You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 3, 2026

Bank of Thailand Proposes New Digital Channel Security Standards

Subscribe to Updates

On July 23, 2026, the Bank of Thailand (BOT) released for public comment its draft Notification on Digital Channel Security, which would significantly expand the scope and stringency of Thailand’s existing mobile banking security framework. If finalized in its current form, the draft notification would extend mandatory security requirements to credit card providers and credit providers, cover internet banking in addition to mobile applications, phase out SMS one-time passwords (OTPs) for transaction authentication, and introduce biometric verification requirements for high-value transactions. The public comment period is open through August 24, 2026.

Background

The BOT’s existing Mobile Banking Security Notification, issued in 2024, sets minimum security standards for financial institutions, specialized financial institutions (SFIs), and e-money providers, significantly reducing “money-draining app” fraud. However, fraudsters have since shifted to nonbank providers and internet banking channels, prompting the BOT to propose broader security requirements.

Expanded Scope of Regulated Entities and Channels

The existing Mobile Banking Security Notification covers only financial institutions, SFIs, and e-money providers offering mobile banking services. The draft expands coverage in two key areas: entities and channels. On the entity side, it adds credit card providers and credit providers that offer fund transfers to third parties at other financial service providers or that provide cash withdrawal services to individual retail customers. On the channel side, it broadens coverage to include internet banking in addition to mobile banking.

Strengthened Customer Authentication

The draft introduces enhanced authentication requirements in three areas:

  • Service enrollment and device changes. Providers must implement rigorous identity verification, notify customers of enrollment results through out-of-band communication channels, and adopt risk-mitigation measures such as cooling-off periods and temporary transaction limits.
  • Transaction-level authentication. Providers must use two-factor authentication for fund transfers, cardless ATM withdrawals, and transaction limit increases.
  • Secure authentication factors. Key requirements include the following:
    • “What-you-know” factors must protect against brute-force attacks.
    • “What-you-have” factors must use secure methods such as a registered mobile application with device binding or hard/soft tokens.
    • SMS OTPs must be discontinued for transaction authentication.
    • Biometric factors must use effective antispoofing technology, such as facial scanning, in compliance with the BOT’s guidelines on biometric technology in financial services.

Providers must cease sending SMS messages and emails containing embedded links and must establish incident response processes for counterfeit applications or websites.

Mobile Application Security Controls

Providers must ensure application integrity and block remote-access applications. Facial comparison with antispoofing technology is required for transfers exceeding THB 50,000 (approx. USD 1,490) per transaction or THB 200,000 (approx. USD 5,960) per day.

Next Steps

Affected financial service providers should assess their current systems against the draft requirements and consider submitting comments to the BOT by August 24, 2026.

Related Professionals

Industries

Fintech

Technology

Practices

Banking and Finance

Location

RELATED INSIGHTS​ 

January 4, 2024
On December 25, 2023, Thailand’s Personal Data Protection Committee (PDPC) issued two notifications under sections 28 and 29 of the Personal Data Protection Act 2019 (PDPA) that address essential aspects and criteria for the cross-border transfer of personal data. These notifications are scheduled to come into effect on March 24, 2024. Key points in the notifications are outlined below. Adequate Data Protection Standards (Section 28) Unless otherwise provided by the PDPA, the destination country or international organization that receives the transferred personal data must have “adequate data protection standards,” as determined by the following factors: Legal measures and mechanisms. The destination country or international organization must have legal measures or mechanisms aligned with the personal data protection laws in Thailand. Specifically, the obligations of data controllers need to include providing appropriate security measures, implementing personal data protection measures that are suitable and that enable the exercise of data subjects’ rights, and establishing effective legal remedial measures. Regulatory authority. The presence of an agency or organization entrusted with the duties and authority to enforce laws and regulations related to personal data protection is also a critical factor. In addition, this notification empowers the Office of the PDPC to refer cases, either independently identified or proposed by a data controller, to the PDPC for adjudication. The PDPC retains the discretion to make decisions on a case-by-case basis or to establish a list of destination countries or international organizations that it considers to have adequate data protection standards. Binding Corporate Rules and Appropriate Safeguards (Section 29): In the realm of global data exchange, two prominent mechanisms have emerged as key enablers of secure and compliant transfer of personal data: Binding corporate rules (BCRs). Implementation of BCRs involves enforcing an approved policy for safeguarding personal data transferred among affiliated businesses or within the
Read More
January 2, 2024
Myanmar’s Ministry of Commerce (MOC) has released updated information regarding the registration fees for online retail businesses. The fees and criteria, which are included in the MOC’s Export/Import Newsletter No. 17/2023 dated December 28, 2023, are laid out below. Registration Fees The official registration fees vary depending on the applicant type: Companies or other commercial organizations: MMK 70,000 (approx. USD 33.5) for registration and renewal; MMK 3,000 (approx. USD 1.5) for each amendment. Small and medium enterprises (SMEs): MMK 50,000 (approx. USD 24) for registration and renewal; MMK 3,000 (approx. USD 1.5) for each amendment. Individual applicants: 30,000 MMK (approx. USD 14.5) for registration and renewal; MMK 3,000 (approx. USD 1.5) for each amendment. Validity Period Registrations approved from January 1, 2024, will be valid for two years from the date of grant. The requirement for online retail businesses to register their operations was announced in July 2023. Based on statements from the MOC, online retail businesses need to complete their registration by late January 2024 to avoid potential enforcement actions. Regarding SMEs, the MOC will also evaluate their SME registration certificate issued by the Agency Office under the Small and Medium Enterprises Development Law 2015. For assistance completing the registration process, or for more details on any aspect of online retail operations in Myanmar, contact Tilleke & Gibbins at [email protected].
Read More
December 15, 2023
As part of its membership in Lex Mundi, Tilleke & Gibbins has published an updated edition of its Guide to Doing Business in Thailand for 2023. This guide outlines the key factors for starting and operating a business in the Thai market. Issues covered include: Investment incentives Financial facilities Exchange controls Import and export regulations Structures for doing business Requirements for the Establishment of a Business Operation of the Business Cessation or Termination of the Business Labor legislation, relations, and supply Tax Immigration requirements This publication is part of Lex Mundi’s Country Guides series prepared by member firms in more than 100 jurisdictions worldwide. The guides serve as a useful resource for planning international business strategy and researching new markets. The full Guide to Doing Business in Thailand is available through the button below.
Read More
December 15, 2023
Vietnam’s new Law on Electronic Transactions No. 20/2023/QH15 (LOET 2023) was promulgated by the National Assembly on June 22, 2023, and will replace the existing Law on Electronic Transactions No. 51/2005/QH11 (LOET 2005) when it enters into effect on July 1, 2024. The LOET 2023 is aimed at facilitating transactions carried out in an electronic environment in all sectors. Derived from the fundamental principles of the LOET 2005, the LOET 2023 is similarly considered a framework law, developed based on the Model Law on E-Commerce of the United Nations Commission on International Trade Law (UNCITRAL). The main points of interest of the LOET 2023 are summarized below. 1. Scope of Application Unlike the LOET 2005, which explicitly excludes certain areas such as the issuance of certificates of land use rights and birth certificates from the scope of application, the LOET 2023 covers all areas without exception. However, the LOET 2023 will still not interfere with the regulations of substantive laws that stipulate the content, conditions, and forms of transactions in their respective areas (Article 1.2). The LOET 2023 also provides that it will only be applicable if other laws either allow or remain silent on the electronic execution of transactions; otherwise, if another law specifically does not permit a transaction to be carried out electronically, such law shall apply (Article 1.3). This emphasizes that the applicability of the LOET 2023 depends on the electronic readiness of specific sectors. 2. Enabling E-Transactions in All Sectors For traditional transactions or contracts to be legally valid, they typically require written documentation, the signatures of the involved parties, and the seals of organizations or companies, if required by substantive laws or common practice. Additionally, certain sectors mandate further steps like notarization or certification, such as in property transactions like house sales or inheritance
Read More