ABS Access Control Guidelines for Financial Institutions in Singapore: Doors, Security Zones, 2FA and Fire Alarm Integration

Electronic access control is one of the core physical security systems addressed in the ABS Physical Security Guidelines for Financial Institutions 2.0 (Revised 2025).

However, as with CCTV, the ABS guideline does not simply prescribe one identical access-control design for every financial institution.

Its approach is risk-based.

ABS says physical-security countermeasures should vary depending on the location, type of assets and operations of the financial institution. It specifically distinguishes between offices, retail branches and critical facilities such as data centres.

The important question is therefore not:

“Does every door need a card reader?”

It is:

“Which areas need to be controlled, how strongly should access be restricted, and what additional controls are justified by the risk?”

What does ABS say about electronic access control?

ABS describes effective access control as regulating movement by determining who is authorised to enter particular areas.

It states that maintaining an effective door-access-control system is a fundamental principle of good access-control management.

When designing electronic access control, ABS highlights several considerations, including:

• prioritising and minimising entrances;
• identifying areas that should be restricted from public access; and
• ensuring that access control does not compromise fire-protection and life-safety systems.

The system should therefore be designed around both security requirements and safe operation of the premises.

Which doors should have access control?

ABS states that access control should be established at relevant and appropriate entry and exit points within the organisation.

Examples include:

• building entrances;
• office entrances; and
• perimeter doors.

The phrase “relevant and appropriate” is important.

ABS does not say every internal office door must be electronically controlled.

Instead, the requirement should follow the sensitivity of the area and the associated security risk.

Should every internal office door have a card reader?

The ABS guideline does not state that every internal door requires electronic access control.

For internal access points, ABS says the level of security should be appropriate to the sensitivity of the area. It recommends complementing access points with measures such as:

• lighting;
• CCTV surveillance; and
• door-access-control hardware, including secure locking mechanisms.

This supports a graduated approach.

For example, an ordinary meeting room may not require the same security controls as:

• a server room;
• telecommunications room;
• cash-processing room;
• sensitive-document storage room; or
• data hall.

Consultant’s perspective

The sensible sequence is:

Classify the area → understand the consequence of unauthorised access → determine the required access-control level.

Starting with “one reader per door” can lead to unnecessary cost and complexity.

Which areas should have stronger access control?

ABS specifically identifies sensitive or critical areas where stronger access-control measures should be considered.

Examples include:

• cash-processing areas;
• safe rooms;
• sensitive-document storage rooms; and
• data halls.

The same underlying principle can be applied to other spaces identified as critical through the risk assessment.

For instance, if loss or compromise of a telecommunications room or critical equipment room would significantly affect operations, stronger controls may be appropriate.

ABS separately states that access to critical equipment rooms should be restricted to authorised personnel.

Does ABS require two-factor authentication?

This is one of the most useful distinctions in the guideline.

ABS does not state that every electronically controlled door must use two-factor authentication.

Instead, it says stronger access-control measures for sensitive or critical areas may include:

• card and PIN;
• card and biometric;
• anti-passback; and
• interlocking door controls or man-traps.

In its section on internal access points, ABS also says restricted or critical areas should be designed with complementary controls such as 2-Factor Authentication, intrusion detection or audible alarms.

Practical interpretation

The guideline supports the use of 2FA for higher-risk areas.

It does not establish:

“All doors in a financial institution must have 2FA.”

That would be an overstatement of the source.

What forms of 2FA does ABS mention?

ABS specifically gives the following examples:

Card + PIN

and

Card + biometric.

These are examples of stronger access control for sensitive or critical locations.

The guideline does not state that either method must be used universally.

The appropriate method should follow the security risk, operational needs and any applicable privacy or technical requirements.

Does ABS mention biometrics?

Yes.

Biometric authentication is mentioned as one possible component of two-factor physical access control, specifically card + biometric.

The ABS guideline, however, does not provide detailed biometric-system requirements in this section.

Therefore, matters such as biometric-data governance, privacy, accuracy or enrolment procedures should not be inferred from ABS alone.

Does ABS recommend anti-passback?

Yes.

ABS includes anti-passback among the stronger access-control measures that may be used for sensitive or critical areas.

Anti-passback can help prevent a credential from being repeatedly passed between people or reused in a way inconsistent with the intended movement sequence.

Consultant’s perspective

Anti-passback should be applied carefully.

Operational issues need to be considered, including:

• missed reader transactions;
• emergency evacuation;
• tailgating;
• visitor movement;
• shift changes; and
• procedures for resetting users.

ABS identifies anti-passback as an available security measure, but does not prescribe detailed implementation logic.

Does ABS recommend man-traps or interlocking doors?

ABS mentions interlocking door access controls, or man-traps, as one possible stronger access-control measure for sensitive or critical areas.

It also states that specially designed entrances such as gates, interlocking systems or portals may be required depending on the risk assessment to delay forced entry.

Again, this is not a blanket requirement.

Such arrangements are generally more appropriate to higher-security areas where the increased control is justified.

What is security zoning?

ABS recommends creating security-level zoning with role-based access privileges as a good practice.

It provides an example with four broad levels.

Public

Public areas are shown as unrestricted and accessible to employees and members of the public.

Limited

Visitor areas are shown as limited access, with employees and pre-registered visitors permitted.

Moderate

Employee common areas and offices are shown as accessible to employees.

High

Restricted areas are shown as accessible only to authorised employees.

This is a useful conceptual model for access-control design.

How can security zoning be applied in a financial institution?

A practical office zoning model might be:

Zone 0 – Public

Reception or customer-facing area.

Zone 1 – Controlled Visitor Area

Meeting rooms and visitor zones beyond reception.

Zone 2 – General Employee Area

Normal office workspace.

Zone 3 – Restricted Department Area

Finance, HR, trading-support or other sensitive business functions.

Zone 4 – Critical Area

Server room, telecommunications room, critical security-control room or other high-impact asset.

That is a consultant’s example, not a zoning scheme prescribed by ABS.

The guideline supports the principle of role-based security zoning, while the organisation determines the actual zones based on risk and operations.

Should access rights be role-based?

ABS explicitly describes role-based privileges as good practice within security-level zoning.

This is generally preferable to individually assigning access without a clear structure.

For example:

General Employee

may have access to standard office areas.

IT Operations

may also receive access to designated technology rooms.

Security

may receive access to operational security areas.

Facilities

may require access to selected equipment or plant rooms.

Access should therefore follow the person’s legitimate business role.

How often should door-access rights be reviewed?

ABS states that door-access privileges should be reviewed regularly to ensure that employees’ physical access rights remain valid.

It does not provide one universal review interval in this section.

The organisation should establish a review cycle appropriate to its security governance framework.

Event-driven reviews are equally important

Even where periodic reviews are conducted, access should also be reconsidered when a person:

• leaves the organisation;
• changes department;
• changes job responsibilities;
• moves to another office;
• becomes a contractor rather than an employee; or
• no longer requires access to a particular area.

Those examples are practical governance measures rather than specific ABS wording.

Should access-control logs be reviewed?

For sensitive or critical areas, ABS says the financial institution should review door-access log records to identify potential:

• access violations; or
• suspicious activities.

This is important.

An access-control system should not only be used to unlock doors.

Its event history can also support detection and investigation.

Should access-control points have CCTV?

ABS lists access-control points and screening points among typical CCTV deployment locations.

This creates an important layered-security relationship.

The access-control system tells you:

which credential was used.

CCTV may help determine:

who physically used the door and what happened around the transaction.

For sensitive areas, combining access records with video can significantly improve incident investigation.

That is an operational interpretation of the combined systems, rather than an ABS requirement to integrate every reader electronically with a camera.

What does ABS say about forced entry?

ABS says internal access points should be designed according to their security sensitivity.

Where risk justifies stronger protection, specially designed gates, interlocking systems or portals may be used to delay forced entry.

This fits the wider ABS layered-security model:

Deter → Detect → Delay → Deny → Respond.

The physical strength of the door, frame, partition and locking arrangement can therefore matter just as much as the card reader.

Is a card reader enough to secure a high-risk room?

Not necessarily.

ABS consistently promotes complementary controls.

For restricted or critical areas, the guideline discusses combinations including:

• secure physical construction;
• access control;
• CCTV;
• intrusion detection;
• audible alarms;
• 2FA; and
• specially protected entrances.

A reader attached to a weak door or lightweight partition may therefore offer limited security.

Consultant’s perspective

For high-risk rooms, the full security envelope should be considered:

wall + ceiling/floor interface + door + frame + lock + access control + detection + surveillance + response.

What does ABS say about walls and partitions around restricted areas?

ABS notes that walls and partitions segregate public from non-public or restricted areas and form part of the overall protection system.

It discusses reinforced construction and floor-to-ceiling slab partitioning as measures that can prevent access through raised floors or above suspended ceilings.

This is particularly relevant to rooms that have strong access-controlled doors but weaker surrounding partitions.

How should access control interact with the fire alarm system?

ABS is clear that access control should not compromise fire protection and safety systems.

It states that electronically controlled doors should be integrated with the fire-protection system, such as releasing secure doors for emergency egress in accordance with local fire code.

This is one area where project teams must be especially careful.

The ABS guideline establishes the security principle, but the detailed arrangement for:

• door release;
• fail-safe or fail-secure operation;
• emergency break-glass devices;
• exit devices;
• fire alarm interfaces; and
• evacuation requirements

must be determined against the applicable fire and life-safety requirements for the actual project.

Does ABS require fail-safe or fail-secure locks?

The ABS access-control section states:

“Fail-secure design electronic locks are recommended for such doors.”

However, this statement sits alongside the requirement that electronically controlled doors should release appropriately for emergency egress in accordance with local fire code.

Consultant’s note

This wording should not be used in isolation to select the locking mode for a specific door.

The appropriate lock behaviour depends on the actual door function, fire strategy, emergency-egress arrangement and applicable approval requirements.

The ABS guideline should therefore be read together with the relevant life-safety requirements.

Does ABS say anything about emergency access or egress?

Yes.

The central principle is that security must not compromise emergency egress.

ABS states that electronically controlled doors should interface appropriately with fire-protection systems so secure doors can release for emergency exit in accordance with local fire requirements.

This means access-control design needs coordination between:

• security;
• architecture;
• fire safety;
• M&E;
• door hardware; and
• building management.

It should not be designed as an isolated security-system package.

What about access to critical equipment rooms?

ABS says critical equipment rooms should be adequately protected and access should be restricted to authorised personnel only.

It also identifies CCTV, access-control hardware and intrusion detection as possible controls for these rooms.

Examples of critical equipment include systems supporting:

• electricity;
• water;
• air;
• communications;
• networks; and
• fire protection.

For financial institutions, this can make utility and technology rooms part of the wider physical-security programme even where those rooms are managed by building management.

What if access control is managed by the landlord?

ABS says that where the access-control system forms part of the building infrastructure managed by building management, the financial institution should assess it as part of the overall infrastructure supporting its security programme.

A tenant should therefore understand:

• how credentials are issued;
• which floors or areas are controlled;
• how access is removed;
• who administers the system;
• what records are available;
• what happens during fire alarm;
• what happens during lockdown;
• and how incidents are escalated.

The presence of a building access-control system does not remove the need for the financial institution to evaluate whether it meets its own risk requirements.

What does ABS say about visitor access?

Visitor management is closely linked to access control.

ABS states that visitors should be:

• directed to a registration point;
• identified using appropriate photo identification;
• recorded before visitor passes are issued; and
• accompanied by authorised personnel where necessary.

Its sample security-zoning model also describes visitor areas as accessible to visitors whose names have been pre-registered with the Security Office.

This supports linking visitor management with access privileges rather than issuing unrestricted visitor credentials.

Does ABS say anything about access control during heightened security?

Yes.

During heightened or enhanced security conditions, ABS identifies measures including:

• limiting entry and exit points;
• lockdown procedures;
• deploying additional security personnel; and
• carrying out bag or vehicle screening.

The Building Management Engagement Checklist also asks whether the building can limit ingress and egress points and conduct security screening during heightened security.

The access-control system may therefore play a different operational role during elevated threat conditions than during normal business operations.

Can a building be locked down during a security incident?

The ABS Building Management Engagement Checklist specifically asks whether exterior doors are protected against forced entry and can be locked down during exigency.

It also asks, in the context of armed attack, whether building management has lockdown procedures such as securing perimeter doors.

Any lockdown functionality must still be coordinated with applicable life-safety and emergency procedures.

What does ABS recommend for retail-bank branch access control?

Appendix 2 provides a general guide for retail branches.

ABS explicitly states that this is not intended to be a baseline requirement, but rather a guide to commonly acceptable physical-security protection.

The branch matrix includes access-control recommendations such as:

Branch perimeter

Electronic access-control systems on access points and secured electronic or mechanical locks.

Teller counter area

Where located in a non-public area, electronic access control to the teller area.

Back of house

Electronic access control to the back-of-house area.

Vault / built-in safe

Day gate and burglary-resistant door.

Safe-deposit-box facility

Day gate and burglary-resistant door.

These controls are combined with CCTV, intrusion detection and duress alarms.

Common mistakes when interpreting the ABS access-control guidance

Several statements should be avoided unless another applicable requirement supports them.

“ABS requires card access on every door.”

No. ABS says access control should be established at relevant and appropriate points, with the level of protection based on sensitivity and risk.

“ABS requires 2FA on all doors.”

No. ABS associates stronger controls such as 2FA with sensitive or critical areas.

“Every server room must use biometrics.”

ABS does not say this.

It mentions card + biometric as one example of stronger 2FA, but the required control should follow the risk assessment.

“A card reader means the room is secure.”

Not necessarily.

ABS promotes layered protection and also addresses doors, walls, partitions, CCTV, alarms and response arrangements.

“Access control can be designed separately from fire safety.”

No.

ABS expressly says access control must not compromise fire protection and emergency egress.

A practical access-control design process

A useful design sequence for a financial institution would be:

1. Identify areas and assets

Understand which spaces are public, employee-only, restricted or critical.

2. Classify security zones

Develop a logical zoning hierarchy.

3. Determine authorised roles

Define which job roles genuinely require access to each zone.

4. Identify controlled doors

Determine which entry or exit points require electronic access control.

5. Determine authentication strength

Decide whether card-only access is sufficient or whether higher-risk locations require stronger controls such as 2FA.

6. Review the physical door and partition

Ensure the door, frame, locking hardware and surrounding construction provide a level of protection consistent with the intended security zone.

7. Coordinate CCTV and intrusion detection

Use complementary controls where the risk warrants them.

8. Coordinate fire and life safety

Confirm the required emergency-egress and fire-alarm behaviour with the relevant project professionals.

9. Establish access administration

Define who approves, creates, changes and removes access privileges.

10. Review access periodically

Confirm that access remains appropriate and review critical-area logs for suspicious activity.

This process follows the ABS philosophy more closely than simply determining the number of card readers from an architectural drawing.

Practical access-control checklist

When reviewing access control for a financial institution, useful questions include:

• What security zones exist?
• Which areas are public?
• Which areas are employee-only?
• Which areas are restricted or critical?
• Which doors genuinely require electronic access control?
• Who is authorised to access each area?
• Are privileges role-based?
• Do high-risk areas require stronger authentication?
• Is 2FA justified?
• Is anti-passback required?
• Is an interlocking entrance justified?
• Does CCTV cover important access points?
• Is intrusion detection required?
• Are doors and frames physically adequate?
• Are surrounding walls or partitions secure enough?
• How does the door behave during a fire alarm?
• Is emergency egress maintained?
• Who administers access rights?
• How quickly is access removed for leavers?
• Are privileges reviewed regularly?
• Are access logs for critical areas reviewed?
• Does building-management access control form part of the overall security programme?
• How does access-control operation change during lockdown or heightened security?

This creates a much stronger design conversation than simply asking:

“How many readers do we need?”

Conclusion

The ABS Physical Security Guidelines 2.0 treats access control as part of a broader risk-based and layered physical-security programme.

It supports electronic control at appropriate entry and exit points, stronger controls for sensitive and critical areas, role-based security zoning and measures such as 2FA, anti-passback and interlocking doors where risk justifies them.

At the same time, ABS makes an important point that should never be overlooked:

physical security must not compromise fire protection or emergency egress.

The best access-control design therefore does not begin with the reader.

It begins with:

what is being protected, who should have access, what would happen if unauthorised access occurred, and what level of control is proportionate to that risk.