You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 26, 2016

New e-Payment Service Regulations for SFIs: A Boon for Customer Confidence?

Subscribe to Updates
Informed Counsel

In today’s digital economy, financial technology (FinTech) is a major economic driving force. FinTech has transformed the private sector, resulting in a drastic shift in the way customers use financial services. Financial institutions, in particular, have taken significant strides to implement innovative platforms to facilitate financial transactions and payment methods for goods and services. As electronic services become more sophisticated and prevalent, however, greater regulatory scrutiny needs to be paid to the industry in order to protect end-users and prevent damage to the country’s economy.

Background

Commercial banks are veterans in the e-Payment service market. They are governed by the Royal Decree Regulating Electronic Payment Services B.E. 2551 (2008); relevant Notifications of the Electronic Transaction Commission (ETC); and applicable Notifications of the Bank of Thailand (BOT), which also closely monitors their business activities.

Specialized Financial Institutions (SFIs), which were established by the government to provide financial services to various sectors that are not sufficiently served by commercial banks, are also engaged in the e-Payment service market. Thailand’s regulatory authorities determined that the laws and regulations surrounding SFIs and their engagement in e-Payment service businesses were insufficient, and further regulations were needed.

The Royal Decree on e-Payment Services

On March 30, 2016, the government promulgated the Royal Decree Governing the Control and Supervision of Electronic Payment Service Businesses of Specialized Financial Institutions B.E. 2559 (2016). It took effect on July 28.

As with commercial banks, the Royal Decree of 2016 designates the BOT to control and supervise the e-Payment service businesses of the following SFIs: Government Savings Bank, Bank for Agriculture and Agricultural Cooperatives, Government Housing Bank, Islamic Bank of Thailand, Export-Import Bank of Thailand, Small and Medium Enterprise Development Bank of Thailand, Thai Credit Guarantee Corporation, and Secondary Mortgage Corporation.

The Royal Decree aims to standardize supervisory provisions and measures enforced on both private and state service providers. This should help ensure financial and commercial stability, prevent damage caused to the public, and build trust and credibility in the e-Payment system among the public.

In terms of substantive provisions, the Royal Decree categorizes e-Payment service business into three lists, which resemble the categories for commercial banks in the Royal Decree Regulating Electronic Payment Services B.E. 2551 (2008), as follows:

  • List A: e-Money services used for purchasing specific goods or services as specified in advance from an entrepreneur, excluding e-Money services used only for customers’ convenience without the procurement of any profit from issuing the card, as prescribed by the BOT with the approval of the ETC. These services require notification before business operations commence.
  • List B: Credit card network services, electronic draft capture services, transaction switching services for payments in one system, and e-Money services used for purchasing specific goods or services as specified in advance at a place which uses the same system for distributing and providing these goods or services. These services require registration before business operations commence.
  • List C: Clearing services, settlement services, e-Payment services through any devices or networks, transaction switching services for payment through several systems, payment service provider services, and e-Money services used for purchasing specific goods or services as specified in advance in which the place where the services were used was not limited and the system for distributing or providing the services is not the same. These services require a license before business operations commence. The license lasts for ten years.

The Royal Decree also empowers the ETC to set methods and service conditions on: (1) custody and disclosure of customers’ personal information; (2) examining and maintaining system security for consistent reliability; (3) express prescribing of any service fees; (4) receiving and the process to ratify customers’ complaints or disputes; and (5) accounting and reporting, among others.

In addition, depending on the type of business, the BOT may prescribe additional rules on: (1) issuing evidence for payment; (2) keeping money which will be sent; (3) prescribing the finality of transferred money which may be unconditionally and promptly utilized by the beneficiary; and (4) arranging an independent auditor for security.

Any service providers in List A and List B that fail to comply with these rules will be subject to an administrative fine and/or an order of the ETC to take appropriate corrective action. Any service providers in List C that fail to comply with these rules can be subject to corrective measures, suspension, or license revocation.

Implementation

Even though the Royal Decree came into force on July 28, its transitional provisions allow SFIs which have operated an e-Payment service business prior to this date to continue their operation until November 24, 2016. The SFIs that want to continue their business need to notify, register, or apply for a license in accordance with this Royal Decree from August 26 to September 25, 2016.

If the Royal Decree is effectively enforced, and both the BOT and the ETC undertake their supervisory authority properly, information technology systems and electronic platforms will be much safer for customers who interact with these SFIs. Improved security and protection will lead to greater credibility with customers, and this will entice considerably more people to use e-Payment services.

Download Full Article
Related Professionals

Practices

Banking and Finance

Location

RELATED INSIGHTS​ 

August 11, 2026
On July 27, 2026, the State Bank of Vietnam (SBV) released a draft decree proposing amendments to Decree No. 52/2024/ND-CP dated May 15, 2024, on non-cash payments (Decree 52). The draft decree would amend 17 of Decree 52’s 38 articles, with several key changes directly affecting providers of intermediary payment service (IPS). The key proposed changes affecting IPS providers are outlined below. Streamlining IPS Licensing Procedures A central objective of the draft decree is to simplify regulatory procedures for IPS providers. Notably, it would significantly reduce IPS licensing documentation requirements by removing the need to submit enterprise registration certificates, investment registration certificates, and documents evidencing the qualifications of the legal representative and general director. Instead, the SBV would retrieve this information directly from national business registration and other specialized databases, requesting additional documents only where the relevant information cannot be verified electronically or is incomplete. The draft decree also removes the current limit of two rounds for dossier supplementation and shortens processing timelines for several IPS licensing procedures such as issuance, amendment, and reissuance of IPS licenses. The processing time for new IPS license applications would be thereby reduced from 90 to 60 working days. In addition, several continuing IPS business conditions would be removed. For example, IPS providers would no longer be required to maintain certain representations relating to corporate restructuring or the legality of contributed capital. Likewise, the IPS project plan (đề án) would become a one-time application document rather than an ongoing licensing condition. If retained in the final decree, this change could provide IPS providers with significantly greater flexibility to implement post-licensing technology upgrades, system integrations, and corporate restructuring transactions without needing to revisit the originally approved project plan. The draft decree also removes the requirement for the SBV to consult the Ministry of Public
Read More
August 3, 2026
On July 23, 2026, the Bank of Thailand (BOT) released for public comment its draft Notification on Digital Channel Security, which would significantly expand the scope and stringency of Thailand’s existing mobile banking security framework. If finalized in its current form, the draft notification would extend mandatory security requirements to credit card providers and credit providers, cover internet banking in addition to mobile applications, phase out SMS one-time passwords (OTPs) for transaction authentication, and introduce biometric verification requirements for high-value transactions. The public comment period is open through August 24, 2026. Background The BOT’s existing Mobile Banking Security Notification, issued in 2024, sets minimum security standards for financial institutions, specialized financial institutions (SFIs), and e-money providers, significantly reducing “money-draining app” fraud. However, fraudsters have since shifted to nonbank providers and internet banking channels, prompting the BOT to propose broader security requirements. Expanded Scope of Regulated Entities and Channels The existing Mobile Banking Security Notification covers only financial institutions, SFIs, and e-money providers offering mobile banking services. The draft expands coverage in two key areas: entities and channels. On the entity side, it adds credit card providers and credit providers that offer fund transfers to third parties at other financial service providers or that provide cash withdrawal services to individual retail customers. On the channel side, it broadens coverage to include internet banking in addition to mobile banking. Strengthened Customer Authentication The draft introduces enhanced authentication requirements in three areas: Service enrollment and device changes. Providers must implement rigorous identity verification, notify customers of enrollment results through out-of-band communication channels, and adopt risk-mitigation measures such as cooling-off periods and temporary transaction limits. Transaction-level authentication. Providers must use two-factor authentication for fund transfers, cardless ATM withdrawals, and transaction limit increases. Secure authentication factors. Key requirements include the following: “What-you-know” factors must
Read More
July 27, 2026
A new decree on penalties for violations related to the crypto asset market creates compliance risks for offshore crypto asset exchanges in Vietnam that do not hold, and practically cannot obtain, a Vietnamese license, and for Vietnamese users who continue to transact on those platforms. Decree No. 284/2026/ND-CP (Decree 284), issued by the government of Vietnam on July 16, 2026, formally establishes an administrative penalty framework for violations related to crypto assets and the crypto asset market. The decree takes effect on September 1, 2026, and will remain in force for the duration of the five-year pilot program under Resolution No. 05/2025/NQ-CP, which is scheduled to end in September 2030. Direct Penalties on Vietnamese Users The most immediate commercial risk to offshore platforms is that their Vietnamese users now face direct personal liability for using their exchanges. Vietnamese users who trade crypto assets outside of a Ministry of Finance-licensed service provider face fines of up to VND 50 million (approximately USD 1,900). Vietnamese users trading in crypto assets that are offered or issued to foreign users face higher penalties of up to VND 100 million (approximately USD 3,800). It is expected that Vietnamese users will be more willing to migrate away from offshore platforms now that there is a risk of real enforcement against them. Penalties on Unlicensed Service Providers Violations of providing crypto asset services or advertising crypto-related services without a license face fines of up to VND 200 million (approximately USD 7,700). Operating a crypto asset trading market without proper authorization falls within the same highest penalty bands. Organizations that violate issuance, provision, or disclosure rules may face fines of up to VND 200 million. Although the maximum administrative fine per violation is capped at VND 200 million for organizations and VND 100 million for individuals, these
Read More
July 17, 2026
On July 11, 2026, media reports conveyed key messages from Bank of Thailand (BOT) Governor Vitai Ratanakorn’s announcement of a sweeping regulatory crackdown on grey capital activities. The measures target high-value cash transactions, gold trading, and stablecoin flows, with new requirements set to take effect in the fourth quarter of 2026. The initiative aims to prevent financial institutions from facilitating shadow economy activity, money laundering—particularly through stablecoins—and capital flight, through enhanced compliance obligations on commercial banks across multiple transaction channels. Expanded Cash Controls Close the Deposit–Withdrawal Circuit New fourth-quarter guidelines will require individuals depositing THB 5 million or more in cash to formally verify the source of their funds. This builds on restrictions introduced in April 2026, which required anyone withdrawing 5 million baht or more in cash to provide their bank with verified commercial justification for why electronic transfers or checks could not be used. That initial measure caused high-value physical cash withdrawals to drop by 35 percent nationwide. The upcoming deposit-side requirement closes the circuit on large cash movements. The BOT is also assessing tracking mechanisms for high-value banknote swaps, specifically targeting individuals seeking to exchange large volumes of THB 1,000 notes into smaller THB 100 or THB 500 denominations without clear business justification. Governor Vitai emphasized that these measures require continuous deployment of multiple parallel strategies rather than short-term fixes. Tightened Bullion Reporting Frameworks Restrict Money Laundering Channels The BOT has also tightened reporting frameworks for gold trading to close money laundering loopholes and shield the Thai baht from speculative bullion volatility. Regulators identified a recurring pattern in which buyers purchased large quantities of gold through digital applications in the morning and then made same-day physical withdrawals from retail gold shops in the afternoon. Gold shops are reminded of their duties to flag and report cash
Read More