BOT Proposes New Digital Channel Security Requirements to Strengthen Fraud Prevention

The Bank of Thailand (the “BOT”) is conducting a public consultation (the “Consultation”) from 7 October to 6 November 2026 on the draft BOT Notification on Digital Channel Security (the “Draft Notification”). The Consultation seeks feedback from relevant stakeholders.

The Draft Notification aims to strengthen the security of financial and payment services delivered through digital channels, in response to evolving cybersecurity threats and unauthorized payment fraud.

Background and Objectives

In 2025, the BOT introduced mobile banking security requirements to protect users against cybersecurity threats and unauthorized payment fraud. Although these requirements share similar objectives and principles, they were issued under three separate notifications, each applicable to a different category of service provider:

• BOT Notification No. 4/2568: financial institutions;
• BOT Notification No. 17/2568: specialized financial institutions; and
• BOT Notification No. 18/2568: regulated e-money service providers offering services through mobile applications.

Fraudsters have since expanded their activities beyond mobile banking applications to other digital channels, in particular internet banking and the mobile applications of non-bank financial service providers.

To address these risks, the BOT proposes to extend the security requirements to internet banking and additional categories of service providers, and to consolidate the three existing notifications into a single regulatory framework. These changes are intended to strengthen fraud prevention, ensure consistent security standards and enhance public confidence in Thailand’s financial and payment systems.

Key Principles and Changes

The Draft Notification proposes a unified security framework covering a broader range of digital financial services and service providers. Its key requirements, and the changes from the existing framework, are summarized below.

(1) Repeal of Existing Notifications

The Draft Notification would repeal and replace the three existing notifications with a single notification establishing consistent security requirements for all covered service providers.

(2) Definitions and Scope of Application

The Draft Notification would expand the existing scope in three key respects:

• Digital Channels: The scope would extend from mobile banking applications to both mobile banking and internet banking.
• Service Providers: The number of covered categories would increase from three to six, comprising financial institutions, specialized financial institutions, regulated e-money service providers, credit card business operators, regulated personal loan business operators and regulated nano-finance business operators (collectively, the “Service Providers”). The last three categories would be newly covered.
• Covered Services: The framework would apply only to services that enable individual customers to (i) transfer money to an account held with a different bank or service provider (for example, an interbank transfer); or (ii) withdraw cash from ATMs or other electronic machines (for example, a cardless withdrawal initiated through a mobile banking application).

Accordingly, the Draft Notification would not cover all financial services offered through mobile banking applications or internet banking, but only the services specified above.

(3) Security Requirements

The Draft Notification would incorporate the existing mobile banking security measures into the expanded framework and require Service Providers to implement security measures in three key areas:

• Prevention of Unauthorized Payment Fraud: Service Providers would be required to implement secure customer identification and authentication, including Know Your Customer (“KYC”) procedures or reliable multi-factor authentication (“MFA”) for service registration and for installation on new devices. Additional measures include account and device restrictions, MFA for specified high-risk transactions, restrictions on the use of SMS and email one-time passwords (OTPs) for certain transactions, and transaction alerts.
• Prevention of Service Provider Impersonation: Service Providers would be required to restrict links sent via SMS and email, as well as links requesting sensitive information through social media, subject to specified exceptions. They would also be required to monitor and respond to fraudulent websites and applications that impersonate their services.
• Mobile Application Security: Service Providers offering covered services through mobile applications would be subject to additional requirements, including customer data protection, encryption, secure communications, and safeguards against unauthorized access, malware and application tampering. Facial verification would also be required, subject to specified exceptions, for the following transactions:
  • a single transfer of THB 50,000 or more;
  • cumulative transfers reaching THB 200,000 per day; and
  • an increase of THB 50,000 or more in the daily transfer limit.

(4) Exemptions

Service Providers that are unable to comply with certain requirements due to necessary or exceptional circumstances may request an exemption from the BOT, supported by reasons and an implementation plan.

For circumstances existing before the Draft Notification takes effect, exemption requests must be submitted within seven days after its effective date, in accordance with the transitional provisions. The BOT would consider each request within 30 business days of receiving all required documents.

(5) Effective Date

The Draft Notification would generally take effect 30 days after its publication in the Government Gazette. However, certain MFA requirements relating to cash withdrawals and credit drawdowns through ATMs would take effect 90 days after publication.

Current Status and Next Steps

Following the Consultation, the BOT is expected to review the feedback received and consider any necessary revisions before issuing the final notification.

The Draft Notification carries a proposed signing date in January 2027, which suggests that issuance is anticipated around that time. However, the BOT has not confirmed the final issuance date, which remains subject to the outcome of the Consultation and the subsequent regulatory process.

Key Takeaways

• The BOT proposes to replace three existing notifications with a single notification covering both mobile banking and internet banking, and to expand regulatory coverage from three to six categories of service providers.
• Covered Service Providers would be required to implement measures against unauthorized payment fraud and impersonation, including customer authentication, transaction alerts and additional mobile application safeguards.
• The Consultation remains open until 6 November 2026. Once issued, the Draft Notification would generally take effect 30 days after publication in the Government Gazette, with certain requirements taking effect after 90 days. Relevant Service Providers should review their existing security measures and prepare for compliance.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

• DIP: WIPO GRATK Study Puts Genetic Resource Records in Focus
• FDA: Building a Telepharmacy Platform—What Developers Need to Address
• DIP: New Facility Checks the Status of Corporate Trademark Owners
• Thailand’s Revenue Department Launches Public Consultation on Draft Departure Tax Act: Key Proposed Principles and Implications
• PDPA: Research Consent, Lawful Bases and the Use of Personal Data in Research
• Thailand–Canada Free Trade Agreement (TCAFTA): Cabinet Approves Negotiating Framework

BOI: New Screening Requirements for Data Center Investment Promotion

The Board of Investment (BOI) has introduced a mandatory screening requirement for Data Center projects seeking investment promotion, extending its application to certain pending applications and expansions of existing projects. Under BOI Notification No. Sor. 3/2569, projects must obtain prior approval from a BOI-designated subcommittee before submitting an investment-promotion application. The notification, published on the Energy Regulatory Commission (ERC) website, reflects increasing regulatory scrutiny of Data Center investments, particularly their demands on electricity infrastructure, water resources and the environment.

Mandatory Screening Before BOI Applications:

Notification No. Sor. 3/2569 replaces Notification No. Sor. 2/2569, which previously required confirmation from the ERC before an investment-promotion application could be submitted. Under the revised requirements, Data Center projects classified under Category 8.2.1.1 (high-energy-efficiency Data Centers) and Category 8.2.1.2 (other Data Centers) must instead obtain approval from a subcommittee designated by the BOI to screen Data Center projects. This approval is a prerequisite to submitting an application for investment promotion, introducing an additional regulatory stage that developers must address before proceeding with the BOI application process.

Pending Applications and the 30% IT Load Threshold:

Importantly, the notification is not limited to new applications. Clause 3 expressly extends its application to projects submitted under the previous investment-promotion policy that remain under consideration, as well as applications to amend existing projects where the proposed changes increase IT load by more than 30%. Accordingly, developers cannot assume that earlier applications are automatically exempt from the revised screening requirements. The 30% threshold is particularly significant for phased developments and capacity expansions, as an existing BOI-promoted project may require further screening when its approved IT load is substantially increased.

Implications for Data Center Developers:

The revised requirements introduce an additional consideration for investment planning and regulatory due diligence. Developers should assess the screening requirement before filing new applications, review the status of pending applications and evaluate whether planned capacity expansions exceed the prescribed IT load threshold. Electricity infrastructure, water availability and environmental considerations should also be addressed early in project planning, given their express recognition in the notification. These requirements are already operative and must be distinguished from the broader national Data Center regulatory proposals concerning building classification, electricity-consumption categories and Direct Power Purchase Agreements (Direct PPAs), which remain separate policy matters and are not implemented by this notification.

Key Takeaways:

• Prior approval: Data Center projects under BOI Categories 8.2.1.1 and 8.2.1.2 require subcommittee approval before applying for investment promotion.
• Pending applications: Projects submitted under the previous policy and still under consideration are subject to the revised requirements.
• Expansion threshold: Project amendments increasing IT load by more than 30% are also covered.
• Infrastructure scrutiny: Electricity, water resources and environmental considerations are central to the revised screening policy.
• Separate regulatory framework: The BOI notification establishes an existing investment-promotion requirement, independently of the proposed national Data Center regulations.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

• DIP: WIPO GRATK Study Puts Genetic Resource Records in Focus
• FDA: Building a Telepharmacy Platform—What Developers Need to Address
• DIP: New Facility Checks the Status of Corporate Trademark Owners
• Thailand’s Revenue Department Launches Public Consultation on Draft Departure Tax Act: Key Proposed Principles and Implications
• PDPA: Research Consent, Lawful Bases and the Use of Personal Data in Research
• Thailand–Canada Free Trade Agreement (TCAFTA): Cabinet Approves Negotiating Framework

Competition: New Mandatory Credit Terms for Payments to SMEs

The Trade Competition Commission has introduced new rules governing credit terms between large businesses and small and medium-sized enterprises (SMEs). The new framework represents a significant development in the regulation of unfair trade practices by imposing maximum payment periods on large businesses purchasing goods or services from SMEs and restricting practices that may delay payment or otherwise place SMEs at a disadvantage. The rules are particularly relevant to large manufacturers, service providers, distributors, wholesalers, retailers and corporate groups that routinely procure goods or services from SME suppliers.

Who Is Subject to the New Rules?

The rules apply where an SME supplies goods or services to a large business or a large wholesale or retail business. A large business generally means a business operator whose revenue generated from business operations in Thailand in the preceding accounting year is THB 500 million or more. Importantly, the assessment is not necessarily limited to the revenue of a single legal entity. Businesses having relationships in terms of policy or control may be considered together in determining whether the threshold is met. This aggregation concept is particularly relevant to corporate groups, meaning that an entity with revenue below THB 500 million should not automatically assume that it falls outside the rules. Large businesses should therefore establish a reliable process for determining which suppliers qualify as SMEs and whether the revenue threshold is met on an individual or group basis.

Maximum Credit Terms of 30 or 45 Days:

For general trade, manufacturing and service transactions, payment must generally be made within 45 days. A shorter maximum period of 30 days applies to agricultural products and primary processed agricultural products involving uncomplicated production processes. Where the parties have already agreed to a payment period shorter than the applicable statutory maximum, the shorter agreed period continues to apply. The statutory periods should therefore be regarded as maximum limits rather than standard payment terms permitting businesses to extend existing, more favorable terms.

When Does the Credit Period Begin?

The credit period generally begins when the goods or services have been completely delivered and the required documentation is complete and correct. This makes delivery confirmation, service acceptance, invoices and supporting documentation important elements of compliance. Large businesses should examine whether their internal procedures could effectively postpone the commencement of the payment period. Requirements relating to acceptance certificates, invoice submission, tax invoice corrections, procurement approvals or other supporting documents should have a legitimate operational basis and should not be used as mechanisms to delay payment. Compliance may therefore require coordination among procurement, business units, finance, legal and accounts payable functions.

Unfair Payment Practices:

The rules extend beyond maximum payment periods and address conduct that may constitute an unfair trade practice. Large businesses should not delay payment to SMEs without reasonable justification or improperly change agreed credit terms or contractual conditions. Relevant changes are also subject to advance-notice requirements, including at least 60 days’ prior notice in applicable circumstances. Accordingly, compliance cannot be achieved merely by inserting a contractual provision stating “payment within 45 days.” Repeatedly rejecting invoices for immaterial deficiencies, unnecessarily delaying acceptance of delivered goods, imposing unjustified documentation requirements or changing payment procedures in a manner that effectively extends the credit period may potentially attract regulatory scrutiny.

Impact on Existing Contracts and Procurement Practices:

The rules restrict the extent to which payment terms can simply be treated as a matter of contractual negotiation. Large purchasers may historically have required SME suppliers to accept payment periods of 60, 90 or even 120 days under standard procurement terms. Contractual agreement alone will no longer necessarily validate such arrangements where the applicable statutory maximum is exceeded. Businesses should therefore review master supply agreements, purchase orders, vendor terms, procurement policies and supplier portals, including contractual mechanisms that may have substantially the same economic effect as an extended credit term.

Competition Law Consequences:

Non-compliance may constitute an unfair trade practice under Section 57(4) of the Trade Competition Act B.E. 2560 (2017) and may result in an administrative fine of up to 10% of the offender’s revenue in the year in which the violation occurred. It is important to distinguish this administrative liability from criminal liability under other provisions of the Act. A violation of the credit-term requirements does not, by itself, automatically constitute a criminal offense. However, the same conduct may separately fall within other provisions of the Act, including those concerning abuse of dominance or anticompetitive conduct, where the relevant statutory elements are independently satisfied.

Preparing for Compliance:

Affected businesses should review both their contractual documentation and actual payment processes. The review should identify SME suppliers, determine whether the THB 500 million threshold applies on an individual or group basis, classify transactions subject to the 30-day and 45-day limits, and examine master agreements, purchase orders and standard procurement terms. Businesses should also review how they determine complete delivery and receipt of correct documentation and ensure that invoice approval, dispute resolution and accounts payable processes do not unnecessarily extend payment periods. For corporate groups with centralized procurement or accounts payable functions, supplier classification and automated payment-term controls within ERP or payment systems may provide an effective compliance mechanism.

Key Takeaways:

The new credit-term rules materially strengthen payment protection for SMEs dealing with larger counterparties. Businesses meeting the THB 500 million revenue threshold, including through aggregation where applicable, should assess their procurement relationships and identify SME suppliers subject to the new regime. The principal maximum credit terms are 45 days for general trade, manufacturing and services and 30 days for qualifying agricultural and primary processed agricultural products. Compliance extends beyond contractual wording to delivery acceptance, documentation, invoice verification and actual payment practices. Given the potential administrative fine of up to 10% of annual revenue, affected businesses should treat compliance with the new credit-term requirements as a competition-law and procurement compliance issue rather than merely an accounts payable matter.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

• DIP: WIPO GRATK Study Puts Genetic Resource Records in Focus
• FDA: Building a Telepharmacy Platform—What Developers Need to Address
• DIP: New Facility Checks the Status of Corporate Trademark Owners
• Thailand’s Revenue Department Launches Public Consultation on Draft Departure Tax Act: Key Proposed Principles and Implications
• PDPA: Research Consent, Lawful Bases and the Use of Personal Data in Research
• Thailand–Canada Free Trade Agreement (TCAFTA): Cabinet Approves Negotiating Framework

Thailand Seeks U.S. Investment in AI and Digital Infrastructure

Executive Summary

During an official diplomatic mission to New York, a high-level Thai delegation led by the Prime Minister and Minister of Interior, accompanied by the Deputy Prime Minister and Minister of Commerce, and the Minister of Digital Economy and Society (“DES”), engaged in strategic discussions with global financial and technology leadership—including senior executives from Bank of America (“BofA”), Microsoft Corporation, and Pacific Investment Management Company LLC (“PIMCO”). Joined by senior representatives from the Stock Exchange of Thailand (SET) and the Federation of Thai Capital Market Organizations (FETCO), the delegation presented Thailand’s policy roadmap to over 25 major institutional fund managers representing more than USD 40 trillion in assets under management (AUM).

The discussions focused primarily on foreign direct investment (FDI) opportunities in Thailand’s rapidly expanding digital economy—specifically targeting Artificial Intelligence (“AI”), data center architecture, cybersecurity, digital infrastructure, and clean energy transition to support energy-intensive tech operations. To reinforce global investor confidence, the Thai government emphasized its neutral, balanced foreign policy between the United States and China, focusing on mutual economic benefit without taking sides. Furthermore, the delegation expressed gratitude to Microsoft Corporation for its ongoing support of Thailand’s accession process to the Organization for Economic Co-operation and Development (“OECD”) as a structural catalyst to elevate domestic regulatory frameworks, legal productivity, and regional supply chain competitiveness.

Benefits for Thai Business Operators and Local Investors

The Thai government’s focused push to position the country as Southeast Asia’s digital and AI hub creates significant structural advantages for domestic commercial entities and institutional investors:

• Local Tech, Telecom, and Infrastructure Developers: Domestic companies operating in telecommunications, cloud hosting, and data center facilities stand to benefit directly through joint ventures, technical knowledge transfer, and strategic co-investments with major U.S. technology leaders such as Microsoft Corporation.
• Renewable Energy and Utility Operators: As large-scale AI processing and data center operations require sustainable power, local clean energy providers gain direct commercial opportunities through long-term Power Purchase Agreements (PPAs) and green energy solution partnerships.
• Export and Technology-Driven Supply Chains: Alignment with international technology and OECD standards enhances the global competitiveness of Thai enterprises, facilitating seamless integration into multinational supply chains and technology networks.
• Thai Capital Market and Local Financial Institutions: Sustained engagement with top-tier asset managers like PIMCO and BofA stimulates foreign portfolio allocations toward domestic debt and capital markets, lowering capital costs and enhancing liquidity for local corporate issuers seeking digital transformation financing.

Preparation for Thai Business Operators and Investors: Strategic and Legal Roadmaps

To effectively absorb foreign direct capital, leverage advanced U.S. technology, and ensure seamless commercial integration, domestic business operators and local investors should address key regulatory, legal, and operational considerations:

1. Compliance with the Upcoming Draft Digital Infrastructure Act for Data Center Operators

Under the pending Draft Digital Infrastructure Business Operation Act, data center operators face an evolving regulatory landscape:

• Licensing & Corporate Setup: Operators shall incorporate as a Thai limited or public limited company, secure an operating license from the Ministry of Digital Economy and Society (DES), and post performance financial guarantees.
• Resource & Environmental Standards: High-energy operations shall meet mandatory clean energy consumption ratios, strictly manage power/water usage effectiveness (PUE/WUE), comply with zoning rules, and undergo Environmental Impact Assessments (EIA).
• Local Data Storage: The bill enforces data localization for domestic personal and corporate data, permitting overseas transfers only under specific legal exemptions.

2. Data Governance, Cross-Border Transfer, and Cybersecurity Compliance

In tandem with sector-specific data center rules, domestic entities shall maintain full compliance with the Personal Data Protection Act B.E. 2562 (2019) (PDPA) and the Cybersecurity Act B.E. 2562 (2019). Companies partnering with multinational cloud or AI providers shall review cross-border data transfer mechanisms and cloud infrastructure security protocols to ensure strict regulatory alignment.

3. Intellectual Property (IP) Protection and Technology Licensing

Collaboration with foreign technology providers involves processing proprietary algorithms and advanced software solutions. Thai business operators shall establish comprehensive IP protection strategies under the Patent Act B.E. 2522 (1979) and the Copyright Act B.E. 2537 (1994). Commercial contracts shall explicitly define IP ownership rights, technology licensing terms, source code access, and non-disclosure obligations (NDAs) for co-developed AI solutions.

4. Corporate Structuring, Green ESG Alignment, and Investment Incentives

Foreign partnerships and joint venture arrangements shall comply with statutory foreign equity limitations prescribed under the Foreign Business Act B.E. 2542 (1999) (FBA). Additionally, local enterprises should structure corporate vehicles to align with international ESG metrics and capitalize on green investment privileges granted by the Board of Investment (BOI) or regulatory incentives within the Eastern Economic Corridor (EEC) framework.

5. Workforce Upskilling and Legal Governance for AI Integration

Local companies integrating enterprise AI solutions should update internal employment contracts, acceptable use policies, and compliance manuals to account for AI-driven workflows. Organizational governance frameworks should adhere to national guidelines—such as the Thailand National AI Strategy and Action Plan—ensuring transparent algorithmic risk management and proper employee training on data privacy and cyber defense.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

• DIP: WIPO GRATK Study Puts Genetic Resource Records in Focus
• FDA: Building a Telepharmacy Platform—What Developers Need to Address
• DIP: New Facility Checks the Status of Corporate Trademark Owners
• Thailand’s Revenue Department Launches Public Consultation on Draft Departure Tax Act: Key Proposed Principles and Implications
• PDPA: Research Consent, Lawful Bases and the Use of Personal Data in Research
• Thailand–Canada Free Trade Agreement (TCAFTA): Cabinet Approves Negotiating Framework

Social Commerce Overhaul: From Seller Verification to Influencer Accountability

The regulatory gap created by social commerce:

Social commerce has blurred many of the distinctions on which traditional e-commerce regulation was built. A consumer may discover a product through an influencer, encounter promotional content on a social-media platform, communicate directly with a seller through the same platform, and complete the purchase without ever visiting a conventional online marketplace. The seller, the person promoting the product, the person paying for the advertisement, and the platform carrying the content may all be different parties. This structure creates a regulatory challenge because consumer protection laws have traditionally focused on businesses supplying goods or services and unlawful advertising, while digital-platform regulation has focused principally on platform operators. Social commerce sits between these regimes. Recent regulatory initiatives indicate that this gap is gradually being addressed—not through a single “social commerce” law, but through complementary regulatory work-streams involving the Electronic Transactions Development Agency (ETDA) and the Office of the Consumer Protection Board (OCPB).

ETDA: From online marketplaces to identifying sellers and advertisers

The regulatory framework for digital commerce has already moved beyond conventional marketplace websites. Under the Digital Platform Services (DPS) framework, ETDA regulates qualifying digital platform services and has progressively developed requirements and guidance concerning online marketplaces, product and seller information, advertising, notice-and-takedown mechanisms, and other aspects of platform governance. Social media is increasingly relevant to this framework because commercial activity can take place within services that were not originally designed as conventional marketplaces. ETDA has also identified social commerce as an area requiring further regulatory attention.

A particularly important development is the increasing emphasis on the identity and traceability of sellers and advertisers. ETDA’s existing advertising guidance recommends that platforms establish procedures for checking advertiser information and verifying identity, maintain relevant advertiser records, and use mechanisms such as watchlists, blacklists, and whitelists. It also addresses screening advertisements before publication and monitoring them afterward through reporting and flagging mechanisms. ETDA’s developing measures for social-media platforms build on this approach by contemplating risk-based identification and verification of users, sellers, and persons placing advertisements. The underlying regulatory objective is increasingly clear: commercial activity conducted through social media should not permit the persons behind a seller account or paid advertisement to remain effectively unidentifiable. For social-commerce businesses, advertiser and seller identification may therefore become an increasingly important part of the platform compliance infrastructure.

OCPB: Bringing influencers into the consumer-protection framework

A parallel development is occurring under consumer protection law. The OCPB has proposed a substantial amendment to the Consumer Protection Act aimed at modernizing the framework for digital commerce and contemporary advertising practices. One of its significant features is the proposed expansion of responsibility within the advertising ecosystem, including persons hired to advertise goods or services. If enacted in its proposed form, this could bring influencers, content creators, and other persons engaged to promote products more directly within the statutory consumer-protection framework. This is particularly important for influencer marketing, where the traditional distinction between an advertiser and the medium carrying an advertisement can be difficult to maintain. Influencers may create promotional content themselves, demonstrate products, repeat claims supplied by brands, integrate commercial messages into personal recommendations or entertainment, provide purchasing links, and participate in affiliate arrangements. The person communicating the advertising message can therefore play a much more active role in influencing the consumer’s decision than a conventional advertising medium.

The OCPB initiative addresses a different part of the social-commerce problem from ETDA’s platform regulation. ETDA’s developing framework focuses substantially on the platform and the identification and traceability of persons using it for commercial activity, while the OCPB proposal strengthens responsibility for the consumer-facing commercial message and the persons participating in communicating that message. The proposed Consumer Protection Act amendment remains draft legislation, so its final scope may change during the legislative process. Nevertheless, its direction is important for brands, agencies, influencers, and content creators because compliance may increasingly extend beyond the business that ultimately supplies the product.

Two regulatory layers across one transaction:

The interaction between these initiatives is perhaps the most significant feature of the emerging framework. Consider a typical social-commerce transaction: a brand engages an influencer to promote a product; promotional content appears on a social-media service; the content directs consumers to a seller operating through that platform or another online channel; and a consumer purchases the product after relying on representations contained in the promotional content. Different regulatory obligations can potentially attach at several points along that chain. The platform may increasingly be expected to identify sellers and advertisers, retain information permitting them to be traced, screen certain advertisements, monitor problematic content, and provide mechanisms for responding to complaints or unlawful activity. The seller or brand remains subject to applicable consumer-protection and product-specific requirements. At the same time, the OCPB amendment could place influencers and other persons hired to advertise more directly within the consumer-protection regime.

The emerging division can therefore be summarized as follows: ETDA is developing the infrastructure of accountability, while OCPB is extending accountability through the advertising chain. The distinction is not absolute. ETDA’s role extends beyond identity verification into advertising screening and monitoring, while OCPB already exercises broad authority over consumer-facing advertising. The regulatory regimes should therefore be understood as overlapping layers rather than completely separate jurisdictions. Together, however, they address a central weakness of social commerce: the difficulty of identifying and allocating responsibility among the multiple parties involved between the creation of an advertisement and the eventual consumer transaction.

From regulating the seller to regulating the commercial chain:

These developments point toward a broader change in the regulation of digital commerce. Traditional e-commerce could largely be conceptualized around the consumer, the online seller, and the marketplace facilitating the transaction. Social commerce introduces additional actors: platforms distribute commercial content, advertisers may be different from sellers, influencers and content creators communicate product claims, and transactions can move from public social-media content into private messaging or other channels. The emerging regulatory framework increasingly follows this entire chain. Instead of asking only who sold the product, regulators are developing mechanisms that can also address who promoted it, who paid for or arranged the advertisement, who communicated the claims, and which platform facilitated the commercial interaction.

For businesses, social-commerce compliance should therefore no longer be treated solely as an issue for the legal entity making the final sale. Brands will need to consider how influencers and advertisers are selected, instructed, and supervised; whether advertising and product claims can be substantiated; what information must be supplied to platforms; and how responsibility is allocated contractually among brands, agencies, influencers, and other participants. Influencer and advertising agreements may require greater attention to regulatory compliance, disclosure and approval procedures, substantiation of claims, record-keeping, corrective measures, content removal, and cooperation with platforms or regulators. Platforms face a different compliance trajectory, with increasing expectations around identification, verification, screening, monitoring, traceability, and intervention where commercial activity creates risks for consumers.

An emerging social-commerce framework:

There is not yet a single comprehensive regulatory instrument governing social commerce. Instead, a network of complementary rules is emerging to regulate different stages of the same commercial activity. ETDA’s DPS framework and related initiatives provide the platform-governance layer; developing seller and advertiser verification requirements strengthen identification and traceability; and the proposed Consumer Protection Act amendment would strengthen the consumer-facing advertising layer by potentially extending responsibility more directly to influencers and other participants in the advertising process. Viewed together, these developments suggest that social commerce is moving toward end-to-end accountability—from the identity behind an advertisement to the person delivering the commercial message and ultimately to the transaction with the consumer.

Key Takeaways:

The social-commerce regulatory framework is developing through several complementary initiatives rather than one dedicated law. ETDA is strengthening the platform side of the equation, particularly the identification and traceability of sellers and advertisers, while OCPB is seeking to strengthen responsibility on the consumer-facing side, including the role of influencers and other persons engaged in advertising. Businesses operating through social commerce should therefore look beyond seller compliance alone. Brands, sellers, advertising agencies, influencers, content creators, and digital platforms increasingly form parts of the same regulated commercial chain, and the compliance focus is shifting from responsibility for the final sale toward accountability throughout the process by which a consumer encounters, evaluates, and purchases a product online.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

• DIP: WIPO GRATK Study Puts Genetic Resource Records in Focus
• FDA: Building a Telepharmacy Platform—What Developers Need to Address
• DIP: New Facility Checks the Status of Corporate Trademark Owners
• Thailand’s Revenue Department Launches Public Consultation on Draft Departure Tax Act: Key Proposed Principles and Implications
• PDPA: Research Consent, Lawful Bases and the Use of Personal Data in Research
• Thailand–Canada Free Trade Agreement (TCAFTA): Cabinet Approves Negotiating Framework

BOT Framework for Safeguarding the Financial Sector from Illicit Activities: New Supervisory Expectations for Financial Institutions and Payment Providers

The Bank of Thailand (BOT), together with financial institutions and regulated financial service providers, has formally launched the Framework for Safeguarding the Financial Sector from Illicit Activities, a sector-wide initiative intended to prevent the financial system from being used to facilitate technology-enabled crime, corruption, money laundering, fraud, and other illicit activities. The Framework represents a significant supervisory development for banks, payment service providers, e-money operators, foreign exchange businesses, and non-bank lenders. While the Framework itself is principally a cooperation and policy framework rather than a standalone regulation imposing penalties, the BOT has expressly indicated that it will strengthen regulations, minimum standards, and supervisory oversight to promote consistent implementation across the financial sector. Accordingly, regulated entities should view the Framework not merely as a statement of policy, but as an indication of the direction in which future supervisory expectations and regulatory requirements are likely to develop.

Five Core Principles:

The Framework is built around five principles that participating institutions are expected to apply in a manner appropriate to their business models and risk profiles. First, preventing misuse of the financial sector should form part of leadership and corporate governance, with boards and senior management responsible for establishing policies, strategic direction, oversight arrangements, and adequate resources. Second, institutions should translate those commitments into effective standards and execution, including appropriate minimum standards for monitoring, detection, and risk response, with periodic review as risks evolve. Third, institutions are expected to develop expertise and data-driven capabilities, using data, technology, and specialized knowledge to improve monitoring and detection. Fourth, the Framework emphasizes collaboration and collective intelligence, including exchanges of information, intelligence, fraud typologies, risk indicators, and best practices among financial institutions, government authorities, private-sector organizations, and other relevant stakeholders, subject to applicable legal frameworks. Finally, preventive measures should pursue balanced objectives, taking into account financial inclusion, fair competition, innovation, customer convenience, and the need to avoid unnecessary burdens on legitimate users.

From Policy Framework to Operational Controls:

The significance of the Framework becomes clearer when the commitments of the BOT and participating industry groups are considered. The BOT intends to strengthen KYC, Customer Due Diligence (CDD), and Enhanced Due Diligence (EDD) standards, including end-to-end controls against mule accounts. It also plans to strengthen Know Your Merchant (KYM) requirements and oversight of high-risk merchants, particularly in payment acceptance services. Other areas identified for enhanced controls include high-value cash transactions, conversion of illicit proceeds into assets that are more difficult to trace, digital financial service security, and standards applicable to non-bank operators.

Financial institutions and industry associations have correspondingly committed to stronger customer identification and due diligence, greater scrutiny of high-risk accounts and cash transactions, and increased use of data and technology to identify unusual transactions and behavioral patterns. Banks are expected to integrate internal information with trusted external sources and use customer profiles, behavioral information, and transaction inflow/outflow patterns to identify links among accounts and suspicious activity. Payment service providers are expected to strengthen KYM throughout the merchant lifecycle, including enhanced merchant screening and behavioral monitoring, while non-bank lenders are expected to strengthen their assessment of customers, related parties, transactions, and sources of funds. The Framework also contemplates databases of high-risk persons and merchants, links with the Central Fraud Registry, and development of industry-wide AML/CFT operational guidelines.

Data Sharing Becomes a Central Compliance Issue:

One of the most consequential elements of the Framework is its emphasis on information sharing. The BOT intends to analyze linkages and share risk patterns, behavioral indicators, and information concerning individuals, legal entities, and merchants identified as high risk. It also envisages greater data exchange and collaborative analytics involving regulatory authorities, law enforcement agencies, and other government bodies. Financial institutions and payment providers will likewise be expected to contribute relevant information, including unusual transaction patterns, merchant information, fraud intelligence, and other indicators that may assist in identifying misuse of the financial system.

This creates an important intersection between financial-crime prevention and personal data protection. The Framework expressly recognizes that information exchange must occur within applicable legal frameworks. Consequently, an expectation or request to share information for fraud prevention purposes should not automatically be treated as removing the need for analysis under the Personal Data Protection Act (PDPA). Institutions should identify an appropriate lawful basis for each relevant processing and disclosure activity, determine whether the data collected and shared are necessary and proportionate to the stated purpose, establish appropriate retention periods, and implement access controls and security safeguards. Data accuracy will be particularly important where information is used to classify a person or merchant as high risk or to restrict access to financial services.

High-Risk and Blacklist Databases Require Particular Attention:

The contemplated development and sharing of high-risk-person and merchant information raises additional governance considerations. A risk indicator used merely to trigger additional review is materially different from a blacklist that automatically results in account restrictions, rejection of onboarding, termination of services, or other adverse consequences. Institutions should therefore consider establishing clear criteria for inclusion and removal, defining the evidentiary threshold required for a high-risk designation, controlling who may submit or amend records, periodically reviewing whether information remains accurate and relevant, and establishing escalation or review procedures where a designation may materially affect a customer.

These issues become more significant as databases are interconnected across institutions or with centralized fraud information systems. Incorrect, outdated, or insufficiently verified information could potentially propagate across the financial sector and affect an individual or business beyond the institution that originally generated the risk indicator. Governance of shared databases should therefore address not only cybersecurity and access management but also data provenance, accuracy, correction procedures, retention, accountability, and the distinction between intelligence suggesting risk and verified findings of unlawful conduct.

What Financial Institutions and Payment Providers Should Do Now

Although detailed minimum standards will continue to develop, regulated entities should consider conducting a readiness assessment against the Framework now rather than waiting for individual implementing measures. This should include reviewing whether board and senior-management oversight adequately covers financial-crime and fraud risks; mapping existing KYC/CDD/EDD and KYM controls against the emerging supervisory direction; assessing high-value cash and unusual-transaction monitoring; reviewing the use of AI, behavioral analytics, and external data sources; and identifying existing or planned information-sharing arrangements with other institutions, industry bodies, regulators, and law-enforcement agencies. Particular attention should be given to the interface between financial-crime controls and the institution’s PDPA, cybersecurity, data governance, outsourcing, and third-party risk frameworks.

Institutions should also document the legal and governance architecture supporting fraud-related data processing before broader industry sharing becomes operational. This may include reviewing privacy notices, records of processing activities, data-sharing agreements or protocols, retention schedules, access matrices, security controls, procedures for correcting inaccurate risk information, and the allocation of responsibilities among compliance, AML, fraud, privacy, cybersecurity, legal, and business teams. Where automated tools or risk-scoring systems are used to identify high-risk customers or transactions, institutions should also consider whether their governance arrangements provide sufficient human oversight and mechanisms to manage false positives and unintended customer impacts.

Key Takeaways:

The Framework marks a shift toward a more coordinated, intelligence-led approach to protecting the financial sector from illicit activities. Although it is not, by itself, a standalone penal regulation, the BOT has expressly signaled further development of regulations, minimum standards, and supervisory oversight, making the Framework an important indicator of future compliance expectations.

For financial institutions, payment providers, and other regulated non-banks, the immediate priorities are to assess existing KYC/CDD/EDD and KYM controls, strengthen technology-based detection and high-risk transaction monitoring, and prepare for substantially greater information sharing across the financial ecosystem. At the same time, fraud prevention and financial-crime objectives must be reconciled with PDPA requirements, cybersecurity controls, proportionality, data accuracy, retention, and appropriate governance of high-risk and blacklist databases.

The next major development to monitor will be the BOT’s issuance or enhancement of minimum standards, regulations, supervisory guidelines, or operational requirements implementing the Framework. Those measures are likely to determine when the Framework moves from a high-level sector commitment to more concrete and enforceable compliance expectations.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

• DIP: WIPO GRATK Study Puts Genetic Resource Records in Focus
• FDA: Building a Telepharmacy Platform—What Developers Need to Address
• DIP: New Facility Checks the Status of Corporate Trademark Owners
• Thailand’s Revenue Department Launches Public Consultation on Draft Departure Tax Act: Key Proposed Principles and Implications
• PDPA: Research Consent, Lawful Bases and the Use of Personal Data in Research
• Thailand–Canada Free Trade Agreement (TCAFTA): Cabinet Approves Negotiating Framework

Bangkok Blueprint: A New Framework for Protecting the Financial Sector from Illicit Activities

The Bank of Thailand (BOT) is moving toward a broader and more coordinated approach to preventing the financial system from being used for fraud and other illicit activities. As part of this initiative, the BOT, together with relevant financial-sector stakeholders, is preparing the Framework on Safeguarding the Financial Sector from Illicit Activities, while the BOT, the International Monetary Fund (IMF), and the World Bank Group are also advancing the Bangkok Blueprint for Fraud-Resilient Financial Services.

Although the final text of the Framework has not yet been separately published in the official materials reviewed for this article, the initiatives signal an important development in financial-sector supervision: fraud prevention and the prevention of illicit financial flows are increasingly being treated as responsibilities extending across the financial ecosystem rather than as matters confined to individual institutions or conventional anti-money laundering controls.

The Bangkok Blueprint:

The Bangkok Blueprint is intended to strengthen the resilience of financial services against fraud and scams in the digital age. The BOT has described the initiative as being developed with the IMF and World Bank Group and as providing a practical reference for strengthening coordinated responses to digital financial fraud.

This direction reflects the changing nature of financial crime. Digitalization has made payments faster and financial services more accessible, but it has also allowed fraud proceeds to move rapidly between accounts, institutions, payment channels, and potentially other asset classes. An effective response therefore increasingly depends on coordination among financial institutions and other participants in the financial ecosystem.

The BOT has already taken measures addressing unauthorized payment fraud and, more recently, authorized push payment fraud. These measures have included controls relating to mule accounts, tracing of fund flows, use of customer behavioral information, risk-based transaction limits, and shared-responsibility principles. The Bangkok Blueprint appears to place these developments within a broader policy framework focused on making financial services more resilient against fraud.

Safeguarding the Financial Sector from Illicit Activities

Alongside the Bangkok Blueprint, the BOT is coordinating the Framework on Safeguarding the Financial Sector from Illicit Activities. According to the BOT’s official announcement, this is intended to be a sector-wide initiative aimed at preventing the financial system from being misused for illegal and fraudulent activities.

The significance of the Framework is its potentially broad institutional reach. The policy direction described publicly extends beyond commercial banks and reflects the need for controls across different points through which illicit funds may enter, move through, or leave the financial system.

Public statements surrounding the initiative indicate an emphasis on strengthening customer due diligence, identifying higher-risk transactions, improving information sharing, and reinforcing anti-money laundering controls. However, until the final Framework is officially published, these matters should not be treated as new binding regulatory requirements merely by reason of the Framework itself.

From Individual Compliance to Ecosystem Responsibility:

The more important development may be the shift in regulatory philosophy. Traditional compliance programs tend to focus on whether an individual institution has properly identified its customer, monitored transactions, reported suspicious activity, and complied with applicable restrictions. Digital fraud demonstrates the limitations of an institution-by-institution approach because funds can move through several accounts and service providers within a very short period.

The emerging approach therefore places greater importance on the ability of institutions to identify suspicious behavior rapidly, connect information from different sources, exchange relevant fraud intelligence, and intervene before illicit funds disappear from the regulated financial system.

For banks and other regulated financial businesses, this could eventually affect the design of onboarding controls, customer risk classification, transaction-monitoring systems, mule-account detection, escalation procedures, information-sharing arrangements, and internal governance. It may also increase expectations that management can demonstrate not merely formal compliance with existing rules, but the effectiveness of controls in preventing the institution’s products and infrastructure from facilitating illicit activity.

What Financial Institutions Should Watch:

The practical significance of the Framework will depend on the final text and any subsequent BOT rules, guidelines, supervisory expectations, or industry commitments implementing it. In particular, financial institutions should monitor whether the initiative results in more specific expectations concerning mule-account identification and management, customer and merchant onboarding, enhanced due diligence for higher-risk customers, transaction monitoring, cross-institution information sharing, rapid restriction or suspension of suspicious transactions, and governance responsibility for financial-crime controls.

Institutions should also consider the interaction between these measures and their existing obligations concerning anti-money laundering, cybersecurity, fraud prevention, consumer protection, and personal data protection. Greater information sharing can improve fraud detection, but institutions will need appropriate legal bases, governance, security measures, access controls, retention policies, and safeguards governing the use and disclosure of customer information.

Key Takeaways:

The Bangkok Blueprint and the Framework on Safeguarding the Financial Sector from Illicit Activities indicate a move toward a more integrated approach to financial crime, linking fraud prevention, illicit-fund detection, customer due diligence, transaction monitoring, and cooperation across the financial ecosystem.

For regulated financial businesses, the key issue will be whether the final Framework remains principally a statement of collective commitment or develops into concrete supervisory expectations. If detailed obligations or commitments are introduced, institutions may need to reassess their customer onboarding, mule-account controls, transaction-monitoring capabilities, information-sharing arrangements, escalation procedures, and governance structures.

Until the final Framework is officially available, however, institutions should distinguish between the BOT’s announced policy direction and legally or regulatory binding requirements. The publication of the final Framework—and any subsequent implementing measures—will therefore be important in determining the immediate compliance impact on banks, payment service providers, non-bank lenders, foreign exchange businesses, and other regulated financial-sector participants.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

• DIP: WIPO GRATK Study Puts Genetic Resource Records in Focus
• FDA: Building a Telepharmacy Platform—What Developers Need to Address
• DIP: New Facility Checks the Status of Corporate Trademark Owners
• Thailand’s Revenue Department Launches Public Consultation on Draft Departure Tax Act: Key Proposed Principles and Implications
• PDPA: Research Consent, Lawful Bases and the Use of Personal Data in Research
• Thailand–Canada Free Trade Agreement (TCAFTA): Cabinet Approves Negotiating Framework