The Cybersecurity Act 2018 overlay

Read the PDF edition (1 page)

The Cybersecurity Act 2018 established the Cyber Security Agency and a regime for critical information infrastructure, under which designated owners of systems essential to the delivery of essential services must comply with codes of practice, report incidents and undergo audits.¹ Banking and finance is an essential service sector, but the designation of critical information infrastructure is made by the Commissioner for individual systems and has not been extended to crypto exchanges. The 2024 amendments broadened the Act to cover systems of temporary cybersecurity concern, entities of special cybersecurity interest and foundational digital infrastructure such as cloud and data centre services, which touch crypto businesses indirectly through their providers.²

For a crypto platform the operative cybersecurity requirements are therefore those of MAS. The Technology Risk Management Guidelines and the Notice on Technology Risk Management set the standards and the reporting duties. The Cyber Hygiene Notice imposes baseline controls on all licensed financial institutions.³ The Computer Misuse Act 1993 supplies the criminal offences for unauthorised access and modification, which apply to hackers whether or not the victim is a designated infrastructure owner.⁴

Notes

Cybersecurity Act 2018, Part 3 (critical information infrastructure), in particular ss 7 (designation), 10 (duty to report), 14 (incident reporting) and 15 (audits). ↩
Cybersecurity (Amendment) Act 2024, passed on 7 May 2024, inserting Parts 3A to 3C into the Cybersecurity Act 2018. ↩
MAS Notice on Cyber Hygiene and MAS Technology Risk Management Guidelines (January 2021). Part L, Chapter VII treats their application to DPT licensees. ↩
Computer Misuse Act 1993, ss 3–5. Part N, Chapter I describes the offences. ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.

English

Contact

Dr Alexander Ressos, TEP

Of Counsel, KGP Legal LLC

I am Of Counsel with KGP Legal LLC in Singapore, where I work with a global client base of successful entrepreneurs and their families, independent asset managers, commodity trading houses and other commercial clients. I am a German and Swiss attorney-at-law, also admitted as a solicitor in England & Wales and in Hong Kong. I divide my time between Zug in Switzerland, Singapore and Hong Kong. Since 2017 I have advised international clients on more than 700 crypto and digital asset projects. I also have extensive experience in cross-border litigation and arbitration in Singapore, Hong Kong and other markets in South-East Asia and Greater China.

I operate across the key financial centres in South-East Asia, the Middle East and Switzerland, with a particular focus on asset protection, international tax and estate planning, as well as trusts, company administration and other fiduciary services. My philosophy is to serve as a trusted advisor working closely with my clients and to help them achieve their commercial objectives.

All Singapore law advice is provided through KGP Legal LLC, an established and duly licensed firm of Singapore advocates and solicitors.

KGP Legal LLC is a medium-sized law firm in Singapore that is capable of providing the full range of legal services and corporate administration work. Please contact me if you need any further information.

Get in touch →

Articles and Insights

Setting up or expanding in Singapore?

SingaporeIQ is edited by Dr Alexander Ressos, an international business lawyer with more than 15 years of local experience in Singapore as a permanent resident, a Singapore registered foreign lawyer and managing partner of a Singapore foreign law practice. In addition to significant experience in cross-border investments and transactions, UHNWI private client work and sanctions/export controls, Dr Ressos has extensive experience in cross-border business and in crypto and digital-asset projects in Singapore, drawn from more than 700 projects since 2017.

If you are planning a company incorporation, an investment, a holding structure or a market entry through Singapore, you can reach Dr Ressos directly at [email protected]. Singapore law advice is provided by KGP Legal LLC, a licensed firm of Singapore advocates and solicitors. Dr Ressos and his team facilitate the full range of Singapore legal, compliance and company administration services, including company incorporation, corporate transactions, commercial contracts, crypto and digital assets, financial regulatory work and dispute resolution, including litigation in the Singapore courts. For Hong Kong, our parallel site HongkongIQ.com offers the same practical guidance. For crypto and digital assets, dltreg.com covers legal, tax and fiduciary services. For legal, tax and fiduciary services in Switzerland, see helveticaregister.com.