Recent events at a Thai listed company, where a proposal to remove the director was not successful, amid claims that a competitor was attempting to gain control of the company, illustrate how disputes over corporate control can unfold differently at the board level and shareholder level. At the board level, removing directors of a listed company mid-term to gain corporate control is not an easy task under Thai law, as it requires a higher threshold than appointing a new director, which typically only requires a simple majority vote in a listed company. At the shareholder level, Thailand’s tender offer and competition regimes add complexity where different shareholder groups act in concert to remove opposing board representatives or otherwise influence control. In this article, we will explore why the attempted removal of a director may fail, and how the tender offer regime may apply. Key Issues at a Glance Shareholder groups may seek to convene meetings to propose changes to board composition or company authority. Such proposals can be delayed or complicated by regulatory requirements and the need for additional disclosures. Regulatory authorities and minority shareholders may raise concerns when major shareholders coordinate to influence board control, especially if such actions could trigger tender offer or merger control obligations. Companies often respond by seeking further information on shareholder relationships and potential conflicts before proceeding. Why the Director Removal Failed Under Section 76 of the Public Limited Companies Act B.E. 2535 (as amended), the early removal of a director requires two conditions to be satisfied at the same meeting of shareholders: Headcount test: At least 75% of shareholders attending and entitled to vote must vote in favor. If multiple shareholders appoint the same person as proxy, each proxy is counted as a separate head for the purpose of the headcount test,

In September 2025, Thailand’s Securities and Exchange Commission (SEC) accused a company listed on the Stock Exchange of Thailand (SET), including its current and former directors, of concealing material information in connection with its filing registration and draft prospectus. This recent enforcement action demonstrates the serious consequences of making false statements or appearing to conceal material information in IPO filings and ongoing disclosures. In addition to being subject to criminal penalties, such actions can impact the eligibility of directors and executives to serve and may cause lasting reputational damage. Key Legal Risks The Securities and Exchange Act B.E. 2535 (1992) (as amended) imposes strict liability for making false statements or concealing material information in IPO registration statements and draft prospectuses. In such cases, investors can claim for damages, and there are also criminal penalties, including imprisonment for up to five years and substantial fines, may apply to the company, its directors, and responsible officers. However, misstatements or omissions in IPO filings do not, by themselves, disqualify directors or executives from holding office, whether arising from an SEC accusation or even a final court judgment. In contrast, for ongoing disclosures after listing, such as financial statements, annual reports, and meeting notices, false or misleading statements or concealment of material information can result in not only criminal liability but also immediate disqualification of directors and executives. If the SEC accuses a listed company or its directors or executives of such misstatements or omissions, those directors or executives are immediately disqualified from their positions, even before a final court judgment. Director and Executive Qualifications Directors and executives must meet the SEC’s specified standards of trustworthiness, as set out in the relevant rules. The SEC clearly defines characteristics that are considered to demonstrate a lack of trustworthiness. For ongoing disclosures, being involved in

On September 12, 2025, the Bank of Thailand (BOT) officially released its AI Risk Management Guidelines for Financial Service Providers, building upon the draft guidelines issued in June 2025. The guidelines reflect a balanced approach, encouraging innovation while safeguarding financial stability and consumer protection. The guidelines are targeted at all financial service providers, including financial institutions and special financial institutions under the Financial Institution Business Act, as well as payment providers under the Payment Systems Act. The guidelines apply to both AI systems developed in-house and those developed by third parties that are adopted for use by financial service providers. AI Risk Management Guidelines The two main pillars in managing AI risk are (1) governance of AI system implementation and (2) AI system development and security controls, consisting of the following key elements: 1. Governance Stakeholder roles and responsibilities. Boards and senior management assume accountability for decisions and operations involving AI systems, and are responsible for defining roles and responsibilities for AI oversight. This includes establishing an AI system usage policy, designating personnel responsible for AI risk management, and building awareness of AI-related risk within the organization. Organizations are expected to foster internal capabilities to use AI securely and avoid overreliance that could compromise business continuity or customer service. AI system usage policy. Policies governing AI usage should align with organizational goals, regulatory obligations, and recognized responsible AI frameworks—such as the FEAT principles (fairness, ethics, accountability, and transparency). These policies should be reviewed regularly to respond to technological advancements and evolving risk profiles. Risk management throughout the AI lifecycle. Risk management should encompass the entire AI lifecycle, from establishing risk appetite to implementing continuous risk assessment and control measures tailored to specific use cases. Financial service providers should assess risks and impacts of AI usage on operations and customer services.

On September 10, 2025, Vietnam’s National Credit Information Center (CIC) reported to the Vietnam Cybersecurity Emergency Response Team (VNCERT) a suspected significant cybersecurity incident involving unauthorized access to the CIC’s credit information database. A hacker group has claimed responsibility and allegedly posted over 160 million records for sale, including sensitive personal and financial data. Implications for Banks and Financial Institutions Companies that share customers’ or potential customers’ personal data with the CIC for credit scoring or other purposes—and continue to act as a data controller for such data—may be obligated under Vietnam’s Personal Data Protection Decree (PDPD) and related regulations to: Notify A05 (Department of Cybersecurity and High-Tech Crime Prevention) and the State Bank of Vietnam without delay. Inform affected individuals if their personal data is at risk. Recommended Actions Companies that could be impacted by this data breach should take the following actions: Conduct an internal review of CIC-related data in their systems, and identify whether and how the systems have been affected by this incident. Assess whether to notify regulators and customers/potential customers. Enhance cybersecurity controls, monitor for suspicious activity, and implement additional safeguards to prevent secondary breaches.