Paradise lost: Vietnam and Thailand reveal the blueprint of finance control

Walk into a bank branch in Hanoi in 2025 and you saw the future: queues of people holding phones up to their faces, staff telling them to blink into the camera, and notices warning that accounts without biometric verification would lose their online banking. Not "reviewed". Not "upgraded". Switched off.

In July 2025, Vietnamese state media went further and reported that from 1 September more than 86 million accounts that had not completed biometric checks, or had been dormant for a long time, would be deleted, out of roughly 200 million on the books, with about 113 million personal and 711,000 organisational accounts counted as verified. The figure went round the world. It was not quite what happened: the central bank's payment department said a day later that no bank would delete a customer's account without a specific rule, and the rule that followed in late August ordered no mass closure. What did happen is less dramatic and more lasting, and it is described below.

A thousand miles away, Bangkok ran a different version of the same script. In August 2025 the Bank of Thailand told banks to put a personal daily limit on every customer's online transfers, starting at no more than 50,000 baht a day, while a new emergency decree against technology crime let banks suspend accounts suspected of being part of "mule" networks. For weeks, vendors, freelancers and expats found themselves locked out of their money overnight.

Two countries. Two different tactics: switching off versus freezing. One unmistakable direction of travel: financial access conditioned on digital and biometric compliance.

Vietnam: no face scan, no online banking

Vietnam did not stumble into this. The State Bank of Vietnam has staged the shift through a chain of decisions and circulars. Since 1 July 2024, under Decision 2345, individuals must confirm online transfers above VND 10 million (about 380 US dollars), or above VND 20 million in a day, with a face or fingerprint scan, and the first transaction from a new device needs one too. This is not a world where you show ID once at onboarding; it is continuous proof of life.

The keystone is Circular 17/2024/TT-NHNN. Since 1 January 2025, an individual whose ID and biometrics have not been verified with the bank cannot pay, transfer or withdraw online; since 1 July 2025 the same applies to companies whose legal representative has not been verified. The account is not closed. Counter service and incoming payments continue, and access returns after a branch visit or a check through the national VNeID identity app. By October 2025, the central bank counted 128.9 million personal and 1.3 million corporate accounts as biometrically verified.

The deletion story has a sequel. In mid-2026 the central bank consulted on a draft amendment that would let banks close "junk" accounts with no transactions for three years or more, without the holder's consent. Even if many of those accounts really are dormant, the precedent is plain: no biometrics, no banking; no activity, no account.

What about people abroad? For emigrants and long-term travellers, "come to a branch" or "verify in the national app" is not a formality. A Vietnamese account held from abroad can become an account you can see but not use. The structural message is unmistakable: access to money now flows through a single chokepoint, centralised identity plus biometrics.

Thailand: limits, freezes and a hotline

Thailand's move is different in form but not in spirit. Since August 2025, banks set a daily limit for digital transfers and payments for each customer, based on a risk profile; the starting point is no more than 50,000 baht a day, for new mobile banking customers immediately and for existing customers by the end of 2025. The limit can be raised on request. The central bank's own slides of July 2026 show the tiers: up to 50,000 baht, up to 200,000 baht, and above. From autumn 2026 children and teenagers get far lower caps, from 3,000 baht a day on e-money for the youngest.

In parallel, banks froze accounts flagged as part of scam money trails. At the peak, in August and September 2025, around 10,000 to 14,000 accounts a week were being suspended. For countless innocent people the experience was not a gentle limit but a hard stop: payments declined, small businesses stranded, expats and tourists facing a wall of bureaucracy when they asked why.

Under pressure, the authorities changed course. From mid-September 2025, account holders could call the 1441 hotline, and wrongly suspended accounts were to be released within four hours to one working day, instead of up to seven days. Banks were told to hold only the suspicious amount, not the whole account, and to say so in plain words. That nuance matters, but it is cold comfort when your rent is due and your account is effectively bricked.

Different tactics, same architecture

Look closely and you see the same architecture in both countries.

• National digital identity plus biometrics becomes the gatekeeper to finance. In Vietnam it sits alongside the VNeID ecosystem, which ties a person to one persistent identity across services. Banks must keep testing that identity at the point of transaction.
• Programmable constraints appear in policy. Thailand's limits are not about how much you have, but how much you are allowed to move, based on your risk band. That is programmability in embryo.
• Exceptional tools become routine. Bulk suspensions justified by an emergency become normal, and a mass cleanup of accounts is announced as housekeeping.

Think one layer ahead and you reach central bank digital currencies built on top of this identity stack. If identity plus biometrics controls the on-ramp and programmable limits control the flow, a digital currency would control the money itself. Whether or not one is on the agenda in these countries, the plumbing is being laid. Europe's own debate is covered in our piece on the digital euro and its holding limit.

"But it is to fight scams"

Yes, fraud is real, vicious and rampant. The Thai central bank's governor said in September 2025 that stolen money leaves the system in about three minutes, while victims often notice only many hours later. Instant payments are a dream for criminals and a nightmare for victims, and throttling speed and freezing suspicious flows does make recoveries easier. The central bank reports that losses from victims tricked into transferring money fell from about 8.6 billion baht in the second quarter of 2024 to about 1.8 billion baht two years later. That is the state's argument, and the numbers back it.

Vietnam's regulators likewise point to fake accounts, inactive shells and identity fraud on a huge scale. Understandable motive. Extraordinary method.

The problem is that error and overreach are built in. Algorithmic false positives, one-size-fits-all freezes and sweeping cleanups inevitably hit innocent people, especially foreigners, the elderly, small merchants and people living abroad. Thailand's emergency pledges to unfreeze within hours are the proof: if the machine were perfectly calibrated, none of that would have been needed.

Why call these sandboxes?

Because the direction of policy, digital identity plus biometric gating plus programmable limits, is the direction promoted in countless international "best practice" papers on fighting money laundering and fraud. Vietnam and Thailand have the scale, the technology adoption and the regulatory freedom to run the hardest tests first. The results are then packaged as success stories for everyone else: it works there, so why not here?

Notice the playbook:

• Define a crisis: scams, fraud, money mules.
• Mandate stronger ID: biometrics, device binding, re-verification.
• Throttle the rails: transfer limits, risk bands.
• Normalise emergency powers: bulk freezes, mass cleanups.
• Backfill customer service afterwards: hotlines, apologies, faster unfreezing.

At the end of this cycle, populations are trained: access to money is conditional. Today the condition is "prove you are you and you are not a mule". Tomorrow the condition can be anything.

What happens when this reaches you?

You do not need a digital currency or a dramatic law to feel the effect. Imagine the near future in London, Stockholm or Oslo:

• Your bank app demands a live selfie because you logged in from a new device. The liveness check fails. Your account is suspended pending review.
• You try to send a large transfer. A new rule imposes a daily limit unless you accept a deeper review: upload a video, read a phrase, scan your ID again.
• A donation or a purchase that fits a "risk pattern" triggers an automatic hold. You are told to contact support.
• You travel for six months. Your profile drifts out of pattern. Compliance flags your account, and service is reduced until you appear in a branch.

Every one of those steps already exists somewhere, in policy, in code or in a pilot. In the UK, banks can already freeze accounts on suspicion, as our pieces on account freezing orders and on being debanked in the UK show. Vietnam and Thailand have simply gone further and faster.

The counter-narrative you will hear

You will hear that cleaning up tens of millions of unverified accounts is good housekeeping; that bulk freezes are the only way to stop industrialised fraud; that biometrics and limits are for your safety; that innocent people now have a hotline and a four-hour path back to their money. All technically true, and politically transformative. Once access to money depends on central databases and continuous biometric checks, the balance of power shifts. Your bank account stops being property and becomes a revocable permission.

The human cost

In Thailand, vendors stopped accepting QR payments for a while, expats queued in branches for hours, and people went days without access to pay rent or buy stock. The central bank's reassurances, that it would fix the process and speed it up, were an admission that the rollout hit innocent people hard.

In Vietnam, companies that missed the July 2025 deadline for verifying their legal representative lost their online payments, and individuals who had not re-verified found that their account still existed but no longer worked online. That is no longer banking as you knew it.

What smart people are doing now

This is not a pitch for anarchy. It is a case for redundancy and jurisdictional diversification, before your home system tightens further:

• Several banking relationships in jurisdictions with different risk appetites and dispute processes.
• Buffers outside a single platform, including some cash where sensible and other payment rails, so you can operate for a while if an algorithm trips you.
• A hard separation between personal spending and operating accounts, so one freeze does not cascade.
• A second residence and compliant structures, so you are not trapped by a single national switch.

Holding accounts in several countries is legal, your income stays taxable where you are resident, and we never help anyone hide anything. If you live in or move to the region, our Thailand page and the piece on Wise and Thai addresses cover the local side.

Vietnam and Thailand are not outliers; they are the sandbox. The question is whether you wait until an account is frozen or a face scan fails to match, or whether you build a real Plan B now, while it is still a matter of choice.