Vietnam’s Decree No. 72/2013/ND-CP, as amended by Decree 27/2018/ND-CP (referred to collectively as “Decree 72”) regulates internet services and online information, and plays a crucial role in governing significant services such as social networks, online games, and aggregated information websites, as well as key matters like domain names and online information security. Given the rapid pace of development in these areas, Decree 72—having been in effect for nearly a decade—is in need of an update. The Ministry of Information and Communications (MIC) had initially intended to draft an amendment to Decree 72 in 2021. However, the magnitude of required changes made it impractical to retain the form of an amending decree, leading the MIC to shift its focus toward replacing Decree 72 entirely. As a result, a new draft decree to replace Decree 72 (the “Draft Decree”) was released by the MIC for public consultation from July 17 to September 15, 2023. The Draft Decree is comprehensive, with six chapters, 87 articles, and an appendix of 56 forms. The following are some of the main issues covered by the new Draft Decree. 1. Social Network Services Classification and licensing/notification Social network services include onshore and offshore social network services. Onshore social network services refer to those provided by organizations or enterprises with legal status in Vietnam, and are divided into “high-visitor” or “low-visitor” categories based on number of regular visitors. The high-visitor category includes social networks with total visits of 10,000 or more per month for six consecutive months or with more than 1,000 regular members in a month. High-visitor onshore social network service providers must obtain a license to provide social network services. Low-visitor onshore social network service providers only need to notify the MIC’s Authority of Broadcasting and Electronic Information (ABEI) and receive the ABEI’s written notification

Myanmar’s Ministry of Commerce (MOC) issued three notifications related to e-commerce on July 21, 2023, classifying online retail businesses as essential services, requiring them to register with the relevant authorities, and setting the criteria for their registration. Under Notification No. 49/2023 the MOC authorized the Department of Trade (DOT) to issue notifications, orders, and directives relating to online retail businesses. This was followed by Notification No. 50/2023, which classifies online retail businesses as essential services under the Essential Supplies and Services Law and requires them to register with the DOT within six months of the issuance of the notification (i.e., by January 21, 2024). Failure to register within the specified period will be punishable by imprisonment for six months to three years and a fine of up to MMK 500,000 (approx. USD 238). Finally, under Notification No. 51/2023, the MOC set out the criteria and requirements for the registration of online retail businesses by entities, business institutions, and individuals, as well as the duties and liabilities of sellers and consumers. Pursuant to this notification, registration should be completed via the DOT’s online system, fees must be paid digitally, and electronic registration certificates will be issued. Certificates are initially valid for two years, and can be renewed. The MOC will provide information at a later time on the prescribed forms, certificate format, registration and online fees, and online registration portal. In applying for registration, an entity or business institution established under the Myanmar Companies Law, Special Company Act, Co-operative Society Law, or any other existing Myanmar laws must have a website with its own domain name or an online channel with an exact address that is used for online sales and a registered business address within Myanmar. Individual applicants must be at least 18 years old, reside in Myanmar, and

Thailand’s Electronic Transactions Development Agency (ETDA) held a briefing session on July 20, 2023, laying out the changes and new requirements in draft sublaws under the Royal Decree on Digital Platform Services. These sublaws are expected to be announced in August 2023. The key changes and new requirements are listed below. The ETDA has drafted guidelines on the methods for identifying active users to give digital platform service operators a better understanding of the calculation methods. The definition of “users” for calculating annual monthly active users (AMAUs) has been reduced in scope to cover only users in Thailand. E-marketplace digital platform services that will suspend or terminate operations for specific users must inform the affected users and provide a period for them to challenge the suspension or termination. Digital platform service operators cannot use the requirements to identify their active users as a legal basis for processing users’ personal data, especially for profiling and tracking activities. The sublaws on announcement of terms and conditions (T&Cs) and changes to T&Cs, once issued, will take effect on January 3, 2024, while the other sublaws will take effect immediately (i.e., August 21, 2023). This shows that the ETDA has acknowledged the private sector’s feedback that the requirements on T&Cs will take more time for operators to comply with. The requirements for changing T&Cs have been adjusted. Under the current draft, the required advance notification period can be exempted if a change in the T&Cs is for the purpose of, for example, rolling out new products or services and improving the platform. Required submissions under the Royal Decree for Digital Platform Services and its sublaws will be made through the ETDA’s online portal. There will likely be no extensions granted for compliance with the Royal Decree for Digital Platform Services and its sublaws

The Bank of Thailand (BOT) has issued new notifications amending regulations for payment businesses that fall under the Payment Systems Act B.E. 2560 (2017) to promote transparency and good governance in the payment industry. Notification No. SorKorChor 2/2566 (“Notification 2”) increases the required qualifications for applicants seeking a license to provide payment services designated as being under the BOT’s supervision, and Notification No. SorKorChor 4/2566 (“Notification 4”) stipulates additional duties and exemptions for certain types of business operators. The notifications were published in the Government Gazette on July 7, 2023, and came into effect the following day. Additional Qualifications Notification 2 expands the list of prohibited characteristics for business operators applying for a license or registration to engage in a designated payment service, and their directors. For example, applicants must not have been ordered to suspend or cease their operations, and their registration or license to engage in financial business or operate a designated payment system or service must not have been revoked. The notification defines “financial business” as including financial institutions, credit card business, personal loan business, securities business, and so on. In addition, applicants’ directors and management must not have prohibited characteristics, such as being involved in the management of a financial business or designated payment system or service that was ordered to suspend or cease its operations. The applicable registration or license also must not have been revoked. Reporting Requirements During the application process, Notification 2 requires applicants to disclose information on shareholders and related parties (including spouses) who hold an aggregate 10 percent or more of the total paid-up shares. Notification 4 imposes this same reporting duty regarding shareholders and related parties but applies it to licensed operators in an ongoing manner. Existing payment service operators must make their first report of this information to