Access Control System Singapore: Types, Rules & Cost
An access control system in Singapore does more than unlock a door. From 15 September 2025 the rules tightened, and installing or servicing security equipment now sits under a three-year Security Service Provider licence. This blog walks you through the system types, the wiring protocols that decide long-term security, the PSIA licensing that many buyers miss, and how to specify access control supply and installation that passes an audit.
What is an access control system, and what parts does it need?
An access control system is an electronic security setup that decides who may enter a space and records every entry attempt. Three parts do the work. A credential the person carries, a reader mounted at the door that captures it, and a controller that checks the credential against a permission list and then releases the lock. Remove any one part and you have a lock, not a system.
The controller is the brain. A single door controller panel typically manages 2, 4, or 8 doors and holds the schedules, the cardholder database, and the audit log. The reader lives on the unsecured side of the door and reads the credential, which can be a 125 kHz proximity card, a 13.56 MHz MIFARE DESFire smart card, or a mobile credential stored on a phone. The electric lock does the physical work, wired either fail-safe or fail-secure depending on whether the door sits on a fire escape route.
Demand for these systems keeps climbing across the region. MarketsandMarkets values the Asia Pacific access control market at USD 3.11 billion in 2025, rising to USD 5.13 billion by 2030 at a 10.5 percent compound annual growth rate, with Singapore named among the commercial-led markets driving that growth.
What types of access control systems are used in Singapore?
Singapore properties run five main types: proximity card, smart card, biometric, mobile credential, and keypad PIN. Most commercial buildings combine two of them rather than picking one.
Card-based systems dominate multi-tenant offices because a card is cheap to issue and easy to revoke when a tenant leaves. Biometric readers, using fingerprint or facial recognition, suit server rooms, pharmacies, and finance floors where you need to prove the person is present, not just their card. Mobile credentials, delivered over Bluetooth or NFC, are the fastest-growing category because facilities teams can issue and cancel access remotely without printing anything.
The cleaner approach for a commercial tower is a hybrid. Issue a smart card as the daily credential, add mobile credentials for staff who rotate sites, and reserve biometrics for a small number of high-value rooms. Running biometrics on every door raises both cost and personal-data obligations without matching the risk profile of a general office corridor.
Which is more secure: card, biometric, or mobile credentials?
Biometric and smart-card credentials beat legacy proximity cards on security, and the gap is wide. A basic 125 kHz proximity card broadcasts a fixed number that a cloning device bought online can copy in seconds. That is the weakest link in most older Singapore installations.
A 13.56 MHz MIFARE DESFire smart card encrypts the stored credential and challenges the reader before releasing data, which defeats simple cloning. Mobile credentials add a second factor for free, because the phone itself is usually locked behind the owner’s fingerprint or face. Biometrics remove the credential-sharing problem entirely, since a fingerprint cannot be lent to a colleague.
Worth noting: the credential is only as strong as the wiring behind it. An encrypted smart card still exposes its raw number if the reader talks to the controller over an unencrypted protocol, which is why the reader-to-controller link matters as much as the card itself.
Do you need a licence to install access control in Singapore?
Yes. In most cases the company installing your access control system needs a Security Service Provider licence, and this is the compliance point that separates a compliant contractor from a risky one. Under the Private Security Industry Act, the Singapore Police Force requires a Security Service Provider licence for anyone who installs, maintains, repairs, or services security equipment on premises by physical or electronic means.
The regime changed on 15 September 2025. The licence now runs for a three-year tenure at a fee of 126 dollars, and reporting rules for changes of directors and business names were simplified. One exemption exists: a licence is not required to sell a security system that any ordinary customer can install without a technician. Access control that involves door wiring, controller configuration, and lock integration does not fall under that exemption.
The practical takeaway is simple. Ask any prospective installer for their Security Service Provider licence number and verify it against the police register before signing. A contractor who cannot produce one is not permitted to wire your doors.
Wiegand or OSDP: which wiring protocol should you specify?
Specify OSDP for any new installation. Wiegand is a 1970s interface that sends credential data in plain text over one-way wiring, and it is now the single biggest weakness in access control that ships without scrutiny. Wiegand caps out at a 150 metre cable run, has no encryption, and cannot tell the controller if a reader has been removed or tampered with.
OSDP, the Open Supervised Device Protocol, was adopted by the Security Industry Association and approved as international standard IEC 60839-11-5 in May 2020, with version 2.2 released that December. It runs over RS-485, carries AES-128 encryption in Secure Channel mode, communicates in both directions, and supervises the line so the panel knows the moment a reader is attacked. It reaches roughly 1,200 metres, eight times the Wiegand limit, which matters on industrial estates and long carpark perimeters.
The wiring economics favour OSDP too. Devon Felise of Suprema America notes that a single four-door panel supports four Wiegand readers or 132 readers over OSDP on a shared bus, collapsing dozens of Wiegand panels into one. As Tony Diodato, CTO of Cypress Integration Solutions, puts it, OSDP “supervises the connection, so the panel is alerted if a reader is tampered with.” For new work in Singapore, specifying Wiegand today is specifying a known vulnerability.
How does access control integrate with turnstiles, barriers, and CCTV?
Access control becomes the control layer that unifies every entry point under one credential and one policy. The same card that opens a staff door can drive the lobby turnstile entry systems, lift the carpark barrier integration, and dispatch the lift to the right floor, all governed by one permission list.
The integration pattern is straightforward once the controller sits at the centre. A credential presented at the carpark reader lifts the boom and logs the vehicle. The same credential at the lobby turnstile enforces one person per pass. Tie the controller into CCTV surveillance and every access event links to the exact camera frame, so an investigation pulls the footage by cardholder and timestamp instead of scrubbing hours of video. This is where treating access control, turnstiles, barriers, and cameras as one system pays back, rather than buying four disconnected products.
How do access control systems stop tailgating and anti-passback?
Tailgating and anti-passback are two sides of the same problem, and access control tackles them with policy plus physical hardware. Tailgating is one person following an authorised holder through an open door without presenting a credential. Anti-passback is the control that blocks a credential from entering twice in a row without an exit read in between, which stops one card from being passed back to admit a second person.
Software anti-passback alone leaves a gap, because a determined follower still slips through a swinging door. The reliable fix pairs the policy with hardware that physically enforces single entry, such as a tripod or full-height turnstile in the lobby or a mantrap at a data hall. In practice, high-security Singapore sites layer both: anti-passback in the controller logic, and a turnstile or speed gate that only cycles once per valid read.
How much does an access control system cost in Singapore?
Cost is driven by four levers, not a single per-door figure: door count, credential type, wiring protocol, and integration scope. A two-door proximity system for a small office sits at the low end. A biometric, OSDP-wired system across a multi-storey building with turnstile and carpark integration sits far higher.
Two numbers help you sanity-check a quote. First, protocol choice changes the panel count, since one OSDP four-door panel replaces the roughly 33 panels a large Wiegand deployment would need, so an OSDP design that looks pricier per reader often costs less across a full building. Second, the installer’s own Security Service Provider licence costs 126 dollars for three years, a compliance overhead that any legitimate quote already absorbs.
Be wary of a headline per-door price that does not state the reader protocol, the credential type, or whether maintenance is included. The cleanest way to compare quotes fairly is a site assessment that fixes the door schedule and integration scope first, then prices against it.
How do you choose an access control installer in Singapore?
Judge an installer on four things: a valid Security Service Provider licence, OSDP capability, an integration track record, and a maintenance plan. The licence is non-negotiable, and the other three separate a wiring subcontractor from a security partner.
Ask whether they design in OSDP by default or still default to Wiegand to shave hardware cost. Ask to see installations where they tied access control into turnstiles, barriers, and CCTV under one platform, because integration is where cheap installers cut corners. A firm that supplies the full range of entry management systems can align the credential, the readers, and the physical barriers instead of stitching together mismatched brands. When you are ready to compare properly, request a site assessment so the design is priced against your actual door schedule.
Conclusion
In Singapore, specifying an access control system is a compliance and integration decision as much as a hardware one. The buyers who get it right verify the installer’s Security Service Provider licence, insist on OSDP Secure Channel over legacy Wiegand, and plan turnstile, barrier, and CCTV integration before the first cable is pulled. Those three moves protect both the building and the audit trail.
Enforce Automatic Global designs, supplies, installs, and maintains access control as one integrated system across residential, commercial, and industrial sites. Book a site assessment to map your door schedule, credential mix, and integration scope, then receive a specification that is licensed, OSDP-ready, and built to pass inspection.
Frequently asked questions
Is biometric access control legal in Singapore?
Yes. Biometric access control is legal, but fingerprint and facial data are personal data under Singapore’s Personal Data Protection Act 2012, enforced by the PDPC. You must collect consent, limit the data to the access-control purpose, and secure it. Many firms store a mathematical template rather than the raw image to reduce exposure.
What is the maximum distance a card reader can be from the controller?
A Wiegand reader must sit within about 150 metres of the controller, while an OSDP reader over RS-485 can run to roughly 1,200 metres. That eightfold difference is why OSDP suits long carpark perimeters and spread-out industrial estates across Singapore without adding extra controller panels.
Will access control still work during a power cut?
It depends on the lock type and backup power. Doors on fire escape routes are usually wired fail-safe, so they release when power drops or the fire alarm triggers, which keeps egress legal. High-security doors are wired fail-secure and rely on a battery backup or UPS to stay locked and logging through a short outage.
Can one card open the turnstile, the carpark barrier, and the lift?
Yes. With a unified controller and a single credential format such as MIFARE DESFire, one card drives the lobby turnstile, the carpark barrier, and destination lift dispatch. Enforce integrates these under one access control platform so facilities teams manage every entry point from a single cardholder database.
