You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

March 14, 2025

Bank of Thailand Releases Draft Guidelines for Digital Fraud Management

Subscribe to Updates

The Bank of Thailand (BOT) has published the Draft Guidelines for Digital Fraud Management, which aim to help financial service providers tackle digital fraud and ensure safety and trust in the Thai financial system. These draft guidelines, which are available for public comment until March 18, 2025, provide a comprehensive framework for financial service providers, covering prevention, detection, management, and resolution of digital fraud, as well as support for customers affected by fraud.

The BOT tentatively plans to implement these draft guidelines on April 1, 2025, along with circular letters on the minimum required measures for tackling “mule accounts” (deposit or e-money accounts used as tools to receive and transfer funds obtained through the commission of any offense) and measures to strengthen Thailand’s customer due diligence and enhanced due diligence procedures.

Under the draft guidelines, “financial service providers” include financial institutions and special financial institutions under the Financial Institution Business Act and payment providers under the Payment Systems Act.

Commercial banks, special financial institutions, and operators of transferable e-money services must adhere to every requirement in the draft guidelines. Other financial service providers (e.g., payment providers other than operators of transferable e-money services) can implement the draft guidelines as deemed appropriate to their services, products, and service channels.

Digital Fraud Management Requirements

The draft guidelines establish the following key requirements:

  • Policy and oversight. Directors and senior executives of financial service providers must set and adopt appropriate “end-to-end” fraud management policies and KPIs to manage digital fraud, covering prevention, monitoring, detection, management, resolution, and support for affected customers.
  • Fraud management processes. Financial service providers must establish a clear framework for managing digital fraud throughout the customer lifecycle, from customer onboarding to service termination, according to industry standards at a minimum and covering at least the following processes:
    • Know your customer (KYC) and customer due diligence (CDD): Providers must implement risk assessment processes to identify potential mule accounts, continuously monitor customer transaction behaviors, and regularly review and update customers’ risk levels. In addition, authentication processes must suit the (1) risk level of the transaction, (2) products and services, and (3) service channel.
    • Fraud monitoring and detection: Providers must develop proactive processes to detect and monitor unusual transactions and utilize data from various sources to identify potential mule accounts and fraud. This may involve adopting new technologies (e.g., artificial intelligence) to enhance efficacy and stay ahead of emerging fraud techniques.
    • Action and response to fraud: Providers must develop swift and appropriate measures to prevent, limit, and promptly mitigate digital fraud damage (e.g., by providing alerts to customers), including handling suspected mule accounts. They must also respond clearly, fairly, and swiftly to support customers affected by scams (e.g., by offering 24/7 customer support through dedicated hotlines and electronic channels, having service level agreements with timeframes to assist customers affected by fraud incidents, and reporting to the BOT any incidents that cause widespread customer damage or affect the financial service provider’s reputation).
  • Information sharing. Financial service providers must have mechanisms to share accurate information in a timely manner with one another and with relevant external agencies (e.g., Anti-Money Laundering Office, Royal Thai Police) to enhance collective fraud management efforts, and must appoint responsible persons to coordinate and procure information necessary for any investigations.
  • Awareness. Financial service providers must proactively raise customers’ and the public’s awareness of digital fraud to prevent and reduce potential damage. Required actions include implementing a practical method on an easily accessible service channel (e.g., mobile app or infographic on social media) at least once a month, and having customers take awareness tests when using mobile banking and transferable e-money services.
Related Professionals

Industries

Fintech

Practices

Banking and Finance

Location

RELATED INSIGHTS​ 

November 14, 2024
In recent years, Thailand has taken significant steps to regulate and integrate digital assets into its financial ecosystem. This article explores the regulatory framework governing digital asset businesses in Thailand, focusing on the key legislation, regulated activities, and recent developments in this rapidly evolving sector. Regulatory Environment In 2018, Thailand enacted the Emergency Decree on Digital Asset Businesses, marking a pivotal moment in the country’s approach to cryptocurrencies and digital tokens. This decree, supervised by the Securities and Exchange Commission (SEC) and the Ministry of Finance, provides a comprehensive regulatory framework for both the primary and secondary markets of digital assets. For the primary market, the decree regulates the issuance and sale of digital assets through initial coin offerings (ICOs). A key feature of this regulation is the requirement for ICOs to be conducted through SEC-approved ICO portals. This approach aims to provide a structured and supervised environment for companies seeking to raise funds through digital token sales. In the secondary market, the decree outlines the regulatory framework for various digital asset intermediaries, including digital asset exchanges, brokers, dealers, advisory services, fund managers, and custodians. In implementing its digital asset-related policies, the SEC imposes ongoing obligations on licensed digital asset intermediaries. These include restrictions on the listing of certain digital assets on digital asset exchanges, and limitations on intermediaries facilitating digital assets as a means of payment. Regulatory Trends and Outlook The SEC has demonstrated a commitment to regularly revising its digital asset regulations to keep pace with global trends and market developments. A notable example of this approach is the SEC’s efforts to refine the classification of nonregulated ready-to-use utility tokens by dividing these tokens into two groups: Group 1: Ready-to-use utility tokens issued for consumption purposes or as a digital representation of a certificate (e.g., NFTs with
Read More
November 4, 2024
Crowdfunding has emerged as a promising option for raising capital, particularly for startups and small businesses. In Thailand, investment-based crowdfunding falls primarily under the regulatory purview of the Securities and Exchange Commission (SEC). The SEC is responsible for licensing and overseeing crowdfunding portals, ensuring compliance with regulatory requirements while ensuring investor protection and market integrity. The crowdfunding regulations in Thailand allow non-publicly traded companies to raise funds by offering equity and debentures for sale through SEC-licensed crowdfunding portals. This framework opens new possibilities for businesses seeking alternative funding sources and for investors looking for new opportunities.  Crowdfunding Portals Under Thai regulations, “crowdfunding portals” are defined as websites, mobile phone applications, or other similar electronic media developed for offering securities for sale. To operate a crowdfunding portal in Thailand, applicants must meet several key requirements: Incorporation: The applicant must be incorporated in Thailand. This requirement ensures that the portal operator has a significant local presence and is subject to Thai law. Minimum capital: A minimum paid-up registered capital of THB 5 million is required. This capital requirement helps ensure that portal operators have sufficient financial resources to maintain their operations. Operational readiness: The applicant must have crowdfunding portal systems ready for use upon applying to the SEC for approval to operate. This requirement demonstrates the applicant’s technical capability and readiness to provide crowdfunding services. These requirements are designed to ensure that crowdfunding portal operators are well-capitalized, technologically prepared, and committed to operating within the Thai market. Business and Investment Implications The regulatory framework for crowdfunding in Thailand offers non-publicly traded companies with an additional avenue for raising funds, as licensed crowdfunding portals provide a structured and regulated environment for fundraising. However, companies must ensure compliance with SEC regulations when offering securities through these platforms. For investors, crowdfunding offers new investment
Read More
October 21, 2024
One key component of Thailand’s support for the development of fintech innovations is its sandbox framework, supervised by the Bank of Thailand (BOT). This framework supports business operators in experimenting with new technologies under controlled conditions. This article explores the structure and significance of the BOT’s sandbox program in driving fintech innovation in Thailand. The BOT Sandbox Framework In June 2024, the BOT updated its sandbox framework to provide a more comprehensive and flexible environment for testing fintech innovations. The framework allows participants to experiment with their ideas in a controlled and limited environment, balancing the need for innovation with the imperative of maintaining financial stability and consumer protection. Three Types of Sandboxes The BOT’s framework encompasses three distinct types of sandboxes: the Regulatory Sandbox, the Own Sandbox, and the Enhanced Regulatory Sandbox. Regulatory Sandbox The Regulatory Sandbox is a mandatory testing ground for certain BOT-licensed financial services to ensure that potentially impactful innovations are tested and evaluated before wide-scale implementation. Participation in this sandbox is a prerequisite for: License applications for specific financial services. Implementation of new technologies or innovations in existing licensed services. Financial services that have the potential to become a structural element or standard of the Thai financial sector. A prime example of a service requiring participation in the Regulatory Sandbox is the Thai QR code payment via PromptPay system, which involved various banks several years ago until the Bank of Thailand granted permission for these services to be provided to the general public. Own Sandbox The Own Sandbox is an optional program that the BOT encourages for financial service providers and fintech operators implementing new technologies. This sandbox provides a more flexible environment for testing innovations that may not require the same level of regulatory scrutiny as those in the Regulatory Sandbox. Enhanced Regulatory
Read More
October 20, 2024
Following the U.S. Securities and Exchange Commission’s approval of spot Bitcoin ETFs, Thailand’s Securities and Exchange Commission (SEC) is reassessing regulations on the investments of mutual funds and private funds (collectively “Funds”). The SEC has launched a public consultation on new draft notifications introducing  the new asset classes that can be held by Funds, and aims to bring these rules into effect on January 1, 2025. The highlights of these changes are set out below. Eligible New Asset Classes The new asset classes that can be held by Funds can be categorized into two types—investment tokens and crypto assets—and the determination will focus on substance over form. Investment tokens: If the substance involves raising funds, regardless of what the assets are called, and they are legally issued and offered or approved by home regulators that are members of the International Organization of Securities Commissions (IOSCO), Funds can invest in these types of assets as transferable securities within the permitted ratio. Crypto assets: The eligible crypto assets which Funds are entitled to hold focus on crypto ETFs or offshore funds investing in crypto assets, and they are subject to investment limits. Funds can hold crypto assets directly, but only temporarily, and only for the purpose of purchasing, selling, or exchanging the crypto assets, not speculative purposes. The notifications state that Funds may hold Bitcoin/Ethereum for no longer than five business days and USDT/USDC for no more than one month. Investment Limits Typically, the rules segregate investment limits into listed and non-listed digital assets, and the limits depend on the sophistication of the investors in the Funds. In general, UI Funds (mutual funds offered to institutional investors or ultra-high net worth investors) can invest in these new asset classes without any limitations, although net exposure to other crypto assets  –  which
Read More