Thailand

Issued on 13 June 2024 and in force from that date; the PDF is in Thai. Financial institutions, non-bank businesses under BOT supervision and other businesses offering financial services through innovation may apply. The BOT gives its decision within 30 days for the Regulatory Sandbox and 45 days for the Enhanced Regulatory Sandbox, and testing should not exceed one year.

Dated September 2023 and replacing the BOT guideline of 22 July 2020. Sets governance, data capture, accuracy, storage, consent and incident-response expectations for financial institutions using biometrics, including encryption of biometric data and at least yearly penetration tests.

Dated 15 February 2023 (reference ธปท.ฝกส.(01)ว.113/2566). Asks financial institutions and financial business group companies to assess environmental impacts in decisions and operations under four headings: governance, strategy, risk management and disclosure, and to offer green financial products.

Classifies economic activities by environmental objectives using green, amber and red categories. Phase 1 was published on 30 June 2023 and Phase 2 on 27 May 2025; the page lists energy, transportation, agriculture, construction and real estate, manufacturing and waste management, plus do-no-significant-harm and minimum social safeguard criteria. The BOT page describes use as a voluntary common reference.

Applies to commercial banks and their financial business groups. Banks may handle digital asset transactions but not run digital asset businesses; group companies need BOT approval case by case, exposure is capped at 3% of capital, and credit for individuals' digital asset investment is barred. Announced on 6 October 2022.

Amends the 2001 Act: replaces the electronic signature provision (Section 9), adds automated contract rules (Sections 13/1, 13/2, 17/1), restructures the Commission (Sections 36 to 40) and replaces the notification, registration and licensing rules for service businesses (Sections 32 to 34/2). Signed 12 April B.E. 2562.

Requires a licence from the Minister, on the SEC's recommendation, for digital asset exchanges, brokers and dealers (Section 26), SEC approval for token offerings (Section 17) and for digital token portals (Section 19). Section 7 treats operators and portals as financial institutions under the anti-money laundering law.

Requires a licence or registration to run a designated payment system (Sections 12 and 13) or provide a designated payment service such as electronic money (Sections 16 and 17), and requires providers holding prepaid user funds to segregate them (Section 19). Sections 44 and 45 set penalties for operating without a licence or registration.

Allows commercial banking only by a public limited company licensed by the Minister on the Bank of Thailand's advice (Section 9), sets capital funds and liquidity requirements (Sections 29 to 30 and 64) and limits on lending to single borrowers and related parties (Sections 48 to 51). The BOT may examine institutions and order corrective measures, business suspension or closure (Sections 85 to 97). The BOT's unofficial translation is current to Act (No. 3), B.E. 2561 (2018).

Criminalises unauthorised access to protected computer systems (Sections 5 and 7), interception (Section 8), interference with data and systems (Sections 9 and 10) and sending messages with a hidden or faked source (Section 11). It also requires service providers to keep traffic data for at least 90 days (Section 26). Amended by Act (No. 2), B.E. 2560 (2017). The MDES translation is unofficial.

Establishes the Office of the Insurance Commission as a state unit with juristic person status (Section 17) and sets its tasks as overseeing, promoting and developing insurance business (Section 20).

Gives data messages legal effect, sets rules on writing, signatures, originals, record retention and contract formation, and covers service businesses for electronic transactions and the Electronic Transactions Commission. Published in the Government Gazette on 4 December 2001 and amended by Act (No. 2), B.E. 2551 (2008). The English translation on the MDES site is tentative.

Sets customer identification (Section 20), customer acceptance and due diligence (Section 20/1), reporting of cash, asset and suspicious transactions (Sections 13 to 17), staff training duties (Section 21/3) and record keeping (Sections 22 and 22/1). Section 40 establishes AMLO. AMLO's unofficial consolidated translation cites amendments up to Act (No. 6), B.E. 2565 (2022).

Allows life insurance to be written only by a public limited company holding a Ministerial licence with Cabinet approval (Section 7), requires the same licence for foreign insurers' branches (Section 8) and bars acting as an insurer without a licence (Section 18). The OIC's unofficial translation notes amendments up to Act (No. 3), B.E. 2558 (2015).

Limits non-life insurance to public limited companies licensed by the Minister with Cabinet approval (Section 6), requires a security deposit with the Registrar and technical reserves (Sections 19 and 23), and lets the Registrar order improvements, a capital change or a temporary halt to underwriting (Section 52). The OIC's unofficial translation notes amendments up to Act (No. 3), B.E. 2558 (2015).

Founding statute of the SEC. It is the basis for the SEC's administrative, criminal and civil sanctions on market manipulation and insider trading (for example Sections 244/3, 296 and 317/1), and has been amended several times, most recently in the SEC's index by Act (No. 5), B.E. 2559.

Constitutes the Bank of Thailand as the central bank, a juristic person and state agency (Section 5), and sets its objective as monetary stability, financial institution system stability and payment systems stability (Section 7). The BOT's translation is current to the Bank of Thailand Act (No. 7), B.E. 2561 (2018).