Thailand’s Ministry of Finance has issued the Notification re: Criteria, Methods and Conditions for Applying for and Issuing Licenses to Operate Virtual Bank Business, which was published in the Government Gazette on March 4, 2024. This notification opens an opportunity for qualified experts in technology, digital services, and diverse data usage fields to apply for virtual bank licenses to provide financial services through new digital channels. The main goal is to serve the financial needs of target groups that may not have received sufficient or tailored financial services from the traditional banking system. Licensing Timeline Application submission period: 6 months (March 20–September 19, 2024). Announcement of successful applicants: Mid-2025 (approx. 9 months–1 year from the end of the submission period) After the announcement, successful licensees must demonstrate their readiness to commence virtual bank operations within 1 year (extendable for up to 1 additional year) via the following: Having paid-up registered capital of THB 5 billion and plans to increase the paid-up registered capital to at least THB 10 billion after the initial business period; Establishment or adjustment of a financial business group; Procurement of human resources, IT systems, and relevant risk management tools. Number of Licenses to be Issued No written or specified limit, subject to the discretion of the Bank of Thailand (BOT). Key Qualifications Applicants must have the following: Experience and resources to support virtual banking operations according to the business model and plan. Expertise and experience in conducting business that utilizes technology and provides services through digital channels. Experience demonstrating the ability to obtain, access, manage, and utilize data, including development of systems or data connections to facilitate user activities, allowing them to use their data to conduct transactions with other providers. Criteria In assessing applicants’ qualifications for a virtual bank license, the BOT will consider

Thailand’s National Cyber Security Committee (NCSC) released three notifications under the Cybersecurity Act on January 18, 2024, setting cybersecurity-related requirements for key organizations and assets. While one of these notifications already took effect, the two most notable will take effect on January 18, 2025 (i.e., one year from their publication in the Government Gazette). These two are the NCSC Notification Re: Standards for Defining the Security Category for Data or Information Systems B.E. 2566 (2023) (“Notification on Security Category”) and the NCSC Notification Re: Minimum Standards for Data and Information Systems B.E. 2566 (2023) (“Notification on Minimum Standards”). These notifications apply to: State agencies; Supervising or regulating organizations (i.e., state organizations, private organizations, or persons designated by law to regulate or supervise the affairs of state organizations or critical information infrastructure organizations); and Critical information infrastructure organizations (i.e., organizations related to or providing national security, significant public services, banking and finance, information technologies and telecommunications, transportation and logistics, energy and public utilities, and public health). Collectively these are defined as “Organizations” under the notifications. Notification on Security Category The Notification on Security Category sets forth risk-based security classifications—or “security categories”—for Organizations’ data or information systems. For security category assessment purposes, Organizations are required to perform a self-assessment of their data or information systems based on three key security objectives: confidentiality, integrity, and availability. Each of these objectives is further categorized into three risk levels (low, medium, and high), taking into account the assessment of potential impact in the following areas: Organizations’ financial value or reputation; Organizations’ number of service users; Organizations’ ability to perform their duties; State stability or public order. The risk levels for the three objectives are determined by considering whether there are “minimal,” “severe,” or “serious severe” effects, as described below: Confidentiality (not including data classified

Thailand is preparing to implement new rules on drug importation for clinical studies. The Medicines Regulation Department of Thailand’s Food and Drug Administration (Thai FDA) first issued the Notification Re. Detailed Requirements for Drug Importation into Thailand for Clinical Studies almost a year ago, and the notification is expected to come into effect on March 1, 2024. Key Provisions The notification aims at enhancing the efficiency of conducting clinical studies while ensuring the protection of human subjects participating in such studies within Thailand. Some of its key provisions include: Definition of Clinical Study. The notification defines a “clinical study” as a study of a medicine involving human subjects, conducted to provide supporting evidence for the registration of a medicinal product in Thailand or other countries, including for additional indications or variations of a registration dossier. Compliance with ICH GCP. Clinical studies conducted in Thailand must adhere to the current edition of the International Council for Harmonization of Technical Requirements for Pharmaceuticals for Human Use (ICH) Good Clinical Practice (GCP) guidelines. Clinical Trial Application. Sponsors are required to submit a clinical trial application along with supporting documents to the Thai FDA for approval before commencing a clinical study. The permit remains valid for five years and is renewable. Supply of Investigational Drugs. Sponsors must obtain investigational drugs from manufacturers compliant with Good Manufacturing Practice (GMP) standards as recognized by the Thai FDA. Postapproval Obligations. The secretary-general of the Thai FDA may impose postapproval conditions or order investigators to conduct or suspend certain activities to ensure human subject protection and regulatory compliance. Regulatory Oversight. The Thai FDA is responsible for inspecting and overseeing the regulatory compliance of clinical studies, including during prestudy, ongoing, and poststudy phases. The Thai FDA may also conduct inspections of clinical studies conducted overseas. The Thai FDA

Attorneys in Tilleke & Gibbins’ regulatory affairs team have produced the Cannabis and Hemp Business Guide – Thailand, a primer on the rapidly developing cannabis industry in Thailand.