Fintech 2026

THAILAND LAW AND PRACTICE Contributed by: Wongsakrit Khajangson, Panupan Udomsuvannakul, Koraphot Jirachocksubsin and Pitchaya Roongroajsataporn, Chandler Mori Hamad a

The Personal Data Protection Act B.E. 2562 (2019) (PDPA), which came into full effect on 1 June 2022, was introduced in order to establish a regulatory regime and specify the requirements for processing and protecting personal data in Thailand. The Thai government introduced the PDPA to enhance per - sonal data protection and align with the EU’s General Data Protection Regulation. Furthermore, the Cybersecurity Act B.E. 2562 (2019) (“Cybersecurity Act”) categorises cyberthreats into three levels, as follows: • non-serious cyberthreats; • serious cyberthreats; and • critical cyberthreats. Such threats shall be subject to investigation, and the private operator may be required to: • provide access to relevant computer data or com - puter systems, or other information relating to the computer system; • monitor computers or computer systems; and • allow officials to test the operations of computers or computer systems or seize computers or com - puter systems. For 2026, authorities are advancing targeted amend - ments to the PDPA and the Cybersecurity Act, follow - ing multi-round public consultations aimed at clarifying roles, lawful bases and incident response obligations for Critical Information Infrastructure operators, with revised drafts expected after the latest consultation rounds. 2.12 Review of Industry Participants by Parties Other Than Regulators Auditors may monitor industry participants for accounting purposes. Industry participants may vol - untarily perform internal audits for various matters – eg, IT audits. Currently, no other organisations have the power to supervise, regulate or monitor partici - pants in the fintech industry. The Thai Fintech Association was recently established in Thailand and registered as a non-profit organisa - tion. The organisation has the main obligation to:

• be a centre of knowledge of fintech; • support the public’s use and accessibility to fintech services; and • support standardisation of the fintech industry. At the time of writing, the Thai Fintech Association has not been granted authoritative power by the regula - tor, nor have regulations been passed to allow it to supervise industry participants. However, as regula - tors appear to encourage self-regulatory mechanisms in the fintech industry, the Thai Fintech Association may become a key organisation in establishing wider sector policies and standardisation. The Thai Fintech Association, the Thai Blockchain Association, the Thai Digital Asset Association and the Thai Digital Trade Association were all established to support and be the voice of each respective eco - system. 2.13 Conjunction of Unregulated and Regulated Products and Services Certain regulations restrict a licensee from providing business services other than those covered under the relevant licence held by the business operator or busi - ness services/activities related to the licensed busi - ness activity. Under the Payment Systems Act, business operators licensed to engage in e-money business services may not operate other businesses except those that such operators are licensed to perform or business activi - ties that support e-money business services. 2.14 Impact of AML and Sanctions Rules The Anti-Money Laundering Act B.E. 2542 (1999) (the “AML Act”) and the Counter-Terrorism and Prolifera - tion of Weapons of Mass Destruction Financing Act B.E. 2559 (2016) are the two primary laws regulating anti-money laundering in Thailand. Fintech businesses may be required to comply with these two laws since they may deal with financial activities – ie, e-payment systems, money exchanges or financial institutions (as prescribed under the AML Act (“Specified Opera - tors”)). If a particular fintech business is included in the scope of Specified Operators, such fintech operator is required to verify its customers’ identities upon com - mencement of certain activities, conduct customer

863 CHAMBERS.COM