The Bank of Thailand (BOT) has officially implemented a new regulatory framework governing systemically important retail payment systems (SIRPS), effective from 21 February 2026. PromptPay has been designated as the first payment system to fall within the SIRPS regime.
Under the new regulations, the BOT may designate payment systems as SIRPS under the Payment Systems Act B.E. 2560 (2017), based on both quantitative and qualitative assessments. Once designated, the operator of a SIRPS becomes subject to enhanced supervisory obligations that go beyond the general requirements of the Payment Systems Act.
Enhanced Supervisory Requirements
SIRPS operators are required to comply with a heightened supervisory framework across three key areas, as outlined below.
1. Governance
SIRPS operators must maintain robust and transparent governance structures, including:
- A balanced board composition, with at least one-third of board members being independent directors representing system stakeholders (such as payment service providers, consumers, and relevant experts). Independent directors may serve no more than two consecutive terms.
- The establishment of subcommittees to support the board in overseeing compliance, policy implementation, and operational strategy.
- A clear separation between executives responsible for risk management and information security and those overseeing day-to-day business operations.
2. Risk Management and System Security
SIRPS operators must implement comprehensive risk management frameworks, including:
- Clear service agreements between the SIRPS operator and its direct participants (payment service providers that connect directly to the SIRPS), clearly defining roles and responsibilities. These agreements must also require direct participants to supervise any indirect participants they onboard, ensuring compliance with applicable service agreements and business rules.
- A business continuity plan covering both IT and non-IT aspects, subject to annual review. The SIRPS must target service availability comparable to international payment infrastructures, including the ability to recover operations within two hours of a disruption and to maintain scalable operational capacity.
- Tools and controls to monitor and manage material or systemic risks, including credit and settlement risk, liquidity risk, and operational risk.
3. User Protection and Competition
To promote transparency and equitable market access, SIRPS operators must:
- Establish fair, transparent, and non-discriminatory criteria for system access and exit.
- Develop and maintain business rules aligned with guidelines issued by the BOT’s Payment Strategy Forum (PSF) working group. The BOT may require amendments to business rules where appropriate.
- Ensure fair and transparent fee structures, covering both fees charged by the SIRPS operator to system participants and fees charged by participants to end users (such as merchants). Fee structures must comply with BOT requirements and be approved by the PSF, and SIRPS operators must consider feedback from system participants when setting fees.
Key Takeaways
As PromptPay becomes a core component of Thailand’s retail payment ecosystem, its designation as a SIRPS significantly increases regulatory obligations for the PromptPay operator and participating payment service providers. All SIRPS participants—whether connecting directly or indirectly—must ensure that their operations, governance, and fee structures comply with PromptPay business rules and the BOT’s enhanced supervisory standards.
