Put in place real-time fraud surveillance directed at detecting unauthorised transactions in a phishing scam that results in an account being rapidly drained of a material sum to a scammer. In such scenarios, FIs must either block the transaction until it is able to reach the customer for positive confirmation, or send a notification to the customer and block or hold the transaction for 24 hours. The MAS will allow a six-month transition period for FIs to be comply with this fraud surveillance duty.

Duties of responsible telcos

• Telco Duty #1: Connect only to authorised aggregators for delivery of Sender ID SMS to subscribers.
• Telco Duty #2: Block Sender ID SMS that are not from authorised aggregators.
• Telco Duty #3: Implement an anti-scam filter for all SMS that pass through its network, where the SMS will be scanned to determine if it contains any URL that matches that of a known malicious URL in a designated database.

Further information

For further details on the SRF, you may refer to the following:

• MAS Media Release on Implementation of Shared Responsibility Framework (24 October 2024) (link)
• MAS Response to Consultation Paper on Proposed Shared Responsibility Framework (24 October 2024) (link)
• MAS Consultation Paper on Proposed Shared Responsibility Framework (25 October 2023) (link)

Our Financial Services Regulatory team recently provided insights on the SRF and broader regulatory considerations for FIs in tackling the growing scam crisis:

• We shared our expert insights on Singapore's enforcement response to the escalating scams crisis, at our Scams: Regulatory Expectations for FIs seminar on 17 September 2024. We discussed the latest legislative developments regarding scams as well as the critical steps FIs should take to implement the anti-scam measures under the MAS-ABS anti-scam initiatives, Guidelines for E-Payments User Protection and Guidelines on SRF, among others. See our LinkedIn post on the seminar here.

* * * * *

© 2024 Baker & McKenzie.Wong & Leow. All rights reserved. Baker & McKenzie.Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "principal" means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.