Safeguards to Prevent Misuse of Banking Customers' Personal Data Given New Advisory on Full NRIC Number
Ministry of FinanceSpeakers
Summary
This question concerns the implementation of safeguards to prevent the misuse of personal data and identity theft in banking following updated advisory guidelines on the use of National Registration Identity Card (NRIC) numbers. Mr Don Wee and Miss Rachel Ong enquired about enhanced authentication requirements and specific regulations the Monetary Authority of Singapore (MAS) would introduce to address public concerns regarding cybersecurity threats. Deputy Prime Minister and Minister for Trade and Industry Gan Kim Yong replied that banks are reviewing their practices to ensure alignment with Personal Data Protection Commission guidelines and have confirmed that NRIC numbers alone cannot trigger fund transfers. He explained that MAS will collaborate with financial institutions to adjust practices as revised guidelines are issued, following the government's new policy intent announced in January 2025. Furthermore, financial institutions will persist in educating customers on good cyber hygiene to mitigate the risks associated with identity theft and evolving digital threats.
Transcript
1 Mr Don Wee asked the Prime Minister and Minister for Finance (a) what safeguards and regulations will MAS be implementing in order to address public concerns about the potential misuse of personal data, including NRIC numbers, under the Personal Data Protection Commission's advisory guidelines to be updated to align with the Government's new policy intent; and (b) what steps will be taken to reassure banking clients that the risk of thefts of identities will be eliminated, particularly in light of increasing cybersecurity threats.
2 Miss Rachel Ong asked the Prime Minister and Minister for Finance (a) whether banks and financial institutions will be required to enhance account authentication requirements for access to services and information, beyond requesting for NRIC numbers, phone numbers or full names; and (b) if so, how will the roll-out be timed with the discontinuation of the use of masked NRIC numbers within the Government.
Mr Gan Kim Yong (for the Prime Minister): The Association of Banks in Singapore has recently assured consumer banking customers that the National Registration Identity Card (NRIC) numbers alone cannot be used to effect payment and fund transfers. Banks are also conducting a thorough review of their practices on the use of NRIC numbers to confirm that their practices are in line with the prevailing Personal Data Protection Commission's Advisory Guidelines on NRIC.
The Ministry of Digital Development and Information has announced that the Personal Data Protection Commission will be updating its Advisory Guidelines on the use of NRIC numbers, following public and industry consultations. This has been addressed in the Ministerial Statement on 8 January 2025. [Please refer to "Responsible Use of NRIC Numbers", Official Report, 8 January 2025, Vol 95, Issue 149, Ministerial Statements section.]
The Monetary Authority of Singapore will work with financial institutions to align practices where needed when the revised guidelines are issued. Financial institutions will continue to educate their customers on good cyber hygiene habits and guard against identity theft.