Thailand is taking decisive action to combat online fraud and cybercrime. On April 8, 2025, the Thai Cabinet approved two critical amendments to existing emergency decrees, which were swiftly published in the Royal Gazette on April 12, 2025, and came into immediate effect on April 13, 2025.
The Emergency Decree on Measures for the Prevention and Suppression of Technological Crimes (No.2) B.E. 2568 (2025) (unofficial translation), is designed to boost online safety and crack down on scams and digital fraud. The Emergency Decree on Digital Asset Businesses (No 2.) B.E. 2568 (2025) (unofficial translation), targets the fast-growing crypto space to ensure all digital asset service providers offering services to Thai citizens fall under unified regulatory oversight.
The two decrees stem from a unified legislative initiative—the draft amendment to the Emergency Decree on Measures for the Prevention and Suppression of Technological Crimes, which was initially aimed at addressing both cybercrime and digital asset regulation. However, the draft was split into two laws, each focusing separately on cybercrime and digital assets.
The Emergency Decree on Measures for the Prevention and Suppression of Technological Crimes (No.2) B.E. 2568 (2025)
- Definition and entities: Business operators regulated under this Emergency Decree are financial institutions, payment service providers, digital asset businesses, telcos, and social media platform service providers.
- Information disclosure is mandatory: Should any suspicious activities related to cybercrime be found, financial institutions, payment service providers, and digital asset businesses are required to disclose or exchange information through a system jointly established by relevant government agencies. The said businesses are also mandated to reject transactions done by the blacklisted accounts.
- Subject to shared liability, and stricter anti-scam preventive measures required: Business operators will bear shared liability for damage caused by scams. To avoid being held liable, businesses must demonstrate that they fully comply with the law and have implemented sufficient preventive measures against technological crime as specified by the government agencies.
- Losses are to be recovered: Victims will be entitled to financial restitution through administrative procedures aligned with the ministerial regulations and Anti-Money Laundering Office (AMLO) regulations, including the right to claim damages.
- Non-compliance penalties increased: Imprisonment and fines will be imposed on financial institutions or businesses that violate the law, as well as individuals involved in trading phone numbers or collecting/disclosing personal data for criminal purposes.
- Law enforcement entities’ authority enhanced: The officials under the Computer Crime Act are authorized to block access to unregulated digital asset platforms. Also, the authority of the Anti-Online Scam Operation Center (AOC), under the Ministry of Digital Economy and Society, is elevated from the hotline to a functional operation center with legal power. Their responsibilities include receiving reports on cybercrime, tracing the transaction for loss recovery, freezing fraudulent transactions, suspending suspicious telco operations, ordering information disclosure, and blacklisting individuals and digital asset wallets.
The decree significantly raises the stakes for the businesses, introducing shared liability for online scams, stricter penalties for non-compliance, and a mandate for closer cooperation with the Anti-Online Scam Operation Center (AOC). Impacted businesses must implement robust fraud prevention measures and proactively engage with emerging authorities, such as the AOC, to maintain clear communication and effectively manage legal and financial risks.
The Emergency Decree on Digital Asset Businesses (No 2.) B.E. 2568 (2025)
- Foreign digital asset platforms are targeted: The law now regulates all digital asset businesses that offer services to Thai people, regardless of their geographical location.
- Inclusive criteria: Digital asset platforms are considered offering services to the Thais, if their businesses are conducted in manners such as (1) having interface in the Thai language on its website or application (2) using .th domain (3) offering transaction in Thai baht (4) pays for services enabling Thai-based user access such as search engine optimization and (5) establishes a local office or personnel to provide support for Thai users.
- Peer-to-peer (P2P) mechanism is excluded: This draft does not specifically include the regulation on the P2P mechanism. However, the Securities and Exchange Commission (SEC) will issue subordinate laws to control or prohibit it in the future.
The Emergency Decree on Digital Asset Businesses (No 2.) B.E. 2568 (2025) targets unlicensed foreign digital asset businesses more than licensed locals. Any services that could be deemed to serve the Thais result in those businesses being subjected to this law. If they operate without permission, the platforms are at risk of being taken down by the authorities.
As for the P2P transaction, although these laws have not yet banned it outright, businesses offering this service should prepare for increased scrutiny or enforcement actions, as the regulators aim to issue subordinate regulations to restrict the mechanism.
What are the next steps?
The two decrees are special laws issued by the Cabinet with royal approval to address urgent matters. They will soon be presented to Parliament for approval, and if endorsed, they will become equivalent to a regular Act of Parliament. If rejected, though highly unlikely, they will cease to have legal effect.
Any amendments to the details of the legislation would require going through the standard, often lengthy legislative process, including cabinet approvals and public consultations, just like changes to a regular Act of Parliament.