On September 12, 2025, the Bank of Thailand (BOT) officially released its AI Risk Management Guidelines for Financial Service Providers, building upon the draft guidelines issued in June 2025. The guidelines reflect a balanced approach, encouraging innovation while safeguarding financial stability and consumer protection. The guidelines are targeted at all financial service providers, including financial institutions and special financial institutions under the Financial Institution Business Act, as well as payment providers under the Payment Systems Act. The guidelines apply to both AI systems developed in-house and those developed by third parties that are adopted for use by financial service providers. AI Risk Management Guidelines The two main pillars in managing AI risk are (1) governance of AI system implementation and (2) AI system development and security controls, consisting of the following key elements: 1. Governance Stakeholder roles and responsibilities. Boards and senior management assume accountability for decisions and operations involving AI systems, and are responsible for defining roles and responsibilities for AI oversight. This includes establishing an AI system usage policy, designating personnel responsible for AI risk management, and building awareness of AI-related risk within the organization. Organizations are expected to foster internal capabilities to use AI securely and avoid overreliance that could compromise business continuity or customer service. AI system usage policy. Policies governing AI usage should align with organizational goals, regulatory obligations, and recognized responsible AI frameworks—such as the FEAT principles (fairness, ethics, accountability, and transparency). These policies should be reviewed regularly to respond to technological advancements and evolving risk profiles. Risk management throughout the AI lifecycle. Risk management should encompass the entire AI lifecycle, from establishing risk appetite to implementing continuous risk assessment and control measures tailored to specific use cases. Financial service providers should assess risks and impacts of AI usage on operations and customer services. Human oversight must be embedded in decision-making processes,

On September 15, 2025, Vietnam’s Ministry of Science and Technology announced that the country will issue an updated version of its National AI Strategy (first issued in 2021) and its first-ever AI Law by the end of this year. The ministry emphasized that the AI strategy is not just a legal framework, but a commitment to embracing AI to drive Vietnam into a new era. The AI adoption plan is set as a priority of the country, and marks a significant step in shaping Vietnam’s AI governance and innovation landscape. Highlights of the plan include the following: Strategic vision. Vietnam’s ambition is to leverage AI for economic growth, social development, and global competitiveness, under the guiding principle “AI for humans – safe, autonomous, cooperative, inclusive, and sustainable.” AI as national infrastructure. The updated strategy positions AI as core national infrastructure, comparable to electricity or the internet, aiming to provide every citizen with a “personal digital assistant.” Core principles for AI legislation. The AI Law will be built around the following six core principles: Risk-based regulation Transparency and accountability Human-centric development Domestic AI autonomy AI as a driver of sustainable growth Digital sovereignty, with data, infrastructure, and AI technology being three strategic pillars Ethics and openness. A National AI Ethics Code will accompany the upcoming law, aligned with international standards but tailored to the Vietnamese context. The government emphasizes open standards and open-source development. Market development and incentives. The government plans to expand domestic AI adoption, particularly in public services and key industries. The National Technology Innovation Fund (NATIF) will allocate at least 40% of its budget to AI projects, prioritizing SMEs through vouchers for locally developed AI solutions. Background on AI Law Development Regulations on AI are found in various Vietnamese laws and regulations, notably the recently adopted Law on Digital Technology Industry (DTI Law). However, these provisions are fragmented and not comprehensive.

Over the past two years—particularly since Thailand announced incentives for EVs, including tax exemptions and reductions—there has been a clear trend of manufacturers relocating their facilities to Thailand. This shift is reshaping the country’s industrial landscape and creating significant opportunities in the real estate sector for companies looking to establish or expand EV manufacturing operations in Southeast Asia. Incentive-Driven Market Transformation The government’s tax exemptions and reductions have proven effective in attracting foreign investment, with Chinese manufacturers currently dominating the market. Most EV parts and car manufacturers operating in Thailand are from China, reflecting the prominence of Chinese EV brands that have already established a presence in the country. The sector encompasses manufacturers of electrical equipment as well as companies seeking to establish facilities for producing electric vehicle components, parts, and accessories. The surge in activity is evident across Thailand’s EV manufacturing sector, with legal practices handling these transactions experiencing unprecedented demand. Industrial Real Estate Framework and Market Dynamics Thailand’s industrial real estate framework provides compelling advantages for foreign manufacturers, who typically face restrictions on foreign land ownership under the Land Code. However, foreign investors can benefit from exemptions to these restrictions if the land is located within industrial real estate zones designated by the Industrial Estate Authority of Thailand (IEAT) or they obtain investment promotion from the Board of Investment (BOI) if the land is located outside an industrial estate area governed by the IEAT. Both the IEAT and BOI provide special tax and nontax incentives, including foreign land ownership, with even greater incentives available for land situated within the country’s Eastern Economic Corridor (EEC). This regulatory advantage has sparked a parallel trend in land development. Industrial real estate developers in the EEC are actively consolidating land into large plots to develop new industrial estate projects, recognizing that EV manufacturing facilities require significant space.

M&A specialists at Tilleke & Gibbins have contributed the Vietnam chapter to Private M&A 2025, a newly released guide from Lexology Panoramic. The publication provides practical insights into private mergers and acquisitions frameworks in jurisdictions worldwide. The Vietnam chapter addresses key aspects of private M&A transactions, including: Structure and process, legal regulation, and required consents Advisers, negotiation, and documentation Due diligence and disclosure obligations Pricing, consideration, and financing Conditions, preclosing covenants, and termination rights Representations, warranties, indemnities, and postclosing covenants Taxation of transfers Employees, pensions, and benefits Recent legal, regulatory, and market practice developments The chapter highlights how Vietnam’s legal framework governs private acquisitions and disposals, outlines typical transaction processes and structures, and provides guidance on common regulatory and practical considerations. It also notes recent trends, including increased scrutiny of merger control filings by the Vietnam Competition Commission and regulatory changes affecting M&A approvals. The full Vietnam chapter is available as a PDF through the button below. Readers can also gain 30 days of complimentary access to Private M&A 2025 and Lexology Panoramic’s full library of resources through this link.

Thailand’s Ministry of Finance has introduced a five-year personal income tax exemption on capital gains from the disposal of cryptocurrency or digital tokens. The Ministerial Regulation No. 399, published in the Government Gazette on September 5, 2025, offers the personal income tax exemption for transfers occurring between January 1, 2025, and December 31, 2029. The ministerial regulation was enacted to promote Thailand as a global financial center and digital asset business hub while encouraging increased domestic investment in digital assets. Key Conditions The exemption, which covers capital gains from cryptocurrency and digital token disposals during the specified five-year period, applies only to individuals. Companies that trade in digital assets are not eligible for this tax exemption. With the tax holiday set to expire in 2029 (unless extended), individual traders should plan ahead for postexemption taxation to ensure full compliance with Thailand’s personal income tax requirements. Proper documentation of digital asset transactions during the exemption period will be essential for future tax compliance. For more details on this tax exemption, or on any aspect of Thailand’s tax law and regulations, please contact Saravut Krailadsiri at [email protected] or Papavarin Sarawongsuth at [email protected].

Thailand has enacted amended alcohol control legislation that significantly tightens restrictions on marketing and advertising, strengthens enforcement, and creates mechanisms to support the country’s tourism objectives. The Alcoholic Beverage Control Act (No. 2) B.E. 2568 (2025), published in the Government Gazette on September 9, 2025, will take effect on November 8, 2025. Key aspects of the new law are outlined below. Continuation of Sales-Hour Restrictions Sales-hour restrictions remain in effect, though now under an updated regulatory pathway. Alcohol sales are permitted only between 11:00 a.m. and 2:00 p.m. and between 5:00 p.m. and midnight, with exceptions for airport terminals, entertainment venues under the Entertainment Place Act 1966, and hotels. Despite earlier discussions about relaxing these hours, no changes have been implemented under the new law. Enhanced Seller Responsibilities Sellers are now expressly permitted to check identification cards to verify purchaser age and may assess the condition of intoxicated customers. The assessment conditions will be announced in a forthcoming notification from the director of the Department of Disease Control. Sellers who willfully or negligently violate the law and cause damage to life, health, or property face possible penalties. Alcohol Vending Machines Permitted The law allows alcohol to be sold in vending machines that can verify buyer information and comply with rules, procedures, and conditions to be prescribed by the Alcoholic Beverage Control Committee. This means the industry must await the committee’s implementing regulations before deploying such machines. Expanded Marketing and Advertising Restrictions The amended law introduces a new suite of advertising restrictions, including more detailed and expansive definitions involving marketing and promotions. “Marketing communication” is broadly defined to include any direct or indirect act of publicizing, presenting, or disseminating information about alcoholic beverages through advertising, public relations, sales promotions, sponsorships, or any other means that may induce or encourage the public to consume alcoholic beverages. This includes using names,

Since Thailand formally removed Mitragyna speciosa (kratom) from the list of narcotic drugs, the country has progressed from outright prohibition to a structured, license-based regime. While the Ministry of Public Health oversees cannabis plant regulation, the Ministry of Justice (MOJ) is the regulatory authority overseeing kratom plants. For the avoidance of doubt, separate Ministry of Public Health notifications prohibit the use of kratom as a food ingredient unless a food safety evaluation has been conducted; however, this restriction does not affect trade in unprocessed leaves per se. For businesses in Thailand dealing exclusively in kratom leaves, the most consequential development is the Ministerial Regulation on the Application for Permits and Notifications for the Importation and Exportation of Kratom Leaves B.E. 2568 (2025), a bylaw of the Kratom Plant Act 2022. The ministerial regulation establishes the following notable definitions: “Kratom leaves”: Fresh or dried leaves in their natural, unprocessed state (no extracts, concentrates, or infused products). “Import/Export”: Any act of bringing kratom leaves into or out of Thailand, whether for commercial sale, industrial processing abroad, or research. Import/Export Licensing Under the Kratom Plant Act, a license is mandatory for importing or exporting kratom leaves. Individuals, juristic persons, community enterprises, and state agencies in Thailand are eligible to obtain a license to import (or a license to export) kratom leaves. Licenses are available to qualified individuals and juristic persons. Individuals must satisfy the following qualifications to be eligible for a license: Thai nationality, ≥ 20 years old, resident in Thailand. Not incompetent, quasi-incompetent, or under legal guardianship. No license suspension currently in force under the Kratom Act or Narcotics Code. No license revocation in the previous two years. No conviction under the Kratom Act or Narcotics Code within the previous two years (unless fully released from punishment). Juristic persons must satisfy the following qualifications to be eligible for a license: Structured as a company

On September 10, 2025, Vietnam’s National Credit Information Center (CIC) reported to the Vietnam Cybersecurity Emergency Response Team (VNCERT) a suspected significant cybersecurity incident involving unauthorized access to the CIC’s credit information database. A hacker group has claimed responsibility and allegedly posted over 160 million records for sale, including sensitive personal and financial data. Implications for Banks and Financial Institutions Companies that share customers’ or potential customers’ personal data with the CIC for credit scoring or other purposes—and continue to act as a data controller for such data—may be obligated under Vietnam’s Personal Data Protection Decree (PDPD) and related regulations to: Notify A05 (Department of Cybersecurity and High-Tech Crime Prevention) and the State Bank of Vietnam without delay. Inform affected individuals if their personal data is at risk. Recommended Actions Companies that could be impacted by this data breach should take the following actions: Conduct an internal review of CIC-related data in their systems, and identify whether and how the systems have been affected by this incident. Assess whether to notify regulators and customers/potential customers. Enhance cybersecurity controls, monitor for suspicious activity, and implement additional safeguards to prevent secondary breaches.