Named on a mule-account list: is it criminal record data?

Picture this: one morning your banking app refuses a transfer. At the branch, staff tell you the account is on a list the bank received from the authorities. The bank will close the account, and if you open a new one it will work only over the counter, with no app or online access.

That scenario is not invented. In its request to the Personal Data Protection Committee, the Thai Bankers' Association described exactly these proactive internal measures: ending the relationship with listed customers who fail customer due diligence (CDD), refusing new accounts, or allowing new accounts without electronic channels.

In everyday Thai, an account suspected of being used to receive or pass on scam money is called a mule account. The consultation never uses that phrase. It asks about lists that official bodies such as the police send to financial institutions, and about data banks handle under the Emergency Decree on Measures for the Prevention and Suppression of Technology Crimes B.E. 2566 (2023). In this article we call all of that the mule-account list.

Why the label matters: Section 26 of the Personal Data Protection Act B.E. 2562 (2019) (PDPA) lists criminal records among sensitive data. Collecting it without explicit consent is prohibited unless an exception applies, and Section 26 paragraph three adds that criminal record data must be collected under the control of a competent authority or with protective measures set by the Committee.

Is a mule-account list criminal record data?

It depends on the source. The advisory subcommittee of the Personal Data Protection Committee split the Association's question into three sources of data and tested each against one definition: Clause 3 of the Committee's 2023 Notification on protective measures for collecting criminal record data that is not collected under the control of a competent authority (the Notification).

For the agency letters and both kinds of order, the subcommittee drew its conclusion straight from Clause 3. The CFR is different. As the consultation summarises Section 4 of the Emergency Decree, it is a channel through which financial institutions and businesses disclose or exchange data among themselves when there is reasonable suspicion, using a system jointly approved by the Ministry of Digital Economy and Society, the Royal Thai Police, the Department of Special Investigation, the Anti-Money Laundering Office and the Bank of Thailand.

Our reading: if a bank learns through the CFR only that an account shows suspicious activity, with no state certification and no use in a case, that is probably still ordinary personal data. Once the same data is used in an investigation, or an agency letter follows, its status may change. A bank should therefore record the source of each item separately from the day it arrives.

Does criminal record data mean the account holder is guilty?

No. Classifying data as criminal record data is about the type of information the bank holds and how strictly the bank must protect it. The consultation makes no finding that any account holder committed an offence.

The Clause 3 definition starts at the investigation stage and applies "irrespective of whether such actions have become final or not". Our reading is that a person named in a letter asking the bank to check them may already have criminal record data in the bank's hands, even before any charge, any prosecution, or a finding that they did nothing wrong.

The Association's earlier consultation on screening job applicants follows the same logic: a document recording a withdrawn complaint or a decision not to prosecute still counts, while a "no record found" result that links to no case data does not. The hiring side is covered in how far you can check a job applicant's criminal record.

Can a bank use the list without the account holder's consent?

Yes in two situations, and only with care in a third. The subcommittee sorted its answer by what the bank uses the data for and under whose authority, not by the data itself. The three cases below summarise its opinion on issues 2.1 and 2.2.

Internal measures are where banks need the most care

The Association tried two routes to bring its internal measures within an exception. The first was to treat them as collection under a competent authority's control (Section 26 paragraph three), which would take them outside the Notification. The second was Section 26(5)(e), which would remove the need for explicit consent. It pointed to Bank of Thailand circular No. FPG. (02) W. 224/2566 forwarding a policy framework on managing fraud risk in financial transactions.

The first route fails unless the measure is something the Emergency Decree or another law requires under the direct control of a competent state agency. The subcommittee's wording on this point leaves little room.

On the second route, the subcommittee gave no verdict. It handed the bank two questions to answer itself. First, does a law require the controller to take this action, with an aim of substantial public interest? Second, is collecting and using criminal record data necessary to comply with that law?

If the answer to both is yes, the bank does not need explicit consent, but it must put suitable measures in place to protect the data subject's fundamental rights and interests. If not, and no other Section 26 exception fits, explicit consent is the only route left.

Which Notification duties apply to a bank's internal measures?

Clauses 6, 7 and 8 apply in every case. Clauses 5 and 9 apply as well when the bank's purpose falls within Clause 5 paragraph one (1), (2) or (3), as the subcommittee pointed out. The table sets the duties out in the Notification's own order.

Our advice: Clause 7 turns into three concrete tasks. Limit who can open the list to the team that needs it, log who viewed it and when, and keep the flag that says a customer is listed out of the account screen every branch employee sees.

Clause 5 and decisions to close accounts or restrict services

Our reading: Clause 5 paragraph one (3) covers checking a person's qualifications or prohibited characteristics before "providing other services to a person" by a non-state controller. Deciding whether someone may open an account or use online channels may fall within it. If so, the bank needs either a law requiring the check or explicit consent, and the Clause 9 retention limit applies. The consultation does not address this, so a bank's legal team should assess each measure.

How long may the list be kept?

The Association asked this directly in issue 2.3: could it rely on periods under anti-money laundering law, or on the criminal limitation periods in Section 95 of the Criminal Code? The opinion as published in the collected consultations answers only issues (1), (2.1) and (2.2). There is no answer to issue 2.3.

That leaves the statutory text. PDPA Section 37(3) requires a system to erase or destroy data when the retention period ends or the data is no longer necessary, unless it is kept to comply with a law or to establish, exercise or defend legal claims. Clause 9 of the Notification applies when the purpose falls within Clause 5. Our advice is to set retention per data source and per legal basis, and to record the reasons in the Section 39 record. For setting retention periods, see our retention and erasure guide.

Can a listed account holder see or correct what the bank holds?

Yes, wherever the PDPA applies: when the bank uses the data under another law, under an order that is not exempt, or for its own internal measures. For what the bank does under the Emergency Decree, the opinion says the PDPA does not apply. Our reading is that the data subject rights in Chapter 3 of the PDPA cannot be used against that part.

What listed people usually want to know first is where their name came from. Section 30 paragraph one covers that request directly, because it gives a right to ask for disclosure of how data obtained without consent was acquired. Under paragraph four, where the request cannot be refused, the bank must act without delay and within 30 days of receiving it.

The bank may refuse only on the grounds paragraph two allows. If another law bars disclosure of some details, the bank must be able to name that law, and paragraph three requires it to record the refusal and its reasons in the Section 39 record. Our reading is that a bare "we cannot tell you", with no reason given, does not meet this section.

If the listed name is not you, or the data is wrong

The PDPA puts the duty of accuracy on the controller itself. A bank must keep its own record of the list matched to the facts, rather than waiting for the account holder to complain.

If the account holder asks for a correction and the bank does not make it, Section 36 requires the bank to record the request and its reasons in the Section 39 record, and applies Section 34 paragraph two: the data subject may complain to the expert committee, which may order the controller to act.

Our reading: the right to correction covers what the bank itself recorded, such as matching the wrong national ID number to a name, or keeping a flag after the state agency has notified a change. It cannot force the bank to delete a name that a state agency properly sent. Asking that agency to review its list is a matter for the law the agency works under, and outside the scope of this article.

The right to erasure under Section 33 is limited here. Section 33 paragraph two excludes retention needed to comply with a law or to establish, exercise or defend legal claims. If the bank keeps the list for those reasons, an erasure request may well fail.

Our advice for a listed account holder, in the order we suggest. For how data subject requests work in general, see our guide to data subject requests.

1. Ask the bank to state in writing where the data came from (an agency letter, an order or the CFR) and whether it is acting under the Emergency Decree, under another law, or as an internal measure.
2. File a Section 30 request for access and a copy, and ask how the bank obtained the data. Note the filing date: the 30 days run from the day the bank receives the request.
3. If the data names the wrong person or is out of date, request a correction under Sections 35 and 36 and attach evidence, such as a letter from the agency that sent the list.
4. If the bank asks for consent to use the data for internal measures, ask what happens if you refuse or later withdraw it. Clause 6 of the Notification requires the bank to tell you.
5. If the bank does not answer, or refuses without a legal ground, keep every record of your contact and use your right to complain under Section 73 of the PDPA.

How should banks and fintechs handle mule-account lists?

Start by separating, from the day a list arrives, where each item came from and on what basis it will be used. Every answer the subcommittee gave turns on those two things. The sequence below is our advice, built from the consultation and the statutory text; it is not a procedure the PDPC has prescribed.

1. When a list or letter arrives
   Record its source (agency letter, order or CFR) and whether a state agency certified it or it is being used in a criminal case.Notification Clause 3
2. Before using the data
   Decide whether this use is compliance with the Emergency Decree, with another law or order, or the bank's own internal measure.Section 26 para 3 · 26(5)(e)
3. If it is an internal measure
   Answer the two Section 26(5)(e) questions in writing. If the answer is no and no other exception fits, obtain explicit consent and explain the effect of refusing.Section 26 · 27 para 1 · Notification Clause 6
4. Every use or disclosure without consent
   Record it in the Section 39 record.Section 27 para 3 · 39
5. While the list is held
   Restrict access, log views, and keep security at or above the minimum standard.Notification Clauses 7 · 8
6. When a customer makes a request
   Answer within 30 days; any refusal must rest on a law or court order, with reasons recorded.Section 30 · 36
7. When the retention period ends or the need lapses
   Erase, destroy or anonymise, following the period set for that data source.Section 37(3) · Notification Clause 9

Wherever the PDPA applies, the exposure is clear. Section 84 sets an administrative fine of up to 5 million baht for a controller that violates Section 26 paragraph one or three, or Section 27 paragraph one or two. Section 79 adds criminal penalties for violating Section 27 with Section 26 data in a way likely to cause damage, harm someone's reputation, or expose them to scorn, hatred or humiliation.

This consultation is the subcommittee's opinion to the Thai Bankers' Association. It is not statute and not an administrative order, but it shows how the regulator itself reads the issue. A bank that follows it and documents its own reasoning will be far better placed to explain its decisions than one with nothing on file. For police requests made to companies directly, see police asking for customer data.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)