This is to outsource the entire IT resources and operations including location, equipment, hardware, software, staff, facilities, communication and other necessities to the third-party service providers. By that, financial institutions will not involve in those operations but rather assign a coordinator to monitor the performance of the provider. 2  BIS Review 35/2005  -  Selective areas of IT operations. With this, a financial institution may acquire a certain service of a provider, for example, renting the facility of a service provider to operate its back-up hardware and software. Both full and selective scopes of outsourcing can be carried out with a third-party service provider residing domestically or abroad. This raises supervisory concerns. Since financial institutions' data including customer and transaction data are processed by other parties, A financial institution must ensure its data integrity, security and confidentiality to prevent data leakage and mishandling. Moreover, though operated elsewhere - whether domestically or abroad, system reliability and availability still fall under the financial institutions' responsibilities. All of these issues can in fact impact the institution's reputation, image and credibility. E-banking frauds in Thailand E-banking, unfortunately, also brings about electronic frauds. There are two major kinds of frauds thriving in electronic payment environments in Thailand: card-based and networks-based frauds. Card-based frauds include counterfeited ATM and Credit cards, and Skimming, which involves copying the magnetic stripe encoding from debit or credit cards to forged cards The network-based fraud is called "Phishing".

Normally, IT and Financial or Safety and Soundness examinations are performed concurrently where their examination results are integrated together for an overall risk assessment. At this stage, examiners gather information through a variety of examination techniques such as interview, observation, review of documents to summarize the findings. 3. Post examination  After the findings, examiners will assess the risks of those findings and report on significant issues. The risks regarding IT are assessed and assigned to IT risk rating which is divided into three levels, high, medium, low with respect to the probability of occurrence and the degree of impact to a financial institution. For significantly high risk issues which indicate serious control weaknesses which then need an immediate correction, we could enforce the FI to take corrective action within a predetermined period of time. And, it is our duty to monitor compliance with such an enforcement action. This is a process of follow-up The risk assessment is performed not only when conducting IT examination but also when considering new products and services' applications. Currently, the products and services that need BOT's IT risk assessment prior to approval are internet banking and e-money. IT Risk Assessment Factors, at a minimum, include: Security: The financial institutions have to prove that they have adequate security measures in place to ensure that information is protected against harm from threats leading to different types of vulnerabilities such as loss, inaccessibility, alteration or wrongful disclosure. Risk management: Risks of new products and services must be thoroughly considered by the financial institution.