High-risk payment gateway and merchant accounts in Singapore

OpenGate is operated by BTI Payments Singapore Pte. Ltd. (UEN 201304112H), registered in Singapore. The rules a Singapore online merchant meets come from these authorities.

A data breach must be notified to the PDPC when it is likely to cause significant harm or affects 500 or more people, no later than three calendar days after the organization determines it is notifiable. Since October 1, 2022, organizations with annual turnover in Singapore above S$10 million face penalties of up to 10% of that turnover.

NETS runs Singapore’s national debit scheme, opened in 1985 and owned equally by the three largest banks. PayNow, launched on July 10, 2017 for banks, sends Singapore dollars instantly over FAST using a mobile number, an identity number or a business’s UEN, and PayNow Corporate lets a company receive payments on its UEN. Merchants may not add any surcharge for PayNow, and a bank or payment provider can suspend or cancel PayNow for a merchant that does. PayNow QR and NETS QR are separate schemes for now; MAS and the banks’ association plan a pilot of QR interoperability by the end of 2026, and deep links for online checkout within a year. The SGQR label, co-owned by MAS and IMDA, shows several schemes in one code.

MAS required card issuers to introduce 3-D Secure with a one-time password from 2010, and the Association of Banks in Singapore states that a merchant not using 3-D Secure is liable for fraudulent card transactions, even when they were authorized. Issuers are moving approval into their apps: UOB, for one, stopped offering SMS codes for 3-D Secure to its app users at the end of June 2025. Under MAS’s E-Payments User Protection Guidelines, the real-time alerts banks send for outgoing payments must include the merchant’s trading name, and where possible its reference number, so a billing name that matches your site matters. The 3-D Secure guide covers the mechanics.

The regulator’s guidelines on price transparency, in force since November 1, 2020 for online and physical sellers, put every unavoidable charge, taxes, surcharges and service fees included, in the headline price; where a charge cannot be calculated in advance, its existence must be shown with the headline price. A “free” offer must state any later charges and key terms prominently. Under the Opt-Out Practices Regulations, a free trial also needs a reminder sent 3 to 14 working days before it ends, giving the end date and a way to cancel; without one, the customer can claim back what was charged.

The Commission names subscription traps, pre-ticked boxes that sneak items into the basket, false urgency, hidden costs and fake reviews among the dark patterns it pursues. We found no statute on card surcharges in Singapore: the card schemes’ rules and the acquirer contract decide, and any mandatory charge still belongs in the headline price.

The Consumer Protection (Fair Trading) Act lets consumers seek redress against unfair practices. Its Second Schedule lists, among others, accepting payment when the supplier knows or ought to know it cannot deliver in the stated or a reasonable time, hiding a material fact in small print, and a discount presented as time-limited that runs much longer. Complaints go first to CASE for residents or the Singapore Tourism Board for tourists, and persistent offenders are referred to the Commission, which seeks court injunctions; breaching one is contempt of court.

For goods bought on or after September 1, 2012, the Lemon Law lets a consumer require repair or replacement, then a price reduction or rescission, for goods that did not conform at delivery, and goods found faulty within six months are presumed faulty from the start. Singapore’s statutory cooling-off covers direct sales, timeshare and long-term holiday product contracts, not ordinary online purchases, so refunds follow your published policy.

Singapore has no subscription act, but the Opt-Out Practices Regulations require that reminder before a free trial turns paid, and treat a material change to a continuing supply as unsolicited without the buyer’s written consent. A court ordered an e-commerce retailer to stop using subscription traps in January 2020, and the Commission treats them as unfair practices; the subscription billing guide shows how to build a flow that holds up. Under the Online Criminal Harms Act, the police issued an enhanced E-Commerce Code for designated marketplaces in August 2026, building on seller verification and payment protection, with compliance due by January 31, 2027.

The GST rate has been 9% since January 1, 2024. A business registers once its taxable turnover exceeded S$1 million in a calendar year or is expected to within the next twelve months; late registration is backdated, the GST is due on past sales even if never collected, and the business may face a fine of up to S$10,000 and a penalty of 10% of the GST due. Splitting a business across entities to stay under the threshold can be disregarded.

Overseas businesses with global turnover above S$1 million that make more than S$100,000 a year of sales of remote services or low-value goods to Singapore consumers register under the overseas vendor regime. GST has applied to digital services from abroad since January 1, 2020, and to all remote services and goods worth S$400 or less since January 1, 2023. Corporate income tax is a flat 17% of chargeable income, with partial exemptions on the first S$200,000.

Card disputes run under the card schemes’ rules. The banks’ association explains that most Singapore banks ask cardholders to file a dispute within 14 days of the statement date, and that for an unauthorized card-not-present payment made without one-time-password authentication, the issuer usually charges it back to the merchant. A purchase not delivered, or received not as described or damaged, is also a ground for a chargeback once the cardholder has tried the merchant.

The loss-sharing rules of MAS’s E-Payments User Protection Guidelines and the Shared Responsibility Framework for phishing scams, in force since December 16, 2024, do not apply to Singapore-issued credit, charge and debit cards. For bank accounts and e-wallets, so PayNow and transfers, an account holder who breached none of the user duties is not liable for the first S$1,000 of a loss caused by a third party. FIDReC mediates disputes between consumers and their financial institutions and adjudicates claims up to S$150,000. Each card chargeback counts toward your chargeback ratio.

The ACRA business profile, bought on Bizfile for S$5.50, gives a company’s UEN, registration date and officers. Companies keep a register of registrable controllers and file it with ACRA’s central register, which is not public: a new company files on the day it registers, and updates are due within two business days. Since June 16, 2025, nominee directors and shareholders are disclosed to ACRA and their nominee status appears on the business profile, which ACRA says can trigger extra due diligence by anti-money laundering-obligated firms; fines reach S$25,000. Changes to company information, officers and shareholders are reported within 14 days, and from October 20, 2026 the annual return confirms that the particulars ACRA holds on directors, the chief executive, the secretary, auditors and members are accurate.

FAST has moved Singapore dollars almost immediately between banks, around the clock, since March 17, 2014, and large-value transfers settle through MEPS+, MAS’s real-time gross settlement system, since 2006. Banks stop processing corporate cheques in Singapore dollars on January 1, 2027.

1. Hiding fees until checkout. A service charge added at the last step breaks the price transparency guidelines and feeds “not as described” disputes.
2. Surcharging PayNow. It is prohibited, and the bank can suspend PayNow for the merchant.
3. Taking money for stock you cannot ship. It is a listed unfair practice, and non-delivery is a standard chargeback ground.
4. A subscription that is easy to start and hard to leave. The regulator treats subscription traps as unfair practices, and unwanted renewals come back as disputes.
5. Skipping 3-D Secure. The banks’ association says a merchant not using it is liable for card fraud.
6. A billing name customers cannot match. Bank alerts show the merchant’s trading name, and a mismatch invites “I don’t recognize this” reports.
7. Stale ACRA records, missing controllers or undeclared nominees. Filings are due within days, nominee status is public, and fines reach S$25,000.
8. Crossing S$1 million without registering for GST. Registration is backdated and the GST is due even if it was never collected.

Most of these are fixed before go-live. A business model that needs one of them to work is declined, whatever its volume.