You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

November 29, 2017

Thailand’s Payment Systems Act 2017: Electronic Payments and Bankruptcy

Informed Counsel

In October 2017, the Thai government published the Payment Systems Act in the Government Gazette, setting out the framework for a new licensing and registration regime to regulate electronic payment business operators and putting in place several provisions for a stable and reliable e-payment ecosystem. The Act is expected to facilitate the offering of many new and innovative payment services in Thailand. Operation of the new regime will depend on forthcoming regulations, which are yet to be issued, and it is necessary to await those regulations before offering any actionable commentary on that aspect of the Act. However, some other aspects of the Act, which have drawn less attention, have a significant effect and are very worthy of attention.

Electronic payments have been governed under multiple laws and layers of regulations which, until now, have lacked statutory provisions for finality of payment. This raises a concern that if a payment system participant enters into receivership or reorganization, transactions involving that participant could be canceled or reversed, which can affect other participants in the payment system; for example, where a recorded transfer is not funded or settlement fails. If the payments are for a large amount of money, this problem could spread even more broadly to other payment systems and other participants in them. In extreme scenarios, cancellations or reversals of high-value payments could present serious risks to the entire financial system affecting both banks and non-banks.

Protecting “Important” Payment Systems

The Act sets out provisions for dealing with this issue, which are applicable to participants in “important” payment systems, the security or stability of which can have an impact on the financial institution system or the financial system of Thailand. To be regarded as an important payment system, a system must:

  1. be part of the main infrastructure of the country, trouble with or disruption of which would have a broad effect on the continuity of its participants’ business; and
  2. be a system that supports high-value transfers or that is used for clearing or settlement among its members.

Any payment systems established or operated by the Bank of Thailand (e.g., BAHTNET and the imaged check clearing system) are deemed to be important payment systems. Beyond those, the Minister of Finance has the authority, on the recommendation of the Bank of Thailand, to specify important payment systems in secondary legislation. Therefore, private-sector payment systems could also be designated as important, if specified in ministerial regulations, meaning that these provisions would also be applicable to their participants.

The Act provides that, where a court accepts a reorganization petition in respect of a participant in an important payment system, or orders the participant into receivership, any of the participant’s transfers, clearing, and settlement that were pending before the court order must continue until completion under the payment system rules, but not beyond the end of the date of the court order. The law makes it clear that such transactions cannot be reversed, modified, stopped, or suspended, and that statutory provisions for revocation of a fraudulent act or other act under the Civil and Commercial Code or the Bankruptcy Act cannot affect the validity of such a payment system’s operations. Further, any cash, securities, or instruments that such a participant maintains in the payment system, must be protected, and must not be distributed to the participant’s creditors without the Bank of Thailand’s approval. Each of these measures is important to ensure that instructed transfers are made, and that settlement successfully occurs, despite a participant’s bankruptcy. In that sense, it can help to contain what could otherwise be a contagion.

Protecting Customers of “Payment Service Providers”

For a similar purpose, the Act also sets out provisions for payment service providers that hold customer funds. “Payment service providers” under the Act will include providers of: (1) credit, debit, and ATM cards; (2) e-money; (3) electronic payment services to a seller, service provider, or creditor; (4) electronic money transfer services; and (5) other payment services that may affect the financial system or public interest, and others that may be specified by royal decree.

While current regulations already require certain categories of electronic payment business operators to establish separate bank accounts for holding customer funds, the Act  expands on them.

Specifically, the Act protects customer funds held by a payment service provider from disposal or transfer under a court order, in the following circumstances:

  1. where the service provider suspends its operations under the Payment Services Act or another law;
  2. if a petition for reorganization is filed in respect of the payment service provider;
  3. if a petition is filed in bankruptcy court in respect of the payment service provider; or
  4. if the court orders the payment service provider into receivership.

Further, if a payment service provider is a judgment debtor in a civil case or is ordered into receivership, any customer funds that it holds will not be subject to attachment or execution, and will not be distributed to the payment service provider’s creditors.

In the case of receivership, the Act provides that the Bank of Thailand will return customer funds to the customers, transfer the accounts to another payment service provider, and/or take other actions necessary to conclude business with the customer funds. Customers unrelated to the payment service provider will have priority over those that are related. Any remaining compensation due would be subject to regular bankruptcy proceedings.

The new Payment Services Act offers the possibility of many innovative services for customers in Thailand to enjoy. From a legal standpoint, however, perhaps the greatest achievement of the Act is the security and stability of payment finality and the protection of customer funds.

RELATED INSIGHTS​ 

February 10, 2026
Data center and cloud investments are forming a major focus of private-sector investment in Thailand, with tech giants like Amazon, Google, Microsoft, and TikTok, as well as numerous telecom and data center companies, committing significant outlays to data center and cloud development. The country’s Board of Investment (BOI) approved projects worth THB 1.87 trillion in 2025, and THB 746 billion of this was from planned data center investments—by far the largest amount from any single industry. Thailand’s swift rise as a regional data center hub is fueled by surging demand for cloud, AI, and digital services, as well as large-scale investments from global tech firms. The country’s strategic location, competitive power costs, robust fiber infrastructure, expanding IT talent, and supportive government policies—including BOI incentives and streamlined approvals—have made it an attractive destination for scalable and sustainable digital infrastructure investments. The BOI’s proactive approach in updating promoted categories and providing both tax and non-tax incentives further ensures Thailand’s continued growth in this sector. 2025 BOI Changes for Data Centers In the middle of 2025, the BOI responded to the remarkable trend by updating investment‑promotion categories across various sectors (e.g., machinery and electrical equipment, public utilities, digital and innovative industries) to accommodate growing investment in data‑center projects. Before the change, which was detailed in a notification that has applied to investment promotion applications submitted from July 1, 2025, onward, data‑center projects under BOI promotion were granted a single A1 incentive (an eight‑year corporate income‑tax exemption) and subject to one uniform set of conditions. The July 2025 notification restructured promotion for data centers into two categories based on power‑usage efficiency: high‑efficiency data centers and other data centers. Under these rules, qualified high‑efficiency data centers are eligible for an eight‑year corporate income tax (CIT) exemption, while for other data centers this exemption is
February 4, 2026
On November 18, 2025, Vietnam’s Ministry of Finance released for public consultation a draft decree on administrative sanctions in the field of crypto assets and crypto asset markets (the “Draft Decree”), intended to implement Resolution No. 05/2025/NQ-CP dated September 9, 2025, on the pilot crypto asset market in Vietnam (“Resolution 05”). While Resolution 05 sets out who may participate and under what conditions, the Draft Decree addresses a more practical question for market participants, i.e., what happens if those conditions are not met. In doing so, the Draft Decree offers important insight into how Vietnamese regulators intend to supervise, discipline, and ultimately shape the crypto market during the pilot phase. Regulatory Scope and Overall Sanctions Architecture The Draft Decree applies to both domestic and foreign organizations and individuals engaging in crypto-related activities in Vietnam’s market. Covered entities include: (i) crypto asset issuers; (ii) crypto asset service providers, including trading platforms and market operators; (iii) Vietnamese and foreign investors participating in the pilot market; and (iv) other organizations involved in the offering, issuance, or provision of crypto-related services in Vietnam. The breadth of this scope is deliberate. It appears to reflect a regulatory view that cross-border structures, offshore platforms, and indirect participation may not necessarily insulate market actors from compliance obligations once they operate within the pilot framework. For the crypto industry, this may mark a shift from regulatory ambiguity toward a more explicit articulation of jurisdictional reach. At first glance, the Draft Decree’s monetary penalties appear restrained. The maximum fine per administrative violation is capped at VND 200 million (approx. USD 7,700) for organizations and VND 100 million (approx. USD 3,800) for individuals. However, focusing solely on fine levels risks missing the point. The Draft Decree also places great regulatory weight on supplementary sanctions and corrective measures, including: (i)
January 30, 2026
Thailand’s Data Privacy Day 2026, hosted by the Office of the Personal Data Protection Committee (PDPC), underscored the country’s commitment to strengthening personal data protection, advancing regulatory maturity, and preparing organizations for the next phase of PDPA enforcement. The event marked a clear shift from policy-level compliance toward “Privacy in Action,” signaling that operational readiness and real-world implementation are now priorities. The Office of the PDPC also emphasized that data protection is now a national economic enabler that supports digital trust, competitiveness, and sustainable growth, not just a compliance obligation. The following insights summarize the key takeaways from the Data Privacy Day 2026 event. PDPA in Real Life: What Happens to Your Data Today The Office of the PDPC provided concrete data on enforcement trends and real-world compliance issues facing organizations across Thailand. Complaints and trends. The Office of the PDPC’s Personal Data Protection Act (PDPA) Center recorded 2,672 PDPA-related complaints as of January 2026, with the highest volumes involving failure to comply with the data minimization principle, collection without lawful basis, and use and disclosure without lawful basis. Administrative penalties. Several administrative penalties have been imposed on data controllers and data processors across various sectors, including government, healthcare, retail, SMEs and e-commerce, ranging from tens of thousands to several million baht. Most violations stemmed from weak security measures, failure to notify data breaches within the required timeline, absence of a data protection officer (DPO) when required, and noncompliance with governance requirements such as the Record of Processing Activities (ROPA) and data processing agreements with data processors. Case studies. The Office of the PDPC highlighted specific examples of violations: Hospitals misused personal data for purposes beyond their intended scope (e.g., using personal data collected for providing medical services to send birthday cards) Vendors compromised systems due to inadequate password
January 29, 2026
Following the recent enactment of a comprehensive legal framework addressing sexual harassment, Thailand has launched a fast-track judicial process enabling victims of online sexual harassment to obtain court orders suspending and removing obscene content from the internet. On January 26, 2026, the Office of the Judiciary introduced the “Take It Down” procedure through the Court Integral Online Service (CIOS) platform, providing victims with their first direct, expedited pathway to halt the spread of online content that violates the new legal provisions against sexual harassment. This new remedy stems from section 284/4 of the Penal Code, introduced through the Act Amending the Penal Code (No. 30) B.E. 2568, which took effect on December 30, 2025. Under section 284/4, an injured person or a competent official may petition the court to suspend dissemination of violating data and remove the data from computer systems within a court-specified period. The court may also direct system controllers, service providers, or competent authorities to carry out the order and report back within 15 days. Filing through the CIOS Platform The CIOS platform serves as the primary electronic channel for these petitions. Key features include: Individuals can file online without appearing in person and may submit petitions at any time the system is available. Users must complete digital identity verification via the ThaID application to access the CIOS. Petitions under section 284/4 are limited to requests to suspend or remove violating content. Claims for monetary damages must be pursued separately, including via separate proceedings or prefiling mediation. Streamlined Review Process The submission workflow is end-to-end electronic, and the system provides step-by-step guidance. After submission, court staff review the petition before presenting it to a judge for consideration. The court may conduct an online inquiry to obtain additional information, and in-person attendance is required only if deemed