Thailand: New Crypto Custody Regulations Take Effect

The regulations provide clarity on the IT controls custody providers must have in place to mitigate cyber risks in their management of crypto wallets and keys. 

On Monday (16 January), new regulations for crypto custody providers from the Securities and Exchange Commission, Thailand (SEC) came into effect.

They require digital asset custodians – as termed by the SEC – to establish a wallet management system that ensures the efficient custody of digital assets and keys, and the safety of client assets.

Among other requirements, businesses providing such custody services need to have:

  • Risk management policy on the custody of wallets and keys, including communication and internal controls to ensure compliance;
  • Procedures for the design, development and management of wallets as well as the creation, maintenance and access of keys to ensure safety and security;
  • Contingency plan for events that may affect the management of wallets and keys; and
  • Regular audits of system security and digital forensic investigations of events impacting client assets.

These regulations have been a long time coming. In July last year, the SEC first introduced a licensing regime for digital asset custodians. This was followed up by the gazetting of rules for the operation of such businesses last September.

With the new regulations, the SEC has now provided specific guidance on the IT controls that Thai custody providers must have in place to mitigate related cyber risks in their management of crypto wallets and keys.

This development continues in the same vein of others that Thailand introduced last year to enhance investor protection in crypto. These include the proper management of client assets – both fiat and crypto – held in custody by businesses, the tightening of advertising rules, and the prohibition on crypto deposit taking and lending.

In many ways, Thailand has been very quick with crypto regulation as compared to other countries in the region. For example, it set out guidelines to regulate financial services involving baht-backed stablecoins in early 2021. This is a year ahead of Japan, Hong Kong and Singapore, which only started the consultation on or actual regulation of fiat-backed stablecoins in 2022.

Of course, this is not a matter of the fastest being the winner – remember the tortoise and hare? Supervision and enforcement are equally important in the implementation of any regulatory regime.

Nonetheless, Thailand’s swift and timely introduction of new regulations to govern its nascent crypto sector offers business clarity, sets regulatory expectations and helps it to stay abreast of the fast-evolving crypto sector.

For an overview of Thailand’s crypto regulations, see Elliptic’s country guide.

Tung Li Lim is Senior Policy Advisor for APAC at blockchain analytics firm Elliptic, and a former Deputy Director of the Monetary Authority of Singapore (MAS)

To Top
Share via
Copy link
Powered by Social Snap