BANGKOK, THAILAND – Thailand’s central bank ordered sweeping new ID checks and stricter reviews for large cash transactions from April 2026.
Why the central bank acted now
The trigger was not a theoretical risk but a concrete finding. BOT Governor Vitai Ratanakorn publicly reported a withdrawal of 250 million baht and another of 200 million baht, both made entirely in 100‑baht notes. Such transactions could hardly be explained within normal economic activity.
The central bank responded with a resolution published in the Royal Gazette. It required all credit institutions to scrutinise any customer handling cash more closely from April 2026. The framework had been set and implementation was due to begin within days.
ID checks now required for every cash transaction
The most noticeable change for everyday customers was that banks had to verify identity for every cash transaction. Thai nationals were required to show their national ID card, while foreigners had to present their passport. This applied regardless of whether someone withdrew 500 or 500,000 baht.
In addition, banks had to collect up‑to‑date contact details and a signature on the bank form. Regular visitors to their home bank were unlikely to be surprised, as many institutions already recorded customer data. For occasional visitors, the passport became mandatory from April.
First phase: focus on withdrawals and cashier’s cheques
In the initial phase, authorities focused mainly on two types of transaction: cash withdrawals at the counter and cheques exchanged directly for notes. These channels were seen as particularly vulnerable because they left few electronic traces.
Cash left hardly any trace, and that was precisely the problem. The new recording requirement was designed to deliberately limit anonymity for larger sums. What remained a brief formality for small amounts would become a multi‑step procedure for high‑value transactions.
From five million baht a day: tougher checks without exception
Anyone withdrawing cash worth five million baht or more in a single day automatically triggered an expanded review. According to the current exchange rate, this amount corresponded to around 135,000 euros. It did not have to be moved in a single transaction; the threshold applied to the daily total.
In such cases the transaction was immediately classified as high risk. Bank staff were then obliged to ask about the purpose of the withdrawal and request supporting documents. Customers who failed to provide a plausible explanation would not receive the money, and the bank had to reject the transaction.
Enhanced Due Diligence: what banks must check on large withdrawals
The international term for the stricter procedure was Enhanced Customer Due Diligence, or EDD. In essence, this meant the bank had to obtain reliable information about occupation, employer and beneficial owners. For private individuals, a credible explanation of how the cash would be used was generally sufficient.
For corporate clients the requirements were significantly more extensive. Banks could request documents on company structure, revenue and the persons actually controlling the business. The institution was not allowed to rely on information that could not be checked against reliable sources.
When behaviour no longer matches the account history
Not only large withdrawals triggered duties to investigate. Banks were required to continuously compare their customers’ transaction behaviour with their own account history. If a withdrawal deviated significantly from the usual pattern, the system could issue an internal alert, regardless of the amount.
In practice this could mean that a pensioner known for frequent small withdrawals who suddenly requested an unusually large cash amount had to expect questions about the reason. Those who offered a coherent explanation could proceed without difficulty. Customers who remained silent or refused to provide relevant documents would be stopped.
Mandatory reporting to AMLO in suspicious cases
If a bank rejected a transaction, the matter did not end there. Under the Anti‑Money Laundering Act, the bank had to report suspicious transactions immediately to the Anti‑Money Laundering Office (AMLO). The institution froze the process and awaited instructions from the authority.
AMLO coordinated the next steps in such cases and decided whether an in‑depth investigation would be launched. For customers with transparent finances, this mechanism was irrelevant. It applied solely where banks did not receive a plausible explanation.
Money changers also targeted: new daily limits
The new regulation did not only affect bank branches. Licensed currency exchange operators were also subject to stricter controls from April 2026. They were allowed to disburse a maximum of 800,000 baht per person per day, while border areas faced a much lower ceiling of 200,000 baht daily.
These limits targeted a practice the Bank of Thailand had monitored for some time: cash being fed into the formal economy through exchange booths without appearing as a bank transaction. The new caps closed this loophole and complemented controls in the banking sector.
Security standards at ATMs and in banking apps
The tightening was not limited to over‑the‑counter business. Security standards were also raised for withdrawals at ATMs and transactions via mobile banking apps. Existing tools such as PIN codes, one‑time passwords and biometric approval in the app remained the main instruments.
The background was a growing number of fraud cases via digital channels. BOT had already increased requirements for transfers from 50,000 baht upwards in recent years. The new rules fitted into this trend and extended the control framework to cash transactions.
Data storage: how long banks must keep records
All identification records and documents on the purpose of cash transactions had to be stored for five years under the Anti‑Money Laundering Act, calculated from the date of the transaction or the end of the customer relationship. For certain risk‑relevant documents, a ten‑year retention period applied.
This documentation was available to the central bank for internal audits and to law enforcement authorities for court proceedings. Strict data protection rules ensured that stored information could only be used for legally prescribed purposes.
What happens to banks that ignore the rules
The central bank made clear it would not tolerate violations. Financial institutions that failed to implement the new identification and review duties consistently risked severe sanctions. BOT could impose additional conditions, suspend certain services or order further corrective measures.
These consequences applied only to institutions, not to ordinary bank customers. For consumers, a possible breach by their bank mainly meant uncertainty over whether their transactions were processed correctly. Well‑run banks therefore had a strong self‑interest in full compliance.
What Thailand signalled internationally with these rules
With the new regulation, Thailand closed a gap that many other countries had already addressed. The requirements matched international standards for combating money laundering and terrorism financing as defined by the Financial Action Task Force (FATF). Thailand was now applying these guidelines to the cash sector as well.
For most customers – including expats, retirees and tourists – this meant a brief extra step at the counter: have a passport ready and know the purpose of the transaction. Those who managed their finances transparently had nothing to fear. Anyone who had relied on the anonymity of cash would find it much harder to do so unnoticed.
The measures described by the Bank of Thailand (BOT) took effect on 1 April 2026 and were published in the Royal Gazette. They obliged all financial institutions to verify identity for every cash transaction and to conduct enhanced due diligence for daily cash movements from five million baht. Euro figures were approximate, as the exchange rate of around 36–37 baht per euro fluctuated daily, and the information provided did not replace individual legal or financial advice.