On September 12, 2025, the Bank of Thailand (BOT) officially released its AI Risk Management Guidelines for Financial Service Providers, building upon the draft guidelines issued in June 2025. The guidelines reflect a balanced approach, encouraging innovation while safeguarding financial stability and consumer protection. The guidelines are targeted at all financial service providers, including financial institutions and special financial institutions under the Financial Institution Business Act, as well as payment providers under the Payment Systems Act. The guidelines apply to both AI systems developed in-house and those developed by third parties that are adopted for use by financial service providers. AI Risk Management Guidelines The two main pillars in managing AI risk are (1) governance of AI system implementation and (2) AI system development and security controls, consisting of the following key elements: 1. Governance Stakeholder roles and responsibilities. Boards and senior management assume accountability for decisions and operations involving AI systems, and are responsible for defining roles and responsibilities for AI oversight. This includes establishing an AI system usage policy, designating personnel responsible for AI risk management, and building awareness of AI-related risk within the organization. Organizations are expected to foster internal capabilities to use AI securely and avoid overreliance that could compromise business continuity or customer service. AI system usage policy. Policies governing AI usage should align with organizational goals, regulatory obligations, and recognized responsible AI frameworks—such as the FEAT principles (fairness, ethics, accountability, and transparency). These policies should be reviewed regularly to respond to technological advancements and evolving risk profiles. Risk management throughout the AI lifecycle. Risk management should encompass the entire AI lifecycle, from establishing risk appetite to implementing continuous risk assessment and control measures tailored to specific use cases. Financial service providers should assess risks and impacts of AI usage on operations and customer services.

Over the past two years—particularly since Thailand announced incentives for EVs, including tax exemptions and reductions—there has been a clear trend of manufacturers relocating their facilities to Thailand. This shift is reshaping the country’s industrial landscape and creating significant opportunities in the real estate sector for companies looking to establish or expand EV manufacturing operations in Southeast Asia. Incentive-Driven Market Transformation The government’s tax exemptions and reductions have proven effective in attracting foreign investment, with Chinese manufacturers currently dominating the market. Most EV parts and car manufacturers operating in Thailand are from China, reflecting the prominence of Chinese EV brands that have already established a presence in the country. The sector encompasses manufacturers of electrical equipment as well as companies seeking to establish facilities for producing electric vehicle components, parts, and accessories. The surge in activity is evident across Thailand’s EV manufacturing sector, with legal practices handling these transactions experiencing unprecedented demand. Industrial Real Estate Framework and Market Dynamics Thailand’s industrial real estate framework provides compelling advantages for foreign manufacturers, who typically face restrictions on foreign land ownership under the Land Code. However, foreign investors can benefit from exemptions to these restrictions if the land is located within industrial real estate zones designated by the Industrial Estate Authority of Thailand (IEAT) or they obtain investment promotion from the Board of Investment (BOI) if the land is located outside an industrial estate area governed by the IEAT. Both the IEAT and BOI provide special tax and nontax incentives, including foreign land ownership, with even greater incentives available for land situated within the country’s Eastern Economic Corridor (EEC). This regulatory advantage has sparked a parallel trend in land development. Industrial real estate developers in the EEC are actively consolidating land into large plots to develop new industrial estate projects, recognizing that

On September 10, 2025, Vietnam’s National Credit Information Center (CIC) reported to the Vietnam Cybersecurity Emergency Response Team (VNCERT) a suspected significant cybersecurity incident involving unauthorized access to the CIC’s credit information database. A hacker group has claimed responsibility and allegedly posted over 160 million records for sale, including sensitive personal and financial data. Implications for Banks and Financial Institutions Companies that share customers’ or potential customers’ personal data with the CIC for credit scoring or other purposes—and continue to act as a data controller for such data—may be obligated under Vietnam’s Personal Data Protection Decree (PDPD) and related regulations to: Notify A05 (Department of Cybersecurity and High-Tech Crime Prevention) and the State Bank of Vietnam without delay. Inform affected individuals if their personal data is at risk. Recommended Actions Companies that could be impacted by this data breach should take the following actions: Conduct an internal review of CIC-related data in their systems, and identify whether and how the systems have been affected by this incident. Assess whether to notify regulators and customers/potential customers. Enhance cybersecurity controls, monitor for suspicious activity, and implement additional safeguards to prevent secondary breaches.

Thailand’s consumer protection authorities have strengthened oversight of residential leasing businesses following numerous complaints about unfair lease terms, including unjustified deposit forfeitures and excessive utility charges. The Contract Committee of Thailand’s Office of the Consumer Protection Board issued the Notification of the Contract Committee Re: The Stipulation of Residential Property Leasing as a Contract-Controlled Business B.E. 2568 (2025), published in the Government Gazette on June 6, 2025. The notification becomes effective on September 4, 2025, and repeals the prior notification issued in 2019. The notification prescribes two types of standard residential lease contracts: short-term residential lease contracts (for leases of not more than three years) and long-term residential lease contracts (for leases of more than three years up to 30 years or for the lessee’s lifetime). However, use of these standard contract forms is not compulsory, and parties may use any form as long as the terms do not contradict the notification’s requirements. Expanded Scope The notification expands the scope of enforcement to include any lessor with at least three residential units, while the 2019 notification applies only to businesses leasing five or more residential units. Hotels and dormitory operators are excluded, as they are regulated under other specific laws. Residential lease contracts entered into under the 2019 notification will remain valid and enforceable until the expiration of the contract. Any residential lease contract executed from September 4, 2025, onward must comply with the new notification. The notification also expressly extends its applicability to lease contracts made through online platforms. Electronically executed lease contracts must comply with the required and prohibited terms specified in the notification as well as applicable laws governing electronic transactions in Thailand. Mandatory Terms and Conditions Residential lease contracts must contain clearly legible Thai text no smaller than two millimeters in size and no more