Monitoring built on the customer profile, the way Thai rules require.
A practical breakdown of how financial institutions and payment service operators in Thailand can align transaction monitoring with the CDD Ministerial Regulation and the 2026 Bank of Thailand notifications.
The profile is the benchmark. Under Thai rules, unusual activity is measured against what you know about the customer, not against one fixed number for everyone.
Clause 17 of the CDD Ministerial Regulation requires customer activity to stay consistent with the stated purpose, business profile, risk level, and source of income. A system that compares payments only against a fixed threshold will flag customers doing exactly what they said they would and can miss the activity that matters.
The reporting bar has risen too. BOT Notifications No. 18/2569 and No. 25/2569 require covered entities to report unusual customer behaviour to BOT. Notification No. 31/2569 sets the data, format, and deadlines: monthly submissions, including EDD examination results, due by the 15th of the following month. Thai commercial banks report from the June 2026 period. Foreign bank branches, subsidiaries, and non-bank payment service operators report from September 2026.
This guide maps each of those obligations to the monitoring capabilities needed to meet them and to the audit trail needed to show your work.
Inside you'll discover:
- Why Thai regulation makes customer profile consistency the starting point for detecting unusual activity, and what that asks of your monitoring system
- A rule-by-rule map of your obligations, covering the CDD Ministerial Regulation, BOT Notifications 18/2569, 25/2569, and 31/2569, the AMLA, and AMLO thresholds, and how each is met in practice
- How to build scenarios around the risks in Thailand's National Risk Assessment, including corruption, drug offences, gambling, fraud, human trafficking, and cross-border fund movement, and around patterns agreed with BOT
- The practical questions BOT expects every covered institution to answer, from "how does monitoring reflect each customer's risk?" to "how do you know detection is working?"
- What a defensible audit trail looks like, from the profile the activity was tested against through the rule that fired and the evidence reviewed to the reasoning that closed the case
Reporting the outcome of a review is the easy part. The harder part is showing a supervisor how you got there. Closing that gap is what separates a rule set from a monitoring program.
Best for: compliance officers, MLROs, and AML teams at Thai commercial banks, foreign bank branches and subsidiaries, and payment service business operators preparing for BOT's monthly unusual-behaviour reporting.
