You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 3, 2026

Bank of Thailand Proposes New Digital Channel Security Standards

Subscribe to Updates

On July 23, 2026, the Bank of Thailand (BOT) released for public comment its draft Notification on Digital Channel Security, which would significantly expand the scope and stringency of Thailand’s existing mobile banking security framework. If finalized in its current form, the draft notification would extend mandatory security requirements to credit card providers and credit providers, cover internet banking in addition to mobile applications, phase out SMS one-time passwords (OTPs) for transaction authentication, and introduce biometric verification requirements for high-value transactions. The public comment period is open through August 24, 2026.

Background

The BOT’s existing Mobile Banking Security Notification, issued in 2024, sets minimum security standards for financial institutions, specialized financial institutions (SFIs), and e-money providers, significantly reducing “money-draining app” fraud. However, fraudsters have since shifted to nonbank providers and internet banking channels, prompting the BOT to propose broader security requirements.

Expanded Scope of Regulated Entities and Channels

The existing Mobile Banking Security Notification covers only financial institutions, SFIs, and e-money providers offering mobile banking services. The draft expands coverage in two key areas: entities and channels. On the entity side, it adds credit card providers and credit providers that offer fund transfers to third parties at other financial service providers or that provide cash withdrawal services to individual retail customers. On the channel side, it broadens coverage to include internet banking in addition to mobile banking.

Strengthened Customer Authentication

The draft introduces enhanced authentication requirements in three areas:

  • Service enrollment and device changes. Providers must implement rigorous identity verification, notify customers of enrollment results through out-of-band communication channels, and adopt risk-mitigation measures such as cooling-off periods and temporary transaction limits.
  • Transaction-level authentication. Providers must use two-factor authentication for fund transfers, cardless ATM withdrawals, and transaction limit increases.
  • Secure authentication factors. Key requirements include the following:
    • “What-you-know” factors must protect against brute-force attacks.
    • “What-you-have” factors must use secure methods such as a registered mobile application with device binding or hard/soft tokens.
    • SMS OTPs must be discontinued for transaction authentication.
    • Biometric factors must use effective antispoofing technology, such as facial scanning, in compliance with the BOT’s guidelines on biometric technology in financial services.

Providers must cease sending SMS messages and emails containing embedded links and must establish incident response processes for counterfeit applications or websites.

Mobile Application Security Controls

Providers must ensure application integrity and block remote-access applications. Facial comparison with antispoofing technology is required for transfers exceeding THB 50,000 (approx. USD 1,490) per transaction or THB 200,000 (approx. USD 5,960) per day.

Next Steps

Affected financial service providers should assess their current systems against the draft requirements and consider submitting comments to the BOT by August 24, 2026.

Related Professionals

Industries

Fintech

Technology

Practices

Banking and Finance

Location

RELATED INSIGHTS​ 

June 8, 2023
At a conference organized by Vietnam’s Ministry of Public Security (MPS) on June 7, 2023, government officials provided more guidance on the recently issued Personal Data Protection Decree (PDPD), which is set to take effect on July 1, 2023. Key takeaways included the following: A national portal on personal data protection for online submission of notifications and registrations will be launched before July 1, 2023. The MPS also plans to issue templates for data processing impact assessments (DPIAs) and transfer impact assessments (TIAs) in the near future. The PDPD requires data controllers, data processors, and data controller-processors to prepare a DPIA at the start of personal data processing. The MPS clarified that the DPIA is expected to be prepared and submitted once. Only changes to its content would require submission of an updated DPIA. Both DPIAs and TIAs (which are for cross-border data transfers) must be prepared in Vietnamese. Since the sale and purchase of personal data is strictly prohibited unless explicitly permitted by law, the MPS has handled approximately 14 cases involving unlawful trading of personal data, including sensitive data. Under the PDPD, sensitive data has a broader definition than under the GDPR (the European Union’s General Data Protection Regulation), and also includes location data, creditworthiness, and personal financial data. Consent is not a legal basis for the trading of personal data, including sensitive data. The 72-hour timeline for responding to a data subject’s request does not mean 72 working or business hours. Rather, it means 72 actual consecutive hours. Any organization transferring the personal data of Vietnamese citizens outside of Vietnam must comply with the PDPD, regardless of the organization’s location. For organizations incorporated overseas that must comply with the PDPD, there is no requirement to appoint a local representative (unlike the GDPR)—but appointment of a data
Read More
June 2, 2023
In Southeast Asia, artificial intelligence (AI) products and services are being leveraged across industries such as finance, healthcare, retail, agriculture, and manufacturing. Governments across the region are recognizing the benefits of harnessing AI and the positive impact of AI technology on economic development. As the rise in AI deployment creates opportunities for economic growth in Southeast Asia, regulatory and digital governance efforts should focus on ethical, inclusivity, and cybersecurity concerns to help ensure that the widespread use of AI technology in the region is sustainable. Two jurisdictions in the region that have already made significant strides in developing initiatives surrounding AI are Singapore and Thailand. Singapore Due to its more advanced technological infrastructure, Singapore was one of the first countries in the region to address AI-related issues. Singapore has been aligning its data protection policies and regulations with the changing digital landscape since 2012—the year Singapore passed its Personal Data Protection Act. In 2019, Singapore unveiled its National AI Strategy to increase the use of AI technologies and deploy “scalable, impactful AI solutions in key verticals by 2030.” The goal is to align talent, regulation, and business growth to ensure AI applications serve society. Singapore’s approach is to facilitate innovation while safeguarding consumer interests, as it strives to become one of the regional leaders in the field of AI. In terms of Singapore’s regulatory landscape, Singapore’s Personal Data Protection Commission (PDPC) oversees data and AI, including AI developers and AI-using companies, which consist of backroom operations, front-end usage companies, and distributors of equipment with AI features. The Singapore Academy of Law (SAL) oversees all laws applicable to AI systems and decides on issues that impact the AI industry. Singapore has joined various bilateral and regional trade arrangements to facilitate research, development, and collaboration in support of its growing digital
Read More
May 24, 2023
The draft Royal Decree on Artificial Intelligence System Service Business, which was introduced by the Office of the National Digital Economy and Society Commission earlier for public comment in October last year, focuses on potential risks from artificial intelligence (AI) systems to public health, safety, and freedoms. The framework emphasizes the importance of risk assessment, reporting requirements, and the establishment of specific measures and criteria deemed necessary to minimize AI risks. AI Systems Defined by the Decree Under the draft royal decree, an AI system is defined as a machine-based system that can make predictions, recommendations, or decisions that affect real or virtual environments pursuant to the objectives set by humans. The definition clarifies that artificial intelligence systems are designed to operate at different levels of autonomy, including: machine learning AI; logic-based and knowledge-based AI; statistical AI; Bayesian estimation AI; and search and optimization AI. Risk-based Approach The draft AI royal decree takes a risk-based approach to regulation and specifically identifies prohibited or high-risk AI services that could cause harm or engage in unethical practices to ensure that AI systems do not pose major risks to public health, safety, or freedoms. The extent of regulatory scrutiny applied to an AI system corresponds to the level of risk presented by the AI system. For example, AI systems that pose unacceptable risks are generally prohibited, AI systems considered to be high-risk are subject to a conformity assessment, and AI systems considered to be limited-risk are subject to transparency requirements. Compliance with specified criteria and procedures to minimize potential risks of each AI service would be further outlined in subregulations. Prohibited AI Systems The draft AI royal decree prohibits AI systems that: employ subliminal techniques to covertly influence human behavior (below the threshold of conscious awareness); utilize social scoring; access sensitive personal
Read More
May 17, 2023
In Myanmar, a Union Tax Law is enacted each year to announce the rates of tax set out in the Income Tax Law 1974, the Commercial Tax Law 1990, and the Special Goods Tax Law 2016. The Union Tax Law 2023 (UTL 2023) came into force on April 1, 2023. It sets the rates of special goods tax (SGT), income tax (IT), and commercial tax (CT) for the period of April 1, 2023, to March 31, 2024, and exempts certain goods and services from these taxes. The key changes implemented by the UTL 2023 are summarized below. Special Goods Tax The UTL 2023 exempts battery electric vehicles (BEVs) from SGT. At the same time, it increases the rate of SGT on imported liquor. Previously, the rate of SGT ranged from 190 MMK per liter to 60 percent of the per-liter price of imported liquor in the previous fiscal year. The UTL 2023 raises the minimum rate to 209 MMK per liter while leaving the upper rate unchanged. Commercial Tax and Customs Tariffs BEVs imported into Myanmar were made exempt from CT under the Law Amending the Union Tax Law 2022. The UTL 2023 extends the exemption until the end of the 2023–24 fiscal year, along with two- and three-wheeler BEVs, BEV batteries, and related parts for specific use in BEVs. The CT exemption for battery charging services for BEVs, also introduced in 2022, has similarly been extended. Following enactment of the UTL 2023, the Ministry of Planning and Finance (MOPF) issued Notification No. 31/2023, reducing to zero the customs tariffs on imported BEVs, including those imported completely built up (CBU), completely knocked down (CKD), or semi-knocked down (SKD). The tariffs on spare parts and materials for BEVs have also been reduced to zero. In addition to exempting BEVs from
Read More