You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

March 17, 2026

Thailand Issues New Group-Wide Insurance Risk Supervision Rules

Subscribe to Updates

Thailand’s Office of Insurance Commission (OIC) has introduced comprehensive group-wide supervision requirements for insurers operating within corporate groups. Published on February 26, 2026, in two separate notifications in the Government Gazette, the new rules establish parallel frameworks for life and non-life insurance companies. Both notifications take effect on July 1, 2026, and impose significant new requirements on insurance business groups. Affected insurers should begin reviewing their group structures, governance frameworks, and risk management systems now to ensure timely compliance.

The notifications aim to ensure that group-level operations are orderly, stable, and reliable, and prevent the accumulation of systemic risk that could undermine public confidence in the insurance sector. Both notifications share a substantially parallel structure and require insurers to assess and manage the financial position, risk exposure, reliability, and corporate governance of their entire insurance business group on a comprehensive and ongoing basis.

The regulations introduce definitions for several key terms. An “insurance business group” encompasses the insurer together with its ultimate parent company, parent companies, subsidiaries, and related companies. The “head of the insurance business group” is the entity responsible for overseeing group-wide supervision, operations, and governance. An “ultimate parent company” is one that exercises control without itself being controlled by another entity.

Key Requirements

The notifications establish the following core obligations for insurers:

  • Group structure and shareholding reporting: Insurers must report the organizational chart and shareholding structure of their insurance business group—covering the ultimate parent company, parent companies, subsidiaries, and related entities—to the OIC registrar by June of each year, and whenever material changes occur. The regulations prescribe specific thresholds for determining when shareholding proportions constitute control.
  • Corporate governance standards: Board members, executives, and authorized persons of the ultimate parent company or parent company must not be disqualified (e.g., bankrupt individuals, persons convicted of property-related fraud, or persons removed from directorship for misconduct), and their qualifications must be reported to the OIC registrar annually by June of each year and whenever any disqualifying characteristic arises. Additionally, the head of the insurance business group must appoint a dedicated unit or committee for group-level supervision, with authority and responsibilities proportionate to the group’s size, nature, and complexity.
  • Intragroup transactions: All transactions between group entities must be conducted on an arm’s-length basis, with pricing and conditions comparable to those between independent third parties. Insurers must report intragroup transactions to the OIC registrar, ensuring transparency in areas including underwriting, investments, shared services, transfer pricing, mergers, assignments, and other related-party dealings. Where a group entity is located outside Thailand, its impact on the group’s capital, reserves, and risk exposure must not adversely affect the group.
  • Reinsurance: Insurers with intragroup reinsurance arrangements must report those transactions, disclose information relating to intragroup reinsurance in accordance with applicable accounting standards, and manage the risk arising from intragroup reinsurance arrangements.
  • Enterprise risk management and ORSA: Insurers must ensure that insurance business groups implement an enterprise risk management (ERM) framework and conducts an own risk and solvency assessment (ORSA). Group ERM/ORSA reports must be submitted to the OIC registrar. The ERM framework must, at a minimum, include identification of key risk indicators and an acceptable risk appetite; monitoring, evaluation, and control processes with clear reporting lines; internal control and audit mechanisms consistent with the group’s operations; a business continuity management (BCM) plan; and determination of risk limits appropriate to the group’s scale and complexity.
  • Risk management policy and internal audit: The head of the group must establish board-approved, group-wide risk management policies aligned with the group’s business plan and strategy. Internal audit procedures must be established and their effectiveness reported to the OIC registrar regularly. Adequate staff with relevant knowledge, skills, and experience must be allocated at every operational level.
  • Reporting and disclosure: Insurers must file periodic reports with the OIC registrar, including shareholding structure and corporate governance reports, by June of each year. Financial statements of the ultimate parent company or parent company, for fiscal years ending from 2025 onward, must also be submitted to the OIC registrar within six months from the end of each calendar year.

While both notifications take effect on July 1, 2026, transitional provisions grant grace periods for certain requirements. For the year 2026, only reports relating to the following aspects must to be filed with the OIC registrar by July 31, 2026:

  • Intragroup transactions
  • Intragroup reinsurance arrangements
  • Group structure and shareholding structure of insurance business groups
  • Disqualification of board members, executives, and authorized persons of ultimate parent companies or parent companies
  • Structure, authority, and responsibilities of business units or committees supervising insurance business groups
  • Financial statements of ultimate parent companies or parent companies for fiscal years ending in 2025

Recommended Actions

Affected life and non-life insurers operating within corporate groups in Thailand should consider taking the following steps ahead of the July 1, 2026, effective date:

  • Map the insurance business group. Confirm the full group structure, including the ultimate parent company, parent companies, subsidiaries, and related entities, and prepare the required shareholding and organizational charts for filing by July 31, 2026.
  • Review corporate governance. Verify that all board members, executives, and authorized persons of the ultimate parent company and any other parent companies satisfy the qualification requirements and are free from disqualifying characteristics.
  • Assess intragroup transactions. Audit all intragroup transactions for arm’s length compliance and prepare the necessary disclosures for the OIC registrar.
  • Develop or enhance ERM and ORSA frameworks. Ensure that a group-level ERM framework and ORSA process are in place, including key risk indicators, risk appetite, risk limits, BCM plans, and internal audit mechanisms.
  • Establish a dedicated group supervision function. Appoint or formalize the unit or committee responsible for group-level oversight, with clearly defined authority and responsibilities.
Related Professionals

Industries

Insurance

Location

RELATED INSIGHTS​ 

April 2, 2026
Thailand’s Personal Data Protection Act (PDPA) enforcement has entered a new phase, and the insurance industry is squarely in the regulatory spotlight. The Personal Data Protection Committee (PDPC) considers insurers “large-scale” processors of sensitive data—including health records, financial information, and biometric data—making the sector a focal point for enforcement action. In August 2025 alone, the PDPC issued administrative fines totaling THB 21.5 million, and fines for individual violations have ranged from THB 50,000 to THB 2 million. The PDPC has also deployed its “Eagle Eye Crawler,” an AI-driven surveillance tool that monitors websites around the clock for data leaks and noncompliant privacy notices. This article highlights the key regulatory developments directly affecting insurers and outlines practical steps toward compliance. What Has Changed: OIC and PDPC Alignment The Office of Insurance Commission (OIC) has synchronized its sector-specific rules with the PDPA through the Notification on Customer Personal Data Protection (No. 2) B.E. 2568 (2025). The combined effect of the PDPC’s general enforcement push and the OIC’s sectoral guidance creates four critical compliance areas for insurers. Consent unbundling. Consent for marketing must be strictly separated from the core insurance contract; bundling marketing consent into the policy application is no longer permissible. Agent and intermediary oversight. Insurance intermediaries are generally classified as data processors, meaning that insurers—as data controllers—must provide specific written instructions and security protocols to all agents and brokers. A 2026 enforcement trend shows controllers being held liable for the “weak security” of their vendors and downstream processors. Enhanced privacy notices. Insurers must provide a summary privacy notice alongside the full policy, plainly stating categories of data, purposes, lawful bases, disclosure recipients, cross-border transfers, retention periods, data subject rights, and easy marketing opt-out channels. DPO registration and ROPA. All organizations involved in “regular or systematic monitoring of data subjects on
Read More
January 22, 2026
On December 10, 2025, Vietnam’s National Assembly enacted Law No. 139/2025/QH15 amending the Law on Insurance Business. The amendment, effective from January 1, 2026, introduces various changes in an effort to lift restrictions and hurdles for insurance businesses. Key points that may impact the activities of stakeholders in Vietnam’s insurance market are highlighted below. Management Personnel Qualifications To broaden the talent pool while ensuring competency standards, the amended law opens up the positions of director or general director to more candidates. Previously, candidates were required to hold either (i) a university degree or higher in insurance or (ii) a university degree in another discipline and an insurance certificate issued by a qualified insurance training institution. Now, candidates holding a university degree or higher in economics, finance, banking, law, business administration, accounting, or auditing, with at least one insurance‑related module, are also accepted. These changes are expected to mitigate the ongoing challenges faced by insurers in recruiting suitably qualified candidates for key executive positions, while still maintaining appropriate professional standards. Fewer Registrations for Insurance Businesses As part of the legislature’s broader initiative to reduce administrative burdens across all business sectors, the amended Law on Insurance Business relaxes registration requirements for the insurance industry, notably: Insurance enterprises and foreign non‑life insurance branches are no longer required to register and obtain prior approval from the Ministry of Finance (MOF) for their methodologies and bases for calculating premiums for motor vehicle insurance products (excluding compulsory civil liability insurance for motor vehicle owners). Instead, insurance enterprises are now only required to notify the MOF before applying or amending these methodologies. While life insurers must continue to register with the MOF their principles for separating owners’ equity from insurance premium funds, non‑life insurance enterprises and foreign non‑life insurance branches are now only required to notify
Read More
August 8, 2025
Thailand’s Office of Insurance Commission (OIC) has opened a public hearing period on its amendments of notifications concerning the timeframe for an insurance company to submit its annual financial statements and financial and operating reports (called “XML reports”). The amended notifications also require insurance companies to submit some data sets from the quarterly capital maintenance reports and XML reports to the OIC in advance, before the full reports are submitted. Key changes in these amended notifications are summarized below. Financial Statements Audited annual financial statements will need to be submitted to the OIC within two months from the last day of each calendar year (i.e., by the end of February of the following year), instead of within four months as currently required. Capital Maintenance Reports While the deadline for submitting quarterly capital maintenance reports is still 45 days from the last day of the quarter, the OIC will now require life and non-life insurance companies to submit a set of data from the report in advance, within 21 days from the last day of each quarter. This data set includes the following information from the capital maintenance report: Form 1 – Calculation of Capital Adequacy Ratio (CAR) Form 2 – Calculation of Total Capital Available (TCA) Form 4 – Calculation of Capital for Insurance Risk (Table 4.1, 4.2, 4.4, and 4.5 for life insurance companies; Table 4.1 and 4.2 for non-life insurance companies) Financial and Operating Reports (XML Reports) Similar to the audited annual financial statement, the annual XML report will need to be submitted to the OIC within two months from the last day of each calendar year, instead of within the current four-month timeframe. For quarterly XML reports, which must still be submitted within 45 days from the last day of each quarter, there is a new
Read More
June 24, 2025
Insurance specialists from Tilleke & Gibbins in Bangkok have contributed the Thailand chapter to the newly released 2025 edition of Thomson Reuters’ Practical Law guide to insurance and reinsurance. The Thailand chapter offers a comprehensive Q&A-style overview of the legal and regulatory framework governing insurance and reinsurance in the country. It provides key insights for businesses, insurers, reinsurers, and intermediaries operating in or entering the Thai market. Key topics covered include: Market structure and common types of insurance; Regulatory framework and oversight by the Office of Insurance Commission (OIC); Authorisation requirements for insurers, reinsurers, and intermediaries; Ownership restrictions and foreign investment rules; Corporate governance, capital requirements, and solvency obligations; Reinsurance arrangements, including fronting, risk transfer, and common contractual clauses; Policy content requirements, standard clauses, and consumer protections; Claims procedures, statutory time limits, and subrogation rights; Dispute resolution mechanisms, including OIC arbitration and court proceedings; Insolvency protections for policyholders; Tax treatment of insurance and reinsurance businesses in Thailand; Recent legal developments, including pending amendments to the Life and Non-Life Insurance Acts and updated OIC regulations on reinsurance and investment activities. The 2025 edition reflects Thailand’s evolving regulatory environment, including proposed legislative reforms to strengthen corporate governance, risk-based capital requirements, and financial stability in the insurance sector. It also highlights practical considerations for foreign insurers, reinsurers, and intermediaries seeking to participate in Thailand’s insurance market. Tilleke & Gibbins contributes regularly to the Practical Law series of guides for various jurisdictions in Southeast Asia, providing trusted legal insight for multinational companies. To access the latest Thailand chapter of the insurance and reinsurance guide, please visit the Practical Law website and enroll in the free Practical Law trial to gain full access.
Read More