On January 16, 2023, Thailand’s Securities and Exchange Commission (SEC) prescribed a set of security measures that digital asset business operators must implement if they provide custody of digital assets for their customers. The new security measures are prescribed in two notifications from the SEC and its office on digital asset wallet management systems and cryptographic key management systems, with the aim of safeguarding digital assets in custody against loss, fraud, and cybertheft. The notifications took immediate effect. The new security measures and the management systems are summarized below. Policy and guidelines for managing systems related to digital asset custody Digital asset business operators must have a written risk management policy for all systems relating to digital asset custody, approved by their board of directors and made accessible to all employees. The policy must be reviewed or revised at least once annually, or promptly if any potential risks are identified. Specific procedures must be implemented, such as establishment of a compliance team and internal controls. Management of systems for digital asset wallets and cryptographic keys Digital asset business operators must have policies and procedures for managing all systems relating to digital asset custody. This includes properly designing, developing, and managing digital asset wallets in a safe and secure manner. The same requirement on policies and procedures applies to cryptographic key management as well. Management of incidents that may affect systems related to digital asset custody Digital asset business operators must have measures in place to manage incidents that may impact systems related to digital asset custody. The measures include designating a person responsible for incident management, testing and reviewing the incident management policy annually, reporting any incidents affecting digital asset custody to the designated responsible person and the SEC immediately, and conducting a digital forensic investigation with an independent

Vietnam’s Ministry of Finance is drafting a circular on determining the origin of imported and exported goods. This circular, a draft version of which has been released for public comment (“Draft Circular”), consolidates prevailing regulations and guidelines on determining the origin of imported and exported goods that are stipulated in the following legal documents, which the Draft Circular would replace when it comes into effect: Circular No. 38/2018/TT-BTC dated April 20, 2018, of the Ministry of Finance regulating the determination of origin of imported and exported goods, as amended by Circular No. 62/2019/TT-BTC dated September 5, 2019, of the Ministry of Finance; Circular No. 47/2020/TT-BTC dated May 27, 2020, regulating the time to submit documents proving the origin of goods and form of the documents proving the origin of imported goods applied during the Covid-19 pandemic; and Circular No. 07/2021/TT-BTC dated January 25, 2021, regulating the time to submit documents proving the origin of imported goods under the EU-Vietnam Free Trade Agreement (EVFTA). Generally speaking, the Draft Circular does not increase the administrative procedures for importers and exporters, but rather seeks to codify the recent practices implemented by the customs authorities. The Draft Circular focuses on providing comprehensive guidance for importing/exporting companies when carrying out administrative procedures to certify the origins of imported and exported goods to be in line with current trade practices and international commitments under new-generation free trade agreements. In particular, the Draft Circular supplements guidelines on declaring origins and submitting Certificates of Origin (C/Os) of imported goods under the EVFTA and the Regional Comprehensive Economic Partnership Agreement (RCEP). The Draft Circular also provides some new guidelines to facilitate exports (and imports) and overcome some obstacles and issues when implementing the prevailing regulations. For example, the submission of C/Os online, which was only applicable during the

Government Approves Legislative Dossier On February 7, 2023, the Vietnamese government issued Resolution No. 13/NQ-CP (“Resolution 13”) to approve the latest version of the draft Personal Data Protection Decree (“Draft PDPD”)—a draft which has not yet been made public. Similar to Resolution No. 27/NQ-CP issued in March 2022 approving the previous version of the Draft PDPD (“Resolution 27”), Resolution 13 stipulates the different cases where data subjects’ consent is exempted for processing personal data. Most of these lawful bases are similar to those under Resolution 27—except for the fourth case, which is brand new—with some changes for better clarity. According to Article 1 of Resolution 13, personal data can be processed without consent in the following five cases: (1) The processing is to protect the life and health of the data subject or others in an emergency situation. Data Controllers, Data Processors, Parties Controlling and Processing Personal Data, and Third Parties are responsible for proving this case; Remarks: Vietnamese law, including the prior published version of the Draft PDPD, has never used the terms “data controller”, “data processor,” and “parties controlling and processing personal data.” The inclusion of these terms suggests that the latest version of the Draft PDPD has adopted the GDPR-like concepts of “data controller” and “data processor.” However, until the latest version of the Draft PDPD can be assessed, it is uncertain how these concepts are defined and whether they are fully in line with GDPR definitions. (2) The disclosure of personal data is in accordance with the law; (3) The processing of data is performed by competent state agencies in the event of a state of emergency related to national defense, national security, social order and safety, major disaster, or dangerous epidemic; when there is a threat to security and national defense but not to

The Federation of Thai Industries (FTI) announced on January 16, 2023, the opening of registration for carbon credit trading on its Renewable Energy and Carbon Credit Exchange Platform. This new online platform supports the domestic carbon market and provides Thai exporters with the ability to purchase carbon credits, allowing them to address demands from importing nations to conform to carbon emission reduction regulations. This is expected to be a positive step forward for the current practice in Thailand, in which the carbon market operates as a voluntary and unregulated buy-sell platform, free from government regulation. Developed in partnership with the Thailand Greenhouse Gas Management Organization (TGO), the FTI: CC/RE/REC X Platform, or FTIX, is intended to increase the promotion of national carbon credits, renewable energy, and renewable energy certificates, thus improving the country’s efforts to mitigate climate change. Entrepreneurs interested in registering for carbon credit trading on the FTIX can do so through the FTIX website at fti-cc.com. The platform initially supports carbon credit trading through over-the-counter methods. In the near future, the FTIX will be developed to support 100% renewable energy (i.e., RE100 energy) and renewable energy certificate trading. However, the related tax and carbon pricing policies have not yet been issued. The TGO is currently in discussions with the Fiscal Policy Office and the Ministry of Finance regarding fiscal policy for the FTIX. For more information on the FTIX, or on any aspect of renewable energy activities in Thailand, please contact Charuwan Charoonchitsathian at [email protected], Napassorn Lertussavavivat at [email protected], or Ratchapat Triteeyaputranonta at [email protected].