Thailand has given its crypto industry a firm deadline: digital asset businesses must be ready to identify exactly who is sending and receiving digital assets, or risk falling out of compliance. Thailand’s Securities and Exchange Commission has finalized the country’s version of the crypto Travel Rule, a regulation that requires every digital asset business operator to collect, verify and transmit detailed information about both parties in a crypto transfer. The rules take effect on February 27, 2027, giving the industry about six months to prepare the systems needed for compliance.

Key takeaways

• Thailand’s SEC finalized a crypto Travel Rule that takes effect on February 27, 2027.
• Operators must verify ownership or control of self-custodial wallets before processing transfers to or from them.
• Originator and beneficiary details, including names and account numbers, must be collected for every crypto transfer.
• Transaction records must be kept for five years, with regulators granted immediate access during the first two years.
• The rule reflects a global trend: roughly 83% of jurisdictions surveyed by the Financial Action Task Force had already passed similar legislation as of 2026.

Thailand finalizes crypto Travel Rule effective February 2027

Starting in early 2027, no Thai digital asset operator will be able to move crypto for a customer without first identifying who is on the other side of that transfer. The Thailand crypto Travel Rule requires virtual asset service providers, or VASPs, to attach originator and beneficiary information to every transaction, effectively making crypto transfers behave more like traditional wire transfers from a compliance perspective.

That shift matters because the rule does not just add paperwork; it changes the operational baseline for platforms that handle digital asset transfers. Identity checks, wallet controls and recordkeeping now sit closer to the center of the transfer process, which raises the bar for both compliance systems and internal data management.

What prompted the new framework

According to the SEC, the regulations are designed to reduce the risk that digital asset operators could facilitate money laundering and the financing of terrorism. That places the rule squarely within Thailand’s broader anti-money laundering efforts rather than treating it as a standalone crypto policy.

From consultation to final rule

The final text was not rushed. The regulations were developed in partnership with Thailand’s Anti-Money Laundering Office after two rounds of public feedback: proposed principles were floated in March 2026, followed by a draft notification in June 2026. According to the SEC, most stakeholders supported the proposals. The final version was issued on September 1, 2026, starting the countdown to the February 2027 effective date.

What digital asset operators must do

Under the new framework, Thai crypto platforms now face two related obligations: confirming who controls a wallet and keeping detailed records of what moves through it. Both requirements add operational cost and technical complexity for operators that previously handled transfers with far less scrutiny.

Verifying self-custodial wallet ownership

The most contentious part of the rule applies to self-hosted wallets, where users control their own private keys rather than relying on an exchange or custodian. Under the new requirements, operators must confirm that the person sending or receiving a transfer has actual ownership of, or authority over, the relevant self-custodial wallet.

That is significantly harder than identity checks on a centralized platform, since self-custodial wallet verification does not include an intermediary that can confirm ownership. This requirement is likely to drive much of the industry’s compliance spending over the next six months.

Five-year data retention and regulator access

Beyond wallet checks, VASPs must collect originator and beneficiary details, including names, account numbers and other identifying data, for every digital asset transfer. That information must then be retained for at least five years and made available for regulatory review.

The rule also requires that the data be immediately accessible to regulators on demand during the first two years of that period, leaving little room for delayed reporting or manual retrieval processes. For operators, that means compliance is not limited to collection at the point of transfer; it also depends on whether they can securely store and retrieve information at scale over time.

Thailand joins a global compliance push

Thailand is not creating this framework in isolation. The Financial Action Task Force, an intergovernmental organization that sets global anti-money laundering standards, first introduced the crypto Travel Rule through its Recommendation 16. As of early 2026, roughly 83% of jurisdictions surveyed by FATF had already enacted some version of Travel Rule legislation, putting Thailand in line with a majority of regulated markets rather than ahead of the curve.

That wider adoption helps explain why similar rules are increasingly shaping how exchanges, custodians and other digital asset firms build their infrastructure. In practice, compliance is becoming a cross-border issue, since firms that operate across multiple markets often need systems that can handle overlapping identity and reporting requirements.

Bank of Thailand’s separate review of stablecoins

Separately, the Bank of Thailand has been reviewing stablecoin transactions, with particular attention to USDT. That parallel review suggests Thai regulators are not treating crypto oversight as a one-time exercise. While the Travel Rule addresses transfer-level identity data, the central bank’s scrutiny of stablecoins could lead to additional rules for specific asset types.

Industry readiness and the data security issue

Some Thai platforms are already adapting instead of waiting for the deadline. Bitazza, a domestic digital asset platform, has been integrating compliance tools from providers such as Sumsub to prepare its systems ahead of the February 2027 start date. That early move suggests larger, better-capitalized operators may be able to turn the transition period into an advantage, while smaller platforms could face higher costs in catching up.

A larger question remains around data security. Requiring operators to store detailed personal and financial information for five years creates a concentrated pool of sensitive data, and such pools are attractive targets for attackers. The rule explains what information must be retained and for how long, but it says far less about how that crypto transaction data retention obligation will be protected against breaches.

That gap matters because the framework’s success will not only be measured by whether operators comply on paper. It will also depend on whether users continue to trust Thai platforms with their identity and transaction history five years from now.

For an industry already adjusting to broader Thai digital asset regulation, including SEC proposals this year on retail access to overseas crypto derivatives and draft rules for spot Bitcoin and Ether ETFs, the Travel Rule adds another compliance layer to manage. Whether the six-month runway proves sufficient may depend less on the rule itself than on how quickly operators can turn wallet verification and secure long-term storage into routine infrastructure rather than a last-minute scramble.