The facts
- Who files
- Commercial banks, foreign bank subsidiaries and branches, specialised financial institutions, finance companies and credit foncier companies; the IT Risk Data Set also covers non-bank payment service providers. Source
- How often
- 9 Monthly; 6 Quarterly; 4 Semi Annually; 3 Weekly; 1 Yearly (counting each dataset in the group; see the inventory for which). Source
- Deadline
- Varies by item: mostly 15 to 21 days after the reporting period end, up to 2 months for annual items. Source
- Format
- XML. Reported via the DMS as the Risk Management data set; the IT Risk Data Set guide is published as a separate Word document on the same page. Source
- How it is filed
- Filing routes recorded for the BOT: DAP (Data Acquisition and Publication); RDT (Regulatory Data Transformation). See how firms file with the BOT.
- Status
- In force
- Group
- Risk management
Templates (23)
The tables and forms inside the return. Plain name first, the BOT's code in brackets.
- Financial Targets (DS_FTG)
- Committed Credit Line (DS_CCL)
- Risk Limit Trigger (DS_RLT)
- Value at Risk (VaR) (DS_VAR)
- Greek (DS_GRK)
- IR PV01 (DS_IRP)
- Credit Valuation Adjustment (CVA) (DS_CVA)
- Profit and Loss of Financial Instruments Held at Fair Value through Profit and Loss (DS_PLF)
- แบบรายงาน Funding Concentration (DF_FCC)
- แบบรายงาน LCR Significant Currency - Solo (DF_LSC)
- Liquidity Coverage Ratio: CONSO (DF_LCC)
- Net Stable Funding Ratio: CONSO (DF_NSFC)
- Excel For Market Risk (DF_MRC)
- IT Audit (DS_ITA)
- IT Capacity (DS_ITC)
- IT DC-DR (DS_IDD)
Show all 23 templatesShow fewer
- IT Infrastructure (DS_ITI)
- IT Project (DS_ITP)
- IT Staff (DS_ITS)
- IT System Profile (DS_ISP)
- Technology Implementation (DS_TGI)
- Third Party (DS_TPT)
- IT Outsourcing (DS_ITO)
23 datasets across strategic, market, operational and liquidity risk; version 2.1 of the Risk Management Data Set. Source
Validation rules
The BOT publishes the checks it runs on this return. They could not be counted from the published material. They are written for people to read; software cannot run them as published. Source
How they are written: Written rules in BOT's documents, in Thai and English: a 'Validation Rule' column for each data element in Risk Management Data Set Manual version 2.1 (117 rows with a rule, in 18 tables); numbered rules in tables headed 'Validation Id' in คู่มือการรายงาน IT Risk Data Set (IT Risk Data Set reporting guide) (46 ids); a 'Validation Rule' column for each data element in คู่มือการรายงาน IT Risk Data Set (IT Risk Data Set reporting guide) (44 rows with a rule, in 8 tables)..
BOT publishes no XML schema file or rule file that software can run as published. BOT's Data Set page describes three automated checks its DMS system runs on every submission: Basic Validation, Complex Validation (relationships within the same data set, run on data received by 17:00 each day) and Cross Validation (between data sets, with results shown to the reporting firm the next day).
How they were counted
Not counted: the checks are written for each data element in the manual's 'Validation Rule' column, often several to a cell, not as numbered rules.
Counts are in the BOT's own unit, so they are not comparable with other regulators' counts.
Public data
No published data from this return was found. No published aggregate or firm-level figures from this return were found on BOT's statistics pages. Source
Official documents (3)
The BOT's own files, with the size and SHA-256 fingerprint of each as downloaded on 13 November 2026, so anyone can tell whether a copy is the same version.
- Risk Management Data Set Document version 2.1
Instructions · ZIP · 300.3 KB · 15 October 2025
SHA-256
ad146b8870c0show in fullad146b8870c0156fac2e40e71af6eda478ff8909bb46b85916f4dbe305153849 - Risk Management Data Set Manual version 2.1
Instructions · ZIP · 271.1 KB · 12 May 2023
SHA-256
1c0e708ea7d5show in full1c0e708ea7d5989206bcd05e27d0519858551db80eabddf5eee7499c74bb9604 - คู่มือการรายงาน IT Risk Data Set (IT Risk Data Set reporting guide)
Instructions · DOCX · 288.5 KB · 12 May 2023
SHA-256
89104e78bad6show in full89104e78bad6d7085b8ff6b7b32b7d98ce8237378a682bfcc1a75b19594c3938
Sources
Every page and document this return's facts were read from.
- bot.or.th/th/our-services/data-acquisition-publication/report-document-financial-institution/riskmgt-fi.html
- bot.or.th/content/dam/bot/documents/th/statistics/dms/dataset-inventory/dataset-inventory-by-fi-type-and-regulation-20260630.xlsx
- bot.or.th/th/our-services/data-acquisition-publication/report-document-financial-institution/datasetfifm.html
Knowing exactly what is collected, in what format and under which rules is the first step to real-time supervision. Line4 builds SupTech software for financial regulators that runs checks like these as each return arrives.
Line4's text and records here are free to reuse under CC BY 4.0. Please credit: “Source: Line4 regulatory submissions library (CC BY 4.0), https://www.line4.ai”. The regulators' documents, forms, taxonomies, rules and data belong to them: see BOT's reuse terms. This describes what regulators publish. It is not legal or regulatory advice: always rely on the regulator's own text.
Last checked 13 November 2026.
