On February 14, 2024, Thailand’s Department of Climate Change and Energy (DCCE) began holding public hearings on the draft Climate Change Act, which is being developed to help the country achieve its commitments under the Paris Agreement. These hearings, held throughout the country, are expected to be completed by the end of March 2024. Key features and developments of the draft Climate Change Act are outlined below. Supervising Authority Under the current draft, the main supervising authority is changed from the Office of Natural Resources and Environmental Policy and Planning to the DCCE. The DCCE will focus on fostering collaboration with national and international governmental committees, agencies, and private sector organizations to facilitate the implementation of activities in alignment with the Climate Change Act. Thailand’s Climate Change Master Plan To be issued by the National Climate Change Policy Committee (NCCPC), the Climate Change Master Plan will serve as a national-level plan and framework for Thailand’s actions on climate change adaptation. The DCCE will review the plan every five years and is in charge of monitoring and enhancing state agencies’ implementation of the master plan. GHG Database The DCCE will establish and maintain a national greenhouse gas (GHG) database to track the quantity of GHG emissions from human activities, sequestration, and reduction efforts. In this regard, eight state agencies and other agencies to be prescribed by the NCCPC are required to store GHG-related information and submit reports to the DCCE. If necessary, certain private entities (e.g., factory operators and energy companies) may be required to report activity data to government agencies for compiling the GHG database. GHG Reporting For the benefit of the emissions trading system, legal entities under private and public laws prescribed by the NCCPC are required to submit an annual report of the quantity of emissions or

The Bank of Thailand (BOT) has opened a public comment period on their consultation paper titled “Criteria for Supervising Virtual Banks” from March 19, 2024, to April 17, 2024. The consultation paper reveals that the BOT intends to apply traditional commercial bank supervisory standards to virtual banks. However, the BOT also explains that the wholly digital nature of the services offered by virtual banks necessitates additional regulatory supervision. Additional Supervisory Criteria for Virtual Banks Financial business group: If a virtual bank is within the same financial business group as other financial institutions, its parent company must structure the virtual bank to be under its own sole consolidated financial business group. After the virtual bank has undergone the “restricted phase” in its initial years of operation (see below), other financial institutions within the group are prohibited from extending credit to or engaging in transactions similar to lending activities with the virtual bank. Shareholding structure: If the increase in the financial institution system capital is higher than the actual capital injection resulting from the bank’s shareholding structure, the BOT aims to issue an additional regulation to supervise the capital of the virtual bank and financial institution system to prevent double counting. Operational risk: Virtual banks must not use a trademark or logo that bears resemblance to or implies association with other financial institutions or financial institution groups. Governance: Virtual banks must have at least one director and chief technology officer (CTO) with at least three years of experience in IT or digital service. Additionally, the CTO must work full-time for the virtual bank and may not be an employee of another legal entity. Restriction on related lending and related-party transactions: Virtual banks must obtain prior unanimous approval from their boards of directors before engaging in transactions with major shareholders or businesses

Thailand’s Ministry of Finance has issued the Notification re: Criteria, Methods and Conditions for Applying for and Issuing Licenses to Operate Virtual Bank Business, which was published in the Government Gazette on March 4, 2024. This notification opens an opportunity for qualified experts in technology, digital services, and diverse data usage fields to apply for virtual bank licenses to provide financial services through new digital channels. The main goal is to serve the financial needs of target groups that may not have received sufficient or tailored financial services from the traditional banking system. Licensing Timeline Application submission period: 6 months (March 20–September 19, 2024). Announcement of successful applicants: Mid-2025 (approx. 9 months–1 year from the end of the submission period) After the announcement, successful licensees must demonstrate their readiness to commence virtual bank operations within 1 year (extendable for up to 1 additional year) via the following: Having paid-up registered capital of THB 5 billion and plans to increase the paid-up registered capital to at least THB 10 billion after the initial business period; Establishment or adjustment of a financial business group; Procurement of human resources, IT systems, and relevant risk management tools. Number of Licenses to be Issued No written or specified limit, subject to the discretion of the Bank of Thailand (BOT). Key Qualifications Applicants must have the following: Experience and resources to support virtual banking operations according to the business model and plan. Expertise and experience in conducting business that utilizes technology and provides services through digital channels. Experience demonstrating the ability to obtain, access, manage, and utilize data, including development of systems or data connections to facilitate user activities, allowing them to use their data to conduct transactions with other providers. Criteria In assessing applicants’ qualifications for a virtual bank license, the BOT will consider

Thailand’s National Cyber Security Committee (NCSC) released three notifications under the Cybersecurity Act on January 18, 2024, setting cybersecurity-related requirements for key organizations and assets. While one of these notifications already took effect, the two most notable will take effect on January 18, 2025 (i.e., one year from their publication in the Government Gazette). These two are the NCSC Notification Re: Standards for Defining the Security Category for Data or Information Systems B.E. 2566 (2023) (“Notification on Security Category”) and the NCSC Notification Re: Minimum Standards for Data and Information Systems B.E. 2566 (2023) (“Notification on Minimum Standards”). These notifications apply to: State agencies; Supervising or regulating organizations (i.e., state organizations, private organizations, or persons designated by law to regulate or supervise the affairs of state organizations or critical information infrastructure organizations); and Critical information infrastructure organizations (i.e., organizations related to or providing national security, significant public services, banking and finance, information technologies and telecommunications, transportation and logistics, energy and public utilities, and public health). Collectively these are defined as “Organizations” under the notifications. Notification on Security Category The Notification on Security Category sets forth risk-based security classifications—or “security categories”—for Organizations’ data or information systems. For security category assessment purposes, Organizations are required to perform a self-assessment of their data or information systems based on three key security objectives: confidentiality, integrity, and availability. Each of these objectives is further categorized into three risk levels (low, medium, and high), taking into account the assessment of potential impact in the following areas: Organizations’ financial value or reputation; Organizations’ number of service users; Organizations’ ability to perform their duties; State stability or public order. The risk levels for the three objectives are determined by considering whether there are “minimal,” “severe,” or “serious severe” effects, as described below: Confidentiality (not including data classified