You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

March 10, 2026

Thailand Expands “Major Shareholder” Definition for Securities and Digital Asset Businesses

Thailand’s Ministry of Finance and Securities and Exchange Commission (SEC) have issued regulations broadening the criteria for determining who qualifies as a “major shareholder” of licensed securities and digital asset business operators. Under relevant SEC regulations, major shareholders of a regulated entity must obtain regulatory approval and undergo screening by the SEC. The revised framework introduces both shareholding-based and control-based tests to determine which shareholders require regulatory approval for a wider range of indirect ownership structures and de facto control. The Ministry of Finance notification took effect on February 21, 2026, while the SEC’s clarifying rules took effect on March 4, 2026. These changes aim to enhance transparency around beneficial ownership and strengthen regulatory oversight of entities operating in Thailand’s capital markets.

Expanded Definition

Under the revised framework, a “major shareholder” now includes persons who directly or indirectly hold more than 10% of the voting rights in a regulated company, as well as persons who exercise control over the regulated company or its shares. This system of two separate tests, based on both shareholding and control, differs from the prior regime, which focused primarily on shareholding thresholds and applied a more limited method for determining indirect shareholdings. The two tests (detailed below) operate independently of each other, and any person identified by either of the tests will be deemed a major shareholder.

Shareholding-Based Test Broadens Indirect Ownership Attribution

For the shareholding-based test, the SEC recognizes two existing methods for identifying indirect ownership, together with a new proportional attribution method. Any person captured under these methods, which are described below, will be regarded as a major shareholder of the regulated company and must obtain SEC approval as a major shareholder.

First, the existing framework continues to apply to both first-tier and chain ownership structures. Approval is required for (1) first-tier shareholders of an entity that directly holds more than 10% of the voting rights in a regulated company (or where an entity holds 100% or nearly 100% in the layer above), and (2) ultimate shareholders holding more than 50% of the voting rights at each level of an unbroken ownership chain. These approaches reflect the previous application of the shareholding-based test.

Second, the SEC will apply a pro rata calculation to identify ultimate beneficial owners whose effective economic interests in the regulated entity exceed 10%, even where no single tier holds more than 50% of the voting rights. This proportional attribution method increases transparency in complex multilayered ownership structures and reduces the risk of circumvention through dispersed shareholdings. The calculation method will significantly broaden the pool of persons deemed major shareholders under the new rules.

Control-Based Test Adds New Trigger

In addition to the shareholding-based test, the amendments introduce a separate control-based test under which a person may qualify as a major shareholder.

Under the separate control-based test, shareholders will be deemed “major” if they possess the authority to appoint or remove at least half of the company’s board of directors or control a majority of votes at shareholder meetings, regardless of the basis for such authority. This provision captures persons who may hold relatively small equity stakes but nevertheless exercise significant influence over the company’s management or decision-making.

Attribution to Related Persons

In determining whether the major shareholder threshold is met, the SEC will aggregate shareholdings and control among spouses (including de facto partners), minor children, and persons acting in concert. Licensed operators must exercise reasonable efforts to review relevant relationships and identify such arrangements to ensure that all shareholders and controlling persons captured under the new framework are submitted for SEC approval.

Transition and Compliance Timeline

Persons who were approved as major shareholders under the previous regulations are deemed approved under the revised framework. However, where a person newly falls within the expanded definition, the licensed operator must file an application with the SEC for approval of that person as a major shareholder within 180 days of February 21, 2026 (conservatively, August 19, 2026).

For changes involving major shareholders by any action rather than as a result of these amendments, the application must be filed no later than 14 days after the licensed operator becomes aware, or has reason to know, that the person qualifies as a major shareholder under the expanded definition. For newly issued shares, licensed operators must submit the application before a person becomes a major shareholder.

Practical Implications

Securities firms and digital asset business operators should review their shareholding structures and governance arrangements to identify persons who may now qualify as major shareholders. This includes:

  • Mapping multi-tier corporate chains and calculating effective ownership percentages;
  • Examining board nomination and removal rights under shareholder agreements or bylaws; and
  • Documenting spousal and family relationships as well as potential acting-in-concert arrangements.

Operators should prioritize compliance for persons captured under the transitional provisions. Failure to obtain approval within the prescribed 180-day period will result in regulatory enforcement.

RELATED INSIGHTS​ 

April 18, 2025
On April 12, 2025, Thailand issued an amended digital asset regulation that covers offshore digital asset businesses providing services on a cross-border basis to Thai users. These businesses will now be subject to the licensing requirements of the Royal Decree on Digital Asset Business Operations B.E. 2561 (2018), which is supervised by Thailand’s Securities and Exchange Commission (SEC). A digital asset business will be deemed as providing services in Thailand—and therefore subject to requirements under the Royal Decree on Digital Asset Business Operations—if the business does any of the following: Displays content in Thai, either fully or partially; Is registered under a “.th,” or “.ไทย” domain, contains any name relating to Thailand, or uses a domain written in Thai characters; Allows or requires payments in Thai baht (THB) or receives payments through Thai bank accounts or e-wallets; Chooses Thai law to govern transactions or Thai courts to litigate any dispute; Pays online search engines to attract users in Thailand to its services; Has an office, establishment, or personnel in Thailand to support or assist users within the country; or Meets any other criteria specified by the SEC. To operate legally in Thailand, offshore operators meeting any of the above criteria will be required to incorporate a local company in Thailand in order to apply for a digital asset business license with the SEC.
April 11, 2025
Vietnam’s draft Personal Data Protection Law (PDPL) continues to evolve, with significant implications for businesses operating in the region. The latest draft, released to the public in March 2025, contains several noteworthy changes from the previous draft that businesses with operations in Vietnam should be aware of when developing their data protection strategies and compliance frameworks. The draft PDPL will be submitted to the vote of the National Assembly in May 2025 with a tentative entry into force on January 1, 2026. Key Changes in the Latest Draft PDPL 1. Redefined Categories of Personal Data The draft PDPL has made important revisions to personal data classifications: Basic personal data: An individual’s image is no longer classified as basic personal data. Sensitive personal data: Bank account information has been removed from this classification (and is now considered basic personal data), but two new categories have been added: (i) salary, allowances, and other income sources, and (ii) information on land users and information on land containing such information. Organizations should review their data classification schemes and update protection measures accordingly, particularly for salary and compensation information. 2. Data Encryption Requirements The draft PDPL explicitly states that encrypted data remains classified as personal data. Additionally, it mandates that sensitive personal data must be encrypted when stored, transmitted, received, or shared in cyberspace. Organizations and individuals can freely opt for one or more encryption solutions and encryption/decryption processes suitable for their personal data management and administration activities. 3. Biometric Data Processing The latest draft PDPL adds new protection requirements for biometric data. Organizations processing biometric data (such as fingerprints) must: Implement physical security measures for devices storing and transmitting biometric data. Use strong encryption methods during transmission and storage. Restrict access to biometric data. Have early-detection monitoring systems to detect violations of biometric
April 10, 2025
After making revisions to the initial draft notification released in November 2024, Thailand’s Electronic Transactions Development Agency (ETDA) has released an updated draft Notification on Additional Obligations for Digital Platform Service Operators of Online Marketplaces for Goods with Specific Characteristics under Section 18(2) of the Royal Decree on the Operation of Digital Platform Service Businesses Subject to Prior Notification B.E. 2565 (2022) B.E. … . A focus group session was also held to gather feedback from business operators. Below is a summary of key provisions in the new draft. Unchanged Items Some key concerns that remain unchanged from the previous version of the draft notification include the following: Offshore business operators running online marketplaces that act as intermediaries for the sale or exchange of goods and provide facility services for the sale of goods (referred to as “specific marketplace operators” in the draft) are required to establish a local entity in Thailand. However, the criteria for determining which operators are specific marketplace operators are still under discussion due to feedback from business operators. Specific marketplace operators must submit a compliance report to the ETDA along with their annual report each year. Specific marketplace operators must verify that “business users” (e.g., merchants) provide complete details about goods in accordance with product standardization requirements. Removed Obligations The updated draft notification has removed specific marketplace operators’ obligations to: Conduct Identity Assurance Level 2 (IAL2) verification of business users before onboarding them on their platforms. Submit a registry of business users’ information to the ETDA. Retain business users’ information for a specified retention period. Implement measures to filter reviews of products subject to specific standards. Revisions Key revisions made to the draft notification include the following: The effective date has been extended to 120 days after the notification’s publication in the Government Gazette,
March 18, 2025
On February 6, 2025, the prime minister of Vietnam, Pham Minh Chinh, chaired an online meeting to review the progress of Vietnam’s digital transformation agenda. The meeting assessed achievements under the National Digital Transformation Program and Project 06 on the development and application of population data, electronic identification, and authentication for national digital transformation for the period 2022-2025, with a vision to 2030, approved by the prime minister in 2022. The meeting also outlined key legislative and regulatory priorities for 2025, as set forth in Notice No. 56/TB-BPCP issued by the Government Office on February 23, 2025 (Notice 56). One of the central focuses of the 2025 digital transformation agenda is the development and issuance of laws and regulations governing digital technology, data management, and cybersecurity. Below are the key legal developments provided in Notice 56 that stakeholders should anticipate in the coming months. 1. Law on Digital Technology Industry The Ministry of Information and Communications (MIC) has been tasked with finalizing the draft Law on Digital Technology Industry (DTI Law) for submission to the National Assembly at its 9th session in May 2025. This law is expected to establish a comprehensive legal framework for the digital technology sector, addressing regulatory gaps in emerging fields such as artificial intelligence (AI), Internet of Things (IoT), cloud computing, big data and platform services to promote innovation, ensure data security, and support the growth of the digital economy in Vietnam. Concurrently, the MIC will expedite the issuance of guiding decrees to ensure the swift implementation of the DTI Law once enacted. 2. Law on Personal Data Protection and regulations guiding implementation of Data Law The Ministry of Public Security (MPS) is making efforts to finalize the long-anticipated Law on Personal Data Protection (PDPL)—data protection is currently governed by Decree No. 13/2023/ND-CP on