#
Singapore's flagship consumer-protection instrument for payment fraud is the Shared Responsibility Framework (SRF), implemented 16 December 2024 by MAS and IMDA via Guidelines. It allocates losses from defined phishing scams across FIs, telcos and consumers on a 'waterfall' basis with no liability cap, adds an FI real-time fraud-surveillance duty (6-month transition), and sits alongside the E-Payments User Protection Guidelines. Recourse runs through the FI as first contact, then FIDReC. Unlike the UK's APP-fraud reimbursement regime, the SRF covers unauthorised phishing transactions (not authorised push payments) and uniquely holds telcos accountable.
The model divergence is the analytical spine here. The SRF differs from the UK APP-fraud reimbursement regime — which carries an £85,000 cap and covers authorised transactions — in three material respects: the SRF covers unauthorised phishing transactions rather than authorised push payments, it has no liability cap, and it uniquely brings telecommunications operators into the liability waterfall. The liable parties span full banks and relevant PSPs (including MPI e-wallet issuers) on the financial side and telecommunications operators on the communications side, making applicability genuinely cross-sectoral and cross bank/nonbank.
Scope exclusions matter: the SRF excludes corporate customers, malware-enabled scams and authorised (investment or love) scams, and applies to transactions with both a digital and a territorial nexus.
Outlook
The SRF is now implemented and the trajectory is established. The forward edge is the real-time fraud-surveillance duty bedding in across liable FIs and the interplay with the EUPG conduct duties carried in W1b. No expansion of SRF scope to authorised push payments is currently signalled.
Consumer Protection & APP Fraud
The Shared Responsibility Framework has been in force since 16 December 2024, assigning financial institutions and telcos duties to mitigate phishing scams and requiring payouts to victims where those duties are breached. It covers full banks and e-wallet-issuing PSPs holding a Major Payment Institution licence, together with mobile network operator telcos — a scope that spans both bank and non-bank payment providers. The Protection from Scams Bill separately empowers police to issue Restriction Orders directing banks to restrict an individual's banking transactions on reasonable belief of impending scam victimisation, with a fine of up to SGD 3,000 for bank non-compliance without reasonable excuse. Against this framework, one lower-confidence estimate put 2024 total scam cases up 10.6% to 51,501, with losses surging 70.6% to at least SGD 1.1 billion, up from SGD 651.8 million in 2023.
Outlook
The interaction between the Shared Responsibility Framework's reimbursement mechanics and the Restriction Order power under the Protection from Scams Bill, and whether 2025 scam-loss figures confirm or revise the cited 2024 trend, are the items to watch under this module.
Sources and findings (4)
- T1https://www.mas.gov.sg/regulation/guidelines/guidelines-on-shared-responsibility-frameworkretrieved
- T1https://www.mas.gov.sg/news/media-releases/2024/mas-and-imda-announce-implementation-of-shared-responsibility-framework-from-16-december-2024retrieved
- T3https://www.aoshearman.com/en/insights/ao-shearman-on-fintech-and-digital-assets/combatting-payment-account-fraud-singapores-shared-responsibility-frameworkretrieved
- T3https://www.hsfkramer.com/notes/data/2024-posts/financial-institutions-and-telcos-required-to-share-responsibility-for-phishing-scams-in-singaporeretrieved