How Will the New Licensing Regimes Operate?
Singapore’s Parliament passed the Digital Infrastructure Bill on 7 October 2026, introducing new safeguards for data centres and cloud services that underpin essential digital services such as banking and payments. The legislation establishes two licensing regimes to enhance resilience and accountability across critical digital infrastructure. Operators of vital data centres and cloud platforms will now face stricter oversight to prevent service disruptions that could impact the economy and public trust.
Breaking news
X Money Launches with High-Yield Savings and Cashback Rewards
Splitit Announces White-Label Credit Card Launch
Billing Friction Puts $12.3 Billion in Auto Loan Payments at Risk
OneSpan Unveils New e‑Signature Features Including Identity Wallets and AI Workflow SupportThe bill responds to growing concerns over the concentration of digital services in a limited number of facilities and the potential cascading effects of outages. Under the new framework, providers must meet enhanced standards for redundancy, cybersecurity, and incident reporting. The Infocomm Media Development Authority will oversee compliance, with powers to impose penalties for non-adherence. The move aims to strengthen national digital resilience as Singapore advances its Smart Nation agenda.
What Challenges Might Providers Face in Compliance?
The first licence applies to operators of critical data centres, requiring them to maintain minimum uptime thresholds and conduct regular stress tests. The second targets cloud service providers, mandating clear service level agreements and transparent communication during incidents. Both licences include provisions for independent audits and mandatory reporting of major outages within two hours. Authorities say the dual approach ensures accountability at both the physical and service layers of digital infrastructure.
Compliance could increase operational costs, particularly for smaller providers needing to upgrade systems or hire specialised staff. Industry groups have urged the government to provide a grace period and technical guidance to ease the transition. However, officials stress that the risks of inaction—such as prolonged disruption to financial transactions or healthcare systems—far outweigh the adjustment burden. Consultations with stakeholders are ongoing to refine implementation timelines.
What services are considered critical under the bill? Critical services include digital banking, payment systems, healthcare platforms, and government digital identity systems that rely on uninterrupted data centre and cloud operations.
Frequently Asked Questions
Will foreign-owned providers be subject to the same rules? Yes, all operators of designated critical infrastructure in Singapore, regardless of ownership, must comply with the licensing requirements and oversight mechanisms.
How will outages be monitored and reported? Providers must report significant service disruptions to the Infocomm Media Development Authority within two hours and submit detailed post-incident analyses within seven days.
