You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

April 10, 2026

Thailand Issues Guidelines on Digital Platform Fee Transparency and Fairness

Subscribe to Updates

Thailand has introduced new regulatory guidance requiring digital platform operators to adopt structured, transparent, and fair fee practices. On March 16, 2026, the Electronic Transactions Development Agency (ETDA) published Announcement No. DPS 2/2569, titled “Guidelines for Transparency and Fairness in Digital Platform Service Fee Determination,” issued under the Royal Decree on Digital Platform Service Business Operations B.E. 2565 (2022). The guidelines establish a framework governing how digital platform operators should set, disclose, and adjust fees charged to users and related service providers such as logistics and payment providers.

Although framed as best-practice guidance rather than legally binding rules with explicit penalties, the guidelines carry regulatory weight under the royal decree and represent a significant step toward structured governance of digital platform fee practices in Thailand.

The guidelines establish various transparency principles and divide fees into two distinct categories—compulsory and additional—with specific governance principles for each.

Transparency Principles

The guidelines recommend that digital platform operators adopt several transparency measures to ensure that users can fully understand the costs of using a platform.

  • Fee catalog. All fees should be consolidated into a single, accessible location, which should include the fee name, definition, scope of covered services, calculation methodology, rate, billing period, and calculation examples.
  • Minimum service disclosure. Operators should disclose the minimum service that users can expect, such as baseline visibility, product listing capabilities, access to transaction data, and back-end dashboard access.
  • Price structure disclosure. Operators should disclose the categories of costs underlying their fees, such as system maintenance, cybersecurity, and operational costs. While exact cost figures need not be made public, operators should be able to provide numerical data to regulators upon request.
  • Clear fee formulas. Fee calculations should be simple and easy to understand—for example, percentage of net sales, cost per order, or cost per product listing. Operators should avoid multilayered or stacked fee formulas that may mislead users.
  • Advance notice. Operators should notify users at least 15 days in advance of any fee change, disclosing the reason, scope, potential impact on users, and channels for inquiries and feedback.

Compulsory Fees

Compulsory fees cover services essential to basic platform operations, such as transaction processing, payment systems, identity verification, back-end systems, security, and basic customer service. Key recommendations include the following:

  • “1 activity = 1 fee” principle. Each fee should correspond to a clearly defined service scope, with no double-charging.
  • Cost-based logic. Fees should be justifiable by reference to cost categories, though detailed cost figures need not be publicly disclosed.
  • Minimum service guarantee. Users who pay compulsory fees are entitled to stable systems, baseline visibility, basic customer support, and access to essential data.
  • No conditional linkage. Basic rights should not be degraded if a user declines to purchase advertising or add-on services. For example, product visibility should not be reduced for users who do not purchase advertising.

Additional Fees

Additional fees include value-added services such as advertising, sales promotions, and subscription packages that enhance business performance beyond the baseline. Governance recommendations for additional fees include the following:

  • No impact on core benefits. Declining add-on services should not reduce baseline visibility or degrade basic system performance.
  • Value-based pricing. Fees should reflect measurable outcomes, such as impressions or search ranking improvement.
  • Optional, not mandatory. The purchase of add-on services should be voluntary, with no coercive bundling or pressure to purchase.
  • Unbundling principle. Basic and add-on services should not be mixed in ways that force users to purchase unnecessary bundles.

Common Principles for All Fee Types

Regardless of category, the guidelines recommend several overarching principles applicable to all fees:

  • Minimum service standards. Each fee type should be linked to clearly defined minimum service levels, including baseline data access, standard visibility, and appropriate service periods.
  • 15-day public consultation. Before any fee adjustment, operators should open a minimum 15-day consultation period, which should be accompanied by a summary of key issues, impacts, and the operator’s response to any feedback.
  • Fee challenge mechanism. Operators should maintain a formal process allowing users to dispute fees, with clear timelines, response procedures, and reasoning.
  • Fair exit. Cancellation procedures, especially for monthly or annual subscriptions, should be clear, reasonable, and free of excessive penalties.

Implications for Digital Platform Operators

Under the new guidelines, digital platform operators—particularly e-commerce marketplaces, food delivery apps, and similar intermediary platforms—may need to make significant operational and legal adjustments, and should review their current fee structures, disclosure practices, and terms of service for alignment with these guidelines. Key priorities include the following:

  • Preparing a consolidated fee catalog
  • Developing advance-notice and consultation procedures for fee changes
  • Implementing fee-dispute mechanisms
  • Ensuring internal cost-allocation records can be produced for regulators on request

In addition, the “1 activity = 1 fee” principle and unbundling requirements may force operators to unbundle existing combined fee packages and justify pricing with cost-based or value-based rationale. The prohibition on conditional linkage, such as suppressing product visibility for users who do not buy ads, directly limits a common monetization strategy and may affect revenue models.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

June 25, 2025
Generative artificial intelligence (GenAI) is no longer a distant innovation confined to science fiction and research labs; it has become an integral part of daily business operations worldwide. Employees across industries are adopting GenAI tools at a remarkable pace—including in Southeast Asia, where a tech-savvy workforce and widespread internet and mobile access have driven early adoption. The reality facing organizations today is clear: employees are integrating GenAI into their daily work, often without official approval or clear policies. This phenomenon, often called “Bring Your Own AI,” comes out of a disconnect between organizational governance and employee behavior and reveals the urgent need for proactive AI policies and oversight. For business leaders and legal teams, GenAI is both an opportunity and a challenge. On one hand, these tools can deliver real business value and boost efficiency. On the other, the unsanctioned and unmonitored use of GenAI introduces substantial legal risks, such as data privacy violations, confidentiality breaches, and intellectual property issues. The widespread adoption of GenAI tools by employees, regardless of official organizational stance or guidelines, demonstrates that prohibition is neither practical nor effective. A more strategic approach involves establishing comprehensive governance policies that encourage responsible AI use while managing the risks. Organizations that take the lead in developing GenAI governance policies are better positioned to benefit from its transformative potential. The question isn’t whether GenAI will change how we work, but how quickly organizations can put the right safeguards in place to manage this change successfully. Risks of GenAI Use The use of GenAI in business operations, whether sanctioned or not, exposes organizations to a unique set of risks. The following are particularly relevant: Data security and confidentiality: General GenAI tools in the market may transmit data to external servers, retain conversation histories, and use inputs for model training.
Read More
June 19, 2025
The Bank of Thailand (BOT) has released draft guidelines establishing principles for managing artificial intelligence (AI) risks in the financial sector. The draft guidelines provide a structured framework for the responsible adoption of AI technologies. Financial service providers will be able to use the guidelines as a reference to appropriately manage their risks in a manner that aligns with internationally recognized best practices. The BOT is accepting public comments on the draft guidelines until June 30, 2025. Scope and Application The draft guidelines apply to all financial service providers, including financial institutions and special financial institutions under the Financial Institution Business Act, as well as payment providers under the Payment Systems Act. These guidelines supplement existing BOT risk management guidelines covering IT risk management, third-party risk management, data governance, and market conduct. The guidelines define AI systems as systems that mimic human intelligence, including machine learning, deep learning, generative AI (such as large language models), and agentic AI. This definition specifically excludes rule-based automation systems like robotic process automation and condition matching. Key Risk Management Principles The guidelines lay out two main principles in managing AI risk. Governance: Financial service providers should define and establish clear roles and responsibilities for their personnel and AI system supervision structures to uphold FEAT (fairness, ethics, accountability, and transparency) principles as follows: Stakeholder roles and responsibilities. Financial service providers should define roles and responsibilities for boards and executives on AI risk oversight. Responsibilities include establishing an AI system usage policy, designating personnel responsible for AI risk management, and building awareness of AI-related risk within the organization. AI system usage policy. The AI system usage policy should be aligned with organizational objectives, regulatory requirements, and FEAT principles. These policies should be reviewed regularly to respond to technological advancements and evolving risk profiles. Risk management
Read More
June 19, 2025
Thailand’s Electronic Transactions Development Agency (ETDA) has announced plans for increased enforcement of the Royal Decree on the Operation of Digital Platform Service Businesses That Are Subject to Prior Notification B.E. 2565 (2022). The ETDA outlined a comprehensive enforcement framework and review process during an online meeting with digital platform service operators on June 11, 2025. The ETDA’s enhanced enforcement approach includes systematic reviews of notification submissions, formal correction orders, and potential criminal penalties for noncompliance. Digital platform operators should immediately assess their current notification status and prepare for increased regulatory scrutiny. Review and Amendment of Previously Submitted Notification Data The ETDA will begin reviewing operation notification forms and annual reports submitted by digital platform service operators to assess each platform’s risk level and develop tailored regulatory obligations. In this comprehensive review process, the ETDA will: Examine the accuracy and completeness of submitted notification data; Request additional information as needed by phone or email; and Issue formal orders as needed requiring operators to correct or complete missing information. Operators who fail to comply with ETDA orders may face suspension of operations, revocation of their notification receipt, and public disclosure of their noncompliant status on the ETDA’s website. The ETDA will conduct follow-up workshops in July 2025 for operators whose data remains unclear or incomplete. Enforcement Framework and Penalties The ETDA outlined a three-tiered enforcement framework with escalating consequences for different types of violations, as follows: Failure to notify before commencing operations: Operators who begin services without proper notification may face criminal penalties under the Electronic Transactions Act, including up to one year of imprisonment, fines of up to THB 100,000 (approx. USD 3,070), or both. Additional consequences include suspension of operations and potential liability for company directors. Failure to correct or comply with official orders: Noncompliance with ETDA correction
Read More
June 13, 2025
In today’s digital age, cyberattacks have become a real threat to organizations worldwide. These attacks can range from phishing and malware to ransomware and distributed denial of service (DDoS) attacks. As the frequency and sophistication of these attacks increase, so does the importance of cybersecurity compliance. In the corporate world, compliance refers to the process of ensuring that a company and its employees adhere to all relevant laws, regulations, standards, and ethical practices—but it should not stop there. Compliance should also encompass asset recovery and disciplinary measures, which can both help organizations address incidents effectively and promote good governance. Cyberattacks are malicious attempts to access or damage a computer system or network, often carried out for financial gain, for political activism, or simply to cause disruption. For instance, a successful attack might involve an attacker creating an email address that closely resembles a legitimate one, perhaps by changing only one or two characters. That email address is then inserted into an existing conversation thread, making it appear as if the user with this email address was already part of the discussion. This tactic can easily deceive a recipient into believing the email was sent from a trusted source, thereby leading them to click on malicious links, provide sensitive information, or even make payments in accordance with the attacker’s request or instructions. Phishing attacks like these are particularly dangerous and can have a serious impact on the ongoing business of a corporation because they exploit the trust and familiarity established in the original email chain. Effective Mitigation Approaches Mechanisms for addressing the aftermath of a crisis provide important recourse to affected organizations, but effective compliance mechanisms can minimize the risk of such crises ever occurring. Companies should therefore prioritize preventative measures and implementation of effective crisis management schemes. Various legal
Read More