The Bank of Thailand has Implemented Regulations for the Supervision of Virtual Banks

On 6 September 2024, the Bank of Thailand (“BOT”) issued Notification No. FPG. 6/2567 regarding the supervision of virtual banks (“Notification”). The Notification requires virtual banks to comply with regulations for traditional commercial banks, as well as additional requirements specific to their digital nature and corporate structures. Its aim is to ensure effective operations, appropriate risk management and stability of the financial system. The Notification applies to virtual banks and their parent companies, subsidiaries and affiliates within financial business groups, as defined by the Financial Institution Business Act B.E. 2551 (2008).

General regulations

1. A virtual bank, which shall obtain prior approval from the BOT, is classified as a financial business under the BOT's regulations for the financial business groups of commercial banks. If it is a part of a financial group, the parent company must treat the virtual bank separately from its other institution's Solo Consolidation group, even within the same Full Consolidation group. After completion of the initial phase, the other institutions and its subsidiaries are prohibited from granting credit or engaging in similar transactions as granting credit with the virtual bank, except for permitted short-term interbank liquidity management or other specific circumstances approved by the BOT.
2. Supervision of capital involves situations where other financial institutions directly or indirectly hold shares in a virtual bank. This leads to increased capital beyond actual investment, which can impair the virtual bank’s ability to manage risk effectively. If such financial institutions increase their investments and the virtual bank raises its lending limit for large borrowers, the BOT may require the virtual bank to maintain capital according to its guidelines.
3. Virtual banks must not use names, logos or symbols similar to those of other financial institutions, thus to prevent public confusion about their services and stability. 
4. Corporate governance mandates that virtual banks must have at least one director and a full-time technology executive with a minimum of three years’ experience in IT or digital services. 
5. Virtual banks and their subsidiaries must obtain unanimous approval from their boards for any transactions with major shareholders or related entities, and this authority cannot be delegated. Additionally, they are required to prepare and submit a report on such transactions every six months to their boards, as well as keep the reports on file for potential review by the BOT.
6. Virtual banks must primarily offer services through digital channels, with exceptions requiring prior approval from the BOT. Alternative services, such as using online branches or financial agents, should not undermine digital offerings. Additionally, virtual banks must provide annual updates on their implementation plans to the BOT.
7. Virtual banks must maintain continuous IT services, limiting disruptions to no more than eight hours per year and resolving any interruptions within two hours. They are also prohibited from integrating their banking systems with those of other financial institutions, both domestically and internationally.

Initial Phase

1. In the initial phase, a virtual bank is permitted to request approval from the BOT to appoint a manager or authorised representative from another financial institution to oversee their operations as secondment. The BOT will assess each request by considering the justification provided, the necessity of the appointment and the measures proposed to address any potential conflicts of interest. This process ensures that the governance of virtual banks remains transparent and in alignment with regulatory expectations.
2. The BOT has eased its stress testing guidelines for virtual bank in their initial phase, allowing the virtual banks to use either self-developed or standard supervisory scenarios. The virtual banks must classify the scenarios into at least two severity levels: baseline and adverse. Additionally, they are required to assess risks in at least three areas - credit risk, market risk in trading accounts and liquidity risk - according to the BOT’s supervisory capital framework (Pillar 2). If insufficient data exists to model the impacts, the virtual bank should apply qualitative criteria or prudent discretion.
3. A virtual bank is not required to submit a recovery plan to the BOT during their initial phase. However, upon exiting this phase, they must comply with recovery plan requirements; the details of which are issued by the BOT. If a virtual bank receives approval to transition out of the initial phase between April and June, it must submit its recovery plan by October of that year; otherwise, it should follow the standard submission timeline. If unforeseen circumstances impede compliance, the virtual bank may request an extension from the BOT, which will be considered based on the justification and necessity of the request.

This is intended merely to provide a regulatory overview and not to be comprehensive, nor to provide legal advice. Should you have any questions on this or any other areas of law, please do not hesitate to contact: 

Nuttaros Tangprasitti
Partner
Anutchakij Soontornraksa
Associate

Authors