Thailand: Implemented Royal Decree on the Supervision of Regulated Digital Identification Authentication and Verification Service Businesses

On 21 June 2023, the Royal Decree on the Supervision of Regulated Digital Identification Authentication and Verification Service Operators entered into force. The Royal Decree establishes regulations for businesses involved in digital identification and authentication in Thailand, requiring these businesses to obtain a license for operations such as identity proofing, authenticator lifecycle management, and authentication services. Furthermore, the decree outlines requirements for license applications, including risk management, data protection, and security plans, and specifies that only juristic persons like limited or public limited companies can operate these services. Certain services, such as those supporting electronic signatures or used solely for internal purposes, are exempt from licensing. The Electronic Transactions Development Agency is responsible for supervising compliance and has the authority to issue orders, suspend, or revoke licenses if businesses do not meet regulatory standards. Licensees must report changes in management, technology, or other key business aspects and inform the Agency at least 60 days prior to ceasing operations.