Singapore telecoms compliance teams carry anti-scam duties, Do Not Call obligations and consumer protection rules, all under IMDA licensing and the PDPA. AI agents can test scam-filtering and sender ID controls, screen marketing against Do Not Call status, and review new products before launch. People decide breaches, remediation and regulator engagement. The PDPC enforces data protection.
What do telecoms compliance teams in Singapore spend their time on?
Scams shape the agenda. Operators must block messages from unregistered sender IDs, filter scam calls and texts, and meet duties under the framework that shares scam losses between banks and telecoms operators. When a scam victim's bank looks to the operator, compliance must show that each required control was in place and worked on the day.
Do Not Call rules are the second load. Under the PDPA, organisations must check the Do Not Call registry before sending marketing messages or making calls to Singapore numbers, unless they hold clear consent. Operators market heavily, and they also carry other organisations' messages, so the subject touches them twice.
New products bring the third strand. eSIM journeys, bundled devices and services, roaming add-ons and value-added services all need review against consumer protection rules and data protection duties before launch.
Where can AI agents help?
- Scam control assurance (depth 1). For a sample of days, or a specific complaint, the agent reads filtering logs, sender ID registry checks and blocking records, and reports whether each control operated as specified. It cites the log line for each statement.
- Do Not Call screening (depth 1). Before a campaign, the agent checks the list against registry results, consent records and their dates, and reports numbers that must be removed. After sending, it samples delivered messages to confirm suppression held.
- New product review (depth 2). The agent reads the product design, customer journey, terms and data flows, and drafts a compliance risk review listing the rules that apply and the questions the product team must answer. Our answer on whether an AI agent can review a new product for compliance risk explains what the draft can and cannot settle.
- Complaint pattern analysis (depth 2). The agent groups complaints by cause, such as unexpected roaming charges or contract renewals, and drafts the root cause note for the compliance committee.
Scam control assurance shows why sources matter. Filtering logs are sealed records from the operator's own systems. A customer's screenshot of a scam message is external. The agent must keep them separate, because an external claim cannot establish what the operator's systems did. The guide to AI compliance agents explains how this keeps findings defensible.
What stays with people?
Whether the operator met its anti-scam duties in a particular case, and whether it bears any share of a loss, is a judgement for named people with legal input. The outcome affects a customer who has lost money and the operator's relationship with banks and the regulator.
Product launch approval stays human. The agent drafts the review; the compliance lead decides whether risks are acceptable and what conditions apply.
Breach notification decisions under the PDPA, responses to the PDPC and IMDA, and any action against a business customer that sends spam through the network also stay with people.
Which rules apply in Singapore?
IMDA licenses telecoms operators and sets their obligations, including consumer protection rules on contracts and charges, and anti-scam measures such as sender ID registration and blocking. Operators also have duties under the scam loss-sharing framework.
The Personal Data Protection Act 2012, administered by the PDPC, governs personal data: consent, purpose, notification, protection, retention and transfers abroad. It also contains the Do Not Call provisions. An agent that reads subscriber data must sit within the purposes the operator has notified. Critical telecoms systems are also subject to cybersecurity law protecting critical information infrastructure, which reaches agents with access to them.
For AI, IMDA's Model AI Governance Framework gives practical guidance on internal governance, the level of human involvement, operations management and communication with stakeholders. It is a natural reference for a telco. MAS rules apply only where the operator runs a regulated financial business. Our guide to how AI agents are regulated in Singapore covers the rest.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How do you start in the first 90 days?
Days 1 to 30: start with Do Not Call screening. Results are binary, the data is internal and mistakes are costly. Name the officer who owns findings and record the agent's purpose in your PDPA documentation.
Days 31 to 60: replay the agent on past campaigns, including any that generated complaints, and check it would have caught each error before the send.
Days 61 to 90: add scam control assurance, starting with sampled days rather than live complaints, so the agent's floor is proven before its output reaches a dispute. Canadian operators face similar consent rules with different law; see our brief on compliance agents in Canadian telecoms.
Questions people ask
Can an agent decide whether the operator shares a scam loss?
No. It can show which controls operated and when. The decision depends on legal interpretation and the facts of the case, and stays with people.
Does Do Not Call apply to existing customers?
Consent and the nature of the relationship matter, and the rules have specific conditions. The agent should apply your documented policy, and edge cases go to a person.
What does the Model AI Governance Framework ask of a compliance agent?
It asks you to decide the level of human involvement based on risk, to manage the agent in operation, and to be transparent. For compliance findings, that means a person reviews every output.