Thailand’s Office of Insurance Commission (OIC) has opened a public hearing period on a draft notification from the Ministry of Finance (MOF) that would relax foreign shareholding and board limits for life insurers. The hearing period runs until May 31, 2024. Key principles of the draft notification are outlined below. Life Insurer Qualifications Life insurers may apply for permission to exceed 49% foreign shareholding or have a majority of foreign directors if: They operate a business that may cause harm to insured parties or the public and either (1) the OIC has directed the company to improve its status or adjust its capital, or (2) the company’s actions may have a significant impact on the insurance industry, causing significant compensation burdens and affecting the company’s capital adequacy ratio (CAR); Their shareholders are unable to increase capital; and They are unable to attract Thai investors to increase the capital necessary to ensure stability and the long-term operation of the business. Foreign Shareholder Qualifications Eligible foreign shareholders must: Be an insurance company or participate in the insurance industry; Have at least 10 years of relevant experience; Demonstrate financial stability and possess a credit rating (or have a parent company with a credit rating) of at least “A” from a reliable credit rating agency; Present a clear business plan, financial resolution plan and strategy, and technological and expertise development plan to develop and promote the company’s efficiency and competitiveness in the industry; and Be capable of investing and increasing the capital to at least THB 2 billion to maintain stability and maintain a CAR of at least 250%. In addition, life insurers are required to present a clear restructuring plan and new organization chart to the OIC for further approval by the MOF. For more details on the MOF’s notification regarding criteria on foreign shareholding limits for life insurance companies, or on any issue concerning insurance regulations

Thailand’s Office of Insurance Commission (OIC) has released draft Notifications regarding Guidelines for Considering Qualifications and Suitability of Insurance Agents and Brokers to Manage Risks Related to Insurance Fraud for Life and Non-Life Insurance Companies for a public hearing period. The draft notifications set out criteria that life and non-life insurance companies should follow to assess the risk of brokers and agents committing insurance fraud. Risk Rating Under the OIC’s draft notifications, the risk of insurance agents and brokers committing insurance fraud is represented by four color-coded levels, according to the characteristics of the agent or broker. These levels are summarized in the table below. Insurance companies can verify the qualifications and suitability of agents and brokers by accessing information on insurance fraud in the OIC’s database. This access must comply with the Personal Data Protection Act, requiring the consent of the agent or broker whose information is being accessed. For more details on the OIC’s notification, or on any aspect of insurance regulations in Thailand, please contact Athistha (Nop) Chitranukroh at [email protected], Witchupong Chittchang at [email protected], Ajaree Trachukul at [email protected], Thammapas Chanpanich at [email protected], or Sireethorn Wijan at [email protected].

On May 4, 2024, the Vietnamese government issued Decree No. 46/2024/ND-CP (“Decree 46”) amending and supplementing certain articles of Decree No. 99/2013/ND-CP dated August 29, 2013, on administrative sanctions in industrial property, as amended and supplemented in 2021 (“Decree 99”). Decree 46, which will come into force on July 1, 2024, is designed to bring Decree 99 in line with the amended IP Law of 2022. Some of the notable amendments of Decree 46 are discussed below. New Infringing Acts Decree 46 added the following new infringing acts subject to sanctions, which had not been set out in the former decree: Use of patents, utility solutions, layout designs, or industrial designs without paying compensation according to the provisions on temporary rights specified in Article 131 of the amended IP Law. Accepting a trademark license not in the form of a written contract in the case of using the licensed trademark on goods or packaging. Failure to notify clients of costs, charges, and fees related to procedures for establishing and protecting industrial property rights. Deceiving clients in the course of entering into and performing industrial property representative service contracts, but not to the extent of criminal prosecution, or forcing customers to enter into and perform industrial property representative service contracts. Although these acts are not common occurrences, it is nevertheless important to have clear regulations in order to ensure consistency with the amended IP Law and overcome difficulties and obstacles if such acts are committed in practice. Amendments and Supplements Decree 46 adopted amendments and supplements to main sanctions, additional sanctions, and remedial measures, specifically: The monetary fine imposed for violations against trade secrets is VND 50 million to VND 100 million (approx. USD 2,000 – USD 4,000), a large increase compared to the VND 5 million to VND 15 million (approx. USD 200 – USD 600) in the previous decree.

On May 1, 2024, Thailand’s National Cyber Security Committee (NCSC) published the draft NCSC Notification Re: Cloud Cybersecurity Standards for a public hearing period, which was open until May 14, 2024. These standards have been drafted to drive the country’s cloud-first policy with the aim of minimizing risks from cyber threats to cloud services utilized by government agencies, supervising or regulating organizations, and critical information infrastructure (CII) organizations. The key points of the draft Cloud Cybersecurity Standards are below. Scope The standards apply to government agencies, supervising or regulating organizations, and CII organizations under the Cybersecurity Act B.E. 2562 (2019), as well as cloud service providers (defined below). The standards prescribe cloud system cybersecurity measures for cloud service customers (defined below) and providers only to the extent that the service is provided to the in-scope organizations outlined above. Definitions Cloud service customers (CSCs): In-scope organizations that have a formal contractual agreement to use cloud services provided by a cloud service provider. Cloud service providers (CSPs): Persons who enable cloud services to be used by a cloud service customer, responsible for maintaining infrastructure, platforms, and software that enable provision of the cloud services and for managing these resources to ensure their accessibility, security, and scalability for their cloud service customers. Application In-scope organizations that will use or have been using cloud services must comply with the Cloud Cybersecurity Standards by taking into account their data or technology information systems’ level of impact, as specified in the previously issued Notification of the NCSC Re: Standards for Defining the Security Category for Data and Information Systems B.E. 2566 (2023). The impact level related to personal data is to be rated as being at least at the medium level, and the minimum standards for that level specified in the draft Cloud Cybersecurity Standards must be adopted. In-scope organizations must report their implementation of the

On May 2, 2024, Vietnam’s Ministry of Justice published on its online platform the most recent version of the draft decree on administrative sanctions for violations in the field of cybersecurity (“Draft Sanction Decree”) to gather feedback and contributions from the community and stakeholders. After receiving the Ministry of Justice’s assessment, the Ministry of Public Security (“MPS”), in charge of drafting the Draft Sanction Decree, may make further revisions before submitting it to the government for review and final decision on enactment. The decree is expected to have an effective date of June 1, 2024. The stringent penalties for infringements involving personal data of the previous draft version remain in this Draft Sanction Decree—a sign of the proactive stance of the MPS in enforcing the Personal Data Protection Decree (“PDPD”). Effective Date and Transitional Provisions It is important to note that the Draft Sanction Decree does not impose any new obligations on organizations or individuals, and only sets out the administrative sanctions that could be imposed on violators as soon as June 1, 2024, which is indicated as the effective date in Article 49. This signals the MPS’s eagerness to begin taking enforcement actions against recalcitrant organizations and individuals that have not complied with the various obligations imposed on them under the Law on Network Information Security (enacted in 2015), the Law on Cybersecurity (enacted in 2018) and its guiding decree (Decree 53 – enacted in 2022), and the most recent PDPD (enacted in 2023). Article 50.1 of the Draft Sanction Decree outlines the transitional provisions regarding administrative violations in the cybersecurity field. It clarifies that the decree does not have retroactive effect, by stating that violations occurring before its effective date, but discovered or under review after such effective date will be subject to the regulations on administrative sanctions in force at

Thailand’s Board of Investment (BOI) has issued a notification granting investment privileges to qualified new residential projects for low-income individuals. Notification No. Sor. 1/2567 Re: Promotion of Residential Activities for Low-Income People was published in the Government Gazette on May 3, 2024, and came into effect the following day. To be eligible for BOI promotion, at least 80% of the total residences in a project must meet the requirements for usable area and price. The minimum usable area is 24 square meters for condominium units and 70 square meters for town houses and detached houses. The residences can only be sold to individuals, and the sale price for each of these condominium units or houses (including the price of any land) must not exceed THB 1.5 million. Projects must also meet the following criteria: Projects must include a car park, closed circuit television (CCTV) throughout the project, a 24-hour security guard, cleaning staff, a common area, and other facilities in an appropriate proportion. The building plan and layout must be approved by the BOI. A permit for the construction of a building under building control laws and other relevant laws must be obtained. Approval must also be obtained from the Government Housing Bank prior to submission of the application to the BOI. However, ISO 9000, ISO 14000, or other similar international standard certification is not required. Under the notification, applications for such promotion must be submitted to the BOI by the end of 2025. New low-income residential projects promoted by the BOI will be granted a corporate income tax exemption for a period granted for A4-promoted activities (typically three years). For corporate income tax exemptions, the investment will only be calculated based on the construction costs for roads, other facilities, or public utilities that are commonly used within the project. The construction costs for the residences, houses, buildings,

This is the first in a series of quarterly articles prepared by Tilleke & Gibbins’ capital markets practice group in Thailand, with a view to providing periodic updates on material changes to the relevant rules and regulations pertaining to securities laws in Thailand. Here are some of the key updates for the first quarter of 2024. Amendments to “investment company” prohibition The Securities and Exchange Commission (SEC) has amended the rules on the offering of securities and information disclosure where listed companies operating as an investment company would face consequences from regulatory arbitrage. The amended rules, which took effect on January 1, 2024, can be summarized as follows: A company (excluding financial institutions) will be deemed an investment company if it invests in securities, derivatives, or digital assets without active participation in the management of the target business, and the total of the passive portfolio exceeds 40 percent of the company’s total assets according to its most recent financials. Listed companies falling under the above definition of an investment company must disclose information related to their investments in the notes to their financial statements until the passive investment portfolio is less than 40 percent of their total assets. The Stock Exchange of Thailand (SET) will publish a warning label (either “C” for caution or “SP” for trading suspension) next to the ticker symbol of any listed company that is deemed an investment company. Once this is done, the company will be unable to offer any securities under the Securities and Exchange Act of 1992 (as amended) (SEC Act), such as shares, warrants, and underlying shares, as well as debt instruments. Amendments on offering of newly issued bonds by foreign issuers Rules on the offering of newly issued bonds in Thailand by foreign issuers were revised by the SEC with a view to ensuring that the

As non-cash payments continue to surge in Vietnam, the requirement for strong security standards and a clear legislative framework for intermediary payment services (“IPS”) is becoming more and more critical. Recognizing this, the State Bank of Vietnam (“SBV”) has been working on a draft decree to supersede the outdated Decree No. 101/2012/ND-CP dated November 22, 2012, on non-cash payments (“Draft Non-Cash Payment Decree”), which will lay the groundwork for non-cash payments in general and the provision of IPS in particular. Building upon this, the SBV recently issued a draft circular to replace Circular No. 39/2014/TT-NHNN dated December 11, 2014, on IPS (“Circular 39”) (“Draft IPS Circular”), which will offer more detailed guidance on the provision of IPS in Vietnam on top of the Draft Non-Cash Payment Decree. The Draft IPS Circular will be applicable to (i) IPS providers; (ii) foreign organizations providing IPS in Vietnam; and (iii) organizations and individuals involved in the provision of IPS. Some key updates regarding the Draft IPS Circular are as follows: Scope of Application The Draft IPS Circular sets out further guidance for the provision of IPS as listed under the Draft Non-Cash Payment Decree, including: (i) electronic clearing services; (ii) electronic wallet (“e-wallet”) services; (iii) collection and payment support services; (iv) financial switching services; (v) international financial switching services; and (vi) electronic payment gateway services. Notably, the Draft IPS Circular has explicitly excluded from its scope of application the provision of accounts by goods/service providers to their customers solely for the purpose of payment within the systems of such providers (e.g., cards/coupons or service/transaction accounts of online game service providers, transportation service providers, or securities companies, etc.). Requirements on the Provision of IPS Electronic Clearing Services: The Draft IPS Circular introduces regulations to cover certain elements of electronic clearing services that have not been explicitly outlined in Circular 39.