On September 10, 2025, Vietnam’s National Credit Information Center (CIC) reported to the Vietnam Cybersecurity Emergency Response Team (VNCERT) a suspected significant cybersecurity incident involving unauthorized access to the CIC’s credit information database. A hacker group has claimed responsibility and allegedly posted over 160 million records for sale, including sensitive personal and financial data. Implications for Banks and Financial Institutions Companies that share customers’ or potential customers’ personal data with the CIC for credit scoring or other purposes—and continue to act as a data controller for such data—may be obligated under Vietnam’s Personal Data Protection Decree (PDPD) and related regulations to: Notify A05 (Department of Cybersecurity and High-Tech Crime Prevention) and the State Bank of Vietnam without delay. Inform affected individuals if their personal data is at risk. Recommended Actions Companies that could be impacted by this data breach should take the following actions: Conduct an internal review of CIC-related data in their systems, and identify whether and how the systems have been affected by this incident. Assess whether to notify regulators and customers/potential customers. Enhance cybersecurity controls, monitor for suspicious activity, and implement additional safeguards to prevent secondary breaches.

Under Thai law, authorized directors stand as a company’s mind and will and, as such, may incur personal criminal liability for acts or omissions committed in the course of company business. When allegations surface, directors must be prepared for the practical reality that, before guilt or innocence is ever adjudicated, they could be deprived of liberty unless bail release is promptly achieved through the competent legal authority. When Bail Can Be Granted Two procedural moments trigger the need to consider bail. The first arises during the investigative phase, when a claim is lodged against a director with the competent law enforcement authorities. Upon receipt of a complaint, the assigned inquiry officer summons the director for questioning, compiles evidence, and ultimately forwards a prosecution or nonprosecution recommendation to the public prosecutor. Although the public prosecutor retains ultimate discretion to indict an accused director, the police or prosecutor may conclude that pretrial detention is necessary and may therefore apply to the court for an order to hold the director in court custody. The second moment occurs after a criminal case is filed directly with the court. This occurs once a court accepts a criminal case filed by a prosecutor against a director or, alternatively, when the court accepts a case filed by an individual for trial. For cases filed by individuals, the plaintiff presents prima facie evidence at the preliminary hearing, and the court will accept the complaint if it finds sufficient grounds, thereby conferring upon the director the status of a criminal defendant. Upon acceptance of the criminal case, the court then has the inherent authority to order custody pending trial unless the defendant secures bail release. Procedural Considerations Experienced litigants typically prepare bail security in advance and submit a bail petition at the earliest possible time. While there are

On September 1, 2025, Myanmar’s Directorate of Investment and Company Administration (DICA) issued Directive No. 106/2025 to remind all companies and organizations registered under the Myanmar Companies Law of their obligation to strictly comply with the DICA registrar’s orders, directives, and procedures. This directive highlights the importance of legal and procedural compliance in corporate filings, governance changes, and operational conduct. It also signals increased scrutiny over documentation submitted during annual returns, share transfers, and director appointments or resignations. Public companies will be subject to closer regulatory attention, and new company registrations will involve vetting of proposed directors to ensure prior compliance with applicable laws. Compliance The directive emphasizes the following points: Companies must ensure full compliance with the Myanmar Companies Law and all directives issued by the registrar. This includes the proper submission of annual returns and adherence to updated requirements for share transfers and changes in directors. Companies and organizations must comply with all applicable laws, rules, directives, and procedures issued by relevant ministries and departments. If any authority takes action due to noncompliance, the registrar may also take appropriate measures. Noncompliance may result in regulatory sanctions, including restrictions on future company participation and vetting under anti–money laundering and counter–terrorism financing protocols. Prospective directors of newly registered companies will be vetted to confirm no prior violations of applicable laws. Entities must respond promptly and accurately to document requests from the registrar, both during initial registration and in subsequent filings. Companies are strongly advised to review their internal compliance frameworks and ensure readiness to meet DICA’s documentation and procedural expectations. In particular, companies must respond promptly and accurately to document requests from the registrar, whether during initial registration or in subsequent filings. For more information on this DICA announcement, or on any aspect of corporate registration, or assistance with

Thailand’s Office of the Consumer Protection Board (OCPB) has initiated a sweeping regulatory review of licensed direct sale and direct marketing businesses in Thailand and is in the process of notifying business operators to submit their annual business report and financial statement to the OCPB as part of their postlicensing obligations. This move marks a significant escalation in the government’s efforts to enforce compliance and transparency in the sector, which has faced growing scrutiny in recent years. Key Regulatory Considerations All businesses holding a direct sales or direct marketing license are required to submit their audited financial statement along with their business operation report to the OCPB within 60 days from the end of their fiscal year (extendable for up to 30 days by request, if necessary). The OCPB is currently conducting license audits as part of its enforcement duties. The office aims to complete audits for at least 90% of the 2,983 registered businesses that have obtained their license since 2022. This includes a review of the business conduct of the license holder. New license applications are also under scrutiny. Applicants are currently being subjected to background checks, and the OCPB has signaled a more rigorous vetting process moving forward. Impact of Noncompliance Failure to comply with these reporting obligations may result in escalating enforcement actions, including: Official notice to rectify noncompliance within a specified timeframe. Revocation of business registration, if the operator fails to respond. Revocation of business registration could result in a five-year prohibition on reapplying for a direct sales or direct marketing license following the revocation. The OCPB has already initiated outreach efforts, including SMS and email notifications, and has hosted seminars to raise awareness of these obligations. These measures are part of a broader initiative to enhance transparency and consumer trust in the sector. Businesses operating in the direct selling and