# Thailand Technology Crime Emergency Decree B.E. 2566 and (No. 2) B.E. 2568: Regulated Duties and Shared Responsibility

Locale: `en`

Source: `/en/compliance/tech-crime-decree/`

Summary: Thailand Technology Crime Emergency Decree B.E. 2566 and (No. 2) B.E. 2568: duty holders, the AOC (ศปอท.), Section 8/10 shared responsibility, and Section 11/2 data

On this page

1. [Overview](/en/compliance/tech-crime-decree/#topic-overview)
2. [Duty Holders and Data Exchange (Sections 3, 4, 8/5, and 8/10)](/en/compliance/tech-crime-decree/#tech-crime-decree-scope)
3. [Regulator Standards, SMS Screening, and Refusal or Suspension of Service (Sections 4/1 and 4/2)](/en/compliance/tech-crime-decree/#fraud-exchange-and-suspension)
4. [Transaction Holds, Orders Against Unlicensed Digital Asset Operators, and Shared Responsibility (Sections 6, 7, 7/1, and 8/10)](/en/compliance/tech-crime-decree/#digital-asset-blocking-and-shared-liability)
5. [Mule Accounts, SIMs, and Personal or Deceased Persons Data Offenses (Sections 9 to 11/2)](/en/compliance/tech-crime-decree/#personal-and-deceased-data-offenses)
6. [Requirements Matrix](/en/compliance/tech-crime-decree/#compliance-matrix)
7. [Implementation Checklist](/en/compliance/tech-crime-decree/#compliance-readiness-checklist)
8. [Frequently Asked Questions](/en/compliance/tech-crime-decree/#compliance-faq)
9. [Related Frameworks](/en/compliance/tech-crime-decree/#related-compliance-frameworks)

# Thailand Technology Crime Emergency Decree B.E. 2566 and (No. 2) B.E. 2568: Regulated Duties and Shared Responsibility

A compliance and security testing guide to the Emergency Decree on Measures for the Prevention and Suppression of Technology Crimes B.E. 2566 and its Amendment (No. 2) B.E. 2568 (effective 13 April 2025), covering the duty holders under Sections 3, 4, and 8/10, account and transaction data exchange, the role of the AOC (ศปอท.), transaction holds, orders against unlicensed digital asset operators, shared responsibility under Section 8/10, and data offenses under Section 11/2.

Overview

Target Audience

Financial institutions, payment providers, digital asset operators, telecoms, social media platforms, and custodians of personal or deceased persons data

Testing and Review Frequency

Continuous anti-fraud control enforcement, statutory transaction holds, and periodic security testing under sector regulator rules

Assessment Scope

Section 4 data exchange, AOC-notified lists, SMS screening, mobile applications, and customer databases

Relevant Risks

Shared responsibility for damage under Section 8/10, and penalties under Section 8/11 (a fine of up to THB 500,000 for the entity, and up to 1 year in prison, a THB 100,000 fine, or both for a director or manager whose order or omission caused the offence), Section 8/12, and Sections 9 to 11/2

## Duty Holders and Data Exchange (Sections 3, 4, 8/5, and 8/10)

The No. 2 decree widens the defined term operator to include digital asset business operators, adds digital asset wallet numbers to the data that must be exchanged, and creates the AOC (ศปอท.) inside the Office of the Permanent Secretary of the Ministry of Digital Economy and Society.

[![Technology Crime Emergency Decree: Duty holders (Sections 3, 4, and 8/10) → Standards and lists (Sections 4/1, 4/2) → Holds and shared responsibility (Sections 6, 7, 7/1, 8/10) → Personal and deceased data offenses (Section 11/2)](/assets/compliance/guide-tech-crime-decree-compliance-control-summary-en-v3.webp)](/assets/compliance/guide-tech-crime-decree-compliance-control-summary-en-v3.webp)

**Technology Crime Emergency Decree**

B.E. 2566 as amended by (No. 2) B.E. 2568

1. **Duty holders (Sections 3, 4, and 8/10)**
  - Financial institutions, payment and digital asset operators, telecom providers, other related service providers, and social media providers
2. **Standards and lists (Sections 4/1, 4/2)**
  - Regulators set standards and telecom providers screen SMS. When the AOC notifies a list, refuse accounts or suspend service
3. **Holds and shared responsibility (Sections 6, 7, 7/1, 8/10)**
  - Holds up to 7 days, orders against unlicensed digital asset operators, and shared responsibility unless compliance is proved
4. **Personal and deceased data offenses (Section 11/2)**
  - Up to 1 year, 100,000 THB, or both. If buying, selling, or unlawful profiteering, up to 5 years, 500,000 THB, or both

- The duty holders are financial institutions (commercial banks and specialized state financial institutions), operators under the payment systems law, and digital asset business operators (Section 3), and telephone network, other telecom, and other related service providers (Section 4 paragraph 2). Social media providers are named in Section 8/10.
- Section 4 paragraph 1 requires financial institutions and operators to disclose or exchange customer account and transaction data and digital asset wallet numbers when there is reasonable suspicion of technology crime, through a system or process jointly approved by the Ministry of Digital Economy and Society, the Royal Thai Police, the Department of Special Investigation, AMLO, the Bank of Thailand, and the SEC Office.
- Section 4 paragraph 2 (original 2023 text) requires telephone network, other telecom, and other related service providers to exchange service data among themselves through a system or process jointly approved by the Ministry and the NBTC Office.
- Section 8/5 establishes the AOC (ศปอท.), which receives victim reports, suspends transactions on deposit or e-money accounts, orders submission of suspicious account data, announces lists of persons or wallet numbers, and passes phone, SMS, and sender-name data to the NBTC Office. STH recommends securing the integrations, authentication, and audit trail used for these exchanges.

## Regulator Standards, SMS Screening, and Refusal or Suspension of Service (Sections 4/1 and 4/2)

Section 4/1 directs regulators to set standards for the purposes of Section 8/10, while Section 4/2 imposes a direct duty on financial institutions and operators once the AOC notifies a list.

- Section 4/1 paragraph 1 directs the Bank of Thailand, the SEC Office, the NBTC board and its Office, and the Electronic Transactions Commission to set technology-crime prevention standards or measures for the purposes of Section 8/10. This paragraph does not itself impose a duty on providers.
- Section 4/1 paragraph 2 requires telephone network and other telecom providers to screen SMS content that may relate to technology crime under standards set by the NBTC Office. Suspending telecom service is a separate power under Section 5 paragraph 2, where the police, the DSI, AMLO, or the AOC ask the NBTC Office to order the provider to suspend service.
- Section 4/2 requires financial institutions and operators to refuse account opening, suspend service or transactions, or close accounts for persons or digital asset wallet numbers on a list notified by the AOC until the listing is withdrawn. Failure to comply carries a fine of up to 500,000 THB under Section 8/11.
- STH recommendation: penetration testing of mobile banking, e-wallet, and digital asset platforms helps confirm device, authentication, and transaction controls against regulator standards. The decree itself sets no testing cycle.

## Transaction Holds, Orders Against Unlicensed Digital Asset Operators, and Shared Responsibility (Sections 6, 7, 7/1, and 8/10)

Sections 6 and 7 are original 2023 provisions that now also reach digital asset operators through the redefined term. Sections 7/1 and 8/10 were added by the No. 2 decree.

- Section 6: when a financial institution or operator finds reasonable suspicion itself or receives data from the Section 4 exchange, it must suspend the transaction, notify the next recipients, and enter the data into the exchange. The suspension is temporary, for up to 7 days from the date of the finding or notice, and the authorities must act within 7 days of notice or the suspension is lifted. Section 7: when a victim who holds the account reports the transaction, the institution suspends it temporarily, enters the data into the exchange, and tells the victim to file a complaint within 72 hours. The investigator must decide within 7 days of the complaint, and the suspension is lifted if no order to continue is made.
- Section 7/1: when an official appointed under the computer crime law finds a digital asset business operating without a license under the digital asset business law, the official orders suspension of the circulation of the data or its removal from the computer system without delay, under steps announced by the Minister of Digital Economy and Society. Non-compliance with an order is punished under Section 8/12. Section 7/1 does not mention foreign operators. Operators outside the Kingdom that serve persons in the Kingdom fall under Section 26 paragraph 3 and Section 26/1 of the Emergency Decree on Digital Asset Businesses B.E. 2561, as amended by (No. 2) B.E. 2568, unless the service is one the SEC board announces otherwise, and Section 26/1 lists seven characteristics that count as serving persons in the Kingdom, such as Thai-language display or payment in baht.
- Section 8/10: financial institutions or operators, telephone network providers, other telecom providers, other related service providers, and social media providers share responsibility for damage caused by technology crime unless they prove they complied with the standards or measures set by the regulators.
- STH recommendation: keep evidence of compliance with regulator standards, such as test reports, remediation proofs, and fraud-monitoring logs, to support the proof required under Section 8/10.

## Mule Accounts, SIMs, and Personal or Deceased Persons Data Offenses (Sections 9 to 11/2)

Beyond mule accounts and SIM cards, the No. 2 decree adds offenses for using, collecting, possessing, or disclosing identifiable data about living or deceased persons.

- Section 9: opening or letting others use your deposit account, electronic card, or e-money account (defined in the No. 2 decree to include digital asset accounts), or lending a mobile number, knowing or ought to know it will be used for an offense, carries up to 3 years, up to 300,000 THB, or both. Sections 10 and 11: brokering or advertising the sale, rental, or lending of accounts, or the sale of registered mobile numbers whose user cannot be identified, carries 2 to 5 years, 200,000 to 500,000 THB, or both.
- Section 11/2 paragraphs 1 and 2: using, collecting, possessing, or disclosing identifiable data about a living or deceased person to commit a criminal offense carries up to 1 year, up to 100,000 THB, or both. Paragraph 3: if done by buying, offering to buy, selling, offering to sell, exchanging, or other unlawful profiteering, the penalty rises to up to 5 years, up to 500,000 THB, or both.
- Section 11/2 covers data of deceased persons, which the definition of personal data in Section 6 of the PDPA specifically excludes. Section 12 of the 2023 decree exempts processing under the decree from the PDPA but bars recipients from disclosing the data to unrelated persons.
- STH recommendation: include databases holding both living and deceased customer records within penetration testing, access control review, and data-loss prevention scopes.

## References and Assessment Scope

Summary of source references, assessment scope, and review timing in the context of each item.

| Reference | Topic | Assessment Scope | Testing Cycle |
| --- | --- | --- | --- |
| **Sections 3, 4, and 8/5** | Section 4 Data Exchange and the Role of the AOC | Financial institutions and operators exchange account, transaction, and wallet data when there is reasonable suspicion, while telecom providers exchange service data among themselves | When reasonable suspicion arises, as the text provides |
| **Sections 4/1 and 4/2** | Regulator Standards, SMS Screening, and Refusal or Suspension of Service | Comply with standards of the Bank of Thailand, the SEC Office, the NBTC and its Office, and the Electronic Transactions Commission, screen SMS under NBTC Office standards, and refuse or suspend service for lists notified by the AOC | As set by the regulators, since the decree itself sets no testing cycle |
| **Sections 6, 7, and 7/1** | Temporary Transaction Holds and Orders Against Unlicensed Digital Asset Operators | Hold transactions temporarily for up to 7 days under Section 6 or the Section 7 procedure, notify next recipients, and comply with official orders under Section 7/1 | Immediately upon reasonable suspicion, a victim report, or an official order |
| **Sections 8/10 and 11/2** | Shared Responsibility for Damage and Criminal Protection of Personal or Deceased Data | Keep evidence of compliance with regulator standards to support the Section 8/10 proof, and control access to records of living and deceased persons | Ongoing evidence retention, as an STH recommendation |

### Implementation Checklist

Select items your organization has completed. The percentage shows selected items only and does not assess security or compliance.

0%

Identify which duty-holder group applies under Sections 3, 4, and 8/10, and connect securely and auditably to the Section 4 data exchange.
          
          
            
            Track and comply with the technology-crime prevention standards or measures of the Bank of Thailand, the SEC Office, the NBTC and its Office, and the Electronic Transactions Commission that apply to the organization (Section 4/1).
          
          
            
            Test the process for receiving AOC lists, refusing accounts or suspending service under Section 4/2, and temporary transaction holds under Sections 6 and 7.
          
          
            
            STH recommendation: penetration test financial applications, digital asset platforms, and customer databases, including records of deceased customers (Section 11/2).
          
          
            
            Retain evidence of compliance with regulator standards, such as test reports, remediation proofs, and fraud-monitoring logs, to support the proof under Section 8/10.

No items selected

Select items above to track your progress.

[Request Pentest Quote](/en/#contact)

## Frequently Asked Questions (FAQ)

Key answers and practical guidance addressing common compliance questions.

### What did the Technology Crime Emergency Decree (No. 2) B.E. 2568 add?

Effective 13 April 2025, the No. 2 decree widens the defined term operator to include digital asset business operators, adds digital asset wallet numbers to the Section 4 data exchange, adds Sections 4/1 and 4/2, lets officials order suspension of data about unlicensed digital asset operators (Section 7/1), creates the AOC (ศปอท.) under Section 8/5, sets shared responsibility for damage (Section 8/10), and adds criminal penalties for misuse of personal or deceased persons data (Section 11/2).

### When does shared responsibility under Section 8/10 apply?

Financial institutions or operators, telephone network providers, other telecom providers, other related service providers, and social media providers share responsibility for damage caused by technology crime unless they prove they complied with the standards or measures set by the Bank of Thailand, the SEC Office, the NBTC, the NBTC Office, or the Electronic Transactions Commission, as the case may be. The text sets this starting position and lets the provider rebut it by proving compliance.

### How does Section 11/2 relate to personal data protection?

Section 11/2 paragraphs 1 and 2 impose up to 1 year in prison, a fine of up to 100,000 THB, or both for using, collecting, possessing, or disclosing identifiable data about a living or deceased person to commit a criminal offense. Paragraph 3 raises the penalty to up to 5 years, 500,000 THB, or both when done by buying, selling, exchanging, or other unlawful profiteering. It covers data of deceased persons, which the definition of personal data in Section 6 of the PDPA excludes.

## Related Compliance Frameworks and Security Standards

- [
                Bank of Thailand pentest rules for financial institutions
                
              ](/en/compliance/bank-of-thailand/)
- [
                Thai SEC penetration testing requirements
                
              ](/en/compliance/sec/)
- [
                Does Thailand's PDPA require penetration testing?
                
              ](/en/compliance/pdpa/)
- [
                Thailand Digital ID: ETDA, DGA, IAL/AAL, and DPS Security
                
              ](/en/compliance/thailand-digital-id/)

Open full-size image to zoom

## Official source documents

Emergency Decree on Measures for the Prevention and Suppression of Technology Crimes (No. 2) B.E. 2568 (2025)

[Go to the official source ](https://ratchakitcha.soc.go.th/documents/67320.pdf)

- [Emergency Decree on Measures for the Prevention and Suppression of Technology Crimes B.E. 2566 (2023)](https://ratchakitcha.soc.go.th/documents/140A018N0000000000100.pdf)
- [Emergency Decree on Digital Asset Businesses (No. 2) B.E. 2568 (2025)](https://ratchakitcha.soc.go.th/documents/67321.pdf)

## Need a pentest that satisfies these requirements?

Tell us about your systems and the requirements you must meet. The STH team will assess the approach and prepare a quotation.

[Request a Pentest quote](/en/#contact)

Last updated 1 November 2026