You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

September 3, 2019

Cryptocurrency Regulations in Mainland Southeast Asia

Informed Counsel

Introduction

The rapid global proliferation of cryptocurrencies—digital currencies using advanced cryptography (typically blockchain) to verify and secure transactions and maintain supply—has seen governments scrambling to regulate what some see as an opportunity and others see as a threat. The digital nature of cryptocurrencies has meant that investors faced with new regulations can quickly seek new jurisdictions to act as a safe harbor for their assets, while developing countries that have a varied history with fiat currency have responded to this high-risk capital inflow in a number of different ways.

In this article, we compare the cryptocurrency regulations (or lack thereof) in mainland Southeast Asia—an area of increasing interest to investors following restrictive policies in China, India, and elsewhere.

Country Overviews

Cambodia – Jay Cohen, Partner and Director, Cambodia

While there is no clear regulatory scheme in Cambodia for cryptocurrencies and cryptocurrency-related activities, a joint statement on cryptocurrencies was released on May 11, 2018, by the National Bank of Cambodia (NBC), the Securities and Exchange Commission of Cambodia (SECC), and the General-Commissariat of the National Police. The release of this statement likely indicates that these ministries would be involved in the regulation of cryptocurrencies in the future, should Cambodia choose to regulate them.  

The statement makes it clear that unlicensed operations related to cryptocurrencies (e.g., propagation, buying, selling, trading, and settlement) are illegal. To date, however, neither the NBC nor the SECC have given guidance on how to apply for such a license. This could indicate that a licensing scheme for cryptocurrencies is being considered, but overall the NBC and SECC have shown reluctance to adopt cryptocurrencies in recent public statements.   

The statement also indicates that those who participate in cryptocurrency-related activities without obtaining a license from competent authorities would be subject to penalties in accordance with applicable laws. However, it is unclear what laws apply in this case, so the scope of punishments could range greatly in severity.

Laos – Dino Santaniello, Head, Laos

There is also no regulatory framework yet in place in Laos, but the Bank of the Lao P.D.R. (BOL) has issued two notifications and a warning regarding cryptocurrency.   

The first, Notification No. 314/BOL, dated August 29, 2018, encourages the Lao population to be more knowledgeable about cryptocurrency. To combat questionable or potentially misleading advertisements on social media and elsewhere promoting the use of cryptocurrencies, the BOL warned that cryptocurrency is not money and cannot be used to pay debts, while expressly identifying that there are no attendant regulations in Laos. The notification also explains the risks, lack of transparency, and potential negative ramifications of using cryptocurrencies for payment.

The BOL again addressed cryptocurrencies in Notification No. 382/BOL, dated October 30, 2018, which prohibits financial institutions in Laos from engaging in cryptocurrency-related activities or helping their clients to participate in various activities. However, no penalties for violating these prohibitions were clearly indicated. The positions of both notifications were subsequently reiterated in a BOL warning.

Some have interpreted this response as the BOL waiting to learn more about cryptocurrency before deciding upon its approach—merely urging caution rather than taking steps toward providing a clear legal framework. However, although cryptocurrency has not been declared illegal per se, the BOL’s position lays the groundwork for a potentially negative response.

Myanmar – Ross Taylor, Counsel   

In Myanmar, the only official statement on cryptocurrencies has been an announcement issued by the Central Bank of Myanmar (CBM) on May 3, 2019, which affirms that the CBM is the sole legal issuer and manager of domestic currency; that the CBM does not recognize any cryptocurrency as legal tender in Myanmar; and that the CBM has not given approval to any financial institutions to buy, sell, or exchange cryptocurrencies. Any financial institutions (bank and non-bank) that do not abide by the announcement’s provisions may face a variety of administrative sanctions up to and including the revocation of licenses under the Financial Institutions Law (2016), and consumers who buy, sell, or exchange cryptocurrencies do so at their own risk.   

Some other regulations are also pertinent here. For example, if buying and selling cryptocurrencies were used to avoid the foreign exchange regime, the party doing so could arguably be prosecuted for conducting a foreign exchange business without a license under the Foreign Exchange Management Law (2012). Similarly, if any such activity was deemed to involve money laundering, the act could be punishable by up to 10 years’ imprisonment. As for tax obligations, any profits made from cryptocurrency trading would be taxable in Myanmar as income upon examination by a tax officer.

Thailand – Praew Annez, Consultant       

Thailand leads the way as the only country in mainland Southeast Asia to have a regulatory regime for cryptocurrency. The Securities and Exchange Commission (SEC) supervises cryptocurrency-related activities, which are regulated by the 2018 Emergency Decree on Digital Asset Businesses (the “ICO Decree”). This regulates the offering and dealing of “digital assets,” including cryptocurrencies and digital tokens.    

The ICO Decree also sets requirements for ICO portals and digital asset businesses. An ICO portal is defined as an electronic system provider with the offering of newly issued digital tokens, while digital asset businesses include digital asset exchanges, digital asset brokers, and digital asset dealers. Under the ICO Decree, issuers of digital tokens must register with the SEC and obtain the appropriate approvals. This process includes the submission of a draft prospectus to the SEC.    

Additional requirements are set for issuers offering digital tokens to the public. When applying for approval, issuers must submit a registration statement and a draft prospectus, and must issue tokens according to the categories specified under the SEC approval.   

The ICO Decree sets a comprehensive structure of offenses subject to criminal sanctions and civil sanctions, which could include civil penalties, financial damages, prohibitions of involvement in cryptocurrency-related activities, and reimbursement of expenses incurred in investigating the offense.

Capital gains from the sale of digital assets are subject to income tax. For VAT purposes, digital assets are regarded as “goods,” which are subject to 7% VAT.

Vietnam  – Thao Thu Bui, Trainee Lawyer

In Vietnam, cryptocurrencies are commonly referred to as “virtual assets.” There are no legal definitions, and a regulatory framework is still lacking. However, cryptocurrencies are strictly prohibited from use as payment instruments in Vietnam.

On August 21, 2017, the prime minister issued Decision 1255 directing the Ministry of Justice, the State Bank, the Ministry of Finance, and the Ministry of Public Security to prepare reports explaining the legal status of “virtual assets” and “virtual currencies” and to recommend the amendment or issuance of relevant legislation. Almost two years later, the reports have either not yet been completed or have not been announced publicly. This delay may indicate that the government has not been able to adopt a clear stand on how to regulate cryptocurrencies in Vietnam.

In the meantime, the prime minister issued Directive 101 on April 11, 2018, after a series of cryptocurrency-related fraudulent activities. This directive ordered:

  1. the State Bank to direct credit institutions and intermediate payment providers not to carry out transactions associated with “virtual currencies”;
  2. the Ministry of Finance to direct securities firms not to engage in issuance, brokerage, and trading of “virtual currencies”; and
  3. the Ministry of Public Security to intensify its investigations into acts of mobilizing funds, multi-level marketing, and fraud in relation to “virtual currencies.”

Following this directive, the State Bank and the State Securities Commission issued warnings to lower-level banks, securities firms, and public companies not to engage in cryptocurrency-related transactions.   

Issuance, provision, or use of illegal payment instruments is subject to an administrative fine of up to VND 400 million (approx. USD 17,094) or imprisonment for 6 to 36 months.

Summary   

Although cryptocurrency regulations remain scant across mainland Southeast Asia, a quick comparison of the provisions that are in place shows that the region is not a uniformly welcoming environment for them either. Indeed, the only jurisdiction with a clear regulatory framework—Thailand—is the most expressly hospitable, with other countries issuing tentative warnings and cautionary prohibitions, rather than full regulatory frameworks.

RELATED INSIGHTS​ 

November 11, 2024
The Vietnamese government has demonstrated a strong commitment to building a digital government, digital economy, and digital society through its recently issued national strategy on digital infrastructure. Under Decision No. 1132/QD-TTg dated October 19, 2024, on “Digital Infrastructure Strategy to 2025 with Orientation to 2030,” the government will create supportive conditions for both domestic and international businesses to invest in digital infrastructure with cybersecurity as a priority. Recognized as vital to the economy, this digital infrastructure will consist of four main components: (i) telecommunications and internet infrastructure, (ii) data infrastructure, (iii) physical-digital infrastructure, and (iv) digital utility infrastructure, including digital technology as a service. Key goals for 2025 include universal fiber optic access for households, 100% 5G coverage across all provinces and cities, deployment of at least two new international undersea fiber optic cables, establishment of AI data centers, development of green-standard data centers, and platforms for IoT, AI, big data, blockchain, and cybersecurity. By 2030, goals include fiber access with speeds of at least 1 Gbps, 5G coverage for 99% of the population, readiness for 6G trials, six additional international undersea fiber optic cables, development of a hyperscale data center, and positioning Vietnam as a digital hub. To achieve these goals, the government has outlined some core tasks, creating significant opportunities for both foreign and domestic investors: Developing telecommunications and internet infrastructure for widespread fiber optic and 5G access, while preparing for emerging technologies like 6G, Open RAN, satellite, and IpV6. Telecommunication enterprises will jointly invest in and share the use of international fiber optic cable routes to ensure efficient capacity utilization and optimize investment capital. Attracting foreign and domestic investment to establish hyperscale data centers and cloud computing services that meet global standards. Creating physical-digital infrastructure by integrating technology across key sectors such as transportation, energy, healthcare,
November 8, 2024
On October 31, 2024, Thailand’s Office of the Personal Data Protection Committee (PDPC) opened a public consultation period on its draft notifications—one directed at data controllers and another at data processors—regarding exemptions from the requirement to create and maintain records of processing activities (ROPAs) under the Personal Data Protection Act B.E. 2562 (2019) (PDPA). The draft notification for data controllers aims to amend and revoke certain aspects of the first ROPA exemption notification issued in June 2022 and outlines the criteria for data controllers to be exempted from the obligation to prepare and maintain such records. Although it is officially titled “Notification of the Personal Data Protection Committee on Exemption from Record-Keeping Requirements for Small Business Data Controllers,” this draft notification applies to all types of exempted data controllers (see list below), and not only small businesses. The draft notification for data processors is new and does not replace any prior notification. The criteria under both draft notifications exempt certain data controllers and data processors from the obligation to maintain ROPAs, but exempted data controllers are not free from the obligation to retain information on the rejection of data subjects’ requests to exercise certain rights under the PDPA. While these criteria remain consistent with the June 2022 ROPA exemption notification, there are a few key takeaways from the notifications, as detailed below. Types of Exempted Parties The draft notification on data controllers adds condominium and housing estate juristic persons, as well as individuals, to the list of parties eligible for an exemption, while removing internet cafes from the list. The new draft notification for data processors mirrors the corresponding list in the draft notification for data controllers. The complete list of parties eligible for ROPA exemptions under the draft notifications is as follows: SMEs according to the law on
October 8, 2024
On October 1, 2024, the Thai cabinet acknowledged the recommendations proposed by the National Anti-Corruption Commission (NACC) to prevent corruption related to online gambling. The Ministry of Digital Economy and Society (MDES) has been assigned as the lead agency to collaborate with various relevant agencies to reach a consensus on the necessary amendments and updates to laws related to online gambling. In assigning the MDES this role, the cabinet emphasized the importance of the following key items: Establishment of a national committee. The national committee will be chaired by a minister and will comprise relevant agencies, including policymaking bodies, technology agencies, frequency management agencies, law enforcement agencies, and other experts. The committee’s primary responsibility will be to consider amending and updating laws related to online gambling. Urgent action on online gambling. As online gambling has been deemed a serious issue requiring urgent action, joint policies will be developed among relevant agencies such as the Royal Thai Police, the Bank of Thailand, and the Anti-Money Laundering Office to elevate the importance of online gambling issues. Public awareness and law enforcement. Public awareness campaigns are to be conducted to educate the public about the risks and legal consequences of online gambling, and laws against online gambling and related financial crimes are to be strictly enforced. Compliance with the Cybersecurity Act. It is necessary to ensure strict compliance with the Cybersecurity Act B.E. 2562 (2019). At the same time, government data systems are to be moved to cloud computing for enhanced data security. Next Steps The MDES is tasked with summarizing the results of the related discussions, actions taken, and overall opinions and submitting the summary to the cabinet secretariat for further presentation to the cabinet. These measures aim to address and mitigate the risks associated with online gambling and related corruption.
October 8, 2024
Thailand’s Electronic Transactions Development Agency (ETDA) issued guidelines for managing advertisements on digital platform services (DPSs) earlier this year. These guidelines aim to prevent fraud, illegal product or service offerings, and inducements to commit illegal acts, and are likely to provide a basis for greater regulation of this issue in the future. Key obligations for DPS business operators under the guidelines are detailed below. Advertiser Screening and Data Collection Verification and collection: Business operators must establish processes for verifying and collecting advertiser data. This includes steps, methods, and required information for advertiser registration. Identity verification: Business operators should follow identity verification requirements for advertiser registration. This may include using identity verification results from other identity providers or conducting their own identity verification processes with a minimum identity assurance level (IAL) of IAL2. Data storage: Advertiser data must be stored in a machine-readable format. Business operators must maintain records for watchlists, blacklists, and whitelists. Prepublication Advertisement Review Review process: Business operators should review advertisements before publication. This review should consider factors such as prohibited or restricted advertisements, required permissions, and avoiding sensitive user data. Postpublication Monitoring Advertisement monitoring: Business operators must monitor published advertisements using automated systems, staff, or contracted personnel. Criteria for prioritizing reviews should be established. Reporting channels: Business operators must provide channels for users to report illegal or inappropriate advertisements. Reports must be promptly addressed, prioritizing cases involving intellectual property owners or multiple credible reports. Advertiser account monitoring: Business operators must monitor advertiser accounts. This includes considering factors such as the number of reports/flags received and compliance with service agreements and community standards. For more information on this initiative from the ETDA, or on any aspect related to Thailand’s regulations for DPSs, please contact Athistha (Nop) Chitranukroh at [email protected], Thammapas Chanpanich at [email protected], Pornpan Wichawut at [email protected],