You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

March 2, 2021

Decree on Consumer Protection in the Financial Sector in Laos

Informed Counsel

Background

On May 8, 2020, the Lao Ministry of Justice published the Decree on Consumer Protection regarding Financial Services No. 225/GOV, dated April 6, 2020, in its online Official Gazette. The decree was drafted by the Bank of the Lao PDR (BOL), which is the central bank in Laos. In addition to supplementing the country’s guidelines on commercial banks’ obligations to their customers, the new decree bolsters the country’s consumer protection regulatory regime under its primary relevant piece of legislation, the Law on Consumer Protection No. 02/NA, dated June 30, 2010.

Scope of Application

The decree was drafted to elaborate on Article 57 of the Law on Commercial Banks No. 56/NA, dated December 7, 2018, which requires commercial banks to devise clear procedures for receiving and resolving consumer complaints. Besides its application to commercial banks as defined by the law, the decree also applies to a wide range of service providers, including microfinance institutions (deposit-taking or otherwise), deposit and savings cooperatives, leasing companies, pawnshops, and providers proposing other types of financial services under the supervision of the BOL (referred to collectively as “service providers”). Likewise, the decree addresses a spectrum of financial services, including:

  • Monetary deposits and issuance of deposit certificates;
  • Provision of credit;
  • Card services;
  • Hire-purchase and leasing;
  • Mortgages;
  • Payment services;
  • Buying and selling currencies; and,
  • Other services authorized by the BOL, which covers all types of banking services in Laos.

Fee Restrictions and Disclosure Requirements for Financial Services

The decree requires service providers to set a written policy determining the appropriateness of the selected product, official fee, service fee, representation fee, interests rate, and other fees, in accordance with the relevant law and regulations (if any), and to document the justification for the price of each product.

Service providers are also required to advise consumers on financial services through supporting documents and materials. Though the decree provides specific requirements for different types of financial services, it notes that all service providers must provide consumers with information on the following:

  • Fees or service fees, representation fees (if any), interest and other fees—to be summarized in the relevant section of the material;
  • Impact of a change of interest rate, exchange rate, or other factors that affect the price, remuneration, or other conditions relating to the financial service;
  • The expected return of the product;
  • Duration of the contract and payment plan;
  • Conditions for termination of contracts with consumers if the consumers cannot fulfill their obligations;
  • Risks to the financial service;
  • Other similar products (if any); and,
  • How the consumer’s confidential information will be kept private.

The supporting documents and materials, which must be written primarily in the Lao language, are to use terms that are easily understood and should be in an easily readable font size and color (especially the section on the consumer’s rights and obligations under the contract). Moreover, financial service advertisements should not mislead consumers. For instance, service providers cannot claim that they guarantee a return on investment for financial services that are deemed risky.

Consumer Data Maintenance and Other Requirements for Service Providers

The decree is also attentive to the manipulation of personal information, financial information, and card passwords. Service providers must not disclose the information of consumers, and if any information is leaked, the service provider must inform the relevant consumer and document the leak. If the leak affects a large number of consumers, the service provider must also report the situation to the BOL.

The decree also requires service providers to:

  • Provide the financial services without discrimination concerning nationality, ethnicity, gender, or religion;
  • Explain the financial services;
  • When applicable, propose options that may be most appropriate for the selected consumer, so that the consumer can make an informed decision (e.g., by discussing the pros and cons of selected financial services);
  • Not retain information that may harm the consumer for the benefit of the service provider;
  • Provide services based on the disclosed or advertised information of the selected product, and not charge undisclosed fees;
  • Provide consumers with all necessary documents, such as the unsigned draft contract, the original copy of the contract after being signed, and any accompanying documentation, and specify when the consumer has the right to terminate the contract; and,
  • Set a reasonable time for the consumer to review a contract before signing or to cancel the contract (in which case the service provider may charge the consumer for the actual expenses incurred).

The decree also requires service providers to assist non-literate or visually impaired consumers, either by explaining or reading the relevant contract and other relevant documents before their signing, or by having the consumers’ respective representatives sign the contract on their behalf.

Contracts for Financial Services

All contracts related to financial services must include the following information:

  • Names and addresses of the contracting parties;
  • Terms and conditions of using the financial service;
  • Rights and obligations of the consumer;
  • Fees, service charges, and penalties (if any);
  • Information on the confidentiality of the consumer’s information;
  • Dispute resolution requirements;
  • Rights, conditions, and methods for terminating the contract; and
  • Consequences of terminating the contract.

The required content may also differ according to the type of financial service. For example, card services contracts must include information on withdrawal fees, using the card in Laos and internationally, and the credit granted and minimum monthly repayments, while contracts to provide credit must include interest rates and consequences of default.

Dispute Resolution and Penalties

In setting up a new unit or hiring an employee, service providers are required to set up communication channels to receive comments from and propose solutions to consumers’ feedback. The decree permits the service providers to administer these channels in writing, verbally, or electronically.

Upon establishing these communication channels, service providers must indicate the contact details of the unit or employee, and the relevant consumer protection department of the BOL, in every contract of services proposed. Service providers must also explain contact details and processes to the public by clearly displaying this information in their offices, branches, units, or websites.

The decree requires service providers to pay special attention to consumer complaints by recording them and, upon receiving the complete information of the source of the complaints, resolving them promptly. If the service provider cannot propose a solution to the relevant consumer immediately and requires further information on the corresponding issue, they must provide updates to the consumer every 15 days.

If the service provider’s solution is not satisfactory, the service provider and customer may then refer the dispute to the BOL (including cases involving multiple consumers). If the parties still cannot reach an agreement, the decree stipulates that they may then consult the Economic Dispute Resolution Center (a domestic arbitration center), the Lao People’s Courts, or both.

The decree provides only a broad outline of the penalties that may be triggered if its provisions are violated. It indicates that the particular sanctions will depend on the violation and may include disciplinary measures and civil compensation, but a sliding scale of the proposed fines is not given. As a result, the sanctions under the current decree may be difficult to implement, though future regulations may elaborate further.

Conclusion

By addressing financial services and their providers in Laos, this decree is an innovative regulation that is notable for its dedication to filling out the country’s consumer protection regulatory regime, as well as its transparent counsel and recommendations for service providers and their consumers. In particular, its obligations imposed on service providers, and its elaboration of the expected content of contracts for financial services, are significant steps. By clarifying the requirements of the contracts, the decree conveys its recognition of the surge of financial leasing services, which have become common for the purchase of various goods, such as cars, throughout the country in recent years, but which many had considered somewhat unregulated to date.

Overall, although the relevant sanctions have yet to be to clarified, this decree is another positive signal that the Lao authorities are expanding consumer protection in Laos after their publication earlier this year of other consumer protection-related decisions (including on the establishment of consumer protection associations, and consumer protection considerations for telecommunications and internet service providers). Moreover, the decree fulfills, in large part, its objective to elaborate on parts of the Law on Consumer Protection and the Law on Commercial Banks. Consequently, although the decree is not exhaustive, it has clearly made a positive contribution to Laos’ efforts to enhance the relationship between consumers, service providers, and financial services, both domestically and internationally.

RELATED INSIGHTS​ 

November 24, 2025
A recent warning from the Central Bank of Myanmar (CBM) against cryptocurrency use upholds the country’s ongoing strategy of enforcing strict prohibitions on unauthorized cryptocurrency activities while also promoting the controlled development of a central bank digital currency (CBDC). The CBM’s warning, issued November 16, 2025, reminded the public of announcements in May 2019 and a notification in May 2020 confirming that all online and offline cryptocurrency transactions are strictly prohibited. The CBM also clarified that no financial institution in Myanmar is authorized to deal with digital currencies. The warning highlighted global risks, such as money laundering, scams, tax evasion, hacking, and severe financial losses caused by price volatility and insufficient regulation. The CBM urged the public to use only legitimate banking channels and avoid illegal cryptocurrency activities. The warning comes five months after the CBM issued a notification announcing the formation of the Central Committee for the Issuance of a Central Bank Digital Currency. This committee includes senior CBM officials, representatives from relevant ministries and the banking sector, and technology experts. Its main role is to research CBDC models, test secure digital payment systems, and ensure that any future implementation aligns with Myanmar’s monetary policy and financial stability objectives. Taken together, these two actions illustrate the CBM’s continued pursuit of its dual strategy to promote innovation through CBDC development while prohibiting cryptocurrency use. Businesses should note that while CBDC pilot programs may appear in the future, cryptocurrencies remain off-limits.
September 24, 2025
On September 12, 2025, the Bank of Thailand (BOT) officially released its AI Risk Management Guidelines for Financial Service Providers, building upon the draft guidelines issued in June 2025. The guidelines reflect a balanced approach, encouraging innovation while safeguarding financial stability and consumer protection. The guidelines are targeted at all financial service providers, including financial institutions and special financial institutions under the Financial Institution Business Act, as well as payment providers under the Payment Systems Act. The guidelines apply to both AI systems developed in-house and those developed by third parties that are adopted for use by financial service providers. AI Risk Management Guidelines The two main pillars in managing AI risk are (1) governance of AI system implementation and (2) AI system development and security controls, consisting of the following key elements: 1. Governance Stakeholder roles and responsibilities. Boards and senior management assume accountability for decisions and operations involving AI systems, and are responsible for defining roles and responsibilities for AI oversight. This includes establishing an AI system usage policy, designating personnel responsible for AI risk management, and building awareness of AI-related risk within the organization. Organizations are expected to foster internal capabilities to use AI securely and avoid overreliance that could compromise business continuity or customer service. AI system usage policy. Policies governing AI usage should align with organizational goals, regulatory obligations, and recognized responsible AI frameworks—such as the FEAT principles (fairness, ethics, accountability, and transparency). These policies should be reviewed regularly to respond to technological advancements and evolving risk profiles. Risk management throughout the AI lifecycle. Risk management should encompass the entire AI lifecycle, from establishing risk appetite to implementing continuous risk assessment and control measures tailored to specific use cases. Financial service providers should assess risks and impacts of AI usage on operations and customer services.
September 12, 2025
On September 10, 2025, Vietnam’s National Credit Information Center (CIC) reported to the Vietnam Cybersecurity Emergency Response Team (VNCERT) a suspected significant cybersecurity incident involving unauthorized access to the CIC’s credit information database. A hacker group has claimed responsibility and allegedly posted over 160 million records for sale, including sensitive personal and financial data. Implications for Banks and Financial Institutions Companies that share customers’ or potential customers’ personal data with the CIC for credit scoring or other purposes—and continue to act as a data controller for such data—may be obligated under Vietnam’s Personal Data Protection Decree (PDPD) and related regulations to: Notify A05 (Department of Cybersecurity and High-Tech Crime Prevention) and the State Bank of Vietnam without delay. Inform affected individuals if their personal data is at risk. Recommended Actions Companies that could be impacted by this data breach should take the following actions: Conduct an internal review of CIC-related data in their systems, and identify whether and how the systems have been affected by this incident. Assess whether to notify regulators and customers/potential customers. Enhance cybersecurity controls, monitor for suspicious activity, and implement additional safeguards to prevent secondary breaches.
August 25, 2025
To implement the recently issued Resolution on International Financial Centers in Vietnam (“IFC Resolution”), which is set to take effect on September 1, 2025 (see our previous article), the government of Vietnam is making every effort to formulate and issue guiding decrees—up to eight in total—before the effective date of the resolution. These decrees will establish key principles, define the rights and obligations of stakeholders, and outline permissible business activities within the IFCs, and serve as a foundation for the legal framework of the IFCs. Below are highlights of two draft decrees that have been released for public consultation. Draft Decree on IFC Establishment Ho Chi Minh City: The IFC in Ho Chi Minh City will focus on capital markets integrated with asset management services, fund management, insurance, financial products and financial derivatives; banking systems and money market products; fintech and financial innovation through sandbox mechanisms; specialized exchanges and new trading platforms; commodity markets, commodity and commodity derivatives exchanges linked to domestic and international physical commodity markets; and regional supply chain services, logistics hubs, maritime transport, and seaport infrastructure. Da Nang: The IFC in Da Nang will mainly develop green finance and commercial finance for SMEs and innovative enterprises, non-resident organizations and individuals (i.e., offshore financial services); cross-border trade activities linked to free trade zones, high-tech zones, new economic zones, and industrial zones; pilot control mechanisms for emerging models, such as digital assets, cryptocurrencies, and digital payments and transfers; new exchanges and trading platforms; investment funds, remittance funds, and small and medium fund management companies; startups in financial solutions for consumer services, tourism, e-commerce, logistics, and services within free trade zones; and related support, advisory, development, and legal services. Incentives: The People’s Committees of Ho Chi Minh City and Da Nang will need to decide on their list of