Skip to content

Digital Infrastructure Bill: What Singapore's New Data Centre Rules Mean for Your Banking Apps and REITs

Picture of The Financial Coconut
Follow The Financial Coconut

 

Singapore's Digital Infrastructure Bill, passed by Parliament on 7 October 2026, requires major data centres and cloud providers to hold a licence, plan for outages and report incidents to IMDA, or face fines of up to S$1 million or 10% of Singapore turnover. It targets the kind of failure that disrupted banking apps for over 12 hours in 2023.

TL;DR

  • Two new IMDA licences: one for security and resilience, one for energy efficiency.
  • The law does not make outages impossible. It makes big operators answerable for them.
  • REIT investors should watch who pays for upgrades: the landlord or the tenant.
  • Singapore's first biological data centre is a 20-unit research rack, not a fix for the power crunch yet.

What is the Digital Infrastructure Bill?

Until now, Singapore's data centres and cloud providers followed advisory guidelines. The Bill turns those into enforceable baselines through two licensing regimes run by IMDA:

  • Security and resilience: co-location and cloud data centres with a critical IT load of at least 10MW, plus cloud providers earning at least S$100 million a year on average from Singapore users over three years. They must manage security risks, keep business continuity and disaster recovery plans, and report incidents.
  • Sustainability: every data centre of at least 3MW, new or existing, must meet energy-efficiency requirements. The first is power usage effectiveness (PUE), a measure of how much of a facility's electricity actually reaches its computing equipment.

Singapore has about 70 data centres, and The Straits Times reported that about two-thirds are expected to need licences.

Will it stop my banking app from going down?

Not entirely. MDDI's own case for the law is an October 2023 cooling failure at a single Singapore data centre. It disrupted online banking and payment services at major banks for more than 12 hours, causing over 810,000 failed access attempts and 2.5 million failed payment and ATM transactions.

That was not a hack. It was a cooling problem. The Cybersecurity Act already covers cyber threats, and this Bill extends the rules to power, cooling, fire and other physical failures.

What changes is accountability: IMDA can require operators to notify affected users of specified cybersecurity threats or incidents.

None of this is immediate. Existing operators get six months to apply once the provisions take effect. The Straits Times reported that licences are expected by mid-2027, with detailed standards finalised from 2027.

So a second account with a different bank and a little cash at home remain cheap insurance for the day PayNow does not load.

What does it mean for data centre REIT investors?

Costs could rise. The PUE requirement has not been set, but capacity awarded in July 2023 came with a requirement of 1.3, according to The Straits Times. Older facilities that fall short may need upgrades. Who pays depends on the lease. In a co-location facility, the landlord runs the building. In a shell-and-core lease, the tenant typically fits out and operates it. Keppel DC REIT's S$5 billion portfolio holds a mix of lease types across several countries, so only its Singapore assets are directly affected.

Scarcity gets formalised. Singapore hosts more than 1.6 gigawatts of data centre capacity. Under the Bill, the green energy and economic commitments operators make to win new capacity become enforceable licence conditions. Scarce licensed capacity can support rents, though that is a possibility, not a promise.

Either way, the question for income investors is the one we asked of Singapore dividend stocks after Q2 2026 earnings: did the payout actually grow, or just the story?

  
Photo source: Antaranews, CL1 biological computing system during a live demonstration at the launch event.

Is Singapore's first biological data centre the answer to the power crunch?

Not yet. On 17 August 2026, DayOne, Cortical Labs and NUS Medicine launched Singapore's first Biological Data Center Prototype. It is a single rack of 20 CL1 units at NUS that computes with living human neurons, grown from stem cells and connected to silicon hardware.

DayOne says such systems can perform certain computing tasks on a fraction of the wattage of digital computers.

But this is a research deployment aimed at areas such as drug discovery and neurological disease research. The Next Web reported that the neurons stay viable for only up to six months. A scale-up to as many as 1,000 units in a DayOne facility is being explored, subject to technical validation and regulatory approvals.

It is the same gap between headline and ground reality we found when asking whether AI skills actually pay more in Singapore. Read it as a signal of where regulation is pushing the industry rather than as an investable theme today.

In summary

The Digital Infrastructure Bill will not end outages, but it puts a price on being unprepared for them. As a consumer, keep a backup way to pay. As an investor, watch where the PUE requirement lands and who foots the upgrade bill.

For more breakdowns of how policy reaches your wallet, follow The Financial Coconut Podcast and join the community at linkin.bio/thefinancialcoconut.

This article is for general education and is not financial advice.

FAQ

1. When does the Digital Infrastructure Bill take effect? Parliament passed the Bill on 7 October 2026. Existing operators will have six months from the date the relevant provisions take effect to apply for a licence. The Straits Times reported that major operators are expected to be licensed by mid-2027.

2. Which data centres need a licence in Singapore? Co-location and cloud data centres with a critical IT load of at least 10MW need a security and resilience licence, as do cloud providers with at least S$100 million in average annual revenue from Singapore users over three years. Every data centre of at least 3MW needs a licence with energy-efficiency requirements.

3. What is the penalty for breaching the new data centre rules? Breaches of certain requirements can draw a fine of up to S$1 million or 10% of the operator's annual Singapore turnover, whichever is higher.

4. What is a biological data centre? It is a computing facility that uses living neurons grown from stem cells, connected to silicon hardware, to process information. Singapore's first prototype, launched on 17 August 2026 at NUS, is a 20-unit research rack.

Reference

Let us know what you think about this topic, and what do you want to hear next.
, , , ,

Let us know what you think of this post