Navigate BOT Penetration Testing & iPentest with Confidence
BOT rules require banks, specialized financial institutions, and non-bank payment operators to pentest their Internet-facing systems at least once a year and after significant change. D-SIBs and commercial banks with high cyber inherent risk also fall under BOT's iPentest direction. We run the tests, write board-ready reports, and include one retest of your fixes.
The Foundation: BOT IT Risk Notification สกช. 5/2566
สกช. 5/2566 sets the IT risk rules for every financial institution under the Financial Institutions Businesses Act, including commercial banks and foreign bank branches, and every specialized financial institution (ข้อ 4), with the testing duties in attachment 2. Non-bank payment operators follow a parallel notification, สนช. 1/2564.
- Pentest by independent internal or external experts, covering at least Internet-facing applications and networks, at least once a year and after significant change (att. 2 ข้อ 6.7)
- Vulnerability assessment of all systems by risk, with critical systems assessed at least once a year and after significant change (att. 2 ข้อ 6.6)
- BOT's Q&A names the bank website, mobile banking, and internet banking as public-network systems the yearly pentest must cover (Q&A item 3)
- Security test before go-live, against the security process set in the technical specification (att. 2 ข้อ 7.2)
- IT risk compliance self-assessment to BOT within 30 days of calendar year end, a compliance report separate from testing (ข้อ 10.5)
iPentest: Intelligence-Led Testing for Priority Banks
iPentest is the intelligence-led penetration testing guideline BOT co-authored with TB-CERT. BOT circular ว. 1252/2562 sets which banks must adopt it.
- BOT directed D-SIBs and commercial banks with high cyber inherent risk to adopt iPentest by the end of 2563 (2020) (ว. 1252/2562)
- Other commercial banks adopt it according to their risk and readiness; for all banks and specialized financial institutions it is an optional enhancement under สกช. 5/2566
- The guideline sets no fixed test frequency
- Testers can be internal or external, provided they meet the bank's own criteria (guideline 1.6)
- Our method, beyond the BOT text: we build scenarios from current threat intelligence and measure how your team detects and responds
Who Is in Scope?
Scope follows the license. Each group below names the BOT rule that covers it.
Commercial Banks
Pentest and VA duties under สกช. 5/2566. D-SIBs and banks with high cyber inherent risk also fall under the iPentest direction in ว. 1252/2562.
Specialized Financial Institutions
Covered by สกช. 5/2566 (ข้อ 4). The mobile banking notification 4/2568 does not apply to them.
Foreign Bank Branches and Subsidiaries
BOT guidance lets them use the parent bank's pentest results if those cover every critical system the branch or subsidiary uses (สกช. 5/2566 Q&A item 2).
Non-Bank Payment System Operators
Systemically important or regulated payment systems under the Payment Systems Act. Testing duties sit in สนช. 1/2564, which covers non-banks only.
Payment Service and e-Money Operators
Every operator follows the Cyber Hygiene pentest and VA duties in สนช. 1/2564 ข้อ 5.1.6. e-Money apps that transfer to accounts at other providers also carry app controls under BOT 18/2568.
Banks with Mobile Banking Apps
Institutions under the Financial Institutions Businesses Act must meet the app controls in BOT 4/2568. The notification sets controls and has no testing clause.
What the BOT Expects
These obligations come from BOT notifications and circulars. Each card names its source.
Yearly Pentest of Internet-Facing Systems
Banks and specialized financial institutions: at least once a year and after significant change, by independent internal or external experts (สกช. 5/2566 att. 2 ข้อ 6.7). Non-bank payment operators carry the same yearly duty under สนช. 1/2564 ข้อ 5.1.6.
Vulnerability Assessment by Risk
All systems, prioritized by risk, with critical systems assessed at least once a year and after significant change (att. 2 ข้อ 6.6). Payment operators assess all systems at least once a year (สนช. 1/2564 ข้อ 5.1.6).
iPentest for D-SIBs and High-Risk Banks
Directed for D-SIBs and commercial banks with high cyber inherent risk (ว. 1252/2562). The guideline sets no fixed frequency and accepts internal or external testers who meet the bank's own criteria.
Security Test Before Go-Live
New systems get a security test before launch (สกช. 5/2566 att. 2 ข้อ 7.2). Payment operators under the สนช. 1/2564 IT risk rules carry the same duty (att. 2 ข้อ 7.2).
Annual IT Audit
An audit, separate from the pentest: significant IT work is audited at least once a year (สกช. 5/2566 att. 5). Payment operators run an IT security audit at least once a year (สนช. 11/2561 ข้อ 4.2.2).
Reporting Deadlines
Banks send the IT risk self-assessment to BOT within 30 days of calendar year end (ข้อ 10.5). Payment operators file the self-assessment within 30 days of year end (สนช. 1/2564 ข้อ 7.3; Cyber Hygiene only for payment service operators below the ข้อ 3.2 tests). Payment service operators also assess significance each year and notify BOT within 30 days if they meet all three ข้อ 3.2 tests. Payment operators under the สนช. 1/2564 IT risk rules send BOT a copy of IT audit results within 45 days of completion (att. 4); for other operators, BOT's สนช. 11/2561 guideline asks for the same.
Testing Scope
The first three items are the BOT minimum: Internet-facing systems, with the bank website, mobile banking, and internet banking named in BOT's Q&A. We recommend scoping the rest by risk.
- Mobile Banking Applications (iOS & Android)
- Bank Website & Internet Banking
- Other Internet-Facing Applications & Networks
- API Interfaces & Core Banking Systems
- Internal Network & Segmentation
- Cloud Environments
- Payment Gateway Infrastructure
- Third-Party Vendor Integrations
Testing Standards We Work To
สกช. 5/2566 and สนช. 1/2564 set what to test and how often and prescribe no method; the iPentest guideline sets the method for banks directed to adopt it. For payment operators, BOT's Q&A points to a method such as OWASP (สนช. 1/2564 Q&A item 2).
OWASP WSTG / MASTG
Web and Mobile Application Security Testing Guides, the benchmarks we use for banking portals and mobile apps.
NIST SP 800-115
Technical Guide to Information Security Testing and Assessment, the framework behind our structured test phases.
Secure Code Review
BOT's IT risk implementation guideline recommends independent source code review on every development or change that touches important transactions (s.2.7.2).
What the BOT Can Order
Beyond the scheduled tests, BOT holds the power to order more.
Additional Pentest by an External Expert
BOT may order a bank or payment operator to appoint an independent external expert for an additional pentest (สกช. 5/2566 att. 2 ข้อ 6.7; สนช. 1/2564 ข้อ 5.1.6).
External IT Audit
BOT may order an external IT audit (สกช. 5/2566 att. 5; สนช. 1/2564 att. 4 for payment operators under its IT risk rules).
Deadline to Close Mobile Vulnerabilities
Under BOT 4/2568, an institution that finds a new mobile banking vulnerability must close it within a suitable time or by the deadline BOT sets.
The Legal Backbone
Three statutes sit around the BOT rules, and each applies on its own terms.
Cybersecurity Act B.E. 2562 (2019)
Applies to organizations designated as Critical Information Infrastructure (CII); a financial institution is CII only once designated. Under the 2568 criteria, regulators propose lists and the NCSC designates them. The critical finance services BOT lists are retail deposit and withdrawal, BAHTNET, ICS cheque imaging, PromptPay, and the Single Payment System. Designated organizations run a cybersecurity risk assessment and a cybersecurity audit at least once a year, and report significant threats to NCSA within 24 hours.
Personal Data Protection Act (PDPA) B.E. 2562 (2019)
Requires appropriate security measures for personal data, reviewed when necessary and when technology changes (s.37(1)). The law names no testing. Our view: testing is a common way to show those measures work.
Payment Systems Act B.E. 2560 (2017)
The act under which BOT supervises payment system and payment service operators. BOT rules under it require non-bank operators to pentest Internet-facing systems at least once a year (สนช. 1/2564 ข้อ 5.1.6) and to run an annual IT security audit, which is an audit separate from the pentest (สนช. 11/2561 ข้อ 4.2.2).
How Our Assessments Map to BOT Mandates
Each assessment we deliver maps to the BOT clause it helps you meet.
| Assessment | BOT Requirement | Coverage |
|---|---|---|
| Mobile App Security Testing | App controls, BOT 4/2568 | Certificate pinning, anti-tampering, obfuscation, rooted or jailbroken device blocking, risky accessibility and remote-control app blocking (tested with OWASP MASTG, our method) |
| API Security Assessment | Internet-facing pentest (ข้อ 6.7) | Authentication, authorization, data validation, rate limiting |
| Network Penetration Testing | Internet-facing networks (ข้อ 6.7) | Firewall rules, VLAN segmentation, lateral movement testing |
| Intelligence-Led Testing (iPentest) | iPentest guideline (ว. 1252/2562) | Real-world attack scenarios, TTP emulation, social engineering, detection testing (Reconix method) |
| Web Application Testing | Bank website and internet banking (Q&A item 3) | OWASP WSTG, business logic, authentication flows |
| Pre-Launch Security Testing | Security test before go-live (ข้อ 7.2) | New systems and major changes, tested against the security process in your technical specification |
BOT Compliance Readiness Checklist
Check your institution against the BOT rules above before the next examination cycle. Items marked as recommended are our advice, not BOT rules.
- Yearly pentest of Internet-facing systems scheduled, plus a test after each significant change (สกช. 5/2566 ข้อ 6.7 or สนช. 1/2564 ข้อ 5.1.6)
- Testers independent of the systems they test, internal or external
- Vulnerability assessment of all systems by risk, critical systems at least once a year (ข้อ 6.6)
- Bank website, mobile banking, and internet banking inside the pentest scope (Q&A item 3)
- Security test completed before each go-live (ข้อ 7.2)
- D-SIB or high cyber inherent risk bank: iPentest adopted per ว. 1252/2562
- Mobile banking app controls under BOT 4/2568 in place: pinning, anti-tampering, obfuscation, rooted or jailbroken device blocking
- IT contingency plan reviewed and tested at least once a year (สกช. 5/2566 att. 2 ข้อ 9.5)
- IT risk self-assessment sent to BOT within 30 days of calendar year end
- Payment operators under the สนช. 1/2564 IT risk rules: copy of IT audit results sent to BOT within 45 days of audit completion (att. 4); other payment operators: the same under the สนช. 11/2561 guideline
- Critical and high findings fixed and retested (recommended)
- Board-level summary of results presented (recommended)
What You Receive: BOT-Ready Deliverables
Every engagement produces the documentation your team needs for the next BOT examination.
Executive Board-Level Summary
A non-technical risk overview designed for board of directors presentation.
Technical Findings with CVSS Scoring
Detailed vulnerability report with industry-standard severity ratings.
Prioritized Remediation Roadmap
An actionable fix plan ordered by risk severity and business impact.
Retest Evidence
The result of the included retest for each fixed finding.
Assessment Report Mapped to BOT Clauses
The full report, with each finding mapped to the สกช. 5/2566 or สนช. 1/2564 clause it relates to.
Official References
Consult the original regulatory documents for full requirements.
Related Services
Security services that support your BOT duties.
Penetration Testing
Full-scope penetration testing for enterprise infrastructure and applications.
Learn MoreMobile App Penetration Testing
Specialized security testing for iOS and Android banking applications.
Learn MoreNetwork Penetration Testing
Infrastructure and network segmentation validation for financial systems.
Learn MoreBOT Penetration Testing FAQs
Answers to the most common questions about BOT penetration testing, iPentest, and compliance timelines.
Stay Ahead of Your Next BOT Examination
Get penetration testing and iPentest assessments mapped to the BOT clauses that apply to you, with board-ready reports and a clear remediation roadmap.
Reconix is the proof-first offensive security specialist in Thailand, serving regulated digital businesses of all sizes.