Thailand’s draft Emergency Decree on Technology Crimes Suppression, which we covered in a client alert in January 2025 primarily addressed to telecom operators and financial institutions, is expected to have significant implications for a wide range of business operators. The draft emergency decree has already been approved by the cabinet but may undergo further developments as it continues in the legislative process.
In this article, we will highlight the material impacts of the draft emergency decree on overseas and local fintech operators.
Expanded Definition of “Technology Crimes”
The definition of “technology crimes” now includes the following acts of forgery or alteration:
- Forging or altering the identity of individuals and biometric characteristics by utilizing computer or communication systems or other electronic means to commit offenses.
- Forging or altering symbols, trademarks, or seals of groups (e.g., foundations, community enterprises) or juristic persons, including acts by juristic persons using individuals or juristic persons as nominal directors or shareholders, regardless of whether such individuals or legal juristic persons reside in Thailand.
- Forging or altering digital or online platforms, regardless of the platform’s location or legal status.
Individuals who conspire, utilize, assist, or support the commission of these offenses will face the same penalties as the principal offender.
Business Operator Definition
The scope of “business operators” is now expanded to cover various fintech and digital asset operators beyond those under the Payment Systems Act (PSA). The draft emergency decree now includes the following operators, whether they are legally authorized or not:
- Business operators under the PSA and business operators who operate “as if” they are payment system operators
- Business operators under the Royal Decree on Digital Asset Businesses or business operators who operate “as if” they are digital asset business operators.
- Foreign exchange business operators.
Disclosure and Exchange of Information
Business operators must disclose or exchange information on accounts and transactions linked to technology crimes and notify a centralized system for relevant government agencies to access. In this regard, the lead regulator (e.g., Bank of Thailand, the Securities and Exchange Commission) of the business operator can mandate this within a set timeline.
Customers’ accounts related to technology crimes are publicly disclosable. Moreover, activities involving personal data sharing or processing under the draft emergency decree are exempt from the Personal Data Protection Act.
Transaction and Account Suspension
When there is a reasonable suspicion that the customer’s account is used or may be used for technology crimes or the victim reports that a deposit or e-money account of a business operator’s customer was used for a technology crime-related act, that business operator must (1) suspend the relevant customer’s account and business relationship, (2) notify other entities (i.e., financial institutions, other business operators, and telecom operators) in the transaction chain to ensure coordinated action, (3) input information into a system for disclosure or exchange, and (4) report the situation to the relevant authorities.
If an account holder is found to have multiple accounts without a valid reason, the business operator must (1) immediately suspend all related accounts, (2) notify account holders, and (3) report the situation to the relevant authorities.
Accounts can only be reinstated (1) upon notification by the relevant officer or (2) if the account holder provides face-to-face verification and evidence that the account is not related to technology crime. Failure to provide verification and clarification within 30 days will result in a presumption that the money is related to technology crime. Consequently, money will be transferred back to the original source, with the original account owner notified.
Victim Compensation
Business operators, including financial institutions and telecom operators, are required to share the burden of compensating victims of technology crimes. If a business operator is found to have neglected their duties or facilitated technology crimes, they are obligated to compensate the victims for their losses.
Penalties for Business Operators
Financial institutions, business operators, and network service providers involved in technology crimes face significant penalties. This includes fines and imprisonment for those who facilitate or support technology crimes, including employees of the business operators.
Adoption and Compliance
Once the decree is issued, there is no transition period for business operators to comply with the requirements under the decree. It is expected that this decree will be issued in the very near future.
