Singapore's financial system depends on things most customers never see: data centres, cloud platforms and the capital buffers that keep banks standing in a crisis. In the week of 6 to 9 October, the city-state's Parliament and government moved on all of them. Lawmakers passed a Digital Infrastructure Bill that brings major data centres and cloud providers under licensing, passed amendments giving the Monetary Authority of Singapore power to set loss-absorbing capacity requirements for its biggest banks, and the government clarified the limits of its anti-scam tool, ScamShield, according to reports by Fintech News Singapore.
None of these measures is as eye-catching as a new product launch. Together, they show how Singapore approaches the resilience of a financial centre that runs on digital infrastructure: identify critical dependencies, bring them under clear rules, and make sure the system can absorb shocks without disrupting customers.
The Digital Infrastructure Bill
Parliament passed the Digital Infrastructure Bill on 7 October. It creates two licensing regimes overseen by the Infocomm Media Development Authority. The first covers major data centres and cloud providers: colocation and cloud data centres with a critical IT load of at least 10 megawatts need a licence, as do cloud providers whose infrastructure and platform services generate at least S$100 million in average annual revenue from Singapore users over three years.
Licensed operators must manage security risks, minimise disruptions, maintain recovery plans and report specified incidents to IMDA. The law covers operational risks such as power outages, cooling failures and fires, alongside existing cybersecurity requirements, and IMDA can require operators to notify affected users of specified incidents. Breaches of certain requirements can bring fines of up to S$1 million or 10 percent of the operator's annual Singapore turnover, whichever is higher.
The second regime covers energy efficiency. Data centres with a critical IT load of at least 3 megawatts need a licence and must meet efficiency standards, with requirements on IT equipment and water efficiency possibly added later. Existing operators have six months from when the relevant provisions take effect to apply.
- Major data centres: licence needed at 10 MW or more of critical IT load.
- Cloud providers: licence needed at S$100 million or more average annual Singapore revenue over three years.
- Obligations: security risk management, disruption minimisation, recovery plans, incident reporting.
- Penalties: up to S$1 million or 10 percent of Singapore turnover, whichever is higher.
- Energy efficiency: licence and standards for data centres of 3 MW or more.
The thresholds are designed to capture providers whose failure would matter most. A 10 megawatt data centre or a cloud provider earning at least S$100 million a year from Singapore users is likely to host services for many businesses at once, including banks and payment firms. Smaller providers remain outside the licensing regime but still face existing cybersecurity rules.
Why outages became a financial regulation issue
The bill responds to experience. In October 2023, a cooling system failure at a Singapore data centre disrupted banking and payment services for more than 12 hours. According to the Ministry of Digital Development and Information, the incident caused more than 810,000 failed access attempts and 2.5 million failed payment and ATM transactions.
That event showed how a single facility failure can ripple through the financial system. Banks may have excellent internal resilience, but if a data centre or cloud provider they rely on goes down, customers still cannot pay or access accounts. Regulating those providers directly closes a gap that financial regulation alone could not reach.
Singapore has more than 1.6 gigawatts of data centre capacity, and demand is growing with AI and cloud adoption. The law balances resilience with the need to manage land, power and water, which are scarce in the city-state.
A single cooling failure once caused 2.5 million failed payment and ATM transactions. Singapore has now made the data centres behind banking accountable by law.
Loss-absorbing capacity for systemically important banks
On 6 October, Parliament passed the Financial Services and Markets (Amendment) Bill. It lets MAS require domestic systemically important banks, or D-SIBs, to hold additional resources that can absorb losses, under a Total Loss Absorbing Capacity framework, as outlined in MAS's second reading speech. D-SIBs would hold eligible loss-absorbing instruments and other financial resources to support their resolution if they became distressed.
MAS already has powers to bail in subordinated creditors of a distressed institution. TLAC complements those powers by ensuring that enough resources exist to absorb losses and rebuild capital without relying on taxpayers. Under the amendments, MAS can set TLAC requirements and require banks to disclose their TLAC levels, composition and the priority of instruments in a wind-down.
MAS said D-SIBs remain well capitalised and well managed, describing the framework as preparation for the unlikely event of a distressed bank. Institutions that fail to comply could face fines of up to S$250,000, plus up to S$25,000 a day for continuing offences. The bill also aligns Singapore's counter-proliferation financing framework with updated international standards.
The ScamShield clarification
In a parliamentary response on 7 October, MAS board member Alvin Tan said ScamShield, the government's anti-scam tool, is not designed to help investors vet the people behind investment schemes. ScamShield lets users check, block and report suspected scam messages, websites and phone numbers.
For background checks on individuals and companies, the government pointed to the Accounting and Corporate Regulatory Authority's Bizfile platform for directorships and business interests, and the Ministry of Law's Insolvency Office for bankruptcy records, both for a fee. The core advice was to deal only with MAS-licensed entities and their appointed representatives.
The clarification matters because investment scams remain a major problem across Asia. Tools that block scam calls and links are valuable, but they cannot confirm whether an investment opportunity is legitimate. Our guide to checking broker licences in Southeast Asia explains how to use regulators' registers instead.
What it means for banks, fintechs and cloud providers
For banks, the measures reinforce expectations on both financial and operational resilience. TLAC adds a capital planning requirement for the largest banks, while the infrastructure law strengthens the reliability of the providers they depend on. MAS's separate technology risk guidelines already require banks to manage outsourcing and cloud risks, and the new law adds direct obligations on the providers themselves.
For fintechs, the infrastructure law is mostly indirect: their cloud providers will face new obligations, which may bring better incident reporting and recovery planning, and potentially higher costs passed through. Fintechs should review their own dependencies and resilience plans in light of the new rules.
For cloud and data centre operators, the law brings licensing, reporting and potentially large fines. Global cloud providers with significant Singapore revenue will need to demonstrate compliance, including incident notification to IMDA and, where required, to affected users.
Lessons for the region
Other Southeast Asian countries face similar dependencies as digital banking and payments grow. Regional regulators have watched Singapore's approach to outsourcing and technology risk for years, and the Digital Infrastructure Bill may become a reference point. Cooperation between regulators, such as the cybersecurity agreement between MAS and the Bank of Thailand covered in our earlier report, shows the region aligning on technology risk.
The broader lesson is that financial stability now includes digital infrastructure. Capital buffers protect against financial shocks, and infrastructure regulation protects against operational ones. Singapore has strengthened both in the same week.
What is Singapore's Digital Infrastructure Bill?
Passed on 7 October 2026, it requires licences for colocation and cloud data centres with at least 10 MW of critical IT load and for cloud providers with at least S$100 million average annual Singapore revenue, overseen by IMDA.
What are the penalties under the Digital Infrastructure Bill?
Breaches of certain requirements can bring fines of up to S$1 million or 10 percent of the operator's annual Singapore turnover, whichever is higher.
Why did Singapore pass the bill?
A 2023 data centre cooling failure disrupted banking and payments for more than 12 hours, causing more than 810,000 failed access attempts and 2.5 million failed payment and ATM transactions.
What is TLAC for Singapore banks?
Total Loss Absorbing Capacity requires systemically important banks to hold eligible instruments and resources that can absorb losses and support resolution if they become distressed. MAS can now set these requirements.
Can ScamShield check if an investment is legitimate?
No. The government said ScamShield is not designed for investment background checks. Investors should use MAS registers, ACRA's Bizfile and the Insolvency Office, and deal only with MAS-licensed entities.
When does the data centre energy licence apply?
Data centres with at least 3 MW of critical IT load need a licence and must meet efficiency standards. Existing operators have six months from when the provisions take effect to apply.
Singapore's resilience week tightened the foundations beneath its financial centre. The Digital Infrastructure Bill makes the data centres and clouds behind banking accountable, TLAC prepares the largest banks for the unlikely event of distress, and the ScamShield clarification points investors to the right tools. For banks, fintechs and providers across Asia, Singapore has again shown how it treats resilience: as a matter of law, not just best practice.
Talk to the SpinDepth deskYou've finished this story
Read on, send it to someone, or ask about it.
