You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 3, 2026

Bank of Thailand Proposes New Digital Channel Security Standards

Subscribe to Updates

On July 23, 2026, the Bank of Thailand (BOT) released for public comment its draft Notification on Digital Channel Security, which would significantly expand the scope and stringency of Thailand’s existing mobile banking security framework. If finalized in its current form, the draft notification would extend mandatory security requirements to credit card providers and credit providers, cover internet banking in addition to mobile applications, phase out SMS one-time passwords (OTPs) for transaction authentication, and introduce biometric verification requirements for high-value transactions. The public comment period is open through August 24, 2026.

Background

The BOT’s existing Mobile Banking Security Notification, issued in 2024, sets minimum security standards for financial institutions, specialized financial institutions (SFIs), and e-money providers, significantly reducing “money-draining app” fraud. However, fraudsters have since shifted to nonbank providers and internet banking channels, prompting the BOT to propose broader security requirements.

Expanded Scope of Regulated Entities and Channels

The existing Mobile Banking Security Notification covers only financial institutions, SFIs, and e-money providers offering mobile banking services. The draft expands coverage in two key areas: entities and channels. On the entity side, it adds credit card providers and credit providers that offer fund transfers to third parties at other financial service providers or that provide cash withdrawal services to individual retail customers. On the channel side, it broadens coverage to include internet banking in addition to mobile banking.

Strengthened Customer Authentication

The draft introduces enhanced authentication requirements in three areas:

  • Service enrollment and device changes. Providers must implement rigorous identity verification, notify customers of enrollment results through out-of-band communication channels, and adopt risk-mitigation measures such as cooling-off periods and temporary transaction limits.
  • Transaction-level authentication. Providers must use two-factor authentication for fund transfers, cardless ATM withdrawals, and transaction limit increases.
  • Secure authentication factors. Key requirements include the following:
    • “What-you-know” factors must protect against brute-force attacks.
    • “What-you-have” factors must use secure methods such as a registered mobile application with device binding or hard/soft tokens.
    • SMS OTPs must be discontinued for transaction authentication.
    • Biometric factors must use effective antispoofing technology, such as facial scanning, in compliance with the BOT’s guidelines on biometric technology in financial services.

Providers must cease sending SMS messages and emails containing embedded links and must establish incident response processes for counterfeit applications or websites.

Mobile Application Security Controls

Providers must ensure application integrity and block remote-access applications. Facial comparison with antispoofing technology is required for transfers exceeding THB 50,000 (approx. USD 1,490) per transaction or THB 200,000 (approx. USD 5,960) per day.

Next Steps

Affected financial service providers should assess their current systems against the draft requirements and consider submitting comments to the BOT by August 24, 2026.

Related Professionals

Industries

Fintech

Technology

Practices

Banking and Finance

Location

RELATED INSIGHTS​ 

August 26, 2021
Background In Thailand, bad-faith domain name registrations can present a unique challenge to brand owners. According to the current domain registration policy, Thai domain names can be based on the registered name of a company or organization, or on a registered trademark, depending on the domain name category. When Thailand’s domain name registrar, the Thai Network Information Centre Foundation (THNIC), considers applications for new domain names, it examines only whether the applicant meets these criteria – and not whether the application has been led in bad faith, such as when a registered company uses someone else’s registered trademark without authorization. Domain name registration in Thailand is a first-to-file system, so if all criteria are met, THNIC must allow registration. There are no opposition or cancellation proceedings, making it impossible for an interested person, as well as THNIC itself, to invalidate a Thai-registered domain name. Disputes between two legitimate owners Disputes sometimes arise between trademark owners and Thai-registered companies, such as third-party companies, local distributors, or even authorized trademark licensees who exploit the policy gap identified above. For instance, in a recent case a brand owner found that its Thailand distributor had been able to register a company name containing its registered trademark, and subsequently register such name as a domain name, without the trademark owner’s consent. Fortunately, the two parties had a strong existing business relationship as supplier and distributor; through amicable negotiation, the local distributor agreed to withdraw the disputed domain name. However, if both parties had insisted on their legitimate rights over the disputed name, the case would have had to proceed to court, as THNIC does not get involved in such disputes and offers no dispute resolution mechanisms. Navigating the options Trademark owners facing such a dispute have two options: initiating proceedings with the Intellectual Property
Read More
August 18, 2021
On July 15, 2021, Thailand’s Electronic Transactions Development Agency (ETDA) announced a public hearing for their draft royal decree to regulate digital platforms (particularly e-commerce and e-service platforms) that provide services to people in Thailand. The draft royal decree is to be issued under the country’s Electronic Transactions Act B.E. 2544 (2001) and will be of particular concern to digital platform operators, which are defined as operators of intermediary digital platforms that provide a connection space for platform users to offer goods, services, or intangible property via a computer network, regardless of whether a contract is made on the digital platform. The key elements of the current draft royal decree are as follows: Extraterritorial scope. Operators of digital platforms located outside Thailand may be subject to the royal decree if the platform is intended to provide services to people in Thailand (evidenced by actions such as inclusion of Thai language, Thai currency, Thai domain names, and so on). Appointment of a local representative. A foreign digital platform operator that falls under the extraterritorial scope of the royal decree must appoint a local representative in Thailand, without limitation of liability. Notification requirements. Regulated digital platform operators must notify the ETDA of their operations via an online submission channel. The ETDA will also develop an online channel for consumers to check or verify the list of regulated digital platform operators. Further notification requirements and procedures are to be prescribed by the ETDA later. Platform-related requirements. The draft royal decree also sets various platform-related requirements, depending on the size of the digital platform operator (to be specified later). These requirements relate to the following: Terms and conditions; Content display; Content rating; Feedback mechanisms; Dispute settlement; Access and use of data; Control of advertisements; Notice and takedown measures; User verification processes; Suspension of
Read More
July 26, 2021
Laos’ first law specifically addressing contracts for electronic transactions comes as a relief to operators who had previously been left to interpret laws on contracts generally in a context for which they were not designed.
Read More