Anti-scam duties set Singapore telecoms operations apart, and AI agents can carry much of the evidence work: sender ID exceptions, scam SMS reports, shared responsibility claim files and service fault handling. Blocking decisions, loss claim positions, number changes and complaint outcomes stay with people. IMDA's rules, the shared responsibility approach, the PDPA and the Model AI Governance Framework apply.
What fills a Singapore telecoms operations leader's week?
Scam controls. Telcos in Singapore carry specific anti-scam duties. Organisations that send SMS using an alphanumeric sender ID must register it, and messages from unregistered sender IDs are blocked or labelled. Operators also filter messages containing known malicious links and act on scam calls. Each control generates exceptions: legitimate senders blocked, new senders not yet registered, customers reporting suspicious messages.
Loss allocation. Under the shared responsibility approach for phishing scams, telcos can bear losses if they did not carry out their expected duties. When a scam is reported, operations must show what controls applied to the messages involved, when and how.
Service faults. Dense urban networks, high mobile and fibre penetration and demanding customers mean faults are noticed quickly and complaints follow fast.
Enterprise and banks. Banks and government agencies depend on SMS and voice for authentication and customer contact. They expect fast answers when messages fail.
Where can AI agents help Singapore telecoms teams?
- Sender ID exception handling (depth 2). The agent checks why a legitimate organisation's messages were blocked, compares the sender ID with the registry and drafts the resolution. A person approves any change to filtering.
- Scam SMS report triage (depth 3). The agent logs customer reports of suspicious messages, extracts links and sender details, checks them against existing blocks and routes new threats to the security team.
- Shared responsibility evidence files (depth 2). For a reported scam, the agent assembles the message records, the sender ID status, the filtering applied and the timing, and drafts the operator's evidence summary. A person signs it.
- Service fault resolution (depth 3). The agent runs remote diagnostics, applies runbook fixes and books visits only when needed.
- Enterprise message failure enquiries (depth 2). The agent traces failed messages for bank and enterprise customers and drafts the incident note.
Shared responsibility files are the most Singapore-specific use. They decide whether your operator bears part of a customer's loss, the evidence sits in systems that are hard to read by hand, and every timestamp matters. An agent that assembles them completely is worth more than one that resolves faults faster.
What stays with people, and why?
Changes to filtering, blocking and sender ID decisions stay with people. Errors block legitimate messages, such as a bank's one-time passwords, or let scams through.
The operator's position on a loss claim stays with people. It allocates money and can be disputed.
Number changes, SIM replacements and disconnections stay with trained staff.
Complaint outcomes stay with people.
Keeping the agent good over time also stays with people. Scam patterns change weekly, so an agent certified on last quarter's messages can drift; our answer on how to stop an AI agent's performance from drifting explains the checks.
Which rules apply in Singapore?
IMDA, which regulates the telecoms sector, sets licence conditions and codes covering quality of service, consumer protection, SMS sender ID registration and anti-scam measures. It also published the Model AI Governance Framework, a voluntary guide to internal governance, human involvement, operations management and stakeholder communication for AI.
The shared responsibility approach to phishing scams sets duties for financial institutions and telcos and allocates losses when duties are not met. MAS sets the duties for banks and other financial institutions, including under its Technology Risk Management Guidelines and the FEAT principles, which matters when banks ask telcos for evidence.
The Personal Data Protection Act 2012, administered by the PDPC, governs subscriber data, including message metadata where it identifies individuals. Singapore has no single AI law.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How should you start in the first 90 days?
Weeks 1 to 4: start scam SMS report triage in shadow. It is high volume, the routing rules are known, and the security team can score each case.
Weeks 5 to 8: certify triage at depth 3 and begin shared responsibility evidence files in shadow on recent cases. Agree with the fraud and legal teams what a complete file contains.
Weeks 9 to 13: add sender ID exceptions at depth 2 and service faults at depth 3. Many pilots stall at this point because nobody owns the move to production; our answer on why AI agent pilots fail lists the usual causes. Follow deploying an AI agent: train, shadow, certify, widen. For a market where consumer codes drive operations, see our brief on operations agents in Canadian telecoms.
Where Pryme fits
In Pryme, filtering logs and the sender ID registry arrive as sealed sources, a bank's report of a failed message as signed, and a customer's forwarded screenshot as external. The evidence file shows which class supports each statement. Certificates lapse after 90 days, which suits a domain where scam patterns change faster than that; every verdict is filed.
Questions people ask
Can the agent unblock a legitimate sender?
It drafts the change after checking the registry. A person approves, because a wrong change could let scam messages through.
Can the agent decide whether we owe a share of a scam loss?
No. It assembles the evidence against each duty. People decide the operator's position.
How often should the triage agent be re-certified?
At least every 90 days, and sooner when scam patterns shift. A run that clears no depth drops it to depth 1 the same day.