BOT Proposes New Digital Channel Security Requirements to Strengthen Fraud Prevention

The Bank of Thailand (the “BOT”) is conducting a public consultation (the “Consultation”) from 7 October to 6 November 2026 on the draft BOT Notification on Digital Channel Security (the “Draft Notification”). The Consultation seeks feedback from relevant stakeholders.

The Draft Notification aims to strengthen the security of financial and payment services delivered through digital channels, in response to evolving cybersecurity threats and unauthorized payment fraud.

Background and Objectives

In 2025, the BOT introduced mobile banking security requirements to protect users against cybersecurity threats and unauthorized payment fraud. Although these requirements share similar objectives and principles, they were issued under three separate notifications, each applicable to a different category of service provider:

• BOT Notification No. 4/2568: financial institutions;
• BOT Notification No. 17/2568: specialized financial institutions; and
• BOT Notification No. 18/2568: regulated e-money service providers offering services through mobile applications.

Fraudsters have since expanded their activities beyond mobile banking applications to other digital channels, in particular internet banking and the mobile applications of non-bank financial service providers.

To address these risks, the BOT proposes to extend the security requirements to internet banking and additional categories of service providers, and to consolidate the three existing notifications into a single regulatory framework. These changes are intended to strengthen fraud prevention, ensure consistent security standards and enhance public confidence in Thailand’s financial and payment systems.

Key Principles and Changes

The Draft Notification proposes a unified security framework covering a broader range of digital financial services and service providers. Its key requirements, and the changes from the existing framework, are summarized below.

(1) Repeal of Existing Notifications

The Draft Notification would repeal and replace the three existing notifications with a single notification establishing consistent security requirements for all covered service providers.

(2) Definitions and Scope of Application

The Draft Notification would expand the existing scope in three key respects:

• Digital Channels: The scope would extend from mobile banking applications to both mobile banking and internet banking.
• Service Providers: The number of covered categories would increase from three to six, comprising financial institutions, specialized financial institutions, regulated e-money service providers, credit card business operators, regulated personal loan business operators and regulated nano-finance business operators (collectively, the “Service Providers”). The last three categories would be newly covered.
• Covered Services: The framework would apply only to services that enable individual customers to (i) transfer money to an account held with a different bank or service provider (for example, an interbank transfer); or (ii) withdraw cash from ATMs or other electronic machines (for example, a cardless withdrawal initiated through a mobile banking application).

Accordingly, the Draft Notification would not cover all financial services offered through mobile banking applications or internet banking, but only the services specified above.

(3) Security Requirements

The Draft Notification would incorporate the existing mobile banking security measures into the expanded framework and require Service Providers to implement security measures in three key areas:

• Prevention of Unauthorized Payment Fraud: Service Providers would be required to implement secure customer identification and authentication, including Know Your Customer (“KYC”) procedures or reliable multi-factor authentication (“MFA”) for service registration and for installation on new devices. Additional measures include account and device restrictions, MFA for specified high-risk transactions, restrictions on the use of SMS and email one-time passwords (OTPs) for certain transactions, and transaction alerts.
• Prevention of Service Provider Impersonation: Service Providers would be required to restrict links sent via SMS and email, as well as links requesting sensitive information through social media, subject to specified exceptions. They would also be required to monitor and respond to fraudulent websites and applications that impersonate their services.
• Mobile Application Security: Service Providers offering covered services through mobile applications would be subject to additional requirements, including customer data protection, encryption, secure communications, and safeguards against unauthorized access, malware and application tampering. Facial verification would also be required, subject to specified exceptions, for the following transactions:
  • a single transfer of THB 50,000 or more;
  • cumulative transfers reaching THB 200,000 per day; and
  • an increase of THB 50,000 or more in the daily transfer limit.

(4) Exemptions

Service Providers that are unable to comply with certain requirements due to necessary or exceptional circumstances may request an exemption from the BOT, supported by reasons and an implementation plan.

For circumstances existing before the Draft Notification takes effect, exemption requests must be submitted within seven days after its effective date, in accordance with the transitional provisions. The BOT would consider each request within 30 business days of receiving all required documents.

(5) Effective Date

The Draft Notification would generally take effect 30 days after its publication in the Government Gazette. However, certain MFA requirements relating to cash withdrawals and credit drawdowns through ATMs would take effect 90 days after publication.

Current Status and Next Steps

Following the Consultation, the BOT is expected to review the feedback received and consider any necessary revisions before issuing the final notification.

The Draft Notification carries a proposed signing date in January 2027, which suggests that issuance is anticipated around that time. However, the BOT has not confirmed the final issuance date, which remains subject to the outcome of the Consultation and the subsequent regulatory process.

Key Takeaways

• The BOT proposes to replace three existing notifications with a single notification covering both mobile banking and internet banking, and to expand regulatory coverage from three to six categories of service providers.
• Covered Service Providers would be required to implement measures against unauthorized payment fraud and impersonation, including customer authentication, transaction alerts and additional mobile application safeguards.
• The Consultation remains open until 6 November 2026. Once issued, the Draft Notification would generally take effect 30 days after publication in the Government Gazette, with certain requirements taking effect after 90 days. Relevant Service Providers should review their existing security measures and prepare for compliance.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

• DIP: WIPO GRATK Study Puts Genetic Resource Records in Focus
• FDA: Building a Telepharmacy Platform—What Developers Need to Address
• DIP: New Facility Checks the Status of Corporate Trademark Owners
• Thailand’s Revenue Department Launches Public Consultation on Draft Departure Tax Act: Key Proposed Principles and Implications
• PDPA: Research Consent, Lawful Bases and the Use of Personal Data in Research
• Thailand–Canada Free Trade Agreement (TCAFTA): Cabinet Approves Negotiating Framework