You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 29, 2024

Thailand Updates Requirements for Digital Asset Business Governance and Exchange Rules

Subscribe to Updates

Thailand’s Securities and Exchange Commission (SEC) has revised its regulations on digital asset operators and exchanges to impose stricter governance standards on digital asset business operators and to align digital asset exchange rules with international standards. The new regulations are laid out in SEC Notification No. GorThor. 23/2567 on the Criteria, Conditions, and Procedures for Operating a Digital Asset Business (No. 24) and SEC Notification No. GorLorThor. 24/2567 on Determination of Prohibited Qualifications for Directors and Executives of Digital Asset Business Operators (No. 5). These were published in the Government Gazette on August 16, 2024, with most of the provisions taking effect on the same date.

Governance for Digital Asset Businesses

The heightened standards for digital asset business operators aim to ensure efficient business supervision and appropriate response to operational risks. The new requirements mainly address:

  • Board of directors composition. Large-sized digital asset business operators (i.e., those with at least 10,000 customers and holding customer assets of at least THB 500 million) who do not provide digital asset custodian services must have at least five directors, at least two of whom must be independent directors. In addition, the business operators must establish an audit committee, with at least two members being independent directors, to create an appropriate “check and balance” mechanism within the organizational structure. Current digital asset business operators must comply with the requirements within 180 days of the notification’s effective date.
  • Qualifications of authorized directors and managers. Authorized directors and managers are now required to (1) either have at least one year of working experience in the digital asset field or have participated in a digital asset course from an SEC-approved list, and (2) participate in a good corporate governance course recognized by the SEC. Current authorized directors and managers who have not previously completed a good corporate governance training course must complete such a course within one year of the notification’s effective date.
  • Management and operational structures. Check-and-balance mechanisms are required for every major operational system. Business operators must establish a customer asset management policy, and all customer assets in the business operator’s custody must be managed according to the security risk and by separate personnel from other operational personnel that may have a conflict of interest. Business operators must also provide a customer service system that is suitable to the risk and complexity levels of the relevant types of digital assets.

Exchange Rules

The SEC has also introduced new minimum requirements for digital asset exchange rules, which must be approved by the SEC. The key updates include:

  • Listing and delisting rules. As indicated by a new utility token supervisory scheme that was issued days earlier, group 1 utility tokens are not allowed to be listed on the exchange. (Group 1 utility tokens are those issued for consumption purposes or as a digital representation of a certificate, such as loyalty points, concert tickets, NFTs, and carbon credits.) In addition, listing rules now require adoption of the “silent period” concept, whereby tokens offered for sale below the market price cannot be listed in the six months after the offering. In terms of issuer disclosure, digital asset exchanges must now require digital token issuers to disclose information as stipulated by the SEC.
  • Trading, clearing, and settlement rules. Digital asset exchanges are now required to have a real-time trade monitoring system to detect abnormal trades, and daily monitoring reports must be submitted to the SEC. If the digital asset exchange finds suspicious action, it must promptly report this to the SEC. The digital asset exchange must also have signposting to inform investors about potential risks from investing in certain tokens.
  • Market makers. Digital asset exchanges with market makers must have rules on qualifications, scope of work, ongoing performance supervision, and noncompliance measures relating to market makers.

For more information on these new notifications, or on any aspect of digital assets and cryptocurrency in Thailand, please contact Kobkit Thienpreecha at [email protected], Pornpan Wichawut at [email protected], Napassorn Lertussavavivat at [email protected], or Rujaporn Paritsantik at [email protected].

Related Professionals

Industries

Fintech

Technology

Location

RELATED INSIGHTS​ 

January 13, 2025
The State Bank of Vietnam’s Circular No. 50/2024/TT-NHNN regulating safety and security for the provision of online services in the banking sector (“Circular 50”), issued on October 31, 2024, took effect on January 1, 2025, with delayed effectiveness for certain provisions on (i) network, communication, and security systems, online banking application software, and mobile banking application software (July 1, 2025); (ii) transaction confirmation for payment transactions conducted via the straight-through processing method (January 1, 2026); and (iii) authentication forms and reporting obligations (July 1, 2026). The cybersecurity situation in Vietnam is complicated, and the banking and finance sector has been one of the top targets of high-tech criminals. Circular 50 seeks to enhance user protection by expanding the technical requirements to more services in the banking sector as well as standardizing how transactions are authenticated. Expanded Scope of Services Covered Previous regulations on safety and security of online services in the banking sector only covered banking services and intermediary payment services. Circular 50 expands the scope to include other services of credit institutions and foreign bank branches such as credit information services, foreign exchange services, securities depository services, and services related to factoring and letters of credit, which now need to comply with technical requirements and standards for online services such as firewalls and DMZ network barriers. Risk-Based Approach to Authentication Circular 50 sets out standards for payment transactions and card transactions by: Classifying various online transactions based on the type of client, the purpose of the transfer, the value of the specific transaction, and the total value of certain transactions during the day; and Applying various types of authentication for the corresponding types of online transactions, e.g., using passwords or PINs for small-value online transactions, and using OTPs (through SMS, voice, or email), biometric matching, or e-signatures for
Read More
January 10, 2025
On January 8, 2025, Thailand’s Office of the Personal Data Protection Committee published two notifications in the Government Gazette—one for data controllers and the other for data processors—concerning exemptions for data controllers and data processors from the requirement to create and maintain records of processing activities (ROPAs) under the Personal Data Protection Act B.E. 2562 (2019). The notification for data processors took effect on January 9, 2025, the day after its publication. The notification for data controllers will take effect on April 8, 2025. The content of these notifications is identical to that in the draft versions of the notifications previously released for public consultation in October 2024. For more information on the ROPA exemptions for data controllers and data processors, or on any aspect of personal data protection in Thailand, please contact Nopparat Lalitkomon at [email protected] or Wilin Somya at [email protected].
Read More
January 9, 2025
On January 1, 2025, Myanmar’s State Administration Council enacted Cybersecurity Law No. 1/2025, which aims to regulate various aspects of digital security and online activities. The law has not yet been implemented and will come into force on a date specified by the Myanmar president, who will also provide an official adoption and compliance timeline for individuals and organizations impacted by the new regulations. Below are some of the key provisions, implications, and penalties under the Cybersecurity Law. Extraterritorial penalties. The law contains an important provision that authorizes penalties against Myanmar citizens who are found guilty of violations, even if these occur outside the country’s borders. VPN definition and regulation. Virtual private networks (VPNs) are defined by this law as specific systems that function as backup networks by using technological means in order to ensure the safety of linking networks to each other. This definition sets the framework for subsequent regulations and penalties associated with VPN usage. The law does not restrict individuals or entities from using VPNs; it regulates VPN service providers. Penalties for unapproved VPN services. Establishing a VPN or providing VPN services without approval from the designated ministry (to be appointed later by the government) can result in significant penalties. For individuals, the punishment may be imprisonment for 1–6 months, a fine of MMK 1–10 million (approx. USD 476–4,760), or both, with the proceeds of the violation being confiscated. If the violator is a company or organization, the minimum fine will be MMK 10 million, and the proceeds will be confiscated. Government oversight. The ministry designated by the government is authorized to investigate and take control of cybersecurity services and digital platform services for national defense and security purposes, or upon request from a government department or organization in accordance with respective laws. Licensing requirements. The
Read More
January 9, 2025
Thailand’s Fiscal Policy Office (FPO) has released a draft of its planned Financial Business Hub Act, which is in line with the government’s aim of positioning Thailand as a regional financial hub and a critical player in the global economy. The draft act, on which the FPO is accepting comments until January 9, 2025, details the framework for promoting and attracting international financial businesses and related services to operate in Thailand, proposes various incentives, and outlines supervisory guidelines. This article examines key elements of the draft Financial Business Hub Act relevant to financial business operators. Incentivized Financial Businesses The draft act identifies the financial businesses to be promoted and incentivized. These target businesses include: Commercial banking businesses, Payment service businesses, Securities businesses, Derivatives businesses, Digital assets businesses, Insurance and reinsurance brokerage businesses, and Other financial-related businesses as determined by the Committee for the Supervision and Promotion of Financial Centers. Thailand’s finance minister explained that initially, the draft law intends to target businesses using an “out-out” model, which describes the raising of capital abroad for investment abroad, before expanding to an “out-in” model, in which capital is raised abroad for investment domestically. Therefore, the draft law currently specifies that the target businesses must only provide services to nonresidents without soliciting residents of Thailand to use their services. Authorization Targeted financial business operators will need to receive authorization from the Committee for the Supervision and Promotion of Financial Centers. The main eligibility criteria for authorization are the incorporation an entity (e.g., a company registered in Thailand, a branch of a foreign juristic person) with an office in designated areas to be specified in a royal decree (currently expected to be Bangkok and adjacent provinces) and the possession of other qualifications as prescribed in the draft act. Target businesses in Thailand will
Read More