Crypto Regulation in Thailand: 2026 Update

Crypto regulation in Thailand is governed by a dedicated statutory framework that predates most comparable regimes in Southeast Asia. The Digital Asset Business Act and its subordinate regulations, administered by the Securities and Exchange Commission (SEC) and the Bank of Thailand (BOT), impose licensing, disclosure and conduct requirements on exchanges, brokers, dealers and fund managers operating with digital assets. Foreign operators entering the Thai market face a structured approval process with meaningful capital and compliance thresholds. This guide covers the legal framework, licensing requirements, recent regulatory updates, ongoing compliance obligations, and the practical considerations that matter most for international businesses.

Thailand';s primary legislation for digital assets is the Emergency Decree on Digital Asset Businesses B.E. 2561, commonly referred to as the Digital Asset Business Act. Enacted in the late 2010s, the Decree brought digital asset exchanges, brokers, dealers, fund managers, advisors and custodians within the regulatory perimeter of the SEC. It was one of the first comprehensive digital asset statutes in Asia and remains the cornerstone of the current framework.

The Decree defines two categories of regulated instruments: cryptocurrencies and digital tokens. Cryptocurrencies are defined as electronic data units created to serve as a medium of exchange. Digital tokens are subdivided into investment tokens, which confer rights to participate in investment projects, and utility tokens, which grant access to goods or services. The distinction matters because it determines which disclosure and licensing obligations apply to a given product or business model.

Subordinate regulations issued by the SEC under the Decree set out detailed rules on capital adequacy, client asset segregation, cybersecurity, anti-money laundering (AML) and know-your-customer (KYC) procedures. The SEC has updated these rules several times through notifications, most recently tightening requirements around stablecoin listings, leverage products and marketing to retail investors.

The Bank of Thailand retains authority over payment system aspects of digital assets. The BOT has issued guidance restricting the use of cryptocurrencies as a means of payment for goods and services within Thailand, a position it has maintained consistently. This creates a clear regulatory boundary: the SEC governs digital asset businesses as investment and trading activities, while the BOT governs payment infrastructure.

The Revenue Department has also issued guidance on the taxation of digital asset income, treating gains from trading as assessable income subject to personal income tax or corporate income tax, depending on the taxpayer';s status. Withholding tax obligations apply to certain digital asset transactions conducted through licensed platforms.

Any entity wishing to operate a digital asset exchange, broker, dealer, fund manager, advisor or custodian in Thailand must obtain a licence from the SEC before commencing operations. Operating without a licence is a criminal offence under the Digital Asset Business Act and can result in imprisonment and substantial fines for responsible individuals.

The licensing process begins with a formal application to the SEC, accompanied by a business plan, financial statements, evidence of minimum paid-up capital, AML and KYC policies, cybersecurity frameworks, and details of key personnel. The SEC reviews applications against a fit-and-proper standard that covers the financial soundness, technical competence and integrity of the applicant and its directors.

Minimum capital requirements vary by licence category. Exchanges face the highest thresholds, reflecting their role as central market infrastructure. Brokers and dealers face lower but still material requirements. Fund managers and advisors face separate capital and professional qualification standards. Applicants should treat these as floors, not targets, because the SEC may require additional capital buffers based on the scale and risk profile of the proposed business.

The approval timeline is typically several months from submission of a complete application. In practice, the SEC engages in a dialogue with applicants, requesting additional information or clarifications, which can extend the process. Foreign-owned entities face additional scrutiny regarding ultimate beneficial ownership, source of funds and the regulatory standing of any parent entity in its home jurisdiction.

A non-obvious requirement is that all digital assets listed or traded on a licensed Thai platform must be pre-approved by the SEC. The SEC maintains a list of approved cryptocurrencies and tokens. Listing an unapproved asset, even temporarily, constitutes a breach of licence conditions. This approval process for individual assets adds a layer of ongoing compliance that many foreign operators underestimate when planning their market entry.

In practice, founders should consider whether a full licence is necessary for their initial market entry strategy. Some business models can be structured to operate as a technology provider or white-label partner to an existing licensed entity, reducing the regulatory burden during the early phase. Legal advice on structuring is essential before committing to a licence application.

The SEC has been active in updating its digital asset framework in recent periods, responding to market developments including the collapse of offshore exchanges, the growth of decentralised finance (DeFi) and the proliferation of stablecoins. Several significant changes have come into effect or been proposed.

The SEC tightened rules on the listing of memecoins and highly speculative tokens, introducing enhanced disclosure requirements and restricting their availability to retail investors on licensed platforms. Exchanges must now conduct more rigorous due diligence on token issuers before listing, and must provide standardised risk warnings to clients.

Stablecoin regulation has become a priority area. The BOT and SEC have jointly signalled that stablecoins pegged to fiat currencies will be subject to a distinct regulatory regime, potentially requiring issuers to hold reserves with Thai financial institutions and to obtain separate authorisation. This mirrors global trends, including the direction of the European Union';s Markets in Crypto-Assets Regulation (MiCA), though Thailand';s approach is being developed independently and tailored to its domestic financial system.

The SEC has also strengthened its rules on custody and client asset protection. Licensed custodians and exchanges must now demonstrate that client digital assets are held in segregated wallets, with regular third-party audits. The rules are designed to prevent the commingling of client and proprietary assets, a failure mode that contributed to high-profile exchange collapses in other jurisdictions.

Marketing and advertising rules have been tightened. Licensed entities and their agents are prohibited from making misleading claims about returns, using celebrity endorsements in ways that imply guaranteed profits, or targeting advertisements at vulnerable groups. The SEC has taken enforcement action against several platforms for breaches of these rules, signalling that it treats marketing compliance as a substantive obligation rather than a formality.

DeFi and non-fungible tokens (NFTs) remain in a regulatory grey area. The SEC has indicated that DeFi protocols with identifiable operators may fall within the scope of the Digital Asset Business Act if they perform functions equivalent to a licensed activity. NFTs that confer investment rights may be classified as digital tokens subject to the full disclosure regime. Businesses operating in these areas should seek specific legal advice rather than assuming they fall outside the regulatory perimeter.

If you are assessing whether your digital asset business model requires a Thai licence or falls within an exemption, contact info@vlolawfirm.com. We can help structure the setup correctly the first time.

Licensed digital asset businesses in Thailand are subject to the Anti-Money Laundering Act and the Counter Terrorism and Proliferation of Weapons of Mass Destruction Financing Act, administered by the Anti-Money Laundering Office (AMLO). These obligations run in parallel with the SEC';s conduct rules and impose their own reporting and record-keeping requirements.

KYC obligations require licensed entities to verify the identity of all customers before onboarding, using government-issued identification and, for higher-risk customers, enhanced due diligence procedures. Corporate customers require verification of beneficial ownership to a defined threshold. The SEC and AMLO have aligned their KYC standards to a significant degree, but operators must ensure their procedures satisfy both sets of requirements simultaneously.

Transaction monitoring is a core ongoing obligation. Licensed entities must maintain systems capable of detecting unusual transaction patterns, flagging large transactions above defined thresholds, and filing suspicious transaction reports (STRs) with AMLO within prescribed timeframes. Failure to file an STR when required is itself an offence, separate from any underlying misconduct.

Record-keeping requirements are extensive. Licensed entities must retain customer identification records, transaction records and correspondence for a minimum period specified in the regulations, currently set at several years from the date of the transaction or the end of the customer relationship. These records must be available for inspection by the SEC and AMLO on request.

Cybersecurity is treated as a compliance matter, not merely an operational one. The SEC requires licensed entities to maintain written cybersecurity policies, conduct regular penetration testing, and report material security incidents to the SEC within a short timeframe after discovery. A common mistake is treating cybersecurity as an IT department responsibility rather than a board-level governance obligation with regulatory consequences.

Annual audits by approved external auditors are mandatory. The auditor must assess not only financial statements but also compliance with the SEC';s operational rules, including client asset segregation, capital adequacy and AML procedures. The audit report must be submitted to the SEC within the prescribed period after the financial year end.

The Revenue Department treats digital asset income as assessable income under the Revenue Code. For individuals, gains from trading digital assets are subject to personal income tax at progressive rates. For companies, gains form part of taxable profits subject to corporate income tax at the standard rate applicable to Thai companies.

A practical complication arises from the treatment of losses. The Revenue Department';s guidance has not always been consistent on whether losses from digital asset trading can be offset against gains in the same tax year or carried forward. Operators and investors should obtain specific tax advice rather than assuming that the general rules on loss relief apply straightforwardly to digital asset transactions.

Withholding tax applies to certain payments made through licensed digital asset platforms. The platform operator may be required to withhold tax at source on gains distributed to customers and to remit that tax to the Revenue Department. This creates an administrative burden for platform operators and requires careful system design to ensure accurate calculation and timely remittance.

VAT treatment of digital asset transactions has been clarified to some extent. Transfers of cryptocurrencies on licensed exchanges are currently exempt from VAT, following a specific exemption introduced to support the development of the licensed market. This exemption does not extend to all digital asset transactions, and businesses should verify the VAT position of their specific activities.

Foreign operators earning income from Thai-source digital asset activities may be subject to Thai tax even without a permanent establishment, depending on the nature of the income and applicable tax treaties. Thailand has a network of double tax agreements, but their application to digital asset income is not always straightforward and requires case-by-case analysis.

Foreign businesses seeking to operate in Thailand';s digital asset market face a combination of corporate law constraints and sector-specific regulatory requirements. The Foreign Business Act restricts foreign ownership in certain business categories, and financial services activities, including digital asset businesses, may fall within restricted categories depending on their precise nature. Foreign operators typically need to structure their Thai presence carefully, often using a locally incorporated entity with appropriate shareholding arrangements.

Scenario one: a foreign exchange operator seeking to offer services to Thai retail customers. This operator must incorporate a Thai company, obtain a digital asset exchange licence from the SEC, comply with the BOT';s restrictions on payment use cases, and ensure all listed assets are SEC-approved. The capital requirement for an exchange licence is material, and the operator must demonstrate that its global compliance infrastructure meets Thai standards. The timeline from incorporation to licence approval is realistically measured in months, not weeks.

Scenario two: a foreign fintech company wishing to issue a utility token to Thai investors to fund access to its platform. If the token confers any investment-like rights, it will likely be classified as a digital token under the Digital Asset Business Act, requiring a token offering portal licence and a SEC-approved whitepaper. The issuer must engage a licensed digital asset advisor to review the offering. Marketing the token to Thai investors without compliance with these requirements exposes the issuer and its directors to criminal liability.

Many underestimate the cost of ongoing compliance. Beyond the initial licence fee and capital requirement, operators face recurring costs for external audits, legal and compliance counsel, cybersecurity assessments and AMLO reporting systems. Professional fees for maintaining a compliant operation in Thailand typically start from the low thousands of USD per month for a small operator and scale significantly with transaction volume and product complexity.

A common mistake made by foreign founders is assuming that a licence obtained in another jurisdiction, such as a VASP registration in Europe or a money services business licence in the United States, provides any form of mutual recognition or reduced scrutiny in Thailand. It does not. The Thai SEC conducts its own independent assessment, and foreign regulatory standing is considered only as background context, not as a substitute for Thai compliance.

To discuss your specific market entry structure or compliance position in Thailand, contact info@vlolawfirm.com. We can assist with documents, filings and regulatory strategy.

What happens if a digital asset business operates in Thailand without a licence?

Operating a digital asset business without a licence from the SEC is a criminal offence under the Digital Asset Business Act. Penalties include imprisonment for responsible individuals and substantial fines for the entity. The SEC has the authority to issue cease-and-desist orders, freeze assets and refer cases to prosecutors. Enforcement has been active, and the SEC has taken action against both domestic and foreign-linked operators. Relying on a grey-area interpretation of the law is a high-risk approach that Thai courts have not been receptive to in recent cases.

How long does it take and what does it cost to obtain a digital asset exchange licence in Thailand?

The timeline from submission of a complete application to licence approval is typically several months, though complex applications or those requiring significant back-and-forth with the SEC can take longer. State and regulatory fees are set by the SEC and vary by licence category. Professional fees for preparing the application, including legal counsel, compliance consultants and auditors, typically start from the low tens of thousands of USD for a straightforward application. Ongoing compliance costs add materially to the total cost of operation. Operators should budget for the full lifecycle cost, not just the initial application.

Can a foreign company provide digital asset services to Thai customers from outside Thailand without a Thai licence?

The SEC takes the position that providing digital asset services to Thai residents, regardless of where the provider is incorporated or where its servers are located, may bring the provider within the scope of the Digital Asset Business Act if the activity constitutes a regulated business. The SEC has issued warnings to offshore platforms and has taken steps to restrict access to unlicensed foreign exchanges. While enforcement against purely offshore operators is practically limited, the legal risk is real, and Thai customers using unlicensed foreign platforms do so without the protections the Thai regulatory framework is designed to provide.

Thailand';s digital asset regulatory framework is among the most developed in Southeast Asia, combining a statutory licensing regime, active SEC supervision, AML obligations and evolving rules on stablecoins, marketing and custody. Foreign operators must navigate both sector-specific requirements and broader corporate law constraints. The framework continues to evolve, with recent reforms tightening standards across listing, custody and consumer protection.

VLO Law Firms advises international clients on crypto regulation and digital asset business matters in Thailand. We can assist with licence applications, corporate structuring, compliance programme design, token offering analysis and ongoing regulatory advisory. To request a consultation, contact: info@vlolawfirm.com