Apply for Licence

Under the Cybersecurity Act and Cybersecurity (Cybersecurity Service Providers) Regulations, the following groups of persons are required to obtain a cybersecurity service provider’s (“CSP”) licence:

• those who engages in the business of providing any of the following licensable cybersecurity service (“LCS”) to other person is required to obtain a cybersecurity service provider’s (“CSP”) licence.

• those who is in the business of providing a LCS, is required to obtain a licence before advertising their LCS.

At A Glance

Note:

1. All providers of LCS, regardless of whether they are companies or individuals who are engaged for such services, are required to obtain a licence, except for companies that provide LCS solely to their related companies or in-house consumers of LCS.
2. Providers who offer or intend to offer both LCS are required to submit separate licence applications and obtain a licence for each LCS.
3. With effect from the launch of licensing framework on 11 April 2022, all providers who are engaged in the business of providing LCS, have until 11 October 2022 to apply for a licence. Providers who have submitted their licence application to CSRO between 11 April 2022 and 11 October 2022, may continue to engage in the business of providing LCS until a decision is made on their licence application. In the event that the application for a licence is refused, the provider would not be allowed to engage or continue to engage in the business of providing the LCS. Any providers providing the LCS after 11 October 2022, without having lodged an application for a licence for the LCS they engage in, will be deemed to be operating illegally.

Submit Application

Criteria for Grant of a Licence

To be eligible for a licence, applicant is required to be fit and proper.

Fit and Proper Criteria

As stipulated in section 26(8) of the Cybersecurity Act, in deciding whether an individual or a business entity is a fit and proper person to hold or continue to hold a licence, the licensing officer may take into account any matter the licensing officer considers relevant, including any of the following:

(a) In the case of an individual —

(i) that the individual has been convicted in Singapore or elsewhere of any offence involving fraud, dishonesty or moral turpitude;

(ii) that the individual has had a judgment entered against the individual in civil proceedings that involves a finding of fraud, dishonesty or breach of fiduciary duty on the part of the individual;

(iii) that the individual is or was suffering from a mental health condition (for example, psychotic disorder, psychosis, schizophrenia, schizoaffective disorder, delusional disorder, bipolar disorder, psychotic depression, or personality disorder, etc.)^[1]

(iv) that the individual is an undischarged bankrupt or has entered into a composition with the creditors of the individual; or

(v) that the individual has had a licence revoked by the licensing officer previously.

^[1]If the mental health condition is properly managed and certified by a qualified physician or healthcare professional, the presence of a mental health condition will not affect a person’s eligibility to be licensed.

(i) that the business entity has been convicted in Singapore or elsewhere of any offence involving fraud, dishonesty or moral turpitude;

(ii) that the business entity has had a judgment entered against the business entity in civil proceedings that involves a finding of fraud, dishonesty or breach of fiduciary duty on the part of the business entity;

(iii) that any officer of the business entity is not a fit and proper person to be an officer of a business entity holding the licence;

(iv) that the business entity is in liquidation or is the subject of a winding up order, or there is a receiver appointed in relation to the business entity, or the business entity has entered into a composition or scheme of arrangement with the creditors of the business entity; or

(v) that the business entity has had a licence revoked by the licensing officer previously.

Note:

• Business entity applicant should ensure the following officers are included as officers of the business entity in the licence application:

1. Any director, partner or any other person listed in the business entity’s business profile e.g. ACRA BizFile, with the exception of shareholders (who are not directors or partners) and company secretary; and
2. Any other person who is responsible for the management of the business entity.

• Business entity applicant should specify one Key Executive Officer, which refers to the person who is responsible for the proper administration and overall management of the business entity and supervision of its employees. The remaining officers of the business entity would be termed as Key Officers in the licence application.

Online application

Application for licence is to be submitted online via GoBusiness Licensing. Do note that CorpPass or SingPass credential is required to access the system. For more information on CorpPass or SingPass, please visit www.corppass.gov.sg or www.singpass.gov.sg.

Supporting Documents Required

Applicant is required to submit the following supporting documents for each licence application via GoBusiness Licensing “Upload Supporting Documents” function (please refer to our step-by-step guide for more details).

Note:

• Supporting documents not in the English language must be submitted together with an accurate translation in the English language. The translation must be certified by the person making it to be a correct translation. The certificate must contain a statement of that person’s full name, of his address and of his qualifications for making the translation.

Guide to New Licence Application

Applicant may download this step-by-step guide which serves to guide cybersecurity service providers on the application submission process in GoBusiness Licensing.