ABS CCTV Guidelines for Financial Institutions in Singapore: Coverage, Monitoring and Retention

CCTV is one of the most visible components of a financial institution’s physical security programme, but the ABS Physical Security Guidelines for Financial Institutions 2.0 (Revised 2025) does not treat video surveillance as a simple exercise of installing a fixed number of cameras.

Instead, ABS takes a risk-based approach.

The guideline states that physical security measures will vary depending on the location, assets and operations of the financial institution. Offices, retail branches and critical facilities such as data centres may therefore require different security measures.

The same principle applies to CCTV.

The key questions are not simply:

How many cameras are required?

or:

What megapixel camera should we install?

The more useful questions are:

What risks need to be detected?

What areas need to be observed?

What image is required from each camera?

Who will monitor or review the video?

What happens when an incident is detected?

That distinction is important when interpreting the ABS guideline.

What does ABS say about CCTV?

ABS describes CCTV surveillance as an integral part of security monitoring.

It identifies two broad functions.

First, CCTV provides recorded information that can support investigations.

Second, depending on how and where it is deployed, visible CCTV may also deter potential threat actors who believe their actions are being monitored and recorded.

However, ABS does not recommend indiscriminate camera deployment.

It states that the proper placement of CCTV surveillance devices should be based on the risks identified.

That makes the physical security risk assessment the logical starting point for CCTV design.

Where does ABS recommend CCTV coverage?

ABS provides a useful list of locations where CCTV is typically deployed.

These include:

• building perimeter;
• fence or boundary lines;
• vehicle access points;
• building or branch entrances;
• building or branch lobbies;
• vaults;
• access-control and screening points;
• ATM and ATM lobbies;
• sensitive or restricted office entrances;
• critical equipment rooms;
• technology rooms;
• data halls; and
• security control rooms.

This is not presented as a universal camera schedule.

The wording is important: these are typical locations, while actual placement should be driven by identified risks.

Consultant’s perspective

A useful way to interpret this during design is to ask what security purpose each camera performs.

For example, one camera may monitor an office entrance, another may support identification at an access-controlled door, while another may provide situational awareness of a critical room.

The design purpose should ideally be established before camera positions and models are selected.

Does ABS require CCTV at office entrances?

ABS lists building and branch entrances among the typical areas for CCTV surveillance. It also separately identifies sensitive or restricted office entrances and access-control points.

For a corporate financial office, entrances therefore warrant particular attention during the risk assessment and CCTV design.

However, coverage alone does not necessarily mean that the image will provide useful identification.

ABS refers financial institutions to the SPF Video Surveillance System Standard for Buildings and GEBSS for more detailed technical information and design considerations.

The functional question from ABS is therefore:

Should this location be monitored?

The technical question is:

What camera position, image quality and system design are necessary to achieve the required surveillance purpose?

Those are related, but they are not the same question.

Should access-controlled doors have CCTV?

ABS lists access-control points and screening points among typical CCTV deployment locations.

The guideline also states that internal access points should be complemented, as appropriate, by measures such as lighting, CCTV surveillance and secure door-access hardware.

This supports a layered approach.

The access-control system regulates who should be permitted through the door.

CCTV can provide visual information regarding what occurred at that access point.

Consultant’s perspective

For higher-risk areas, access-control events and associated CCTV can be particularly useful during investigation.

For example, an access-control record may show that a credential was used at a particular time, while CCTV may assist in establishing who physically used the door and what occurred around that event.

That is an operational benefit rather than a separate ABS technical requirement.

Should server rooms and technology rooms have CCTV?

ABS specifically lists technology rooms and data halls among typical CCTV surveillance locations.

It also provides separate guidance for critical equipment rooms.

ABS states that rooms containing critical equipment should have adequate protection, which may include:

• CCTV surveillance;
• door-access-control hardware and systems;
• intrusion detection systems; and
• restriction of access to authorised personnel.

The guideline therefore supports stronger protection for rooms whose loss or compromise could significantly affect operations.

Whether CCTV should cover the inside of a particular server room, only its entrance, or both should still be based on the risk assessment, operating environment and other relevant requirements.

Does ABS specify a minimum CCTV resolution?

The CCTV section of the ABS guideline does not state a universal minimum camera resolution.

Instead, ABS directs financial institutions to GEBSS and the SPF Video Surveillance System Standard for Buildings for more detailed technical information and design considerations.

Therefore, statements such as:

“ABS requires 4MP cameras”

should not be made unless another applicable document actually establishes that requirement.

The same principle applies to other technical specifications that are not stated in the ABS guideline itself.

Does ABS specify a minimum frame rate?

The ABS CCTV section likewise does not state a universal frame-rate requirement.

ABS instead refers readers to the relevant technical standards for more detailed CCTV design information.

A required frame rate should therefore be established from the applicable technical standard, security objective or organisational specification rather than attributed to ABS where the guideline does not state one.

Does ABS specify how long CCTV footage must be retained?

This is one of the most important distinctions in the guideline.

The main CCTV section does not provide a single universal CCTV retention period.

However, the Building Management Engagement Checklist asks:

whether there is a minimum CCTV retention period stipulated by the organisation and whether periodic checks are conducted to validate it.

This indicates that retention should be:

defined, and then verified.

It does not establish one universal retention duration within that checklist.

Consultant’s perspective

For project design, the sequence should therefore be:

Determine required retention → establish recording assumptions → calculate storage → provide appropriate resilience/buffer → verify actual retention after commissioning.

It is risky to work in the opposite direction by selecting a recorder or hard-disk size first and accepting whatever retention period happens to result.

Should CCTV retention actually be tested?

Yes.

ABS’s retail-branch guidance recommends periodic operational checks of CCTV systems, including playback to verify:

• image quality;
• retention period; and
• that the approved field of view has not changed.

The Building Management Engagement Checklist similarly asks about periodic checks of security systems and specifically mentions image quality, recording and whether the approved CCTV field of view has been altered.

This is significant because a CCTV system may appear operational while no longer meeting its intended performance.

Why should CCTV field of view be checked periodically?

A camera position can change after commissioning.

Renovations, furniture, signage, displays, storage, partitions or even accidental movement can affect the original image.

ABS specifically uses the example of checking whether an approved field of view has been altered as part of security-system maintenance.

For retail branches, it again recommends periodic CCTV playback to confirm the approved field of view.

Consultant’s perspective

A meaningful CCTV maintenance programme should therefore check more than whether the camera is “online”.

It should ask:

Can the camera still see what it was designed to see?

and:

Is the recorded image still usable for its intended security purpose?

What factors affect CCTV image quality?

ABS’s detection section specifically identifies considerations including:

• lighting;
• camera angle; and
• humidity in internal and external environments.

These should be considered to ensure quality information is obtained from the detection system.

This is another indication that simply specifying the camera hardware is insufficient.

A technically capable camera installed at a poor angle or under unsuitable lighting may not provide useful security information.

Does ABS require CCTV to be actively monitored?

ABS states that system detection should be supplemented with active monitoring so that appropriate action can be taken when threats are detected.

This is an important point.

CCTV can provide recorded evidence after an incident, but detection becomes much more operationally useful when information can lead to timely response.

ABS discusses monitoring through:

• an off-site third-party Central Monitoring Station (CMS); or
• an on-site Security Control Room (SCR) or Security Command Centre (SCC).

Therefore, ABS does not assume that all monitoring must take place physically at the financial institution’s premises.

Can CCTV monitoring be carried out remotely?

Yes.

ABS explicitly recognises both on-site and off-site monitoring.

For premises fully controlled by the financial institution, such as a standalone data centre or wholly occupied building, an on-site security control room may be appropriate.

For financial institutions occupying multi-tenant premises, ABS states that they may depend on the building-management security control room or on off-site monitoring performed by an internal security team elsewhere or by a third-party security vendor.

This is particularly relevant to financial institutions considering centralised or regional security monitoring.

Consultant’s perspective

The more important issue is not simply where the operator sits.

The real operational questions are:

What events are being monitored?

Who receives the alarm?

How is the incident verified?

Who is contacted?

Who can physically respond?

How quickly can response occur?

Remote monitoring without an effective escalation and response arrangement does not by itself complete the security process.

What should a CCTV control room do?

ABS describes the security control room as a nerve centre where security-system field devices connect and alerts and security information are received.

Personnel should be capable of:

• maintaining situational awareness;
• processing information;
• assessing and prioritising CCTV and alarm data;
• distinguishing genuine incidents from false alarms; and
• escalating detected threats appropriately.

The security control room should also have an escalation plan identifying what personnel should do and whom they should notify when a threat is detected.

This means effective monitoring is more than watching screens.

Does every CCTV camera need to be watched continuously?

The ABS guideline does not state that an operator must continuously watch every camera feed at all times.

What it does state is that system detection should be supported by active monitoring and that control-room personnel should have the capability to process, assess and prioritise CCTV and alarm information.

The appropriate monitoring strategy may therefore depend on the premises, risk and detection architecture.

Consultant’s perspective

In a modern security operation, this may mean combining CCTV with access-control events, alarms or analytics so operators are directed towards information requiring attention rather than attempting to observe every screen continuously.

That is an operational interpretation; the ABS guideline itself does not prescribe a specific analytics platform or monitoring interface.

What if the building landlord manages the CCTV?

This is common for financial institutions occupying commercial office buildings.

ABS states that when CCTV forms part of infrastructure managed and maintained by building management, the financial institution should assess it as part of the overall infrastructure supporting its security programme.

A financial institution should therefore understand what the landlord’s system actually provides.

Useful questions include:

• Which areas are covered?
• Is the relevant entrance visible?
• Is the CCTV actively monitored?
• How long is footage retained?
• Who is authorised to retrieve footage?
• How is an incident reported?
• Can footage be obtained promptly after an incident?
• What happens if the CCTV or communications system fails?

The ABS Building Management Engagement Checklist supports this wider review and asks, among other things, whether building CCTV is monitored by security personnel.

What does ABS say about CCTV recording equipment?

ABS states that CCTV recording equipment should be kept in a secured facility accessible only by authorised personnel.

The purpose is to prevent tampering with equipment settings or recorded video.

This highlights an often overlooked issue.

Protecting cameras while leaving recorders, servers or security-network equipment easily accessible can create another vulnerability.

Does PDPA apply to financial-institution CCTV recordings?

Yes.

ABS states explicitly that the collection, use and disclosure of CCTV recordings must be in accordance with the Personal Data Protection Act.

The guideline also addresses data handling during security-system maintenance.

It says procedures should exist for the removal and destruction of data, including CCTV recordings on faulty recorder hard disks, while complying with personal-data-protection guidance where applicable.

This means CCTV governance does not stop with camera installation.

It should also address who can access recordings and what happens to stored data when equipment is repaired, replaced or disposed of.

Does ABS require CCTV maintenance?

Yes.

ABS states that preventive checks and servicing should be performed regularly to ensure security equipment continues operating at an optimum level.

Appendix 1 asks whether there is a regular maintenance regime for systems including CCTV, access control and intrusion detection.

For CCTV specifically, it refers to:

• image quality;
• recording; and
• whether the approved field of view has changed.

The retail-branch guidance also recommends both preventive and corrective maintenance.

Should CCTV remain available during a power failure?

The Building Management Engagement Checklist asks whether essential security-monitoring equipment remains available during interruptions to utilities such as power and communications.

Examples include:

• electronic control systems;
• CCTV recorders;
• network switches; and
• PA systems.

This does not itself specify a particular UPS capacity or backup duration.

However, it establishes system resilience as an issue financial institutions should assess.

What does ABS recommend for retail bank branch CCTV?

Appendix 2 contains a specific matrix of basic protective measures for retail branches.

It recommends CCTV coverage for several typical branch areas.

For the branch perimeter, it recommends covering ingress and egress points.

For the customer-service counter, it recommends coverage of the counter.

For the teller area, it identifies teller counters, cash-handling areas and cash-counting stations or machines.

For back-of-house, it recommends coverage of ingress/egress points and cash-handling or counting areas.

For vaults or built-in safes, it identifies ingress/egress points and the vault interior.

For safe-deposit-box facilities, it identifies ingress/egress points and the SDB interior.

There is an important qualification.

ABS explicitly states that Appendix 2 is not intended to be a baseline requirement and does not replace any additional requirements established by individual financial institutions.

Common mistakes when interpreting the ABS CCTV guidance

There are several conclusions that should not automatically be drawn from the document.

“ABS requires every bank to install the same number of cameras.”
The document takes a risk-based approach and does not provide such a universal camera quantity.

“ABS requires a particular megapixel camera.”
The ABS CCTV section does not provide one universal resolution. It refers readers to the relevant technical guidance.

“ABS requires a particular frame rate.”
The ABS CCTV section does not state one universal frame rate.

“ABS says CCTV must be kept for X days.”
The guideline asks whether the organisation has defined and validates its minimum retention period; the cited section does not prescribe one universal figure.

“If the building already has CCTV, the bank does not need to assess it.”
ABS states that building-managed CCTV supporting the FI’s security programme should still be assessed.

“If all cameras are online, the CCTV system is compliant with its intended design.”
ABS specifically recommends checks on image quality, recording, retention and approved field of view.

A practical CCTV design process for financial institutions

Based on the structure of the ABS guideline, a sensible consulting process is:

1. Identify the assets and areas requiring protection.

Understand entrances, restricted spaces, critical assets and high-value operations.

2. Identify the applicable threats and vulnerabilities.

Determine what the CCTV system is expected to detect, deter or document.

3. Define the required surveillance purpose.

For each location, determine what useful information is required from the camera.

4. Determine camera positions and technical performance.

Use the appropriate technical standards and project requirements rather than assuming the ABS guideline itself supplies every specification.

5. Establish recording and retention requirements.

Define required retention before sizing storage.

6. Establish monitoring and escalation.

Determine whether monitoring is on-site, building-managed, remotely operated or a combination.

7. Protect the recording infrastructure and access to footage.

Consider both physical security and data governance.

8. Commission and verify the system.

Confirm that the approved field of view, recordings and intended security function have actually been achieved.

9. Maintain and periodically test the system.

Verify image quality, recording, retention and field of view throughout the system lifecycle.

This sequence is consistent with the wider ABS philosophy that security controls should be derived from identified risks rather than selected in isolation.

ABS CCTV checklist for a financial institution

When reviewing a CCTV design, a security manager or consultant should at minimum be able to answer:

• What risk is each camera addressing?
• Which entrances and access-control points require coverage?
• Which restricted or critical areas require surveillance?
• What image is required at each location?
• Is lighting adequate?
• Is the camera angle appropriate?
• Is footage recorded?
• What retention period has the organisation established?
• Has storage been designed to achieve that period?
• Who can access recordings?
• Where is the recording equipment located?
• Is the recording infrastructure protected?
• Does PDPA apply to the way footage is handled?
• Who monitors the system?
• Is monitoring on-site or off-site?
• What happens when an incident is detected?
• Is there an escalation procedure?
• Can critical CCTV equipment continue during relevant utility interruptions?
• Is there a preventive-maintenance programme?
• Are image quality, recording, retention and field of view periodically verified?

Those questions are generally more useful than asking only:

“How many cameras do we need?”

Conclusion

The ABS Physical Security Guidelines 2.0 does not provide a single universal CCTV specification for every financial institution in Singapore.

Instead, it establishes a risk-based CCTV approach.

Cameras should be positioned according to identified security risks and the areas requiring protection. CCTV should form part of a broader system that includes access control, intrusion detection, monitoring, people, procedures and response.

For more detailed technical CCTV requirements, ABS itself directs financial institutions towards GEBSS and the SPF Video Surveillance System Standard for Buildings.

The key principle is therefore:

Do not begin with the camera specification. Begin with the security outcome the camera is expected to achieve.

That is the difference between installing CCTV and designing an effective surveillance system.