Kenny's Thinking Garden

Helper Match SG - Compliance and Risk

4 min read

Helper Match SG - Compliance and Risk

Core Idea

The legal and regulatory landscape that Helper Match SG must navigate — EA licensing, worker protection rules, PDPA, fair hiring obligations, and payment service considerations.

State of Thinking

Employment Agency (EA) licensing

  • If the platform communicates with jobseekers to process employment, collates biodata to help placement, or facilitates contact between maids and employers, it likely requires an EA licence from MOM
  • A purely passive job board (no matching, no introductions, no messaging) may be exempt — but this significantly limits the product
  • For FDW placement specifically, the Comprehensive Licence (All) is required — the non-FDW licence explicitly excludes FDWs
  • EA personnel typically need CEI (Certificate of Employment Intermediaries) certification

Key decision for MVP: Either apply for the EA licence and run compliant operations from day one, or launch as a pure bulletin board with no matching features until licensed. There is no middle ground — MOM is explicit on the trigger points.

Fee rules and worker protection

  • Singapore EAs are capped on fees charged to workers: maximum 1 month of fixed monthly salary per year of service, capped at 2 months total
  • Refund conditions are set by EA Rules — processes need to be in place to evidence compliance
  • These rules apply even if fees are collected via an overseas agent tied to the Singapore EA

PDPA and privacy

  • Must appoint a Data Protection Officer and publish a privacy policy
  • Obligations cover: consent, purpose limitation, notification, accuracy, protection, retention, transfer
  • NRIC/FIN handling: avoid collecting or displaying full NRIC/FIN unless strictly necessary — mask and secure if collected, do not use as usernames or passwords
  • Data breach: if notifiable, inform PDPC within 3 calendar days and notify affected individuals as soon as practicable
  • If hosting data outside Singapore, the Transfer Limitation obligation applies

Fair hiring and content moderation

  • Job listings and filters must be merit-based and non-discriminatory under Tripartite Guidelines
  • Workplace Fairness Act (2025) tightens anti-discrimination requirements — needs to be baked into posting rules
  • Testimonials carry defamation risk — need moderation for factual accuracy, a right of reply for helpers, and verified reviewer identity

Payments and token model

  • Charging access fees (tokens to view contacts or testimonials) via a standard payment processor with no stored value or escrow should avoid Payment Services Act licensing
  • If holding funds, running escrow, or issuing redeemable stored value, PSA licensing may apply
  • Safest approach for MVP: no-custody checkout only — validate demand before adding complexity

Transfer-specific compliance to surface in the product

These are not the platform’s direct obligations but users will fail if the product ignores them:

  • Direct transfer requires current employer consent, valid Work Permit (≥30 days remaining), and 6-monthly medical exam up to date
  • Employers must buy medical insurance (≥S60,000) for MDWs
  • Security bond of S$5,000 required for non-Malaysian MDWs — cannot be passed to the worker
  • At least one rest day per week, with at least one mandatory rest day per month that cannot be bought out
  • Employment contracts are encouraged; safety agreement is required
  • Build guardrails and education into the product flows for all of the above

Thinking Trace

  • Used ChatGPT to get an initial landscape of compliance requirements — have not yet read and verified every point in depth
  • The EA licensing question is the most critical blocker — it determines whether the MVP can have any matching features at all
  • PDPA is heavier than it looks, especially around NRIC/FIN handling and breach notification timelines
  • The transfer-specific compliance items (insurance, security bond, rest days) are not our obligations but if users trip over them they will blame the platform — better to surface them proactively
  • Token model for testimonials looks safe if structured as access fees with no stored value — need to stay away from escrow

What changed?

— skip, v1 —

Why it changed?

— skip, v1 —

Evidence / Signals

  • MOM documentation is explicit about EA licensing trigger points — this is not ambiguous
  • PDPC breach notification timeline (3 calendar days) is strict and requires a playbook to execute

Open Questions

  • Do we apply for EA licence before or after validating the product concept?
  • What does compliant bulletin-board mode actually look like in the UI — how much does it limit the product?
  • Who will be our Data Protection Officer at MVP stage?
  • How do we handle NRIC/FIN if work pass verification requires it?
  • Which testimonial moderation approach is practical at small scale — manual or automated?
  • At what stage does the security bond and insurance checklist need to be in the product?

Connections

Changelog

  • v1 — Initial node

Graph View

Backlinks