You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

September 3, 2019

Cryptocurrency Regulations in Mainland Southeast Asia

Informed Counsel

Introduction

The rapid global proliferation of cryptocurrencies—digital currencies using advanced cryptography (typically blockchain) to verify and secure transactions and maintain supply—has seen governments scrambling to regulate what some see as an opportunity and others see as a threat. The digital nature of cryptocurrencies has meant that investors faced with new regulations can quickly seek new jurisdictions to act as a safe harbor for their assets, while developing countries that have a varied history with fiat currency have responded to this high-risk capital inflow in a number of different ways.

In this article, we compare the cryptocurrency regulations (or lack thereof) in mainland Southeast Asia—an area of increasing interest to investors following restrictive policies in China, India, and elsewhere.

Country Overviews

Cambodia – Jay Cohen, Partner and Director, Cambodia

While there is no clear regulatory scheme in Cambodia for cryptocurrencies and cryptocurrency-related activities, a joint statement on cryptocurrencies was released on May 11, 2018, by the National Bank of Cambodia (NBC), the Securities and Exchange Commission of Cambodia (SECC), and the General-Commissariat of the National Police. The release of this statement likely indicates that these ministries would be involved in the regulation of cryptocurrencies in the future, should Cambodia choose to regulate them.  

The statement makes it clear that unlicensed operations related to cryptocurrencies (e.g., propagation, buying, selling, trading, and settlement) are illegal. To date, however, neither the NBC nor the SECC have given guidance on how to apply for such a license. This could indicate that a licensing scheme for cryptocurrencies is being considered, but overall the NBC and SECC have shown reluctance to adopt cryptocurrencies in recent public statements.   

The statement also indicates that those who participate in cryptocurrency-related activities without obtaining a license from competent authorities would be subject to penalties in accordance with applicable laws. However, it is unclear what laws apply in this case, so the scope of punishments could range greatly in severity.

Laos – Dino Santaniello, Head, Laos

There is also no regulatory framework yet in place in Laos, but the Bank of the Lao P.D.R. (BOL) has issued two notifications and a warning regarding cryptocurrency.   

The first, Notification No. 314/BOL, dated August 29, 2018, encourages the Lao population to be more knowledgeable about cryptocurrency. To combat questionable or potentially misleading advertisements on social media and elsewhere promoting the use of cryptocurrencies, the BOL warned that cryptocurrency is not money and cannot be used to pay debts, while expressly identifying that there are no attendant regulations in Laos. The notification also explains the risks, lack of transparency, and potential negative ramifications of using cryptocurrencies for payment.

The BOL again addressed cryptocurrencies in Notification No. 382/BOL, dated October 30, 2018, which prohibits financial institutions in Laos from engaging in cryptocurrency-related activities or helping their clients to participate in various activities. However, no penalties for violating these prohibitions were clearly indicated. The positions of both notifications were subsequently reiterated in a BOL warning.

Some have interpreted this response as the BOL waiting to learn more about cryptocurrency before deciding upon its approach—merely urging caution rather than taking steps toward providing a clear legal framework. However, although cryptocurrency has not been declared illegal per se, the BOL’s position lays the groundwork for a potentially negative response.

Myanmar – Ross Taylor, Counsel   

In Myanmar, the only official statement on cryptocurrencies has been an announcement issued by the Central Bank of Myanmar (CBM) on May 3, 2019, which affirms that the CBM is the sole legal issuer and manager of domestic currency; that the CBM does not recognize any cryptocurrency as legal tender in Myanmar; and that the CBM has not given approval to any financial institutions to buy, sell, or exchange cryptocurrencies. Any financial institutions (bank and non-bank) that do not abide by the announcement’s provisions may face a variety of administrative sanctions up to and including the revocation of licenses under the Financial Institutions Law (2016), and consumers who buy, sell, or exchange cryptocurrencies do so at their own risk.   

Some other regulations are also pertinent here. For example, if buying and selling cryptocurrencies were used to avoid the foreign exchange regime, the party doing so could arguably be prosecuted for conducting a foreign exchange business without a license under the Foreign Exchange Management Law (2012). Similarly, if any such activity was deemed to involve money laundering, the act could be punishable by up to 10 years’ imprisonment. As for tax obligations, any profits made from cryptocurrency trading would be taxable in Myanmar as income upon examination by a tax officer.

Thailand – Praew Annez, Consultant       

Thailand leads the way as the only country in mainland Southeast Asia to have a regulatory regime for cryptocurrency. The Securities and Exchange Commission (SEC) supervises cryptocurrency-related activities, which are regulated by the 2018 Emergency Decree on Digital Asset Businesses (the “ICO Decree”). This regulates the offering and dealing of “digital assets,” including cryptocurrencies and digital tokens.    

The ICO Decree also sets requirements for ICO portals and digital asset businesses. An ICO portal is defined as an electronic system provider with the offering of newly issued digital tokens, while digital asset businesses include digital asset exchanges, digital asset brokers, and digital asset dealers. Under the ICO Decree, issuers of digital tokens must register with the SEC and obtain the appropriate approvals. This process includes the submission of a draft prospectus to the SEC.    

Additional requirements are set for issuers offering digital tokens to the public. When applying for approval, issuers must submit a registration statement and a draft prospectus, and must issue tokens according to the categories specified under the SEC approval.   

The ICO Decree sets a comprehensive structure of offenses subject to criminal sanctions and civil sanctions, which could include civil penalties, financial damages, prohibitions of involvement in cryptocurrency-related activities, and reimbursement of expenses incurred in investigating the offense.

Capital gains from the sale of digital assets are subject to income tax. For VAT purposes, digital assets are regarded as “goods,” which are subject to 7% VAT.

Vietnam  – Thao Thu Bui, Trainee Lawyer

In Vietnam, cryptocurrencies are commonly referred to as “virtual assets.” There are no legal definitions, and a regulatory framework is still lacking. However, cryptocurrencies are strictly prohibited from use as payment instruments in Vietnam.

On August 21, 2017, the prime minister issued Decision 1255 directing the Ministry of Justice, the State Bank, the Ministry of Finance, and the Ministry of Public Security to prepare reports explaining the legal status of “virtual assets” and “virtual currencies” and to recommend the amendment or issuance of relevant legislation. Almost two years later, the reports have either not yet been completed or have not been announced publicly. This delay may indicate that the government has not been able to adopt a clear stand on how to regulate cryptocurrencies in Vietnam.

In the meantime, the prime minister issued Directive 101 on April 11, 2018, after a series of cryptocurrency-related fraudulent activities. This directive ordered:

  1. the State Bank to direct credit institutions and intermediate payment providers not to carry out transactions associated with “virtual currencies”;
  2. the Ministry of Finance to direct securities firms not to engage in issuance, brokerage, and trading of “virtual currencies”; and
  3. the Ministry of Public Security to intensify its investigations into acts of mobilizing funds, multi-level marketing, and fraud in relation to “virtual currencies.”

Following this directive, the State Bank and the State Securities Commission issued warnings to lower-level banks, securities firms, and public companies not to engage in cryptocurrency-related transactions.   

Issuance, provision, or use of illegal payment instruments is subject to an administrative fine of up to VND 400 million (approx. USD 17,094) or imprisonment for 6 to 36 months.

Summary   

Although cryptocurrency regulations remain scant across mainland Southeast Asia, a quick comparison of the provisions that are in place shows that the region is not a uniformly welcoming environment for them either. Indeed, the only jurisdiction with a clear regulatory framework—Thailand—is the most expressly hospitable, with other countries issuing tentative warnings and cautionary prohibitions, rather than full regulatory frameworks.

RELATED INSIGHTS​ 

August 21, 2025
On August 18, 2025, Thailand’s Securities and Exchange Commission (SEC), in collaboration with the Ministry of Finance, the Anti-Money Laundering Office, and the Ministry of Tourism and Sports, announced the launch of TouristDigiPay. The initiative, implemented under the SEC’s Regulatory Sandbox, allows foreign tourists to convert digital assets into Thai baht for use in everyday transactions in Thailand. Foreign tourists who opt to participate in TouristDigiPay must open two accounts once they are in Thailand: An account with a licensed digital asset operator to sell or exchange digital assets for Thai baht; and A tourist wallet account with a licensed e-money operator regulated by the Bank of Thailand. Funds from digital asset sales will be transferred into the tourist wallet, enabling tourists to make payments at participating merchants that accept e-money. Key Regulatory Requirements The TouristDigiPay project will operate for a period of up to 18 months, with the following conditions: Only licensed digital asset brokers, dealers, and exchanges integrated with licensed e-money operators are eligible to participate. Operators must implement anti-money laundering (AML) protocols that are proportionate to the assessed risk level. These include: Conducting know-your-customer and customer-due-diligence (KYC/CDD) checks on all users. For monthly transactions exceeding THB 50,000 per person, verifying the source of the digital assets and assessing AML risk using internationally recognized blockchain forensic tools or equivalent procedures. Suspending or rejecting services if digital assets are transferred from wallets flagged for AML concerns. Ensuring that conversion between digital assets and fiat includes safeguards such as matching account names and returning digital assets only to the original wallet. The following transaction limits apply to participants in the TouristDigiPay initiative: Payments to small vendors are capped at THB 50,000 per month. Payments to vendors who have completed the know-your-merchant (KYM) process are capped at THB 500,000 per
August 15, 2025
More than a decade after the issuance of Decree No. 52/2013/ND-CP (as amended by Decree No. 85/2021/ND-CP; collectively, “Decree 52”), Vietnam’s legal framework for e-commerce is under growing pressure to keep pace with the evolving digital economy. While Decree 52 has provided a foundational framework, it has shown certain limitations in keeping up with issues such as counterfeit goods, intellectual property enforcement, unqualified products, and emerging models like livestream selling and affiliate marketing. To address these regulatory gaps, the Ministry of Industry and Trade (MOIT) has released the 2025 Draft E-Commerce Law (“Draft Law”) for public consultation. The Draft Law is intended to supersede the current framework under Decree 52 and establish a more detailed and comprehensive legal foundation for the regulations of e-commerce activities in Vietnam. It is currently expected to be submitted to the National Assembly for review and potential adoption during its 10th session in October 2025. In this article, we discuss the Draft Law’s most significant updates and legal developments in comparison to existing regulations, and assess the practical challenges that businesses may face in preparing for implementation in the near future. Platform Classification: Toward a More Nuanced Framework Unlike Decree 52’s simpler structure, which broadly categorized platforms into either (i) websites selling goods and services or (ii) websites providing e-commerce services, the Draft Law introduces a more detailed framework that aims to classify platforms based on their technical functions and business models. Specifically, the Draft Law introduces a four-tier classification system for e-commerce platforms, consisting of: (i) Direct Business Platforms, (ii) Intermediary Platforms, (iii) Social Networks with E-Commerce Functions, and (iv) Multi-Service Integrated Platforms. This approach reflects an effort to more accurately capture the complexity of today’s e-commerce landscape, including hybrid platforms such as TikTok Shop. While this approach reflects the growing complexity of
August 6, 2025
Thailand’s Digital Government Development Agency (DGA) has released drafts of two pivotal documents to guide Thai government agencies in adopting cloud technology and classifying data for cloud usage. These draft guidelines, open for public hearing through August 12, 2025, are part of the national “Go Cloud First” policy, which aims to accelerate digital transformation, improve efficiency, and ensure robust data security across the public sector. The new standards will have significant implications for both government agencies and cloud service providers operating in Thailand. Highlights of the draft guidelines are presented below. Government Cloud Usage Guidelines Cloud-first transformation: All government agencies are directed to prioritize cloud solutions for new IT projects, in line with the cabinet’s “Go Cloud First” policy. Cloud model selection: Agencies must assess their needs and select the most appropriate cloud deployment model—public, private, hybrid, or community cloud—based on the sensitivity of the data and operational requirements. Service types: The guidelines provide criteria for choosing between Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS), emphasizing the importance of using standard, non-customized services where possible. Cost management: Agencies are required to plan and separate cloud-related expenses, ensuring transparency and efficient budget allocation. Cloud migration: The guidelines outline the steps for migrating to the cloud and highlight the role of cloud service providers in facilitating the process, including supporting innovation and enabling smooth exit strategies. Procurement compliance: All cloud procurement must comply with public sector procurement laws and regulations. Only providers meeting government-mandated standards can be selected. Security and shared responsibility: The guidelines clarify the division of security responsibilities between cloud providers and government agencies. While providers manage infrastructure security, agencies remain responsible for data, application, and access controls. Legal framework: Agencies must comply with the Digital Government Administration Act, Cybersecurity
August 1, 2025
Thailand’s Personal Data Protection Committee (PDPC) announced to the press on August 1, 2025, that it had issued eight new administrative fines under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) in five cases of noncompliance by public and private entities. The enforcement actions reflect a growing commitment by the PDPC to penalize noncompliance across all sectors, regardless of organizational type or size. The total amount imposed to date was approximately THB 21.5 million (approx. USD 654,690), underscoring the financial risks tied to PDPA violations. The five cases—one involving a state agency and the remainder in the private sector—are summarized below. Case 1: State Agency Providing Online Services to the Public The order in this case stemmed from a cyberattack on a state agency’s web app, resulting in personal data of 200,000 data subjects being leaked to and sold on the dark web. The software developer was also found to have implemented no privacy by design, lacked an access control system, had no data breach prevention measures, and failed to conduct risk assessments or review existing security measures. Key noncompliance identified: Lack of appropriate security measures Weak password protection No risk assessment or ongoing review of security measures No data processing agreement with software developer that acted as data processor The state agency and the developer were each fined THB 153,120 (approx. USD 4,670). Case 2: Private Hospital This case involved a hospital that engaged an individual contractor to destroy patient medical record documents. However, the contractor stored the documents at their own premises, failed to follow the required destruction protocols, and ultimately used the medical records to wrap sweets, resulting in the leak of over 1,000 records during the destruction process. The contractor also failed to notify the hospital of the data breach. Although there was a