Penetration testing under Thai SEC requirements
The Thai Securities and Exchange Commission defines penetration testing duties for securities firms and digital asset businesses. This page summarizes both requirement sets with links to the source notifications.
- Target Audience
- Securities firms, fund managers, derivatives brokers, digital asset operators (exchanges, brokers, dealers, custodial wallets), and ICO portals
- Mandatory Frequency
- Separate VA from pentest and determine the cycle by licensed activity. Any three-year pentest relief requires the formal small-entity RLA classification, not merely SME status, and is not automatic VA relief. Check pre-launch and change-triggered duties in the applicable instrument.
- Required Scope
- Systems relevant to licensed activities and the actual implementation, such as trading applications, mobile apps and APIs. Wallets, HSM/KMS and smart contracts are examples for businesses with those systems or obligations, not a universal scope for every SEC-regulated entity.
- Non-Compliance Risk
- SEC administrative action, mandatory remediation, and enforcement under applicable notifications
What to confirm under the applicable Thai SEC requirements
Define critical systems based on license categories and live services, aligning vulnerability assessments, penetration testing, and reporting timelines with current SEC rules.
Distinguish VA from pentesting and connect results to ownership, remediation, and evidence.
- Business type and significant systems — Determine applicable requirements and scope
- Vulnerability assessment — Assess significant and internet-facing systems
- Penetration testing — Test applications and networks within scope
- Independent tester — Remain independent of system owners and developers
- Remediate and retain evidence — Report, track, and preserve records for review
- Annex 3 to Notification SorThor 38/2565 (as amended by SorThor 33/2567) and Guideline NorPor 6/2567 distinguish vulnerability assessments (Clause 8.9) from penetration testing (Clause 8.10).
- Vulnerability assessments must cover significant IT systems and internet-facing systems at least annually, with no 3-year small-firm relief.
- Digital asset operators under Notification KorThor 19/2561 Clause 18 must pentest critical systems prior to go-live and annually thereafter, without 3-year small entity relief.
- Digital asset pentest reports must be submitted to the SEC within 30 days of receiving the official report and no later than 90 days following test completion.
- Testers must be independent of system owners under Clause 8.10.2. CREST, OSCP, and GPEN credentials are recommended in NorPor 6/2567 for significant IT systems, not a universal hard mandate.
THAI SEC / REGULATORY TAXONOMY
Thai SEC Regulatory Architecture and Governed Business Taxonomy
The Securities and Exchange Commission governs information technology security through primary acts and specialized business notifications to ensure all critical capital market systems and customer assets remain safeguarded.
- Securities Companies: Brokerages, asset management companies, and investment advisers operate under Notification SorThor 38/2565 (as amended by SorThor 33/2567, effective 1 January 2025) and Guideline NorPor 6/2567.
- Derivatives Businesses: Derivatives brokers and dealers under the Derivatives Act B.E. 2546 (2003) follow the SEC IT framework applicable to their licence category.
- Digital Asset Operators: Digital asset exchanges, brokers, dealers, fund managers, advisory services, and custodial wallet providers are governed under the Emergency Decree on Digital Asset Businesses B.E. 2561 (2018) and Notification KorThor 19/2561.
- ICO Portals: Electronic system providers for token offerings operate under Notification KorJor 16/2561 and must screen offerings and review smart-contract source code for consistency with disclosed information.
- Crowdfunding Portals: Equity and debt crowdfunding platforms must follow the SEC IT rules that apply to their licence and live systems.
- Market Infrastructure Operators: The Thailand Securities Depository (TSD), Clearing House, and Stock Exchange (SET/TFEX) may be designated as Critical Information Infrastructure (CII) entities subject to both SEC rules and the Cybersecurity Act B.E. 2562 (2019).
Legal obligations depend on the specific license category granted by the Thai SEC. Confirm governing notices with compliance officers and legal counsel prior to scoping engagements.
THAI SEC / VULNERABILITY ASSESSMENT (CLAUSE 8.9)
Technical Vulnerability Assessment Standards (Clause 8.9)
Clause 8.9 of Annex 3 to SorThor 38/2565 (as amended by SorThor 33/2567) and NorPor 6/2567 section 2.8.9 require risk-based technical vulnerability assessment.
- Assessment Scope: Must cover significant IT systems and all internet-facing IT systems.
- Testing Frequency: At least annually and after any significant change, such as IT infrastructure changes or added critical functions.
- No 3-Year Relief for VA: IT Q&A 4.8.10.13 confirms that small entities must still assess significant IT systems and internet-facing systems at least annually.
- Distinction Between VA and Pentest: Per the table in IT Q&A 4.8.10.13, vulnerability assessment scans systems to identify and rate weaknesses. Penetration testing simulates attacks to determine whether systems can actually be reached.
- Remediation and Follow-up: Rate discovered weaknesses, set proportionate fix timelines, report to system owners, and present progress to the board or designated senior management.
Vulnerability assessment findings must feed directly into organizational IT risk registers and be presented to system owners for systematic remediation tracking.
THAI SEC / PENETRATION TESTING (CLAUSE 8.10)
Penetration Testing Cadence, Independent Tester Standards, and Small-Firm Relief (Clause 8.10)
Clause 8.10 of Annex 3 to SorThor 38/2565 and NorPor 6/2567 section 2.8.10 govern internet-facing penetration testing, internal risk evaluation, tester independence, and report retention.
- Public-Facing Testing Cadence (Clause 8.10.1): Application systems and networks connected to public communication networks must be pentested at least annually and after significant change.
- Small-Firm Cadence: Small entities under the Risk-Level Assessment (RLA) framework must pentest internet-facing application systems and networks at least every 3 years and after significant change, per NorPor 6/2567 and IT Q&A 4.8.10.13.
- Internal Network Evaluation: Operators must assess intrusion risk through internal networks and set internal pentest scope accordingly.
- Tester Independence (Clause 8.10.2 and IT Q&A 4.8.10.11): Testers must be independent of system owners and developers. They must not be the same person as the developer and must not report to the same supervisor.
- Recommended Credentials for Significant IT (NorPor 6/2567 section 2.8.10): High-risk practice recommends recognized certifications such as CREST Registered Penetration Tester, CREST Certified Web Application Tester, CREST Certified Infrastructure Tester, Offensive Security (OSCP, OSWP, OSCE, OSEE, OSWE), or GIAC (GPEN, GWAPT, GXPN, GAWN, GMOB, GCIH). Equivalent certifications may be considered.
- Report Retention and Submission (Clauses 8.10.4 and 8.10.5): Retain test reports for at least 2 years and submit them to the SEC without delay when notified.
Official reports must explicitly document tester identities, testing dates, comprehensive scope, methodologies, discovered vulnerabilities, risk severity ratings, and actionable remediation roadmaps.
THAI SEC / DIGITAL ASSET OPERATORS (KORTHOR 19/2561)
Digital Asset Business Penetration Testing Requirements and Strict Reporting Deadlines (Clause 18)
Digital asset operators are subject to elevated cybersecurity baselines under Notification KorThor 19/2561 with strict pre-service testing and reporting windows.
- Pre-Go-Live and Annual Mandates (Clause 18): Critical systems must be pentested before service starts and at least annually thereafter, by a person independent of the responsible IT function.
- Reporting Deadlines: Submit the official test report to the SEC within 30 days of receiving it, and no later than 90 days after testing ends.
- No 3-Year Small Entity Relief: The footnote to IT Q&A 4.8.10.13 states that digital asset businesses must still pentest critical systems at least annually, even if RLA classifies them as small.
- Critical System Scope: Define scope from live services that hold customer assets or deliver the licensed activity, such as trading, custody, customer channels, and related connectivity.
- Non-compliance: The SEC may act under the Digital Asset Decree and related notifications if testing is not performed or reports are not submitted on time.
Digital asset businesses are directly regulated by the Thai SEC, not the Stock Exchange of Thailand (SET).
THAI SEC / WALLET CUSTODY AND SMART CONTRACTS
Digital Asset Wallet Custody, Cold Storage, HSM Controls, and Smart Contract Review
Notification SorThor 44/2565 and Guideline NorPor 8/2565 set wallet-management and key-management duties for digital asset custody.
- Cold Wallet Architecture: A cold wallet connects to the network only when a transaction is executed, distinct from a hot wallet that remains connected beyond transaction time.
- Multi-party Control (Multi-Signature): NorPor 8/2565 expects seed or key-recovery data to be split into at least 3 parts, held by different people, so a single person cannot complete a transfer.
- Key Protection and HSM: Restrict key access on a need-to-know basis and store keys in high-assurance hardware such as a Hardware Security Module (HSM).
- Smart Contract Review (Notification KorJor 16/2561): ICO Portals must screen offerings and review smart-contract source code for consistency with disclosed information before a public offer.
Smart contract review should match the disclosed offering documents, including transfer logic, asset safeguarding, and investor rights as stated.
THAI SEC / IT Q&A PRACTICAL INTERPRETATIONS
Practical Operational Guidance from SEC IT Q&A Official Clarifications
Official SEC determinations regarding bug bounties, automated scanners, static promotional websites, commercial off-the-shelf software, and parent company testing.
A useful report lets the owner act: what was tested, what failed, who will fix it, and how the fix will be verified. Apply the testing cadence relevant to the business.
- Define scope — Classify systems by risk and exposure
- Assess and test — Separate VA from independent pentesting
- Report the results — Record scope, method, findings, and fixes
- Review and follow up — Assign owners and track remediation
- Bug Bounties Cannot Replace Pentests (IT Q&A 4.8.10.1): A bug bounty does not guarantee that testers will cover the required scope or report findings completely, so scheduled penetration testing remains necessary.
- Automated Scanners Are Not Pentests (IT Q&A 4.8.10.3): Tools such as a web application scan are only an initial technical vulnerability assessment and cannot replace expert-led penetration testing.
- Exemption for Customer-Information Websites (IT Q&A 4.8.10.7): A website that provides customer information, does not accept file uploads, and does not support electronic transactions may be exempted from annual pentesting if residual risk, including reputation risk, is acceptable and an authorized person of the organization approves.
- Vendor COTS Pentest Acceptance (IT Q&A 4.8.10.4): A vendor pentest may be used for unmodified commercial off-the-shelf software if connecting it to the firm's environment does not introduce additional vulnerabilities.
- Parent Company Group Testing (IT Q&A 4.8.10.12): A parent-company test may be used if its scope covers all internet-connected IT systems used in the Thai business under SorThor 38/2565.
Any exemption or customized testing approach must be backed by documented risk assessments and formal executive approval readily auditable by SEC inspectors.
Requirements and Testing Scope Matrix
Summary of the referenced clauses, the testing scope they cover, and the expected evaluation cycle.
| Reference | Mandate Title | Scope Required | Testing Cycle |
|---|---|---|---|
| SorThor 38/2565 Clause 8.9 | Technical Vulnerability Assessment (VA) | Significant IT systems and all internet-facing systems | At least annually and after significant change (no 3-year relief) |
| SorThor 38/2565 Clause 8.10 | Penetration Testing for Securities Businesses | Internet-facing application systems and networks | At least annually (small entities: at least every 3 years for internet-facing systems) |
| KorThor 19/2561 Clause 18 | Penetration Testing of Critical Digital Asset Systems | Critical systems before go-live and after operations commence | Before go-live and at least annually (reporting within 30 and 90 days) |
| SorThor 44/2565 and NorPor 8/2565 | Digital Asset Wallet and Cryptographic Key Management | Cold wallets, hot wallets, seed splits, HSM modules, key recovery flows | Prior to deployment and reviewed at least annually |
| KorJor 16/2561 | Smart Contract Source-Code Review for ICO Portals | Offering smart contracts and disclosed investor information | Prior to public offering |
Compliance Readiness Self-Assessment
Select items your organization has completed to evaluate your readiness score.
Frequently Asked Questions (FAQ)
Key answers and practical guidance addressing common compliance questions.
How often does the Thai SEC require penetration testing for securities and crypto businesses, and is there small-firm relief?
Under SorThor 38/2565 Clause 8.10, securities firms must pentest internet-facing systems at least annually and after significant changes. Small entities under the Risk-Level Assessment (RLA) framework pentest internet-facing application systems and networks at least every 3 years, per NorPor 6/2567 and IT Q&A 4.8.10.13. Under Notification KorThor 19/2561 Clause 18, digital asset businesses must test critical systems before launch and annually thereafter, without 3-year small-entity relief.
Can automated vulnerability scanners or public bug bounties substitute for penetration testing under SEC rules?
No. According to SEC IT Q&A items 4.8.10.1 and 4.8.10.3, automated scanners perform vulnerability assessment (VA) only, while bug bounties lack methodological completeness. Neither replaces a structured penetration test performed by an independent qualified specialist.
Can informational or static websites be exempted from annual penetration testing requirements?
Yes, conditionally. Under SEC IT Q&A item 4.8.10.7, a customer-information website that does not support file uploads or electronic transactions may be exempted from annual penetration testing if residual risk, including reputation risk, is acceptable and an authorized person of the organization approves the exemption, with the risk assessment retained as evidence.
What are the regulatory submission deadlines for digital asset penetration test reports?
Under Notification KorThor 19/2561 Clause 18, digital asset operators must submit formal test reports to the Thai SEC within 30 days of receiving the official report from the tester, and no later than 90 days from the date testing was completed. Non-compliance can result in administrative sanctions or operational suspension.
Are third-party vendor COTS pentest reports or parent group penetration tests accepted by the SEC?
Under SEC IT Q&A 4.8.10.4, a vendor pentest may be used for unmodified commercial off-the-shelf software if connecting it to the firm's environment does not introduce additional vulnerabilities. Under 4.8.10.12, a parent-company test may be used if its scope covers all internet-connected IT systems used in the Thai business under SorThor 38/2565.
