Singapore has issued an implementation directive to Meta under the country’s Online Criminal Harms Act (OCHA) framework, ordering the company to expand anti-impersonation protections that use facial-recognition-based signals. The directive, announced on January 29, 2026, follows earlier action focused on government-official impersonation and extends the scope to a broader set of high-risk individuals.
The move is a notable example of a regulator explicitly directing a major platform to operationalize biometric signals as part of scam prevention. Authorities have argued that impersonation scams cause measurable harm and that platforms should be required to implement and scale countermeasures when specific risk thresholds are met.
The directive targets Meta products including Facebook and Instagram, and it focuses on expanding coverage rather than introducing a wholly new technical approach. That framing signals that authorities see facial-recognition-based protections as sufficiently mature to be scaled under regulatory oversight.
Meta has already been experimenting with face matching and related approaches in some markets as part of broader efforts to reduce impersonation and fraud. Those efforts have included Meta’s face-matching expansion in the UK, EU and South Korea and earlier testing described in Meta’s facial recognition test for celebrity scam content.
Singapore’s directive also fits within a wider domestic pattern of tying biometric checks to safety-critical flows. The government has previously required additional verification for certain banking scenarios, including Singapore’s high-risk banking selfie check, which normalized facial verification for higher-risk transactions.
The directive raises practical questions for platform policy and compliance teams about how high-risk categories are defined, how coverage is measured, and what performance criteria regulators will expect. Biometric-based anti-impersonation protections typically rely on matching signals that can be noisy and constrained by consent, privacy rules, and regional regulatory regimes. At the same time, failure to expand protections can leave platforms exposed to enforcement action as governments seek to curb scam ecosystems that exploit public trust.
The episode underscores a growing shift from optional deployments to mandated uses of biometric signals in anti-fraud contexts. As more regulators treat facial verification and matching as enforceable safety controls rather than product experiments, platforms and vendors may face tighter requirements around documentation, auditability, and redress.
Sources: Tech Policy Press, Singapore Ministry of Home Affairs
–
By Cass Kennedy
