09 · 10 · 26·8 MIN READ

Building a Custom AI Trade Platform in Thailand: A Practical Guide

A custom AI Trade platform lets traders work with an AI assistant on their own accounts — and the design that holds up in Thailand keeps the account owner in control: the AI drafts, the owner approves, and official broker APIs execute. TecTony offers custom builds of these platforms for brokers, prop firms, trading academies and trading communities, on the same consent-first design that runs in TradeTwin, our own AI Trade product.

Published and sources checked: 9 October 2026. This guide is a product and engineering framework, not legal, investment or financial advice.

What an AI Trade platform is — and what it is not

An AI Trade platform is An AI Trade platform is not
Software that helps a trader apply their own method faster A fund, a pooled account or a managed portfolio
An AI that drafts plans from the trader's own rules and knowledge A signal service or a promise of returns
A connector to the trader's own broker or exchange account A broker, an exchange or a custodian of client money
A record of who approved what, and when A black box that trades without the owner's yes

The right-hand column is where regulatory risk starts. Thai law licenses activities such as investment advice, brokerage, dealing and fund management, and the Securities and Exchange Commission (SEC) supervises the licensed firms — its AI/ML governance guidelines name investment advisers and robo-advisory providers among them (Tilleke & Gibbins on the Thai SEC's AI/ML governance guidelines, April 2026). A platform that stays in the left-hand column is more likely to be treated as a software business, but where the line falls depends on the business model; one that drifts to the right needs a licence — and counsel — before it launches.

Who builds one, and why

  • Brokers and prop firms that want an AI assistant inside their own branded app, rather than sending clients to a generic chatbot.
  • Trading academies and communities whose members already have a method and want help applying it consistently.
  • Fintech teams that need the product layer — accounts, consent, AI and connectors — without rebuilding the plumbing.

The five building blocks

1. Identity and account ownership

Every trading account belongs to exactly one owner. Passwordless sign-in (an emailed code plus passkeys) removes the weakest link, and ownership is re-checked before anything sensitive happens.

2. The strategy twin

The trader's method becomes structured knowledge: rules, notes, worked examples, even recorded explanations transcribed into searchable text. Retrieval-augmented generation (RAG) lets the AI answer from that knowledge instead of from general internet opinion.

3. The AI layer

Let users bring their own API key from a choice of AI providers, or offer hosted AI. The platform should add no market view of its own: the output comes from the provider and from the user's instructions, inside the platform's safety boundaries.

4. Consent and execution

This is the heart of the design. Each AI proposal is stored as a versioned draft with a hash of its exact content. The owner approves that version — not "the bot" in general — and any new draft needs a new approval. Position-size and risk caps are enforced in code, never only in a prompt. This mirrors human-in-the-loop, one of the controls the SEC's AI guidelines recommend for high-risk uses, where the AI only recommends and nothing happens without a person (Tilleke & Gibbins on the Thai SEC's AI/ML governance guidelines, April 2026). Add a kill switch the owner can use to stop everything at once.

5. Connectors through official APIs

Use each venue's official API and its approval process. cTrader's Open API, for example, requires the application to be registered and approved by Spotware (cTrader Open API: creating and approving an application), and each trading account is then authorised through OAuth 2.0 (cTrader Open API: account authentication). Crypto exchanges issue API keys with separate permissions — Bitkub, for example, separates trade, deposit and withdraw rights (Bitkub official API documentation) — so grant only what a feature needs, never withdrawal, and restrict keys to known IP addresses where the exchange supports it. Store keys encrypted, with rotation and access logging (OWASP Secrets Management Cheat Sheet). Start every connector read-only — market data and balances first, orders later.

Design for Thai regulation from day one

These are the boundaries we build into every platform:

  1. No pooled money. Funds stay in the user's own account at the venue; the platform never holds client money.
  2. No promises. No guaranteed returns, win rates or profit screenshots — in the product or in its marketing.
  3. No advice. The platform does not recommend what to buy or sell. The AI applies the user's own method, and a clear notice says so on every public page.
  4. Owner consent for every action, recorded with time, plan version and account.
  5. Education stays separate. If you also sell courses or run a community, keep them as separate services with their own terms.

Enforcement is real: on 20 February 2026 the SEC filed a criminal complaint against a licensed digital-asset broker, its overseas trading platform and their executives, treating the arrangement as the joint operation of an unlicensed exchange (Tilleke & Gibbins on the SEC's February 2026 cross-border enforcement). A 2025 amendment to the digital-asset emergency decree also reaches offshore operators that serve people in Thailand, with Thai-language content among the tests (DFDL on the 2025 digital-asset decree amendment). Distribution has gatekeepers too: Apple expects trading and investing apps to be submitted by the licensed financial institution (Apple App Store Review Guidelines), and LINE's MINI App policy excludes investment-related consulting services (LINE MINI App Policy, revised 19 February 2026). Confirm your business model with a Thai lawyer experienced in securities and digital-asset law before launch — especially if you charge by performance, touch client funds or offer derivatives.

Guardrails for the AI itself

Large language models can be confidently wrong, and text from outside — a web page, a document, a chat message — can try to give them instructions (prompt injection) (OWASP LLM01: Prompt Injection). So:

  • The AI can draft, but never approve or execute — OWASP's guidance on excessive agency is to require a human to approve high-impact actions (OWASP LLM06: Excessive Agency).
  • Tools exposed to outside AI agents, for example through an MCP server, are draft-only and scoped to the owner.
  • Every proposal, approval and order is logged and auditable.
  • New strategies start on demo or paper accounts, then go live with capped position sizes.

A typical delivery path

  1. Assessment — business model, target venues and regulatory boundaries, with your counsel.
  2. Read-only pilot — accounts, the strategy twin, AI chat and read-only market data.
  3. Consent engine — versioned proposals, approvals, caps and an audit log, on demo accounts only.
  4. Live connectors — one venue at a time, each after its own application approval.
  5. Launch and discovery — a bilingual site, a help assistant with RAG, SEO and AEO.

Scope and timeline are agreed after the assessment. We do not quote a fixed timeline before seeing your venues and your model.

How TradeTwin applies the design

TradeTwin (tradetwin.me) is TecTony's own AI Trade product, in early access:

  • private AI twins, each with its own knowledge, rules, AI key and account;
  • consent bound to an exact plan version, so every new draft needs a new yes;
  • a cTrader Open API connector with each account checked first, plus read-only market and account data from Kraken, Binance TH and Bitkub;
  • audio files as knowledge, with Thai speech transcription;
  • an owner-only MCP server that can draft proposals but never accept a plan or place an order.

TradeTwin does not lead trades, raise investment money, trade for hire or give investment advice. See the TradeTwin product page for details, or contact TecTony to scope your own platform.

Frequently asked questions

Q1: Is an AI trading assistant legal in Thailand?
A1: Software that helps people apply their own method on their own accounts is different from licensed activities such as investment advice, brokerage or fund management. Where a platform sits depends on its business model, so confirm it with a Thai lawyer experienced in securities and digital-asset law before launch.

Q2: Can the AI place trades automatically?
A2: We design platforms so the AI drafts and the account owner approves each exact plan version before anything executes, with size and risk caps enforced in code.

Q3: Which brokers and exchanges can a platform connect to?
A3: Venues with official APIs and an approval process, such as cTrader's Open API, and exchange APIs that support restricted keys. Each connection starts read-only and depends on the venue's own approval.

Q4: Can TecTony build a platform like TradeTwin under my brand?
A4: Yes. We build your platform under your brand on the same consent-first design. Scope, venues and timeline are agreed after an assessment.

Q5: Does an AI Trade platform guarantee better results?
A5: No. No platform can guarantee trading results. The value is speed, consistency and a clear record of every decision — not a promised return.

Chat on LINE@tectony