BOT 4/2568 Is Live. Is Your Mobile Banking App Ready?
Notification 4/2568 sets minimum Mobile Banking security standards for every financial institution under the Financial Institutions Businesses Act: one user account on one device, face comparison on high-value transfers, no links in SMS or email, and controls on the app, the device, and the data. We break down each control and show you how to prove it holds before your next BOT examination.
What is BOT Notification 4/2568?
The Bank of Thailand issued Notification 4/2568 under sections 39 and 41 of the Financial Institutions Businesses Act. It targets unauthorized payment fraud, where a criminal installs malware, takes control of a user's device or app, and transfers money without consent. It replaced the 2019 Guiding Principles for Mobile Banking Security (ว. 1922/2562).
Reference: BOT Notification No. 4/2568, clause 5.3
Who Falls Under BOT 4/2568?
4/2568 applies to every financial institution under the Financial Institutions Businesses Act (clause 4) that offers Mobile Banking to individual users. Specialized financial institutions and e-money licensees fall under other BOT rules.
The 4/2568 Controls in Six Groups
The notification sets controls in two parts: preventing unauthorized payment fraud (clause 5.3.1) and securing the Mobile Banking service (clause 5.3.2). We group them into six areas.
One Account, One Device, Safe Devices
Each user gets one user account per Mobile Banking app at each institution, used on one device only (5.3.1(3)). The app must not run on rooted or jailbroken devices (5.3.2(3.1)). Institutions must avoid serving devices on operating systems that a recognized body such as TB-CERT flags as risky; where they still serve them, they must warn users and cap transfers at ฿5,000 a day (5.3.2(3.3)).
Face Comparison and Transfer Limits
Face comparison with presentation attack detection, such as liveness detection, is required for transfers of ฿50,000 or more, each time daily transfers reach another ฿200,000, and any raise of the daily limit to ฿50,000 or more (5.3.1(4)). Daily withdrawal and transfer caps follow user risk groups; BOT gives a ฿50,000 daily cap for users under 15 as an example, with a controlled exception process (5.3.1(5)).
Link Rules
No links in SMS or email, in any form, including URL text that cannot be clicked, images, and QR codes (5.3.1(1), Q&A item 2). On social media, no links that ask for login or personal data such as usernames, passwords, OTPs, PINs, ID numbers, or dates of birth. A link may go out when the user asks, one request at a time, with a note that it was sent only on request.
Fake Apps and Risky Apps
Institutions must monitor official app stores such as Google Play and the Apple App Store for fake or impersonating apps and respond in time, with a response process for fakes outside those stores (5.3.1(2)). The app must not run while another app behaves riskily: unneeded accessibility services, remote control, or hiding or stealing screen content (5.3.2(3.2)).
App Integrity and Patch Timelines
Check the app for tampering at every launch and block modified copies (5.3.2(2.3)). Obfuscate source code (2.5), stop serving old app versions (2.2), request only the permissions the app needs and review them on significant change (2.1), and secure sessions against hijacking (2.4). New vulnerabilities must be closed within a suitable time or by the deadline BOT sets (5.3).
Data and Channel Protection
Avoid storing sensitive data on the device; where you must, encrypt it with an international-standard method and destroy it after use (5.3.2(1.1)). Mask passwords and blur the screen when the app is minimized (1.2). Use a secure protocol with certificate pinning or an equivalent method, plus application-layer encryption of sensitive data in transit (1.3).
What We Test in Your Mobile App
4/2568 sets controls and contains no testing clause. We verify each control with a test based on the OWASP MASTG, a Reconix method mapped clause by clause to the notification.
Duties That Continue After Launch
These four clauses create work after go-live, and each one needs evidence when BOT asks.
Close New Vulnerabilities in Time
When a new vulnerability is found, the institution must put protection in place and close it within a suitable time, or by the deadline BOT sets (clause 5.3).
Waivers Are Case by Case
An institution that cannot meet a control must apply to BOT with its reasons and a plan to comply. BOT decides within 30 business days of a complete request and may add conditions (clause 5.4).
App-in-App Counts
The controls apply whether users reach Mobile Banking through the institution's own app or through another provider's app (Q&A item 1).
Risky Operating Systems
If you still serve operating systems flagged as risky, you must warn those users and cap their transfers at ฿5,000 a day (clause 5.3.2(3.3)).
Related BOT Rules
4/2568 sets controls. The yearly penetration test and the e-money app rules sit in other BOT notifications.
BOT Notification 5/2566: IT Risk Supervision
Requires a penetration test by independent internal or external experts of Internet-facing systems at least once a year and on significant change (attachment 2, clause 6.7). BOT's Q&A names Mobile Banking as one of those systems (item 3). A security test is also due before go-live (clause 7.2). Covers financial institutions and specialized financial institutions.
BOT Notification 18/2568: e-Money Mobile Apps
Sets app controls for e-money licensees whose app transfers to accounts at other providers, including certificate pinning, anti-tampering, obfuscation, and rooted or jailbroken blocking, with new vulnerabilities closed in a suitable time (clauses 4 and 5.2.2).
Financial Institution Business Act B.E. 2551 (2008)
BOT issued 4/2568 under sections 39 and 41 of this Act, and the notification applies to every financial institution under it (clauses 2 and 4).
How We Validate BOT 4/2568 Compliance
We map each control in 4/2568 to a test, back every finding with a proof of concept, and include one retest of your fixes.
BOT 4/2568 Readiness Checklist
Use this checklist to gauge where your organization stands against each control in Notification 4/2568, plus the yearly penetration test under 5/2566.
Official References
Consult the original regulatory documents for full requirements.
Related Security Services
Complement your BOT compliance with these specialized security assessments.
Frequently Asked Questions
Everything you need to know about BOT Notification 4/2568 and mobile banking security compliance.
Close Your BOT 4/2568 Compliance Gaps
Get an assessment mapped to each control in Notification 4/2568, with a proof of concept for every finding and one included retest of your fixes.
Reconix is the proof-first offensive security specialist in Thailand, serving regulated digital businesses of all sizes.