You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

April 18, 2025

Thailand Amends Emergency Decree on Technology Crime

Subscribe to Updates

On April 12, 2025, Thailand published an amendment to the Emergency Decree on Measures for the Prevention and Suppression of Technological Crimes in the Government Gazette, with the regulation taking effect the following day.

Drafts of the amendment had been shared in recent months, and the final amendment of the decree contains some additional key revisions, such as narrowing the business operators subject to the decree’s requirements, reducing operators’ obligations, and establishing collaboration between relevant stakeholders to tackle technology crime.

These key revisions to the amendment are detailed below.

  • Business operators subject to the decree: The business operators covered under the decree now include only payment service providers under the Payment System Act and digital asset operators under the Royal Decree on Digital Asset Businesses. Digital platform services under the Royal Decree on Digital Platform Service Businesses That Are Subject to Prior Notification are no longer within the scope of the decree.
  • Definition of technology crime: The final version of the amendment removed the expanded definition of technology crime that had been included in a previous draft, leaving the decree’s existing definition unchanged.
  • Telecommunications provider obligations: Mobile and telecommunications service providers now have an obligation to monitor and screen for content that may be related to technology crime and suspend SIM cards when instructed to do so by the National Broadcasting and Telecommunications Commission (NBTC).
  • Transaction and account suspension: The amendment removes the decree’s complex transaction suspension procedures and leaves room for business-specific regulators (e.g., Bank of Thailand, Securities and Exchange Commission, NBTC) to impose various technology crime suspension requirements on business operators under their supervision. The newly established Center for Prevention and Suppression of Technology Crimes can also notify financial institutions and business operators of names or digital asset wallet addresses that may be related to technology crime, triggering an obligation to suspend the accounts.
  • Shared liability: Although digital platform service providers are not in the scope of business operators under the amended decree, online social media platform operators are still jointly accountable with other operators (i.e., financial institutions, business operators, and related service providers) for damages from technology crime. To be released from this liability, operators have to prove their compliance with the technology crime standards and measures stipulated by their regulators (safe harbor rules).

Business operators will need to wait and see how their sector-specific regulators impose requirements to combat technology crime. Online social media platforms should closely monitor the safe harbor rules, which are expected to be issued soon.

Related Professionals

Industries

Fintech

Technology

Location

RELATED INSIGHTS​ 

February 28, 2025
Vietnam’s Decree No. 163/2024/ND-CP (Decree 163), which has been in full effect since January 1, 2025, provides crucial guidance on the implementation of Vietnam’s 2023 Telecom Law. Decree 163 replaced Decree No. 25/2011/ND-CP dated April 6, 2011 (Decree 25), which guided the implementation of the previous 2009 Telecom Law, and introduces many notable changes to the regulations on telecom service provision. Some key changes that will impact businesses engaged in the telecom sector in Vietnam are detailed below. 1. Classification of Telecom Services The classification of telecom services into “basic telecom services” and “value-added telecom services” has been retained, in alignment with Vietnam’s WTO commitments in the telecom sector. However, Decree 163 expands the scope of both categories, as follows: Basic telecom services: “Transmission services for machine-to-machine (M2M) communication” and “leasing services of all or part of the telecom network” are added. “Image transmission services” is changed to “transmission services for radio and television.” Value-added telecom services: “Data center services,” “cloud computing services,” and “basic telecom services over the internet” (also known as over-the-top (OTT) telecom services) are added. 2. M2M Communication Services Since M2M communication services are classified as basic telecom services, without exception, they are subject to the same regulatory framework. Specifically: Cross-border provision: M2M communication services provided across borders must be conducted through a commercial agreement with a Vietnamese telecom enterprise licensed to provide telecom services with an international communication scope. Onshore provision: Onshore M2M communication services will require a telecom license. 3. New Telecom Services (Data Center, Cloud, and OTT Telecom Services) The 2023 Telecom Law adopted a light-touch management approach for data center, cloud, and OTT telecom services by not requiring the same licensing as previously regulated value-added telecom services, but instead mandating registration or notification before service provision. Decree 163 offers clearer guidance
Read More
February 26, 2025
Tilleke & Gibbins has contributed the Vietnam chapter to Data Protection 2025, a comprehensive comparative guide in the Law Over Borders series from Global Legal Post. This Q&A-style resource offers detailed insights into data protection regulations across multiple jurisdictions, serving as an essential reference for organizations managing personal data in today’s global business environment. The Vietnam chapter examines the evolving data protection landscape in Vietnam, including analysis of relevant provisions in the Cybersecurity Law, the Law on Information Technology, and the upcoming Personal Data Protection Decree. The chapter addresses key aspects of data protection through the following topics: Regulatory framework: Analysis of national laws regulating personal data, jurisdictional scope, application to different entities, and regulated data processing activities. Data categories and processing: Overview of regulated personal data types, special categories requiring enhanced protection, and lawful processing requirements. Compliance requirements: Explanation of controller and processor obligations, technical and organizational measures, and data subject rights. Commercial communications and international transfers: Rules governing direct marketing and cross-border data flows. Regulatory oversight: Details on enforcement powers, investigation procedures, sanctions, and remedies for noncompliance. Tilleke & Gibbins also contributed the Thailand chapter to Data Protection 2025. Readers can access the complete Data Protection 2025 guide through Global Legal Post’s Law Over Borders platform.
Read More
February 26, 2025
Tilleke & Gibbins has contributed the Thailand chapter to Data Protection 2025, a newly published comparative guide from Global Legal Post’s Law Over Borders series. This comprehensive Q&A-style resource provides insights into data protection regulations across multiple jurisdictions worldwide, offering valuable guidance for businesses navigating the complex landscape of global data privacy requirements. The Thailand chapter offers a detailed analysis of the country’s data protection framework, with particular focus on the Personal Data Protection Act (PDPA) that came into full effect in 2022. The chapter addresses key aspects of data protection in Thailand through the following topics: Regulatory framework: National laws governing personal data, scope of application, territorial reach, and regulated operations. Data categories and protection: Types of personal data covered, special categories subject to enhanced protection, and processing requirements. Compliance obligations: Requirements for lawful processing, organizational responsibilities, and data subject rights. Marketing and cross-border considerations: Rules for commercial communications and international data transfers. Enforcement mechanisms: Regulatory powers, investigation procedures, sanctions, and remedies for noncompliance. Tilleke & Gibbins also contributed the Vietnam chapter to Data Protection 2025. Readers can access the complete Data Protection 2025 guide through Global Legal Post’s Law Over Borders platform.
Read More
February 24, 2025
On January 31, 2025, the Bank of Thailand (BOT) announced a new Notification re: Responsible Lending, replacing a similar notification from 2023. This new notification provides updated measures to assist debtors in different circumstances and clear implementation guidelines for lenders, with the aim of resolving household debt issues. Scope The service providers covered by the notification include banks and nonbanks (e.g., credit card companies, asset management companies, licensed personal loan providers, and nano finance operators) that conduct lending business. New Requirements The notification’s core focus remains loan management throughout the lifecycle of a loan—from credit product development to legal proceedings and debt transfers to other creditors—but with further clarification and detail compared to the 2023 notification. The key revisions in the new notification are summarized below. Advertising standards: The notification tightens requirements in some areas and relaxes them in others. Stricter requirements: It is now clearly stipulated that the BOT oversees taglines that may encourage excessive borrowing. More examples of noncompliant statements are also added (e.g., “Elevate your lifestyle now, pay later”; “Get approved, even with credit challenges”). In addition, advertising material that contains multiple credit products should provide clear minimum and maximum interest rates, especially when there are significant differences in the interest rates of each product. Relaxed requirements: The required information for some marketing activities is now reduced. For example, in marketing events with staff promoting loan products and offering free giveaways, service providers have the discretion to provide effective interest rate information in the manner they deem appropriate, and the advertisement material can display only the mandatory warning statements without providing interest rate details. Encouraging customer financial discipline: The notification requires service providers to implement more elaborate and extensive tools to influence customer behavior (termed “nudging” by the BOT) at every stage of the lending cycle. This
Read More