Thailand · Compliance
PCI DSS compliance in Thailand
Achieve PCI DSS compliance in Thailand with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Manila office team
- Effivity software included
- Academy training included
Who asks for PCI DSS in Thailand
Clients include
PCI DSS compliance in Thailand at a glance
In Thailand, PCI DSS is asked for by buyers and schemes rather than required by law. The drivers below show where the pressure comes from.
Card security in Thailand sits under two authorities at once: the payment brands, which set PCI DSS, and the Bank of Thailand, whose notifications cover payment security and IT risk for financial institutions. Neither Bank of Thailand notification names PCI DSS. SorNorChor. 11/2561 sets access control, confidentiality and integrity, availability and security audit expectations for payment system providers, and FPG. 19/2560 sets IT risk rules for financial institutions and their service providers. Compliance with PCI DSS is validated by a Qualified Security Assessor or by self-assessment, as the brands and your acquirer require; there is no certificate from a certification body. The firms that feel the requirement most are BPOs handling card data for overseas retailers and banks, payment providers and card-taking e-commerce businesses. Sterling's Manila office scopes the cardholder data environment, closes gaps and prepares assessment evidence, remotely or on site, with Effivity and Sterling Academy included in the engagement. Local questions are answered below.
Who needs PCI DSS in Thailand, and what happens without it
These are the organisations in Thailand that most often need to show PCI DSS.
- Payment system and payment service providersThe Bank of Thailand's payment security notification sets security expectations that sit alongside card scheme rules.
- Banks and card-issuing institutions and their processorsThe IT risk notification covers security controls and service providers of financial institutions.
- BPOs handling card data for overseas retailers and banksOverseas clients usually require PCI DSS validation from outsourced card handling.
- E-commerce, travel and software firms that take card payments
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the PCI DSS readiness checkPCI DSS requirements in Thailand
Strip away the vocabulary and PCI DSS asks any business that stores, processes or transmits card data to comply in six areas.
In Thailand these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: PCI DSS explained →
How to achieve PCI DSS compliance in Thailand
One team from the Manila office carries the work from scoping to sign-off. Clients across Thailand are served from Sterling's Manila office, on site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against PCI DSS and the Thai requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does PCI DSS compliance take in Thailand?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Thailand these are the factors that set the timeline.
- Scope of the cardholder data environment
- Segmentation and logging maturity
- Assessor availability and the card brands' timetable
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does PCI DSS compliance cost in Thailand?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In Thailand these factors move both.
- Size of the cardholder data environment
- Remediation of controls found missing
- QSA fees quoted separately from consulting
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
PCI DSS consultants and assessors in Thailand
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers PCI DSS and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Thailand are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive PCI DSS in Thailand (2)
| Instrument | How it treats the standard |
|---|---|
| Bank of Thailand Notification No. SorNorChor. 11/2561 | Related Security expectations for payment system providers; the notification does not name PCI DSS. |
| Bank of Thailand Notification No. FPG. 19/2560 | Related IT security controls of financial institutions and their service providers; does not name PCI DSS. |
Accreditation, audit language and remote audits in Thailand
Compliance, not certification: PCI DSS compliance is validated by a Qualified Security Assessor (QSA) or by self-assessment, as the payment brands and your acquirer require for your merchant or service provider level. No accreditation body issues a PCI DSS certificate, and no QSA company is named here. Edition and transition details: PCI DSS hub →
Audit language
Reports of compliance and the assessor's working papers are normally in English; internal procedures can be in Thai or English.
Remote and on-site
Document review and many interviews can be remote; card data environments, data centres and branch or call centre sites are inspected on site where scope requires.
PCI DSS in Thailand: questions clients ask
Does the Bank of Thailand require PCI DSS?
Neither Bank of Thailand notification names PCI DSS. They set the regulator's own security expectations for payment system providers and for financial institutions' IT risk, while PCI DSS comes from the card brands through your acquirer. Both can apply to the same business, so confirm each with the regulator and your acquirer.
Who validates PCI DSS compliance?
Either a Qualified Security Assessor (QSA) or yourself, through a self-assessment, depending on the validation level the payment brands and your acquirer set for your type and size of business. Nobody issues a PCI DSS certificate the way an accredited certification body would. The first practical step is to ask your acquirer which route and level apply.
Do BPOs in Thailand need PCI DSS?
If they handle card data for overseas clients, usually their clients require it, since the client remains responsible for the card data its supplier touches. The requirement then comes from the contract and the payment brands rather than from a Thai law we found. Check the contract and ask your acquirer or client.
Is PCI DSS the same as ISO 27001?
No. PCI DSS is the payment card industry's security standard and is validated by a QSA or self-assessment. ISO/IEC 27001 is a management system certified by an accredited certification body. They overlap in controls, so one security programme can support both, but neither replaces the other.
More on PCI DSS for Thai organisations
- PCI DSS: the complete guide
- Watch: How to implement PCI DSS
- Banking and financial services: PCI DSS for the sector
- BPO and contact centres: PCI DSS for the sector
- E-commerce and retail: PCI DSS for the sector
- Fintech and payment facilitators: PCI DSS for the sector
- Healthcare providers and insurers: PCI DSS for the sector
- Hospitality and travel: PCI DSS for the sector
- Software and hosting: PCI DSS for the sector
- PCI DSS compliance in Thailand and every other standard Sterling delivers there
Other standards Thai businesses ask Sterling for
Organisations in Thailand often combine PCI DSS with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Manila office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Bank of Thailand Notification No. SorNorChor. 11/2561 — bot.or.th (accessed 7 Oct 2026)
- Bank of Thailand Notification No. FPG. 19/2560 — bot.or.th (accessed 7 Oct 2026)
- Board of Investment (BOI) investment promotion — Investment Promotion Guide 2025 — osos.boi.go.th (accessed 7 Oct 2026)
Talk to a consultant
Plan your certification with the Manila team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
philippines@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice