Acra to restore Bizfile search function, restrict access to full NRIC numbers to paying users

From the week of Dec 23, people will once again be able to find basic information on individuals registered with the Accounting and Corporate Regulatory Authority (Acra).

They can continue to pay $33 to access full NRIC numbers on the Bizfile portal, Singapore’s online business information retrieval system.

These changes were announced by Minister in the Prime Minister’s Office and Second Minister for Finance Indranee Rajah during a press conference on Dec 19. Minister for Digital Development and Information Josephine Teo and Acra chief executive Chia-Tern Huey Min were also present.

The press conference followed a public outcry over Acra’s Dec 9 decision to make NRIC numbers searchable on Bizfile for free, without requiring users to first register.

The search function, which allows users to look up information about a company’s directors and public representatives, was disabled on Dec 13.

Ms Indranee said the People Search function will be restored as it is required to support business needs.

“The search results will not show any NRIC number, masked or unmasked,” she added.

Instead, those who search for a name like “Emily” might be shown a list of people in Acra’s database with matching names – such as Emily Tan, Emily Lee or Emily Pereira.

People who want more information about specific individuals, including their full NRIC numbers and business links, will need to pay a fee, said Ms Indranee.

This had been the practice before Dec 9.

This service is in line with Singapore’s laws and Acra’s role as the national business register, Ms Indranee said.

“This change will make it less convenient for some users of Bizfile because they may not be able to so readily identify the specific individual they are looking for from the search function,” Ms Indranee said.

“But after assessing the situation, we believe it is the right balance to strike between corporate transparency and public concerns regarding personal information.”

The minister gave examples of legitimate needs that Bizfile’s search function supports, such as enabling due diligence checks.

Lawyers and accountants do not rely solely on their clients’ claims, but use Bizfile to verify their clients’ roles in business entities – for instance, their shareholding and related companies they are involved in.

Companies negotiating contracts with one another also need to perform checks on directors before committing to deals.

“When the names of owners, directors and key position holders of companies are publicly known, this helps to ensure accountability and could deter individuals from engaging in illegal activities,” Ms Indranee said.

The minister emphasised that Acra does not have every citizen’s information.

“This is the Acra database... and not the Registry of Births and Deaths,” she said.

“This is not the registry of all Singaporeans.

“This is the register of businesses and the people who transact with Acra.”

Ms Indranee was asked why the Government decided against reverting to the previous practice of having searches reveal masked NRIC numbers on the Bizfile site.

She replied: “Given that one of the concerns is that partial NRIC gives a false sense of security... and given the public concerns in the wake of this incident, we felt it would be better not to show either partial or full for the present time.”

The authorities are studying how to make it easier for people to find Bizfile information they are looking for, Ms Indranee added.

The Ministry of Digital Development and Information (MDDI) had earlier said that public agencies are phasing out the use of masked NRIC numbers to avoid a “false sense of security”.

This is because full NRIC numbers can be guessed at using basic algorithms, it said.

Privacy concerns formed the core of public backlash over Acra’s Dec 9 move to make NRIC numbers publicly available.

Some of The Straits Times’ readers highlighted recent scams, including what happened to a holidaying couple whose bank accounts were blocked and credit cards cancelled by impersonators believed to have used the couple’s NRIC numbers or other personal details.

On Dec 19, the authorities said the newly launched Bizfile feature was caused by a miscommunication between Acra and MDDI.

MDDI had at some point in 2024 informed public agencies in an internal message of plans to move away from using masked NRIC numbers.

This instruction led to confusion at Acra, which in December mistakenly made public the full NRIC numbers of registered individuals as a result.

Explaining the Government’s approach to NRIC numbers, Mrs Teo said they should be used only to identify individuals, but not as a means of authentication.

NRIC numbers have always been meant as a unique identifier and cannot be a secret, just as people’s names are not a secret, said Mrs Teo.

“However, over time, NRIC numbers have increasingly come to be used as more than an identifier,” she added.

She noted that some organisations rely on NRIC numbers to prove that a person is who they claim to be, in order to access privileged information or services like freezing bank accounts.

Organisations that still rely on NRIC numbers as proof that a person is who they claim to be should use alternative authenticators as soon as possible.

Ms Indranee said the authorities will monitor the public’s use of Bizfile and update the site accordingly.

“We are thoroughly reviewing the incident to identify areas where we should have done and can do better, including the communication and coordination between agencies, and the features of our digital services.”

She apologised for the incident and said the Finance Ministry and Acra will learn from the episode, adding: “We do not take this incident lightly.”

Source: Straits Times © SPH Media Limited. Permission required for reproduction.

Misunderstanding of internal govt circular led to unmasking of NRIC numbers on Bizfile: Acra