Bank of Thailand’s Regulatory Agenda

1. Revised draft rules on digital channel security

On 7 October 2026, the Bank of Thailand (BOT) released a revised draft Notification on Digital Channel Security for a second round of public consultation, following a first draft in July 2026. The consultation closed on 6 November 2026. Once finalised, the notification is expected to consolidate and replace the BOT's existing notifications on mobile banking security.

Who is covered

The draft applies to financial institutions, specialised financial institutions, e-money providers, credit card providers, and supervised personal loan and nano-finance providers. It covers all digital channels, including mobile applications and internet banking.

Key requirements in the draft

• Stronger authentication. Identity checks at enrolment and on any change of device, one account per service on one device, and multi-factor authentication for high-risk transactions such as third-party transfers, cash withdrawals, credit drawdowns and limit increases.
• Moving away from SMS and email OTPs. For key transactions, one-time passwords sent by SMS or email would give way to passkeys, hardware tokens or OTPs generated within a registered app.
• Facial verification thresholds. Required for individual transfers of THB 50,000 or more, each time cumulative daily transfers reach THB 200,000, and for daily limit increases of THB 50,000 or more, with limited exemptions.
• No links by SMS or email. Providers could not send hyperlinks by SMS or email, and their use on social media would be restricted unless the customer asks for them.
• App security. Encryption, anti-tampering controls, blocking of rooted devices and risky apps, restrictions on vulnerable operating systems, and monitoring for counterfeit apps and websites.

Timing

As drafted, the rules would take effect 30 days after publication in the Royal Gazette, with certain authentication requirements applying after 90 days. Providers that cannot meet the timetable would need to apply for an exemption within seven days of the effective date.

A seven-day window to seek an exemption is not a planning timetable. Gap assessments should start now.

2. Already in force: tighter checks on large cash transactions

Separately, BOT Notification No. 57/2569 on risk management for cash-related transactions took effect on 1 November 2026. Financial institutions must now apply enhanced, risk-based due diligence to cash transactions of THB 5 million or more in a single day carried out at their branches – for example by asking about the source of funds or the purpose of a transaction, or requesting supporting documents.

The rules now also reach deposits of cheques and drafts, exchanges of baht banknotes, foreign currency transactions and cash payments for insurance premiums and investment products. Unusual transactions must be reported to the BOT. Electronic channels are not affected.

3. The BOT’s pipeline for late 2026 and early 2027

At a public event on 29 October 2026, the BOT Governor outlined five further measures expected over the coming months. Apart from the gold controls, which were put to public consultation earlier in the year, these are policy announcements and no draft legal texts have yet been published. As reported, they are:

• Cash gold trades (expected November 2026). A cap on cash payments for gold bar trades at gold shops, with larger amounts paid electronically. The Governor referred to a THB 10 million threshold; the draft consulted on in July and August 2026 proposed a cash ceiling of between THB 1 million and THB 10 million per customer, per day, per shop.
• Buy Now, Pay Later licensing (expected December 2026). A licensing framework for credit offered through digital platforms, with reported parameters of a THB 20,000 credit limit, a maximum six-month repayment period and a 15% interest-rate ceiling.
• Credit bureau fees (expected December 2026). Lower fees for credit-bureau checks.
• Money changers (expected January 2027). Higher, risk-based operating standards for money-changing businesses. The BOT has also paused new money-changer licences for 2027: applications under the current criteria are accepted only from 1 to 30 December 2026, and applications under the revised criteria are expected to reopen in 2028, with windows in March and September.
• Baht-linked stablecoins (expected March 2027). Rules governing stablecoins referencing the Thai baht.
• The BOT also plans to launch an SME credit portal in January 2027 to connect small and medium-sized enterprises with lenders.

Who should pay attention

• Banks, e-money and lending businesses. The digital-channel rules will require changes to app design, authentication flows and customer communications, likely at significant cost.
• E-commerce and platform operators. Where they offer instalment or deferred-payment options, a BNPL licensing regime may bring them, or their lending partners, under BOT supervision.
• Gold traders, jewellers and money changers. Expect tighter customer due diligence, transaction controls and reporting.
• Digital-asset and payment businesses. Baht stablecoin rules will shape which products can be offered in Thailand and by whom, alongside the SEC’s digital-asset framework.

Speak with our legal team

SBC advises businesses on Thai regulatory and licensing requirements, including anti-money-laundering and data-protection compliance. We can help you assess how the new rules affect your business and plan your licensing position. To discuss how these changes affect your business, get in touch.