You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

November 27, 2023

Thailand: ETDA Stipulates Digital Platform Risk Assessment and Identity Verification

Subscribe to Updates

Thailand’s Electronic Transaction Development Agency (ETDA) has released two new subordinate regulations under the Royal Decree on Digital Platform Services: one detailing the assessment of digital platform services (DPSs) that will be deemed “high-risk” and subject to additional obligations, and another setting guidelines on user verification and authentication for all DPSs.

The two subordinate regulations are summarized below.

Impact Assessment of DPS Operations

Under the Royal Decree on Digital Platform Services, DPS operations that have the risk of seriously impacting financial and commercial security, reliability and credibility of data message systems, or the general public are subject to additional obligations. The first subordinate regulation mentioned above (officially titled Notification of the Electronic Transactions Commission Re: Criteria for Impact Assessment on Operation of Digital Platform Services) outlines the criteria for the ETDA to determine which DPSs are “high-risk.” DPSs falling under this designation include:

  • DPSs whose total value of transactions conducted through the platform in Thailand exceeds THB 100 million (approx. USD 2.8 million) per year;
  • DPSs whose operators have not registered their entities with the Department of Business Development (DBD)—notably overseas operators—and that have 100 or more merchants or business users in Thailand or total users in Thailand between 5 and 10 percent of the country’s population (i.e., approx. 3.3–6.1 million users, calculated using official 2022 figures);
  • DPSs that allow their users to freely post certain messages, or do certain acts, that may affect the public in certain cases, such as: (1) unlawful messages or acts; (2) messages or acts that may affect a child’s rights or people’s fundamental rights; and (3) messages or acts that may negatively affect political opinions of Thai citizens (whether before or after an election) or statements or actions likely to negatively affect other individuals due to gender differences or sexual violence.

After considering these criteria and the details provided by DPS operators when notifying the ETDA, the ETDA will announce a list of the types or names of “high-risk DPSs.”

According to the Royal Decree on Digital Platform Services, the high-risk DPSs must:

  • Conduct risk assessments;
  • Implement risk management measures;
  • Conduct hearings for changes to terms and conditions for providing the DPS;
  • Report on their compliance with the above obligations on an annual basis; and
  • Comply with other obligations to be prescribed by the ETDA.

Identification and Verification

The second subordinate regulation (Notification Re: Manual for Identification and Verification Process) prescribes the manual and standards for the identification and verification of DPS users. The manual serves as a guideline for DPS operators on verifying and authenticating the identity of high-risk or potentially impactful users. This may include users who have greater access rights or the ability to access more features than regular users, users with numbers of followers exceeding a defined threshold (e.g., more than 5,000 followers), and users with transaction volumes or frequencies exceeding specified limits (e.g., a total transaction value of more than THB 50,000 per month).

DPS operators should comply with the identity verification and authentication requirements for user registration on digital platforms by at least undertaking the following:

  • Verifying the identity of applicants for DPS user registration. Information for verifying the identity of service applicants should be from the results of identity verification by identity providers (IDPs) that have previously verified the individual’s identity (such as verifying the Thai ID card information issued by the Ministry of Interior). IDPs should support at least identity assurance level 2 (IAL2).
  • Collecting user data. For the purpose of verification and authentication, DPS operators should collect data such as name and surname, ID card number or passport number, and contact details of individual users (or for corporate entities, name of the company, corporate registration number, and name of any authorized persons). DPS operators should collect additional user data as appropriate to the nature of their DPS. For example, digital platforms categorized as online marketplaces may collect electronic commerce registration numbers.
  • Determining the access rights and features accessible on the platform. DPS operators should specify the access rights and accessible features for users based on the level of identity verification and authentication or based on the user data collected. Users who have undergone identity verification and authentication at a higher level may be granted greater access rights and more accessible features.
  • Displaying symbols or statements confirming identity verification and authentication. DPS operators should have a “verified” badge indicating that a user has completed identity verification using the methods defined by the DPS operator. The badge should be a clear and easily accessible and understandable symbol or statement. The display format should be adaptive to different screen sizes.
  • Confirming the identity of users accessing the DPS. DPS operators should ensure that the identity verification of users logging in to the DPS achieves a reliability level of at least authentication assurance level 2 (AAL2) or rely on the results of identity verification obtained from another IDP that has previously verified the individual’s identity.

For more information on compliance with the requirements for digital platform services in Thailand, please contact Tilleke & Gibbins’ digital platform specialists Athistha (Nop) Chitranukroh at [email protected], Thammapas Chanpanich at [email protected], Rada Lamsam at [email protected], or Karnravee Jitvilai at [email protected].

Related Professionals

Industries

Fintech

Technology

Location

RELATED INSIGHTS​ 

September 2, 2026
On August 21, 2026, Thailand’s Securities and Exchange Commission (SEC) published two consultation papers that would broaden regulated access to crypto assets while tightening custody standards. The first proposes a framework for establishing crypto exchange-traded funds (crypto ETFs) in Thailand. The second proposes enhanced qualification requirements for foreign digital asset custodians serving mutual funds and private funds that invest in digital assets. The proposals seek to expand regulated access to crypto assets while strengthening custody, governance, disclosure, and investor protection, and they affect fund managers, trustees, and licensed digital asset operators. Comments on both papers are due by September 20, 2026, and the SEC expects the resulting rules to take effect later in 2026. Elevating Foreign Custodian Standards Under current rules in effect since January 16, 2025, mutual funds and private funds investing in digital assets may use foreign custodians that meet qualifications similar to those set for domestic digital asset business operators. The SEC now proposes that foreign digital asset custodians satisfy two cumulative requirements: Compliance with the existing baseline qualifications: demonstrated expertise, robust cybersecurity measures, segregation of client assets, controls preventing unauthorized asset transfers, and sound financial standing. Supervision by a regulator that is either (1) an IOSCO Signatory A member under the Multilateral Memorandum of Understanding, the international arrangement through which securities regulators share information and cooperate on enforcement, or (2) a regulator in a jurisdiction that the Thai SEC designates as having adequate supervisory and investor protection standards. The SEC is initially considering 11 jurisdictions for the approved-country list: France, Germany, Hong Kong SAR, Ireland, Japan, Liechtenstein, Luxembourg, Malaysia, Singapore, South Korea, and the United States. The SEC may expand this list over time based on its assessment of other jurisdictions’ regulatory frameworks governing custodian licensing, asset segregation, secure custody practices, client rights in insolvency,
Read More
August 27, 2026
The Bank of Thailand (BOT) is seeking public feedback on a proposed overhaul of the regulatory framework for licensed money changers authorized by the finance minister, under the Exchange Control Act, to buy and sell foreign banknotes separately from commercial banks and specialized financial institutions. The BOT published the draft principles on August 19, 2026, for public consultation, with comments accepted through September 18, 2026. If adopted in its current form, the new framework would substantially raise licensing standards, require existing licensees to undergo a review and upgrade process, temporarily freeze new applications in 2027, and reduce application intake rounds from 2028 onward, with significant implications for both existing operators and prospective new entrants. The overhaul initiative stems from the BOT’s recognition of a need to prevent the use of licensed money changers as channels for financial crime. The stated objectives are to build public confidence, ensure the safety of financial service users, and align the supervisory framework with the current risk profile of the business and evolving market conditions. Upgraded Licensing Standards The BOT intends to significantly revise the licensing framework, including requirements relating to registered capital, branch management, operational standards, and customer transaction limits. Detailed criteria have not yet been released and are expected to be subject to further consultation. All existing licensees will be required to upgrade to meet the new standards and submit evidence of compliance for BOT review on a case-by-case basis. Existing licensees that are unable to satisfy the upgraded requirements may face regulatory consequences, subject to the final framework and BOT review process. Freeze and Reopening The BOT will temporarily stop accepting new license applications throughout 2027 to focus resources on inspecting and upgrading existing money changers. Any party wishing to obtain a new money changer license must submit its application by
Read More
August 25, 2026
Vietnam has enacted a new decree establishing administrative penalties for violations in the fields of cybersecurity and personal data protection. Decree No. 330/2026/NĐ-CP (Decree 330), issued and effective from August 19, 2026, provides a detailed sanctions framework for noncompliance with the Law on Personal Data Protection (including its implementing regulations under Decree 356/2025/ND-CP) and the Law on Cybersecurity, together with their guiding decrees. The issuance of Decree 330 signals that the practical grace period previously perceived by many businesses may be drawing to a close, with active regulatory enforcement in these areas expected to commence in earnest. Scope and Key Provisions Decree 330 has extraterritorial effect and applies to both onshore and offshore companies. For offshore companies, it applies to those that (1) provide telecommunications, internet, online-content, information-technology, cybersecurity, or cross-border services and (2) are involved in or related to the processing of personal data of Vietnamese citizens and certain other people of Vietnamese origin. Decree 330’s key provisions cover the following areas: Administrative penalties for violations relating to the protection of national security and public order in cyberspace, including the dissemination of unlawful, false, or unverified information. Sanctions for cyberattacks, unauthorized access, introduction of harmful code or programs, and failure to cooperate with specialized cybersecurity forces. Sanctions for personal data protection violations, such as consent, cross-border data transfers, impact assessments, breach notification, and data-subject rights, among others—with maximum fines of up to 5% of an organization’s preceding-year revenue for cross-border transfer violations, or up to VND 3 billion for other data-protection breaches. Personal Data Protection Penalties The key sanctions for personal data protection violations are as follows: Consent violations: Fines of up to VND 70 million (approx. USD 2,642), plus potential additional sanctions and remedial measures including irreversible deletion of personal data collected without consent and confiscation of
Read More
August 25, 2026
Thailand’s Electronic Transactions Development Agency (ETDA) is studying potential new regulatory measures for digital platform services that could significantly expand the country’s digital platform governance framework. The ETDA has already conducted one public consultation session on the proposed measures and will hold additional sessions on August 25 and September 2, 2026, covering five types of platform services under the Royal Decree on Digital Platform Services B.E. 2565 (2022). The measures under study are preliminary and may be changed based on consultation outcomes. Foundational Measures Applicable to All Platform Types Seven baseline obligations would apply across all digital platform categories: Transparency reports. Platforms must prepare and publish statistical reports on platform governance activities, including the number of content items removed or restricted and appeal outcomes, in a comparable format. Notice and action mechanism. Platforms must establish minimum standards for channels to report potentially illegal content or goods, conduct case-by-case review, provide explanations when content is removed or restricted, and maintain an internal appeals channel. Rights over automated decision-making. Users significantly affected by automated decisions are granted rights to request an explanation, request human review, and contest the decision. Service level agreements (SLAs). Platforms must publish minimum standards for response times, processing timelines, progress notifications, and remedies for incidents on the platform. Labeling of AI-generated content. Content generated or modified by AI must carry visible labels and machine-readable metadata, with exceptions for creative works that disclose AI use in a nonmisleading manner. Prohibition of dark patterns. User interface designs that deceive, coerce, or distort user decision-making are prohibited, including hiding critical information, creating false urgency, or making service cancellation unreasonably difficult. Business user fairness. Platforms must meet minimum standards for the treatment of sellers, workers, and content creators, including advance notice of term changes, explanation of account suspensions or visibility reductions,
Read More