Thai MPs Name Webull in KYC Probe: Anti-Money Laundering and KYC Upgrades

The Thai House of Representatives’ Committee on the Prevention and Suppression of Money Laundering and Narcotics (กมธ.) has sent an invitation letter to the management of securities firm Webull, asking it to explain the KYC/CDD standards related to customer identification and verification. The briefing is scheduled for June 11, 2026, at the Parliament building.

This review stems from complaints and the results of a police investigation. The investigation found that a fraud ring linked to a financial crime network may have used the Webull platform as a channel for parking and transferring funds, raising concerns about the overall credibility of Thailand’s capital market.

Webull responded that the company is not involved in the related crimes, but it urgently patched security vulnerabilities within 1 week after the issues were discovered. The company said it identified about 40 to 50 “mule accounts” (zombie accounts) and has closed them.

Review Focus: KYC/CDD and Money Laundering Risks

The committee believes the issue is not merely a technical flaw in the platform, but one that could also affect the image and credibility of Thailand’s capital market. If a securities firm becomes a loophole for money laundering or criminal fund transfers, the impact could spread further.

According to the report, the date of the “urgent” letter was June 2, 2026, inviting Chief Executive Officer Chonladet Khemarattana to provide an explanation on customer screening procedures, anti-money laundering measures, and the company’s risk control plan.

Police Tracking: From “Mule Accounts” to Capital-Market Fund Cycling

The investigation began with a joint operation by the Central Investigation Bureau (CIB) and the Anti-Online Scam Operation Center (ACSC). The probe expanded after a case involving fraud against a retired civil servant: the victim lost more than 1.4 million baht, and later more than 30 victims were identified.

The investigation found that the group’s fund cycling could exceed 100 million baht per month in the preliminary review, and the total damage could be as high as 1 billion baht per month. The criminal group upgraded from the traditional “mule account” model to using the structure of the capital market as a space for parking and transferring funds.

The original report said the suspects used a “Poipet Circumvention” method: people linked to Thai “zombie accounts” were sent across the border to Poipet, Cambodia, for several weeks to undergo face verification and conduct transactions on behalf of real accounts, thereby bypassing the security measures of Thai financial institutions.

The operation led to the arrest of 8 suspects: 7 Thai nationals and 1 Chinese national. Police also executed searches at upscale condominiums in the Hua Hin area and inspected locations used as cover.

In addition, the report said one suspect in the command structure told investigators that the fraud proceeds were transferred through a stock trading app, but no actual securities investment took place. That claim has also drawn public and investor attention.

Webull Response: Fixes Within 1 Week and Stronger KYC and Risk Controls

According to the report, Webull said the company is not connected to the case and emphasized that its KYC system operates in line with regulatory requirements. The company also noted that its registered capital is 1 billion baht and that it is a subsidiary of Webull Corporation; since Webull Corporation is listed on Nasdaq in the United States, it must comply with international regulatory standards.

The company said it urgently repaired and adjusted internal security measures within 1 week after the issue was discovered. The main improvements include: removing the 100% real-time withdrawal system and extending transaction review times; introducing an AI Scoring Model to analyze customer behavior and identify unusual transactions; adding Enhanced Due Diligence (EDD) for high-risk accounts; using a database for screening high-risk and suspicious persons, and subjecting suspicious accounts to stricter global-level review; and conducting retrospective account reviews, which found about 40 to 50 zombie accounts (out of more than 200,000 customers, or no more than 0.03%), with those accounts closed and disabled.

Thai SEC Considers Upgrades: Industry-Wide Anti-Money Laundering and Cyber Defense

The report said the incident has also become an important opportunity for regulators to push for industry-wide reviews and stronger anti-money laundering and cybersecurity measures. The Thai SEC previously disclosed that it will advance a new set of anti-money laundering and cyber defense measures for the securities industry to close potential loopholes in identity verification procedures.

The article mentioned several key directions under consideration: deposits and withdrawals should go through bank accounts that have already passed screening; real-time KYC capabilities should be improved; and penalties should be increased for operators who neglect risk controls and allow funds to be used for illegal purposes.

As a result, the June 11 explanation by Webull management is seen as a key test for Thailand’s capital market regulatory framework: how to balance financial innovation with the prevention of economic crime while responding to increasingly sophisticated digital fraud tactics.