Bulletin
4notify Singapore · Government Gazette
OFFICIAL · MAS · ABS · PayNow · FAST
Bulletin No
BUL-SG-001
Date
2026-05-27
Status
In force
Category
Banking and payments

PSD2-style strong customer authentication and PayNow: OTP delivery to Singapore retail banks over Singtel, M1, StarHub and SIMBA

Whereas, in exercise of the powers conferred by the Banking Act and the Payment Services Act 2019, the Monetary Authority of Singapore (MAS) supervises the local retail banks, while the Association of Banks in Singapore (ABS) coordinates the PayNow, FAST and SGQR rails. Every login, every transfer and every digital token activation demands a strong second factor. 4notify delivers one-time passcodes with P50 under 3 seconds across Singtel, M1, StarHub and SIMBA via direct tier-1 connections — the code lands before the customer's session timer ticks down.

SMSPushEmail
Preamble

Whereas, in exercise of the powers conferred by the Banking Act (Cap. 19), the Payment Services Act 2019 and the MAS Notice on Technology Risk Management, the present Bulletin is hereby published concerning the delivery of strong customer authentication codes over the Singapore mobile networks.

Statutory basis
Banking Act (Cap. 19)

Statutory basis for the licensing and supervision of banks in Singapore by the Monetary Authority of Singapore.

Payment Services Act 2019

Framework for PayNow, FAST and other payment systems; obligation to authenticate payment initiations.

MAS Notice 644 / TRM Guidelines

Technology risk management; mandatory multi-factor authentication on customer-facing digital channels.

Implementation
01

IMDA SSIR registration plus tier-1 carrier connectivity

4notify maintains direct tier-1 interconnect with Singtel, M1, StarHub and SIMBA and is recognised by the IMDA SMS Sender ID Registry (SSIR) for authentication traffic.

02

OTP minted inside the bank HSM

The one-time code is generated inside the bank's hardware security module; 4notify only ever sees the hash and the destination MSISDN.

03

60-second window plus cascade fallback

SMS is delivered within 60 seconds; if the DLR fails, the cascade falls back to push and then email. No grey-route latency.

04

Seven-year signed audit custody

Every delivery is signed and retained for seven years, in line with MAS retention and AML/CFT requirements.

Delivery envelope
json
{
  "event": "bank.paynow.otp",
  "bank_id": "SG-XXXX",
  "transaction_id": "TX-2026-05-27-948210",
  "amount": 1850.00,
  "currency": "SGD",
  "delivery": {
    "channel": "sms",
    "fallback": ["push", "email"],
    "window_seconds": 60,
    "template": "paynow_otp_sg_v3"
  },
  "audit_signature": "https://4notify.net/sig/bank/948210"
}
Sample message
SMS

DBS: Your OTP to confirm PayNow of S$1,850 to T. Lim is 482193. Valid 5 mins. Never share this code.

Compliance checklist
  • IMDA SSIR registration for authentication Sender IDs current
  • Direct tier-1 interconnect with Singtel, M1, StarHub and SIMBA active
  • OTP P50 measured at or below 3 seconds per quarter
  • Seven-year signed audit custody documented for MAS
The 4notify difference

4notify is the only A2P provider with simultaneous IMDA-registered tier-1 Sender IDs across Singtel, M1, StarHub and SIMBA, with a seven-year signed audit trail for strong customer authentication delivery aligned to MAS TRM Guidelines and the Payment Services Act 2019.

Frequently asked questions
Does 4notify deliver direct to Singapore banks or through an aggregator?

Direct tier-1 connectivity with Singtel, M1, StarHub and SIMBA. No grey-route aggregation for authentication traffic.

Do push notifications count as a second factor under MAS rules?

Yes — an app-bound push is recognised as a possession factor. Because the device cannot guarantee a durable medium for compliance, we always pair it with SMS or email.

Published
4notify Operations Office
2026-05-27 · BUL-SG-001

Start free

14 days, no card. English support on weekdays.

Other entries in this issue