You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

March 10, 2026

Thailand Expands “Major Shareholder” Definition for Securities and Digital Asset Businesses

Subscribe to Updates

Thailand’s Ministry of Finance and Securities and Exchange Commission (SEC) have issued regulations broadening the criteria for determining who qualifies as a “major shareholder” of licensed securities and digital asset business operators. Under relevant SEC regulations, major shareholders of a regulated entity must obtain regulatory approval and undergo screening by the SEC. The revised framework introduces both shareholding-based and control-based tests to determine which shareholders require regulatory approval for a wider range of indirect ownership structures and de facto control. The Ministry of Finance notification took effect on February 21, 2026, while the SEC’s clarifying rules took effect on March 4, 2026. These changes aim to enhance transparency around beneficial ownership and strengthen regulatory oversight of entities operating in Thailand’s capital markets.

Expanded Definition

Under the revised framework, a “major shareholder” now includes persons who directly or indirectly hold more than 10% of the voting rights in a regulated company, as well as persons who exercise control over the regulated company or its shares. This system of two separate tests, based on both shareholding and control, differs from the prior regime, which focused primarily on shareholding thresholds and applied a more limited method for determining indirect shareholdings. The two tests (detailed below) operate independently of each other, and any person identified by either of the tests will be deemed a major shareholder.

Shareholding-Based Test Broadens Indirect Ownership Attribution

For the shareholding-based test, the SEC recognizes two existing methods for identifying indirect ownership, together with a new proportional attribution method. Any person captured under these methods, which are described below, will be regarded as a major shareholder of the regulated company and must obtain SEC approval as a major shareholder.

First, the existing framework continues to apply to both first-tier and chain ownership structures. Approval is required for (1) first-tier shareholders of an entity that directly holds more than 10% of the voting rights in a regulated company (or where an entity holds 100% or nearly 100% in the layer above), and (2) ultimate shareholders holding more than 50% of the voting rights at each level of an unbroken ownership chain. These approaches reflect the previous application of the shareholding-based test.

Second, the SEC will apply a pro rata calculation to identify ultimate beneficial owners whose effective economic interests in the regulated entity exceed 10%, even where no single tier holds more than 50% of the voting rights. This proportional attribution method increases transparency in complex multilayered ownership structures and reduces the risk of circumvention through dispersed shareholdings. The calculation method will significantly broaden the pool of persons deemed major shareholders under the new rules.

Control-Based Test Adds New Trigger

In addition to the shareholding-based test, the amendments introduce a separate control-based test under which a person may qualify as a major shareholder.

Under the separate control-based test, shareholders will be deemed “major” if they possess the authority to appoint or remove at least half of the company’s board of directors or control a majority of votes at shareholder meetings, regardless of the basis for such authority. This provision captures persons who may hold relatively small equity stakes but nevertheless exercise significant influence over the company’s management or decision-making.

Attribution to Related Persons

In determining whether the major shareholder threshold is met, the SEC will aggregate shareholdings and control among spouses (including de facto partners), minor children, and persons acting in concert. Licensed operators must exercise reasonable efforts to review relevant relationships and identify such arrangements to ensure that all shareholders and controlling persons captured under the new framework are submitted for SEC approval.

Transition and Compliance Timeline

Persons who were approved as major shareholders under the previous regulations are deemed approved under the revised framework. However, where a person newly falls within the expanded definition, the licensed operator must file an application with the SEC for approval of that person as a major shareholder within 180 days of February 21, 2026 (conservatively, August 19, 2026).

For changes involving major shareholders by any action rather than as a result of these amendments, the application must be filed no later than 14 days after the licensed operator becomes aware, or has reason to know, that the person qualifies as a major shareholder under the expanded definition. For newly issued shares, licensed operators must submit the application before a person becomes a major shareholder.

Practical Implications

Securities firms and digital asset business operators should review their shareholding structures and governance arrangements to identify persons who may now qualify as major shareholders. This includes:

  • Mapping multi-tier corporate chains and calculating effective ownership percentages;
  • Examining board nomination and removal rights under shareholder agreements or bylaws; and
  • Documenting spousal and family relationships as well as potential acting-in-concert arrangements.

Operators should prioritize compliance for persons captured under the transitional provisions. Failure to obtain approval within the prescribed 180-day period will result in regulatory enforcement.

Related Professionals

Industries

Technology

Practices

Capital Markets

Location

RELATED INSIGHTS​ 

December 15, 2025
Thailand is taking steps to energize its startup scene by drafting the Startup Promotion Law. This draft law aims to remove obstacles, open new funding opportunities, and provide coordinated government support. The goal is to make it easier for Thailand-based startups to grow and compete on a global stage. Why Is This Law Needed? For many years, Thai startups have operated under traditional company law frameworks that were not designed with high-growth businesses or with fundraising opportunities in mind. Restrictions on issuing bonds, offering shares to outside investors, and repurchasing shares for employee incentive programs made it challenging for emerging companies to access capital and accelerate their growth. The draft Startup Promotion Act seeks to remove these obstacles and foster a more competitive, entrepreneur-friendly environment in Thailand. Who’s in Charge? Two main organizations will oversee the startup ecosystem: Startup Promotion Committee: This group, to be appointed by the National Science, Research, and Innovation Policy Council, will set national strategies, policies, and budget; design promotional campaign and incentives; and propose further legislative amendments to promote startups. National Innovation Agency (NIA): Under the draft act, the NIA will be the main contact for startups and will serve as the secretariat office of the Startup Promotion Committee, coordinating data, advising startups, maintaining the public registry, and providing funding and investment (grants, repayable grants, loans, and equity) under committee criteria and, where applicable, cabinet approval. What Startups Are Eligible for Benefits? To be officially recognized and access benefits, a company must: Be a private limited company less than 10 years old at the time of application. Existing companies that already exceed the 10-year threshold may still apply for startup statues within one year of the law’s enactment, as long as they otherwise still qualify for the new regime. Have average annual revenue not
Read More
December 12, 2025
Tilleke & Gibbins has updated the Cambodia, Myanmar, Thailand, and Vietnam chapters in Multilaw’s Global Data Protection Guide, which collects expert advice from Multilaw member firms in 90 jurisdictions around the world (including a Laos chapter, which is also authored by Tilleke & Gibbins). The guide provides answers to key issues concerning the fast-developing data protection and privacy laws around the world, and helps data protection officers and in-house counsel understand how the regulatory regime for data protection can affect their organizations in various jurisdictions. Each section of the guide identifies the main laws that govern data protection in that jurisdiction, and gives a detailed overview of the legal principles in place as well as the enforcement authorities responsible for overseeing compliance. The guide also covers issues related to data subject rights, data protection officers, impact assessments, data breach notification requirements, and cross border data transfers. The use of personal data in marketing is also considered, with specific information on electronic marketing rules, cookies, and marketing to businesses and consumers. Multilaw, of which Tilleke & Gibbins is a longtime member, is a global network of carefully selected independent law firms able to provide expert legal advice in complex environments around the globe. The full guide is available for free on the Multilaw website.
Read More
December 11, 2025
On December 10, 2025, the National Assembly of Vietnam passed a new Cybersecurity Law, which will take effect on July 1, 2026. The new Cybersecurity Law was developed based on the consolidation of the 2018 Cybersecurity Law and the 2015 Law on Network Information Security. While the final approved version of the new Cybersecurity Law has not yet been published, according to official reports, the following notable requirements are confirmed to be included: The new Cybersecurity Law dedicates a specific article to prohibited acts related to cybersecurity, under which it strictly prohibits posting or disseminating information online that propagandizes against the Socialist Republic of Vietnam. The law also prohibits, among other things, (i) the appropriation, trading, seizure, or intentional disclosure of information classified as state secrets, work secrets, business secrets, personal secrets, family secrets, and private life; (ii) intentionally eavesdropping, recording, or filming online conversations without authorization; and (iii) the use of artificial intelligence (AI) or new technologies to conduct prohibited acts. The Ministry of Public Security (MPS) has the authority to require enterprises providing telecommunications, internet, and online services, as well as system administrators, to remove information violating cybersecurity laws from systems under their management. The MPS is also assigned responsibility for ensuring information security in cyberspace and data security, establishing mechanisms for IP address identity management, verifying digital account registration information, and issuing warnings and sharing information on cybersecurity threats. Information systems are classified into five levels (similar to the 2015 Law on Network Information Security) based on the degree of harm to national security and social order if an incident occurs. The MPS is the lead agency assisting the government in state management of cybersecurity. The Ministry of National Defense is responsible for managing military information systems, and the Government Cipher Committee manages cryptographic and cipher
Read More
December 4, 2025
Thailand has expanded the circumstances under which state agencies may bypass competitive bidding procedures to address urgent security challenges. On November 28, 2025, Thailand’s Ministry of Finance published the Ministerial Regulation Determining Cases of Procurement by Specific Method (No. 6) B.E. 2568 in the Royal Gazette, introducing a new pathway for procuring supplies and services needed to address cyber and military threats that may affect the stability of government agencies or the nation. For technology vendors, cybersecurity firms, and defense contractors, this regulatory change creates immediate opportunities to engage directly with government buyers facing urgent security challenges. New Fast-Track Category for Security Threats The regulation amends Thailand’s Public Procurement and Supplies Management Act B.E. 2560 (2017) to add a new category of procurement that qualifies for the “specific method”—a noncompetitive, direct selection process. Previously, agencies could use this expedited method only in limited circumstances, such as emergencies, cases with proprietary technology requirements, or national security operations. The new provision explicitly covers procurement of supplies related to preventing or resolving cyber or military threats that could impact the stability of a state agency or the country. This addition recognizes the urgent nature of modern security challenges, where competitive bidding timelines may leave agencies vulnerable during critical threat windows. State agencies dealing with active cyberattacks, preparing defensive measures against anticipated threats, or responding to military security concerns can now move directly to negotiate with qualified vendors rather than conducting lengthy public tender processes. Vendor Considerations Vendors offering cybersecurity solutions now have a regulatory avenue to work directly with government clients when stability concerns are present. These solutions include threat detection systems, anti-ransomware tools, incident response services, firewalls, and security consulting. Similarly, defense contractors providing military equipment or specialized security supplies can pursue direct engagement channels where traditional procurement methods would create
Read More