Tag: Government

on by

BOT Proposes New Digital Channel Security Requirements to Strengthen Fraud Prevention

The Bank of Thailand (the “BOT”) is conducting a public consultation (the “Consultation”) from 7 October to 6 November 2026 on the draft BOT Notification on Digital Channel Security (the “Draft Notification”). The Consultation seeks feedback from relevant stakeholders.

The Draft Notification aims to strengthen the security of financial and payment services delivered through digital channels, in response to evolving cybersecurity threats and unauthorized payment fraud.

Background and Objectives

In 2025, the BOT introduced mobile banking security requirements to protect users against cybersecurity threats and unauthorized payment fraud. Although these requirements share similar objectives and principles, they were issued under three separate notifications, each applicable to a different category of service provider:

  • BOT Notification No. 4/2568: financial institutions;
  • BOT Notification No. 17/2568: specialized financial institutions; and
  • BOT Notification No. 18/2568: regulated e-money service providers offering services through mobile applications.

Fraudsters have since expanded their activities beyond mobile banking applications to other digital channels, in particular internet banking and the mobile applications of non-bank financial service providers.

To address these risks, the BOT proposes to extend the security requirements to internet banking and additional categories of service providers, and to consolidate the three existing notifications into a single regulatory framework. These changes are intended to strengthen fraud prevention, ensure consistent security standards and enhance public confidence in Thailand’s financial and payment systems.

Key Principles and Changes

The Draft Notification proposes a unified security framework covering a broader range of digital financial services and service providers. Its key requirements, and the changes from the existing framework, are summarized below.

(1) Repeal of Existing Notifications

The Draft Notification would repeal and replace the three existing notifications with a single notification establishing consistent security requirements for all covered service providers.

(2) Definitions and Scope of Application

The Draft Notification would expand the existing scope in three key respects:

  • Digital Channels: The scope would extend from mobile banking applications to both mobile banking and internet banking.
  • Service Providers: The number of covered categories would increase from three to six, comprising financial institutions, specialized financial institutions, regulated e-money service providers, credit card business operators, regulated personal loan business operators and regulated nano-finance business operators (collectively, the “Service Providers”). The last three categories would be newly covered.
  • Covered Services: The framework would apply only to services that enable individual customers to (i) transfer money to an account held with a different bank or service provider (for example, an interbank transfer); or (ii) withdraw cash from ATMs or other electronic machines (for example, a cardless withdrawal initiated through a mobile banking application).

Accordingly, the Draft Notification would not cover all financial services offered through mobile banking applications or internet banking, but only the services specified above.

(3) Security Requirements

The Draft Notification would incorporate the existing mobile banking security measures into the expanded framework and require Service Providers to implement security measures in three key areas:

  • Prevention of Unauthorized Payment Fraud: Service Providers would be required to implement secure customer identification and authentication, including Know Your Customer (“KYC”) procedures or reliable multi-factor authentication (“MFA”) for service registration and for installation on new devices. Additional measures include account and device restrictions, MFA for specified high-risk transactions, restrictions on the use of SMS and email one-time passwords (OTPs) for certain transactions, and transaction alerts.
  • Prevention of Service Provider Impersonation: Service Providers would be required to restrict links sent via SMS and email, as well as links requesting sensitive information through social media, subject to specified exceptions. They would also be required to monitor and respond to fraudulent websites and applications that impersonate their services.
  • Mobile Application Security: Service Providers offering covered services through mobile applications would be subject to additional requirements, including customer data protection, encryption, secure communications, and safeguards against unauthorized access, malware and application tampering. Facial verification would also be required, subject to specified exceptions, for the following transactions:
    • a single transfer of THB 50,000 or more;
    • cumulative transfers reaching THB 200,000 per day; and
    • an increase of THB 50,000 or more in the daily transfer limit.

(4) Exemptions

Service Providers that are unable to comply with certain requirements due to necessary or exceptional circumstances may request an exemption from the BOT, supported by reasons and an implementation plan.

For circumstances existing before the Draft Notification takes effect, exemption requests must be submitted within seven days after its effective date, in accordance with the transitional provisions. The BOT would consider each request within 30 business days of receiving all required documents.

(5) Effective Date

The Draft Notification would generally take effect 30 days after its publication in the Government Gazette. However, certain MFA requirements relating to cash withdrawals and credit drawdowns through ATMs would take effect 90 days after publication.

Current Status and Next Steps

Following the Consultation, the BOT is expected to review the feedback received and consider any necessary revisions before issuing the final notification.

The Draft Notification carries a proposed signing date in January 2027, which suggests that issuance is anticipated around that time. However, the BOT has not confirmed the final issuance date, which remains subject to the outcome of the Consultation and the subsequent regulatory process.

Key Takeaways

  • The BOT proposes to replace three existing notifications with a single notification covering both mobile banking and internet banking, and to expand regulatory coverage from three to six categories of service providers.
  • Covered Service Providers would be required to implement measures against unauthorized payment fraud and impersonation, including customer authentication, transaction alerts and additional mobile application safeguards.
  • The Consultation remains open until 6 November 2026. Once issued, the Draft Notification would generally take effect 30 days after publication in the Government Gazette, with certain requirements taking effect after 90 days. Relevant Service Providers should review their existing security measures and prepare for compliance.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

DIP: WIPO GRATK Study Puts Genetic Resource Records in Focus

No new filing duty yet:

The Department of Intellectual Property (DIP) has published WIPO GRATK, a study of the possible effects and benefits of Thailand joining the WIPO Treaty on Intellectual Property, Genetic Resources and Associated Traditional Knowledge. The publication signals that accession is under study; it does not mean Thailand has joined the treaty or that patent applicants must now make new disclosures.

The treaty would require a patent applicant whose invention is based on genetic resources to disclose their country of origin or, if that is unknown, their source. If the invention is based on associated traditional knowledge, the application would identify the Indigenous Peoples or local community that provided it, or the source of that knowledge. The treaty will enter into force after 15 eligible parties have ratified or acceded. It has not yet been done so.

The business issue is the paper trail:

For companies working with biological materials, the information needed for a patent application may be spread across research partners, suppliers, universities and other organizations. A company may know what material was used in an invention but lack a reliable record of where it came from or how it was obtained. That gap could complicate patent preparation if the treaty’s disclosure rules later apply.

Biotechnology, agriculture, pharmaceutical and food businesses should look at how they record the source of samples and related traditional knowledge. Research and material transfer agreements can help by requiring partners to provide provenance information and pass it along when materials change hands. The same records may help teams address permissions and benefit-sharing arrangements under applicable rules.

Thai companies seeking patents overseas should also check the requirements in each filing country. Foreign disclosure rules may affect an application even if Thailand has not joined WIPO GRATK. The DIP study is a timely reason to examine these practices, but businesses should read its recommendations before making changes to filing procedures or contract templates. Study itself creates no new obligation. DIP’s earlier consultation identified potential benefits in protecting genetic resources and associated local knowledge, improving patent transparency and supporting fair benefit sharing.

Key takeaways:

• DIP’s study concerns possible accession; it does not establish that Thailand has acceded.

• WIPO GRATK’s disclosure requirement will apply when Thailand joins WIPO GRATK.

• Businesses should check whether their research and supply arrangements preserve reliable records of genetic resources and associated traditional knowledge.

• Thai applicants filing abroad should check the disclosure rules in each relevant jurisdiction.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

FDA: Building a Telepharmacy Platform—What Developers Need to Address

The Food and Drug Administration (FDA) has opened a regulated route for licensed modern pharmacies to provide telepharmacy services through recognized digital applications. For businesses developing healthcare platforms, the opportunity extends beyond connecting patients with pharmacists: it involves building a system that supports consultations, medicine supply, and delivery within the applicable regulatory framework. The FDA has established separate procedures for considering telepharmacy applications and for pharmacies seeking to provide the service. Platform developers should address both processes when designing their business model.

Platform Recognition and the Service Model:

FDA recognition of an application and authorization of a participating pharmacy serve different purposes. Recognition does not give the platform or every merchant using it a general right to sell medicines online. The service must operate through authorized pharmacies, with pharmacists providing professional services during pharmacy operating hours. Delivery must be traceable and comply with the prescribed service-area requirements. Developers therefore need to structure onboarding, consultation access, and fulfillment around the authorized pharmacy service.

Build Compliance into the Product;

A developer should assess the FDA’s application-review criteria before committing to the platform’s architecture. The FDA states that its consideration covers legal compliance, information security, and personal data protection. In practical terms, the product design should establish how participating pharmacies and pharmacists are verified, how patients reach the responsible pharmacist, and how consultation and delivery records can be retrieved when a problem arises. These design questions should be tested against the applicable criteria rather than left to individual pharmacies to resolve after launch.

Contracts, Data, and Commercial Responsibility:

The platform’s agreements should reflect who actually performs each part of the service. Matters to settle include responsibility for professional advice, medicine supply, pharmacist availability, delivery failures, complaints, refunds, and cooperation with regulatory inquiries. Patient data also requires particular attention: developers should map what information the platform collects, why it needs that information, who can access it, and what is disclosed to delivery providers. Decisions about consultation storage, analytics, and secondary uses of data should receive legal review before becoming standard product features. A platform that coordinates a transaction may still assume substantial obligations through its own conduct, contractual promises, and handling of patient information.

Key Takeaways:

For prospective platform operators, telepharmacy is a regulated healthcare service model that requires coordinated application recognition, pharmacy authorization, and professional involvement. The strongest starting point is to confirm the applicable FDA criteria, define the platform’s role, and translate that role into product controls and enforceable agreements. Regulatory review should precede launch and inform the core design, particularly where the platform manages consultations, patient records, or medicine delivery.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

DIP: New Facility Checks the Status of Corporate Trademark Owners

A new due-diligence link:

The Department of Intellectual Property (DIP) has added a corporate-status check to its IP Search system. When a trademark record names a legal entity as owner, users can follow a link to the Department of Business Development’s DataWarehouse+ system to check the entity’s status, including whether it has been dissolved, liquidated, or struck off. The facility uses the DBD’s corporate records and is intended to help users identify risks when dealing with someone claiming rights in a company’s trademark.

What the facility means for transactions:

The link is an administrative service; it does not change the rules governing trademark ownership, assignment, or licensing. It gives buyers, licensees, business partners, and enforcement teams a useful first check when reviewing a trademark portfolio or a person’s authority to act for a corporate owner.

A dissolved company’s status should not, by itself, be treated as proof that its trademark rights have disappeared. Thai law provides that a company continues to exist to the extent necessary for liquidation, during which its affairs are settled and assets distributed. The trademark’s status therefore requires a closer review of the liquidation and asset-distribution records, any transfer documents, and the person’s authority to act.

Key takeaways:

  • Check the DBD status when a Thai trademark is registered to a company.
  • Treat the result as a due-diligence flag, then verify the company’s liquidation and asset records.
  • Before signing or enforcing, confirm the current owner and the other party’s authority to deal with the mark.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

Thailand’s Revenue Department Launches Public Consultation on Draft Departure Tax Act: Key Proposed Principles and Implications

The Ministry of Finance, through the Revenue Department (the “RD”), the agency responsible for tax administration and collection, is proposing a revised framework for the collection of departure tax (the “Departure Tax”) under the Draft Departure Tax Act, B.E. [●] (the “Draft Act”).

From 30 September to 29 October 2026, the RD is conducting a public consultation (the “Public Consultation”) on 11 key proposed principles of the Draft Act (the “Proposed Principles”). As the Draft Act has not yet been released for public review, the Public Consultation seeks to inform affected persons and stakeholders of the Proposed Principles, their objectives and their potential impact, and to gather feedback for refining the Proposed Principles and preparing the Draft Act.

Background and Objectives

Thailand first introduced the Departure Tax under the Emergency Decree on Departure Tax, B.E. 2526 (1983) (the “Current Regime”), which took effect on 28 December 1983. Its purpose was to curb excessive outflows of foreign currency and safeguard Thailand’s balance of payments.

Under the Current Regime, the Departure Tax is structured as follows:

1. Persons subject to the Departure Tax

  • Thai nationals, including those born in Thailand or abroad and those who later acquired Thai nationality through naturalization.
  • Foreign nationals holding permanent residence in Thailand, as granted under the applicable immigration laws.

2. Departure Tax rates (maximum THB 5,000)

  • Departures by air: THB 1,000 per person per departure.
  • Departures by land or sea: THB 500 per person per departure.

In practice, however, the Departure Tax is currently exempt for all modes of departure. Departures by land or sea were exempted under Ministerial Regulation No. 4, B.E. 2529 (1986), effective 1 May 1986. Departures by air followed under Ministerial Regulation No. 6, B.E. 2534 (1991), effective 1 July 1991. Both exemptions were introduced in response to the economic conditions of the time and remain in force.

Key Principles of the Draft Act Under Public Consultation

To strengthen fiscal flexibility in responding to future emergencies, the Ministry of Finance has tasked the RD with reviewing the Departure Tax framework. The principal proposed change is to extend the Departure Tax to all persons departing Thailand, regardless of nationality, rather than limiting it to Thai nationals and foreign permanent residents as under the Current Regime.

The 11 Proposed Principles are summarized below:

  1. Persons subject to the Departure Tax: The Departure Tax would apply to all persons departing Thailand, regardless of nationality. The only exception would be carrier personnel, such as pilots and flight attendants, who travel without paying a fare while performing their duties.
  2. Departure Tax rate: The Draft Act would set a maximum rate of THB 5,000 per person per departure. The applicable rate would be prescribed by Ministerial Regulation.
  3. Exemptions: Categories of exempt persons would be prescribed by Ministerial Regulation.
  4. Initial phase: During the initial phase, the rate would be THB 1,000 per air departure, and no Departure Tax would be imposed on departures by land or sea. The Proposed Principles do not specify how long this phase would last after the Draft Act takes effect.
  5. Collection: The Departure Tax would be payable before departure. Where a ticket is purchased, the international passenger carrier or its ticketing agent would collect the tax together with the passenger fare.
  6. Travel without a ticket or fare: Where no ticket is purchased or issued, or no fare is paid or collected through a carrier or ticketing agent, travelers would pay the Departure Tax in accordance with rules and procedures prescribed by the Director-General of the RD.
  7. Commencement: The Draft Act would take effect 180 days after its publication in the Government Gazette.
  8. Non-application to previously purchased tickets: The Draft Act would not apply to tickets purchased before its effective date, even if the passenger departs after that date.
  9. Powers of competent officials: Competent officials would be empowered to assess and collect the Departure Tax, penalties and surcharges; to issue summonses and orders; and to search for or seize accounts, documents and other relevant evidence.
  10. Penalties and surcharges: A penalty of twice the amount of Departure Tax payable or required to be remitted would apply. In addition, a surcharge of 1.5% per month (or part thereof) would accrue on unpaid or unremitted Departure Tax, excluding penalties.
  11. Sanctions for non-compliance: The Draft Act would impose sanctions for tax evasion or attempted evasion involving false statements, false testimony, false evidence or other fraudulent means. Sanctions, including regulatory fines where applicable, would also apply to persons who obstruct or fail to cooperate with competent officials or who breach their statutory obligations.

Next Steps

After the Public Consultation closes, the RD will summarize the feedback received and publish a report on the results. The feedback will be used to refine the Proposed Principles, which will form the basis for preparing the Draft Act and proceeding to the subsequent legislative drafting process.

Key Takeaways

  • The proposed framework would apply to all persons departing Thailand, regardless of nationality, subject to prescribed exemptions.
  • The Draft Act would set an initial tax rate of THB 1,000 for air departures and no tax on land or sea departures. The duration of this initial phase has not been specified. The maximum tax rate will be in the amount of THB 5,000.
  • The Proposed Principles remain subject to the Public Consultation and may be revised in light of the feedback received before the Draft Act is finalized.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

BOI: New Screening Requirements for Data Center Investment Promotion

The Board of Investment (BOI) has introduced a mandatory screening requirement for Data Center projects seeking investment promotion, extending its application to certain pending applications and expansions of existing projects. Under BOI Notification No. Sor. 3/2569, projects must obtain prior approval from a BOI-designated subcommittee before submitting an investment-promotion application. The notification, published on the Energy Regulatory Commission (ERC) website, reflects increasing regulatory scrutiny of Data Center investments, particularly their demands on electricity infrastructure, water resources and the environment.

Mandatory Screening Before BOI Applications:

Notification No. Sor. 3/2569 replaces Notification No. Sor. 2/2569, which previously required confirmation from the ERC before an investment-promotion application could be submitted. Under the revised requirements, Data Center projects classified under Category 8.2.1.1 (high-energy-efficiency Data Centers) and Category 8.2.1.2 (other Data Centers) must instead obtain approval from a subcommittee designated by the BOI to screen Data Center projects. This approval is a prerequisite to submitting an application for investment promotion, introducing an additional regulatory stage that developers must address before proceeding with the BOI application process.

Pending Applications and the 30% IT Load Threshold:

Importantly, the notification is not limited to new applications. Clause 3 expressly extends its application to projects submitted under the previous investment-promotion policy that remain under consideration, as well as applications to amend existing projects where the proposed changes increase IT load by more than 30%. Accordingly, developers cannot assume that earlier applications are automatically exempt from the revised screening requirements. The 30% threshold is particularly significant for phased developments and capacity expansions, as an existing BOI-promoted project may require further screening when its approved IT load is substantially increased.

Implications for Data Center Developers:

The revised requirements introduce an additional consideration for investment planning and regulatory due diligence. Developers should assess the screening requirement before filing new applications, review the status of pending applications and evaluate whether planned capacity expansions exceed the prescribed IT load threshold. Electricity infrastructure, water availability and environmental considerations should also be addressed early in project planning, given their express recognition in the notification. These requirements are already operative and must be distinguished from the broader national Data Center regulatory proposals concerning building classification, electricity-consumption categories and Direct Power Purchase Agreements (Direct PPAs), which remain separate policy matters and are not implemented by this notification.

Key Takeaways:

  • Prior approval: Data Center projects under BOI Categories 8.2.1.1 and 8.2.1.2 require subcommittee approval before applying for investment promotion.
  • Pending applications: Projects submitted under the previous policy and still under consideration are subject to the revised requirements.
  • Expansion threshold: Project amendments increasing IT load by more than 30% are also covered.
  • Infrastructure scrutiny: Electricity, water resources and environmental considerations are central to the revised screening policy.
  • Separate regulatory framework: The BOI notification establishes an existing investment-promotion requirement, independently of the proposed national Data Center regulations.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

PDPA: Research Consent, Lawful Bases and the Use of Personal Data in Research

The use of personal data in scientific and academic research presents legal challenges, particularly where research ethics requirements intersect with obligations under the Personal Data Protection Act B.E. 2562 (2019) (PDPA). On October 9, 2026, the National Research Council of Thailand (NRCT) and the Personal Data Protection Committee Office (PDPC Office) jointly presented guidance on personal data protection in research activities, highlighting the distinction between research ethics consent and consent under the PDPA, the identification of appropriate lawful bases for processing personal data, and measures to reduce the risk of identifying individuals from research datasets. Although the initiative does not introduce new legislation or amend existing PDPA requirements, it signals increasing regulatory attention to the handling of personal data throughout the research lifecycle.

Research Ethics Consent and Consent Under the PDPA:

One of the principal issues addressed is the distinction between consent obtained for research ethics purposes and consent required under the PDPA. Research ethics consent generally concerns a participant’s voluntary agreement to participate in a study after receiving sufficient information about its objectives, methodology, potential risks, and expected benefits. Consent under the PDPA, however, serves a different legal function and must satisfy statutory requirements where consent is relied upon as the lawful basis for processing personal data. Accordingly, obtaining informed consent through an institutional review board or research ethics committee does not automatically establish valid consent under the PDPA. Research institutions must independently assess whether the processing activities require PDPA consent or may be justified under another applicable lawful basis.

Lawful Bases for Processing Research Data:

The PDPA recognizes circumstances in which personal data may be processed for scientific, historical, or statistical research without relying exclusively on consent, subject to applicable statutory conditions and appropriate safeguards. In particular, Section 24(1) addresses certain research-related processing activities, while Section 26 establishes separate requirements for sensitive personal data, including health information, genetic data, and biometric data. These provisions should not be interpreted as providing a blanket exemption for research activities. Research institutions must assess the nature of the data, the purposes of processing, the applicable statutory conditions, and the safeguards necessary to protect data subjects. This assessment becomes particularly important in medical research, clinical trials, pharmaceutical development, and projects involving large-scale datasets or secondary uses of information originally collected for other purposes.

Anonymization, Pseudonymization and Research Publication:

Another important consideration is the risk of identifying individuals through research data, particularly when datasets are shared, combined, or published. Effective anonymization may place information outside the scope of the PDPA where individuals can no longer be identified, directly or indirectly, taking account of reasonably available means of identification. Pseudonymization, by contrast, generally reduces identification risks but does not necessarily remove information from the scope of personal data protection requirements. Research organizations should therefore adopt appropriate technical and organizational measures, including data minimization, access restrictions, separation of identifying information, and assessments of re-identification risks before disclosing research findings or making datasets available to third parties. Similar considerations arise when research data is used to train, test, or develop artificial intelligence systems.

Future Research Funding Requirements and Compliance Expectations:

The NRCT has also outlined plans to strengthen personal data protection requirements within its research funding framework. Preparatory measures are expected during fiscal year 2027, with a proposed requirement for principal investigators to complete personal data protection training as a condition for research funding applications beginning in fiscal year 2028. The NRCT has additionally indicated an intention to encourage the use of artificial intelligence tools to review research information before publication. These initiatives suggest that data protection compliance may increasingly become part of research governance and funding eligibility, rather than remaining solely a matter of institutional policy. However, the proposed training requirement should not yet be treated as an existing legal obligation or a finalized funding condition.

Implications for Research Institutions and Businesses:

Universities, hospitals, research institutes, pharmaceutical companies, and businesses engaged in research and development should review their existing procedures for collecting, using, sharing, retaining, and publishing personal data. Particular attention should be given to the relationship between research participation documents and PDPA privacy notices, the identification and documentation of lawful bases, the processing of sensitive personal data, and arrangements governing data sharing with research collaborators and technology providers. Where personal data is subsequently used for AI development or other secondary research purposes, organizations should assess whether the proposed processing is compatible with the original purposes and whether additional legal conditions or safeguards apply.

The guidance presented by the NRCT and the PDPC Office represents a practical compliance development rather than a change to the statutory framework. As the publicly reported initiative does not yet constitute a complete, formally issued regulatory guidance document, its contents should be distinguished from binding requirements under the PDPA and applicable subordinate legislation.

Key Takeaways:

  • Research ethics consent is not equivalent to PDPA consent: Research organizations must separately establish an appropriate lawful basis for processing personal data.
  • Research activities are not automatically exempt from the PDPA: Applicable statutory conditions and safeguards must be assessed, particularly when sensitive personal data is involved.
  • Anonymization and pseudonymization have different legal consequences: Organizations should evaluate re-identification risks before sharing or publishing research datasets.
  • Research funding requirements may become more closely linked to data protection compliance: The NRCT’s proposed training requirements warrant monitoring but should not be treated as finalized obligations.
  • Secondary research and AI development require careful legal assessment: Reusing research data for new purposes may raise additional questions concerning lawful bases, transparency, data minimization, and data subject rights.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

Competition: New Mandatory Credit Terms for Payments to SMEs

The Trade Competition Commission has introduced new rules governing credit terms between large businesses and small and medium-sized enterprises (SMEs). The new framework represents a significant development in the regulation of unfair trade practices by imposing maximum payment periods on large businesses purchasing goods or services from SMEs and restricting practices that may delay payment or otherwise place SMEs at a disadvantage. The rules are particularly relevant to large manufacturers, service providers, distributors, wholesalers, retailers and corporate groups that routinely procure goods or services from SME suppliers.

Who Is Subject to the New Rules?

The rules apply where an SME supplies goods or services to a large business or a large wholesale or retail business. A large business generally means a business operator whose revenue generated from business operations in Thailand in the preceding accounting year is THB 500 million or more. Importantly, the assessment is not necessarily limited to the revenue of a single legal entity. Businesses having relationships in terms of policy or control may be considered together in determining whether the threshold is met. This aggregation concept is particularly relevant to corporate groups, meaning that an entity with revenue below THB 500 million should not automatically assume that it falls outside the rules. Large businesses should therefore establish a reliable process for determining which suppliers qualify as SMEs and whether the revenue threshold is met on an individual or group basis.

Maximum Credit Terms of 30 or 45 Days:

For general trade, manufacturing and service transactions, payment must generally be made within 45 days. A shorter maximum period of 30 days applies to agricultural products and primary processed agricultural products involving uncomplicated production processes. Where the parties have already agreed to a payment period shorter than the applicable statutory maximum, the shorter agreed period continues to apply. The statutory periods should therefore be regarded as maximum limits rather than standard payment terms permitting businesses to extend existing, more favorable terms.

When Does the Credit Period Begin?

The credit period generally begins when the goods or services have been completely delivered and the required documentation is complete and correct. This makes delivery confirmation, service acceptance, invoices and supporting documentation important elements of compliance. Large businesses should examine whether their internal procedures could effectively postpone the commencement of the payment period. Requirements relating to acceptance certificates, invoice submission, tax invoice corrections, procurement approvals or other supporting documents should have a legitimate operational basis and should not be used as mechanisms to delay payment. Compliance may therefore require coordination among procurement, business units, finance, legal and accounts payable functions.

Unfair Payment Practices:

The rules extend beyond maximum payment periods and address conduct that may constitute an unfair trade practice. Large businesses should not delay payment to SMEs without reasonable justification or improperly change agreed credit terms or contractual conditions. Relevant changes are also subject to advance-notice requirements, including at least 60 days’ prior notice in applicable circumstances. Accordingly, compliance cannot be achieved merely by inserting a contractual provision stating “payment within 45 days.” Repeatedly rejecting invoices for immaterial deficiencies, unnecessarily delaying acceptance of delivered goods, imposing unjustified documentation requirements or changing payment procedures in a manner that effectively extends the credit period may potentially attract regulatory scrutiny.

Impact on Existing Contracts and Procurement Practices:

The rules restrict the extent to which payment terms can simply be treated as a matter of contractual negotiation. Large purchasers may historically have required SME suppliers to accept payment periods of 60, 90 or even 120 days under standard procurement terms. Contractual agreement alone will no longer necessarily validate such arrangements where the applicable statutory maximum is exceeded. Businesses should therefore review master supply agreements, purchase orders, vendor terms, procurement policies and supplier portals, including contractual mechanisms that may have substantially the same economic effect as an extended credit term.

Competition Law Consequences:

Non-compliance may constitute an unfair trade practice under Section 57(4) of the Trade Competition Act B.E. 2560 (2017) and may result in an administrative fine of up to 10% of the offender’s revenue in the year in which the violation occurred. It is important to distinguish this administrative liability from criminal liability under other provisions of the Act. A violation of the credit-term requirements does not, by itself, automatically constitute a criminal offense. However, the same conduct may separately fall within other provisions of the Act, including those concerning abuse of dominance or anticompetitive conduct, where the relevant statutory elements are independently satisfied.

Preparing for Compliance:

Affected businesses should review both their contractual documentation and actual payment processes. The review should identify SME suppliers, determine whether the THB 500 million threshold applies on an individual or group basis, classify transactions subject to the 30-day and 45-day limits, and examine master agreements, purchase orders and standard procurement terms. Businesses should also review how they determine complete delivery and receipt of correct documentation and ensure that invoice approval, dispute resolution and accounts payable processes do not unnecessarily extend payment periods. For corporate groups with centralized procurement or accounts payable functions, supplier classification and automated payment-term controls within ERP or payment systems may provide an effective compliance mechanism.

Key Takeaways:

The new credit-term rules materially strengthen payment protection for SMEs dealing with larger counterparties. Businesses meeting the THB 500 million revenue threshold, including through aggregation where applicable, should assess their procurement relationships and identify SME suppliers subject to the new regime. The principal maximum credit terms are 45 days for general trade, manufacturing and services and 30 days for qualifying agricultural and primary processed agricultural products. Compliance extends beyond contractual wording to delivery acceptance, documentation, invoice verification and actual payment practices. Given the potential administrative fine of up to 10% of annual revenue, affected businesses should treat compliance with the new credit-term requirements as a competition-law and procurement compliance issue rather than merely an accounts payable matter.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

Digital Trust in Action: ETDA’s Key Priorities for 2027

The Electronic Transactions Development Agency (ETDA) has set out its key priorities for 2027, signaling a significant transition in the development of Thailand’s digital regulatory environment. While much of ETDA’s work in recent years has focused on building regulatory frameworks, technical standards and trusted digital infrastructure, the emphasis for 2027 is increasingly on putting those mechanisms into actual use.

ETDA describes its evolving role as a “Co-Creation Regulator & Facilitator” reflecting an approach that combines regulation with collaboration, experimentation and facilitation. Its 2027 agenda focuses on four principal areas: Digital ID and verifiable digital credentials, AI governance, digital transformation of SMEs, and stronger oversight of digital platform services. The common thread is a shift from establishing digital trust frameworks to demonstrating how those frameworks work in practice.

Digital ID: from proving identity to proving rights and authority:

Digital ID has become one of the most developed components of Thailand’s digital infrastructure. ETDA reports that 28 Digital ID service licenses have been issued, while 1,797 government e-services were connected to Digital ID as of June 2026. Accumulated user accounts reached approximately 162.63 million. Digital ID is already being used across government services involving matters such as taxation, healthcare entitlements and household registration.

The next stage goes beyond simply establishing that a person is who they claim to be. ETDA is moving toward an ecosystem in which individuals and organizations can digitally prove particular facts, qualifications, rights or authority through Verifiable Credentials (VCs).

Initial use cases include digital academic transcripts and caregiver services, where digital credentials can be used to establish a relationship between a vulnerable person and a caregiver. ETDA has also been exploring interoperability for cross-border transactions. The objective is therefore progressively moving from electronic identification toward reusable and independently verifiable digital credentials.

In 2027, ETDA plans to further develop the VC ecosystem, including assessment mechanisms for service providers and a VC Trusted List. Another important initiative is the proposed pilot of a national identification card in VC format in cooperation with relevant government agencies.

The model could materially change the conventional practice of repeatedly submitting copies of identification documents. Instead of disclosing an entire document, VC technology may allow a person to disclose only the information required for a particular transaction. This could make digital transactions more efficient while supporting data minimization and reducing unnecessary circulation of copies of identity documents.

ETDA also plans to promote a Digital Document Wallet, allowing individuals to access and use digital documents electronically, and to expand Digital ID infrastructure to support additional user groups, including foreign nationals.

Of particular relevance to businesses is the Integrated Document Signing Platform (IDSP). Having undergone sandbox testing, the platform is intended to support verification of corporate authority and execution of documents between organizations. If adopted more broadly, infrastructure of this kind could simplify one of the persistent practical issues in electronic contracting: verifying not merely the identity of the individual signing a document, but whether that individual has authority to bind the relevant legal entity.

The implications extend beyond electronic signatures. Businesses may increasingly need systems capable of receiving and verifying digital credentials for customer onboarding, employee qualifications, corporate authorization, contractual documentation and other transactions. Digital identity is consequently developing from a standalone authentication mechanism into part of the infrastructure underlying digital commerce.

AI governance: moving from principles into the sandbox

AI governance is another area where ETDA intends to move from frameworks toward practical implementation.

ETDA has developed draft AI legislation together with more than 12 guidelines, toolkits and related governance materials. AI governance initiatives have been implemented across four major sectors—education, the justice system, government and financial services—covering more than 140 organizations. ETDA has also provided AI governance training across government and reports reaching more than 120,000 users through its AI-related knowledge initiatives.

The next stage centers on the AI Governance Practice Center (AIGPC) and the AI Governance Sandbox.

The AIGPC is expected to operate as a central platform bringing together government agencies, AI developers, businesses and experts. Rather than treating AI governance primarily as a collection of abstract principles, the sandbox approach allows governance requirements to be tested against actual AI systems and use cases.

ETDA has identified several areas requiring particular attention because of their potential risk, including education, children and vulnerable groups, and the justice system. Sandbox testing is expected to examine issues such as risk management, privacy, transparency and compliance with applicable laws. The results may subsequently inform sector-specific guidelines and proposals for regulatory measures. ETDA also intends to develop testing criteria for multilingual AI safety. (ETDA⁠)

This direction is significant for organizations developing or deploying AI. The central compliance question is increasingly likely to move from whether an organization has adopted general AI principles to whether it can demonstrate that those principles are implemented in practice.

Organizations using AI should therefore consider governance mechanisms that document matters such as the purpose and scope of an AI system, risk classification, data governance, privacy implications, human oversight, transparency, testing and monitoring, accountability and procedures for responding when the system produces inappropriate or harmful outcomes.

For higher-risk AI applications, governance documentation may become particularly important. The sandbox model also indicates that regulatory expectations may evolve through testing and practical experience rather than solely through prescriptive legislation.

SMEs Growth: from adopting technology to demonstrating growth

ETDA’s third priority approaches digital trust from an economic development perspective. The objective is to move SMEs from being merely “digitally ready” toward achieving measurable growth through technology.

Thailand’s Digital Maturity Index has indicated that many SMEs remain at the “Digital Follower” level. ETDA’s response has been to develop a model that first assesses the particular digital maturity and operational gaps of a business and then connects that business with appropriate technology, expertise and financing.

The SMEs Growth program has operated across four regions and 16 provinces. ETDA reports participation by 1,697 SMEs and 138 digital providers, with 108 successful business matches. The program generated an estimated THB 689.5 million in combined economic and social impact, of which approximately THB 530.6 million was attributed to SMEs and THB 158.9 million to digital providers.

An important development arising from the program is the SMEs Profile, essentially a development map intended to help businesses understand their current position, identify operational gaps and select appropriate technology and support mechanisms. The approach recognizes that different SMEs face different constraints: one business may require technology, another personnel or skills, while another may require financing or specialist advice.

In 2027, ETDA intends to expand this model, with particular attention to trade and retail, manufacturing, and tourism-related businesses. Importantly, the effectiveness of digital transformation is intended to be assessed by business outcomes, including revenue, costs, productivity, market development and competitiveness.

This represents a meaningful change in the way digital transformation is measured. The relevant question is no longer simply whether an SME has adopted digital technology, but whether the technology produces measurable improvements in the business.

For technology providers, this may similarly change expectations. Solutions that can demonstrate improvements in revenue, cost efficiency, productivity or market access are likely to be more persuasive than technology adoption for its own sake.

Digital platforms: from bringing platforms into the system to regulating conduct

The fourth priority is particularly relevant to digital platform operators.

Thailand’s digital platform services regulatory framework has already brought a substantial number of services within the regulatory system. ETDA reported that 2,133 digital platform services had submitted notifications by August 2026. The next phase is increasingly concerned with what platforms do after entering the system. (ETDA⁠)

ETDA’s 2027 direction can broadly be understood through three regulatory mechanisms.

First, existing requirements applicable to particular categories of platforms are expected to move toward more active implementation. ETDA has specifically identified e-marketplaces and ride-sharing platforms as areas where existing rules must produce practical results.

Second, regulation is increasingly focused on preventing harm at an earlier stage. ETDA’s approach emphasizes platform mechanisms for preventing, detecting and responding to problematic activities rather than relying exclusively on intervention after harm has occurred. Content moderation and measures applicable to social media platforms form part of this broader direction.

Third, ETDA is paying greater attention to transparency and fairness in platform commercial practices. One issue is the structure and disclosure of platform fees and gross profit or “GP” charges. ETDA has acknowledged that responsibility for competition, pricing and related matters may fall within the authority of other regulators. Its approach is therefore based partly on transparency requirements and regulatory coordination rather than attempting to regulate every aspect of platform activity under a single statute. ETDA also plans to develop regulatory guidance for application marketplaces.

This illustrates an important characteristic of the emerging platform regulatory model: co-regulation and regulatory coordination.

Many problems arising on digital platforms involve conduct already regulated elsewhere. Non-compliant products, transportation services, accommodation, competition issues and online fraud may each fall within the responsibility of different authorities. ETDA’s role increasingly involves requiring platforms themselves to establish effective systems for prevention, verification, response and coordination with the competent authority.

The development of the 1212 ETDA Center reinforces this approach. ETDA describes complaint information as a form of system-level “radar”: complaints can be aggregated and analyzed to identify emerging risks and then referred to the responsible authority or used to develop preventive measures.

Platform operators should therefore expect regulatory attention to extend beyond formal notification requirements. Internal processes concerning merchant or service-provider verification, complaint handling, content governance, transparency, risk assessment, cooperation with authorities and remediation may become increasingly important aspects of operational compliance.

A broader transition from rules to implementation:

Taken together, ETDA’s four priorities reveal a broader development in Thailand’s digital regulatory policy.

The earlier stage of digital regulation necessarily concentrated on building infrastructure and establishing rules: Digital ID standards had to be created, AI governance principles developed, SMEs encouraged to adopt technology, and digital platforms brought within an identifiable regulatory framework.

The 2027 agenda ask a different question: do those systems work in practice?

For Digital ID, the question is whether trusted identity infrastructure can support reusable credentials, digital documents and corporate transactions. For AI, it is whether governance principles can be translated into controls capable of being tested against real AI systems. For SMEs, it is whether technology adoption produces measurable economic benefits. For platforms, it is whether regulatory obligations result in safer and fairer digital services.

This also explains ETDA’s characterization of itself as a Co-Creation Regulator & Facilitator. The emerging regulatory model does not rely exclusively on issuing additional rules. It combines standards, trusted lists, sandboxes, guidance, complaint data, cooperation with other regulators and collaboration with the private sector. (ETDA⁠)

For businesses, the practical consequence is that operational readiness will become increasingly important.

Digital service providers should consider whether their architecture can accommodate verifiable credentials and trusted digital documents. Organizations deploying AI should establish governance processes capable of being documented and tested. Technology providers serving SMEs should be able to demonstrate measurable business outcomes. Digital platforms should review not only whether they fall within the regulatory regime but also whether their operational processes satisfy emerging expectations concerning transparency, safety, complaint management and risk mitigation.

The direction of travel is therefore clear: digital trust is moving from policy architecture into day-to-day digital transactions and business operations.

Key Takeaways:

  • Digital ID is evolving into broader digital transaction infrastructure. Verifiable Credentials, Digital Document Wallets and corporate authorization mechanisms could change how identity, rights, qualifications and signing authority are established online.
  • AI governance is becoming operational. The AIGPC and AI Governance Sandbox are expected to test governance principles against real use cases, particularly in areas presenting higher risks.
  • AI users should focus on demonstrable governance. Risk assessments, privacy controls, transparency, human oversight, testing and accountability are increasingly relevant as governance moves from principles to implementation.
  • SME digital transformation will be judged increasingly by results. ETDA’s approach emphasizes measurable improvements in revenue, cost, productivity, market access and competitiveness rather than technology adoption alone.
  • Digital platform regulation is entering a more operational phase. Platform operators should expect increasing attention to preventive controls, transparency, content and complaint management, risk-based regulation and cooperation with other authorities.
  • 2027 will be a year of implementation. Across all four priorities, ETDA’s central objective is to turn digital trust from regulatory and technical frameworks into infrastructure and practices that produce tangible results for individuals and businesses.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

Thailand–Canada Free Trade Agreement (TCAFTA): Cabinet Approves Negotiating Framework

Introduction

Thailand’s Cabinet has approved the negotiating framework for the Thailand–Canada Free Trade Agreement (“TCAFTA”) and endorsed Thailand’s participation in the forthcoming negotiations with Canada. The Cabinet also acknowledged the TCAFTA reference paper and the composition of Thailand’s negotiating delegation. In addition, it authorized the Minister of Commerce, or an authorized representative, to launch the negotiations jointly with Canada through an announcement or joint statement.

Background

Thailand currently has 14 free trade agreements (“FTAs”) with 18 countries, covering approximately 60.9% of its total trade. As part of its strategy to strengthen economic stability and competitiveness, Thailand continues to expand its FTA network. In 2025, bilateral trade between Thailand and Canada reached approximately THB 128.9 billion, an increase of about THB 15.4 billion from 2024, with Thailand maintaining a substantial trade surplus. TCAFTA would be Thailand’s first FTA with a North American country.

Scope of the Negotiating Framework

The framework draws on those previously approved by the Cabinet for the ASEAN–Canada FTA and the Thailand–European Union FTA. The draft was discussed with public- and private-sector stakeholders and revised in light of comments from government agencies.

It covers 26 topics, including:

  • Trade in goods
  • Rules of origin
  • Intellectual property
  • Customs procedures and trade facilitation
  • Sanitary and phytosanitary measures
  • Trade in services
  • Digital trade
  • Investment

Domestic procedures are under way to enable the official launch of negotiations in October 2026.

Expected Impact

TCAFTA is expected to have an overall positive impact on Thailand’s trade in goods, trade in services and investment. It would also provide an opportunity to raise Thailand’s trade regulations and standards to a higher international level.

Key Takeaways

  • The Cabinet approved the TCAFTA negotiating framework, Thailand’s participation in the talks and the structure of its delegation.
  • The framework covers 26 topics, including trade in goods, rules of origin, intellectual property, services, digital trade and investment.
  • TCAFTA is expected to enhance Thailand’s competitiveness and benefit trade and investment, while supporting the upgrading of its trade rules.
  • Negotiations are expected to launch in October 2026, once domestic procedures are complete.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles