Thailand’s new payment-service customer risk rules are in force

The checks now run from onboarding through ongoing monitoring

Providers must maintain a customer-risk process covering KYC, checks before establishing a business relationship or carrying out an occasional transaction, identity authentication before payment services are used, ongoing transaction monitoring, record keeping and procedures for customers affected by risk controls.

Risk assessment is meant to be proportionate. The notification points to customer characteristics, geography or country, the product or service involved, and the transaction or delivery channel. For corporate customers, providers are also expected to understand the nature of the business and its ownership or management structure, identify the beneficial owner and perform the required screening checks.

The rules do not introduce one universal document checklist for every customer. The level of scrutiny is tied to the risk presented by the customer and the transaction.

For practical context, see Thailand economy and finance. This development also connects with Thailand Makes Unusual Transaction Reporting Mandatory.

High-risk activity can lead to enhanced due diligence

When behaviour appears unusual before onboarding or an occasional transaction, the provider is expected to seek reliable information or ask the customer for more evidence. The notification gives examples including the source of funds or assets, source of wealth, business activity, occupation, workplace details and supporting transaction information.

For an existing customer, providers must monitor whether payment activity remains consistent with the purpose previously given. If unusual activity indicates a high-risk case, enhanced customer due diligence can include further questions about the source of funds, the purpose of a specific payment and the customer’s business or occupation, together with closer ongoing monitoring.

If material inconsistencies cannot be resolved or the necessary information cannot be verified, the provider may refuse to establish the relationship or carry out an occasional transaction. Where enhanced due diligence on an existing high-risk case cannot be completed, the rules require the provider not to proceed with the transaction; when the issue is linked to a particular payment service, the restriction is directed at that affected service while related activity is checked as well.

Customer protection is built into the same framework

The rules also require systems that detect and review unusual transaction patterns and are updated as risks change. For remote identity checks, multi-factor authentication is cited as one possible safeguard against impersonation.

There is an important limit on the control side: risk management should not impose an excessive burden on customers. Providers must have an appropriate, prompt and fair process for helping a customer who was affected by a control measure if the transaction is later found not to be abnormal.

For a bank or payment-app user, that means an out-of-pattern payment may lead to questions or requests for supporting information. It does not mean that every transfer above a particular amount is automatically blocked, nor does this notification create a single mandatory document list for all users.