ICA to launch new group-based address update feature in eCOA system starting August 15

From August 15, 2025, Singapore’s Immigration & Checkpoints Authority (ICA) will introduce a new feature in its electronic Change of Address (eCOA) service. This group application feature—designed to accommodate up to five individuals relocating to the same residential address—is more than a user upgrade. It is a clear shift in the national digital identity architecture, signaling that security and consent must now be mutually reinforced, especially in shared living arrangements.

For residents navigating this new change, it may seem like an administrative tweak. But structurally, this rollout reflects a rebalancing of convenience and accountability across Singapore’s public digital services. It enforces a higher bar of transactional legitimacy—one that underscores the growing importance of verified identity flows in housing data, access rights, and regulatory compliance.

This article explains how the new group address change function works, why the older system was suspended, and what this new approach reveals about Singapore’s direction in secure digital governance.

The eCOA platform enables Singaporeans, Permanent Residents (PRs), and ICA-issued long-term pass holders to update their official residential address online. It’s an essential tool, especially in a city-state where one’s address governs mail delivery, housing eligibility, schooling zone access, and legal residency documentation.

Previously, the eCOA allowed users to change not only their own address but also those of family members or others—via the “Myself and my family members” and “Others” modules. However, these modules were suspended in January 2025 after ICA discovered unauthorized attempts to alter the residential address records of multiple individuals.

What was intended as a convenience channel became a vulnerability. With no mandatory identity verification for sub-applicants, the system was open to misuse. Some individuals exploited the loophole to update the addresses of others—sometimes without consent, sometimes for malicious purposes.

Following the discovery of these unauthorized transactions, ICA resumed only the “Myself” module—with enhanced safeguards, including Singpass Facial Verification (SFV) for authentication. The new group update module now reintroduces multi-person address changes—but with important changes to the security and consent model.

The new function applies to:

• Singapore Citizens
• Permanent Residents
• ICA-issued long-term pass holders (e.g. S Pass, LTVP, Dependant Pass holders)
• Individuals currently residing overseas with an ICA-issued document

Applicants can initiate a change-of-address application for themselves and up to four other people, provided all individuals are moving to the same address. Crucially, the applicant must also be changing their own address as part of the group. You can no longer submit changes “on behalf” of others without being included in the same move.

This is especially useful for:

• Families relocating together
• Cohabiting tenants in a joint lease
• Spouses or partners sharing a new address
• Foreign domestic workers moving with their sponsoring household

For elderly residents or digital non-users, traditional channels remain open. They can submit their application through FormSG or visit the ICA Services Centre or ServiceSG outlets for in-person assistance.

The new group change-of-address process consists of several checkpoints to ensure secure, consented updates across all sub-applicants:

1. Application Initiation

The main applicant logs into the eCOA system using Singpass and begins the group change-of-address application. They input their own new address and add up to four sub-applicants who are moving with them.

2. Consent Notification

Each sub-applicant receives an SMS notification and has five calendar days to access the eCOA platform, log in via their own Singpass, and give explicit consent to be included in the address update. If any sub-applicant fails to give consent within the five-day window, they are excluded from the update and will not receive further instructions or a sticker with the new address.

3. PIN Mailer Dispatch

Once the five-day consent period passes, ICA sends a physical PIN mailer to the new residential address of the main applicant. This mailer contains a unique code that must be entered into the system to finalize the update.

4. NRIC Sticker Issuance

After the PIN is successfully entered, ICA dispatches stickers bearing the new address to all applicants who completed the consent process. These stickers are mailed to the new address and must be affixed to the back of each applicant’s NRIC.

This sequence ensures that any change of address:

• Is initiated by someone actually moving
• Is independently verified by every adult included
• Is confirmed via a physical token sent to the new address
• Is only recorded in ICA systems after all steps are fulfilled

At a glance, requiring a physical PIN in a digital workflow may appear redundant. But the logic is sound: digital consent alone is not proof of physical residency. By requiring a code to be retrieved from the new residence and entered online, ICA creates a hybrid verification layer that authenticates both intent and presence.

This PIN mailer strategy strengthens what security architects call “destination assurance”. It ensures that the person initiating the address change physically controls or accesses the address in question. It also prevents fraudulent address updates to properties where the applicant does not reside—an issue that previously occurred under the older model.

One of the most critical operational changes is this: there is no assumed consent. Sub-applicants who do not respond to the SMS prompt within five days will not have their address changed, will not be listed under the new address in ICA records, and will not receive the NRIC update sticker.

In a household where, for example, only three out of four people approve the update in time, only those three addresses are changed. The fourth must file a separate application later if needed. This consent window is non-renewable, meaning once it lapses, the group application proceeds without the unresponsive party. The system prioritizes integrity and timeliness over automatic inclusion.

The changes may have ripple effects in Singapore’s rental landscape, especially in shared accommodations or co-living setups where informal living arrangements are common.

Previously, one tech-savvy tenant could submit address updates for all residents in a unit. Now, each co-tenant must individually approve the change. This could complicate things for:

• Tenants on verbal lease terms with no formal documentation
• Residents who are hesitant to confirm their address with ICA (e.g. due to overcrowding concerns)
• Foreign workers living in dorm-style housing or rotating units

By enforcing consent and limiting proxy updates, the new model may discourage informal housing arrangements that bypass regulatory records. This aligns with Singapore’s ongoing efforts to tighten rental disclosures and housing traceability.

Globally, few countries offer a fully digital, real-time national address update service. Many Western nations, such as the United States or Australia, require mail-in forms, utility proofs, or in-person verification at post offices or municipal agencies.

Singapore’s system, by comparison, is remarkably streamlined—but with a new layer of rigor. The inclusion of SFV (Singpass Facial Verification) for login, coupled with physical mail validation, places the city-state in a unique position: digital-first but fraud-resistant.

This hybrid approach may serve as a model for other digitally advanced governments looking to prevent “phantom residency” or misaligned official records in densely populated cities.

This is not simply about address stickers or digital applications. In Singapore, your registered address governs:

• Receipt of official government letters (e.g. HDB, CPF, ICA, IRAS)
• Eligibility for housing grants and property ownership rules
• School admissions and primary catchment areas
• National service obligations and security clearances
• Emergency services and contact traceability

Incorrect or unverified addresses can lead to missed obligations, denied benefits, and legal complications. That’s why ICA treats the accuracy of its address database as a matter of national reliability. This change, then, is not administrative. It is foundational.

In the early weeks following rollout, applicants may experience delays or rejections if they:

• Mistakenly enter outdated phone numbers for sub-applicants
• Overlook the five-day consent deadline
• Fail to retrieve the PIN mailer due to travel or delivery issues
• Share an address that cannot be verified by HDB or URA systems

Applicants are advised to prepare address documentation in advance and to coordinate with their co-residents before initiating the process. ICA has not announced an appeal or extension process for missed deadlines, making it important to get it right the first time.

What ICA has implemented is not just a feature—it is a governance stance.

In recent years, Singapore has expanded its digital citizen services through Singpass and MyICA, but each expansion has been accompanied by tighter authentication standards. From biometric verification to mobile phone OTPs to physical mailers, the city-state’s digital infrastructure emphasizes traceable legitimacy.

This newest eCOA update reflects a view that shared accountability—in the form of mutual consent and identity confirmation—is the backbone of secure public service. Friction is no longer seen as a failure of design, but as a safeguard of trust.

As governments continue digitizing public infrastructure, the temptation is to make everything as “frictionless” as possible. But when it comes to national identity systems, total convenience can become a vulnerability. ICA’s group eCOA update reminds us that every digital transaction is also a trust contract—and that contract must be affirmed, not assumed.

This change represents more than a policy fix. It reflects a belief that digital systems must not only serve citizens—they must protect them, too. Especially from each other. And in a time when many systems are moving faster than users can verify, this shift toward structured consent is a quiet but necessary step forward.