The Securities and Exchange Commission (SEC) of Thailand published Notification No. Sor Thor. 9/2026 on August 25, 2026, establishing Travel Rule obligations for virtual asset service providers (VASPs) operating under Thai licenses. Operators have until February 27, 2027 to comply. The rule was developed in coordination with the Anti-Money Laundering Office (AMLO) and formalizes requirements that underwent two rounds of public consultation: a first round in March and April 2026 covering governing principles, and a second in June and July 2026 on the draft notification itself. Stakeholder feedback was described as broadly supportive at both stages, a reception that helps explain why the notification advanced on its current timeline.

The Travel Rule originates from Recommendation 16 of the Financial Action Task Force (FATF), a global standard-setting body for combating financial crime. The rule historically applied to bank wire transfers and requires that identifying information about the sender and recipient travel alongside any funds transfer. FATF extended this requirement to crypto platforms in 2019. Thailand first classified digital assets under the 2018 Digital Asset Business Decree, and the new notification brings its licensed operators into formal alignment with that framework as an interim measure while broader regulations are finalized.

Under the notification, operators must fulfill four core duties. First, they must build internal risk-management policies specific to digital asset transfers. Second, they must collect information on counterparties, conduct due diligence, and verify that customers actually own or control any self-hosted wallets involved in a transfer. Third, they must include originator and beneficiary data in all transfer instructions sent to other platforms. Fourth, they must retain transaction records for at least five years in a format that regulators can access immediately for the first two years of that window.

SEC Secretary-General Pornanong Budsaratragoon described the measures as targeting money laundering and technology-related crime while reinforcing operator accountability. "The measures aim to enhance detection of money laundering and technology-related crime, reinforce firms' responsibility for customer transactions, and align with FATF standards while strengthening confidence in Thailand's digital asset ecosystem," she said.

The self-hosted wallet requirement deserves particular attention. When a user sends crypto to a personal hardware wallet or a non-custodial address like a MetaMask account, there is no receiving VASP on the other end to exchange data with. Thailand's rule requires operators to verify that the customer owns or controls the destination wallet before processing the transfer, but stops short of specifying how that verification must be done. Different countries have taken harder stances: Singapore and Germany require proof of ownership; Switzerland requires both identity verification and ownership proof; the European Union and the United Kingdom require collecting wallet owner information. Thailand's flexibility on method may reduce friction for smaller operators but could also produce inconsistent user experiences across platforms. In practice, verification methods available to operators may range from cryptographic message-signing proofs to manual declarations by the customer, meaning users are likely to encounter diverse approaches depending on which platform they use.

Bitkub, Thailand's largest exchange by volume with roughly $38.9 million in 24-hour trading volume according to CoinGecko, had not issued a public statement on its compliance approach at the time of publication. Bitazza, the second major licensed broker in the country, has already partnered with identity verification firm Sumsub to achieve Travel Rule readiness ahead of the deadline. Tanawat Sutuntivorakoon, CEO of Bitazza Thailand, cited the partnership as a demonstration of the company's commitment to operating within a transparent and compliant regulatory environment. Nares Laopannarai, President of the Thai Digital Asset Association, said the implementation "strengthens industry standards while building confidence among users, investors, and financial institutions domestically and internationally."

The rule matters beyond Thailand's borders. Thailand ranks 16th globally on Chainalysis's 2024 Global Crypto Adoption Index, with an estimated 8.43 million crypto users representing roughly 11.8 percent of the population. More than 20 percent of Thai adults hold digital assets, above the global average of around 15 percent. Thailand's regulated crypto market was valued at approximately USD 0.58 billion in 2025 and is projected to reach USD 3.18 billion by 2034, a compound annual growth rate of 20.8 percent. Cross-border transfers from Thai operators to platforms in jurisdictions that have not adopted the Travel Rule could create friction. Vietnam, which remains on the FATF grey list, and Myanmar, which is on the FATF blacklist, are notable examples in the immediate region. This gap is a known problem in Travel Rule implementation globally and is sometimes called the "sunrise issue": data must be sent even when the receiving side cannot reciprocate.

Regionally, Thailand now joins Singapore as one of the few Southeast Asian markets with a formal, FATF-aligned Travel Rule framework in place. Singapore's approach is stricter on technical specifics, including rules around privacy-enhancing technologies. The Philippines takes a different path, focusing on a shared liability framework aimed at crypto scams rather than AML compliance broadly. Thailand, Singapore, and Malaysia are all targeting 2028 for adoption of the OECD's Crypto Asset Reporting Framework (CARF), which governs cross-border tax information sharing. Penny Chai, Vice President for Asia-Pacific at Sumsub, observed that "Thailand's move to implement the Travel Rule reflects a broader shift across Southeast Asia toward regulated, interoperable digital asset markets."

The SEC notification is explicitly described as an interim measure. Formal AMLO regulations under the Anti-Money Laundering Act are still pending, and those rules are expected to govern the area more comprehensively once finalized. Decentralized finance protocols and peer-to-peer platforms are not directly named in the current notification, leaving non-custodial activity in a grey zone that the forthcoming AMLO rules may address. Operators have approximately six months to build or procure the necessary systems. For platforms that have not yet started, that window is short.