Thailand: Central Bank Calls In Bank IT Chiefs, Orders Cyber Drills After Overseas Attacks
The Bank of Thailand (BOT), the country’s central bank and banking regulator, has told every bank in the country to tighten its cyber defences and rehearse emergency plans for critical payment systems. The order came after IT failures and cyberattacks hit financial institutions abroad. The BOT stresses that nothing has hit Thai banks so far.
Key facts
- On the morning of 9 November 2026, the BOT called in the chief information officers of all financial institutions for an urgent meeting on cyber readiness.
- The Thailand Banking Sector Computer Emergency Response Team (TB-CERT), which sits under the Thai Bankers’ Association, also joined the meeting.
- Deputy Governor Suwannee Jatsadasak said no impact on Thai financial services had been detected, and that the BOT is closely monitoring the overseas incidents.
- Banks must share threat information, assess new risks together, keep IT systems up to the required security standards and run regular drills for critical payment systems under their business continuity plans (BCPs).
What the central bank is asking for
The BOT’s message has two parts. The first is prevention: banks must keep watching for threats, swap intelligence quickly through TB-CERT and make sure their systems meet the security standards the regulator has already set. The second is readiness: banks need response plans for different levels of cyber risk, so that a small incident and a major one each have a clear playbook.
The most practical instruction is the drills. A business continuity plan is a bank’s script for keeping key services running when something breaks, whether that is a power cut, a software failure or an attack. The BOT wants banks to practise these scripts regularly for critical payment systems: the rails behind mobile banking transfers, card payments and PromptPay, Thailand’s national instant payment and QR service.
The central bank also framed the move as a precaution. It has not reported any attack on Thai banks, and it says people can keep using financial services safely. Bank apps, transfers and payments, including those used by tourists and foreign residents, were working normally, according to local reports.
Why it matters
In Thailand, much of daily spending now runs on mobile banking and QR payments. When a few large banks and one national payment network carry so much of the load, a single outage can stop salaries, shop payments and transfers at once. That is why regulators now treat cyber resilience as a financial stability issue, not only an IT problem.
The meeting also shows how quickly regulators react to trouble elsewhere. The BOT did not wait for an incident at home. It moved within days of the overseas disruptions, and Prime Minister Anutin Charnvirakul had told government agencies on 8 November to prepare for possible cyber threats. Thailand’s National Security Council has described the extra monitoring as a precaution rather than a sign of a serious attack.
The move fits a wider regional push. In July 2026, the BOT signed a memorandum of understanding with the Monetary Authority of Singapore (MAS) to share cyber threat intelligence and incident reports and to run joint crisis exercises. There is a Malaysia link too: in April 2025, the BOT and Bank Negara Malaysia (BNM) signed a similar pact on cybersecurity and digital fraud protection. With Thai and Malaysian QR payments already connected through PromptPay and DuitNow, a cyber problem on one side of the border can quickly matter on the other, so shared early warnings help both.
What to watch
- Whether the BOT turns its guidance into new or tighter rules on incident reporting and payment system drills.
- Any update from the BOT or TB-CERT if the overseas situation changes or if Thai services are affected.
- More joint exercises under the BOT’s cyber cooperation deals with MAS and Bank Negara Malaysia.
Related on FinDeskAsia: ASEAN’s cross-border QR links and Thailand eyes March 2027 for baht stablecoin rules.
Sources: The Nation (November 2026), Malay Mail / Bernama (November 2026), The Thaiger (November 2026), The Star (July 2026), Bank Negara Malaysia (April 2025).
