You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

March 5, 2026

Thai SEC Heightens Enforcement Against Cross-Border Digital Asset Platforms

Subscribe to Updates

Thailand’s Securities and Exchange Commission (SEC) has filed a criminal complaint against a licensed digital asset broker, its overseas trading platform, and its executives for allegedly operating an unlicensed digital asset exchange targeting Thai customers. The case marks an escalation in the SEC’s enforcement efforts against unlicensed offshore platforms that attempt to serve Thai users through local licensed entities.

Criminal Complaint

On February 20, 2026, the SEC filed a criminal complaint with the Economic Crime Suppression Division against a local licensed digital asset broker, its overseas global trading platform, and its executives. The SEC alleges that the parties violated the Digital Asset Business Emergency Decree B.E. 2561 (2018) by cooperatively operating a digital asset exchange business on a cross-border basis since 2023 without the required SEC license.

According to the SEC, the local broker promoted the overseas platform’s services to the public through Thai-language posts on social media channels, with services available exclusively to customers residing in Thailand. Access to the global platform was provided through the local broker’s website and mobile application. Customers who registered for the local broker’s services were automatically granted access to the global platform without having to undergo a separate identity verification process. The SEC also found that the local broker provided back-office system support services to the global platform.

The SEC considers these activities to constitute joint operation of an unlicensed digital asset exchange. The former executives of the local broker are being held liable as the responsible persons during the relevant period. The SEC emphasized that the complaint initiates the criminal process, and the decision to prosecute or convict the accused parties will ultimately be made by law enforcement authorities and the criminal courts.

Platform Blocking

The SEC has also coordinated with the Ministry of Digital Economy and Society to block public access to the global platform under the Emergency Decree on Measures for the Prevention and Suppression of Technology Crime (No. 2) B.E. 2568 (2025). Access is expected to be restricted beginning March 22, 2026. The SEC has cautioned current users in Thailand to take appropriate steps regarding their digital assets held on the platform before the blocking date and reiterated its warning against using the services of unlicensed digital asset operators.

Key Takeaway

This enforcement action reflects the SEC’s heightened scrutiny of unlicensed offshore digital asset platforms and demonstrates that such platforms may not rely on local licensed entities to offer cross-border trading services targeting Thai users.

Related Professionals

Industries

Fintech

Technology

Location

RELATED INSIGHTS​ 

August 23, 2023
Introduction The idea of the metaverse rose to prominence in the public discourse in 2021, most notably when Facebook renamed itself Meta and announced a new focus on launching a virtual, immersive world. The initial excitement around the metaverse has since faded, with worsening economic conditions having a particularly acute effect on companies in the technology sector. When Meta CEO Mark Zuckerberg announced in March 2023 that artificial intelligence (AI) was the company’s “single largest investment,” many took this as a sign of the company shifting focus away from the metaverse. However, there remains significant interest in the metaverse from both businesses and consumers. Zuckerberg himself reaffirmed Meta’s focus on the metaverse, highlighting how developments in AI will improve virtual reality (VR) and augmented reality (AR) technology. Meanwhile, Roblox, a metaverse gaming platform, announced that in Q1 2023, its number of daily active users had increased to 66 million. Most recently, the announcement by Apple of its new ‘Vision Pro’ AR headset is reported to have renewed interest in the metaverse among developers. A particular area of interest in the developing metaverse is digital fashion and retail. In its Metaverse Fashion Trends Report 2022, Roblox found that nearly three in four users aged 14 to 24 spend money on digital fashion items. Roblox itself has partnered with fashion brands Burberry, Gucci, Tommy Hilfiger, and others, to offer experiences and items for use on the platform. In March 2023, Decentraland, a metaverse platform with a decentralized governance structure, hosted the Metaverse Fashion Week, featuring brands such as Adidas, Coach, and DKNY. As businesses continue to invest and look for opportunities to expand into the metaverse, whether through traditional e-commerce or more innovative digital asset offerings, it is important that they consider the ways in which new and existing laws apply
Read More
August 22, 2023
On August 17, 2023, the Thai government rolled out a royal decree that provides certain exemptions to data controllers’ obligations under the Personal Data Protection Act B.E. 2562 (PDPA). The royal decree, which will come into effect after the lapse of 150 days from its publication in the Government Gazette, reflects the government’s ongoing quest to strike a balance between privacy, state interests, and the data protection regulatory burden on organizations. The royal decree seeks to clarify the circumstances in which data controllers—including business operators and state agencies—are exempt from certain PDPA requirements on the collection, use, and disclosure of personal data and data subject rights. In doing so, it establishes three foundational pillars in considering exemptions: Collection or requests for personal data are to be for the public interest pursuant to the purpose and scope prescribed by any law authorizing a state agency to carry out a certain action, without imposing an undue burden on the data controller responsible for disclosing the personal information. Data controllers can share personal data without the data subject’s consent if legally authorized state agencies request it and specify the statutory provisions granting authority to request the data. Data subjects and data controllers of requested personal data must have the right to submit complaints to the PDPA’s Expert Committee or seek its expertise for clarification or determination. Under the three foundational pillars, data controllers will be partially exempted from certain requirements under the PDPA when the following state agencies request personal data: The National Anti-Corruption Commission or other government entities with mandates aligned with anticorruption laws; The Revenue Department, Customs Department, Excise Department, or other governmental units operating under taxation laws; Local governmental bodies recognized by the Personal Data Protection Committee (PDPC), or any government unit with mandates as per the laws related
Read More
July 31, 2023
On July 13, 2023, Thailand’s Personal Data Protection Committee (PDPC) published a draft notification on the requirements for appointment of a data protection officer (DPO). Under the Personal Data Protection Act B.E. 2562 (PDPA), data controllers or data processors must appoint a DPO if: The data controller or data processor is a state agency as prescribed by the PDPC (the list of state agencies was published in the Government Gazette on July 18, 2023); The activities of the data controller or data processor in relation to the processing of the personal data require “regular monitoring of the personal data or the system,” by reason of “having large-scale personal data” as prescribed by the PDPC; or The core activity of the data controller or data processor is related to the processing of special categories of personal data (e.g., health-related data, biometric data, etc.). The draft notification’s criteria for determining whether a processing activity (1) requires regular monitoring of the personal data or the system, and (2) involves large-scale personal data are outlined below. General Principles When determining whether processing of personal data requires regular monitoring due to having large-scale personal data, it is likely that only the “core activity” of the data controller or data processor is to be taken into consideration. The term “core activity” denotes an essential and integral activity directly related to the primary operations of the data controller or data processor and does not include any supplementary business activities. Regular Monitoring of Personal Data or Systems According to the draft notification, activities related to processing personal data require regular monitoring of the personal data or the system if: The core part of the data controller’s or data processor’s activities consists of tracking, monitoring, analyzing, or predicting the behavior, attitude, or profile of individuals; and These activities
Read More
July 31, 2023
Vietnam’s Decree No. 72/2013/ND-CP, as amended by Decree 27/2018/ND-CP (referred to collectively as “Decree 72”) regulates internet services and online information, and plays a crucial role in governing significant services such as social networks, online games, and aggregated information websites, as well as key matters like domain names and online information security. Given the rapid pace of development in these areas, Decree 72—having been in effect for nearly a decade—is in need of an update. The Ministry of Information and Communications (MIC) had initially intended to draft an amendment to Decree 72 in 2021. However, the magnitude of required changes made it impractical to retain the form of an amending decree, leading the MIC to shift its focus toward replacing Decree 72 entirely. As a result, a new draft decree to replace Decree 72 (the “Draft Decree”) was released by the MIC for public consultation from July 17 to September 15, 2023. The Draft Decree is comprehensive, with six chapters, 87 articles, and an appendix of 56 forms. The following are some of the main issues covered by the new Draft Decree. 1. Social Network Services Classification and licensing/notification Social network services include onshore and offshore social network services. Onshore social network services refer to those provided by organizations or enterprises with legal status in Vietnam, and are divided into “high-visitor” or “low-visitor” categories based on number of regular visitors. The high-visitor category includes social networks with total visits of 10,000 or more per month for six consecutive months or with more than 1,000 regular members in a month. High-visitor onshore social network service providers must obtain a license to provide social network services. Low-visitor onshore social network service providers only need to notify the MIC’s Authority of Broadcasting and Electronic Information (ABEI) and receive the ABEI’s written notification
Read More