Thailand's Securities and Exchange Commission issued formal Travel Rule regulations for digital asset operators on September 2, requiring crypto businesses to collect, transmit, and retain information about the parties involved in every digital asset transfer. The rules take effect February 27, 2027, giving operators approximately six months to build compliant systems for information transmission, receipt, and transaction monitoring.
SEC Secretary-General Pornanong Budsaratragoon said the regulations would "enhance the capability to combat technology-related crimes and reduce the risk of DA operators being used for money laundering and terrorist financing." She added that the requirements "reinforce digital asset business operators' responsibilities in overseeing their customer transactions in accordance with applicable regulations and guidelines" and would strengthen Thailand's AML framework "in line with international standards (FATF), thereby enhancing confidence in Thailand's digital asset ecosystem and supporting greater connectivity with international markets over the long term."
The rules went through two public consultation rounds before reaching final form. Thailand's SEC published proposed principles in March and April 2026, followed by a draft notification in June and July. The regulator said most stakeholders supported both the principles and the draft text.
What the Travel Rule requires of Thai crypto operators
The regulations cover four core obligations. Digital asset operators must establish written policies and procedures for managing risks related to transfers and receipts. They must collect information on both their own customers and counterparties to each transaction, conduct due diligence on counterparty virtual asset service providers, and verify the qualifications of any intermediary operator involved in routing a transfer.
The third obligation is the transmission requirement that gives the Travel Rule its name. An ordering operator must send originator and beneficiary information together with the transfer order to the receiving operator, creating a chain of identity data that accompanies the transaction rather than sitting only with the originating platform.
The Financial Action Task Force published its original guidance on the Travel Rule for virtual assets in June 2019 as an update to Recommendation 16, which had long applied the same information-transmission requirement to wire transfers between banks. The crypto application of Recommendation 16 requires that VASPs transmit originator name, account number or wallet address, physical address or national identity number, and beneficiary name and account number alongside transfers above a threshold that jurisdictions set individually. FATF estimated that 83% of surveyed jurisdictions had enacted Travel Rule legislation by 2026, up substantially from the early years after the 2019 guidance when adoption was slow and inconsistent.
Self-hosted wallets and why they are the harder compliance problem
The regulations specifically address self-hosted wallets, also called non-custodial or self-custodial wallets. When a customer transfers digital assets to or from a wallet they control directly rather than one held by a licensed operator, the receiving or sending platform must verify ownership or control of that wallet.
Self-hosted wallet verification is the most technically contested part of Travel Rule implementation globally. Two main approaches exist in practice. The first requires customers to sign a specific message with the private key of the claimed wallet, which cryptographically proves control without revealing the key itself. The second uses on-chain analysis to confirm prior transaction patterns connecting the claimed wallet to the customer's known exchange wallet. Neither approach is fully standardized, and different jurisdictions have reached different conclusions about which methods satisfy their regulatory requirements. The EU's Transfer of Funds Regulation, which extended Travel Rule obligations to crypto in 2023, takes a stricter approach than some other jurisdictions by requiring operators to verify self-hosted wallet ownership before processing transfers above 1,000 euros.
Thailand's regulations do not specify a minimum threshold, requiring verification for transfers to and from self-hosted wallets regardless of size. Records of every transaction must be retained for at least five years in a format that allows supervisory authorities to retrieve or examine them promptly.
How Thailand fits into a wider regional regulatory shift
The Travel Rule announcement is one part of a broader regulatory expansion the Thai SEC has pursued in 2026. Earlier in the same week as the Travel Rule release, the regulator proposed allowing intermediaries to offer retail investors access to certain crypto derivatives traded on regulated overseas exchanges. Days before that, the SEC advanced draft rules for spot Bitcoin and Ether ETFs, and separately sought feedback on requirements for foreign digital asset custodians used by funds that invest in crypto.
Singapore's MAS was among the earliest regulators in Southeast Asia to implement Travel Rule requirements, introducing its rules under the Payment Services Act with a compliance deadline of April 2023. Hong Kong's SFC followed with its own VASP licensing regime that incorporates Travel Rule obligations as a condition of authorization. The regional pattern has been that Singapore sets a benchmark, Hong Kong implements a parallel framework, and other Southeast Asian regulators follow at varying speeds. Thailand's February 2027 deadline puts it broadly in line with jurisdictions that moved after the initial wave of 2022 to 2023 implementation but ahead of several others in the region that have not yet issued final rules.
The SEC coordinated the Travel Rule framework with the Anti-Money Laundering Office, or AMLO, issuing the regulations on an interim basis while AMLO prepares its own rules under the Anti-Money Laundering Act. The Subcommittee on Financial Data Connectivity for Enhancing the Monitoring of Suspicious Financial Transactions directed the joint approach, which ensures alignment between the securities regulator and the dedicated AML authority during the transition period.
Non-Thai VASPs serving as counterparty operators in transfers involving Thai-licensed platforms also fall within the framework's scope where those platforms must verify the counterparty VASP's qualifications before processing the transfer.
Tanya Petrusenko
Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.
