The Bank of Thailand (BOT) has announced its new Enhanced Regulatory Sandbox, which provides an opportunity to experiment with currently restricted financial innovations under a controlled environment. The BOT is employing a thematic approach to determine the scope of technology or innovations that may participate in the Enhanced Regulatory Sandbox and will only accept applications in each theme for a limited period. The first announced theme is “programmable payments,” which refers to payment and payment-related transactions with automatic execution upon the fulfillment of a predefined condition utilizing distributed ledger technology (DLT) and a smart contract or comparable technology in which electronic data units are issued on an electronic system or network. The application period for programmable payment testing in the Enhanced Regulatory Sandbox runs from June 13 to September 13, 2024. A summary of the programmable payment testing framework under the Enhanced Regulatory Sandbox is provided below. Scope The Enhanced Regulatory Sandbox accepts applications for the following programmable payment activities: Automated payment and settlement upon fulfillment of predefined conditions. Escrow services with predefined delivery or transactional conditions. Asset tokenization through issuance of digital tokens representing rights in an asset, with payment for tokens or payment of benefits or returns to holders of digital tokens occurring automatically when conditions are met. Other testing related to the items mentioned above. Requirements and Conditions Programmable payment testing activities in the Enhanced Regulatory Sandbox must comply with the following requirements and conditions: Electronic data units issued for programmable payment testing must be pegged to the Thai baht (THB) on a one-for-one basis (i.e., 1 unit = THB 1), with the float account storing THB equal to the value of the electronic data units issued. Participants must define the redemption rights of the unitholders and proceed with the THB redemption according to the participants’

On May 24, 2024, the Central Bank of Myanmar (“CBM”) issued a public notice warning individuals against participating in the sale, purchase, exchange, or transfer of unregulated digital currencies, as well as unauthorized money transfers. The CBM has indicated its readiness to enforce regulations by closing bank accounts and pursuing legal action, which may result in imprisonment, fines, or both, in accordance with the Central Bank of Myanmar Law, the Anti-Money Laundering Law and the Financial Institutions Law. The CBM is the sole legal entity authorized to issue currency in Myanmar, as stipulated in the Central Bank of Myanmar Law. The CBM does not recognize digital currencies as official currency, nor has it granted permission to financial institutions within Myanmar to trade them. The existing legal framework, comprising the Foreign Exchange Management Law and the Financial Institutions Law, further cements the illegality of cryptocurrency transactions within the nation’s borders. Four years ago, in May 2020, the CBM issued Notification No. 9/2020, prohibiting all persons residing in Myanmar from engaging in the sale, purchase, or exchange of unregulated digital currencies. The list of prohibited currencies includes widely recognized cryptocurrencies such as Bitcoin (BTC), Litecoin (LTD), Ethereum (ETH), and Perfect Money (PM), with a particular emphasis on transactions conducted through personal Facebook accounts and web pages. Before the issuance of the 2020 notification, the CBM had announced that anyone engaging in digital currency transactions did so at their own risk, but no enforcement measures were being taken at the time. However, after the 2020 notification was issued, the CBM has pursued legal action against persons involved in illegal currency conversion and unauthorized hundi money transfers using Tether (USDT). These enforcement measures have included shutting down bank accounts and initiating legal proceedings under the Anti-Money Laundering Law and the Financial Institutions Law.

On May 1, 2024, Thailand’s National Cyber Security Committee (NCSC) published the draft NCSC Notification Re: Cloud Cybersecurity Standards for a public hearing period, which was open until May 14, 2024. These standards have been drafted to drive the country’s cloud-first policy with the aim of minimizing risks from cyber threats to cloud services utilized by government agencies, supervising or regulating organizations, and critical information infrastructure (CII) organizations. The key points of the draft Cloud Cybersecurity Standards are below. Scope The standards apply to government agencies, supervising or regulating organizations, and CII organizations under the Cybersecurity Act B.E. 2562 (2019), as well as cloud service providers (defined below). The standards prescribe cloud system cybersecurity measures for cloud service customers (defined below) and providers only to the extent that the service is provided to the in-scope organizations outlined above. Definitions Cloud service customers (CSCs): In-scope organizations that have a formal contractual agreement to use cloud services provided by a cloud service provider. Cloud service providers (CSPs): Persons who enable cloud services to be used by a cloud service customer, responsible for maintaining infrastructure, platforms, and software that enable provision of the cloud services and for managing these resources to ensure their accessibility, security, and scalability for their cloud service customers. Application In-scope organizations that will use or have been using cloud services must comply with the Cloud Cybersecurity Standards by taking into account their data or technology information systems’ level of impact, as specified in the previously issued Notification of the NCSC Re: Standards for Defining the Security Category for Data and Information Systems B.E. 2566 (2023). The impact level related to personal data is to be rated as being at least at the medium level, and the minimum standards for that level specified in the draft Cloud Cybersecurity Standards

On May 2, 2024, Vietnam’s Ministry of Justice published on its online platform the most recent version of the draft decree on administrative sanctions for violations in the field of cybersecurity (“Draft Sanction Decree”) to gather feedback and contributions from the community and stakeholders. After receiving the Ministry of Justice’s assessment, the Ministry of Public Security (“MPS”), in charge of drafting the Draft Sanction Decree, may make further revisions before submitting it to the government for review and final decision on enactment. The decree is expected to have an effective date of June 1, 2024. The stringent penalties for infringements involving personal data of the previous draft version remain in this Draft Sanction Decree—a sign of the proactive stance of the MPS in enforcing the Personal Data Protection Decree (“PDPD”). Effective Date and Transitional Provisions It is important to note that the Draft Sanction Decree does not impose any new obligations on organizations or individuals, and only sets out the administrative sanctions that could be imposed on violators as soon as June 1, 2024, which is indicated as the effective date in Article 49. This signals the MPS’s eagerness to begin taking enforcement actions against recalcitrant organizations and individuals that have not complied with the various obligations imposed on them under the Law on Network Information Security (enacted in 2015), the Law on Cybersecurity (enacted in 2018) and its guiding decree (Decree 53 – enacted in 2022), and the most recent PDPD (enacted in 2023). Article 50.1 of the Draft Sanction Decree outlines the transitional provisions regarding administrative violations in the cybersecurity field. It clarifies that the decree does not have retroactive effect, by stating that violations occurring before its effective date, but discovered or under review after such effective date will be subject to the regulations on administrative