You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

June 27, 2024

Thailand Updates Customer Codes for Heightened Money Laundering Risk

Subscribe to Updates

On May 17, 2024, Thailand’s Anti-Money Laundering Office (AMLO) issued an amended Notification Concerning the Rules for Designating or Reviewing the List of High-Risk Customers Who Require Close Monitoring under the Ministerial Regulation on Customer Due Diligence B.E. 2563 (2020). This notification, which took effect the following day, updates the previous version of the notification from 2022 to cover cybercrimes listed under the Emergency Decree on Measures for the Prevention and Suppression of Technological Crimes B.E. 2566 (2023). The amended notification sets out the steps that all financial institutions in Thailand must take to manage money laundering risks and to comply with the AMLO’s mandatory Guidelines on Customer Due Diligence.

Under the new notification, account holders suspected of engaging in or facilitating technological crimes, as recorded by the Anti Online Scam Operation Center (AOC), are to be classified as “high-risk persons.” The notification includes provisions for listing high-risk customers under two specific codes:

  • HR-03-1: This code applies to individuals who are the subject of either a petition or a complaint related to a predicate offense accepted by the relevant inquiry officer and recorded as a criminal case. It also covers individuals whose bank accounts are suspected of being used to conduct transactions related to crimes under the Emergency Decree on Measures for the Prevention and Suppression of Technological Crimes B.E. 2566 (2023), with victims seeking prosecution. The names of individuals in this category are received from responsible agencies according to the Criminal Procedure Code or the AOC and are documented in a publicly accessible online notification system.
  • HR-03-2: This code is for individuals involved in the commission of a predicate offense or those whose bank accounts are suspected of being used in such offenses, but whose cases have not been accepted or numbered by the relevant inquiry officer. Names under this category are provided by agencies such as the Royal Thai Police, the Financial Investigation Division, the Cooperation and Standard Development Division, banks, or other sources in Thailand.

These updated rules aim to ensure that relevant individuals and their transactions are closely supervised, thus enhancing the efficiency of monitoring high-risk customers and preventing technological crimes.

For more information on this new notification, or on any aspect of Thailand’s anti-money laundering regulations, please contact Chitchai Punsan at [email protected] or Panisara Moleegul at [email protected].

Related Professionals

Practices

Banking and Finance

Compliance and Investigations

Location

RELATED INSIGHTS​ 

August 3, 2026
On July 23, 2026, the Bank of Thailand (BOT) released for public comment its draft Notification on Digital Channel Security, which would significantly expand the scope and stringency of Thailand’s existing mobile banking security framework. If finalized in its current form, the draft notification would extend mandatory security requirements to credit card providers and credit providers, cover internet banking in addition to mobile applications, phase out SMS one-time passwords (OTPs) for transaction authentication, and introduce biometric verification requirements for high-value transactions. The public comment period is open through August 24, 2026. Background The BOT’s existing Mobile Banking Security Notification, issued in 2024, sets minimum security standards for financial institutions, specialized financial institutions (SFIs), and e-money providers, significantly reducing “money-draining app” fraud. However, fraudsters have since shifted to nonbank providers and internet banking channels, prompting the BOT to propose broader security requirements. Expanded Scope of Regulated Entities and Channels The existing Mobile Banking Security Notification covers only financial institutions, SFIs, and e-money providers offering mobile banking services. The draft expands coverage in two key areas: entities and channels. On the entity side, it adds credit card providers and credit providers that offer fund transfers to third parties at other financial service providers or that provide cash withdrawal services to individual retail customers. On the channel side, it broadens coverage to include internet banking in addition to mobile banking. Strengthened Customer Authentication The draft introduces enhanced authentication requirements in three areas: Service enrollment and device changes. Providers must implement rigorous identity verification, notify customers of enrollment results through out-of-band communication channels, and adopt risk-mitigation measures such as cooling-off periods and temporary transaction limits. Transaction-level authentication. Providers must use two-factor authentication for fund transfers, cardless ATM withdrawals, and transaction limit increases. Secure authentication factors. Key requirements include the following: “What-you-know” factors must
Read More
July 27, 2026
A new decree on penalties for violations related to the crypto asset market creates compliance risks for offshore crypto asset exchanges in Vietnam that do not hold, and practically cannot obtain, a Vietnamese license, and for Vietnamese users who continue to transact on those platforms. Decree No. 284/2026/ND-CP (Decree 284), issued by the government of Vietnam on July 16, 2026, formally establishes an administrative penalty framework for violations related to crypto assets and the crypto asset market. The decree takes effect on September 1, 2026, and will remain in force for the duration of the five-year pilot program under Resolution No. 05/2025/NQ-CP, which is scheduled to end in September 2030. Direct Penalties on Vietnamese Users The most immediate commercial risk to offshore platforms is that their Vietnamese users now face direct personal liability for using their exchanges. Vietnamese users who trade crypto assets outside of a Ministry of Finance-licensed service provider face fines of up to VND 50 million (approximately USD 1,900). Vietnamese users trading in crypto assets that are offered or issued to foreign users face higher penalties of up to VND 100 million (approximately USD 3,800). It is expected that Vietnamese users will be more willing to migrate away from offshore platforms now that there is a risk of real enforcement against them. Penalties on Unlicensed Service Providers Violations of providing crypto asset services or advertising crypto-related services without a license face fines of up to VND 200 million (approximately USD 7,700). Operating a crypto asset trading market without proper authorization falls within the same highest penalty bands. Organizations that violate issuance, provision, or disclosure rules may face fines of up to VND 200 million. Although the maximum administrative fine per violation is capped at VND 200 million for organizations and VND 100 million for individuals, these
Read More
July 17, 2026
On July 11, 2026, media reports conveyed key messages from Bank of Thailand (BOT) Governor Vitai Ratanakorn’s announcement of a sweeping regulatory crackdown on grey capital activities. The measures target high-value cash transactions, gold trading, and stablecoin flows, with new requirements set to take effect in the fourth quarter of 2026. The initiative aims to prevent financial institutions from facilitating shadow economy activity, money laundering—particularly through stablecoins—and capital flight, through enhanced compliance obligations on commercial banks across multiple transaction channels. Expanded Cash Controls Close the Deposit–Withdrawal Circuit New fourth-quarter guidelines will require individuals depositing THB 5 million or more in cash to formally verify the source of their funds. This builds on restrictions introduced in April 2026, which required anyone withdrawing 5 million baht or more in cash to provide their bank with verified commercial justification for why electronic transfers or checks could not be used. That initial measure caused high-value physical cash withdrawals to drop by 35 percent nationwide. The upcoming deposit-side requirement closes the circuit on large cash movements. The BOT is also assessing tracking mechanisms for high-value banknote swaps, specifically targeting individuals seeking to exchange large volumes of THB 1,000 notes into smaller THB 100 or THB 500 denominations without clear business justification. Governor Vitai emphasized that these measures require continuous deployment of multiple parallel strategies rather than short-term fixes. Tightened Bullion Reporting Frameworks Restrict Money Laundering Channels The BOT has also tightened reporting frameworks for gold trading to close money laundering loopholes and shield the Thai baht from speculative bullion volatility. Regulators identified a recurring pattern in which buyers purchased large quantities of gold through digital applications in the morning and then made same-day physical withdrawals from retail gold shops in the afternoon. Gold shops are reminded of their duties to flag and report cash
Read More
July 14, 2026
Tilleke & Gibbins has contributed the Thailand and Vietnam chapters to Investigations in Southeast Asia, a comprehensive guide published by Drew Network Asia (DNA). The resource provides a practical overview of anticorruption laws, corporate investigations, and compliance frameworks across six key Southeast Asian jurisdictions. Designed for in-house counsel, compliance officers, and risk management professionals, the guide offers actionable insights for navigating complex cross-border regulatory challenges and establishing effective, regionally coordinated compliance and investigation strategies. The guide begins with a regional perspective on enforcement trends and cross-border cooperation initiatives. Jurisdiction-specific chapters follow a standardized structure—covering primary corruption offenses, enforcement authorities, corporate liability, investigation procedures and dawn raids, whistleblower protections, and recommended compliance measures. In addition to country-by-country analysis, the publication highlights best practices for conducting internal investigations, managing digital evidence, and handling parallel proceedings involving multiple regional or international regulators. The guide serves as a practical reference for organizations operating in Southeast Asia. Because legal and regulatory risks depend on specific industry sectors and operational contexts, readers seeking tailored advice are encouraged to contact the authors listed in each chapter. The full guide is available for download through the button below or directly from the DNA website.
Read More