You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

September 3, 2019

Cryptocurrency Regulations in Mainland Southeast Asia

Informed Counsel

Introduction

The rapid global proliferation of cryptocurrencies—digital currencies using advanced cryptography (typically blockchain) to verify and secure transactions and maintain supply—has seen governments scrambling to regulate what some see as an opportunity and others see as a threat. The digital nature of cryptocurrencies has meant that investors faced with new regulations can quickly seek new jurisdictions to act as a safe harbor for their assets, while developing countries that have a varied history with fiat currency have responded to this high-risk capital inflow in a number of different ways.

In this article, we compare the cryptocurrency regulations (or lack thereof) in mainland Southeast Asia—an area of increasing interest to investors following restrictive policies in China, India, and elsewhere.

Country Overviews

Cambodia – Jay Cohen, Partner and Director, Cambodia

While there is no clear regulatory scheme in Cambodia for cryptocurrencies and cryptocurrency-related activities, a joint statement on cryptocurrencies was released on May 11, 2018, by the National Bank of Cambodia (NBC), the Securities and Exchange Commission of Cambodia (SECC), and the General-Commissariat of the National Police. The release of this statement likely indicates that these ministries would be involved in the regulation of cryptocurrencies in the future, should Cambodia choose to regulate them.  

The statement makes it clear that unlicensed operations related to cryptocurrencies (e.g., propagation, buying, selling, trading, and settlement) are illegal. To date, however, neither the NBC nor the SECC have given guidance on how to apply for such a license. This could indicate that a licensing scheme for cryptocurrencies is being considered, but overall the NBC and SECC have shown reluctance to adopt cryptocurrencies in recent public statements.   

The statement also indicates that those who participate in cryptocurrency-related activities without obtaining a license from competent authorities would be subject to penalties in accordance with applicable laws. However, it is unclear what laws apply in this case, so the scope of punishments could range greatly in severity.

Laos – Dino Santaniello, Head, Laos

There is also no regulatory framework yet in place in Laos, but the Bank of the Lao P.D.R. (BOL) has issued two notifications and a warning regarding cryptocurrency.   

The first, Notification No. 314/BOL, dated August 29, 2018, encourages the Lao population to be more knowledgeable about cryptocurrency. To combat questionable or potentially misleading advertisements on social media and elsewhere promoting the use of cryptocurrencies, the BOL warned that cryptocurrency is not money and cannot be used to pay debts, while expressly identifying that there are no attendant regulations in Laos. The notification also explains the risks, lack of transparency, and potential negative ramifications of using cryptocurrencies for payment.

The BOL again addressed cryptocurrencies in Notification No. 382/BOL, dated October 30, 2018, which prohibits financial institutions in Laos from engaging in cryptocurrency-related activities or helping their clients to participate in various activities. However, no penalties for violating these prohibitions were clearly indicated. The positions of both notifications were subsequently reiterated in a BOL warning.

Some have interpreted this response as the BOL waiting to learn more about cryptocurrency before deciding upon its approach—merely urging caution rather than taking steps toward providing a clear legal framework. However, although cryptocurrency has not been declared illegal per se, the BOL’s position lays the groundwork for a potentially negative response.

Myanmar – Ross Taylor, Counsel   

In Myanmar, the only official statement on cryptocurrencies has been an announcement issued by the Central Bank of Myanmar (CBM) on May 3, 2019, which affirms that the CBM is the sole legal issuer and manager of domestic currency; that the CBM does not recognize any cryptocurrency as legal tender in Myanmar; and that the CBM has not given approval to any financial institutions to buy, sell, or exchange cryptocurrencies. Any financial institutions (bank and non-bank) that do not abide by the announcement’s provisions may face a variety of administrative sanctions up to and including the revocation of licenses under the Financial Institutions Law (2016), and consumers who buy, sell, or exchange cryptocurrencies do so at their own risk.   

Some other regulations are also pertinent here. For example, if buying and selling cryptocurrencies were used to avoid the foreign exchange regime, the party doing so could arguably be prosecuted for conducting a foreign exchange business without a license under the Foreign Exchange Management Law (2012). Similarly, if any such activity was deemed to involve money laundering, the act could be punishable by up to 10 years’ imprisonment. As for tax obligations, any profits made from cryptocurrency trading would be taxable in Myanmar as income upon examination by a tax officer.

Thailand – Praew Annez, Consultant       

Thailand leads the way as the only country in mainland Southeast Asia to have a regulatory regime for cryptocurrency. The Securities and Exchange Commission (SEC) supervises cryptocurrency-related activities, which are regulated by the 2018 Emergency Decree on Digital Asset Businesses (the “ICO Decree”). This regulates the offering and dealing of “digital assets,” including cryptocurrencies and digital tokens.    

The ICO Decree also sets requirements for ICO portals and digital asset businesses. An ICO portal is defined as an electronic system provider with the offering of newly issued digital tokens, while digital asset businesses include digital asset exchanges, digital asset brokers, and digital asset dealers. Under the ICO Decree, issuers of digital tokens must register with the SEC and obtain the appropriate approvals. This process includes the submission of a draft prospectus to the SEC.    

Additional requirements are set for issuers offering digital tokens to the public. When applying for approval, issuers must submit a registration statement and a draft prospectus, and must issue tokens according to the categories specified under the SEC approval.   

The ICO Decree sets a comprehensive structure of offenses subject to criminal sanctions and civil sanctions, which could include civil penalties, financial damages, prohibitions of involvement in cryptocurrency-related activities, and reimbursement of expenses incurred in investigating the offense.

Capital gains from the sale of digital assets are subject to income tax. For VAT purposes, digital assets are regarded as “goods,” which are subject to 7% VAT.

Vietnam  – Thao Thu Bui, Trainee Lawyer

In Vietnam, cryptocurrencies are commonly referred to as “virtual assets.” There are no legal definitions, and a regulatory framework is still lacking. However, cryptocurrencies are strictly prohibited from use as payment instruments in Vietnam.

On August 21, 2017, the prime minister issued Decision 1255 directing the Ministry of Justice, the State Bank, the Ministry of Finance, and the Ministry of Public Security to prepare reports explaining the legal status of “virtual assets” and “virtual currencies” and to recommend the amendment or issuance of relevant legislation. Almost two years later, the reports have either not yet been completed or have not been announced publicly. This delay may indicate that the government has not been able to adopt a clear stand on how to regulate cryptocurrencies in Vietnam.

In the meantime, the prime minister issued Directive 101 on April 11, 2018, after a series of cryptocurrency-related fraudulent activities. This directive ordered:

  1. the State Bank to direct credit institutions and intermediate payment providers not to carry out transactions associated with “virtual currencies”;
  2. the Ministry of Finance to direct securities firms not to engage in issuance, brokerage, and trading of “virtual currencies”; and
  3. the Ministry of Public Security to intensify its investigations into acts of mobilizing funds, multi-level marketing, and fraud in relation to “virtual currencies.”

Following this directive, the State Bank and the State Securities Commission issued warnings to lower-level banks, securities firms, and public companies not to engage in cryptocurrency-related transactions.   

Issuance, provision, or use of illegal payment instruments is subject to an administrative fine of up to VND 400 million (approx. USD 17,094) or imprisonment for 6 to 36 months.

Summary   

Although cryptocurrency regulations remain scant across mainland Southeast Asia, a quick comparison of the provisions that are in place shows that the region is not a uniformly welcoming environment for them either. Indeed, the only jurisdiction with a clear regulatory framework—Thailand—is the most expressly hospitable, with other countries issuing tentative warnings and cautionary prohibitions, rather than full regulatory frameworks.

RELATED INSIGHTS​ 

January 13, 2026
On January 9, 2026, Thailand’s Securities and Exchange Commission (SEC) filed a criminal complaint with the Economic Crime Suppression Division (ECD) against five individuals for unauthorized operation of a digital-asset dealer business under the Emergency Decree on Digital Asset Businesses B.E. 2561 (2018). This precedent-setting case signals that the regulator is willing to pursue crypto enforcement against natural persons even in the absence of a licensed platform entity. Background and Implications The case follows the SEC’s October 2025 public warning about the use of iris-scanning technology in exchange for certain digital tokens. In its warning, the SEC cautioned that exchanging or trading these specific tokens with unlicensed service providers exposes users to heightened fraud, scam, and money laundering risks. Unlike prior regulatory enforcement matters, which involved platform-level administrative fines for operational or compliance failures, this case targets misconduct by individuals who may not be professional traders but openly advertised their willingness to buy these tokens from the public, opened individual over-the-counter (OTC) trade channels for these tokens, and facilitated off-exchange transactions in a manner resembling ordinary commercial dealing. This enforcement action establishes a clear precedent that natural persons engaging in public-facing digital-asset dealing may face criminal liability under Thai law, even without operating through a corporate or licensed platform structure. Outlook The alleged offenders may not settle this crime by payment of fines. Following the SEC’s referral, the ECD will undertake further investigation, after which prosecutors may review the case and proceed to court. The SEC has stated that it will cooperate fully with enforcement agencies throughout the criminal enforcement process.
January 9, 2026
Vietnam has taken a decisive step into the global artificial intelligence regulatory landscape with the promulgation of the Law on Artificial Intelligence No. 134/2025/QH15 (AI Law), adopted on December 10, 2025, and effective from March 1, 2026. As one of the earliest comprehensive, standalone AI statutes in Southeast Asia, the AI Law signals Vietnam’s ambition to position itself as both an innovation-friendly and governance-conscious AI market. In doing so, the legislature has also streamlined Vietnam’s AI regulatory architecture. The AI Law repeals most AI-related provisions previously embedded in the Law on Digital Technology Industry No. 71/2025/QH15, consolidating AI governance under a single, unified legal framework. This structural move underscores an intent to provide greater regulatory clarity and coherence for businesses operating across the AI value chain. Against this backdrop, the key question for AI developers, providers, deployers, and governance teams is how the new risk-based framework will shape compliance expectations, operational decisions, and governance design in practice. This article examines the new AI Law through that practical lens, focusing on what it means for AI businesses operating in or into Vietnam. Scope of Application The AI Law applies broadly to Vietnamese organizations and individuals, as well as foreign entities that participate in AI-related activities within Vietnam. The law expressly excludes AI activities conducted solely for national defense, security, and cryptography purposes. A defining feature of the AI Law is that it regulates by role, not by industry. It distinguishes between: Developers, who design, build, train, test, or fine-tune AI models and have direct control over the technical methods, training data, or model parameters; Providers, who place AI systems on the market or put them into use under their own names; Deployers, who use AI systems under their control in professional, commercial, or service-provision activities; Users, who interact with AI
January 9, 2026
Thailand continues to advance its legal and regulatory framework for the technology sector, with several key laws undergoing review and proposed amendments. These developments reflect Thailand’s broader efforts to ensure that its regulatory landscape keeps pace with rapid technological change and aligns more closely with international standards and best practices. The following are key legal developments and proposed legislative reforms in 2026 that are expected to impact businesses operating in the technology sector and the broader Thai business landscape. Data Privacy and Cybersecurity Personal Data Protection Act B.E. 2562 (2019) Following the full enforcement of Thailand’s Personal Data Protection Act (PDPA) in June 2022, businesses and practitioners have identified practical implementation challenges and interpretative issues. These challenges were reflected in an effectiveness assessment conducted by the Personal Data Protection Committee (PDPC) in late 2024. The PDPC published a set of principles for public consultation to identify issues and directions for potential amendments to the PDPA. Key issues: Emerging issues include clarifying the definitions of “data controller,” “data processor,” and “criminal record”; revisiting the scope of sensitive personal data to better reflect Thailand’s context; proposing amendments to the hierarchy of legal bases to avoid misconceptions of consent as the default legal basis; and clarifying the required level of expressiveness for explicit consent, as well as rules for collecting personal data from other sources. Current status: The first round of public consultation has concluded. Next steps: The proposed amendments are proceeding to a revised draft following the consultation outcomes. Cybersecurity Act B.E. 2562 (2019) Thailand is moving forward with proposed amendments to enhance the effectiveness of its national cybersecurity framework, as evolving digital technologies bring new risks such as misinformation, system intrusions, and attacks on critical infrastructure, making cybersecurity a national priority. Key issues: The amendments aim to clarify and strengthen
January 8, 2026
Thailand’s Digital Government Development Agency (DGA) has proposed new standards that would require government agencies to select cloud services exclusively from a preapproved shortlist of providers. The draft Digital Government Standards re: Cloud Service Provider Standards aims to strengthen procurement confidence and reduce risks associated with selecting cloud service providers that do not meet the required standards. A public hearing period on these standards concluded on December 27, 2025. The DGA will now review submitted comments and consider revising the standards accordingly. Shortlisted Cloud Service Provider Tiers The draft standards establish three tiers of cloud service providers based on their assessed service capability levels, core qualifications, and certifications. The DGA sets qualification requirements for each tier, and it is at the discretion of each agency to select the tier of cloud service provider that best suits its operational needs, as follows: Tier 1 cloud service providers are suitable for providing services involving disclosable official data. Tier 2 cloud service providers are suitable for handling official data and protected data, such as personal data, which requires a high-security public cloud (e.g., virtual private cloud). Tier 3 cloud service providers are suitable for providing services to agencies with specific regulatory and security requirements that handle highly protected data, such as the national security system. These providers must offer sovereign or hybrid cloud as stipulated by the Ministry of Digital Economy and Society. All tiers of cloud service providers must be legal entities incorporated under Thai law and can be authorized distributors of offshore cloud service providers. However, each tier will be subject to different requirements, including infrastructure obligations. Government agencies are encouraged to select a cloud service provider appropriate for their intended use. For example, if a government agency intends to procure cloud services for operating applications that process personal data,