Who was sanctioned, and for what?

An explosion and fire at a heated mixer machine at Stars Engrg Pte Ltd's Tuas worksite on 24 February 2021 killed three workers and injured seven; the company was fined a total of SGD 500,000 under the Workplace Safety and Health Act. According to investigations by the Ministry of Manpower (MOM, Singapore's labour ministry) and an inquiry committee, the machine had been kept running despite repeated warning signs such as overheating, oil leaks, smoke and a fire shortly beforehand, and there were failures in risk assessment, safe work procedures, maintenance, supervision and training. After the incident, messages significant to the investigation were also deleted.

Authority / court

Ministry of Manpower (MOM); Verurteilung durch ein Singapurer Strafgericht

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

Workplace Safety and Health Act 2006 (WSHA); Penal Code (Behinderung der Justiz, gegen Einzelpersonen)

Action

Fine

Status of proceedings

unknown

Sector

Manufacturing and mechanical engineering

Liability of senior managers

Measures against individuals are not set out here.

Published

25 Jun 2026

Original amount 500,000 SGD, converted at the ECB reference rate of 25 Jun 2026.

Checked against the official source on 4 Oct 2026 · Direct link

The Monetary Authority of Singapore (MAS, Singapore's central bank and financial regulator) allegedly imposed a composition penalty of SGD 300,000 on the licensed trust company Padang Trust Singapore Pte. Ltd. because it failed to inquire into unusual transactions with no apparent economic or lawful purpose and did not file suspicious transaction reports promptly. According to MAS, the causes were inadequate controls, including a lack of scrutiny of unusual transactions and low staff awareness of money laundering and terrorist financing risks and red flags; the company paid the penalty, took remedial action and appointed an independent reviewer to confirm that the measures are effective. The amount and the facts have not been confirmed against the primary source.

Authority / court

Monetary Authority of Singapore (MAS)

Area of law

Money laundering and terrorist financing · Suspicious activity reports

Legal basis

MAS Notice TCA-N03; s 27B(2) Monetary Authority of Singapore Act (Cap. 186); Composition nach s 176(1A) MAS Act 1970

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Published

25 May 2026

Original amount 300,000 SGD, converted at the ECB reference rate of 25 May 2026.

Checked against the official source on 4 Oct 2026 · Direct link

The fund manager Havenport Investments Pte Ltd lacked an adequate framework for managing the risks of the assets under its management, breached its base capital requirement without reporting this to the Monetary Authority of Singapore (MAS, Singapore's central bank and financial regulator), and violated conditions of its Capital Markets Services Licence requiring prior approval for a new product and personalised advice from independent financial advisers for retail investors before onboarding. MAS allegedly imposed a composition fine of SGD 40,000; the company has ceased its retail fund management business and has not been allowed to manage retail investors' money since 18 July 2024. The amount and the facts have not been confirmed against the primary source.

Authority / court

Monetary Authority of Singapore (MAS)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Securities and Futures Act (SFA) und zugehörige Regulations; Auflagen der Capital Markets Services Licence

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Liability of senior managers

Measures against individuals are not set out here.

Published

18 May 2026

Original amount 40,000 SGD, converted at the ECB reference rate of 18 May 2026.

Checked against the official source on 4 Oct 2026 · Direct link

The Ministry of Manpower (MOM, Singapore's labour ministry) issued Twelve Cupcakes Pte. Ltd. a formal stern warning because 80 employees were not paid their salaries for 1 to 29 October 2025 after the company closed on 29 October 2025. The parent company Dhunseri Ventures Limited had placed it into liquidation because of an acute cash-flow shortfall; the ministry regarded the case as a genuine business closure in financial distress rather than a deliberate attempt to evade salary obligations and therefore limited its action to the warning.

Authority / court

Ministry of Manpower (MOM), Singapur

Area of law

Health and safety and employment law · Minimum wage and undeclared work

Legal basis

Employment Act (EA), Singapur (fristgerechte Lohnzahlung)

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Food and agriculture

Employees

50 to 249

Mitigating circumstances

Salaries paid in full up to and including September 2025 despite continued losses, union informed on the day management learned of the liquidation, liquidator appointed; salary claims rank ahead of other unsecured debts in the insolvency.

Published

1 Apr 2026

Checked against the official source on 4 Oct 2026 · Direct link

The management corporation of the Riverfront Residences condominium had not designated a data protection officer until March 2025, had no data protection policies of its own and had given its managing agent, which acted for it as a data intermediary, no instructions on handling personal data; in April 2025 an employee of the managing agent mistakenly sent the names, addresses and maintenance fee details of two owners to another owner. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found breaches of the Accountability Obligation and the Protection Obligation; by contrast, it found no breach in the circulation of a requisition for an extraordinary general meeting bearing the names and signatures of 303 owners, because strata management law prevailed. It directed the corporation to introduce, within 90 days, policies and procedures for the processing of data by the managing agent and to communicate them to it; the managing agent itself had given a voluntary undertaking.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data processors

Legal basis

Sections 11(3) und 12(a) PDPA 2012 (Accountability Obligation); Section 24 i. V. m. Section 4(3) PDPA (Protection Obligation bei Einsatz eines Data Intermediary)

Action

Order

Status of proceedings

unknown

Sector

Construction and real estate

Published

7 May 2026

Checked against the official source on 4 Oct 2026 · Direct link

The provider of cloud-based HR software received an extortion email in April 2024; an attacker had deleted databases on its AWS servers and likely exfiltrated data, and data allegedly taken was offered for sale on the dark web – data on 95,000 employees of its clients (including identity number, salary, bank account and religion) and on 24,765 emergency contacts and children was put at risk. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found a breach of the Protection Obligation because, despite the HR data entrusted to it by clients, the provider had no web application firewall against existing SQL injection vulnerabilities, remote desktop access open to the internet without two-factor authentication, and vulnerability scans only every two years. It imposed 17,500 SGD, payable in twelve monthly instalments in view of the company's cash flow, and directed among other things a web application firewall, annual penetration tests, two-factor authentication and encryption of all personal data fields.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data processors

Legal basis

Section 24 PDPA 2012 (Protection Obligation); Section 48J PDPA (Financial Penalty)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

no

Mitigating circumstances

Cooperation, admission under the Expedited Decision Procedure and first breach; payment in instalments in view of cash flow, while a waiver was refused.

Published

8 Jan 2026

Original amount 17,500 SGD, converted at the ECB reference rate of 8 Jan 2026.

Checked against the official source on 4 Oct 2026 · Direct link

In August 2024 an attacker encrypted a network drive shared by SESAMi and its subsidiary Abecha holding payment data (including full credit card numbers and bank account details) of around 20,471 customers of the subsidiary's fuel fleet discount programme and of up to 18,837 individuals from registrations for SESAMi's B2B platform; exfiltration could not be established. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) classified SESAMi, which ran the network for the subsidiary without a written contract, as a data intermediary in that respect and found a negligent breach of the Protection Obligation by SESAMi (including outdated firewall and VPN firmware, no patch management and unenforced password and MFA rules), and likewise by Abecha, which as controller had taken no steps to ensure adequate security at SESAMi. SESAMi received 8,750 SGD and directions, while Abecha, as the controller, received directions only, including setting out roles and data protection duties within the group in writing.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data processors

Legal basis

Section 24(a) PDPA 2012 (Protection Obligation); Section 4(3) PDPA (Pflichten bei Einsatz eines Data Intermediary); Section 48J PDPA (Financial Penalty)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Mitigating circumstances

Cooperation, prompt and effective remediation, admission under the Expedited Decision Procedure; for Abecha also lower culpability owing to its limited autonomy as a wholly owned subsidiary, one of the reasons for not imposing a fine on it.

Published

26 Feb 2026

Original amount 8,750 SGD, converted at the ECB reference rate of 29 Dec 2025.

Checked against the official source on 4 Oct 2026 · Direct link

On 8 October 2024 Singtel's fixed-line voice service failed for more than four hours for around 500,000 residential and corporate users; customer service lines of government agencies, healthcare organisations and banks as well as emergency call services were also affected. The cause was that the virtualised firewalls of the voice system and of a monitoring system shared the same hardware, so that an overload of the insufficiently filtered monitoring system also disrupted the voice system and the automatic failover did not work cleanly; according to the investigation, there was no cyber-attack. The Infocomm Media Development Authority (IMDA, Singapore's telecoms and media regulator) imposed a penalty of SGD 1 million under the Telecommunications Act because the incident had been within Singtel's control to prevent.

Authority / court

Infocomm Media Development Authority (IMDA)

Area of law

Information security and cyber · Critical infrastructure

Legal basis

Telecommunications Act

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Published

11 Dec 2025

Original amount 1,000,000 SGD, converted at the ECB reference rate of 11 Dec 2025.

Checked against the official source on 4 Oct 2026 · Direct link

After a cyberattack on the travel agency became public in December 2023, data on 336,759 individuals in its booking system was affected, in some cases including full images of identity cards, passports and birth certificates; part of the data was exfiltrated. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found negligent breaches of the Accountability Obligation – a data protection officer appointed only in April 2024, and apart from the customer-facing privacy policy no internal policies, no complaints process and no information to staff – and of the Protection Obligation, because there were no contracts with the IT vendors covering security tasks, no security reviews and no multi-factor authentication, and the server was still running the unsupported Windows Server 2012. It imposed 47,000 SGD, rejected objections based on COVID-19 losses and comparable cases, and directed among other things policies, security clauses in vendor contracts and a penetration test by a provider licensed by the Cyber Security Agency (CSA).

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Sections 11(3) und 12 PDPA 2012 (Accountability Obligation); Section 24 PDPA (Protection Obligation); Section 48J(1)(a) PDPA (Financial Penalty); Section 48I PDPA (Directions)

Action

Fine

Status of proceedings

unknown

Sector

Other

Culpability

negligent

Mitigating circumstances

Voluntary early admission of the breaches (treated as significantly mitigating) and prompt, effective remediation.

Published

8 Jan 2026

Original amount 47,000 SGD, converted at the ECB reference rate of 31 Oct 2025.

Checked against the official source on 4 Oct 2026 · Direct link

When API configurations were manually transferred to a new middleware platform (September 2022 to March 2023), a single employee in sole charge omitted an app identifier, so token verification did not apply to the web page of the ArtScience Friends museum programme for at least six months; an attacker exploited this in October 2023 and retrieved data on 665,495 members of the Sands Rewards Lifestyle loyalty programme, which was then offered for sale on the dark web. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) held that the resort had negligently breached the Protection Obligation by relying on this one employee without independent checks or automation. It reduced the provisionally intended 450,000 SGD to 315,000 SGD after the company's representations; no directions were issued because remediation had already been carried out.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Section 24 Personal Data Protection Act 2012 (Protection Obligation); Section 48J PDPA (Financial Penalty)

Action

Fine

Status of proceedings

unknown

Sector

Other

Culpability

negligent

Repeat case

no

Mitigating circumstances

Otherwise adequate security arrangements, containment on the day of discovery, admission under the Expedited Decision Procedure, cooperation and voluntary notification of all affected individuals.

Published

28 Oct 2025

Original amount 315,000 SGD, converted at the ECB reference rate of 28 Oct 2025.

Checked against the official source on 4 Oct 2026 · Direct link

ZGR Global (formerly Zhongguo Remittance) and Hanshan Money Express, two adjacent leading providers of Chinese yuan remittances in People's Park Complex, shared their current and partly non-public remittance rates with each other daily, often several times a day, from at least January 2016 to February 2022, verbally over the counter, on paper slips or by phone. The Competition and Consumer Commission of Singapore (CCCS) found this to infringe s 34 of the Competition Act and on 31 July 2025 imposed penalties totalling 5,365,007 SGD (ZGR Global 2,793,700, Hanshan 2,571,307 SGD). In addition to its cooperation discount, Hanshan received a further 10% discount for its admission under the Fast Track Procedure.

Authority / court

Competition and Consumer Commission of Singapore (CCCS)

Area of law

Competition law · Cartels and collusion

Legal basis

Competition Act 2004, s 34

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Mitigating circumstances

Hanshan: discount for cooperation plus a further 10% for its admission under the Fast Track Procedure.

Published

31 Jul 2025

Original amount 5,365,007 SGD, converted at the ECB reference rate of 31 Jul 2025.

Checked against the official source on 4 Oct 2026 · Direct link

In 2024 the freight forwarder Ayzo Pte Ltd misused the Unique Entity Numbers of two other companies in applications for export permits for cigarette shipments to Australia that were described as other goods in the shipping documents, and failed to retain the bills of lading. Ayzo had relied solely on information from an unknown client in India without verifying it with the named importers and exporters. After the company pleaded guilty to ten charges under the Customs Act for incorrect UEN declarations and three charges for failure to retain trade documents, the State Courts imposed a fine of SGD 36,000 on 30 July 2025.

Authority / court

Singapore Customs; Verurteilung durch die State Courts

Area of law

Sanctions and export control · Customs

Legal basis

Customs Act (unrichtige Angabe der Unique Entity Number); drei weitere Anklagepunkte wegen fehlender Aufbewahrung von Handelsdokumenten (Vorschrift in der Mitteilung nicht genannt)

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Published

19 Aug 2025

Original amount 36,000 SGD, converted at the ECB reference rate of 30 Jul 2025.

Checked against the official source on 4 Oct 2026 · Direct link

Following inspections of institutions linked to persons of interest (POIs) in the major money laundering case of August 2023, the Monetary Authority of Singapore (MAS, Singapore's central bank and financial regulator) allegedly imposed composition penalties totalling SGD 27.45 million because existing AML/CFT policies had been implemented poorly or inconsistently – in customer risk assessment, corroboration of source of wealth, transaction monitoring and follow-up after suspicious transaction reports. Breakdown: Credit Suisse Singapore Branch SGD 5.8m, United Overseas Bank SGD 5.6m, UBS AG Singapore Branch SGD 3m, UOB Kay Hian SGD 2.85m, Citibank N.A. Singapore and Citibank Singapore Limited together SGD 2.6m, Bank Julius Baer & Co. Ltd. Singapore Branch SGD 2.4m, Blue Ocean Invest SGD 2.4m, Trident Trust Company (Singapore) SGD 1.8m and LGT Bank (Singapore) SGD 1m. The penalty for Credit Suisse also reflects breaches between November 2017 and October 2023 relating to accounts of certain US customers. The amount and the facts have not been confirmed against the primary source.

Authority / court

Monetary Authority of Singapore (MAS)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

MAS Notices 626, 1014, SFA04-N02 und TCA-N03; s 27B(2) Monetary Authority of Singapore Act 1970 bzw. s 16(4) Financial Services and Markets Act 2022; Composition nach s 176(1A) MAS Act 1970 bzw. s 177(1) FSMA 2022

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Liability of senior managers

Measures against individuals are not set out here.

Published

4 Jul 2025

Original amount 27,450,000 SGD, converted at the ECB reference rate of 4 Jul 2025.

Checked against the official source on 4 Oct 2026 · Direct link

The SaaS provider operates a system for licensed moneylenders that is linked to the Moneylenders Credit Bureau and into which its clients enter data on loan applicants and borrowers; in June 2024 an attacker used a vulnerable web application to take over the SQL server's system administrator account, which was protected only by an easily guessed password, deleted databases and exfiltrated data on 190,589 individuals including credit report data, which was offered for sale on the dark web. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found a breach of the Protection Obligation (inadequate access control, no vulnerability assessments or penetration tests) and, given the company's role as a provider processing client data entrusted to it, considered a fine of 17,500 SGD appropriate; it rejected the request for a waiver or reduction. In addition, the company must obtain the Cyber Trust mark certification of the Cyber Security Agency of Singapore (CSA) for its new network within nine months.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data processors

Legal basis

Section 24(a) PDPA 2012 (Protection Obligation); Section 48J PDPA (Financial Penalty); Section 48I PDPA (Directions)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

no

Mitigating circumstances

Cooperation, admission under the Expedited Decision Procedure and first breach of the PDPA.

Published

3 Jul 2025

Original amount 17,500 SGD, converted at the ECB reference rate of 3 Jul 2025.

Checked against the official source on 4 Oct 2026 · Direct link

In examinations of five licensed payment institutions providing cross-border money transfers, the Monetary Authority of Singapore (MAS, Singapore's central bank and financial regulator) found failings in customer due diligence, such as missing residential addresses, no inquiry into beneficial owners, no screening of customers against money laundering risk information sources, unverified authority of persons acting for customers and missing originator or beneficiary information on cross-border wire transfers. On 27 June 2025 it allegedly imposed composition penalties totalling 960,000 SGD: Remsea 280,000, Arcade Plaza Traders 260,000, J-Dee Remittance Services 170,000, Mobile Community Tech 140,000 and OxPay SG 110,000 SGD. The amount and the facts have not been confirmed against the primary source.

Authority / court

Monetary Authority of Singapore (MAS)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

MAS Notice PSN01; s 27B(2) Monetary Authority of Singapore Act bzw. s 16(4) Financial Services and Markets Act 2022; Composition nach s 176(1A) MAS Act 1970 bzw. s 177(1) FSMA 2022

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

27 Jun 2025

Original amount 960,000 SGD, converted at the ECB reference rate of 27 Jun 2025.

Checked against the official source on 4 Oct 2026 · Direct link

The jeweller applied a patch released in February 2022 for a known vulnerability (CVE-2022-24086) in the Magento platform of its online shop only in January 2023; through the gap an attacker extracted the customer database with data on 41,379 individuals and posted it on an online forum in May 2023. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found a negligent breach of the Protection Obligation because the company relied entirely on its maintenance vendor for patching without directing or monitoring it, and rejected the argument that the vendor had been a data intermediary. Alongside 58,000 SGD (provisionally 64,000 SGD; the finding on credentials stored in plain text was dropped after representations) it directed an external security audit of access controls and the remediation of any gaps.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Section 24 PDPA 2012 (Protection Obligation); Section 48J PDPA (Financial Penalty); Section 48I PDPA (Directions)

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

negligent

Mitigating circumstances

Prompt remediation once the incident was known, admission under the Expedited Decision Procedure and cooperation.

Published

8 Jan 2026

Original amount 58,000 SGD, converted at the ECB reference rate of 20 Jun 2025.

Checked against the official source on 4 Oct 2026 · Direct link

The Competition and Consumer Commission of Singapore (CCCS, competition and consumer protection authority) found that Hunan Fengtian Construction Group had prepared the tender documents and prices of Trust-Build Engineering & Construction for three 2022 tenders of the People's Association (works at three community clubs, total value around SGD 56 million), so that the two did not bid independently; the People's Association noticed the possible collusion, reported it and excluded both bidders from the evaluation. Under section 34 of the Competition Act 2004, CCCS imposed financial penalties of SGD 4,295,059 on Trust-Build and SGD 349,350 on Hunan Fengtian, totalling SGD 4,644,409.

Authority / court

Competition and Consumer Commission of Singapore (CCCS)

Area of law

Competition law · Cartels and collusion

Legal basis

Section 34 Competition Act 2004; Geldbuße nach s 69(2)(e) Competition Act 2004

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Published

23 May 2025

Original amount 4,644,409 SGD, converted at the ECB reference rate of 23 May 2025.

Checked against the official source on 4 Oct 2026 · Direct link

A person involved in a traffic accident next to the condominium requested access to the CCTV footage in April 2024; the security company could not save it for lack of administrator access, the system overwrote it after 17 days, and the management corporation then refused the request, citing other individuals' data and strata management law. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) held that a blanket refusal was not justified (other individuals could have been masked) but, as the footage no longer existed, made no finding on the access obligation, and found a negligent breach of the Accountability Obligation: no data protection officer, no data protection policy of its own (only the managing agent's) and no instructions to the managing agent and security company on handling access requests. It directed the corporation to introduce, within 60 days, policies and a procedure for access requests concerning CCTV footage and to pass them on to the managing agent and contractors.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Sections 11(3) und 12 PDPA 2012 (Accountability Obligation); geprüft auch Sections 21 und 22A PDPA (Auskunft, Aufbewahrung bei Ablehnung)

Action

Order

Status of proceedings

unknown

Sector

Construction and real estate

Culpability

negligent

Mitigating circumstances

The management corporation appointed a data protection officer after the incident.

Published

7 Aug 2025

Checked against the official source on 4 Oct 2026 · Direct link

The provider of point-of-sale and CRM software for small and medium-sized enterprises reported two attacks in 2024 in which perpetrators used SQL injection, among other methods, to extract files with data on a total of 698,112 individuals, including health information (skin conditions and treatments) of 9,122 individuals; the data was likely posted on a hacking forum. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) stressed that the SaaS provider holds large volumes of data on behalf of its clients and found a breach of the Protection Obligation: publicly accessible servers, no network firewall, no security testing before releases, unsupported operating system and PHP versions, and credentials left unprotected in source code and configuration files. Alongside 17,500 SGD it directed a package of measures ranging from network segmentation and patch management to vulnerability assessments and penetration tests at least once a year.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data processors

Legal basis

Section 24(a) PDPA 2012 (Protection Obligation)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

no

Mitigating circumstances

Cooperation, admission under the Expedited Decision Procedure and first breach of the PDPA.

Published

8 Jan 2026

Original amount 17,500 SGD, converted at the ECB reference rate of 7 Apr 2025.

Checked against the official source on 4 Oct 2026 · Direct link

From August 2016 to August 2021, Flex Connect (formerly Facility Link) and Tarkus Interiors colluded on twelve tenders for interior fit-out works in shops, food and beverage outlets and offices worth around 34.11 million SGD in total: the designated winner gave the other firm its prices and details so that it would submit a higher cover bid. On 20 December 2024 the Competition and Consumer Commission of Singapore (CCCS) imposed penalties of 5,113,918 SGD on Tarkus and 4,885,263 SGD on Flex Connect, totalling 9,999,181 SGD (the CCCS itself states the total as 9,999,182 SGD); Flex Connect received a leniency discount.

Authority / court

Competition and Consumer Commission of Singapore (CCCS)

Area of law

Competition law · Cartels and collusion

Legal basis

Competition Act 2004, s 34

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Mitigating circumstances

Leniency discount for Flex Connect.

Published

20 Dec 2024

Original amount 9,999,181 SGD, converted at the ECB reference rate of 20 Dec 2024.

Checked against the official source on 4 Oct 2026 · Direct link

Relationship managers at JPMorgan Chase Bank, N.A. misrepresented or incompletely disclosed price components in 24 over-the-counter bond transactions between November 2018 and September 2019, so that clients paid spreads above those agreed (in breach of s 201(c) and (d) SFA, the Securities and Futures Act). The bank admitted liability under s 236C SFA because, lacking adequate processes and controls, it had neither prevented nor detected the misconduct; it allegedly paid the Monetary Authority of Singapore (MAS, Singapore's central bank and financial regulator) a civil penalty of SGD 2.4 million and refunded the overcharged fees to clients. The amount and the facts have not been confirmed against the primary source.

Authority / court

Monetary Authority of Singapore (MAS)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

ss 201(c), 201(d), 232 und 236C Securities and Futures Act (SFA)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Employees

10,000 or more

Culpability

negligent

Published

2 Dec 2024

Original amount 2,400,000 SGD, converted at the ECB reference rate of 2 Dec 2024.

Checked against the official source on 4 Oct 2026 · Direct link

During a cloud migration in 2020 and a restructuring in 2022, the company failed to have data on employees, former employees, directors and shareholders deleted from a shared server belonging to the subsidiary; in September 2022 an attacker gained access to that server through the compromised account of one of the former subsidiary's vendors. Numerous individuals were put at risk, and data on some of them – in some cases images of identity documents, signatures, bank accounts and salaries – may have been exfiltrated. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) treated the failure to delete for more than two years, without clear instructions to or supervision of staff, as a negligent breach of the Protection Obligation and, in view of the duration, the type of data and deterrence, imposed 120,000 SGD; it accepted a voluntary undertaking from the former subsidiary.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Section 24 PDPA 2012 (Protection Obligation); Section 48J PDPA (Financial Penalty)

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Culpability

negligent

Mitigating circumstances

Prompt action once alerted to the incident, admission under the Expedited Decision Procedure and cooperation.

Published

2 Aug 2024

Original amount 120,000 SGD, converted at the ECB reference rate of 14 May 2024.

Checked against the official source on 7 Oct 2026 · Company name anonymised since 14 May 2026 · Direct link

Using a compromised user account, an attacker gained remote desktop access to servers of the payroll service provider between December 2022 and January 2023 and exfiltrated data; data on employees of one client, including name, identity number, bank account and salary, appeared on a leak site. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found a breach of the Protection Obligation because the sensitive data was stored on unsecured internal drives, staff had local administrator rights and there was no multi-factor authentication. Given the company's role as a payroll provider and the type of data, it considered a fine appropriate and set it at 4,000 SGD.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Employee data

Legal basis

Section 24 PDPA 2012 (Protection Obligation); Section 48J PDPA (Financial Penalty)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

no

Mitigating circumstances

Cooperation, admission under the Expedited Decision Procedure and first breach of the PDPA.

Published

22 Apr 2024

Original amount 4,000 SGD, converted at the ECB reference rate of 22 Apr 2024.

Checked against the official source on 7 Oct 2026 · Company name anonymised since 22 Apr 2026 · Direct link

Relationship managers at the Singapore branch gave clients false or incomplete post-trade disclosures on 39 over-the-counter bond transactions, so that the clients paid spreads above the agreed rates. On 28 December 2023 the Monetary Authority of Singapore (MAS, Singapore's central bank and financial regulator) imposed a civil penalty of 3.9 million SGD on the bank because it lacked adequate controls, such as post-trade monitoring, to prevent or detect the misconduct. The bank admitted liability, paid immediately and separately compensated the affected clients.

Authority / court

Monetary Authority of Singapore (MAS)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Securities and Futures Act 2001, s 236C i. V. m. ss 201(c), 201(d); Civil Penalty nach s 232 SFA

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Employees

10,000 or more

Culpability

negligent

Mitigating circumstances

Liability admitted, penalty paid immediately, affected clients compensated and internal controls strengthened.

Published

28 Dec 2023

Original amount 3,900,000 SGD, converted at the ECB reference rate of 28 Dec 2023.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 28 Dec 2025 · Direct link

At the online marketplace, a software bug in 2022 appended users' email addresses and names to chat messages sent to listing owners, and a faulty application programming interface allowed an attacker to scrape non-public user data; an individual then offered data of numerous marketplace users for sale on an online forum. On 28 December 2023 the Personal Data Protection Commission (PDPC, Singapore's data protection authority) found a negligent breach of the Protection Obligation because pre-launch testing was too narrowly scoped and functional and technical specifications were inadequately documented. It imposed 58,000 SGD and directed the marketplace to review its testing procedures and documentation and close any gaps.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Data Protection Act 2012, s 24 (Protection Obligation); Geldbuße nach s 48J PDPA ([2023] SGPDPC 13)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Culpability

negligent

Repeat case

no

Mitigating circumstances

Cooperation, prompt and effective remediation, no previous breaches and an early admission under the expedited procedure; the attacker was particularly sophisticated in evading the existing security measures.

Published

22 Feb 2024

Original amount 58,000 SGD, converted at the ECB reference rate of 28 Dec 2023.

Checked against the official source on 7 Oct 2026 · Company name anonymised since 28 Dec 2025 · Direct link

At the operator of an online language learning platform for children, an attacker used a brute force attack in April 2022 to guess the password of an administrator account, weak and unchanged for more than two years, and accessed data on numerous users worldwide, including students and teachers' salary and bank details. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found negligent breaches of the Protection Obligation owing to the lack of password rules and of the Accountability Obligation because no data protection officer had been designated since incorporation in 2016. It imposed 74,000 SGD and rejected the requested reduction to no more than 35,000 SGD; no directions were issued because remediation had been carried out.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Section 24 PDPA 2012 (Protection Obligation); Section 11(3) PDPA (Accountability Obligation); Section 48J PDPA (Financial Penalty)

Action

Fine

Status of proceedings

unknown

Sector

Other

Culpability

negligent

Mitigating circumstances

No evidence of exfiltration or misuse, prompt remediation including notification of users, voluntary admission and cooperation.

Published

21 Mar 2024

Original amount 74,000 SGD, converted at the ECB reference rate of 24 Oct 2023.

Checked against the official source on 7 Oct 2026 · Company name anonymised since 24 Oct 2025 · Direct link

In June 2022 the leasing and hire-purchase provider discovered that ransomware had encrypted seven servers and six employee computers holding data of numerous individuals (customers, guarantors and employees), including identity, income and bank details. On 4 September 2023 the Personal Data Protection Commission (PDPC, Singapore's data protection authority) found a breach of the Protection Obligation because a patch for the exploited vulnerability in its VPN device had been available for two years and nine months without being installed and administrator accounts had no multi-factor authentication, and imposed 82,000 SGD.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Data Protection Act 2012, s 24 (Protection Obligation); s 48J PDPA ([2023] SGPDPC 9)

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Mitigating circumstances

Cooperation, prompt remediation and voluntary acceptance of responsibility under the expedited procedure.

Published

10 Nov 2023

Original amount 82,000 SGD, converted at the ECB reference rate of 4 Sep 2023.

Checked against the official source on 7 Oct 2026 · Company name anonymised since 4 Sep 2025 · Direct link

In examinations following the irregularities in the financial statements of a German payment services provider, the Monetary Authority of Singapore (MAS, Singapore's central bank and financial regulator) found inadequate anti-money laundering controls at four institutions in dealings with persons who had transactions with, or links to, the payment services provider or its related parties: beneficial owners wrongly identified or not questioned, source of wealth not corroborated and unusually large transactions not examined. It imposed composition penalties totalling 3.8 million SGD: bank A 2.6 million, bank B 600,000, bank C 400,000 and the insurer 200,000 SGD; all institutions accepted. MAS found no wilful misconduct by staff.

Authority / court

Monetary Authority of Singapore (MAS)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

MAS Notice 626 (Banken) und MAS Notice 314 (Lebensversicherer); s 27B(2) Monetary Authority of Singapore Act; Composition nach s 176(1A) MAS Act 1970

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

No wilful misconduct by staff; prompt remediation through improved procedures and training to raise staff vigilance.

Published

21 Jun 2023

Original amount 3,800,000 SGD, converted at the ECB reference rate of 21 Jun 2023.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 21 Jun 2025 · Direct link

The healthcare provider had outsourced call centre and appointment booking services to a social enterprise, which copied customer data for its call centre agents onto an internet-facing file server whose password protection had been disabled for around 20 months; in 2021 data on numerous customers (including diagnosis codes and bank details) was accessed without authorisation and offered for sale on the dark web. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found shortcomings in security reviews and password management at the data intermediary, the social enterprise, and at the healthcare provider inadequate ongoing oversight of the service provider and unnecessary disclosure of sensitive financial and health data. It imposed 68,000 SGD on the two together and directed both to review contracts, data sharing and the scope of security reviews.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data processors

Legal basis

Section 24 PDPA 2012 (Protection Obligation) i. V. m. Sections 4(2) und 4(3) PDPA (Data Intermediary); Section 48J PDPA (Financial Penalty); Section 48I PDPA (Directions)

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Mitigating circumstances

Both cooperated, admitted the breaches under the Expedited Decision Procedure and remedied promptly; in setting the amounts, the healthcare provider's turnover of around 50 times that of the social enterprise was taken into account.

Published

22 Jun 2023

Original amount 68,000 SGD, converted at the ECB reference rate of 23 Mar 2023.

Checked against the official source on 7 Oct 2026 · Company name anonymised since 23 Mar 2025 · Direct link

In 2017 four warehouse operators at a Singapore logistics park coordinated the introduction of an identically named 'FTZ Surcharge' of 6 SGD per freight unit on import cargo instead of setting their prices independently. On 17 November 2022 the Competition and Consumer Commission of Singapore (CCCS) imposed penalties totalling 2,799,138 SGD: operator A 1,436,378, operator B 542,520, operator C 522,889 and operator D 297,351 SGD, the latter after a leniency discount. The Competition Appeal Board allowed the appeal of operators C and A on 16 July 2025; on 30 June 2026 the High Court, on the authority's appeal, reinstated the finding that the two had infringed the law, but the authority has not stated whether their penalties again apply in full.

Authority / court

Competition and Consumer Commission of Singapore (CCCS)

Area of law

Competition law · Cartels and collusion

Legal basis

Competition Act 2004, s 34

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Mitigating circumstances

Leniency discount for operator D, which applied during the inspections.

Published

17 Nov 2022

Original amount 2,799,138 SGD, converted at the ECB reference rate of 17 Nov 2022.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 17 Nov 2024 · Direct link

In 2020 an attacker took over the code-hosting account of an employee of the online grocery platform found a high-privilege access key in the source code and another in the cloud, and thereby reached a database holding data of numerous customers and sellers, which was then offered for sale on an online forum. On 28 October 2022 the Personal Data Protection Commission (PDPC, Singapore's data protection authority) found a breach of the Protection Obligation because the keys were manifestly inadequately secured and the database had no separate authentication, and imposed 72,000 SGD; it rejected objections to the amount.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Data Protection Act 2012, s 24 (Protection Obligation); s 48J PDPA ([2022] SGPDPC 8)

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Repeat case

no

Mitigating circumstances

Cooperation, partial redaction of stored credit card numbers, prompt effective remediation and the late but voluntary acceptance of the findings.

Published

19 Dec 2022

Original amount 72,000 SGD, converted at the ECB reference rate of 28 Oct 2022.

Checked against the official source on 7 Oct 2026 · Company name anonymised since 28 Oct 2024 · Direct link

After two contractors of the platform operator's foreign parent company extracted customer data from its systems in 2020 – data on numerous individuals was affected, including customers of the online retailer – the Personal Data Protection Commission (PDPC, Singapore's data protection authority) examined the transfers from Singapore abroad. The online retailer, as controller, had not obtained contractual commitments securing a standard of protection comparable to the PDPA for data transferred via its data intermediary, and the Singapore platform entity lacked binding contracts or binding corporate rules for passing its own platform data to the foreign parent company within the group. The PDPC directed both to put in place processes to comply with the Transfer Limitation Obligation – the platform entity within 60 days, the online retailer as an SME within six months – and pointed to the ASEAN Model Contractual Clauses.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · International data transfers

Legal basis

Section 26(1) PDPA 2012 (Transfer Limitation Obligation) i. V. m. Regulations 9(1)(b) und 10(1) Personal Data Protection Regulations 2014; Section 4(3) PDPA; Section 48I PDPA (Directions)

Action

Order

Status of proceedings

unknown

Sector

Retail and e-commerce

Mitigating circumstances

According to the PDPC, both companies were highly cooperative.

Published

18 Nov 2022

Checked against the official source on 7 Oct 2026 · Company name anonymised since 6 Oct 2024 · Direct link