SEC Cybersecurity Compliance for Capital Markets & Digital Assets
SEC Notification สธ. 38/2565, as amended by สธ. 33/2567, sets penetration testing, vulnerability assessment, and secure development duties for capital market and digital asset operators. Your Risk Level Assessment tier decides how often you test.
Understanding SEC Cybersecurity Requirements
The SEC sets IT security duties for capital market and digital asset operators in Notification สธ. 38/2565, as amended by สธ. 33/2567. Appendix 3 holds the testing duties and Appendix 4 the IT audit duties. Your Risk Level Assessment tier sets how often you test.
- Appendix 3 of สธ. 38/2565 holds the binding testing duties; frequency and scope depend on your tier (small, low, medium, or high)
- นป. 6/2567 is the SEC guideline: following it in full counts as compliance, and an operator that departs from it must prove it still meets สธ. 38/2565
- Penetration testers must be independent of the system owner, and in-house or external experts both qualify
- Digital asset businesses that hold client assets also follow สธ. 44/2565, which adds yearly wallet incident tests and duties after a custody-system incident
- SEC IT rules do not require a smart contract audit before launch, or red teaming
Who Needs to Comply?
สธ. 38/2565 ข้อ 2, as amended by สธ. 33/2567, covers these SEC-licensed and approved operators. Banks and life insurers holding SEC licenses are covered too.
Securities & Derivatives Firms
Licensed securities and derivatives businesses. Duties scale with the Risk Level Assessment tier you file each year.
Fund Managers & Advisers
Fund managers, and investment or derivatives advisers that use technology to serve clients.
Digital Asset Exchanges
Licensed digital asset exchanges. An exchange that holds client assets also follows the custody rules in สธ. 44/2565.
Digital Asset Brokers & Dealers
Licensed digital asset businesses that transact for clients. The custody rules in สธ. 44/2565 apply when they hold client assets.
ICO & Crowdfunding Portals
SEC-approved ICO portals and crowdfunding portals.
Capital Market Infrastructure
Clearing houses, depositories, and derivatives exchanges.
SEC Testing Duties by Rule
Binding duties come from สธ. 38/2565 Appendices 3 and 4. Items from นป. 6/2567 are marked as guidance. Check your tier first: small operators carry fewer duties.
Vulnerability Assessment
Required for every tier, small operators included. Assess critical systems and all Internet-facing systems at least once a year and on every significant change. (App. 3 ข้อ 8.9)
Penetration Testing
Required. Pentest Internet-facing applications and networks at least once a year and on every significant change; small operators at least every 3 years. For other systems, assess intrusion risk through the internal network, set the scope, and pentest as appropriate. (App. 3 ข้อ 8.10.1)
Independent Testers & Records
Testers must be independent of the system owner, in-house or external. Fix findings promptly, keep pentest records at least 2 years, and send reports to the SEC without delay when it asks. Guidance: rate each finding by risk and set a matching fix deadline. (App. 3 ข้อ 8.10.2 to 8.10.5; นป. 6/2567)
Secure Development
Required above the small tier: a process or tool that controls secure code development, and testing before production. Guidance: source code review, automated or manual by a non-developer, when building or changing critical systems; high tier: manual review by an expert independent of the developers. (App. 3 ข้อ 10.3(4), 10.3(5); นป. 6/2567)
Incident & Contingency Testing
Required above the small tier: test the IT incident plan at least once a year, including a cyber security drill, and test backup restore and the IT contingency plan yearly. Custody operators, at any tier, also test wallet incident procedures yearly. (App. 3 ข้อ 8.6, 11.6, 12.5; สธ. 44/2565 ข้อ 7)
IT Audit & Risk Level Assessment
File your Risk Level Assessment with the SEC within Q1 each year; the result sets your tier. IT audit by an independent auditor holding a certificate the SEC recognizes: full scope yearly for medium and high tiers, at least every 3 years for small and low tiers. (สธ. 38/2565 ข้อ 4; App. 4)
What Reconix Tests
Reconix service scope. Match each service to your own SEC duties above.
Entire IT Infrastructure
Vulnerability Assessment: Systematic discovery of CVEs and misconfigurations across all systems and environments.
Trading Platforms & APIs
Penetration Testing: Proving whether vulnerabilities in web apps, mobile apps, and APIs can be exploited by real attackers.
Application Source Code
Secure Code Review: Catching logic flaws and OWASP Top 10 vulnerabilities before they reach production.
People, Processes & Tech
Red Teaming (Reconix service, not an SEC requirement): Stress-testing incident response, SOC detection, and organizational cyber resilience end to end.
Web3 Tokens & ICOs
Smart Contract Audit (Reconix service, not an SEC requirement): Finding vulnerabilities in on-chain code before investor funds are at stake.
e-KYC & Onboarding
Validating the security of identity verification, document handling, and client onboarding workflows.
Filings and Records the SEC Expects
This page does not cover SEC penalties. These are the filing and record duties in the rules.
- Pentest reports sent to the SEC without delay when it asks (App. 3 ข้อ 8.10.3 to 8.10.5)
- Pentest records kept at least 2 years from the date made (App. 3 ข้อ 8.10.3 to 8.10.5)
- Risk Level Assessment filed within Q1 of each calendar year after board or delegate review (สธ. 38/2565 ข้อ 4)
- Board-reviewed IT audit report and remediation plan filed within 3 months after the calendar year end of the audit year; digital asset operators file under กธ. 19/2561 (App. 4)
- Proof that you still meet สธ. 38/2565 wherever you depart from นป. 6/2567 (นป. 6/2567 ข้อ 4)
How Our Services Map to SEC Requirements
Where each Reconix service fits the rules above.
SEC Compliance Checklist
Core duties from สธ. 38/2565 Appendix 3. Confirm your tier first.
- Risk Level Assessment filed with the SEC within Q1, and your tier on record
- Internet-facing pentest done within your tier's cycle (yearly, or every 3 years for small operators) and after each significant change
- Testers independent of the system owner, whether in-house or external
- Vulnerability assessment of critical and Internet-facing systems at least once a year
- Findings fixed promptly and pentest records kept at least 2 years
- Secure development process or tool in place, and systems tested before production (not required of small operators)
Official References
SEC background pages. The rules cited on this page (สธ. 38/2565, สธ. 33/2567, นป. 6/2567, สธ. 44/2565) are published on sec.or.th.
Related Services
Specialized security services to support your SEC compliance.
Vulnerability Assessment
Systematic vulnerability discovery and risk scoring across your infrastructure and applications.
Learn moreWeb Application Penetration Testing
In-depth security testing for trading platforms, portals, and client-facing web applications.
Learn moreSmart Contract Audit
Rigorous security audits for DeFi protocols, tokens, and ICO smart contracts.
Learn moreSEC Compliance FAQ
Common questions about SEC Thailand cybersecurity requirements for capital markets and digital assets.
Test Against Your SEC Duties
Protect your license and your investors with security assessments built for SEC Thailand requirements.
Reconix is the proof-first offensive security specialist in Thailand, serving regulated digital businesses of all sizes.