Thailand’s Department of Business Development (DBD) has released a new notification to emphasize and encourage the online issuance of company affidavits and certification of corporate documents, in an effort to prevent further spread of COVID-19 in Thailand. This notification, which was announced on January 7, came into effect on January 11, 2021. The new notification repeals and replaces a similar DBD notification issued on April 10, 2020, during the first wave of the pandemic, and notes that requests to issue company affidavits and certify corporate documents can be processed through the DBD’s e-service system via the DBD website (www.dbd.go.th). In using this online system, applicants can choose to receive the documents either as PDF e-certificates or in paper form. The digital signature of the relevant DBD official will appear on the documents using a public key infrastructure (PKI) encryption—an accepted cryptographic practice that binds digital identifiers to people and organizations and verifies any amendments to the information or digital signature. In accordance with Thailand’s laws on electronic signatures, a digital signature by a DBD official is deemed as legitimate as an ink signature on paper. The authenticity of both electronic and paper documents issued by the DBD can be verified via the document’s QR code and through the reference number at the bottom of the document. For paper documents, the authenticity can also be verified by checking the micro-text (which is illegible when photocopied), and the DBD watermark (which disappears or becomes obscured when photocopied). Anyone can verify a legal entity’s current information on the DBD’s website through the “DBD DataWarehouse+” or “DBD Service” portals. The DBD e-certificate service described in the new notification is now available for public use. Even though the DBD had already introduced an online system for this service in 2020, the new notification highlights this implementation to encourage wider use in response to the COVID-19 outbreak.

Following the recent delisting of almost all parts of the hemp plant from Thailand’s list of prohibited narcotics (see here for further details), the Ministry of Public Health has issued a notification allowing hemp to be used in cosmetics. Prior to this development, this use of hemp (whether from natural or synthetic sources) was not allowed, as it fell under the definition of narcotics under the Notification Re: Ingredients Not Allowed for Use in Cosmetics B.E. 2559 (2016). Under the Ministerial Notification Re: Use of Hemp in Cosmetics B.E. 2564 (2021), which was published in the Government Gazette on January 11, 2021, domestic manufacturers are now allowed to produce cosmetics containing hemp seed oil or hemp seed extract, provided the cosmetics do not have a THC level exceeding 0.2% by weight. To register such products with the Thai FDA, applicants must submit a certificate of analysis, safety data sheet, and label for the agency’s evaluation. The timeline for approval of the registration (notification) of a cosmetic containing hemp seed oil or hemp seed extract is three business days. The applicant (i.e., manufacturer or toll manufacturer) must declare the amount of hemp seed extract or hemp seed oil used in the cosmetic in their notification application. Cosmetics must not use a name for the product that evokes an association with hemp flowers or narcotics, and the name of the product must be within the scope of cosmetics. For example, names containing “inflorescence,” “flower,” “CBD,” “THC” or similar will not be allowed. It should also be noted that Thailand does not yet allow the importation of cosmetics containing hemp seeds or hemp seed extract, and this regulation only applies to domestically produced hemp products—a business currently restricted to individuals or companies with Thai nationality. For more details on this development, or on any aspect of hemp and cannabis regulations in Thailand, please contact Tilleke & Gibbins at [email protected]

On November 26, 2020, the Notification of the Ministry of Finance Re: Addition to Other Business Relating to Digital Assets B.E. 2563 (2020) (the Digital Asset Business Notification) and the Notification of the Ministry of Finance Re: Licensing of Digital Asset Business No. 2 B.E. 2563 (2020) (the Digital Asset Business Licensing Notification) were published in the Thai Government Gazette. Additional Digital Asset Businesses The new Digital Assets Business Notification adds two new categories of digital assets business to the list prescribed in the Royal Decree on Digital Asset Businesses B.E. 2561 (2018). Digital Asset Fund Manager is defined as a person who manages funds from digital assets for another person for benefits, or holds themselves out to the general public as being ready to do so, in the ordinary course of business. It does not include the management of digital assets as prescribed by the Securities and Exchange Commission (SEC). Digital Asset Advisory Service is defined as a person who provides consultations to other people, directly or indirectly, regarding the value of digital assets; the suitability of investment in digital assets; or the buying, selling, or exchanging of any digital assets in the ordinary course of business in return for service fees or other compensation. However, this does not include consultations as a part of or relating to a digital asset exchange, digital asset broker, digital asset dealer, digital asset fund manager, or other personal consultation as prescribed by the SEC. Additional Digital Asset Licensing Requirements The Digital Asset Business Licensing Notification amends the definition of “License Applicant” to include cryptocurrency exchanges, digital token exchanges, cryptocurrency brokers, digital token brokers, cryptocurrency dealers, digital token dealers, cryptocurrency fund managers, digital token fund managers, cryptocurrency advisory services, and digital token advisory services. Additional requirements for granting licenses have also been added in the new Digital Asset Business Licensing Notification, including: the licensee must never have been denied a license or had a license revoked in the last six months from the date of the application submission; the licensee’s application must not be a replacement of a previous application that has been withdraw by the licensee; and, the licensee must not currently be under any legal proceedings for any violation of law. The digital assets business must commence within 180 days after receiving licensing approval. Digital Asset Fund Managers and Digital Asset Advisory Services already in operation are required to apply for a license from the SEC within 90 days after this Digital Asset Business Licensing Notification comes into force (i.e. by February 25, 2021). Once an application has been filed with the SEC, the applicant is allowed to continue operating their business until the SEC issues an order to decline the application. The Digital Asset Business Licensing Notification also updates the application fees. For more details on these notifications, or on any aspect of Thai law relating to digital assets or currencies, please contact Charuwan Charoonchitsathian at [email protected], Nopparat Lalitkomon at [email protected] or Teelada Rujirawanichtep at [email protected]  

The Thai Industrial Standards Institute (TISI) has postponed a requirement to display QR codes next to the Thailand Industrial Standards (TIS) logo on certain product labels, linking to each product’s licensing information. Originally scheduled to take effect on January 21, 2021, TISI has agreed to extend this implementation date by a further six months owing to complexities involving product labeling and the COVID-19 pandemic. Manufacturers and importers therefore have an extra six months to prepare for compliance with the new regulations, which will now come into force on July 20, 2021. Thailand’s Ministry of Industry (MOI) requires various manufactured goods, such as gas water heaters, fans, light bulbs, rice cookers, fuel oils, toys, and so on, to meet Thailand’s industrial standards before they are imported or manufactured domestically. The standards, governing product qualities such as design, shape, manufacturing process, durability, safety, and packaging, are laid out in the Industrial Product Standards Act (No. 6) B.E. 2548 (2005) and overseen by the TISI (which operates as part of the MOI). As the MOI prescribes these compulsory standards, via TISI, to ensure product safety and prevent harm to consumers and the public, once a product becomes subject to them it cannot be manufactured or imported without an appropriate license from TISI. Such products must display the TIS logo on their labels. However, many products have been found to display the TIS logo dishonestly—that is, without having been evaluated or licensed by TISI. To deal with this dishonest use of the TIS logo, MOI Regulation Re: Format and Methods to Label and Use Markings on Industrial Products B.E. 2563 (2020) was issued in July 2020, mandating that various household appliances and other approved goods display a QR code linking to the TISI license information. With the postponement of this regulation, all affected companies should take the opportunity to use the additional time to review their labeling standards and make any necessary preparations in advance of the new implementation date (July 20, 2021) to ensure that their product labels comply with the requirements of the ministerial regulation. For more details on compliance with this or any other regulatory requirements, please contact Tilleke & Gibbins’ Bangkok office at [email protected] or +66 2056 5555.

Thailand’s Office of the Insurance Commission (OIC) recently issued two notifications—one for life-insurance companies and another for insurance companies—establishing key criteria and requirements for insurance companies to manage risks relating to IT and cybersecurity. The notifications, entitled Notifications Re: Criteria for the Supervision and Management of Risks Relating to Information Technology for Life/Non-life Insurance Companies B.E. 2563 (2020) came into effect on January 1, 2021, and cover eight major aspects of IT risk management as detailed below. IT Governance Insurance companies are required to monitor and manage IT risks and cyber threats in accordance with the size, characteristics, complexity, and context of their business operations, and each company should have at least one director with knowledge of, or past experience in, the field of information technology. IT Project Management Insurance companies are required to develop a written framework for IT project management, covering at least the commencement, implementation, and control of the project, as well as the project closing and post-project auditing. Companies must also appoint a committee for supervising and monitoring IT projects. IT Security Insurance companies are required to institute a written IT security policy, which must be reviewed at least once a year or upon implementing any significant changes. The policy must be approved by the board of directors, or a relevant subcommittee appointed by the board of directors. In outsourcing IT activities to third-party service providers, or entering into any arrangement that allows business partners to connect to or access the company’s IT system, insurance companies are required to specify their own criteria and procedures for the selection of third-party service providers, enter into a written service agreement and a service level agreement with the third-party provider, and conform with other requirements under the notifications. Insurance companies will also be required to comply with the OIC’s forthcoming guidelines on the criteria for the supervision of IT outsourcing to third-party service providers. IT Risk Management Insurance companies must also write an IT risk management policy and review it at least once a year, or upon implementing any significant changes. This policy must also be approved by the board of directors or their appointed subcommittee. The companies must also have procedures for IT risk assessment, treatment, monitoring, and reviews. IT Compliance Insurance companies are required to implement the required measures for IT compliance to conform with applicable laws and regulations concerning IT and anti-money laundering. IT Audit Insurance companies are required to have at least one internal or external IT auditor with experience and expertise in IT auditing. Companies are also required to establish a plan and scope for IT audits, which must be approved by the audit committee and reviewed at least once a year, or upon implementing any significant changes. The IT audit reports must be approved by the audit committee and kept at the company office. Cybersecurity Insurance companies are required to establish a framework and guidelines for supervision of and protection against cyber threats, in accordance with cybersecurity laws and commensurate with the size and complexity of their business operations. They must also implement required measures against cyber threats, including risk identification, protection, detection, and countermeasures. Reporting Obligations Insurance companies are obligated to report cyber threat incidents to the OIC, and other threats that affect their IT systems, in the following cases: They become aware of any material issue or incident regarding the use of IT that affects the company’s services, systems, reputation, or the data of insured parties. These incidents include cases where a company’s material IT is subject to an actual cyberattack, or there is a potential threat of a cyberattack, that must be reported to the company’s chief executive officer. In this circumstance, the companies are required to report the incident to the OIC, along with other required details, immediately upon becoming aware of it. They are subject to an attack from any cyber threat causing issues or incidents relating to the provision of critical IT infrastructure. These incidents must be reported to the OIC, or the  responsible cybersecurity authority as required under the law, without delay and within 72  hours. For more information on the requirements under these notifications, or on any aspect of insurance law in Thailand, please contact the Tilleke & Gibbins insurance team at [email protected], [email protected], or [email protected]

Due to the resurgence of the COVID-19 pandemic in Thailand since December, 2020, Thailand’s Ministry of Labor recently published two regulations under the Social Security Act (SSA) in the Government Gazette: The Regulation on Entitlement to Compensatory Benefits in the Event of Unemployment Due to Force Majeure from the Pandemic of Dangerous Communicable Disease Under Relevant Law Relating to Communicable Diseases B.E. 2563 (2020) (the Force Majeure Regulation); and The Regulation on Determination of the Amount of Contributions to the Social Security Funds B.E. 2563 (2020) (the SSF Contribution Regulation). Details of the two regulations are provided below. The Force Majeure Regulation This regulation is similar to a previous regulation from April, 2020, during the first wave of the pandemic, stating that the definition of force majeure under the Social Security Act B.E. 2533 (1990) (the SSA) includes hazards from pandemics of dangerous communicable diseases (including COVID-19). This definition therefore affords protection to insured persons (i.e., employees) in the event that the COVID-19 pandemic results in their being unable to work, or their employers being unable to operate their business normally. This regulation allows the Social Security Office (SSO) to pay compensation to employees who: are insured persons who qualify to receive compensatory benefit in case of unemployment in accordance with the SSA; have to cease working temporarily during the period from December 19, 2020 onwards; and do not receive wages from their employer during the temporary cessation. This applies only if the circumstances above result from the following force majeure events related to hazards from COVID-19 (or other pandemics of dangerous communicable diseases that affect the public under the Communicable Diseases Act B.E. 2558 (2015)): The employee cannot work, or the employer does not allow the employee to work, because of quarantine or to comply with a COVID-19 preventative measure; or, The employee cannot work because the employer temporarily ceases operations, wholly or partially, due to a government order to close the premises temporarily under the Communicable Diseases Act preventing the business from operating as normal. The affected employee will be entitled to compensation at a rate of 50% of their daily wages during the quarantine period, period of compliance with a COVID-19 preventative measure, or period of temporary premises closure, for not more than 90 days. The payment will be calculated based on daily wages in accordance with section 57 paragraph 1 of the SSA, but will be paid monthly. The SSO will cease payment of the compensation if the employee resigns or is terminated by an employer, or the employment contract expires. In addition, the employer is obligated to issue a certificate letter to request compensation in the event of unemployment resulting from force majeure. The certificate must be in accordance with a form letter prescribed in the regulation, can be made and sent electronically, and must be retained by the employer as evidence. The SSF Contribution Regulation This regulation reduces the rate of mandatory Social Security Fund contributions under section 33 of the SSA effective from January 1, 2021 to March 31, 2021. Contribution rates are calculated as a percentage of each employees’ monthly wages, based on a minimum monthly wage of THB 1,650 and a maximum monthly wage of THB 15,000. The reduced rates are as follows: The rates of mandatory Social Security Fund contributions under section 33 of the SSA effective from April 1, 2021 onward, are as follows: Therefore, based on the minimum and maximum wages allowed for calculation, from January 1 to March 31, 2021, the contributions would range from THB 49.5 to THB 450 per month for both the employer and the employees. From April 1, 2021 onwards, this will increase to THB 82.5 to THB 750.

Across the globe, the demand for COVID-19 vaccinations has been understandably high, with many regulatory authorities (e.g., U.S. Food and Drug Administration, Medicines & Healthcare Products Regulatory Agency in the U.K., European Medicine Agency, Swissmedic, etc.) issuing emergency use authorizations for COVID-19 vaccines. Similarly, the Thai Food and Drug Administration (Thai FDA) has published the Notification Re: Conditional Approval for Emergency Use of Medical Products, which allows drug importers to register COVID-19 vaccines under the conditional approval scheme.  While as of the date of this article, the Thai FDA has yet to authorize any COVID-19 vaccines, this should follow shortly as clinical trials are completed and government procurement negotiations progress. Under the notification, it appears that the channel of distribution of a COVID-19 vaccine under the conditional approval scheme would be strictly controlled by the Thai FDA. This channel includes the vaccine’s distribution to relevant government agencies (e.g., Department of Disease Control of Thailand and public hospitals specified by the Thai FDA). However, questions have been raised regarding which private hospitals would be included in the distribution list and how the Thai FDA would distribute the vaccine to private hospitals. This confusion over the role of private hospitals was seen recently when one private hospital advertised that it could secure the COVID-19 vaccine from one developer whose product had already been approved elsewhere, until the Thai FDA then stepped in and claimed that the advertisement violated the Drug Act. The Thai FDA notification also enumerates several essential criteria that must be fulfilled in seeking approval for a COVID-19 vaccine, including the following: The available scientific data must substantiate both the efficacy and safety of vaccine. Further, the risk-benefit analysis must indicate that the medicine’s benefits outweigh its risks. A risk management plan, including risk minimization measures, must be submitted. Applications for registration should be prepared using the required template and then be submitted to the Thai FDA. During the assessment, the Thai FDA may rely on an assessment reports provided by stringent overseas regulatory authorities including the U.S., the U.K., the E.U., Australia, Japan, or the WHO. Following approval, the company must conduct a safety monitoring program for every patient (i.e., patient registry), and submit importation records and sales records to the Thai FDA. The storage and distribution of a vaccine under conditional approval must comply with good storage practice (GSP) and good distribution practice (GDP) standards. For more details on this notification, or on any aspect of Thailand COVID-19-related measures, please contact Tilleke & Gibbins at [email protected] or +66 2056 5555.

At a meeting on December 21, 2020, the Thai Board of Investment (BOI) approved a series of stimulus packages aimed at encouraging local and foreign investment, as the government seeks to boost Thailand’s economic recovery from the COVID-19 pandemic. The additional investment incentives, which will be promoted by the BOI in the upcoming year, include a number of sector- and project-specific stimulus measures.   Additional Tax Incentives for Large-Scale Projects Projects in target industries with investment of at least THB 1 billion (approx. USD 33 million) over a 12-month period, starting from the issuance of the BOI promotion certificate, will be entitled to an additional 50% corporate income tax (CIT) deduction for a period of five years, calculated on top of the standard 5–8 year CIT exemptions offered under the normal BOI tax-incentive scheme. To obtain this special tax incentive, eligible projects may apply to the BOI from January 4 to December 30, 2021.   Stimulus Package for Digital Economy and Software Industry Projects that support digital technology adoption, such as software integration, artificial intelligence, machine learning, or big data analytics, may benefit from 50% CIT exemptions on profits generated from their existing BOI projects for an additional three years. Applications for the exemption must be submitted by the end of 2022.   Application Deadline Extensions for Special Economic Zones and Five Southern Provinces Measures relating to special economic zones cover more than 300 investment promotion categories, with both tax and non-tax incentives, including an additional tax incentive for target industries such as textiles, agriculture, home furniture, jewelry, and others. These incentives are available to projects located in the border areas of Thailand (i.e., the 10 special economic zones in the provinces of Chiang Rai, Kanchanaburi, Mukdahan, Nakhon Phanom, Narathiwat, Nong Khai, Sa Kaeo, Songkhla, Tak, and Trat), with the BOI accepting applications for these incentives until the end of 2022. The BOI has also extended investment project deadlines for five southern provinces (Narathiwat, Pattani, Satun, Songkhla, and Yala) by an additional two years, again up to the end of 2022.   New Special Economic Zone for the Genomics Industry Genomics technology, which enables advancements such as embryo examination during in-vitro fertilization (IVF), precise cancer detection, and development of innovative medicines, vaccines, and biological products, is targeted by Thailand as a growth industry worth approximately THB 70 billion (USD 2.35 billion) per year. The BOI has thus granted the Genomics Thailand project, located at Burapha University in the Eastern Economic Corridor (EEC), equivalent status to other special EEC zones, including the EEC of Innovation, Digital Park Thailand, and the Energy Efficiency & Conservation Authority. Investors in this new genomics economic zone will be entitled to the same additional BOI tax incentives as other EEC investment projects.