eKYC Rules in Thailand (2026): What Banks, Insurers and Digital Businesses Need to Know

The short answer

There is no single "eKYC law" in Thailand. Remote identity verification is shaped by four layers that work together: the anti-money-laundering duty to identify customers; the Electronic Transactions Development Agency (ETDA) standard that defines how strongly an identity has been proven; the sector regulator's own rules (the Bank of Thailand, the SEC or the Office of Insurance Commission); and the Personal Data Protection Act (PDPA), which governs the face images and other biometric data that eKYC collects.

For most regulated onboarding, the practical target is identity assurance level IAL2.3: a check of the Thai ID card against a government source, plus a biometric match between the person in front of the camera and the card, with liveness detection when the customer is remote. This guide explains where that requirement comes from and what it means for the platform you build or buy.

---

Layer 1: the duty to know your customer

Thailand's Anti-Money Laundering Act B.E. 2542 (1999) is where the obligation starts. Financial institutions and other reporting entities must identify and verify their customers before doing business with them. eKYC does not change that duty. It changes how it can be met: through a camera, a chip reader or a digital identity network instead of a branch counter.

---

Layer 2: ETDA's identity assurance levels

ETDA's Digital Identity standard (Part 2: Identity Proofing Requirements, 2023 edition) gives Thailand a common scale for "how sure are we that this person is who they claim to be". Regulators and businesses refer to these levels when they set requirements.

• IAL1. The identity is self-asserted. The provider does not have to validate it.
• IAL2.1. The identity document is checked (for a Thai ID card, by reading its chip) and the face is compared with the card photo by a person. Remote proofing must record the customer's face image.
• IAL2.2. As IAL2.1, plus a status check of the ID card against a government verification system, using the chip number or the laser code on the back of the card.
• IAL2.3. As IAL2.2, plus a biometric comparison: the customer's face (or fingerprint) is matched against the biometric data on the card's chip, or through the Ministry of Interior's face verification service when no card reader is used.
• IAL3. Face-to-face only, with a card reader, a card status check, confirmation in at least one government source beyond the civil registration database, and a biometric comparison.

The standard also sets accuracy rules for the biometric match itself. Matching must be one-to-one (this person against this card, not a search across a database), the false match rate must not exceed 0.01% and the false non-match rate must not exceed 3%. When proofing happens remotely, the system must include presentation attack detection, in practice liveness detection that stops a printed photo, a screen replay or a mask from passing.

These numbers are what separate a regulated eKYC platform from a "selfie upload". When you evaluate a vendor, ask for its tested false match and false non-match rates and for its liveness certification, not just a demo.

---

Layer 3: what each regulator expects

Banks and payment providers (Bank of Thailand)

The Bank of Thailand opened the door to remote account opening through its regulatory sandbox, where banks tested opening deposit accounts with e-KYC and facial recognition through the National Digital ID (NDID) platform. The first group approved included Kasikornbank, Siam Commercial Bank, Bangkok Bank, Bank of Ayudhya (Krungsri), TMB and CIMB Thai.

For e-money, BOT Notification Sor Nor Chor 1/2563 (issued 13 March 2020, in force 6 May 2020) set out what non-face-to-face verification must look like: the provider captures a photo of the customer with accepted technology and compares it with the biometric data on the smart ID card. Verifying through NDID is allowed on its own or alongside these steps.

Since then the focus has moved from opening accounts to stopping fraud. Under measures the BOT announced in March 2023, banks must ask for a facial biometric check for transfers over 50,000 baht per transaction, for transfers totalling over 200,000 baht a day, and for raising a transfer limit above 50,000 baht, and each mobile banking user may use only one device. In 2025 the BOT tightened know-your-customer checks for new bank, payment and e-money accounts as part of its anti-scam work. In other words, biometric verification is no longer a one-off step at sign-up: it is part of everyday high-risk transactions.

Securities and funds (SEC)

The SEC encouraged brokers and asset managers to open accounts online through NDID. An investor who has already been verified by their bank can reuse that verification through NDID, so they do not have to repeat the whole process to open a trading or fund account. By November 2020, six securities companies and four asset management companies offered this.

Insurance (OIC)

Insurance is moving to digital-by-default. On 15 September 2026 the Office of Insurance Commission issued new notifications for life and non-life insurance that take effect on 1 January 2027. Among other things they require insurers to deliver policies electronically by default, to submit issued policies to the OIC electronically as soon as they are issued, and to verify the identity and authority of the seller when a policy is sold through employees, agents or brokers. For insurers, that makes identity a two-sided problem: proving who the customer is, and proving who sold to them.

---

Layer 4: PDPA and biometric data

A face template or fingerprint used to identify someone is sensitive personal data under section 26 of the PDPA. As a rule it needs the person's explicit consent, unless another basis in the law applies, such as a legal obligation. For an eKYC journey this means four practical things: ask for consent clearly before capture, collect only what the check needs, keep biometric data encrypted and separate from ordinary customer records, and set a retention period you can defend to an auditor.

---

Thailand's digital identity building blocks

• NDID (National Digital ID). A network that lets one verified institution confirm a customer's identity to another, with the customer's approval in their banking app.
• DOPA and the ThaID app. The Department of Provincial Administration holds the civil registration database that card status checks rely on, and its ThaID app (launched in 2023) lets citizens prove their identity with face verification for online services.
• Chip reading and laser codes. A card reader ("dip chip") reads the card's chip, including the photo used for biometric matching. Without a reader, the laser code on the back of the card is used for the status check.

---

A checklist for your eKYC platform

1. Set the target level per product. A newsletter sign-up does not need IAL2.3. A deposit account, an e-wallet that can transfer money or an insurance policy usually does. Write the level down for each journey.
2. Plan both paths. Support a card reader where you have counters or kiosks, and the laser-code path for customers on their own phones.
3. Check card status against a government source, not just the card image.
4. Use certified liveness detection and keep the test results for your auditors.
5. Know your biometric error rates, and confirm they meet ETDA's limits (false match ≤ 0.01%, false non-match ≤ 3%).
6. Keep a full audit trail of every check, decision and manual override.
7. Handle consent and retention under the PDPA for face images and templates.
8. Re-use verification for later high-risk actions, such as large transfers, limit changes or policy changes, so the customer is not sent back to the start.
9. Integrate with core systems (core banking, policy administration, CRM) so a verified customer is a ready customer.

---

How TMES helps

The TMES Digital Identity and eKYC Platform covers document recognition, face matching with liveness detection, real-time risk scoring, configurable onboarding workflows, consent management and complete audit logs, and integrates with core banking, CRM and data platforms. For Richemont, eKYC brought identity verification down from days to under 60 seconds. To map your onboarding journeys against the rules above, talk to our identity team.

This article is general information about Thai regulations as of November 2026, not legal advice. Regulations change; confirm the current requirements with the relevant regulator or your legal adviser before you design a regulated process.