Technology M&A 2026

Last Updated December 11, 2025

Thailand

Law and Practice

Authors



Formichella & Sritawat Attorneys at Law is a leading Bangkok-based boutique firm specialising in telecommunications, media and technology (TMT), data privacy and energy regulation. It is known for managing complex regulatory and commercial matters at the intersection of law, infrastructure and innovation. The firm advises multinational telecoms operators, satellite and cloud providers, OTT platforms and fintech companies on licensing, compliance and market entry. Its lawyers regularly engage with the NBTC, MDES, PDPC and other key Thai regulators. The firm is recognised for its expertise in NBTC Type I–III licensing, cross-border data transfers, cybersecurity and cloud compliance, fintech and e-payment approvals, content and broadcasting rules, Board of Investment (BOI) promotion, and foreign business structuring. The firm also handles significant cross-border transactions and regulatory due diligence in Thailand’s fast-growing digital sectors. The firm’s strength lies in its technical depth, bilingual capability and strategic, collaborative approach across global markets.

The technology M&A market in Thailand has remained one of the most active sectors in South-East Asia throughout 2025, supported by the country’s digital economy roadmap and strong government incentives. Transaction values in the broader M&A space reached about USD4.2 billion in the first three quarters, with technology-related deals – including fintech, data centres, e-commerce platforms, health-tech and enterprise software – consistently accounting for 35%–45% of total volume. Cross-border acquisitions lead the market, primarily driven by buyers from Singapore, Japan, the United States, Malaysia and, increasingly, India, while domestic conglomerates and private equity funds pursue bolt-on acquisitions to speed up digital transformation.

Data centre and cloud infrastructure transactions have been especially prominent, driven by hyperscaler growth and the Board of Investment’s (BOI) promotion of the Eastern Economic Corridor as a regional digital hub. Fintech consolidation sped up after the Bank of Thailand launched its virtual-bank licensing programme, with applications submitted in 2024 and successful applicants expected in 2025, leading to a wave of strategic acquisitions as market players prepare for fully digital banking operations. AI, automation and cybersecurity targets gained premium valuations as traditional industries seek quick technology integration.

Clear themes shaping technology M&A in 2025–2026 include:

  • strong demand for AI, machine learning and generative AI capabilities, with acquirers purchasing start-ups to integrate these technologies into existing platforms;
  • continued boom in data centre and submarine cable investments, particularly from operators based in Singapore, Malaysia and Hong Kong;
  • fintech restructuring driven by virtual bank applications and the growth of embedded finance;
  • heightened emphasis on ESG and green tech, especially renewable energy software and carbon-accountability tools;
  • widespread use of earn-outs and deferred consideration to address valuation gaps in a higher-rate environment;
  • noticeably tighter regulatory scrutiny of foreign dominance in telecommunications and payment service licensees, prompting more sophisticated joint venture and preferred-share structures; and
  • rising interest from Indian IT service groups and US private equity funds targeting Thai Software as a Service (SaaS) and business-to-business (B2B) enterprise software targets for regional roll-ups.

Incorporating a technology company in Thailand follows the standard private limited company process under the Civil and Commercial Code, managed by the Department of Business Development. Registration is entirely online and usually completes within three to five business days once the documentation is prepared. The process requires:

  • name reservation;
  • submission of the memorandum and articles of association;
  • appointment of at least one director; and
  • declaration of the registered capital.

While there is no statutory minimum for ordinary activities, THB2 million to THB5 million is common for credibility and future BOI applications. Many technology companies seek BOI promotion at inception to gain 100% foreign ownership and tax holidays in eligible activities such as software development, digital platforms, data analytics and R&D.

Private limited companies are mostly preferred because of limited liability, flexibility in issuing share classes and simpler governance. Public limited companies are mainly used by ventures preparing for an IPO. For foreign founders, the two main structures are BOI-promoted companies (which can be 100% foreign-owned) and regular companies with a 49/51 foreign-Thai shareholding split, protected by preferred shares or voting agreements. Telecommunications-licensed entities must stay Thai-owned and free from foreign control under National Broadcasting and Telecommunications Commission (NBTC) rules (see 7.3 Restrictions on Foreign Investments).

Early-stage technology financing in Thailand relies on a mix of angel investors, government co-investment programmes under the National Innovation Agency and SME Development Bank, and licensed equity crowdfunding platforms. Convertible notes and simplified agreements for future equity are now standard instruments. Valuations remain modest by regional standards – typically USD2 million to USD8 million post-money for teams with a functioning product.

Thailand’s venture capital ecosystem is now mature, with active local funds and regular participation from regional investors. Series A and B rounds in 2025 averaged USD6 million to USD18 million for fintech, SaaS and deep-tech companies. Government co-investment schemes and tax incentives for investors have expanded the pool of available capital.

Term sheets follow international norms but include Thailand-specific features such as BOI-compliance covenants, foreign-exchange management and a preference for Thai-court or Singapore International Arbitration Centre (SIAC) arbitration. Shareholders’ agreements regularly include drag-along/tag-along rights, 1–2x non-participating liquidation preferences, anti-dilution protections and board seat entitlements.

Conversion into a public limited company is standard before an IPO on the Stock Exchange of Thailand (SET) or the Market for Alternative Investment (MAI), and requires a special resolution and associated filings. Thailand does not allow re-domiciliation; foreign companies seeking a Thai presence typically transfer assets/IP into a newly incorporated Thai entity, often structured as a tax-neutral reorganisation with prior approval from the Revenue Department.

High-growth Thai technology companies increasingly consider IPOs on the SET or MAI as attractive alternatives to trade sales, mainly for valuation uplift and continued founder control. Trade sales remain faster with lower execution risk, but may not offer the same valuation multiple as public-market listings for fintech or software companies.

The MAI is the preferred platform for most technology issuers due to its lower capital threshold (THB50 million), lighter profitability track record requirements and more flexible governance standards. Larger or BOI-promoted digital platform companies tend to target the SET for greater liquidity and institutional participation.

MAI listings impose lighter disclosure obligations, giving management more flexibility post-IPO. SET listings, however, trigger stricter related-party and tender-offer rules once an acquirer crosses 25%, complicating subsequent take-private attempts.

The typical sale process spans four to six months. It includes:

  • preparation of marketing materials;
  • a competitive auction run by an M&A adviser;
  • execution of non-disclosure agreements (NDAs);
  • data room population;
  • management presentations;
  • indicative bids;
  • confirmatory due diligence; and
  • signing/closing (or short deferred closing pending regulatory approvals).

Share deals dominate because they transfer the entire corporate package – including licences, contracts and BOI benefits. For telecoms-licensed companies, foreign buyers often acquire a 49% stake directly and create a Thai-majority joint venture for the remaining 51% to comply with foreign ownership rules.

Cash continues to be preferred by financial investors, while strategic buyers increasingly favour mixed consideration. Earn-outs based on revenue or EBITDA performance over 12 to 36 months are common for software targets.

Representations and warranties (R&W) insurance is common. Escrows or holdbacks of 10%–15% for 12 to 24 months, capped indemnity baskets and detailed IP warranties are standard. Non-compete and non-solicitation agreements lasting two to three years are enforceable if reasonable.

Spin-offs of digital and fintech units from traditional conglomerates have increased as groups seek valuation clarity and operational focus ahead of listings or strategic exits. The structure is also used to segregate regulated payment-service or telecoms licences before broader group transactions.

A spin-off structured as an entire business transfer under the relevant Revenue Department notifications can qualify for exemptions from VAT, specific business tax, stamp duty and, in many cases, corporate income tax on unrealised gains, provided the receiving entity continues the same business for at least three years.

Where the spin-off qualifies for entire-business-transfer treatment, subsequent mergers or sales generally avoid incremental tax on unrealised gains, provided continuity conditions are satisfied. Merger control filings may be required depending on the parties’ turnover and market share.

Advance tax rulings typically take two to four months and are recommended to confirm the entire-business-transfer treatment.

Investors may acquire up to just below 5% without disclosure. Crossing 5% triggers an immediate filing, with disclosure required for each subsequent 1% increase. Derivatives and contract for difference (CFD) exposure count towards thresholds.

Mandatory tender offers are triggered at 25%, 50% or 75% of voting rights. The offer price must be at least the highest price paid in the prior 90 days or the 15-day volume-weighted average.

Thailand relies primarily on voluntary and mandatory tender offers. Acquirers seeking full ownership commonly follow a staged route: acquire control through an initial tender (often 50%–75%), conduct a delisting tender, and subsequently complete an amalgamation or statutory merger to consolidate minority interests.

Tender offers are efficient for acquiring control without requiring full ownership upfront. Delisting and follow-on restructurings require supermajority approval and careful sequencing. Cross-border acquirers must also assess implications of the Foreign Business Act and sector-specific restrictions (telecoms, payments, data-sensitive sectors).

Cash, listed securities or hybrid consideration may be used. The Securities and Exchange Commission (SEC) imposes a 90-day look-back rule and requires an independent financial adviser’s opinion.

The following are standard:

  • regulatory approvals;
  • minimum acceptance conditions (usually 50%–90%);
  • absence of material adverse change; and
  • no competing offer.

The offer document (Form 247-4) and the independent financial adviser’s opinion must be filed with and approved by the SEC. Documentation typically addresses strategic rationale, financing sources, post-acquisition plans and specific risks for technology businesses, such as data protection and integration of proprietary platforms.

Offerors typically impose a 50%–75% minimum acceptance to obtain effective control or satisfy delisting thresholds. These may be waived subject to takeover rule compliance. Failure to meet the threshold generally results in the offer lapsing. Pre-bid undertakings from major shareholders are common.

Thailand does not provide an automatic statutory squeeze-out right. Acquirers instead pursue supermajority control to complete delisting and then implement an amalgamation or statutory merger, or negotiate buyouts with remaining minorities.

Cash offers require bank confirmation or escrow before SEC approval.

Break fees (1%–2% of equity value) are permitted if approved by independent directors. Exclusivity and no-shop clauses are routine.

Pre-bid undertakings, voting agreements and board-nomination rights are commonly negotiated.

Major shareholders often provide hard commitments to tender, significantly reducing execution risk.

SEC review of the tender offer document typically takes ten to 14 business days. The SET may impose disclosure requirements or temporary trading halts.

The offer period is 25 to 45 business days, extendable up to 90.

Technology businesses must comply with:

  • the Personal Data Protection Act (PDPA);
  • the Cybersecurity Act;
  • the Electronic Transactions Act; and
  • where relevant, the Telecommunications Business Act.

BOI-promoted companies receive incentives but must meet ongoing compliance requirements.

The SEC regulates public offerings, takeovers and ongoing disclosure. The SET supervises listing and trading.

The Foreign Business Act caps foreign ownership at 49% for businesses listed in the restricted categories unless a foreign business licence or BOI promotion is obtained. Telecommunications licensees (Type II/III) must remain Thai-owned and free of “foreign dominance”. Relevant indicators include foreign shareholding at or above 50%, a foreign-majority board, special voting rights or arrangements giving foreigners decisive influence.

Creative structures using preferred shares, shareholder agreement voting mechanics and parallel Thai-majority joint venture vehicles are frequently used to align economic ownership with foreign investors while maintaining Thai nationality of the licensee.

Investments involving encryption, critical infrastructure or defence-sensitive technologies may trigger review by security agencies.

Pre-merger approval is required where a transaction may create a dominant operator. Transactions that do not create dominance but involve aggregate Thai turnover above the statutory threshold must be notified post-completion. Early assessment is recommended.

The Labour Protection Act establishes a 48-hour work week, with overtime at 1.5x (or higher for holidays) and a minimum of six days’ annual leave after one year. Severance is required for termination without cause: up to 300 days’ wages after 10 to 20 years and 400 days after 20 years or more.

In technology deals, employee-incentive plans and change-of-control provisions are key issues. Thai law generally requires employee consent for transfer of employment; there is no automatic-transfer rule. Employee transfer mechanisms and communication planning are essential to minimise disputes.

Employers must contribute to the Social Security Fund at 5% of salary up to the statutory cap. Non-compete and non-solicitation covenants are enforceable if reasonable, and typically last one to two years for senior tech personnel.

Repatriation of dividends, loan repayments and sale proceeds through authorised banks are permitted with supporting documents. Inbound foreign currency receipts of USD50,000 or more require a foreign-exchange form. Outbound remittances above set thresholds require documentation such as board resolutions or agreements. Large cross-border payments should be structured with foreign exchange compliance in mind.

Regulators have adopted a more assertive posture in technology-sector supervision. The NBTC has increased scrutiny of foreign-ownership and control structures in telecoms and data infrastructure licensees, emphasising that de facto control – such as through voting agreements or nominee arrangements – can constitute foreign dominance even where formal shareholding thresholds appear compliant.

Under the PDPA, new subordinate regulations address cross-border transfers, records-of-processing exemptions and security standards. Enforcement activity and guidance have heightened expectations for data-processing agreements, breach notifications and third-party risk management.

The SEC has enhanced rules on digital-asset intermediaries, investment-product governance and IT/cybersecurity standards, which indirectly affect technology M&A by shaping operational resilience and disclosure obligations for listed companies.

Buyers prioritise source code ownership, open source compliance, customer contract assignability, cybersecurity history and data room hygiene. Confirming IP ownership and ensuring that there are no employee-related IP claims are critical.

PDPA due diligence includes:

  • mapping personal data flows;
  • evaluating consent mechanisms;
  • reviewing cross-border transfer practices; and
  • assessing breach logs.

Non-compliance can result in administrative fines of up to THB5 million per violation, civil liability and, in certain cases, personal exposure for responsible directors or officers.

The PDPA imposes practical limits on the scope of due diligence, particularly when a target company holds significant customer or employee data. While data can be reviewed for the purposes of an M&A transaction, the PDPA requires that disclosures to bidders be limited to what is necessary, appropriately anonymised or aggregated, and supported by safeguards such as NDAs and data-processing clauses.

Targets generally do not share raw customer data, personal data, behavioural profiles or identifiable logs unless lawful and necessary. Usually, the lawful basis is “legitimate interests”, requiring a balancing test and data minimisation. Therefore, bidders review sampled, masked or redacted data, summaries of data flows, security details, vendor lists and breach histories, not full datasets.

Employee data is restricted, including identifiable HR files, disciplinary records, medical info and IDs, which are usually unavailable during pre-closing diligence. Instead, anonymised summaries and risk assessments are used. In regulated sectors, regulators also expect restrictions on logs, metadata and network data that could identify users.

In practice, the PDPA does not prevent thorough diligence, but it influences it. Buyers should anticipate a two-phase process: a masked or redacted review before signing, followed by access to more detailed data only after signing, under stricter contractual protections or through a clean-team arrangement.

Public company bids become public upon SEC filing of Form 247-4 and a simultaneous press release.

IPOs and rights issues require a full registration statement and prospectus approved by the SEC.

The Thai Financial Reporting Standards (TFRS) apply, and are aligned with the International Financial Reporting Standards (IFRS). Public companies must provide audited annual and reviewed quarterly financials.

IPO prospectuses disclose material contracts. Tender offer documents summarise key terms, but full sale and purchase agreements (SPAs) are not publicly released unless required by the SEC.

Directors owe duties of care, loyalty and good faith. In M&A transactions, they must act in the best interests of the company and all shareholders, supported by a defensible process (independent valuations, proper board minutes and informed deliberation).

Independent committees are used for related-party transactions and take-private scenarios to manage conflicts and support fairness opinions.

Boards must approve major acquisitions, assess tender offer proposals and oversee independent advisers.

Directors often retain independent legal and financial advisers in public M&A to demonstrate fulfilment of their duties and mitigate litigation risk.

Formichella & Sritawat Attorneys at Law

399, Interchange 21 Building, 23rd Fl
Unit 3, Sukhumvit Road
Klongtoey-Nua, Wattana
Bangkok 10110
Thailand

+66 21071882

info@fosrlaw.com www.fosrlaw.com
Author Business Card

Trends and Developments


Authors



Baker McKenzie has been the leading international law firm in Thailand for over four decades. The firm’s Bangkok office works on some of the largest transactions and most complex legal matters in the Asia-Pacific. With its extensive experience, Baker McKenzie is the go-to firm for Thai companies, multinationals and financial institutions doing business in the country. The team of more than 250 lawyers and 250 business professionals works closely with the firm’s offices worldwide. Collaborating across practice groups, sectors and markets, the firm provides clients with the connected perspectives, integrated solutions and seamless guidance they need to succeed in an increasingly challenging global market. By combining extensive knowledge of Thai laws and regulations with a global perspective, Baker McKenzie ensures that its clients stay competitive in today’s interconnected economy.

Overview

The momentum in Thailand’s technology M&A market is expected to continue, driven by several key factors. Strategic M&A activity has largely been concentrated in technical infrastructure and application-layer vertical Software as a Service (SaaS) platforms. Companies in Thailand’s strong industries – such as food and beverage, manufacturing, healthcare and logistics – are actively pursuing technology-focused M&A deals to enhance their operational capabilities through tech integration. What is especially important is that the rise in technology-related M&A is not just a passing phase – it is being driven by deeper, long-term changes. When looking closer at these steady trends, it is clear that Thailand is in a good position for ongoing technology M&A activity, thanks to its readiness for digital transformation, its mix of strong industries and its strategic role in the region.

AI-related and tech infrastructure continues to be an active M&A target

With unprecedented levels of investment pouring into AI assets and the fruits of those investments beginning to materialise, fears of the AI bubble bursting have subsided. At the same time, the value proposition of AI investments has actively shifted from one of speculation for big returns to one of strategic importance – not surprisingly, the tech M&A market is excited because of that. The likes of Meta, Amazon, Alphabet and Microsoft have announced their intention to spend up to USD320 billion combined on AI technologies and data centre build-outs in 2025, up from USD230 billion capital expenditure last year.

Thailand is no different, with its established industrial base providing natural adoption pathways for AI technologies. This has allowed Thailand to mirror global investment patterns: in the first half of 2025, the data centre industry alone attracted USD16 billion from 28 projects, with the Thailand Board of Investment (BOI) having announced in May and June that it approved six more investments in the country worth USD3.6 billion. The inflow of foreign direct investment into homegrown Thai digital infrastructure assets has not been limited to only greenfield developments by major operators: institutional investors have also signalled interest, with Global Infrastructure Partners, the infrastructure investment arm of BlackRock, recently announcing a partnership valued between USD3 billion and USD5 billion with Thai conglomerate CP Group to develop a giga data centre hub in Thailand. Set against this backdrop, the authors expect the more mature and consolidated data centre markets of North America and Europe to drive institutional capital, in the quest for cheaper and faster ways to tap into AI infrastructure assets, and towards smaller and medium-sized data centres in Thailand and the South-East Asia region.

Vertical SaaS solutions and digital transformation strategies

In parallel, the authors have seen a greater number of software and IT solutions take advantage of these robust digital infrastructure ecosystems and thereby become more attractive targets themselves for major strategic acquirers. Globally, companies such as Mastercard, ServiceNow, Accenture and other vertical SaaS solutions are acquiring AI start-ups to embed proven solutions into mission-critical industries. Thailand’s regional leadership in the food and beverage, logistics and many other industries has positioned these sectors as active arenas for M&A activity, with buyers seeking greater AI and robust infrastructure capabilities that can be deployed, commercialised and integrated into existing workflows (so-called “capability deals”).

The most prominent example of this is LINEMAN Wongnai’s spree of bolt-on acquisitions, having recently announced its acquisition of JERA Cloud, a vertical SaaS offering cloud and POS solutions in the wellness and clinic industry. Humanica’s acquisition of Cadena Group, a Singapore-based provider of human resource information systems, and Lawson Software, a Thai enterprise software provider focused on payroll and business management solutions, exemplifies the growing trend of capability deals. Thailand’s position as a regional hub for traditional industries (including food and beverage, logistics and manufacturing) and the drive for digital transformation should continue attracting M&A and industry-specific solutions. 

The shift to a technology outsourcing model

One factor that the authors expect will help to drive greater tech M&A activity in Thailand in the coming years is the outsourcing trend of multinational and leading local companies, particularly in specialised sectors such as healthcare and biotech, in which large, specialised companies opt to delegate non-core functions to external partners or assets through acquisitions or joint ventures. Thailand is an established regional leader in healthcare in South-East Asia. However, given that healthcare sales channels – ie, the ways in which a healthcare provider reaches its patient or customer – are severely fragmented, large pharmaceuticals or consumer health companies are scarcely able to justify investments in Thailand without a thorough and omni-channel approach to reach Thai consumers. Ultimately, this serves as a quicker and cheaper route to market than greenfield investments and building out local presences.

In Thailand, the authors see this shift as being particularly relevant given the country’s relatively strong healthcare infrastructure. By outsourcing distribution, service delivery and even R&D, global firms can tap into local capabilities while focusing internal resources on a broader global strategy. This model benefits players such as Eppendorf Thailand, a local market leader for laboratory equipment recently acquired by DKSH Technology, allowing DKSH to leverage Thailand’s robust healthcare infrastructure while bypassing the complexities and costs associated with building a local operation from the ground up. The authors expect that Thailand’s position as a regional medical hub will serve as a springboard allowing for the outsourcing trend with M&A activity in health tech to pick up within the next few years.

Outright acquisitions of media assets and sports streaming deals

In the media and entertainment sector, two distinct trends have been driving M&A activity, with the rise of digital streaming technology being a key factor. In today’s streaming-driven entertainment landscape, owning a large library of content – such as music, films and TV shows – has become key to generating strong revenue and profits. As a result, digital streaming platforms, music and movie distributors, major private equity funds and large entertainment companies are all competing to acquire more content assets.

First, today, steaming service providers and other buyers are more motivated than ever to acquire or secure premium media assets. Their goal is to attract and retain subscribers by offering high-value content due to the fiercely competitive streaming market, and the “serial churner” phenomenon (in which users subscribe to a streaming service for the purpose of accessing specific content and then subsequently cancel their subscriptions) has long troubled streaming services. The industry is thus pivoting its focus to retention strategies that give streaming services greater control over their content offerings in a bid to deliver the right content to the right consumer.

One of these strategies is to own the content machine. This allows streaming services to leverage established IP to fit the needs of consumers, without relying on the terms and conditions of the underlying right-holders. ESPN’s acquisition of the National Football League’s (NFL) media assets is a prime example of using media assets that are inherently “seasonal” to generate and monetise year-round content. Thailand is also seeing its share of outright media acquisitions, including (as the authors reported in 2024) Universal Music Group’s acquisition of RS Group’s entire music catalogue. Increased market activity and ongoing deal discussions are also being observed, indicating that content acquisitions will increasingly be pursued through M&A in Thailand in the coming years. 

Another retention strategy seen more frequently in Thailand is the content-bundling strategy, which tends to concentrate in partnerships rather than traditional licensing agreements or outright acquisitions. Paramount Global’s licensing agreement with MONO to create a branded Paramount+ extension on Monomax is a prime example of this. AIS’s recent deal with Prime Video, which bundles access to global streaming services into its offerings via AIS PLAY PREMIUM PLUS, is also an effective merging of infrastructure, platform and premium content into a single ecosystem. The content-bundling strategy through partnerships mirrors the control typically achieved through an outright acquisition, and the arrangement is comprehensive rather than piecemeal content licensing – though it stops short of an acquisition as the buyer does not obtain ownership or operational control of the content. This growing trend of content partnerships – such as bundling and co-branding arrangements – reflects a strategic shift in how businesses access and secure premium media assets for their monetisation. As these collaborations deepen, the authors expect that they will increasingly evolve into M&A activity, where parties move beyond simple partnerships or licensing to form joint ventures. These joint ventures will allow companies to co-own and co-develop content, combining infrastructure, platforms and creative assets under a shared structure.

The second observable trend is at the industry level, with M&A deals expanding beyond music and movies into sports. The arrival of institutional capital in sports is heralded by the announcement of the Electronic Arts (EA) takeover by Silver Lake and the Public Investment Fund (PIF; the Saudi sovereign wealth fund), combined with the NFL’s announcement that it would allow private equity firms to take minority stakes in its sports franchises. Recent years have validated sports as an asset class, and the authors expect that, with the flow of more institutional capital, it will become a more liquid market with an abundance of willing buyers and sellers.

Thailand is taking great interest in international sports, with GULF, AIS and JAS recently securing exclusive Thai League broadcasting rights in a landmark THB2 billion deal with the Football Association of Thailand, which guarantees coverage for four seasons. Notably, AIS also recently secured exclusive streaming rights for National Basketball Association (NBA) games in Thailand, delivered via AIS PLAY. This growing trend of businesses acquiring content rights is expected to evolve into full-scale M&A activity, where companies pursue ownership of content by acquiring content producers, distributors or the companies that hold valuable media assets; the content is now not limited to only music, movies or TV series but also includes sports content. The authors expect continued M&A activity in the Thai media and entertainment market, both from strategic buyers and institutional capital.

Upcoming Regulations

Draft Principles of AI law

The Draft Principles regulate AI providers and AI deployers based on the level of risk associated with the AI systems. They impose obligations on “high-risk AI providers”, including the duties to:

  • implement risk management systems;
  • exercise a duty of care;
  • appoint a legal representative in Thailand (for offshore AI providers); and
  • report serious incidents to the relevant enforcement agency.

The current Draft Principles will not directly specify which types of AI are considered high-risk. Instead, they delegate authority to sector-specific regulators to determine and issue such classifications.

The Draft Principles also outline key rights of AI users, including:

  • the right to notification;
  • the right to explanation; and
  • the right to contest decisions made by AI systems.

In addition, the Draft Principles introduce measures to support Thailand’s emerging AI ecosystem, such as:

  • text and data mining permits for commercial purposes;
  • providing exemptions for scientific research; and
  • establishing safe harbours for AI sandboxes.

Thailand previously proposed two AI-related draft laws: the Draft Royal Decree on Business Operations that Use Artificial Intelligence Systems, and the Draft Act on the Promotion and Support of Thailand’s Artificial Intelligence Innovation. These were developed under government consultancy projects, during a period when generative AI was not yet widespread. In response to rapid advancements in AI and evolving international practices, the Electronic Transactions Development Agency (ETDA) was later assigned to review and update both drafts to better reflect current technological and legal developments. This process led to the creation of the current Draft Principles, for which ETDA is expected to serve as the regulatory authority.

The first version of the Draft Principles was released for public hearing in June 2025, while the related draft act and detailed legislative framework are still being finalised.

Virtual bank licensing framework

A virtual bank is a new type of commercial bank that operates entirely through digital channels without physical branches. It leverages technology and diverse data sources – including financial and behavioural data – to assess risk and deliver innovative financial services tailored to customer needs.

Unlike mobile or internet banking, which are digital extensions of traditional banks, virtual banks are fully digital by design. The Bank of Thailand (BOT) has officially closed the application process for virtual bank licences, and announced a list of approved applicants on 19 June 2025. Approved applicants must:

  • establish a public limited company;
  • comply with conditions set by the Minister of Finance;
  • pass a readiness assessment by the BOT; and
  • begin virtual bank operations within one year of approval (by 19 June 2026).

However, the Bank of Thailand and the Ministry of Finance will continue monitoring the performance of these branchless banks and may consider allowing additional operators if they demonstrate clear benefits to the financial system.

Policy guidelines on risk management for the use of AI by financial institutions and payment service providers

The BOT’s AI risk management policy, recently announced on 12 September 2025, only applies to:

  • financial institutions;
  • specialised financial institutions under the law governing financial institution businesses; and
  • supervised payment service providers and payment service operations that are under supervision according to the law governing payment systems.

It requires these entities to manage risks across the entire AI life cycle and to comply with the “responsible AI” framework, guided by four core principles: fairness, ethics, accountability and transparency (FEAT).

Institutions must implement technical safeguards, ensure fair consumer protection, disclose AI usage and offer opt-out options. Senior executives and board members are responsible for governance, including setting policies and defining acceptable risk levels. For critical AI applications such as loan approvals, human oversight is mandatory. Additionally, institutions must use secure, high-quality training data, prevent data leaks, and address AI-specific cybersecurity threats using global standards.

Emergency Decree on measures for the prevention and suppression of technological crimes

Emergency Decree (No 2) BE 2568, which came into effect on 13 April 2025, introduces enhanced legal measures to combat the growing threat of technology-related crimes in Thailand. It expands the scope of regulated entities to include:

  • digital asset business operators;
  • payment service providers;
  • mobile network operators;
  • telecommunications service providers;
  • social media platform service providers; and
  • other relevant service providers.

These entities may be held jointly liable for damages caused by technological crimes – such as scams – if they fail to comply with mandated security standards (safe harbour) issued by their respective regulators.

The decree requires financial institutions, payment service providers and digital asset business operators to disclose suspicious activities and share data through a centralised system. It also mandates the implementation of robust security protocols to prevent crimes such as SMS fraud and unauthorised data use.

Importantly, the Transaction Committee under the Anti-Money Laundering Act is authorised to consider reimbursing victims without waiting for a final court judgment. The decree also imposes strict penalties, including fines and imprisonment, on institutions and individuals who fail to comply, misuse personal data or facilitate criminal activities through mobile numbers or digital accounts.

Baker McKenzie

195 One Bangkok Tower 4
30th–33rd Floors, Wireless Road
Lumphini, Pathum Wan
Bangkok 10330
Thailand

+66 2636 2000

+66 2636 2111

Bangkok.Info@bakermckenzie.com www.bakermckenzie.com/en/locations/asia-pacific/thailand
Author Business Card

Law and Practice

Authors



Formichella & Sritawat Attorneys at Law is a leading Bangkok-based boutique firm specialising in telecommunications, media and technology (TMT), data privacy and energy regulation. It is known for managing complex regulatory and commercial matters at the intersection of law, infrastructure and innovation. The firm advises multinational telecoms operators, satellite and cloud providers, OTT platforms and fintech companies on licensing, compliance and market entry. Its lawyers regularly engage with the NBTC, MDES, PDPC and other key Thai regulators. The firm is recognised for its expertise in NBTC Type I–III licensing, cross-border data transfers, cybersecurity and cloud compliance, fintech and e-payment approvals, content and broadcasting rules, Board of Investment (BOI) promotion, and foreign business structuring. The firm also handles significant cross-border transactions and regulatory due diligence in Thailand’s fast-growing digital sectors. The firm’s strength lies in its technical depth, bilingual capability and strategic, collaborative approach across global markets.

Trends and Developments

Authors



Baker McKenzie has been the leading international law firm in Thailand for over four decades. The firm’s Bangkok office works on some of the largest transactions and most complex legal matters in the Asia-Pacific. With its extensive experience, Baker McKenzie is the go-to firm for Thai companies, multinationals and financial institutions doing business in the country. The team of more than 250 lawyers and 250 business professionals works closely with the firm’s offices worldwide. Collaborating across practice groups, sectors and markets, the firm provides clients with the connected perspectives, integrated solutions and seamless guidance they need to succeed in an increasingly challenging global market. By combining extensive knowledge of Thai laws and regulations with a global perspective, Baker McKenzie ensures that its clients stay competitive in today’s interconnected economy.

Compare law and practice by selecting locations and topic(s)

{{searchBoxHeader}}

Select Topic(s)

loading ...
{{topic.title}}

Please select at least one chapter and one topic to use the compare functionality.