Content Gen Dashboard

On June 11, 2569 (2026), the Bank of Thailand (BOT) issued Announcement No. 25/2569 concerning guidelines for managing risks arising from customer use of payment services for payment service operators regulated under Thailand's Payment System Act. The announcement was published in the Royal Gazette on June 10, 2569, and became effective June 11, 2569. The guidelines apply to three categories of regulated payment service operators: electronic money service providers, electronic bill payment service providers, and electronic fund transfer service providers. The BOT established these guidelines to elevate risk management practices, prevent misuse of payment services, and protect payment service users. The announcement aims to prevent payment services from being used for money laundering, terrorism financing, or other illegal activities. The guidelines establish comprehensive risk management requirements covering the entire customer lifecycle, from customer identification through transaction monitoring and relationship termination. Key requirements include: implementing Know Your Customer (KYC) procedures; conducting enhanced customer due diligence (EDD) for high-risk customers; establishing transaction monitoring systems to detect unusual financial activity; maintaining robust governance structures with clear roles for boards, senior management, and internal control functions; and implementing a three-lines-of-defense model. Payment service operators must also maintain customer records and documentation for regulatory inspection, establish procedures for assisting affected customers, and report suspicious transactions to the BOT according to specified formats. Payment service operators must implement these guidelines immediately and ensure all staff understand their responsibilities. The BOT's Payment System Policy and Financial Technology Division oversees implementation and can be contacted at 0 2283 5054, 0 2356 7230, 0 2283 6931, or PSD-policyreg@bot.or.th for guidance.

The Bank of Thailand (BOT) has issued payment service risk management guidelines for electronic payment operators The guidance prescribes: Board and senior management oversight mandating that the board of directors approve and regularly review written risk management policies regarding customer payment service usage. Senior management must strictly implement these policies, establish clear reporting structures, and ensure an effective three lines of defense model across the organization. Three lines of defense requiring business units (first line) to collect customer data and monitor for unusual behavior, while the compliance or risk management function (second line) oversees adherence to policies, and the internal audit function (third line) independently reviews the effectiveness of these controls. KYC and Customer Due Diligence (CDD) instructing operators to implement Know Your Customer (KYC) processes commensurate with product risk and conduct CDD to identify ultimate beneficial owners, screen against designated persons lists, and verify the purpose of the business relationship. Operators must apply Enhanced Due Diligence (EDD) and potentially refuse to establish relationships or process transactions if customers present high risks or if information cannot be verified. Identity verification and authentication stipulating that operators must enforce appropriate identity verification measures before allowing payment service usage, such as utilizing multi-factor authentication for non-face-to-face channels, to mitigate the risk of identity theft and unauthorized access. Transaction monitoring and handling obligating operators to maintain effective systems to monitor, detect, and investigate unusual transaction patterns based on internal rules, industry standards, and regulatory alerts. If a transaction strongly indicates criminal involvement, the operator must conduct EDD, suspend the specific service or transaction, and investigate associated accounts linked to the operator. Record-keeping and reporting directing operators to securely retain customer documents, behavioral records, and transaction details from the start of the business relationship until its termination, plus the legally required retention period. Operators must also submit reports on unusual transaction activities to the BOT to facilitate sector-wide risk evaluation. Customer remediation requiring operators to establish appropriate, rapid, and fair procedures to remediate and care for customers who are negatively impacted by risk management actions if their transactions are later proven to be legitimate

meta_id 3233420

Generated

Thailand's Bank of Thailand Publishes Payment Service Risk Management Guidelines for Electronic Payment Operators

Agent draft

Published

Bank of Thailand Publishes Payment Service Risk Management Guidelines for Electronic Payment Operators