Tag: Government

on by

Managing Regulatory Due Diligence for Cross-Border Investors in Financial and Digital Asset Businesses

Introduction:

Cross-border investments in financial services and digital asset businesses present unique regulatory challenges that extend well beyond traditional legal or financial due diligence. Whether an investor is acquiring a licensed payment service provider, a securities business, a digital asset exchange, or a fintech company operating under sector-specific regulation, the value of the transaction can depend as much on the target’s regulatory standing as on its commercial performance.

Unlike ordinary commercial businesses, regulated entities operate under continuing supervision. Their ability to conduct business depends not only on maintaining the necessary licenses but also on demonstrating ongoing compliance with governance requirements, prudential standards, anti-money laundering obligations, cybersecurity controls, and consumer protection rules. A company with strong financial performance may nevertheless represent a significant acquisition risk if its regulatory compliance has deteriorated or if it is subject to undisclosed supervisory concerns.

For cross-border investors unfamiliar with the Thai regulatory landscape, regulatory due diligence is therefore not merely a legal exercise. It is an essential component of transaction risk assessment and should begin early in the acquisition process.

Looking Beyond the License:

One of the most common misconceptions among foreign investors is that verifying the existence of a regulatory license is sufficient. In reality, the existence of a license represents only the starting point of the analysis.

Many regulated businesses have evolved over time, expanding their products and services beyond the scope originally contemplated when their licenses were granted. A fintech company may initially have operated as an electronic payment platform before introducing digital lending, cross-border remittance services, or digital asset-related products. Each new business activity may require separate regulatory approval or may be subject to different supervisory requirements.

Regulatory due diligence should therefore examine whether every revenue-generating activity falls within the scope of the target’s existing licenses and whether any exemptions relied upon remain available. It is equally important to determine whether any license conditions have been imposed by regulators and whether the company has complied with those conditions throughout its operations.

Regulatory Approval May Determine Whether the Transaction Can Close:

Unlike acquisitions involving ordinary commercial companies, transactions involving regulated financial businesses frequently require regulatory approval before completion. In some sectors, a change in significant shareholding or control may not become legally effective until the relevant regulator has approved the transaction. Other regulatory regimes may require post-closing notifications or impose “fit and proper” assessments on incoming shareholders, directors, or senior management.

Consequently, regulatory due diligence should identify not only the approvals required for the target’s day-to-day operations but also those triggered by the proposed acquisition itself. Failure to identify these requirements early can delay completion, affect financing arrangements, or require restructuring of the transaction.

Cross-border investors should also consider whether foreign ownership restrictions, residency requirements, or limitations on board composition may influence the post-closing governance structure.

Compliance Culture Often Matters More Than Written Policies:

Modern financial regulators increasingly assess how compliance operates in practice rather than whether a company simply maintains a complete set of written policies.

Accordingly, regulatory due diligence should extend beyond reviewing compliance manuals and internal procedures. Investors should seek evidence that compliance functions are adequately resourced, that internal reporting mechanisms operate effectively, and that senior management actively oversees regulatory risk.

The company’s interactions with regulators may provide particularly valuable insight. Inspection reports, supervisory correspondence, warning letters, remediation plans, and historical enforcement actions often reveal recurring compliance weaknesses that are not apparent from corporate documentation alone. Even where no formal penalties have been imposed, repeated supervisory findings may indicate weaknesses in governance or internal controls that require significant remediation after closing.

Technology Risk Has Become a Core Regulatory Issue:

Technology is now central to regulatory supervision of financial institutions and digital asset businesses. Cybersecurity failures, operational disruptions, and weaknesses in technology governance increasingly attract regulatory attention regardless of whether they result in customer losses.

For investors, this means regulatory due diligence should include an assessment of cybersecurity governance, incident response procedures, disaster recovery planning, outsourcing arrangements, cloud service management, and operational resilience frameworks. Businesses operating digital asset platforms should also be assessed for wallet security, custody arrangements, transaction monitoring systems, and market surveillance capabilities.

Technology deficiencies may not immediately affect valuation but can require substantial investment after completion to satisfy regulatory expectations.

AML and Financial Crime Controls Remain High-Risk Areas:

Anti-money laundering and counter-terrorism financing compliance continues to be among the highest enforcement priorities for financial regulators. Deficiencies in customer due diligence, transaction monitoring, sanctions screening, or suspicious transaction reporting can expose regulated businesses to substantial regulatory sanctions and reputational damage.

Investors should therefore evaluate not only the target’s written AML policies but also the effectiveness of their implementation. Questions such as how high-risk customers are identified, how beneficial ownership is verified, and how suspicious transactions are escalated can provide a clearer picture of the target’s compliance maturity than policy documents alone.

Where previous regulatory inspections have identified AML deficiencies, investors should assess whether remediation has been completed and whether regulators remain satisfied with the company’s corrective measures.

Data Protection and Outsourcing Should Not Be Overlooked:

Financial institutions increasingly rely on external service providers for cloud infrastructure, customer verification, payment processing, and cybersecurity services. While outsourcing may improve operational efficiency, regulators continue to emphasize that responsibility for regulatory compliance ultimately remains with the licensed entity.

Accordingly, regulatory due diligence should review the contractual framework governing outsourced services, the company’s oversight of critical vendors, and its contingency planning should key service providers become unavailable.

Similarly, businesses handling significant volumes of customer information should be assessed for compliance with personal data protection requirements, particularly where customer information is transferred across borders or processed by third-party vendors.

Due Diligence Findings Should Shape Transaction Documents:

Regulatory due diligence should not end with the preparation of a report. Its findings should directly influence transaction structuring and the allocation of risk between buyer and seller.

Where significant compliance concerns are identified, investors may seek enhanced representations and warranties regarding licensing, regulatory compliance, anti-money laundering controls, cybersecurity, and data protection. Specific indemnities may be appropriate for known regulatory investigations or historical compliance failures. In some cases, buyers may also require identified deficiencies to be remediated as conditions precedent before closing.

Integrating regulatory due diligence into transaction documentation helps ensure that regulatory risks are appropriately allocated and reduces the likelihood of post-completion disputes.

Conclusion:

As financial regulation becomes increasingly complex and technology-driven, regulatory due diligence has evolved from a narrow licensing review into a comprehensive assessment of an institution’s regulatory health. For cross-border investors, understanding how a target interacts with regulators, manages compliance risks, and maintains operational resilience is often as important as evaluating its financial performance.

A well-executed regulatory due diligence exercise enables investors to identify hidden regulatory exposures, anticipate approval requirements, negotiate more effective contractual protections, and develop realistic post-acquisition integration plans. In regulated financial and digital asset sectors, it is often the quality of regulatory compliance—not simply the quality of the business—that ultimately determines whether an investment achieves its intended value.

Key Takeaways:

  • In acquisitions involving financial and digital asset businesses, robust regulatory due diligence is essential to preserving investment value and minimizing post-closing regulatory exposure.
  • Regulatory due diligence should evaluate the target’s overall regulatory health rather than simply confirming the existence of licenses.
  • Investors should assess governance, supervisory history, AML/CTF controls, cybersecurity, data protection, outsourcing arrangements, and change-of-control requirements alongside licensing compliance.
  • Early identification of regulatory risks helps facilitate transaction planning, regulatory approvals, and appropriate contractual risk allocation.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

BOT: Bank of Thailand Introduces Stricter Rules on Large Cash Transactions to Combat Illicit Flows

The Bank of Thailand (BOT) is set to implement enhanced oversight on significant cash movements as part of efforts to address gray-area financial activities, reduce risks of money laundering, and promote greater transparency in the financial system.

Under the upcoming regulations, financial institutions will soon be required to perform detailed customer due diligence for any cash withdrawal exceeding 5 million baht in a single transaction. Customers must clearly explain the source of the funds and the intended purpose of the cash. If the explanation is unsatisfactory or unverifiable, banks may restrict or decline to process the transaction.

This measure primarily targets unusual or high-risk cash usage that could be linked to informal, unregulated, or illicit activities. In a later phase, similar requirements will apply to cash deposits of 5 million baht or more, where the origin of the funds must also be justified.

The BOT has indicated that legitimate needs—such as those of small and medium-sized enterprises (SMEs), individuals conducting regular business operations, or other verifiable purposes—will continue to be accommodated, provided appropriate documentation and explanations are provided. However, the rules aim to make large-scale cash handling more accountable and discourage reliance on physical currency for questionable purposes.

Looking ahead, after an initial implementation period and evaluation of impacts (including any effects on ordinary users), the threshold may be lowered to 3 million baht for both withdrawals and deposits to further strengthen controls.

These changes form part of broader initiatives to tackle structural economic vulnerabilities, encourage electronic payments where practical, and limit opportunities for crime or opaque transactions.

Impact on the Public:

Most everyday individuals and small businesses will remain largely unaffected, as transactions below the 5 million baht threshold face no new requirements, and legitimate large needs can proceed with proper justification.

People or entities accustomed to handling large cash amounts (e.g., for property deals, business purchases, or other high-value activities) will need to prepare explanations and supporting evidence in advance, potentially adding time and documentation steps at the bank.

Those involved in informal or gray-area dealings may find it significantly harder to move large sums in cash without scrutiny, increasing the risk of restrictions or reporting to authorities.

Overall, the shift promotes safer, more traceable financial habits while aiming to reduce crime risks associated with large cash volumes and ease burdens through related reviews of common banking fees.

Key Takeaways:

Implementation is expected in the near future (early to mid-March timeframe), giving the public time to adjust to more accountable cash handling practices.

Cash withdrawals over 5 million baht will require clear justification of purpose and source; unsatisfactory explanations may lead to restrictions.

The rules will later extend to large cash deposits and could lower the threshold to 3 million baht after review.

Legitimate users (e.g., SMEs and individuals with valid reasons) can continue transactions by providing details—no outright ban is intended.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

Thailand Moves to Expand Access to Altruistic Surrogacy Following Marriage Equality

Thailand is considering significant amendments to its legal framework governing surrogacy, with proposed reforms intended to broaden access to assisted reproductive technology while maintaining the country’s longstanding prohibition on commercial surrogacy.

The Ministry of Public Health and relevant government agencies are currently developing amendments to the Protection for Children Born through Assisted Reproductive Technologies Act B.E. 2558 (2015). The proposed changes follow the implementation of Thailand’s marriage equality legislation, which exposed inconsistencies between the country’s family law and the existing surrogacy regime.

The draft legislation has not yet been enacted. It remains subject to public consultation and further legislative consideration.

Why Reform Is Being Considered: 

The current surrogacy law was enacted before Thailand recognized same-sex marriage. As a result, several provisions governing intended parents continue to refer to a “husband” and “wife,” effectively limiting access to opposite-sex married couples.

Following the entry into force of the Marriage Equality Act, the government has acknowledged the need to align the assisted reproduction framework with the broader legal recognition of marriage regardless of gender. The proposed amendments are therefore intended to modernize the legislation by adopting gender-neutral terminology and expanding eligibility for lawful surrogacy arrangements.

Key Proposed Amendments:

Although the draft bill may continue to evolve during the legislative process, the principal proposals under discussion include:

  • extending eligibility for altruistic surrogacy to legally married same-sex couples;
  • replacing gender-specific references in the existing legislation with gender-neutral terminology consistent with the Marriage Equality Act; and
  • expanding eligibility for certain foreign married couples, subject to statutory conditions and safeguards that are still under consideration.
  • The final scope of these amendments, including any nationality, residency, or other qualifying requirements applicable to foreign couples, has not yet been finalized.

Current Legal Position:

Until the proposed amendments become law, the existing statutory framework remains fully effective.

The current legislation permits only altruistic surrogacy, under which a surrogate mother cannot receive financial compensation beyond expenses permitted by law. Commercial surrogacy remains strictly prohibited and is subject to criminal penalties.

The Act also imposes detailed eligibility requirements for intended parents and surrogate mothers, together with regulatory oversight designed to safeguard the interests of both surrogate mothers and children born through assisted reproductive technologies.

Practical Implications

If enacted, the amendments would represent the most significant reform of Thailand’s surrogacy regime since the legislation first came into force.

For married same-sex couples, the reforms would remove one of the remaining legal inconsistencies following the recognition of marriage equality by allowing access to lawful surrogacy under the same regulatory framework applicable to other eligible married couples.

The proposed extension to certain foreign married couples may also make Thailand’s regulatory framework more accessible in cross-border family-building cases. However, there is no indication that the government intends to relax its prohibition on commercial surrogacy or weaken existing safeguards designed to prevent exploitation and reproductive tourism. Any expansion of eligibility is expected to remain subject to stringent statutory controls.

Legislative Outlook:

The proposed amendments remain at the policy development and legislative drafting stage. Accordingly, prospective intended parents, fertility clinics, healthcare providers, and legal practitioners should continue to comply with the existing legal framework until any amendments are formally enacted and accompanying regulations are issued.

Key Takeaways:

  • Businesses and professionals involved in fertility services should monitor the progress of the legislation, as the final provisions may differ from the current draft.
  • Thailand is preparing amendments to its surrogacy legislation following the implementation of marriage equality.
  • The proposed reforms would allow legally married same-sex couples to access altruistic surrogacy under the statutory framework.
  • The draft bill also contemplates expanding eligibility for certain foreign married couples, although the applicable conditions have not yet been finalized.
  • The amendments remain under legislative consideration and have not yet entered into force.
  • The existing legal framework continues to apply, including the prohibition on commercial surrogacy.

Author: Panisa Suwanmatajarn, Motana Sumetsawat, Tanadol Rungruengnoravet, and Pannaphat Suwantharakorn

Other Articles

on by

PDPA Insights: Building Effective Privacy Governance

PDPA: Data Breach Governance Is More Than a 72-Hour Deadline

One of the best-known requirements under Thailand’s Personal Data Protection Act (PDPA) is the obligation to notify the Personal Data Protection Committee (PDPC) of certain personal data breaches without undue delay and, where required, within 72 hours.

As a result, many organizations approach breach preparedness primarily as a reporting exercise. Internal discussions often focus on when the 72-hour period begins, what information should be included in the notification, and whether affected individuals must also be informed.

These are important questions.

They are also the wrong place to begin.

The Personal Data Protection Committee’s recent consultation on security measures and personal data breach management suggests a broader regulatory perspective. Rather than treating breach notification as the central compliance obligation, the consultation emphasizes governance before, during and after a security incident. It discusses risk management, organizational measures, technical safeguards, incident response planning, documentation, and continuous improvement as integral components of compliance. The message is clear: a well-governed organization should be managing breach risk long before it considers whether a notification must be submitted.

A breach rarely begins with the breach:

Organizations often describe a breach as a discrete event.

An employee clicks a malicious link.

A laptop is stolen.

A cloud storage bucket is misconfigured.

A ransomware attack encrypts corporate systems.

Yet these events rarely occur in isolation.

Most data breaches reflect weaknesses that existed long before the incident itself. Poor access management, inadequate vendor oversight, outdated systems, excessive user privileges, insufficient employee training, and incomplete asset inventories frequently contribute to the eventual breach.

Consequently, organizations should regard breach management as an ongoing governance process rather than an emergency response exercise.

The most effective incident response plans are developed before they are needed.

Security is an organizational responsibility:

Information security is often viewed primarily as an IT issue.

The PDPA takes a broader approach.

Protecting personal data requires coordinated action across multiple business functions.

Senior management establishes governance.

Human resources develops training.

Procurement evaluates vendors.

Legal reviews contractual protections.

Business units determine what personal data is collected and why.

Information technology implements technical controls.

Each function contributes to reducing breach risk.

Organizations that treat cybersecurity as the sole responsibility of technical teams may overlook governance failures that contribute equally to privacy incidents.

Incident response plans should answer practical questions:

Many organizations maintain incident response policies that satisfy regulatory requirements but provide limited operational guidance.

An effective incident response plan should answer practical questions before an incident occurs.

Who investigates the incident?

Who determines whether personal data has been compromised?

Who decides whether notification is required?

Who communicates with regulators?

Who informs affected individuals?

Who preserves evidence?

Who approves public statements?

Who manages communications with vendors?

These decisions should not be made for the first time during a cybersecurity incident.

Clear governance significantly improves response quality while reducing confusion during high-pressure situations.

Vendors increasingly determine organizational resilience:

Modern organizations rarely process personal data entirely within their own infrastructure.

Cloud providers.

Payroll processors.

CRM vendors.

Marketing platforms.

AI providers.

Managed security services.

Software developers.

Each may process significant volumes of personal data on the organization’s behalf.

Consequently, incident preparedness increasingly depends upon vendor governance.

Organizations should understand how vendors detect incidents, when they notify customers, what contractual obligations apply, how investigations are coordinated, and whether subcontractors introduce additional risk.

Vendor due diligence should therefore extend beyond procurement and continue throughout the contractual relationship.

Documentation matters before regulators ask for it:

Organizations often focus on documenting the breach itself.

Increasingly, regulators may also expect organizations to demonstrate what preventive measures existed before the incident.

Could the organization explain:

  • why specific security measures were selected?
  • why particular risks were considered acceptable?
  • when systems were last reviewed?
  • whether employees received appropriate training?
  • whether incident response plans had been tested?
  • whether previous incidents had resulted in corrective action?

These questions reflect organizational accountability rather than incident reporting.

Good documentation demonstrates that the organization actively managed risk rather than merely reacting after an incident occurred.

Every breach should improve the organization:

The conclusion of an investigation should not mark the end of breach management.

Every incident provides an opportunity to improve governance.

Organizations should conduct post-incident reviews addressing not only technical causes but also organizational lessons.

Were responsibilities clearly allocated?

Did communication function effectively?

Were vendors responsive?

Did documentation prove sufficient?

Were customers informed appropriately?

Could similar incidents occur elsewhere within the organization?

Continuous improvement is one of the strongest indicators of a mature privacy governance program.

The future of breach management:

Cyber threats will continue to evolve.

Artificial intelligence will introduce new attack vectors.

Cloud ecosystems will become increasingly complex.

Third-party dependencies will continue expanding.

Against this background, organizations should avoid viewing the PDPA primarily as imposing notification obligations.

The broader challenge is establishing governance capable of identifying, managing and learning from security incidents before they become regulatory problems.

The organizations that respond most effectively to future breaches are unlikely to be those that simply notify within 72 hours.

They will be those that can demonstrate that security, governance and accountability existed long before the incident occurred.

Key takeaways:

  • Personal data breach management begins before a breach occurs through governance, risk management and organizational preparedness.
  • Effective breach response requires coordination among legal, IT, information security, procurement, human resources and senior management.
  • Incident response plans should allocate responsibilities and decision-making authority before an incident arises.
  • Vendor governance has become an essential component of breach preparedness because third-party providers increasingly process personal data on behalf of organizations.
  • Documentation of preventive measures and continuous improvement may become as important as the breach notification itself.
  • Organizations should view breach management as an ongoing governance process rather than a regulatory reporting obligation.

Author: Panisa Suwanmatajarn, Managing Partner.

Related Articles in the “PDPA Insights: Building Effective Privacy Governance” Series

on by

Anti-Bribery: Digital Government Data Integration Raises Compliance Expectations

Thailand’s Cabinet has acknowledged progress on a series of anti-bribery initiatives designed to strengthen transparency and improve the government’s ability to detect corruption. While the measures remain at the policy and implementation stage, they indicate a clear direction toward greater use of digital government systems, cross-agency data integration, and risk-based monitoring.

For businesses that interact with government agencies, participate in public procurement, or operate in regulated industries, these developments are likely to increase compliance expectations even before new legal requirements are formally introduced.

Key Policy Developments:

The government’s anti-bribery initiatives contemplate a more integrated approach to corruption prevention through digital technologies and inter-agency cooperation. Key initiatives include:

  • Integration of financial, tax, and public procurement data across government agencies.
  • Greater public disclosure of government information through centralized digital platforms.
  • Expansion of end-to-end digital government services to reduce discretionary human interaction.
  • Use of data analytics and risk assessment tools to identify suspicious transactions and detect corruption proactively.
  • Consideration of incentive mechanisms to encourage greater private-sector participation in anti-corruption efforts.

Although these initiatives primarily reflect policy direction, they are consistent with Thailand’s broader digital government strategy and increasing reliance on technology to strengthen regulatory oversight.

Practical Implications for Businesses:

Businesses should anticipate that government agencies will increasingly be able to cross-reference information obtained from different regulatory systems. As digital integration expands, inconsistencies or unusual transaction patterns may become more visible.

Particular attention should be paid to:

Increased Cross-Database Verification:

Payments, tax filings, procurement records, licensing information, and other regulatory submissions may increasingly be compared across multiple government databases. Information that previously existed in separate systems may become easier for authorities to analyze collectively.

Higher Scrutiny of Third-Party Relationships:

Transactions involving consultants, agents, brokers, intermediaries, subcontractors, and other third parties are likely to attract greater regulatory attention. Authorities may increasingly examine whether such arrangements serve legitimate business purposes or could conceal improper payments or undisclosed benefits.

Enhanced Documentation of Business Hospitality and Related Expenditures:

Corporate hospitality, gifts, sponsorships, charitable contributions, travel expenses, and any facilitation-type payments should be supported by clear business justifications, documented approval processes, and appropriate accounting records. Well-documented decision-making will become increasingly important if government agencies rely on integrated digital records during investigations.

Greater Focus on Third-Party Due Diligence:

Businesses should expect growing emphasis on robust third-party risk management, including:

  • Appropriate due diligence before engaging intermediaries;
  • Verification of beneficial ownership where appropriate;
  • Ongoing monitoring of higher-risk business partners; and
  • Documentation demonstrating that compensation arrangements are commercially reasonable.

Recommended Compliance Actions:

Even in the absence of new mandatory legal obligations, organizations should consider reviewing whether their anti-corruption compliance framework remains appropriate for an increasingly data-driven enforcement environment.

Areas for review include:

  • Anti-bribery and anti-corruption policies;
  • Approval matrices for gifts, entertainment, sponsorships, donations, and government-related expenditures;
  • Conflict-of-interest declaration procedures;
  • Gift and hospitality registers;
  • Third-party due diligence procedures;
  • Beneficial ownership verification processes;
  • Record-keeping and supporting documentation standards; and
  • Whistleblowing channels and internal investigation procedures.

Particular attention should be given to employees who regularly interact with government officials, including sales personnel, business development teams, procurement staff, regulatory affairs personnel, and employees responsible for obtaining government approvals or participating in public procurement.

Looking Ahead:

The government’s continued investment in digital infrastructure suggests that anti-corruption enforcement may increasingly rely on data integration and analytical tools rather than solely on traditional investigations or complaints. As government agencies gain greater ability to connect information across multiple regulatory systems, businesses should expect higher standards of transparency, documentation, and governance.

Organizations that strengthen their compliance controls now will be better positioned to respond to increased regulatory scrutiny and demonstrate effective anti-bribery compliance as Thailand’s digital government initiatives continue to evolve.

Key Takeaways:

Businesses should review their anti-bribery policies, third-party due diligence procedures, conflict-of-interest controls, gift registers, and whistleblowing mechanisms to ensure they remain effective in an increasingly digital regulatory environment.

Government agencies are moving toward greater integration of financial, tax, procurement, and regulatory data.

Cross-agency data sharing is likely to increase the detection of inconsistent or high-risk transactions.

Third-party relationships, including consultants, agents, brokers, and subcontractors, are expected to receive greater scrutiny.

Gifts, hospitality, sponsorships, charitable contributions, and other government-related expenditures should be supported by clear documentation and approval records.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

Thailand and China Strengthen Cooperation on IP Enforcement

The Thai Cabinet has approved a draft Memorandum of Understanding (MOU) between the Ministry of Commerce of Thailand and China’s market regulatory authority to strengthen cooperation on intellectual property enforcement.

The proposed cooperation framework includes information sharing, coordination on IP enforcement, and cooperation in training and capacity building for enforcement officials. The MOU is intended to facilitate closer administrative cooperation between the two authorities and enhance enforcement effectiveness against IP infringement.

Practical implications for businesses:

The MOU does not create a mechanism allowing rights holders to file cross-border enforcement requests directly or alter existing enforcement procedures in either jurisdiction. Nevertheless, it reflects a policy direction toward closer administrative cooperation between Thailand and China.

Businesses that manufacture, distribute, or sell products in China, particularly through e-commerce platforms, should consider strengthening their cross-border IP enforcement strategy by:

  • ensuring that trademarks, patents, and other IP rights are separately registered in China, as protection in Thailand does not extend automatically to China;
  • maintaining evidence of ownership and use of IP rights, distribution channels, and suspected counterfeit products;
  • reviewing agreements with manufacturers, distributors, and online platform operators to ensure adequate IP protection and enforcement provisions; and
  • considering customs recordation and online takedown procedures as part of an integrated enforcement strategy, alongside civil or administrative actions where appropriate.

The development is particularly relevant for brand owners in consumer goods, fashion, cosmetics, food and beverage, and businesses that rely heavily on cross-border e-commerce.

Key takeaways:

Although the proposed MOU does not introduce new legal remedies for rights holders, it signals stronger institutional cooperation between Thai and Chinese enforcement authorities. Businesses with commercial activities in China should ensure that their IP portfolios and enforcement strategies are prepared to take advantage of enhanced cross-border administrative coordination as it develops

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

Supreme Court Confirms Internal Estate Rules Cannot Override the Land Allocation Act

A recent Supreme Court judgment provides important guidance on the limits of a housing estate juristic person’s authority under the Land Allocation Act. In Supreme Court Judgment, the Court held that internal regulations and resolutions adopted by members cannot override mandatory statutory provisions or expand the powers granted to a housing estate juristic person under the Act.

Although the dispute concerned the retention of a construction security deposit, the decision has broader implications for developers, housing estate juristic persons, property managers, and homeowners. It reinforces the principle that private governance documents cannot be used to circumvent statutory protections established under the Land Allocation Act.

Background:

The dispute arose after a homeowner obtained permission from a housing estate juristic person to renovate a house within the estate. As required under the estate’s procedures, the homeowner paid construction security deposits before commencing the renovation works.

The renovation was completed without causing any damage to the estate’s common property or infrastructure. The homeowner subsequently requested the return of the deposits.

The housing estate juristic person refused to refund the full amount, arguing that, under its internal regulations and resolutions adopted at members’ meetings, it was entitled to retain part of the deposits as contributions toward the maintenance of common property.

The Court of First Instance dismissed the homeowner’s claim. However, the Court of Appeal reversed that decision and ordered the housing estate juristic person to refund the retained amount together with statutory interest. The housing estate juristic person appealed to the Supreme Court.

Supreme Court’s Decision:

The Supreme Court upheld the appellate judgment.

The Court first examined the legal purpose of a construction security deposit. It held that such a deposit is intended solely to secure compensation for potential damage to common property or common facilities arising from construction or renovation works.

Because the renovation had been completed without any damage to the common property, the purpose of the security deposit had been fulfilled. Consequently, the housing estate juristic person had no legal basis to continue holding the deposit.

The Court rejected the argument that the retained amount could instead be treated as common area maintenance fees.

Internal Regulations Cannot Override the Act:

The central issue before the Supreme Court was whether the housing estate juristic person could rely on its internal regulations and resolutions adopted by members to justify retaining part of the construction security deposit.

The Court answered this question in the negative.

The Supreme Court observed that the collection and administration of maintenance fees for common property are comprehensively governed by the Land Allocation Act and the subordinate regulations issued under that legislation. The statutory framework prescribes how maintenance fees are to be imposed, collected, and administered.

Accordingly, a housing estate juristic person cannot create an alternative collection mechanism simply because it has been approved by members or incorporated into the estate’s internal regulations.

The Court emphasized that internal regulations may facilitate the administration of the estate but cannot enlarge the statutory powers granted by the Land Allocation Act or create rights that are inconsistent with the legislation.

The Land Allocation Act Is Mandatory Legislation:

Perhaps the most significant aspect of the judgment is the Court’s characterization of the Land Allocation Act itself.

The Supreme Court expressly stated that the Act is legislation enacted to protect purchasers of land allocation projects and concerns matters of public order. As a result, private arrangements that are inconsistent with the statutory framework cannot prevail.

This means that even unanimous resolutions adopted by members of a housing estate juristic person cannot authorize practices that conflict with the Act.

The Court further reasoned that allowing construction security deposits to be retained as maintenance fees would effectively establish an alternative method of collecting maintenance fees that is not contemplated by the legislation. Such an arrangement would undermine the statutory scheme governing the management of housing estates.

Practical Implications:

The judgment has implications extending well beyond construction security deposits.

Housing estate juristic persons should review their bylaws, regulations, and resolutions to ensure that they remain consistent with the Land Allocation Act. Provisions that seek to create additional collection rights or modify statutory obligations may be vulnerable to legal challenge.

Developers and property managers should likewise review renovation procedures and security deposit arrangements to ensure that deposits are used solely for their intended purpose and are refunded promptly once the statutory conditions for their retention no longer exist.

The decision also serves as a reminder that internal governance documents—including estate regulations, bylaws, and members’ resolutions—cannot enlarge statutory powers or circumvent mandatory provisions enacted to protect purchasers.

Key Takeaways:

Housing estate juristic persons should review their internal regulations and operational practices to ensure they do not purport to exercise powers beyond those conferred by the Land Allocation Act.

Supreme Court Judgmentconfirms that internal regulations and members’ resolutions of a housing estate juristic person cannot override the Land Allocation Act.

The Land Allocation Act provides the exclusive statutory framework governing the collection and administration of maintenance fees.

Construction security deposits may only be used for their statutory purpose of securing compensation for damage arising from construction or renovation works.

Once renovation is completed without damage, the legal basis for retaining the security deposit ceases to exist.

The Supreme Court reaffirmed that the Land Allocation Act is mandatory legislation enacted to protect purchasers and concerns matters of public order, meaning inconsistent private arrangements are unenforceable.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

Thailand signals a shift toward expenditure-based management of universal healthcare

Thailand’s universal healthcare system has long been regarded as one of the country’s most successful public policy achievements. However, increasing healthcare utilization, an aging population, rising treatment costs, and fiscal constraints are prompting policymakers to reconsider how the system should be financed over the long term.

Recent policy discussions within the Ministry of Public Health indicate that the focus is no longer solely on expanding healthcare benefits. Instead, the government appears to be moving toward a framework that emphasizes expenditure management, efficiency, and value-based healthcare while maintaining universal access to essential medical services.

Shift from expanding benefits to managing sustainability:

Thailand’s public healthcare system is primarily delivered through three government-funded schemes:

  • the Universal Coverage Scheme (UCS);
  • the Social Security Scheme (SSS); and
  • the Civil Servant Medical Benefit Scheme (CSMBS).

Although annual government appropriations for these schemes have continued to increase, healthcare expenditure has grown at an even faster pace due to demographic changes, increasing prevalence of chronic diseases, advances in medical technology, and greater public expectations regarding access to treatment. Policymakers have therefore expressed concern that healthcare expenditure may outpace long-term fiscal capacity unless structural reforms are implemented.

Proposed expenditure management measures:

Current policy discussions suggest that future reforms may include greater reliance on expenditure controls rather than across-the-board budget increases.

Measures under consideration reportedly include:

  • expenditure ceilings for public hospitals;
  • tighter monitoring of hospital operating costs, pharmaceuticals, and medical supplies;
  • wider use of digital technologies and data analytics to improve financial oversight;
  • periodic review of healthcare benefit packages to prioritize clinically effective and cost-effective services; and
  • broader adoption of value-based healthcare models that reward providers based on patient outcomes rather than service volume.

These initiatives reflect an effort to improve efficiency without fundamentally changing the principle of universal healthcare coverage.

Potential implications for healthcare providers:

Public hospitals may face increasing pressure to operate within fixed budgetary allocations while maintaining service quality. More sophisticated financial management, procurement practices, and clinical governance are therefore likely to become increasingly important.

Healthcare providers may also experience:

  • greater scrutiny of prescribing practices;
  • stronger emphasis on evidence-based treatment pathways;
  • expanded use of health technology assessment in reimbursement decisions; and
  • increased reporting and compliance obligations relating to cost management.

Private healthcare providers participating in government reimbursement programs may likewise experience closer oversight of reimbursement methodologies and service delivery standards.

Regulatory considerations:

While no legislative amendments have fundamentally altered Thailand’s universal healthcare framework, any future implementation of expenditure caps or revised reimbursement mechanisms will require careful alignment with existing legislation governing public health financing and healthcare entitlements.

Future regulatory developments may include:

  • revised payment methodologies;
  • updated reimbursement criteria;
  • enhanced procurement controls;
  • expanded digital monitoring of healthcare expenditure; and
  • revised administrative guidelines governing public healthcare providers.

Businesses operating in the healthcare, pharmaceutical, medical device, and digital health sectors should therefore continue to monitor policy developments, as changes in reimbursement and procurement practices may influence market access and commercial strategies.

Key takeaways:

  • Thailand is shifting its healthcare policy emphasis from expanding benefits toward improving financial sustainability.
  • Expenditure management and value-based healthcare are emerging as central policy themes.
  • Public hospitals are likely to face tighter budgetary controls and enhanced financial oversight.
  • Healthcare suppliers should anticipate increasing scrutiny of reimbursement, procurement, and cost-effectiveness.
  • Although universal healthcare remains intact, future reforms are expected to focus on preserving the system through more disciplined allocation of healthcare resources rather than unlimited expenditure growth.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

Ride-Sharing Platforms Face New Digital Governance Requirements

Thailand has completed another important step in regulating ride-sharing services by introducing additional obligations for digital platform operators under the Digital Platform Services (DPS) regime.

While the Department of Land Transport (DLT) regulates the transport aspects of ride-sharing—including the licensing of drivers, vehicles, and transport operators—the Electronic Transactions Commission (ETC), with the Electronic Transactions Development Agency (ETDA) serving as the regulator, has introduced additional operational requirements applicable specifically to ride-sharing platforms. These requirements are issued under the Royal Decree on Digital Platform Services Businesses Required to be Notified and are intended to strengthen platform governance, consumer protection, and regulatory oversight.

The new notification reflects the growing recognition that digital platforms are no longer merely technology providers but have become key participants in the delivery of transportation services.

Regulatory Background:

Until recently, Thailand’s regulation of ride-sharing focused primarily on transport law. Existing legislation governed the licensing of public vehicles and drivers, while digital platforms facilitating ride-sharing services were subject mainly to general laws relating to electronic transactions, consumer protection, and personal data protection.

As app-based transportation became increasingly popular, regulators recognized that platforms exercise substantial control over the passenger experience. Platforms determine which drivers are permitted to provide services, process payments, establish pricing mechanisms, collect user data, manage customer complaints, and may suspend or remove drivers from the platform.

Accordingly, Thailand has adopted a dual regulatory model.

The Department of Land Transport is responsible for transport regulation, including driver qualifications, vehicle registration, licensing requirements, and operational safety. Separately, the ETC and ETDA regulate the operation of ride-sharing platforms as digital platform services under the DPS Royal Decree. Rather than regulating the transportation service itself, the ETC notification focuses on the responsibilities of platform operators in operating their digital services responsibly and protecting users.

Why Ride-Sharing Platforms Are Subject to Additional Regulation:

The ETC considers ride-sharing platforms to present unique risks compared with many other digital platforms because they facilitate real-world services that directly affect users’ safety and involve continuous interaction between passengers and drivers.

Unlike a conventional online marketplace, ride-sharing platforms influence who may provide transportation services, verify drivers’ qualifications, allocate trips, process payments, and maintain records relating to every journey.

For these reasons, the notification establishes additional operational requirements specifically for ride-sharing platforms.

Enhanced Driver and Vehicle Verification:

One of the principal obligations is the requirement for platform operators to verify that drivers and vehicles satisfy applicable transport law requirements before allowing them to accept bookings.

Platforms are expected to establish systems capable of verifying that:

  • drivers possess the required public driving licences;
  • vehicles have been properly registered for public transport;
  • supporting documentation remains valid; and
  • drivers who no longer satisfy regulatory requirements are prevented from providing services through the platform.

This complements, rather than replaces, the DLT’s licensing framework by requiring platforms to actively support regulatory compliance.

Greater Transparency:

The notification also promotes greater transparency between platform operators and users.

Platforms are expected to provide users with clear and accessible information regarding matters such as:

  • applicable service terms and conditions;
  • pricing information and fees;
  • cancellation policies;
  • complaint procedures;
  • user rights and responsibilities; and
  • other information necessary for users to make informed decisions when using the service.

Greater transparency is intended to strengthen user confidence while reducing disputes arising from misunderstandings concerning platform operations.

Complaint Handling and User Protection:

Consumer protection is another central feature of the notification.

Platform operators are expected to establish accessible procedures allowing users to report complaints, safety incidents, inappropriate conduct, or other service-related concerns.

Operators should maintain procedures for:

  • receiving complaints;
  • investigating reported incidents;
  • communicating investigation outcomes;
  • providing appropriate remedies where justified; and
  • maintaining records of complaint resolution.

These requirements reinforce the principle that platform operators should actively manage user protection rather than relying solely on government enforcement.

Internal Governance and Regulatory Cooperation:

The notification also requires operators to implement appropriate internal governance measures.

Depending on the nature of the platform’s operations, these measures may include maintaining operational records, documenting compliance activities, monitoring platform risks, and cooperating with competent authorities when information is requested.

Such obligations support more effective regulatory supervision while encouraging platforms to adopt robust compliance management systems.

Relationship with Other Laws:

Compliance with the ETC notification does not eliminate obligations arising under other legal regimes.

Ride-sharing platform operators must continue to comply with:

  • transport regulations administered by the Department of Land Transport;
  • the Digital Platform Services Royal Decree and related notifications;
  • the Personal Data Protection Act;
  • consumer protection legislation; and
  • other applicable laws governing electronic transactions.

Businesses should therefore adopt an integrated compliance framework that addresses both transport regulation and digital platform governance.

Practical Implications:

The notification requires ride-sharing platforms to move beyond a purely commercial focus and adopt governance structures comparable to those expected of regulated digital intermediaries.

Operators should review whether their existing compliance programmes adequately address:

  • driver and vehicle verification;
  • platform transparency;
  • complaint handling procedures;
  • user protection measures;
  • internal governance policies;
  • document retention; and
  • coordination between transport compliance and digital platform compliance.

For international platform operators, many of these requirements may resemble governance obligations already implemented in other jurisdictions. Nevertheless, local compliance should be reviewed carefully because the Thai notification imposes specific obligations linked to Thailand’s transport regulatory framework.

Key Takeaways:

  • Thailand now regulates ride-sharing through complementary transport and digital platform regulatory regimes.
  • The Department of Land Transport oversees drivers, vehicles, and transport licensing, while the ETC/ETDA regulates the operation of ride-sharing platforms under the Digital Platform Services framework.
  • The new notification requires platforms to implement enhanced driver and vehicle verification, improve transparency, strengthen complaint handling, and maintain appropriate governance systems.
  • Platform operators should integrate transport compliance with digital platform compliance to satisfy Thailand’s evolving regulatory expectations.
  • The notification demonstrates Thailand’s broader policy of holding digital platforms directly accountable for the services they facilitate, rather than regulating only the underlying transport providers.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

PDPA Insights: Building Effective Privacy Governance

PDPA: PDPC Clarifies the Scope of “Health Data”

The Personal Data Protection Committee (PDPC) has recently issued an advisory opinion addressing whether the appearance of the Thai Red Cross symbol and the wording indicating organ donor status on Thailand’s new driver’s license constitutes sensitive personal data under Section 26 of the Personal Data Protection Act B.E. 2562 (2019) (PDPA). While the factual question concerned organ donor status, the more significant legal development lies in the PDPC’s interpretation of what constitutes “health data” under the PDPA.

The issue arose following the Department of Land Transport’s introduction of a new driver’s license format that allows license holders who have registered their intention to donate organs with the Thai Red Cross Society to display the Thai Red Cross symbol together with a statement indicating organ donor status on the face of the license. A private-sector organization sought clarification from the PDPC regarding whether such information should be treated as sensitive personal data under Section 26 of the PDPA.

The PDPC’s Interpretation of Health Data:

Section 26 of the PDPA imposes enhanced protection requirements on certain categories of sensitive personal data, including data concerning health. However, the PDPA does not provide a specific definition of “health data”.

In considering the issue, the PDPC examined various legislative and regulatory sources relating to healthcare information. The Committee observed that information concerning healthcare services, healthcare-related intentions and the expression of wishes regarding organ donation have traditionally been regarded as information connected with an individual’s health and healthcare status.

The PDPC emphasized that the information displayed on the driver’s license is not merely a symbol or administrative notation. Rather, it reflects an individual’s expressed intention relating to organ donation and is intended to be used by medical personnel and relevant authorities in circumstances where healthcare services and organ transplantation procedures may become relevant. As a result, the information is intrinsically connected to healthcare services and medical treatment.

On that basis, the PDPC concluded that the status of being a registered organ donor, as displayed on a driver’s license, constitutes health-related personal data and therefore falls within the scope of Section 26 of the PDPA.

A Broader Understanding of Health Data:

The opinion provides an important indication of how the PDPC is likely to interpret health data in future cases.

Traditionally, organizations often associate health data with medical records, diagnoses, treatment histories, laboratory results or information concerning physical and mental conditions. The PDPC’s reasoning suggests that the concept is broader.

The Committee’s analysis indicates that information may qualify as health data even where it does not reveal a specific illness or medical condition. Information that reflects an individual’s healthcare-related intentions, healthcare choices or participation in healthcare-related activities may also fall within the scope of health data where such information is sufficiently connected to healthcare services or medical treatment.

This interpretation reinforces the need for organizations to assess the nature and purpose of information being processed rather than relying solely on traditional assumptions about what constitutes medical information.

Practical Implications:

Although the PDPC classified organ donor status as health data, the opinion also contains practical guidance for organizations that routinely collect copies of driver’s licenses.

The Committee recognized that where a data controller collects a copy of a driver’s license solely for identification or verification purposes and does not collect, use or disclose the organ donor information for the purpose of identifying an individual’s donor status or obtaining health-related information, such processing should not automatically be regarded as the collection of health data under Section 26 merely because the information incidentally appears on the document.

This aspect of the opinion will be particularly relevant to banks, financial institutions, insurers, employers, telecommunications providers and other organizations that regularly collect copies of official identification documents as part of their business operations.

At the same time, organisations that specifically collect, use or disclose information concerning donor status or other healthcare-related declarations should carefully assess whether Section 26 applies and whether an appropriate legal basis exists for the processing of such sensitive personal data.

Key Takeaways:

  • The PDPC has confirmed that organ donor status displayed on a driver’s license constitutes health-related personal data under Section 26 of the PDPA.
  • The opinion suggests that health data is not limited to medical records or information concerning diseases and medical conditions.
  • Information reflecting healthcare-related intentions, wishes or decisions may also constitute health data where it is closely connected to healthcare services or medical treatment.
  • Organizations should review whether information they process could reveal healthcare-related intentions or decisions, even where it does not contain traditional medical information.
  • The incidental collection of such information as part of a driver’s license copy does not necessarily mean that the organization is processing health data, provided the information is not used for health-related purposes.

Author: Panisa Suwanmatajarn, Managing Partner.

Related Articles in the “PDPA Insights: Building Effective Privacy Governance” Series