You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 3, 2026

Bank of Thailand Proposes New Digital Channel Security Standards

Subscribe to Updates

On July 23, 2026, the Bank of Thailand (BOT) released for public comment its draft Notification on Digital Channel Security, which would significantly expand the scope and stringency of Thailand’s existing mobile banking security framework. If finalized in its current form, the draft notification would extend mandatory security requirements to credit card providers and credit providers, cover internet banking in addition to mobile applications, phase out SMS one-time passwords (OTPs) for transaction authentication, and introduce biometric verification requirements for high-value transactions. The public comment period is open through August 24, 2026.

Background

The BOT’s existing Mobile Banking Security Notification, issued in 2024, sets minimum security standards for financial institutions, specialized financial institutions (SFIs), and e-money providers, significantly reducing “money-draining app” fraud. However, fraudsters have since shifted to nonbank providers and internet banking channels, prompting the BOT to propose broader security requirements.

Expanded Scope of Regulated Entities and Channels

The existing Mobile Banking Security Notification covers only financial institutions, SFIs, and e-money providers offering mobile banking services. The draft expands coverage in two key areas: entities and channels. On the entity side, it adds credit card providers and credit providers that offer fund transfers to third parties at other financial service providers or that provide cash withdrawal services to individual retail customers. On the channel side, it broadens coverage to include internet banking in addition to mobile banking.

Strengthened Customer Authentication

The draft introduces enhanced authentication requirements in three areas:

  • Service enrollment and device changes. Providers must implement rigorous identity verification, notify customers of enrollment results through out-of-band communication channels, and adopt risk-mitigation measures such as cooling-off periods and temporary transaction limits.
  • Transaction-level authentication. Providers must use two-factor authentication for fund transfers, cardless ATM withdrawals, and transaction limit increases.
  • Secure authentication factors. Key requirements include the following:
    • “What-you-know” factors must protect against brute-force attacks.
    • “What-you-have” factors must use secure methods such as a registered mobile application with device binding or hard/soft tokens.
    • SMS OTPs must be discontinued for transaction authentication.
    • Biometric factors must use effective antispoofing technology, such as facial scanning, in compliance with the BOT’s guidelines on biometric technology in financial services.

Providers must cease sending SMS messages and emails containing embedded links and must establish incident response processes for counterfeit applications or websites.

Mobile Application Security Controls

Providers must ensure application integrity and block remote-access applications. Facial comparison with antispoofing technology is required for transfers exceeding THB 50,000 (approx. USD 1,490) per transaction or THB 200,000 (approx. USD 5,960) per day.

Next Steps

Affected financial service providers should assess their current systems against the draft requirements and consider submitting comments to the BOT by August 24, 2026.

Related Professionals

Industries

Fintech

Technology

Practices

Banking and Finance

Location

RELATED INSIGHTS​ 

April 30, 2025
The Bank of Thailand (BOT) is accepting public comments until May 2, 2025, on three draft notifications that will institute an enhanced supervision scheme and impose additional requirements for systemically important retail payment system (SIRPS) operators to align with international standards and encourage open infrastructure and competition. The SIRPS operators will be determined by the BOT from the “designated payment system operators” under the Payment Systems Act B.E. 2560 (2017). SIRPS Designation The BOT will announce a list of payment system operators designated as SIRPS operators and thus subject to enhanced supervision. The BOT will evaluate whether the payment system operator should be deemed a SIRPS operator when it meets the criteria in either the BOT’s quantitative or qualitative assessments, which cover the following: Quantitative assessment: The payment system’s transaction values, market share, cross-border payment network scale and value, and settlement with other financial market infrastructure. Qualitative assessment: The payment system’s function as a part of the country’s payment system infrastructure, the significance of the system users’ roles in the payment services, the substitutability of the payment system, and the impact level on the public and users in the event of an emergency or system suspension. Supervision of SIRPS Business Operations SIRPS operators will be subject to heightened supervision in three areas, in addition to various BOT regulations on designated payment system supervision, as follows: Governance: SIRPS operators will be required to have a balanced board composition with an independent director and directors with varied expertise, establish subcommittees to assist the board in supervising the operator’s compliance with its policy and strategy, and have senior executives overseeing risk and technology security separately from the executives overseeing business operations. Risk management and security: SIRPS operators will be required to have comprehensive risk management to ensure system stability and security. This
Read More
April 28, 2025
In recent years, Vietnam has positioned itself among the leading countries in the world in terms of digital asset ownership and trading volume. This rapid adoption reflects the country’s growing digital economy and the increasing engagement of individuals and businesses in blockchain-based financial activities. Central to this growth are Resolution No. 57-NQ/TW of the Politburo dated December 22, 2024, on breakthroughs in science, technology, innovation, and national digital transformation with a vision to 2045 (“Resolution 57”) and Resolution No. 03/NQ-CP of the Government dated January 9, 2025, promulgating the Action Plan to Implement Resolution 57 (“Resolution 03”), which outline a flexible and innovative policy framework that embraces pilot programs for emerging technologies to lay the groundwork for Vietnam’s legislative framework concerning cryptocurrency and blockchain technologies. Regulatory clarity in terms of digital assets and blockchain technologies is now more critical than ever for businesses and investors. In light of this, Vietnam is currently in the process of introducing three key legal instruments, with drafts of the Law on Digital Technology Industry (“Draft DTI Law”), Resolution of the National Assembly on the Establishment of Regional and International Financial Centers in Vietnam (“Draft Financial Center Resolution”), and Resolution of the Government on the Pilot Implementation of Crypto Asset Markets in Vietnam (“Draft Crypto Pilot Resolution”) nearing promulgation. Current Regulatory Direction and Schedule Vietnam’s regulatory framework for crypto assets and blockchain has been in a developmental stage since 2017, focusing on directions, plans, and schedules rather than established regulations. In February 2024, under Decision No. 194/QD-TTg of the Prime Minister, the Ministry of Finance (MOF) was assigned to draft a legal framework to either prohibit or regulate virtual assets and service providers by May 2025, signaling a clearer regulatory direction. In March 2025, Directive No. 05/CT-TTg of the Prime Minister directed the MOF
Read More
April 18, 2025
On April 12, 2025, Thailand published an amendment to the Emergency Decree on Measures for the Prevention and Suppression of Technological Crimes in the Government Gazette, with the regulation taking effect the following day. Drafts of the amendment had been shared in recent months, and the final amendment of the decree contains some additional key revisions, such as narrowing the business operators subject to the decree’s requirements, reducing operators’ obligations, and establishing collaboration between relevant stakeholders to tackle technology crime. These key revisions to the amendment are detailed below. Business operators subject to the decree: The business operators covered under the decree now include only payment service providers under the Payment System Act and digital asset operators under the Royal Decree on Digital Asset Businesses. Digital platform services under the Royal Decree on Digital Platform Service Businesses That Are Subject to Prior Notification are no longer within the scope of the decree. Definition of technology crime: The final version of the amendment removed the expanded definition of technology crime that had been included in a previous draft, leaving the decree’s existing definition unchanged. Telecommunications provider obligations: Mobile and telecommunications service providers now have an obligation to monitor and screen for content that may be related to technology crime and suspend SIM cards when instructed to do so by the National Broadcasting and Telecommunications Commission (NBTC). Transaction and account suspension: The amendment removes the decree’s complex transaction suspension procedures and leaves room for business-specific regulators (e.g., Bank of Thailand, Securities and Exchange Commission, NBTC) to impose various technology crime suspension requirements on business operators under their supervision. The newly established Center for Prevention and Suppression of Technology Crimes can also notify financial institutions and business operators of names or digital asset wallet addresses that may be related to technology crime,
Read More
April 18, 2025
On April 12, 2025, Thailand issued an amended digital asset regulation that covers offshore digital asset businesses providing services on a cross-border basis to Thai users. These businesses will now be subject to the licensing requirements of the Royal Decree on Digital Asset Business Operations B.E. 2561 (2018), which is supervised by Thailand’s Securities and Exchange Commission (SEC). A digital asset business will be deemed as providing services in Thailand—and therefore subject to requirements under the Royal Decree on Digital Asset Business Operations—if the business does any of the following: Displays content in Thai, either fully or partially; Is registered under a “.th,” or “.ไทย” domain, contains any name relating to Thailand, or uses a domain written in Thai characters; Allows or requires payments in Thai baht (THB) or receives payments through Thai bank accounts or e-wallets; Chooses Thai law to govern transactions or Thai courts to litigate any dispute; Pays online search engines to attract users in Thailand to its services; Has an office, establishment, or personnel in Thailand to support or assist users within the country; or Meets any other criteria specified by the SEC. To operate legally in Thailand, offshore operators meeting any of the above criteria will be required to incorporate a local company in Thailand in order to apply for a digital asset business license with the SEC.
Read More