In today’s digital age, cyberattacks have become a real threat to organizations worldwide. These attacks can range from phishing and malware to ransomware and distributed denial of service (DDoS) attacks. As the frequency and sophistication of these attacks increase, so does the importance of cybersecurity compliance. In the corporate world, compliance refers to the process of ensuring that a company and its employees adhere to all relevant laws, regulations, standards, and ethical practices—but it should not stop there. Compliance should also encompass asset recovery and disciplinary measures, which can both help organizations address incidents effectively and promote good governance. Cyberattacks are malicious attempts to access or damage a computer system or network, often carried out for financial gain, for political activism, or simply to cause disruption. For instance, a successful attack might involve an attacker creating an email address that closely resembles a legitimate one, perhaps by changing only one or two characters. That email address is then inserted into an existing conversation thread, making it appear as if the user with this email address was already part of the discussion. This tactic can easily deceive a recipient into believing the email was sent from a trusted source, thereby leading them to click on malicious links, provide sensitive information, or even make payments in accordance with the attacker’s request or instructions. Phishing attacks like these are particularly dangerous and can have a serious impact on the ongoing business of a corporation because they exploit the trust and familiarity established in the original email chain. Effective Mitigation Approaches Mechanisms for addressing the aftermath of a crisis provide important recourse to affected organizations, but effective compliance mechanisms can minimize the risk of such crises ever occurring. Companies should therefore prioritize preventative measures and implementation of effective crisis management schemes. Various legal

Thailand’s Ministry of Finance has issued a royal decree placing the business of hire purchase and leasing of cars and motorcycles under the scope of the Financial Institution Business Act B.E. 2551 (2008), effective December 2, 2025. This is to ensure appropriate regulatory oversight of these business activities, as they function similarly to credit granting and serve as a source of funding for the public with a broad impact on the overall economic system and consumers at large. The business operators that this royal decree applies to include corporate entities engaging regularly in the business of hire purchase or leasing of cars or motorcycles, currently excluding: Financial institutions and specialized financial institutions. Individuals operating such businesses (noncorporate entities). Cooperatives. Key regulatory obligations of this royal decree include the following: Business operators must disclose interest rates, service fees, and other relevant business information to the public and report to the Bank of Thailand (BOT). Business operators must display how the annual percentage rate (APR), including all annual charges covering interest and service fees, is calculated. Business operators must maintain accurate accounting records in accordance with recognized accounting standards. The BOT may issue warnings or suspend operations if business operators fail to comply with this royal decree or act unfairly in a way that may result in serious harm to customers. Directors, managers, and responsible persons of any business operator that violates this royal decree may also be subject to the prescribed penalties. Before the royal decree takes effect, business operators should conduct internal assessments and engage with counsel to prepare for regulatory implementation. The BOT is expected to issue further subordinate regulations and guidance regarding: Interest, service fees, deposits, collateral, benefits, and penalties that may be charged by business operators. Contract content, methods of benefit calculation, and format in conducting

Thailand’s tax dispute resolution framework has undergone a significant transformation with the enactment of the Act Establishing the Tax Court and the Procedure for Tax Cases (No. 3) B.E. 2568. Published in the Government Gazette on May 27, 2025, the amended act will come into force on November 24, 2025, which is 180 days after its publication. The amended act marks a pivotal shift in the jurisdiction and procedures of the Tax Court, most notably by empowering it to adjudicate certain criminal tax cases for the first time. Background and Rationale The Tax Court was originally established in 1985 as a specialized forum to handle complex tax disputes, including those related to revenue, customs, and excise taxes. The creation of the Tax Court recognized the need for judicial expertise in tax law, given its technical and specialized nature. The latest amendment is designed to address procedural inefficiencies, modernize court processes, and align Thailand’s tax litigation system with international standards. The reform demonstrates Thailand’s commitment to enhancing the efficiency, transparency, and fairness of its tax dispute resolution mechanisms. Key Amendments and Provisions Six of the key changes in the amendment are highlighted below. Expansion of jurisdiction to criminal tax cases. The most significant change is the extension of the Tax Court’s jurisdiction to include criminal offenses under the Revenue Code, customs law, excise tax law, and other tax-related laws that may be specified by royal decree. New sections in the act explicitly grant the Tax Court authority to hear and decide criminal tax cases, so individuals and entities accused of criminal tax evasion or other tax-related crimes will now have their cases heard by judges with specialized tax expertise. The law also clarifies the Tax Court’s jurisdiction when a single act constitutes multiple offenses (some tax-related, some not) or when

As from July 1, 2025, as part of its ongoing efforts to digitalize and streamline the delivery of public services, the Vietnamese government will officially conduct administrative procedures, both online and offline, only via electronic identity (“e-ID”) accounts on the VNeID platform. In particular: Online administrative procedures carried out via the National Public Service Portal or via information systems for administrative procedures at the ministerial or provincial level are required to be implemented by using e-ID accounts only. When receiving dossiers, authorities will be required to check and verify the e-IDs of companies or individuals responsible for conducting administrative procedures. Further, it is worth noting that to complete the registration of an e-ID account for a company, the legal representative of the company must hold a level-2 e-ID account. Compliance Considerations Vietnam’s first regulation of e-ID accounts for individuals and organizations was issued in Decree No. 59/2022/ND-CP dated September 5, 2022, on electronic authentication and identification. This decree was subsequently replaced by Decree No. 69/2024/ND-CP dated June 25, 2024, which governs the same matters. Registration and operation of e-ID accounts are centralized through VNeID, a digital ID app developed by the National Population Data Center under the Ministry of Public Security of Vietnam. Although the registration of e-ID accounts for companies is not explicitly mandated by law, the absence of an e-ID account may hinder companies from completing administrative procedures, including licensing and reporting obligations. Such non-compliance could consequently result in administrative penalties. To mitigate unexpected non-compliance and administrative fines due to the lack of an e-ID account, companies should be well prepared for and implement the registration of a company e-ID account as soon as possible.