You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

March 17, 2026

Thailand Issues New Group-Wide Insurance Risk Supervision Rules

Subscribe to Updates

Thailand’s Office of Insurance Commission (OIC) has introduced comprehensive group-wide supervision requirements for insurers operating within corporate groups. Published on February 26, 2026, in two separate notifications in the Government Gazette, the new rules establish parallel frameworks for life and non-life insurance companies. Both notifications take effect on July 1, 2026, and impose significant new requirements on insurance business groups. Affected insurers should begin reviewing their group structures, governance frameworks, and risk management systems now to ensure timely compliance.

The notifications aim to ensure that group-level operations are orderly, stable, and reliable, and prevent the accumulation of systemic risk that could undermine public confidence in the insurance sector. Both notifications share a substantially parallel structure and require insurers to assess and manage the financial position, risk exposure, reliability, and corporate governance of their entire insurance business group on a comprehensive and ongoing basis.

The regulations introduce definitions for several key terms. An “insurance business group” encompasses the insurer together with its ultimate parent company, parent companies, subsidiaries, and related companies. The “head of the insurance business group” is the entity responsible for overseeing group-wide supervision, operations, and governance. An “ultimate parent company” is one that exercises control without itself being controlled by another entity.

Key Requirements

The notifications establish the following core obligations for insurers:

  • Group structure and shareholding reporting: Insurers must report the organizational chart and shareholding structure of their insurance business group—covering the ultimate parent company, parent companies, subsidiaries, and related entities—to the OIC registrar by June of each year, and whenever material changes occur. The regulations prescribe specific thresholds for determining when shareholding proportions constitute control.
  • Corporate governance standards: Board members, executives, and authorized persons of the ultimate parent company or parent company must not be disqualified (e.g., bankrupt individuals, persons convicted of property-related fraud, or persons removed from directorship for misconduct), and their qualifications must be reported to the OIC registrar annually by June of each year and whenever any disqualifying characteristic arises. Additionally, the head of the insurance business group must appoint a dedicated unit or committee for group-level supervision, with authority and responsibilities proportionate to the group’s size, nature, and complexity.
  • Intragroup transactions: All transactions between group entities must be conducted on an arm’s-length basis, with pricing and conditions comparable to those between independent third parties. Insurers must report intragroup transactions to the OIC registrar, ensuring transparency in areas including underwriting, investments, shared services, transfer pricing, mergers, assignments, and other related-party dealings. Where a group entity is located outside Thailand, its impact on the group’s capital, reserves, and risk exposure must not adversely affect the group.
  • Reinsurance: Insurers with intragroup reinsurance arrangements must report those transactions, disclose information relating to intragroup reinsurance in accordance with applicable accounting standards, and manage the risk arising from intragroup reinsurance arrangements.
  • Enterprise risk management and ORSA: Insurers must ensure that insurance business groups implement an enterprise risk management (ERM) framework and conducts an own risk and solvency assessment (ORSA). Group ERM/ORSA reports must be submitted to the OIC registrar. The ERM framework must, at a minimum, include identification of key risk indicators and an acceptable risk appetite; monitoring, evaluation, and control processes with clear reporting lines; internal control and audit mechanisms consistent with the group’s operations; a business continuity management (BCM) plan; and determination of risk limits appropriate to the group’s scale and complexity.
  • Risk management policy and internal audit: The head of the group must establish board-approved, group-wide risk management policies aligned with the group’s business plan and strategy. Internal audit procedures must be established and their effectiveness reported to the OIC registrar regularly. Adequate staff with relevant knowledge, skills, and experience must be allocated at every operational level.
  • Reporting and disclosure: Insurers must file periodic reports with the OIC registrar, including shareholding structure and corporate governance reports, by June of each year. Financial statements of the ultimate parent company or parent company, for fiscal years ending from 2025 onward, must also be submitted to the OIC registrar within six months from the end of each calendar year.

While both notifications take effect on July 1, 2026, transitional provisions grant grace periods for certain requirements. For the year 2026, only reports relating to the following aspects must to be filed with the OIC registrar by July 31, 2026:

  • Intragroup transactions
  • Intragroup reinsurance arrangements
  • Group structure and shareholding structure of insurance business groups
  • Disqualification of board members, executives, and authorized persons of ultimate parent companies or parent companies
  • Structure, authority, and responsibilities of business units or committees supervising insurance business groups
  • Financial statements of ultimate parent companies or parent companies for fiscal years ending in 2025

Recommended Actions

Affected life and non-life insurers operating within corporate groups in Thailand should consider taking the following steps ahead of the July 1, 2026, effective date:

  • Map the insurance business group. Confirm the full group structure, including the ultimate parent company, parent companies, subsidiaries, and related entities, and prepare the required shareholding and organizational charts for filing by July 31, 2026.
  • Review corporate governance. Verify that all board members, executives, and authorized persons of the ultimate parent company and any other parent companies satisfy the qualification requirements and are free from disqualifying characteristics.
  • Assess intragroup transactions. Audit all intragroup transactions for arm’s length compliance and prepare the necessary disclosures for the OIC registrar.
  • Develop or enhance ERM and ORSA frameworks. Ensure that a group-level ERM framework and ORSA process are in place, including key risk indicators, risk appetite, risk limits, BCM plans, and internal audit mechanisms.
  • Establish a dedicated group supervision function. Appoint or formalize the unit or committee responsible for group-level oversight, with clearly defined authority and responsibilities.
Related Professionals

Industries

Insurance

Location

RELATED INSIGHTS​ 

May 28, 2025
Tilleke & Gibbins attorneys in Vietnam have contributed the 2025 edition of Doing Business in Vietnam, a comprehensive Q&A-style resource from Thomson Reuters Practical Law that provides essential insights for companies navigating business operations in Vietnam. The guide presents a detailed overview of the country’s legal framework and regulatory environment, reflecting recent updates in Vietnamese legislation and practice. This annually updated guide offers key information on the following areas: Legal system: Structure of the Vietnamese judiciary and the role of codified law. Foreign investment: Conditions for market access, licensing requirements, foreign ownership restrictions, and investment incentives. Business vehicles: Formation and operation of legal entities, including limited liability companies, joint-stock companies, and representative offices. Employment: Employment contracts, social insurance, labor rights, and procedures for hiring foreign nationals. Tax: Overview of corporate income tax, personal income tax, value-added tax, and other tax obligations. Intellectual property: Procedures for protecting and enforcing patents, trademarks, copyrights, and other IP rights. Data protection: Compliance requirements under Vietnam’s data privacy laws, including the Personal Data Protection Decree. Competition law: Antitrust rules and regulatory oversight under the Law on Competition. Anti-bribery and corruption: Legal framework and enforcement practices aimed at curbing corrupt activities. E-commerce and digital business: Regulations governing online platforms, digital content, and cross-border services. Marketing and advertising: Laws and guidelines on advertising standards and consumer protection. Product regulation and liability: Safety requirements, product liability issues, and roles of relevant authorities. Doing Business in Vietnam is part of Practical Law’s global series of legal guides designed to support international practitioners and businesses. To access the most recent edition of the Vietnam guide, visit the Practical Law website and sign up for a free trial.
Read More
May 2, 2025
Attorneys from Tilleke & Gibbins have updated the latest edition of Doing Business in Thailand, a Q&A-style guide from Thomson Reuters Practical Law that offers an overview of key legal considerations for companies operating in jurisdictions worldwide. The contribution outlines the country’s legal and regulatory framework for foreign investment and business operations and reflects the latest legislative developments. The chapter addresses the following core topics: Legal system: Structure of the courts and the codified nature of Thai law. Foreign investment: Business restrictions under the Foreign Business Act, sector-specific regulations, exchange control rules, and investment incentives. Business vehicles: Overview of partnerships, private and public limited companies, and other legal entities. Employment: Labor protections, employment contracts, foreign worker requirements, and termination procedures. Tax: Corporate and personal income tax, indirect taxes, and tax obligations for residents and non-residents. Intellectual property: Registration and enforcement of patents, trademarks, designs, and copyrights. Data protection: Key provisions of the Personal Data Protection Act and related compliance obligations. Competition law: Regulatory framework under the Trade Competition Act. Anti-bribery and corruption: Relevant legislation and enforcement mechanisms. E-commerce and digital business: Legal regime for online transactions and digital platforms. Marketing and advertising: Consumer protection laws and regulations affecting advertising and marketing practices. Product regulation and liability: Safety standards, liability regimes, and roles of enforcement authorities. Practical Law, a legal reference resource from Thomson Reuters, publishes a range of guides for hundreds of jurisdictions and practice areas. The insurance and reinsurance guide is a valuable resource for legal practitioners, covering numerous jurisdictions worldwide. To view the latest version of the guide, please visit the Practical Law website and enroll in the free Practical Law trial to gain full access.
Read More
April 29, 2025
On April 11, 2025, Thailand’s Office of Insurance Commission (OIC) released draft principles for two notifications for public comment, open until the end of April. These aim to amend the OIC Notifications on Guidelines for Customer Personal Data Protection for life and non-life insurance businesses, which were issued in 2021. Key Principles Both life and non-life insurance companies will be required to obtain consent for the following processing activities: Processing of general personal data: When requesting the OIC to disclose information related to a customer’s insurance policy for the purpose of underwriting or claims consideration. Processing of sensitive personal data: When requesting the OIC to disclose information related to a customer’s insurance policy for the purpose of underwriting or claims consideration; and When requesting the OIC to disclose information about a customer’s insurance fraud behavior for fraud monitoring, fraud risk management, and assessing and preventing insurance fraud risk for underwriting or claims payment. The consent for the above processing activities must be in accordance with the consent requirements prescribed by the OIC, and the disclosure of personal data must also comply strictly with the conditions set by the OIC. Life insurance companies may obtain consent for other purposes as long as they comply with Thailand’s Personal Data Protection Act B.E. 2562 (2019), and companies will be liable in the event of a personal data breach. Additional Principles for Non-Life Insurance Businesses Non-life insurance companies will be required to provide a privacy notice and a summary of the privacy notice for each type of insurance policy in accordance with the form prescribed by the OIC. The privacy notice and its summary must be provided prior to or at the time of offering insurance policies, or together with the consent form for data processing through any channels used for offering insurance.
Read More
April 1, 2025
The collapse of a building under construction in Bangkok on March 28, 2025, following a powerful earthquake in Myanmar has sparked widespread public concern about the potential financial impact on local insurers and insurance implications. The construction site was insured under a contractors’ all risks (CAR) policy, and initial reports and market speculation suggest that the event could cause serious financial strain for the domestic insurance industry. Nevertheless, local insurers connected to the site of the collapse may face limited exposure for two main reasons: Reinsurance significantly mitigates local insurers’ exposure. According to market sources, 95% of the CAR coverage for the construction site was reinsured by foreign reinsurers. This is standard risk-management practice for large-scale infrastructure and construction projects, allowing local insurers to participate in underwriting while transferring most of the liability offshore. As a result, the direct financial impact on domestic insurers is expected to be minimal, subject to the reinsurance contracts and any potential claims disputes. Potential exclusions may apply. The Thai General Insurance Association has issued an interim public advisory noting that coverage under the CAR policy may be limited or excluded altogether, pending a full investigation. CAR policies often contain exclusions for certain events, depending on how the policy is worded and the actual cause of the incident. A thorough factual and forensic investigation will be necessary to determine the true cause and assess policy applicability. For further information or assistance in reviewing CAR or project insurance coverage in Thailand, please contact Athistha (Nop) Chitranukroh at [email protected], Witchupong Chittchang at [email protected], or Ajaree Trachukul at [email protected].
Read More