The Bank of Thailand (BOT) is seeking public feedback on a proposed overhaul of the regulatory framework for licensed money changers authorized by the finance minister, under the Exchange Control Act, to buy and sell foreign banknotes separately from commercial banks and specialized financial institutions. The BOT published the draft principles on August 19, 2026, for public consultation, with comments accepted through September 18, 2026. If adopted in its current form, the new framework would substantially raise licensing standards, require existing licensees to undergo a review and upgrade process, temporarily freeze new applications in 2027, and reduce application intake rounds from 2028 onward, with significant implications for both existing operators and prospective new entrants. The overhaul initiative stems from the BOT’s recognition of a need to prevent the use of licensed money changers as channels for financial crime. The stated objectives are to build public confidence, ensure the safety of financial service users, and align the supervisory framework with the current risk profile of the business and evolving market conditions. Upgraded Licensing Standards The BOT intends to significantly revise the licensing framework, including requirements relating to registered capital, branch management, operational standards, and customer transaction limits. Detailed criteria have not yet been released and are expected to be subject to further consultation. All existing licensees will be required to upgrade to meet the new standards and submit evidence of compliance for BOT review on a case-by-case basis. Existing licensees that are unable to satisfy the upgraded requirements may face regulatory consequences, subject to the final framework and BOT review process. Freeze and Reopening The BOT will temporarily stop accepting new license applications throughout 2027 to focus resources on inspecting and upgrading existing money changers. Any party wishing to obtain a new money changer license must submit its application by

Franchising in Thailand has matured into a sizeable commercial sector, but the rules governing franchisor–franchisee relationships remain scattered across general legislation rather than consolidated in a dedicated franchise statute. In this environment, the decisions of the Trade Competition Commission of Thailand (TCCT) have emerged as valuable practical guidance. Thailand follows a civil-law system in which judicial and administrative decisions do not create binding precedent; however, past rulings are nonetheless influential. This article examines the most instructive recent TCCT decisions and distills the practical compliance considerations for franchisors and franchisees operating in Thailand. Postcontract Changes: Justified or Unfair? A recurring issue is whether a franchisor may alter the terms of engagement after contract execution. The TCCT has established that midterm modifications are not inherently unfair; the determinative factors are whether there was a reasonable business justification, adequate advance notice, and a transparent process. In a 2023 coffee franchise matter, for instance, the TCCT declined to find a violation where a franchisor increased raw material prices, noting the increase had been communicated in advance and supported by demonstrable cost pressures. A bubble tea franchise matter reinforces this principle. The TCCT found that postcontract mandatory purchases of branded syrup and flavorings were justified, as the agreement reserved the franchisor’s right to modify product requirements, the materials were sold at or below market prices, and the branded ingredients possessed distinctive qualities deemed essential to franchise quality. The complaint was dismissed, with the additional requirements characterized as a legitimate measure to preserve brand consistency. Considered together, these decisions indicate that post‑contract modifications will be evaluated against three criteria: (1) whether there is a legitimate business rationale, (2) whether adequate advance notice was provided, and (3) whether franchisees were treated equitably throughout the transition. Discriminatory Treatment: Are Renewals and Information Equal? A 2024 automotive dealership

Vietnam has enacted a new decree establishing administrative penalties for violations in the fields of cybersecurity and personal data protection. Decree No. 330/2026/NĐ-CP (Decree 330), issued and effective from August 19, 2026, provides a detailed sanctions framework for noncompliance with the Law on Personal Data Protection (including its implementing regulations under Decree 356/2025/ND-CP) and the Law on Cybersecurity, together with their guiding decrees. The issuance of Decree 330 signals that the practical grace period previously perceived by many businesses may be drawing to a close, with active regulatory enforcement in these areas expected to commence in earnest. Scope and Key Provisions Decree 330 has extraterritorial effect and applies to both onshore and offshore companies. For offshore companies, it applies to those that (1) provide telecommunications, internet, online-content, information-technology, cybersecurity, or cross-border services and (2) are involved in or related to the processing of personal data of Vietnamese citizens and certain other people of Vietnamese origin. Decree 330’s key provisions cover the following areas: Administrative penalties for violations relating to the protection of national security and public order in cyberspace, including the dissemination of unlawful, false, or unverified information. Sanctions for cyberattacks, unauthorized access, introduction of harmful code or programs, and failure to cooperate with specialized cybersecurity forces. Sanctions for personal data protection violations, such as consent, cross-border data transfers, impact assessments, breach notification, and data-subject rights, among others—with maximum fines of up to 5% of an organization’s preceding-year revenue for cross-border transfer violations, or up to VND 3 billion for other data-protection breaches. Personal Data Protection Penalties The key sanctions for personal data protection violations are as follows: Consent violations: Fines of up to VND 70 million (approx. USD 2,642), plus potential additional sanctions and remedial measures including irreversible deletion of personal data collected without consent and confiscation of

Thailand’s Electronic Transactions Development Agency (ETDA) is studying potential new regulatory measures for digital platform services that could significantly expand the country’s digital platform governance framework. The ETDA has already conducted one public consultation session on the proposed measures and will hold additional sessions on August 25 and September 2, 2026, covering five types of platform services under the Royal Decree on Digital Platform Services B.E. 2565 (2022). The measures under study are preliminary and may be changed based on consultation outcomes. Foundational Measures Applicable to All Platform Types Seven baseline obligations would apply across all digital platform categories: Transparency reports. Platforms must prepare and publish statistical reports on platform governance activities, including the number of content items removed or restricted and appeal outcomes, in a comparable format. Notice and action mechanism. Platforms must establish minimum standards for channels to report potentially illegal content or goods, conduct case-by-case review, provide explanations when content is removed or restricted, and maintain an internal appeals channel. Rights over automated decision-making. Users significantly affected by automated decisions are granted rights to request an explanation, request human review, and contest the decision. Service level agreements (SLAs). Platforms must publish minimum standards for response times, processing timelines, progress notifications, and remedies for incidents on the platform. Labeling of AI-generated content. Content generated or modified by AI must carry visible labels and machine-readable metadata, with exceptions for creative works that disclose AI use in a nonmisleading manner. Prohibition of dark patterns. User interface designs that deceive, coerce, or distort user decision-making are prohibited, including hiding critical information, creating false urgency, or making service cancellation unreasonably difficult. Business user fairness. Platforms must meet minimum standards for the treatment of sellers, workers, and content creators, including advance notice of term changes, explanation of account suspensions or visibility reductions,