You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

June 5, 2019

First Peer-to-Peer Lending Regulation Issued by the Bank of Thailand

Subscribe to Updates
Informed Counsel

In recent years, peer-to-peer (P2P) lending technology has taken root in Asia, particularly in China, Singapore, and Indonesia, and the P2P market is continuing to expand significantly. The business model allows lenders and borrowers to link up via an online platform. This disrupts the traditional banking model that requires a financial institution to act as an intermediary. For individuals, this means that underbanked populations are able to secure loans where previously a lack of credit history or little access to financial service institutions posed considerable obstacles. For businesses, this can mean faster access to capital and a simplified process for reaching a broad base of potential investors.   

As it has in other countries, P2P is expected to transform the lending business and reduce funding gaps in the Thai market. The Bank of Thailand (BOT) first announced their intention to regulate P2P lending in September 2018, and in January 2019 circulated a draft of the proposed regulations in order to seek opinions and comments from interested parties. This has roughly coincided with a precipitous decline in the P2P lending market in China, which underlines the importance of regulating this nascent industry. Thailand—like some of its fellow ASEAN members—has chosen to move ahead carefully and establish a sound regulatory framework at an early stage in the local sector’s development.   

On April 29, 2019, the BOT issued Notification 4/2562 Re: The Determination of Rules, Procedures, and Conditions for Peer-to-Peer Lending Businesses and Platforms. The notification took effect the following day.    

The notification is Thailand’s first legislation relating to P2P lending, and it provides a number of parameters within which P2P platform providers and P2P lenders must operate. It defines a P2P platform provider as a person who provides an electronic system or network for P2P lending, and a lender as a natural or juristic person who offers a loan through an electronic system or network (excluding crowdfunding providers). Key provisions of the notification are below.

P2P Platform Provider   

The BOT has devoted a good deal of attention to setting out the structure and activities of P2P platform providers. They have stipulated that a P2P platform provider must:

  • not be a financial institution (including banks, although subsidiaries of banks are permitted);
  • be a private company or public company incorporated in Thailand;
  • have paid-in capital of at least THB 5 million; and
  • have at least 75% of its total shares held by Thais.

Directors of the platform provider must be “fit and proper,” meaning that they must not have been involved in or accused of fraud or corruption, must not demonstrate a lack of qualifications or professional standards, and must be financially sound.

Custodians    

Platform providers are prohibited from holding the money, property, and securities of lenders and borrowers, so a qualified custodian is required. Custodians must be either authorized custodians under Securities and Exchange Commission (SEC) regulations or authorized commercial banks (for escrow accounts) under BOT regulations.

Borrowers and Credit Limits   

Under this notification, borrowers must be natural persons who:

  • have the capability to perform debts;
  • are not platform providers;
  • are not directors or an authorized person of, or a major shareholder in, the provider; and
  • have not already obtained personal loans from three lenders.

The notification also prescribes credit limits for obtaining loans, depending on the type of loan. For example, a loan for consumer purposes is subject to a credit limit that is contingent on the borrower’s income or cash inflow. If the average monthly income is less than THB 30,000, the credit limit cannot exceed 1.5 times the average monthly income or the cash inflow in the consumer’s deposit account. For borrowers whose average monthly income is THB 30,000 or more, the credit limit is five times the average monthly income or cash inflow in the consumer’s deposit account. In these cases, the average must be calculated from a period of six months or more. If the loan is for business purposes, the credit limit is set at THB 50 million.   

In both cases, the interest rate for loans offered through a P2P lending platform must not exceed 15% per year, as laid out in the Civil and Commercial Code of Thailand.

Lenders   

Unlike borrowers, lenders can be either natural or juristic persons. They must possess knowledge and understanding of loans and the risks associated with P2P lending platforms by conducting client suitability assessments before providing loans. Additionally, a lender must not be a platform provider. There are credit limits proposed for the lenders under the notification, but materially for individual lenders the amount should not exceed THB 500,000 within one year.

Regulatory Clarity   

Prior to this enumeration by the BOT, the legal status of P2P lending activities was not consistent or clear-cut, with some types of P2P lending being strictly prohibited without a license from the BOT or the Securities and Exchange Commission of Thailand. With this P2P lending regulation—and the upcoming crowdfunding regulation that is expected to be issued by the SEC later this year—P2P lending businesses will be recognized and specifically regulated in Thailand.

It is hoped that this will lead to the sustainable growth of alternative finance in Thailand and will provide a more accessible option for consumers and entrepreneurs. As greater flexibility in how money flows to and from various sectors of society—coupled with sound regulation—prosperity and opportunity should become more open and available to previously marginalized individuals. Companies looking to get involved in working toward these goals should be sure they are compliant with the laws and regulations so that they can focus on making the promise of alternative finance a reality.

Download Full Article
Related Professionals

Practices

Banking and Finance

Location

RELATED INSIGHTS​ 

August 3, 2026
On July 23, 2026, the Bank of Thailand (BOT) released for public comment its draft Notification on Digital Channel Security, which would significantly expand the scope and stringency of Thailand’s existing mobile banking security framework. If finalized in its current form, the draft notification would extend mandatory security requirements to credit card providers and credit providers, cover internet banking in addition to mobile applications, phase out SMS one-time passwords (OTPs) for transaction authentication, and introduce biometric verification requirements for high-value transactions. The public comment period is open through August 24, 2026. Background The BOT’s existing Mobile Banking Security Notification, issued in 2024, sets minimum security standards for financial institutions, specialized financial institutions (SFIs), and e-money providers, significantly reducing “money-draining app” fraud. However, fraudsters have since shifted to nonbank providers and internet banking channels, prompting the BOT to propose broader security requirements. Expanded Scope of Regulated Entities and Channels The existing Mobile Banking Security Notification covers only financial institutions, SFIs, and e-money providers offering mobile banking services. The draft expands coverage in two key areas: entities and channels. On the entity side, it adds credit card providers and credit providers that offer fund transfers to third parties at other financial service providers or that provide cash withdrawal services to individual retail customers. On the channel side, it broadens coverage to include internet banking in addition to mobile banking. Strengthened Customer Authentication The draft introduces enhanced authentication requirements in three areas: Service enrollment and device changes. Providers must implement rigorous identity verification, notify customers of enrollment results through out-of-band communication channels, and adopt risk-mitigation measures such as cooling-off periods and temporary transaction limits. Transaction-level authentication. Providers must use two-factor authentication for fund transfers, cardless ATM withdrawals, and transaction limit increases. Secure authentication factors. Key requirements include the following: “What-you-know” factors must
Read More
July 27, 2026
A new decree on penalties for violations related to the crypto asset market creates compliance risks for offshore crypto asset exchanges in Vietnam that do not hold, and practically cannot obtain, a Vietnamese license, and for Vietnamese users who continue to transact on those platforms. Decree No. 284/2026/ND-CP (Decree 284), issued by the government of Vietnam on July 16, 2026, formally establishes an administrative penalty framework for violations related to crypto assets and the crypto asset market. The decree takes effect on September 1, 2026, and will remain in force for the duration of the five-year pilot program under Resolution No. 05/2025/NQ-CP, which is scheduled to end in September 2030. Direct Penalties on Vietnamese Users The most immediate commercial risk to offshore platforms is that their Vietnamese users now face direct personal liability for using their exchanges. Vietnamese users who trade crypto assets outside of a Ministry of Finance-licensed service provider face fines of up to VND 50 million (approximately USD 1,900). Vietnamese users trading in crypto assets that are offered or issued to foreign users face higher penalties of up to VND 100 million (approximately USD 3,800). It is expected that Vietnamese users will be more willing to migrate away from offshore platforms now that there is a risk of real enforcement against them. Penalties on Unlicensed Service Providers Violations of providing crypto asset services or advertising crypto-related services without a license face fines of up to VND 200 million (approximately USD 7,700). Operating a crypto asset trading market without proper authorization falls within the same highest penalty bands. Organizations that violate issuance, provision, or disclosure rules may face fines of up to VND 200 million. Although the maximum administrative fine per violation is capped at VND 200 million for organizations and VND 100 million for individuals, these
Read More
July 17, 2026
On July 11, 2026, media reports conveyed key messages from Bank of Thailand (BOT) Governor Vitai Ratanakorn’s announcement of a sweeping regulatory crackdown on grey capital activities. The measures target high-value cash transactions, gold trading, and stablecoin flows, with new requirements set to take effect in the fourth quarter of 2026. The initiative aims to prevent financial institutions from facilitating shadow economy activity, money laundering—particularly through stablecoins—and capital flight, through enhanced compliance obligations on commercial banks across multiple transaction channels. Expanded Cash Controls Close the Deposit–Withdrawal Circuit New fourth-quarter guidelines will require individuals depositing THB 5 million or more in cash to formally verify the source of their funds. This builds on restrictions introduced in April 2026, which required anyone withdrawing 5 million baht or more in cash to provide their bank with verified commercial justification for why electronic transfers or checks could not be used. That initial measure caused high-value physical cash withdrawals to drop by 35 percent nationwide. The upcoming deposit-side requirement closes the circuit on large cash movements. The BOT is also assessing tracking mechanisms for high-value banknote swaps, specifically targeting individuals seeking to exchange large volumes of THB 1,000 notes into smaller THB 100 or THB 500 denominations without clear business justification. Governor Vitai emphasized that these measures require continuous deployment of multiple parallel strategies rather than short-term fixes. Tightened Bullion Reporting Frameworks Restrict Money Laundering Channels The BOT has also tightened reporting frameworks for gold trading to close money laundering loopholes and shield the Thai baht from speculative bullion volatility. Regulators identified a recurring pattern in which buyers purchased large quantities of gold through digital applications in the morning and then made same-day physical withdrawals from retail gold shops in the afternoon. Gold shops are reminded of their duties to flag and report cash
Read More
June 23, 2026
On May 14, 2026, Thailand published a ministerial regulation in the Government Gazette to prescribe measures for prevention and suppression of technology crimes. The regulation creates a comprehensive procedural framework for returning money and digital assets to victims of technology crimes. It will take effect 90 days after publication (in mid-August 2026), giving affected entities a limited window to prepare. Mandatory Reporting Obligations for Financial Institutions When a deposit account, e-money account, or digital asset wallet is frozen in connection with a technology crime, the relevant financial institution or business operator must report transaction data to the Anti-Money Laundering Office (AMLO) via AMLO’s designated electronic system. Required data elements include account numbers (sender and receiver), names, identification or passport numbers, legal entity registration numbers, phone numbers, remaining balance, damage amount, transaction reference numbers, and the bank case ID. Institutions that already share data through the information-sharing system under the emergency decree are deemed to have satisfied this reporting obligation, creating an incentive for platform participation. When the Royal Thai Police or the Department of Special Investigation seize or freeze assets related to technology crimes, they must provide AMLO with investigation reports, complaint evidence, money-trail data, and account statements. Notification and Claims Process Once the AMLO secretary-general approves verified reports of a technology crime, the account information of persons connected to the crime will be published in the Government Gazette, triggering a 90-day window for victims to file claims and for related persons to file objections. Officers will also publish details on AMLO’s electronic media and send registered mail to identified victims, which will be deemed received after 7 days domestically or 15 days internationally. Victims have 90 days from the date the crime is published in the Government Gazette to file claims through AMLO’s electronic system. Claims must include
Read More