# Penetration testing under Bank of Thailand requirements

Locale: `en`

Source: `/en/compliance/bank-of-thailand/`

Summary: BOT security testing duties across iPentest, Mobile Banking, and e-Money rules, with links to source documents.

On this page

1. [Overview](/en/compliance/bank-of-thailand/#topic-overview)
2. [What to consider when planning testing against BOT requirements](/en/compliance/bank-of-thailand/#compliance-control-summary)
3. [e-Money and security testing](/en/compliance/bank-of-thailand/#bot-emoney-security)
4. [Mobile Banking Security - Notification 4/2568](/en/compliance/bank-of-thailand/#bot-mobile-banking-security)
5. [iPentest - Circular 1252/2562](/en/compliance/bank-of-thailand/#bot-ipentest)
6. [VA and Penetration Testing - SorNorChor 1/2564](/en/compliance/bank-of-thailand/#bot-va-pentest)
7. [Technology Crime Emergency Decree](/en/compliance/bank-of-thailand/#bot-tech-crime-decree-2566)
8. [Bank of Thailand: Artificial Intelligence Risk Management - Wor 5994/2568](/en/compliance/bank-of-thailand/#ai-risk)
9. [Requirements Matrix](/en/compliance/bank-of-thailand/#compliance-matrix)
10. [Readiness Assessment](/en/compliance/bank-of-thailand/#compliance-readiness-checklist)
11. [Frequently Asked Questions](/en/compliance/bank-of-thailand/#compliance-faq)
12. [Related Frameworks](/en/compliance/bank-of-thailand/#related-compliance-frameworks)

# Penetration testing under Bank of Thailand requirements

The Bank of Thailand defines security testing duties across several regulations, from the penetration testing guideline and iPentest to Mobile Banking and e-Money requirements. This page summarizes each one with links to the source documents.

Executive Summary and Mandate Overview

Target Audience

In-scope payment-system operators under SorNorChor 1/2564 and financial institutions under Notification SorKorChor 5/2566

Mandatory Frequency

Under SorKorChor 5/2566 Attachment 2, clause 6.6 requires risk-based VA of all systems, with critical systems assessed at least annually and after significant change. Clause 6.7 requires internet-facing pentest at least annually and after significant change. Payment-system operators must separately check SorNorChor 1/2564.

Required Scope

Internet-facing applications and networks under SorNorChor 1/2564 or SorKorChor 5/2566, plus Mobile Banking controls under Notification 4/2568

Non-Compliance Risk

BOT supervisory findings and mandatory remediation under the applicable notice

## What to consider when planning testing against BOT requirements

Confirm the institution's licence category and applicable notices first, then connect VA and penetration-testing activity to risk, change, and remediation evidence.

[![Match BOT requirements to the service and scope: Entity and licence → Actual service → Applicable notification → Test scope → Remediation and retest](/assets/compliance/guide-bank-of-thailand-compliance-control-summary-en-v1.webp)](/assets/compliance/guide-bank-of-thailand-compliance-control-summary-en-v1.webp)

**Match BOT requirements to the service and scope**

Testing scope and cadence come from the notification applicable to the actual entity and service.

1. **Entity and licence** — Confirm the organization’s regulated status
2. **Actual service** — Distinguish payment, mobile banking, e-money, and other services
3. **Applicable notification** — Apply the rule for that entity and service
4. **Test scope** — Link systems, risk, and external exposure
5. **Remediation and retest** — Retain owners, corrective actions, and verification

- For entities in scope, SorNorChor 1/2564 clause 5.1.6 describes risk-based vulnerability assessment at least annually and after significant changes.
- Penetration testing of public-network-connected applications and networks should be performed by appropriately independent specialists under the notice applicable to the institution.
- Mobile Banking, iPentest, and e-Money have different control contexts, so scope must follow the actual service rather than reuse one testing cadence for every system.
- Retain reports, remediation plans, and retest results linked to risk owners and change approval so evidence is auditable.
- BOT policy guideline Wor 5994/2568 provides reference guidance for in-scope financial service providers. It covers data, model-development, and cyber-threat risks and recommends input/output content filtering, performance monitoring, and continuous testing of relevant attack patterns.

BANK OF THAILAND - ELECTRONIC MONEY

## Bank of Thailand: e-Money Mobile Application Security — Notification 18/2568

Notification 18/2568 applies to regulated e-money providers offering a mobile application that can transfer money to another person’s account at another financial provider. It separates unauthorized-payment-fraud prevention from security of the e-money mobile service.

[![e-Money mobile applications: fraud prevention and service security: Communications and fake apps, Account-device binding, Identity checks and limits, Data security, Application security, Device security](/assets/compliance/guide-bank-of-thailand-bot-emoney-security-en-v1.webp)](/assets/compliance/guide-bank-of-thailand-bot-emoney-security-en-v1.webp)

**e-Money mobile applications: fraud prevention and service security**

Notification 18/2568 separates unauthorized-payment-fraud prevention from data, application, and device security, supplementing the general e-money rules in SorNorChor 7/2561

- **Communications and fake apps** — Reduce credential deception and respond to impersonating or modified apps
- **Account-device binding** — Limit each account to one active mobile device at a time
- **Identity checks and limits** — Apply step-up identity checks and limits according to risk
- **Data security** — Protect sensitive data in storage, display, and transmission
- **Application security** — Limit permissions, resist tampering, and protect sessions
- **Device security** — Assess the environment and control risks from unsafe devices or apps

- Unauthorized-payment-fraud prevention covers safer communications, fake-app response, account-device binding, step-up identity checks, and risk-based limits.
- Service security covers data, application, and device controls, including encryption, permissions, anti-tampering, session protection, and device-environment risk.
- SorNorChor 7/2561 remains the general e-money business rule; Notification 18/2568 adds controls for e-money mobile applications.
- Neither notification creates one universal penetration-testing cadence for every operator. Apply the IT-risk requirements governing the actual entity and service.

**Match the correct rule to scope**

First confirm that the service meets the notification’s definition of an e-Money Mobile Application and identify the BOT rules applicable to the actual licence and service.

BANK OF THAILAND - MOBILE BANKING

## Bank of Thailand. Mobile Banking Security - BOT Notification 4/2568

The notification sets minimum controls for financial institutions providing Mobile Banking, separating unauthorised-payment-fraud prevention from Mobile Banking security controls.

[![Mobile banking from user to bank systems: User and device, Mobile application, API and session, Transaction, Fraud response](/assets/compliance/guide-bank-of-thailand-bot-mobile-banking-security-en-v1.webp)](/assets/compliance/guide-bank-of-thailand-bot-mobile-banking-security-en-v1.webp)

**Mobile banking from user to bank systems**

Device, app, API, identity, and transaction controls form one test path.

- **User and device** — Check identity, device posture, and risk
- **Mobile application** — Resist tampering and request only necessary permissions
- **API and session** — Protect authentication and connections
- **Transaction** — Apply risk-based controls and step-up authentication
- **Fraud response** — Detect, respond, and retain evidence

- It applies to financial institutions under the Financial Institution Business Act, and defines Mobile Banking as app-based mobile services that offer withdrawal, transfer, or payment.
- Test fraud-impersonation controls together with step-up authentication for risky actions, transaction limits, and the response to fake apps or malware.
- Test data, application, and device security together: encryption, tamper protection, session security, necessary permissions, and handling of rooted, jailbroken, or remote-controlled devices.

**Match the correct rule to scope**

The notification is a Mobile Banking control baseline; it does not set an independent Penetration Testing cadence. Apply it with the organisation's governing IT-risk requirements.

BANK OF THAILAND - INTELLIGENCE-LED TESTING

## Bank of Thailand. iPentest - Circular 1252/2562

iPentest uses threat intelligence to build realistic scenarios and determine whether a bank's protection, detection, and response processes work together.

[![From threat intelligence to Protect–Detect–Respond evidence: Governance → Threat intelligence → Test scenario → Observe response → Remediate and report](/assets/compliance/guide-bank-of-thailand-bot-ipentest-en-v1.webp)](/assets/compliance/guide-bank-of-thailand-bot-ipentest-en-v1.webp)

**From threat intelligence to Protect–Detect–Respond evidence**

iPentest evaluates how people, process, and technology work together.

1. **Governance** — Define scope, roles, and the control group
2. **Threat intelligence** — Select threats and TTPs relevant to the institution
3. **Test scenario** — Exercise an attack path within controlled boundaries
4. **Observe response** — Measure protect, detect, and respond capabilities
5. **Remediate and report** — Record gaps, owners, and corrective actions

- Establish governance, owners, and tester-selection criteria before setting a scenario, so test risk has a clear decision path.
- Use threat intelligence to scope critical functions, people, and protect, detect, and respond processes instead of only enumerating technical vulnerabilities.
- Production testing can provide realism, while high-risk steps may move to UAT or pre-production when the rationale, scope, and impact are recorded.

**Match the correct rule to scope**

The 2019 circular was addressed to commercial banks. Confirm its current status and risk-based applicability with Compliance and the regulator before starting an engagement.

BANK OF THAILAND - CYBER HYGIENE

## Bank of Thailand. VA and Penetration Testing - SorNorChor 1/2564

SorNorChor 1/2564 contains direct vulnerability-management and penetration-testing requirements for in-scope payment-system providers and operators.

[![From risk to vulnerability closure: Assets and risk → Vulnerability assessment → Independent pentest → Remediation → Retest and reporting](/assets/compliance/guide-bank-of-thailand-bot-va-pentest-en-v1.webp)](/assets/compliance/guide-bank-of-thailand-bot-va-pentest-en-v1.webp)

**From risk to vulnerability closure**

VA, pentesting, remediation, and retesting form one evidence cycle.

1. **Assets and risk** — Identify systems and prioritize them by risk
2. **Vulnerability assessment** — Discover and assess weaknesses
3. **Independent pentest** — Test internet-facing applications and networks
4. **Remediation** — Assign owners and track corrective work
5. **Retest and reporting** — Verify closure and retain evidence

- For entities in scope, assess vulnerabilities across all systems according to risk at least annually and after significant changes.
- Use independent specialists for Penetration Testing of applications and networks connected to public communications networks at least annually and after significant changes.
- Route results to accountable owners, remediation plans, and retest evidence so the organisation can demonstrate that discovered risk was handled, not merely reported.

**Match the correct rule to scope**

The notification covers significant payment-system providers and regulated payment-system or payment-service businesses that are not financial institutions or specialised financial institutions. Confirm the organisation's status before applying a testing cadence.

TECHNOLOGY CRIME EMERGENCY DECREE - B.E. 2566 AND (NO. 2) B.E. 2568

## Emergency Decree on Measures for the Prevention and Suppression of Technology Crimes B.E. 2566, as amended by (No. 2) B.E. 2568

The decree sets duties for financial institutions and business operators to exchange data on suspicious accounts and transactions and to hold transactions temporarily. The (No. 2) B.E. 2568 amendment took effect on 13 April 2025 and was approved by Parliament, as announced in the Royal Gazette on 30 May 2025. It extends "business operator" to digital asset business operators, adds duties tied to the list notified by the Technology Crime Operations Center (ศปอท.), and introduces shared liability for losses.

[![Technology Crime Emergency Decree: Data exchange (Section 4) → Transaction hold (Sections 6 and 7) → 72-hour complaint, 7-day review → (No. 2) B.E. 2568](/assets/compliance/guide-bank-of-thailand-bot-tech-crime-decree-2566-en-v2.webp)](/assets/compliance/guide-bank-of-thailand-bot-tech-crime-decree-2566-en-v2.webp)

**Technology Crime Emergency Decree**

B.E. 2566 as amended by (No. 2) B.E. 2568

1. **Data exchange (Section 4)**
  - Share account, transaction, and digital asset wallet data through the jointly approved system
2. **Transaction hold (Sections 6 and 7)**
  - Hold suspicious transactions for up to 7 days and alert every downstream recipient
3. **72-hour complaint, 7-day review**
  - Victims file a complaint within 72 hours and inquiry officials act within 7 days
4. **(No. 2) B.E. 2568**
  - Refuse or suspend service for listed persons (Section 4/2) and share liability for losses (Section 8/10)

- Section 4, as amended in 2025, requires financial institutions and business operators to disclose or exchange data on the relevant customer accounts and transactions, and digital asset wallet numbers, through a system or process jointly approved by the Ministry of Digital Economy and Society, the Royal Thai Police, the Department of Special Investigation, the Anti-Money Laundering Office, the Bank of Thailand, and the SEC Office.
- Section 6 requires an institution that finds reasonable suspicion itself, or receives data from the Section 4 system, to suspend the transaction, notify the next receiving institution, and enter the data so that every downstream recipient holds the transaction immediately for no more than 7 days. When notified by a competent criminal official or the AMLO Secretary-General, it must also suspend the transaction and enter the data. If no result is reported within the time limit, the hold is lifted.
- Section 7 requires an institution notified by a victim who holds the account to hold the transaction temporarily, enter the data so every downstream recipient holds it immediately, and tell the victim to file a complaint with an inquiry official within 72 hours. The inquiry official considers the accounts within 7 days of the complaint. Section 8 allows information or evidence to be given by telephone or electronic means, and complaints to be filed at any police station in the Kingdom, at the Cyber Crime Investigation Bureau, or electronically.
- The (No. 2) amendment adds Section 4/1, under which the Bank of Thailand, the SEC Office, the NBTC, the NBTC Office, and the Electronic Transactions Commission set standards or measures to prevent technology crime. It also adds Section 4/2, which requires institutions and business operators to refuse to open accounts, suspend services or transactions, or close accounts for persons or digital asset wallet numbers notified by the operations center (ศปอท.) until the listing is revoked. Failing to comply with Section 4/2 carries a fine of up to THB 500,000 under Section 8/11.
- Section 8/10 makes financial institutions, business operators, telecommunication providers, and social media providers share responsibility for losses caused by technology crime unless they prove they followed the standards or measures set by the agencies named in Section 4/1. Sections 8/1 to 8/4 set up victim refunds through the Anti-Money Laundering Office, and Section 8/5 establishes the operations center (ศปอท.) within the Office of the Permanent Secretary of the Ministry of Digital Economy and Society.
- Sections 9 to 11 punish anyone who opens or allows another person to use their deposit account, electronic card, e-money account, or mobile number with up to 3 years' imprisonment, a fine of up to THB 300,000, or both. Arranging, advertising, or brokering the sale of such accounts or numbers carries 2 to 5 years' imprisonment, a fine of THB 200,000 to 500,000, or both. The (No. 2) amendment adds Section 11/1 on incorrect or incomplete mobile number registration and Section 11/2 on using personal data to commit offences, with up to 5 years' imprisonment or a THB 500,000 fine where the data is traded.

**Match the correct rule to scope**

The decree sets data-exchange, transaction-hold, and liability duties but no VA or penetration-testing cadence. Use the cadence in the notification that governs the organisation, such as SorNorChor 1/2564 or SorKorChor 5/2566, and include the data-exchange APIs, authorisation of transaction-hold orders, and protection against forged hold requests in the test scope.

## Bank of Thailand: Artificial Intelligence Risk Management - Wor 5994/2568

BANK OF THAILAND / AI RISK MANAGEMENT

BOT policy guideline (document 25680178) offers principles and reference guidance for in-scope financial service providers to apply according to their AI use cases.

### Scope and Three Risk Dimensions (Clause 4.2)

- Applies to financial institutions, specialized financial institutions (SFIs), and regulated payment systems and payment services providers.
- Data risk: Data quality, recency, privacy, and security to prevent leakage or unauthorized disclosure of sensitive or personal data.
- Model development risk: Explainability of model outputs and mitigation of unreliable, negative, biased, or fabricated results.
- Cyber threat risk: Attacks targeting AI systems, including Prompt Injection, Model Inversion, Data Poisoning, and Adversarial Attacks.

### Technical Controls and Security Testing (Clause 4.4)

- The guideline recommends protecting against disclosure of sensitive organizational information or undesirable output, for example through prompt and response content filtering.
- It recommends continuous testing and monitoring of model performance and reliability before and after deployment, potentially using unseen data, noise, and edge cases; separately test relevant attack patterns continuously, such as data poisoning and adversarial attacks.
- For strategic decisions or uses that directly affect customers, providers may consider human-in-the-loop or human-over-the-loop controls according to risk and impact.

**Integration with Other BOT Rules**

The guideline supplements relevant BOT requirements and guidance on IT risk, third-party risk, data governance, and market conduct. FEAT is cited as one example of generally accepted responsible-AI principles.

## Requirements and Testing Scope Matrix

Summary of the referenced clauses, the testing scope they cover, and the expected evaluation cycle.

| Reference | Mandate Title | Scope Required | Testing Cycle |
| --- | --- | --- | --- |
| **SorNorChor 1/2564 clause 5.1.6** | VA and penetration testing for in-scope payment-system operators | Risk-based VA of all systems, and pentest of internet-facing applications and networks | At least annually and after significant change |
| **SorKorChor 5/2566 Attachment 2 clauses 6.6 and 6.7** | VA and penetration testing for financial institutions and specialized financial institutions | Risk-based VA of all systems, with significant systems at least annually, and pentest of internet-facing applications and networks | At least annually and after significant change |
| **Circular 1252/2562** | iPentest (threat intelligence-led testing) | Commercial banks addressed by the circular, especially D-SIBs and banks with high Cyber Inherent Risk | BOT-directed cycle, not an annual duty for every financial institution |
| **Notification 4/2568** | Mobile Banking control baseline | Mobile Banking apps, step-up authentication, and impersonation-fraud controls | Service control baseline, not a penetration-testing cadence |
| **Technology Crime Emergency Decree B.E. 2566 and (No. 2) B.E. 2568** | Data exchange, transaction holds, and shared liability for losses | Financial institutions, payment-system business operators, and digital asset business operators: temporary holds of up to 7 days under Section 6, victim complaints within 72 hours under Section 7, and refusal or suspension of service for persons listed by the operations center (ศปอท.) under Section 4/2 | No VA or penetration-testing cadence; use the cadence in the notification that governs the organisation |
| **Circular Wor 5994/2568 (Doc 25680178)** | Policy Guideline on AI Risk Management | AI use by in-scope financial service providers, applying relevant guidance to each use case whether internally developed or supplied by a third party | No fixed testing cycle; the guideline recommends ongoing risk and performance monitoring and continuous testing of relevant attack patterns |

### Compliance Readiness Self-Assessment

Select items your organization has completed to evaluate your readiness score.

0%

Confirmed whether the entity is in scope of SorNorChor 1/2564 or Notification SorKorChor 5/2566 before setting a testing cadence
          
          
            
            Risk-based vulnerability assessment completed at least annually and after significant change
          
          
            
            Independent penetration testing of internet-facing applications and networks completed at least annually under the applicable notice
          
          
            
            Test report and remediation plan acknowledged by management, with Mobile Banking controls under Notification 4/2568 where in scope

Assessment Status

Check items above to view assessment result.

[Request Pentest Quote](/en/#contact)

## Frequently Asked Questions (FAQ)

Key answers and practical guidance addressing common compliance questions.

### How often does the Bank of Thailand require penetration testing?

SorNorChor 1/2564 clause 5.1.6 requires risk-based vulnerability assessment of all systems at least annually, and independent penetration testing of internet-facing systems at least annually and after significant change. The iPentest guideline (Circular 1252/2562) is intelligence-led testing for D-SIBs or banks with high Cyber Inherent Risk by 2563; it is not an annual duty for every financial institution.

### Which systems fall within the scope of Bank of Thailand security testing?

Identify the applicable instrument first. Payment-system operators should check SorNorChor 1/2564 clause 5.1.6. Financial institutions and specialized financial institutions should check SorKorChor 5/2566 Attachment 2 clauses 6.6-6.7. These distinguish risk-based VA of all systems, with critical systems assessed annually and after significant change, from pentest covering at least internet-facing applications and networks annually and after significant change. Independent experts may be internal or external. External procurement is not mandatory in every case. Notification 4/2568 is a Mobile Banking control baseline and does not set a separate pentest cadence.

## Related Compliance Frameworks and Security Standards

- [
                PCI DSS v4.0.1: VA, ASV Scan, Pentest, Segmentation
                
              ](/en/compliance/pci-dss/)
- [
                Bank of Thailand ATM malware-risk guidance
                
              ](/en/compliance/bot-atm-malware-guideline/)
- [
                Thailand Cybersecurity Act 2019 and penetration testing
                
              ](/en/compliance/cybersecurity-act/)
- [
                NDID member penetration testing requirements
                
              ](/en/compliance/ndid/)

Open full-size image to zoom

## Official source documents

Original files from the regulating authorities, hosted on sth.sh for convenience. Always defer to the latest version at the source link.

[
            
              
              
              ![First-page preview of Bank of Thailand Notification SKCH 5/2566 on IT Risk Supervision](/assets/process/compliance-sources/sth-source-bot-it-risk-skch-5-2566.webp)
            
          ](/assets/documents/sth-source-bot-it-risk-skch-5-2566.pdf)

### Bank of Thailand Notification SKCH 5/2566 on IT Risk Supervision

By Bank of Thailand

[Open document (PDF) ](/assets/documents/sth-source-bot-it-risk-skch-5-2566.pdf)
              [Download ](/assets/documents/sth-source-bot-it-risk-skch-5-2566.pdf)
              
              [Source ](https://www.bot.or.th/content/dam/bot/fipcs/documents/FOG/2566/ThaiPDF/25660202.pdf)

[
            
              
              
              ![First-page preview of IT risk supervision guideline requiring VA and penetration testing (SorNorChor 1/2564)](/assets/process/compliance-sources/sth-source-bot-va-pentest-snch-1-2564.webp)
            
          ](/assets/documents/sth-source-bot-va-pentest-snch-1-2564.pdf)

### IT risk supervision guideline requiring VA and penetration testing (SorNorChor 1/2564)

By Bank of Thailand

[Open document (PDF) ](/assets/documents/sth-source-bot-va-pentest-snch-1-2564.pdf)
              [Download ](/assets/documents/sth-source-bot-va-pentest-snch-1-2564.pdf)
              
              [Source ](https://www.bot.or.th/content/dam/bot/fipcs/documents/FOG/2564/ThaiPDF/25640024.pdf)

[
            
              
              
              ![First-page preview of Bank of Thailand Notification 4/2568 on Mobile Banking security for financial institutions](/assets/process/compliance-sources/sth-source-bot-mobile-banking-1218-2568.webp)
            
          ](/assets/documents/sth-source-bot-mobile-banking-1218-2568.pdf)

### Bank of Thailand Notification 4/2568 on Mobile Banking security for financial institutions

By Bank of Thailand

[Open document (PDF) ](/assets/documents/sth-source-bot-mobile-banking-1218-2568.pdf)
              [Download ](/assets/documents/sth-source-bot-mobile-banking-1218-2568.pdf)
              
              [Source ](https://www.bot.or.th/content/dam/bot/fipcs/documents/FOG/2568/ThaiPDF/25680027.pdf)

[
            
              
              
              ![First-page preview of Intelligence-led penetration testing guideline (iPentest, Circular 1252/2562)](/assets/process/compliance-sources/sth-source-bot-ipentest-1252-2562.webp)
            
          ](/assets/documents/sth-source-bot-ipentest-1252-2562.pdf)

### Intelligence-led penetration testing guideline (iPentest, Circular 1252/2562)

By Bank of Thailand

[Open document (PDF) ](/assets/documents/sth-source-bot-ipentest-1252-2562.pdf)
              [Download ](/assets/documents/sth-source-bot-ipentest-1252-2562.pdf)
              
              [Source ](https://www.bot.or.th/content/dam/bot/fipcs/documents/FOG/2562/ThaiPDF/25620192.pdf)

[
            
              
              
              ![First-page preview of Biometric technology guideline, B.E. 2566 (2023)](/assets/process/compliance-sources/sth-source-bot-biometric-2566.webp)
            
          ](/assets/documents/sth-source-bot-biometric-2566.pdf)

### Biometric technology guideline, B.E. 2566 (2023)

By Bank of Thailand

[Open document (PDF) ](/assets/documents/sth-source-bot-biometric-2566.pdf)
              [Download ](/assets/documents/sth-source-bot-biometric-2566.pdf)
              
              [Source ](https://www.bot.or.th/content/dam/bot/fipcs/documents/FPG/2566/ThaiPDF/25660181.pdf)

[
            
              
              
              ![First-page preview of Bank of Thailand Policy Guideline on Artificial Intelligence Risk Management (Wor 5994/2568)](/assets/process/compliance-sources/sth-source-bot-ai-risk-management-25680178.webp)
            
          ](/assets/documents/sth-source-bot-ai-risk-management-25680178.pdf)

### Bank of Thailand Policy Guideline on Artificial Intelligence Risk Management (Wor 5994/2568)

By Bank of Thailand

[Open document (PDF) ](/assets/documents/sth-source-bot-ai-risk-management-25680178.pdf)
              [Download ](/assets/documents/sth-source-bot-ai-risk-management-25680178.pdf)
              
              [Source ](https://www.bot.or.th/content/dam/bot/fipcs/documents/FOG/2568/ThaiPDF/25680178.pdf)

## Need a pentest that satisfies these requirements?

Tell us about your systems and the requirements you must meet. The STH team will assess the approach and prepare a quotation.

[Request a Pentest quote](/en/#contact)

## PDF document

[Open in new tab ](/en/compliance/bank-of-thailand/)
              [Download](/en/compliance/bank-of-thailand/)

Last updated 16 October 2026