Thailand’s New Cybercrime Measures Enlist Aid of Banks and Service Providers

March 20, 2023

Thailand’s New Cybercrime Measures Enlist Aid of Banks and Service Providers

Thailand has enacted new legislation to counter cybercrime and scams. The Royal Decree on Measures for Protection and Suppression of Technology Crimes B.E. 2566 (2023) (“Cybercrime Decree”) was published in the Government Gazette on March 16, 2023, and took effect the following day. The Cybercrime Decree provides a new legal tool to interrupt the money-laundering process and aims to crack down on cybercrime perpetrators and scammers by providing stronger legal measures applying to certain types of offenders that had not been sufficiently covered by existing laws.

This new legislation grants victims the right to have commercial banks and online payment platforms freeze suspicious transactions and obligates these banks and platforms to comply with such requests. It further requires these banks and platforms—as well as other service providers—to share data for the prompt prevention and suppression of cybercrime.

The key rights, duties, and offenses established by the Cybercrime Decree are detailed below.

Freezing Transactions

The Cybercrime Decree requires commercial banks and online payment platforms to temporarily freeze (for 72 hours) any related transactions of their account holders upon receipt of an alert from the account holder that he or she is the victim of cybercrime. Victims can report these illicit transactions by phone or electronic means. If by phone, the relevant bank or platform must document the call.

The victim must file a police complaint about the illicit transaction within 72 hours of the freeze being made. A police inquiry officer will then notify the bank or platform about the complaint, and the transaction freeze must be maintained for seven days from the filing of the complaint with the police. The police will then determine whether it is necessary to keep the transaction frozen for longer than seven days. If the seven days lapse without a further order to freeze the transaction, it can be unfrozen.

In addition, commercial banks and online payment platforms must freeze for seven days any suspicious illicit transactions they find, and inform the relevant authority and other related banks and payment platforms. If the authority does not reply with an order to continue freezing the transaction, the bank or platform must unfreeze the transaction after seven days have passed.

Sharing Information with Cybercrime Investigators

The Cybercrime Decree imposes a new obligation on commercial banks, online payment platforms, and telecommunications and other service providers to share with authorities, via a new designated system, information on any account or transaction suspected of being related to the commission of a cybercrime. These parties must also share such information with the Royal Thai Police, the Department of Special Investigation (DSI), and the Anti-Money Laundering Office (AMLO) for their use in protection against and suppression of cybercrime.

The Cybercrime Decree also grants new authority to the Royal Thai Police, DSI, and AMLO to issue orders compelling telecommunications and other service providers to provide cybercrime-related user registration information and computer traffic data.

New Offenses

The Cybercrime Decree prohibits people from allowing their bank account or telephone number to be used for commission of a crime, and it criminalizes facilitating the use of bank accounts or telephone numbers in commission of crimes. Penalties for these offenses include imprisonment for up to five years, a fine of up to THB 500,000, or both.

For more details on the Cybercrime Decree, or on any aspect of countering computer or financial crimes in Thailand, please contact [email protected] or [email protected].

Related Professionals

Thawat Damsa-ard

Thailand

+66 2056 5500

Email

Piyawat Vitooraporn

Thailand

+66 2056 5802

Email

RELATED INSIGHTS

November 15, 2024

Changes to Domain Name Dispute Resolution Under Vietnam’s New Internet Decree

Vietnam’s new Decree No. 147/2024/ND-CP on the management, provision, and use of internet services and online information (“Decree 147”), which will come into effect on December 25, 2024, replacing Decree No. 72/2013/ND-CP (“Decree 72”), introduces several changes to the regime for domain name dispute resolution. The new decree aims to clarify the legal framework and address some longstanding inconsistencies between Vietnam’s laws on intellectual property and information technology. The main changes related to domain name dispute resolution under Decree 147 are summarized below. Removal of Prescriptive Actions Decree 147 no longer lists specific actions for resolving domain name disputes. Decree 72 had outlined three methods: negotiation/mediation, arbitration, and court. However, IP practitioners had long criticized this approach, arguing it conflicted with the IP Law, which additionally allows administrative action. By omitting these methods, the new decree implies an acceptance of administrative action as provided in the IP Law. However, Decree 147 remains silent on establishing a dispute resolution forum aligned with the CPTPP’s requirement for a UDRP-like model. Currently, Vietnam’s available forums do not fully conform to the UDRP framework. An anticipated circular may provide further guidance on this aspect. Deactivation of Domain Names Decree 72 does not have any provision on the deactivation of a domain name. However, Decree 147 has stipulated some situations where domain names will be deactivated, such as when there is a request from an authority, or when it is discovered that incorrect information was used for registration. Clearer Criteria for Dispute Resolution Article 16 of Decree 147 sets out three clear criteria that must be met for domain name dispute resolution to proceed: (i) confusing similarity with the plaintiff’s trademark, trade name, or personal name; (ii) the defendant’s lack of legitimate rights or interests in the domain name; and (iii) bad faith. Previously,

November 15, 2024

Vietnam Issues New Decree Governing Internet Services and Online Information

On November 9, 2024, the government of Vietnam promulgated Decree No. 147/2024/ND-CP on the management, provision, and use of internet services and online information (“Decree 147”). This decree supersedes the previous Decree No. 72/2013/ND-CP dated July 15, 2013, on the same topic (“Decree 72”) and its amending regulations, and will take effect on December 25, 2024. Spanning over 200 pages, with an appendix of 62 forms, Decree 147 addresses a wide range of key internet and online topics, including internet services; domain names; cross-border information provision; social network services; aggregated information websites; online game services; app store services; information content services on mobile telecom networks; responsibilities of telecom, internet, web hosting, data center, and telecom application service providers; and measures to handle illegal content. This decree is expected to have a significant impact on both onshore and offshore service providers in the respective fields, and will potentially tighten the regulatory landscape for internet services and online information provision in Vietnam. Some highlights from the new Decree 147 compared to its predecessor are detailed below. Cross-Border Information Provision Offshore service providers, including offshore social network service providers and offshore app store service providers, who provide services on a cross-border basis and either lease data storage in Vietnam or meet a threshold of 100,000 or more total visits per month from Vietnam for six consecutive months must adhere to stricter requirements than other providers. Notable obligations of these regulated cross-border providers include: Notifying the Authority of Broadcasting and Electronic Information (ABEI) of their contact information. Monitoring and removing illegal content. Storing and managing user data as required. Authenticating social network user accounts using Vietnamese mobile number or ID number. Reporting to the ABEI annually as well as on an ad hoc Handling user complaints. Only cross-border providers who have notified the

November 14, 2024

Fintech Insights: Digital Asset Business Regulations in Thailand

In recent years, Thailand has taken significant steps to regulate and integrate digital assets into its financial ecosystem. This article explores the regulatory framework governing digital asset businesses in Thailand, focusing on the key legislation, regulated activities, and recent developments in this rapidly evolving sector. Regulatory Environment In 2018, Thailand enacted the Emergency Decree on Digital Asset Businesses, marking a pivotal moment in the country’s approach to cryptocurrencies and digital tokens. This decree, supervised by the Securities and Exchange Commission (SEC) and the Ministry of Finance, provides a comprehensive regulatory framework for both the primary and secondary markets of digital assets. For the primary market, the decree regulates the issuance and sale of digital assets through initial coin offerings (ICOs). A key feature of this regulation is the requirement for ICOs to be conducted through SEC-approved ICO portals. This approach aims to provide a structured and supervised environment for companies seeking to raise funds through digital token sales. In the secondary market, the decree outlines the regulatory framework for various digital asset intermediaries, including digital asset exchanges, brokers, dealers, advisory services, fund managers, and custodians. In implementing its digital asset-related policies, the SEC imposes ongoing obligations on licensed digital asset intermediaries. These include restrictions on the listing of certain digital assets on digital asset exchanges, and limitations on intermediaries facilitating digital assets as a means of payment. Regulatory Trends and Outlook The SEC has demonstrated a commitment to regularly revising its digital asset regulations to keep pace with global trends and market developments. A notable example of this approach is the SEC’s efforts to refine the classification of nonregulated ready-to-use utility tokens by dividing these tokens into two groups: Group 1: Ready-to-use utility tokens issued for consumption purposes or as a digital representation of a certificate (e.g., NFTs with

November 13, 2024

Thailand to Set Additional Obligations for Specific Digital Marketplaces

Thailand’s Electronic Transactions Committee has publicized a new draft notification detailing additional duties for specific marketplace digital platform service operators under Section 18(2) of the Royal Decree on Operation of Digital Platform Service Businesses Subject to Prior Notification B.E. 2565 (2022). The draft notification, which is open for public comments until November 30, 2024, aims to provide enhanced protection for users of “specific marketplace platforms” (defined below). Some key points of the draft notification are detailed below. Scope The draft notification applies to “marketplace digital platform services,” which refers to digital platform services that serve as an intermediary for buying or exchanging goods and provide services to facilitate sale transactions, such as providing communication systems (e.g., chat features), shopping carts, delivery arrangements, and supplemental payment processing facilitation. “Specific marketplace platforms” refers to Section 18(2) of the Royal Decree on Digital Platform Services, which covers digital platform services that pose risks to financial and commercial security, the reliability and credibility of data messaging systems, or potential harm to the public, and that have a high level of potential impact based on the criteria for assessing the impact of digital platform service operations. Key Obligations Registration. The draft notification requires the marketplace operators mentioned above to be registered as legal entities in Thailand. Terms and conditions. The draft notification details additional obligations relating to marketplace operators’ terms and conditions: In addition to existing obligations prescribed in the Royal Decree and the relevant subordinate laws, the draft notification emphasizes that the terms and conditions must be in Thai, clear, accessible, and understandable, and may include graphical elements to aid explanation. The terms and conditions must prescribe conditions relating to the sale of products subject to specific standards, such as those restricted under the Food Act, the Drugs Act, and the Industrial Product

You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

Industries

Practices

March 20, 2023