Following the recent delisting of almost all parts of the hemp plant from Thailand’s list of prohibited narcotics (see here for further details), the Ministry of Public Health has issued a notification allowing hemp to be used in cosmetics. Prior to this development, this use of hemp (whether from natural or synthetic sources) was not allowed, as it fell under the definition of narcotics under the Notification Re: Ingredients Not Allowed for Use in Cosmetics B.E. 2559 (2016). Under the Ministerial Notification Re: Use of Hemp in Cosmetics B.E. 2564 (2021), which was published in the Government Gazette on January 11, 2021, domestic manufacturers are now allowed to produce cosmetics containing hemp seed oil or hemp seed extract, provided the cosmetics do not have a THC level exceeding 0.2% by weight. To register such products with the Thai FDA, applicants must submit a certificate of analysis, safety data sheet, and label for the agency’s evaluation. The timeline for approval of the registration (notification) of a cosmetic containing hemp seed oil or hemp seed extract is three business days. The applicant (i.e., manufacturer or toll manufacturer) must declare the amount of hemp seed extract or hemp seed oil used in the cosmetic in their notification application. Cosmetics must not use a name for the product that evokes an association with hemp flowers or narcotics, and the name of the product must be within the scope of cosmetics. For example, names containing “inflorescence,” “flower,” “CBD,” “THC” or similar will not be allowed. It should also be noted that Thailand does not yet allow the importation of cosmetics containing hemp seeds or hemp seed extract, and this regulation only applies to domestically produced hemp products—a business currently restricted to individuals or companies with Thai nationality. For more details on this development, or on any aspect of hemp and cannabis regulations in Thailand, please contact Tilleke & Gibbins at [email protected]

On November 26, 2020, the Notification of the Ministry of Finance Re: Addition to Other Business Relating to Digital Assets B.E. 2563 (2020) (the Digital Asset Business Notification) and the Notification of the Ministry of Finance Re: Licensing of Digital Asset Business No. 2 B.E. 2563 (2020) (the Digital Asset Business Licensing Notification) were published in the Thai Government Gazette. Additional Digital Asset Businesses The new Digital Assets Business Notification adds two new categories of digital assets business to the list prescribed in the Royal Decree on Digital Asset Businesses B.E. 2561 (2018). Digital Asset Fund Manager is defined as a person who manages funds from digital assets for another person for benefits, or holds themselves out to the general public as being ready to do so, in the ordinary course of business. It does not include the management of digital assets as prescribed by the Securities and Exchange Commission (SEC). Digital Asset Advisory Service is defined as a person who provides consultations to other people, directly or indirectly, regarding the value of digital assets; the suitability of investment in digital assets; or the buying, selling, or exchanging of any digital assets in the ordinary course of business in return for service fees or other compensation. However, this does not include consultations as a part of or relating to a digital asset exchange, digital asset broker, digital asset dealer, digital asset fund manager, or other personal consultation as prescribed by the SEC. Additional Digital Asset Licensing Requirements The Digital Asset Business Licensing Notification amends the definition of “License Applicant” to include cryptocurrency exchanges, digital token exchanges, cryptocurrency brokers, digital token brokers, cryptocurrency dealers, digital token dealers, cryptocurrency fund managers, digital token fund managers, cryptocurrency advisory services, and digital token advisory services. Additional requirements for granting licenses have also been added in the new Digital Asset Business Licensing Notification, including: the licensee must never have been denied a license or had a license revoked in the last six months from the date of the application submission; the licensee’s application must not be a replacement of a previous application that has been withdraw by the licensee; and, the licensee must not currently be under any legal proceedings for any violation of law. The digital assets business must commence within 180 days after receiving licensing approval. Digital Asset Fund Managers and Digital Asset Advisory Services already in operation are required to apply for a license from the SEC within 90 days after this Digital Asset Business Licensing Notification comes into force (i.e. by February 25, 2021). Once an application has been filed with the SEC, the applicant is allowed to continue operating their business until the SEC issues an order to decline the application. The Digital Asset Business Licensing Notification also updates the application fees. For more details on these notifications, or on any aspect of Thai law relating to digital assets or currencies, please contact Charuwan Charoonchitsathian at [email protected], Nopparat Lalitkomon at [email protected] or Teelada Rujirawanichtep at [email protected]  

Thailand’s Office of the Insurance Commission (OIC) recently issued two notifications—one for life-insurance companies and another for insurance companies—establishing key criteria and requirements for insurance companies to manage risks relating to IT and cybersecurity. The notifications, entitled Notifications Re: Criteria for the Supervision and Management of Risks Relating to Information Technology for Life/Non-life Insurance Companies B.E. 2563 (2020) came into effect on January 1, 2021, and cover eight major aspects of IT risk management as detailed below. IT Governance Insurance companies are required to monitor and manage IT risks and cyber threats in accordance with the size, characteristics, complexity, and context of their business operations, and each company should have at least one director with knowledge of, or past experience in, the field of information technology. IT Project Management Insurance companies are required to develop a written framework for IT project management, covering at least the commencement, implementation, and control of the project, as well as the project closing and post-project auditing. Companies must also appoint a committee for supervising and monitoring IT projects. IT Security Insurance companies are required to institute a written IT security policy, which must be reviewed at least once a year or upon implementing any significant changes. The policy must be approved by the board of directors, or a relevant subcommittee appointed by the board of directors. In outsourcing IT activities to third-party service providers, or entering into any arrangement that allows business partners to connect to or access the company’s IT system, insurance companies are required to specify their own criteria and procedures for the selection of third-party service providers, enter into a written service agreement and a service level agreement with the third-party provider, and conform with other requirements under the notifications. Insurance companies will also be required to comply with the OIC’s forthcoming guidelines on the criteria for the supervision of IT outsourcing to third-party service providers. IT Risk Management Insurance companies must also write an IT risk management policy and review it at least once a year, or upon implementing any significant changes. This policy must also be approved by the board of directors or their appointed subcommittee. The companies must also have procedures for IT risk assessment, treatment, monitoring, and reviews. IT Compliance Insurance companies are required to implement the required measures for IT compliance to conform with applicable laws and regulations concerning IT and anti-money laundering. IT Audit Insurance companies are required to have at least one internal or external IT auditor with experience and expertise in IT auditing. Companies are also required to establish a plan and scope for IT audits, which must be approved by the audit committee and reviewed at least once a year, or upon implementing any significant changes. The IT audit reports must be approved by the audit committee and kept at the company office. Cybersecurity Insurance companies are required to establish a framework and guidelines for supervision of and protection against cyber threats, in accordance with cybersecurity laws and commensurate with the size and complexity of their business operations. They must also implement required measures against cyber threats, including risk identification, protection, detection, and countermeasures. Reporting Obligations Insurance companies are obligated to report cyber threat incidents to the OIC, and other threats that affect their IT systems, in the following cases: They become aware of any material issue or incident regarding the use of IT that affects the company’s services, systems, reputation, or the data of insured parties. These incidents include cases where a company’s material IT is subject to an actual cyberattack, or there is a potential threat of a cyberattack, that must be reported to the company’s chief executive officer. In this circumstance, the companies are required to report the incident to the OIC, along with other required details, immediately upon becoming aware of it. They are subject to an attack from any cyber threat causing issues or incidents relating to the provision of critical IT infrastructure. These incidents must be reported to the OIC, or the  responsible cybersecurity authority as required under the law, without delay and within 72  hours. For more information on the requirements under these notifications, or on any aspect of insurance law in Thailand, please contact the Tilleke & Gibbins insurance team at [email protected], [email protected], or [email protected]

Across the globe, the demand for COVID-19 vaccinations has been understandably high, with many regulatory authorities (e.g., U.S. Food and Drug Administration, Medicines & Healthcare Products Regulatory Agency in the U.K., European Medicine Agency, Swissmedic, etc.) issuing emergency use authorizations for COVID-19 vaccines. Similarly, the Thai Food and Drug Administration (Thai FDA) has published the Notification Re: Conditional Approval for Emergency Use of Medical Products, which allows drug importers to register COVID-19 vaccines under the conditional approval scheme.  While as of the date of this article, the Thai FDA has yet to authorize any COVID-19 vaccines, this should follow shortly as clinical trials are completed and government procurement negotiations progress. Under the notification, it appears that the channel of distribution of a COVID-19 vaccine under the conditional approval scheme would be strictly controlled by the Thai FDA. This channel includes the vaccine’s distribution to relevant government agencies (e.g., Department of Disease Control of Thailand and public hospitals specified by the Thai FDA). However, questions have been raised regarding which private hospitals would be included in the distribution list and how the Thai FDA would distribute the vaccine to private hospitals. This confusion over the role of private hospitals was seen recently when one private hospital advertised that it could secure the COVID-19 vaccine from one developer whose product had already been approved elsewhere, until the Thai FDA then stepped in and claimed that the advertisement violated the Drug Act. The Thai FDA notification also enumerates several essential criteria that must be fulfilled in seeking approval for a COVID-19 vaccine, including the following: The available scientific data must substantiate both the efficacy and safety of vaccine. Further, the risk-benefit analysis must indicate that the medicine’s benefits outweigh its risks. A risk management plan, including risk minimization measures, must be submitted. Applications for registration should be prepared using the required template and then be submitted to the Thai FDA. During the assessment, the Thai FDA may rely on an assessment reports provided by stringent overseas regulatory authorities including the U.S., the U.K., the E.U., Australia, Japan, or the WHO. Following approval, the company must conduct a safety monitoring program for every patient (i.e., patient registry), and submit importation records and sales records to the Thai FDA. The storage and distribution of a vaccine under conditional approval must comply with good storage practice (GSP) and good distribution practice (GDP) standards. For more details on this notification, or on any aspect of Thailand COVID-19-related measures, please contact Tilleke & Gibbins at [email protected] or +66 2056 5555.