diff --git a/frontend/src/features/admin-form/settings/SettingsService.ts b/frontend/src/features/admin-form/settings/SettingsService.ts
index dbb10843b7..5e2e1a8f77 100644
--- a/frontend/src/features/admin-form/settings/SettingsService.ts
+++ b/frontend/src/features/admin-form/settings/SettingsService.ts
@@ -222,7 +222,7 @@ const updateFormSettings = async (
 // TODO: update this to work with backend
 export const updateFormWhitelistSetting: UpdateStorageFormWhitelistSettingFn =
   async (formId: string, whitelistCsvString: Promise<string> | null) => {
-    return ApiService.putForm<FormSettings>(
+    return ApiService.put<FormSettings>(
       `${ADMIN_FORM_ENDPOINT}/${formId}/settings/whitelist`,
       {
         whitelistCsvString: await whitelistCsvString,
diff --git a/src/app/modules/form/admin-form/admin-form.controller.ts b/src/app/modules/form/admin-form/admin-form.controller.ts
index 8f8473bb6a..946a86b7cc 100644
--- a/src/app/modules/form/admin-form/admin-form.controller.ts
+++ b/src/app/modules/form/admin-form/admin-form.controller.ts
@@ -5,7 +5,6 @@ import { celebrate, Joi as BaseJoi, Segments } from 'celebrate'
 import { AuthedSessionData } from 'express-session'
 import { StatusCodes } from 'http-status-codes'
 import JSONStream from 'JSONStream'
-import multer from 'multer'
 import { ResultAsync } from 'neverthrow'
 
 import {
@@ -1657,29 +1656,24 @@ export const handleDeleteWorkflowStep: ControllerHandler<
 }
 
 const TWENTY_MB_IN_BYTES = 20 * 1024 * 1024
-const handleWhitelistSettingMultipartBody = multer({
-  limits: {
-    fieldSize: TWENTY_MB_IN_BYTES,
-    fields: 1, // only allow csv string field
-    files: 0,
-  },
-})
-
 const _handleUpdateWhitelistSettingValidator = celebrate({
-  [Segments.PARAMS]: {
+  [Segments.PARAMS]: Joi.object({
     formId: Joi.string()
       .required()
       .pattern(/^[a-fA-F0-9]{24}$/)
       .message('Your form ID is invalid.'),
-  },
-  [Segments.BODY]: {
+  }),
+  [Segments.BODY]: Joi.object({
     whitelistCsvString: Joi.string()
+      .allow(null) // for removal of whitelist
+      .max(TWENTY_MB_IN_BYTES)
       .pattern(/^[a-zA-Z0-9,\r\n]+$/)
       .messages({
         'string.empty': 'Your csv is empty.',
         'string.pattern.base': 'Your csv has one or more invalid characters.',
+        'string.max': 'Your csv is too large.',
       }),
-  },
+  }),
 })
 
 const _parseWhitelistCsvString = (whitelistCsvString: string | null) => {
@@ -1792,7 +1786,6 @@ export const _handleUpdateWhitelistSettingForTest =
   _handleUpdateWhitelistSetting
 
 export const handleUpdateWhitelistSetting = [
-  handleWhitelistSettingMultipartBody.none(), // expecting string field
   _handleUpdateWhitelistSettingValidator,
   _handleUpdateWhitelistSetting,
 ] as ControllerHandler[]