You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

March 14, 2025

Bank of Thailand Releases Draft Guidelines for Digital Fraud Management

Subscribe to Updates

The Bank of Thailand (BOT) has published the Draft Guidelines for Digital Fraud Management, which aim to help financial service providers tackle digital fraud and ensure safety and trust in the Thai financial system. These draft guidelines, which are available for public comment until March 18, 2025, provide a comprehensive framework for financial service providers, covering prevention, detection, management, and resolution of digital fraud, as well as support for customers affected by fraud.

The BOT tentatively plans to implement these draft guidelines on April 1, 2025, along with circular letters on the minimum required measures for tackling “mule accounts” (deposit or e-money accounts used as tools to receive and transfer funds obtained through the commission of any offense) and measures to strengthen Thailand’s customer due diligence and enhanced due diligence procedures.

Under the draft guidelines, “financial service providers” include financial institutions and special financial institutions under the Financial Institution Business Act and payment providers under the Payment Systems Act.

Commercial banks, special financial institutions, and operators of transferable e-money services must adhere to every requirement in the draft guidelines. Other financial service providers (e.g., payment providers other than operators of transferable e-money services) can implement the draft guidelines as deemed appropriate to their services, products, and service channels.

Digital Fraud Management Requirements

The draft guidelines establish the following key requirements:

  • Policy and oversight. Directors and senior executives of financial service providers must set and adopt appropriate “end-to-end” fraud management policies and KPIs to manage digital fraud, covering prevention, monitoring, detection, management, resolution, and support for affected customers.
  • Fraud management processes. Financial service providers must establish a clear framework for managing digital fraud throughout the customer lifecycle, from customer onboarding to service termination, according to industry standards at a minimum and covering at least the following processes:
    • Know your customer (KYC) and customer due diligence (CDD): Providers must implement risk assessment processes to identify potential mule accounts, continuously monitor customer transaction behaviors, and regularly review and update customers’ risk levels. In addition, authentication processes must suit the (1) risk level of the transaction, (2) products and services, and (3) service channel.
    • Fraud monitoring and detection: Providers must develop proactive processes to detect and monitor unusual transactions and utilize data from various sources to identify potential mule accounts and fraud. This may involve adopting new technologies (e.g., artificial intelligence) to enhance efficacy and stay ahead of emerging fraud techniques.
    • Action and response to fraud: Providers must develop swift and appropriate measures to prevent, limit, and promptly mitigate digital fraud damage (e.g., by providing alerts to customers), including handling suspected mule accounts. They must also respond clearly, fairly, and swiftly to support customers affected by scams (e.g., by offering 24/7 customer support through dedicated hotlines and electronic channels, having service level agreements with timeframes to assist customers affected by fraud incidents, and reporting to the BOT any incidents that cause widespread customer damage or affect the financial service provider’s reputation).
  • Information sharing. Financial service providers must have mechanisms to share accurate information in a timely manner with one another and with relevant external agencies (e.g., Anti-Money Laundering Office, Royal Thai Police) to enhance collective fraud management efforts, and must appoint responsible persons to coordinate and procure information necessary for any investigations.
  • Awareness. Financial service providers must proactively raise customers’ and the public’s awareness of digital fraud to prevent and reduce potential damage. Required actions include implementing a practical method on an easily accessible service channel (e.g., mobile app or infographic on social media) at least once a month, and having customers take awareness tests when using mobile banking and transferable e-money services.
Related Professionals

Industries

Fintech

Practices

Banking and Finance

Location

RELATED INSIGHTS​ 

January 13, 2026
On January 9, 2026, Thailand’s Securities and Exchange Commission (SEC) filed a criminal complaint with the Economic Crime Suppression Division (ECD) against five individuals for unauthorized operation of a digital-asset dealer business under the Emergency Decree on Digital Asset Businesses B.E. 2561 (2018). This precedent-setting case signals that the regulator is willing to pursue crypto enforcement against natural persons even in the absence of a licensed platform entity. Background and Implications The case follows the SEC’s October 2025 public warning about the use of iris-scanning technology in exchange for certain digital tokens. In its warning, the SEC cautioned that exchanging or trading these specific tokens with unlicensed service providers exposes users to heightened fraud, scam, and money laundering risks. Unlike prior regulatory enforcement matters, which involved platform-level administrative fines for operational or compliance failures, this case targets misconduct by individuals who may not be professional traders but openly advertised their willingness to buy these tokens from the public, opened individual over-the-counter (OTC) trade channels for these tokens, and facilitated off-exchange transactions in a manner resembling ordinary commercial dealing. This enforcement action establishes a clear precedent that natural persons engaging in public-facing digital-asset dealing may face criminal liability under Thai law, even without operating through a corporate or licensed platform structure. Outlook The alleged offenders may not settle this crime by payment of fines. Following the SEC’s referral, the ECD will undertake further investigation, after which prosecutors may review the case and proceed to court. The SEC has stated that it will cooperate fully with enforcement agencies throughout the criminal enforcement process.
Read More
January 9, 2026
Thailand continues to advance its legal and regulatory framework for the technology sector, with several key laws undergoing review and proposed amendments. These developments reflect Thailand’s broader efforts to ensure that its regulatory landscape keeps pace with rapid technological change and aligns more closely with international standards and best practices. The following are key legal developments and proposed legislative reforms in 2026 that are expected to impact businesses operating in the technology sector and the broader Thai business landscape. Data Privacy and Cybersecurity Personal Data Protection Act B.E. 2562 (2019) Following the full enforcement of Thailand’s Personal Data Protection Act (PDPA) in June 2022, businesses and practitioners have identified practical implementation challenges and interpretative issues. These challenges were reflected in an effectiveness assessment conducted by the Personal Data Protection Committee (PDPC) in late 2024. The PDPC published a set of principles for public consultation to identify issues and directions for potential amendments to the PDPA. Key issues: Emerging issues include clarifying the definitions of “data controller,” “data processor,” and “criminal record”; revisiting the scope of sensitive personal data to better reflect Thailand’s context; proposing amendments to the hierarchy of legal bases to avoid misconceptions of consent as the default legal basis; and clarifying the required level of expressiveness for explicit consent, as well as rules for collecting personal data from other sources. Current status: The first round of public consultation has concluded. Next steps: The proposed amendments are proceeding to a revised draft following the consultation outcomes. Cybersecurity Act B.E. 2562 (2019) Thailand is moving forward with proposed amendments to enhance the effectiveness of its national cybersecurity framework, as evolving digital technologies bring new risks such as misinformation, system intrusions, and attacks on critical infrastructure, making cybersecurity a national priority. Key issues: The amendments aim to clarify and strengthen
Read More
January 6, 2026
Among the eight implementing decrees issued on December 18, 2025, to provide the legal framework for Vietnam’s new International Financial Centers (IFC), Decree No. 323/2025/ND‑CP serves the core function of officially establishing the IFC as a unified entity in two locations—Ho Chi Minh City and Da Nang—and setting out a plan for its development and governance. The key contents of the decree are summarized below. Location and Focus of IFCs The Vietnam International Financial Center in Ho Chi Minh City (VIFC‑HCMC) and the Vietnam International Financial Center in Da Nang (VIFC‑DN) are designed to attract capital, fintech, and international market participants under a dedicated regulatory framework. The IFCs will host functional zones for financial trading, banking, securities and commodities exchanges, offices, dispute resolution (via specialized court and international arbitration center), and related activities as set by the executive authority of each IFC. VIFC-HCMC, with a total area of 898 hectares in central Ho Chi Minh City, is oriented to develop a comprehensive and diverse financial ecosystem, providing traditional and specialized financial services, and leveraging synergies between financial services such as capital mobilization, investment, payment services, issuance and trading of financial products, asset management, fintech, and green financial services. VIFC-DN, with a total area of 300 hectares, is oriented to develop as a modern IFC, closely integrated with the innovation ecosystem, digital technology, and sustainable finance. VIFC-DN will establish a controlled testing platform for new financial models, taking the lead in the deployment and scaling of digital-asset products, digital payments, and specialized trading platforms and exchanges, while promoting supply chain finance, third-party services, and non-bank financial intermediaries to complement and support the traditional financial market, developing specialized, flexible, and innovative financial products. Near‑Term Priorities and Review Timeline In 2026, the government will prioritize completing the essential infrastructure and ensuring adequate
Read More
January 5, 2026
Resolution No. 222/2025/QH15 dated June 27, 2025, of the National Assembly of Vietnam (the “IFC Resolution” – see our previous article) set out the foundational legal framework for the establishment and development of Vietnam’s first-ever International Financial Centers (IFC). In furtherance of this framework, on December 18, 2025, the government of Vietnam issued eight implementing decrees to provide detailed regulatory guidance and to operationalize the IFC Resolution in practice. The Eight Implementing Decrees: An Integrated Regulatory Ecosystem The new decrees governing the IFC include the following: Decree No. 323/2025/ND-CP on the establishment of the IFC. Decree No. 324/2025/ND-CP on financial policies applicable within the IFC. Decree No. 325/2025/ND-CP on labor, employment, and social security within the IFC. Decree No. 326/2025/ND-CP on land and environmental matters within the IFC. Decree No. 327/2025/ND-CP on entry, exit, and residence of foreign nationals in the IFC. Decree No. 328/2025/ND-CP on the International Arbitration Center of the IFC. Decree No. 329/2025/ND-CP on banking licensing, foreign exchange management, and anti-money laundering and combating the financing of terrorism (AML/CFT) within the IFC. Decree No. 330/2025/ND-CP on the establishment and operation of commodity exchanges within the IFC. Taken as a whole, these eight decrees translate the IFC Resolution into a coherent and fully operational legal regime governing the establishment, organization, and functioning of Vietnam’s IFC. Collectively, they demonstrate that Vietnam’s IFC framework is best understood not as a collection of isolated incentives, but as a deliberately designed and integrated regulatory system. The Legal Architecture of the IFC: Four Interlocking Pillars Read together, the decrees seem to be designed to address four core regulatory questions from the outset: (i) what the IFC is, from a legal and institutional perspective; (ii) who may participate in the IFC and what activities are permitted; (iii) how people, capital, and projects operate
Read More