You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

April 5, 2021

Stablecoin Policy Guidelines Issued by Bank of Thailand

Subscribe to Updates

On March 19, 2021, the Bank of Thailand (BOT) issued policy guidelines on how stablecoins are to be regulated. These were issued following the BOT’s recent ruling that stablecoins pegged to the Thai baht violate the Currency Act B.E. 2501 (1958).

Stablecoins were developed to offer a more price-stable alternative to traditional cryptocurrencies, which are defined under Thai law as digital units created to serve as means of exchange for goods, services, or any other rights. As traditional cryptocurrencies (such as Bitcoin) have no underlying assets, they are subject to such extreme fluctuations in value, and therefore people often hold them as investments rather than spend them as currency.

Some stablecoins are pegged to the value of a specific fiat currency, such as the Thai baht, and are sometimes even intentionally created to mirror that fiat currency in name, denomination, and value.  The BOT reasoned that such stablecoins—seemingly created to replace Thai baht currency—violate the Currency Act B.E. 2501 (1958), because the public might incorrectly consider them a parallel baht currency.

The BOT’s subsequent policy guidelines on how stablecoins are to be regulated address both baht-pegged stablecoins and those pegged to other currencies or assets.

Stablecoins pegged to the Thai baht (or “baht-backed stablecoins”) that are intended to be used as a means of payment may be considered electronic money (e-money) under the Payment Systems Act B.E. 2560 (2017), which is regulated by the BOT. This type of stablecoin has similar characteristics and risk factors to existing e-money, for which the BOT has issued regulations governing various aspects such as settlement, money laundering, cybersecurity, and consumer protection. Consequently, business operators who intend to launch baht-backed stablecoins in the Thai market should consult with the BOT before doing so. To support their determination on this issue, the BOT notes that their position is consistent with those of other countries, such as Singapore, the UK, and Japan.

The BOT confirmed that stablecoins pegged to foreign currencies or other assets, including those with value backed by a digital mechanism rather than an asset (i.e., algorithmic stablecoins) are currently unregulated. However, the BOT is studying this topic and is open to receiving comments and feedback before deciding whether and how these stablecoins should be regulated.

The BOT itself is developing a cryptocurrency called a retail-type central bank digital currency (CBDC), similar to Digital Yuan of the People’s Bank of China and other government-developed digital currencies, to be freely used by the general public as a stable exchange of value for goods and services. The BOT believes that, when compared to privately issued stablecoins, a CBDC will be more secure and efficient and can meet the demands of all users and business operators.

Cryptocurrency and stablecoins are now at a regulatory crossroads, with Thai regulators set to determine their future. Conceptually, neither traditional cryptocurrency nor stablecoins are regulated under the Emergency Decree on Digital Asset Business Operation B.E. 2561 (2018), but businesses related to them are. The recent BOT rulings indicate some skepticism by Thai regulators toward stablecoins—especially those pegged to the Baht—and the possibility that their widespread introduction into Thailand could create a new and unregulated financial ecosystem that adversely impacts the stability of the financial sector, and by extension the country’s economic development. Nevertheless, the BOT well recognizes this technological development and is therefore actively engaging with it.

Related Professionals

Industries

Technology

Practices

Banking and Finance

Capital Markets

Location

RELATED INSIGHTS​ 

August 15, 2025
More than a decade after the issuance of Decree No. 52/2013/ND-CP (as amended by Decree No. 85/2021/ND-CP; collectively, “Decree 52”), Vietnam’s legal framework for e-commerce is under growing pressure to keep pace with the evolving digital economy. While Decree 52 has provided a foundational framework, it has shown certain limitations in keeping up with issues such as counterfeit goods, intellectual property enforcement, unqualified products, and emerging models like livestream selling and affiliate marketing. To address these regulatory gaps, the Ministry of Industry and Trade (MOIT) has released the 2025 Draft E-Commerce Law (“Draft Law”) for public consultation. The Draft Law is intended to supersede the current framework under Decree 52 and establish a more detailed and comprehensive legal foundation for the regulations of e-commerce activities in Vietnam. It is currently expected to be submitted to the National Assembly for review and potential adoption during its 10th session in October 2025. In this article, we discuss the Draft Law’s most significant updates and legal developments in comparison to existing regulations, and assess the practical challenges that businesses may face in preparing for implementation in the near future. Platform Classification: Toward a More Nuanced Framework Unlike Decree 52’s simpler structure, which broadly categorized platforms into either (i) websites selling goods and services or (ii) websites providing e-commerce services, the Draft Law introduces a more detailed framework that aims to classify platforms based on their technical functions and business models. Specifically, the Draft Law introduces a four-tier classification system for e-commerce platforms, consisting of: (i) Direct Business Platforms, (ii) Intermediary Platforms, (iii) Social Networks with E-Commerce Functions, and (iv) Multi-Service Integrated Platforms. This approach reflects an effort to more accurately capture the complexity of today’s e-commerce landscape, including hybrid platforms such as TikTok Shop. While this approach reflects the growing complexity of
Read More
August 6, 2025
Thailand’s Digital Government Development Agency (DGA) has released drafts of two pivotal documents to guide Thai government agencies in adopting cloud technology and classifying data for cloud usage. These draft guidelines, open for public hearing through August 12, 2025, are part of the national “Go Cloud First” policy, which aims to accelerate digital transformation, improve efficiency, and ensure robust data security across the public sector. The new standards will have significant implications for both government agencies and cloud service providers operating in Thailand. Highlights of the draft guidelines are presented below. Government Cloud Usage Guidelines Cloud-first transformation: All government agencies are directed to prioritize cloud solutions for new IT projects, in line with the cabinet’s “Go Cloud First” policy. Cloud model selection: Agencies must assess their needs and select the most appropriate cloud deployment model—public, private, hybrid, or community cloud—based on the sensitivity of the data and operational requirements. Service types: The guidelines provide criteria for choosing between Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS), emphasizing the importance of using standard, non-customized services where possible. Cost management: Agencies are required to plan and separate cloud-related expenses, ensuring transparency and efficient budget allocation. Cloud migration: The guidelines outline the steps for migrating to the cloud and highlight the role of cloud service providers in facilitating the process, including supporting innovation and enabling smooth exit strategies. Procurement compliance: All cloud procurement must comply with public sector procurement laws and regulations. Only providers meeting government-mandated standards can be selected. Security and shared responsibility: The guidelines clarify the division of security responsibilities between cloud providers and government agencies. While providers manage infrastructure security, agencies remain responsible for data, application, and access controls. Legal framework: Agencies must comply with the Digital Government Administration Act, Cybersecurity
Read More
August 1, 2025
Thailand’s Personal Data Protection Committee (PDPC) announced to the press on August 1, 2025, that it had issued eight new administrative fines under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) in five cases of noncompliance by public and private entities. The enforcement actions reflect a growing commitment by the PDPC to penalize noncompliance across all sectors, regardless of organizational type or size. The total amount imposed to date was approximately THB 21.5 million (approx. USD 654,690), underscoring the financial risks tied to PDPA violations. The five cases—one involving a state agency and the remainder in the private sector—are summarized below. Case 1: State Agency Providing Online Services to the Public The order in this case stemmed from a cyberattack on a state agency’s web app, resulting in personal data of 200,000 data subjects being leaked to and sold on the dark web. The software developer was also found to have implemented no privacy by design, lacked an access control system, had no data breach prevention measures, and failed to conduct risk assessments or review existing security measures. Key noncompliance identified: Lack of appropriate security measures Weak password protection No risk assessment or ongoing review of security measures No data processing agreement with software developer that acted as data processor The state agency and the developer were each fined THB 153,120 (approx. USD 4,670). Case 2: Private Hospital This case involved a hospital that engaged an individual contractor to destroy patient medical record documents. However, the contractor stored the documents at their own premises, failed to follow the required destruction protocols, and ultimately used the medical records to wrap sweets, resulting in the leak of over 1,000 records during the destruction process. The contractor also failed to notify the hospital of the data breach. Although there was a
Read More
August 1, 2025
On July 30, 2025, Myanmar’s Cybersecurity Law No. 1/2025 came into effect with the State Administration Council’s issuance of Notification 113/2025. The law, which was enacted on January 1, 2025, aims to regulate various aspects of digital security and online activities. Below are some key provisions, implications, and penalties under the Cybersecurity Law. Extraterritorial penalties. The law contains an important provision that authorizes penalties against Myanmar citizens who are found guilty of violations, even if these occur outside the country’s borders. VPN definition and regulation. Virtual private networks (VPNs) are defined by this law as specific systems that function as backup networks by using technological means in order to ensure the safety of linking networks to each other. This definition sets the framework for subsequent regulations and penalties associated with VPN usage. The law does not restrict individuals or entities from using VPNs; it regulates VPN service providers. Penalties for unapproved VPN services. Establishing a VPN or providing VPN services without approval from the designated ministry (to be appointed later by the government) can result in significant penalties. For individuals, the punishment may be imprisonment for 1–6 months, a fine of MMK 1–10 million (approx. USD 476–4,760), or both, with the proceeds of the violation being confiscated. If the violator is a company or organization, the minimum fine will be MMK 10 million, and the proceeds will be confiscated. Government oversight. The ministry designated by the government is authorized to investigate and take control of cybersecurity services and digital platform services for national defense and security purposes, or upon request from a government department or organization in accordance with respective laws. Licensing requirements. The Cybersecurity Law introduces two types of licenses, valid for a period of 3–10 years, for (1) cybersecurity services and (2) digital platform providers. Digital platforms with
Read More