MAS issues new guidelines on anti-scam measures for brokers

10 November 2026

In response to an increase in scams targeting investors through capital market intermediaries, particularly brokers, the Monetary Authority of Singapore (“MAS”) issued new Guidelines on Anti-Scam Measures for Brokers (“Guidelines”) on 20 October 2026. The Guidelines set out MAS’ supervisory expectations for anti-scam measures to be implemented by retail brokers to protect retail customers from unauthorised access to their trading accounts and scam-related financial losses.

The measures comprise (i) a robust governance framework for the oversight of scam risk and fair treatment of customers; (ii) login safeguards to mitigate the risk of unauthorised access; (iii) real-time notifications for trade placement and execution; (iv) funds withdrawal controls, such as verification of account ownership and real-time alerts; (v) ongoing monitoring and notification for suspicious activities and account changes; and (vi) an effective incident handling framework for immediate and coordinated responses to unauthorised access and fraudulent activities.

Brokers should maintain sufficient records evidencing their observance of the Guidelines and provide them to MAS upon request. MAS may require brokers to address any deficiencies and may factor any non-observance into its assessment of the broker.

Although the Guidelines will take effect on 30 June 2027, MAS strongly encourages all retail brokers to implement them as early as practicable. MAS also strongly encourages all other brokers to adopt these measures proactively, where appropriate.

Details of the anti-scam measures to be implemented are set out below.

Responsibilities of the Board and Senior Management

The Board and Senior Management should establish a robust governance framework for the oversight of scam risk and the fair treatment of customers. They should implement, and ensure compliance with, written anti-scam policies and procedures that should, among others, include:

• Handling of incidents: In the event of incidents relating to unauthorised access to customers’ trading accounts, the procedures should enable immediate threat containment and an efficient response to minimise customer losses; and
• Handling of customer losses: The procedures should ensure that customer losses arising from fraudulent activities are handled fairly, consistently, and transparently, with clear principles for assessing unauthorised transaction claims.

Login controls

To mitigate the risk of unauthorised access to trading accounts, brokers should adopt the following safeguards:

• Two-factor authentication (“2FA”): Implement 2FA for all account logins using at least one phishing-resistant factor, such as biometrics or device-bound cryptographic keys.
• Login notifications: Provide real-time notification alerts to customers when their accounts are accessed from a new device or browser. The specific criteria these alerts should fulfil are set out in the Guidelines.
• Session controls: Limit customers to one active trading session at any time by default, with automated session timeouts for inactivity. Requests for additional concurrent sessions should be justified by genuine operational needs and subject to safeguards, such as a maximum number of concurrent sessions allowed and periodic reviews. Customers should also be made aware of the implications of having multiple active sessions.

Trade placement and execution controls

To enable the prompt detection of unauthorised activity, brokers should, by default, provide customers with separate, real-time notification alerts at the points of both trade placement and trade execution. These alerts should be sent even if prior verification has taken place, to ensure that customers are kept informed of their account activity on an ongoing basis.

The specific criteria these alerts should fulfil are set out in the Guidelines.

If a broker allows customers to adjust notification thresholds, the change should be communicated to the customers’ account contact via a direct messaging channel. If an adjustment results in the customer opting out of certain alerts, brokers should clearly disclose the associated risks and obtain the customer’s explicit acknowledgement of the relevant risk disclosures before the change takes effect.

Funds withdrawal controls

Brokers should verify that any bank account designated for withdrawal belongs to the customer by conducting due diligence, such as obtaining bank statements that contain the customer’s details. Additionally, brokers should send real-time notification alerts for all fund withdrawals. The specific criteria these alerts should fulfil are set out in the Guidelines.

Ongoing monitoring and notification for suspicious activities and account changes

To detect potential fraud early and enable timely intervention, brokers should establish risk-based monitoring processes that include (i) monitoring for phishing campaigns and identifying fictitious websites and mobile applications; (ii) detection of suspicious internet protocol addresses, device IDs, and other scam indicators; (iii) analysis of trends and patterns in customer behaviour to identify suspicious activities; (iv) enhanced monitoring for higher-risk transactions, including large trades originating from non-resident jurisdictions; and (v) monitoring for new methods used by scammers and money mules. Brokers should review and act on any alerts generated by these processes promptly.

Whenever a customer’s contact information is modified, the broker should send notification alerts to the existing account contact before the change takes effect. The specific criteria these alerts should fulfil are set out in the Guidelines.

Incident handling

To enable immediate and coordinated responses to unauthorised access and fraudulent activities, brokers should establish an effective incident handling framework. This framework should encompass accessible reporting channels, prompt account restriction capabilities, and clear procedures and policies for managing incidents and resulting customer losses.

Brokers should provide reporting channels that are easily accessible, free of charge, and available throughout trading hours. These channels should include at least one manned phone line, monitored email address, or online portal capable of enabling a prompt response. Additionally, brokers should prioritise all cases involving potential fraud or unauthorised access, and provide customers with a written acknowledgement of their report by way of SMS, email, or in-application notification, confirming that an investigation is underway.

Brokers should be able to immediately restrict or freeze compromised trading accounts upon receiving a report or detecting fraudulent activities. Dedicated personnel should be assigned to act as a single point of contact and to provide investigation updates to the affected customer.

To allow customers to take immediate action to secure their accounts, brokers should provide a self-service account restriction feature that is easily accessible on their trading platforms and mobile applications. This feature should offer two options:

• Full restriction by default: This option prevents all customer-initiated access and transactions until the broker has verified the customer’s identity and is satisfied that it is appropriate to restore access.
• Limited restriction: This option allows the customer to manage existing positions while preventing new risk-taking and limiting account activity to the reduction or closure of those positions.

Upon the activation of either option, brokers should immediately implement the following:

Under the limited restriction option, customers may subsequently log in, but their actions should be confined to reducing or closing existing positions. To guard against unauthorised sales at prices inconsistent with prevailing market prices, brokers should consider implementing complementary controls, such as restricting transactions to limit orders placed within pre-defined price collars. Brokers should educate their customers on the purpose and implications of each option prior to activation.

Reference materials

The following materials are available on the MAS website www.mas.gov.sg:

• Guidelines on Anti-Scam Measures for Brokers
• FAQs on Guidelines on Anti-Scam Measures for Brokers