You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

June 19, 2025

Thailand Drafts AI Risk Management Guidelines for Financial Service Providers

Subscribe to Updates

The Bank of Thailand (BOT) has released draft guidelines establishing principles for managing artificial intelligence (AI) risks in the financial sector. The draft guidelines provide a structured framework for the responsible adoption of AI technologies. Financial service providers will be able to use the guidelines as a reference to appropriately manage their risks in a manner that aligns with internationally recognized best practices.

The BOT is accepting public comments on the draft guidelines until June 30, 2025.

Scope and Application

The draft guidelines apply to all financial service providers, including financial institutions and special financial institutions under the Financial Institution Business Act, as well as payment providers under the Payment Systems Act. These guidelines supplement existing BOT risk management guidelines covering IT risk management, third-party risk management, data governance, and market conduct.

The guidelines define AI systems as systems that mimic human intelligence, including machine learning, deep learning, generative AI (such as large language models), and agentic AI. This definition specifically excludes rule-based automation systems like robotic process automation and condition matching.

Key Risk Management Principles

The guidelines lay out two main principles in managing AI risk.

  1. Governance: Financial service providers should define and establish clear roles and responsibilities for their personnel and AI system supervision structures to uphold FEAT (fairness, ethics, accountability, and transparency) principles as follows:
    • Stakeholder roles and responsibilities. Financial service providers should define roles and responsibilities for boards and executives on AI risk oversight. Responsibilities include establishing an AI system usage policy, designating personnel responsible for AI risk management, and building awareness of AI-related risk within the organization.
    • AI system usage policy. The AI system usage policy should be aligned with organizational objectives, regulatory requirements, and FEAT principles. These policies should be reviewed regularly to respond to technological advancements and evolving risk profiles.
    • Risk management throughout the AI lifecycle. Risk management should encompass the entire AI lifecycle, from establishing risk appetite to implementing continuous risk assessment and control measures tailored to specific use cases. When AI systems are used in strategic functions or customer interactions (e.g., loan approval, account opening), human oversight must be integrated into decision-making processes. In customer interactions with AI systems, customers should be notified and have options to disable or bypass AI features.
  1. Development and security controls: Financial service providers should have risk controls covering the AI development and deployment lifecycle as follows:
    • Data risk. Financial service providers should have measures to assess and ensure the quality, accuracy, currency, volume, and diversity of data used in AI model training. They should also implement data leakage prevention measures.
    • Model development risk. Financial service providers should have (1) clear evaluation metrics for assessing model accuracy and reliability through ongoing testing and monitoring both before and after deployment and (2) measures to ensure the explainability of AI outcomes. For generative AI applications, there should be specific measures to reduce AI hallucination risks.
    • Cybersecurity risk. Financial service providers should have measures to prevent and detect emerging cyber threats targeting AI systems, based on established standards such as the OWASP Machine Learning Security Top 10.

For more details on any aspect of fintech, technology, and cybersecurity in Thailand, please contact Athistha Chitranukroh at [email protected], Nopparat Lalitkomon at [email protected], Pornpan Wichawut at [email protected], Napassorn Lertussavavivat at [email protected], or Rujaporn Paritsantik at [email protected].

Related Professionals

Industries

Fintech

Technology

Practices

Banking and Finance

Location

RELATED INSIGHTS​ 

June 30, 2022
Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) became fully effective and enforceable on June 1, 2022. To ensure that the PDPA will be smoothly and efficiently enforced, the Personal Data Protection Commission (PDPC) is issuing various subordinate regulations. On June 20, 2022, the first set of these regulations was issued and published in the Government Gazette, and according to the Ministry of Digital Economy and Society (MDES), another set of subordinate regulations is expected to be issued by the end of June 2022. The first set consists of the following four subordinate regulations:   1) Notification of the PDPC Re: Exemption to the Record of Processing Activities Requirement for Data Controllers that Are Small Businesses B.E. 2565 (2022) (“ROPA Exemption Notification”) Under the PDPA, data controllers are obligated to prepare and maintain a record of processing activities (ROPA) containing information specified in Section 39 of the PDPA, including the personal data collected, the purposes of the processing of the personal data, the retention period, etc. However, under this ROPA Exemption Notification, a data controller will be exempted from the obligation to prepare and maintain a record of such required information (except information related to the rejection of a request from a data subject to exercise (i) right of access; (ii) right to data portability; (iii) right to object; and (iv) right to rectification), if its business falls within the scope of any of the following: Small or medium-sized business according to the law on small and medium-sized enterprise promotion, defined as follows: Community enterprise or social enterprise, as referred to under the law on community enterprise promotion. Social enterprise, as referred to under the under the law on social enterprise promotion. Cooperative, cooperative union, or agriculturist’s group under the law on cooperatives. Foundation, association, religious body, or
Read More
June 6, 2022
Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) entered into force in full on June 1, 2022. The PDPA, which contains similarities to the EU’s General Data Protection Regulation (GDPR) introduces obligations and restrictions relating to the collection, use, and disclosure of personal data in Thailand. While the new law applies to franchisors and franchisees in the same way that it applies to other businesses, there are a number of issues that are of specific importance in franchise businesses. As franchisors and franchisees have the power and duty to make decisions concerning the collection, use, and disclosure of customers’ and employees’ personal data in the course of their operations, they are considered “data controllers” under the PDPA. The Trade Competition Commission of Thailand, via its Notification on the Guidelines for the Consideration of Unfair Trade Practices in Franchise Businesses issued under the Trade Competition Act B.E. 2560 (2017), defines a franchise relationship as one which, among others, involves an element of control by the franchisor over the business operations of the franchisee. It follows then that in some situations, franchisees’ collection, use, and disclosure of personal data will be according to the instructions of their franchisors. In such circumstances, a franchisee will be considered a “data processor” under the PDPA. Whether acting as data controllers or data processors, franchisors and franchisees must nonetheless comply with the requirements of the PDPA in the course of their operations. To ensure their activities are in compliance with the law, franchise businesses should consider five major actions: 1. Auditing existing data collection and retention practices Whether operating online or via a brick and mortar shop, it is increasingly common for franchise businesses to store and process customers’ personal data. This may include the storage and transmission of credit card information for auto-billing
Read More
April 26, 2022
During the first quarter of 2022, Thailand’s Securities and Exchange Commission (SEC) announced a series of notifications aiming to strengthen the regulatory regime for digital assets while safeguarding investors’ interests. The updated rules and conditions apply to digital asset business operators licensed by the SEC. The key features of the new notifications, which took effect in March and April 2022, are summarized below. Custody of customers’ assets (effective March 1, 2022) As custodians of their customers’ assets, digital asset business operators must: Segregate customers’ assets in their custody so that the operators can clearly identify which assets belong to which investors. If customers’ digital assets are to be deposited with a third party, the operators must inform the customers accordingly. Refrain from seeking benefits from customers’ assets in any manner other than the purpose for which the assets are held. This includes refraining from using customers’ assets to provide benefits to others or to the customers themselves, and from depositing customers’ digital assets with a custodian that intends to lend out the digital assets (but does not include giving the customer’s assets to a licensed digital asset fund manager for investment in digital assets). Reconcile customers’ assets and keep evidentiary documentation for a period of at least five years. Privacy coin services (effective April 1, 2022) Digital asset business operators are prohibited from providing privacy coin services that can conceal (or allow the concealing of) specific transactional information, such as data about the transferor, the transferee, and the transfer amount. Digital asset business operators that provided privacy coin services to customers before the effective date of these new regulations may continue to provide such services, but they must arrange for their customers to disclose at least the required transactional information or agree not to engage in information concealment. Digital
Read More
March 10, 2022
On March 7, 2022, the government of Vietnam issued Resolution No. 27/NQ-CP (“Resolution 27”) approving the promulgation of the latest version of the Draft Decree on Personal Data Protection (“Draft PDPD”) prepared by the Ministry of Public Security (“MPS”), and further instructed the MPS to pass this draft to the National Assembly’s Standing Committee for final consideration. Although the full content of the approved Draft PDPD has not been made available to the public, Resolution 27 clearly sets out several circumstances approved by the government in which processing of personal data can be carried out without the consent of the data subjects. In comparison with the corresponding provision under the widely seen version of the Draft PDPD made available to the public in February 2021 (“February Draft”), the main differences are as follows: If the data processing is necessary in response to an emergency situation that threatens the life, health, or safety of the data subject or other individual, the data controller, data processor, data controller/processor, or a third party can process the personal data without consent of the data subject, but they are responsible for proving that the situation is an emergency. The February Draft did not mention any requirement of proof. Moreover, “safety of the data subject or other individual” is a newly added criterion for personal data processing without consent under this circumstance. If the data processing is necessary because of national defense and security requirements, the processing must be carried out by competent authorities in accordance with other laws. The requirement that the processing must be carried out “by competent authorities” in this circumstance was not provided under the February Draft. Two circumstances have been removed: the processing of personal data in compliance with specific provisions that explicitly allow the processing of personal data without
Read More