Normally, IT and Financial or Safety and Soundness examinations are performed concurrently where their examination results are integrated together for an overall risk assessment. At this stage, examiners gather information through a variety of examination techniques such as interview, observation, review of documents to summarize the findings. 3. Post examination  After the findings, examiners will assess the risks of those findings and report on significant issues. The risks regarding IT are assessed and assigned to IT risk rating which is divided into three levels, high, medium, low with respect to the probability of occurrence and the degree of impact to a financial institution. For significantly high risk issues which indicate serious control weaknesses which then need an immediate correction, we could enforce the FI to take corrective action within a predetermined period of time. And, it is our duty to monitor compliance with such an enforcement action. This is a process of follow-up The risk assessment is performed not only when conducting IT examination but also when considering new products and services' applications. Currently, the products and services that need BOT's IT risk assessment prior to approval are internet banking and e-money. IT Risk Assessment Factors, at a minimum, include: Security: The financial institutions have to prove that they have adequate security measures in place to ensure that information is protected against harm from threats leading to different types of vulnerabilities such as loss, inaccessibility, alteration or wrongful disclosure. Risk management: Risks of new products and services must be thoroughly considered by the financial institution.

  With the widespread use of IT, it is important that the legal framework is in line with the new environment. Thailand has started to legislate five new Information and Communication Technology (ICT) Laws to embrace information technology since 1998. They are the Electronic Transactions Law, Computer Crime Law, Data Protection Law, Electronic Funds Transfer Law, and the National Information Infrastructure Law. The Cabinet has appointed the National Electronics and Computer Technology Center (NECTEC) to take charge of the drafting of these laws. The Electronic Transactions Law was promulgated on April 3, 2002 while the others arc in the process of enactment. BIS Review 35/2005  1  2. E- banking products in Thailand and supervisory concerns  What I would like to do next is to give you some examples of IT-related financial products and services currently offered in Thailand and the pertinent risk issues that bring up supervisory concerns. Let me start by briefly showing you our data on e-banking service usage by category. In the first four rows of the table, the figures show customers' e-banking transactions that have high transaction volumes but low average values. In the remaining rows, you will find that the Bank of Thailand is the sole service provider facilitating wholesale payment transactions between financial institutions and the central bank. Even the number of transaction is much smaller, the value is certainly much higher. This type of transaction of course has different risk implications from that with higher transaction volume in smaller amount of money.