You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 26, 2016

New e-Payment Service Regulations for SFIs: A Boon for Customer Confidence?

Subscribe to Updates
Informed Counsel

In today’s digital economy, financial technology (FinTech) is a major economic driving force. FinTech has transformed the private sector, resulting in a drastic shift in the way customers use financial services. Financial institutions, in particular, have taken significant strides to implement innovative platforms to facilitate financial transactions and payment methods for goods and services. As electronic services become more sophisticated and prevalent, however, greater regulatory scrutiny needs to be paid to the industry in order to protect end-users and prevent damage to the country’s economy.

Background

Commercial banks are veterans in the e-Payment service market. They are governed by the Royal Decree Regulating Electronic Payment Services B.E. 2551 (2008); relevant Notifications of the Electronic Transaction Commission (ETC); and applicable Notifications of the Bank of Thailand (BOT), which also closely monitors their business activities.

Specialized Financial Institutions (SFIs), which were established by the government to provide financial services to various sectors that are not sufficiently served by commercial banks, are also engaged in the e-Payment service market. Thailand’s regulatory authorities determined that the laws and regulations surrounding SFIs and their engagement in e-Payment service businesses were insufficient, and further regulations were needed.

The Royal Decree on e-Payment Services

On March 30, 2016, the government promulgated the Royal Decree Governing the Control and Supervision of Electronic Payment Service Businesses of Specialized Financial Institutions B.E. 2559 (2016). It took effect on July 28.

As with commercial banks, the Royal Decree of 2016 designates the BOT to control and supervise the e-Payment service businesses of the following SFIs: Government Savings Bank, Bank for Agriculture and Agricultural Cooperatives, Government Housing Bank, Islamic Bank of Thailand, Export-Import Bank of Thailand, Small and Medium Enterprise Development Bank of Thailand, Thai Credit Guarantee Corporation, and Secondary Mortgage Corporation.

The Royal Decree aims to standardize supervisory provisions and measures enforced on both private and state service providers. This should help ensure financial and commercial stability, prevent damage caused to the public, and build trust and credibility in the e-Payment system among the public.

In terms of substantive provisions, the Royal Decree categorizes e-Payment service business into three lists, which resemble the categories for commercial banks in the Royal Decree Regulating Electronic Payment Services B.E. 2551 (2008), as follows:

  • List A: e-Money services used for purchasing specific goods or services as specified in advance from an entrepreneur, excluding e-Money services used only for customers’ convenience without the procurement of any profit from issuing the card, as prescribed by the BOT with the approval of the ETC. These services require notification before business operations commence.
  • List B: Credit card network services, electronic draft capture services, transaction switching services for payments in one system, and e-Money services used for purchasing specific goods or services as specified in advance at a place which uses the same system for distributing and providing these goods or services. These services require registration before business operations commence.
  • List C: Clearing services, settlement services, e-Payment services through any devices or networks, transaction switching services for payment through several systems, payment service provider services, and e-Money services used for purchasing specific goods or services as specified in advance in which the place where the services were used was not limited and the system for distributing or providing the services is not the same. These services require a license before business operations commence. The license lasts for ten years.

The Royal Decree also empowers the ETC to set methods and service conditions on: (1) custody and disclosure of customers’ personal information; (2) examining and maintaining system security for consistent reliability; (3) express prescribing of any service fees; (4) receiving and the process to ratify customers’ complaints or disputes; and (5) accounting and reporting, among others.

In addition, depending on the type of business, the BOT may prescribe additional rules on: (1) issuing evidence for payment; (2) keeping money which will be sent; (3) prescribing the finality of transferred money which may be unconditionally and promptly utilized by the beneficiary; and (4) arranging an independent auditor for security.

Any service providers in List A and List B that fail to comply with these rules will be subject to an administrative fine and/or an order of the ETC to take appropriate corrective action. Any service providers in List C that fail to comply with these rules can be subject to corrective measures, suspension, or license revocation.

Implementation

Even though the Royal Decree came into force on July 28, its transitional provisions allow SFIs which have operated an e-Payment service business prior to this date to continue their operation until November 24, 2016. The SFIs that want to continue their business need to notify, register, or apply for a license in accordance with this Royal Decree from August 26 to September 25, 2016.

If the Royal Decree is effectively enforced, and both the BOT and the ETC undertake their supervisory authority properly, information technology systems and electronic platforms will be much safer for customers who interact with these SFIs. Improved security and protection will lead to greater credibility with customers, and this will entice considerably more people to use e-Payment services.

Download Full Article
Related Professionals

Practices

Banking and Finance

Location

RELATED INSIGHTS​ 

February 27, 2026
The Bank of Thailand (BOT) has officially implemented a new regulatory framework supervising systemically important retail payment systems (SIRPS), effective February 21, 2026, with PromptPay being the first payment system designated as a SIRPS. Under this new set of regulations, the BOT may designate payment systems under the Payment Systems Act B.E. 2560 (2017) as SIRPSs based on quantitative and qualitative assessments. Once a system is designated as a SIRPS, the operator becomes subject to expanded supervisory obligations beyond the general requirements of the Payment Systems Act. Enhanced Supervisory Requirements SIRPS operators must comply with a heightened supervisory regime across three key areas, outlined below. 1. Governance SIRPS operators must maintain robust and transparent governance structures, including: Balanced board composition, with at least one-third of the board comprising independent directors who represent stakeholders in the system (such as payment service providers, consumers, and experts). Independent directors may serve for no more than two consecutive terms. Subcommittees to assist the board in overseeing compliance, policy implementation, and operational strategy. Clear separation between executives responsible for risk and information security and those overseeing day-to-day business operations. Risk Management and System SecuritySIRPS operators must implement comprehensive risk management frameworks, including: Clear service agreements between the SIRPS operator and its direct participants (payment service providers who connect directly to the SIRPS), defining roles and responsibilities among stakeholders. These agreements must include obligations for direct SIRPS participants to supervise any indirect participants they onboard to ensure compliance with service agreements and business rules. A business continuity plan covering both IT and non-IT aspects, with annual review. The SIRPS must target service availability comparable to international payment infrastructures, including the ability to recover operations within two hours of a disruption and to maintain scalable operational capacity. Tools and controls to monitor and manage material or
Read More
February 9, 2026
When unauthorized credit card transactions occur, who bears responsibility—the cardholder or the issuing bank? In Thailand, a landmark 2025 ruling by the country’s Supreme Court has clarified this question, establishing a stricter standard for banks in fraud disputes and significantly strengthening consumer protections. The case centered on disputed charges where a customer claimed their credit card had been used without authorization. The bank sued to recover the amount, and both the court of first instance and the Court of Appeal ruled in favor of the bank. However, the Supreme Court overruled their judgments and decided that the customer did not need to pay for the unauthorized transactions, placing liability squarely on the bank. This ruling was based on three key findings, which are outlined below. Finding 1: Insufficient Expert Testimony In this case, the bank bore the burden of proving matters related to the credit card system’s manufacture, design, security, and operation, as required under the Consumer Case Procedure Act B.E. 2551 (2008). To meet this requirement, the bank presented testimony from two employees in its credit card department regarding ’security measures and issuance procedures. However, the Supreme Court found these witnesses unqualified as experts, as they did not present technical or academic evidence and did not possess specialized expertise in credit card technology. As a result, their testimony failed to establish that the bank’s credit card technology was sufficiently secure against fraudulent misuse. Finding 2: Contradictory Terms and Conditions The bank’s own credit card terms and conditions included a provision acknowledging that despite the card’s EMV security standards, cardholders must still exercise caution to prevent unauthorized access. The Supreme Court interpreted this clause as an explicit admission that credit card systems remain vulnerable to hacking and fraud, even with high-level security measures in place. This acknowledgment undermined the
Read More
February 4, 2026
On November 18, 2025, Vietnam’s Ministry of Finance released for public consultation a draft decree on administrative sanctions in the field of crypto assets and crypto asset markets (the “Draft Decree”), intended to implement Resolution No. 05/2025/NQ-CP dated September 9, 2025, on the pilot crypto asset market in Vietnam (“Resolution 05”). While Resolution 05 sets out who may participate and under what conditions, the Draft Decree addresses a more practical question for market participants, i.e., what happens if those conditions are not met. In doing so, the Draft Decree offers important insight into how Vietnamese regulators intend to supervise, discipline, and ultimately shape the crypto market during the pilot phase. Regulatory Scope and Overall Sanctions Architecture The Draft Decree applies to both domestic and foreign organizations and individuals engaging in crypto-related activities in Vietnam’s market. Covered entities include: (i) crypto asset issuers; (ii) crypto asset service providers, including trading platforms and market operators; (iii) Vietnamese and foreign investors participating in the pilot market; and (iv) other organizations involved in the offering, issuance, or provision of crypto-related services in Vietnam. The breadth of this scope is deliberate. It appears to reflect a regulatory view that cross-border structures, offshore platforms, and indirect participation may not necessarily insulate market actors from compliance obligations once they operate within the pilot framework. For the crypto industry, this may mark a shift from regulatory ambiguity toward a more explicit articulation of jurisdictional reach. At first glance, the Draft Decree’s monetary penalties appear restrained. The maximum fine per administrative violation is capped at VND 200 million (approx. USD 7,700) for organizations and VND 100 million (approx. USD 3,800) for individuals. However, focusing solely on fine levels risks missing the point. The Draft Decree also places great regulatory weight on supplementary sanctions and corrective measures, including: (i)
Read More
January 23, 2026
On December 31, 2025, the State Bank of Vietnam (SBV) issued Circular No. 72/2025/TT-NHNN (Circular 72), establishing a streamlined foreign exchange framework for Vietnam’s International Financial Center (IFC). Circular 72, which took effect on the same day, implements core provisions of Decree No. 329/2025/ND-CP and marks a fundamental shift from ex ante licensing to ex post supervision for IFC member enterprises and foreign investors. These changes are designed to accelerate capital flows, reduce compliance costs, and position Vietnam as a competitive regional financial hub by granting IFC members substantially greater autonomy in currency transactions, borrowing, lending, and investment activities. Key provisions for IFC members to note are discussed below. Use of Foreign Currency and Payments within the IFC Vietnam generally requires the use of Vietnamese dong for transactions within the country, with limited exceptions. This can be burdensome for foreign investors, who may be unfamiliar with all the foreign exchange rules they must comply with. Under the new regulation, IFC member enterprises and foreign investors gain the ability to transact, list prices, and settle obligations in foreign currency when dealing with other IFC members or offshore counterparties, avoiding currency risk and conversion friction. With respect to individuals and organizations located within Vietnam who are not IFC members, the use of foreign currency must continue to comply with general restrictions on foreign exchange usage within Vietnam. Dual-Track Account System for IFC Members The new regulation introduces a two-tier account structure that differentiates transactions by purpose and counterparty. IFC member enterprises must use a designated foreign currency capital account at an IFC member bank for four specified activities: Borrowing from offshore individuals and organizations Lending to offshore entities and domestic borrowers Outbound investing from the IFC Investing elsewhere in Vietnam from the IFC All other foreign exchange transactions—including operational receipts, vendor
Read More