How to Get an SEC Digital Asset Business Licence in Thailand Exchange, Broker & Dealer

By Jonathon Richards

– posted 2 hours ago

Securing an SEC digital asset licence in Thailand is the essential gateway for any business that wants to operate a cryptocurrency exchange, brokerage or dealing desk in the Kingdom. Thailand’s Securities and Exchange Commission (SEC) administers one of Southeast Asia’s most structured licensing regimes and since 2024, the regulator and its partner agencies have materially raised the bar for applicants in areas ranging from custody architecture and Travel-Rule compliance to capital adequacy and governance. This guide maps the entire journey: eligibility, capital requirements, AML and custody expectations, step-by-step application procedures, realistic timelines and costs, and common reasons applications are delayed or refused.

Who this guide is for

This page is designed for founders planning a Thai-licensed exchange or trading venue, existing operators seeking a broker or dealer licence, compliance officers benchmarking their programmes against SEC expectations, and in-house counsel advising on market-entry strategy. Whether you are a Thai-incorporated incumbent or a foreign-sponsored applicant exploring the Thai market, the checklist-driven approach below is intended to reduce uncertainty and accelerate your readiness.

Legal Framework: Emergency Decree, Ministry of Finance & SEC Oversight

Thailand’s digital asset regulatory architecture rests on the Emergency Decree on Digital Asset Businesses B.E. 2561 (2018), enacted by Royal Decree and subsequently amended to keep pace with market evolution. The Decree grants the Ministry of Finance overall supervisory authority while delegating day-to-day licensing, rulemaking and enforcement to the SEC. Crucially, the Decree defines “digital asset business operators” and establishes that no person may operate an exchange, broker or dealer business in digital assets without a licence approved by the SEC and the Minister of Finance.

Amendments enacted through 2025 and into 2026 have expanded the scope of regulated activities, tightened prudential expectations and introduced clearer cross-border reach provisions meaning that foreign platforms soliciting Thai customers may also fall within the regulatory perimeter.

Who regulates what SEC vs AMLO vs Bank of Thailand

Thailand employs a multi-agency model. The SEC handles licensing, market conduct, disclosure and ongoing supervision of digital asset business operators. The Anti-Money Laundering Office (AMLO) oversees AML/CFT compliance, suspicious transaction reporting and inter-agency coordination. The Bank of Thailand (BOT) governs payment systems, foreign-exchange controls and the interface between digital assets and the traditional banking sector. Since 2024, joint statements by the SEC and AMLO have reinforced transaction-tracing and Travel-Rule expectations, signalling closer inter-agency cooperation that applicants must factor into their compliance architecture.

Recent 2024–2026 updates impacting applicants

Several developments between 2024 and 2026 have reshaped the licensing landscape. The SEC issued updated guidance on wallet and key management, requiring applicants to demonstrate mature custody controls including hardware security module (HSM) deployment, cold-hot wallet segregation and documented key-rotation policies. Multi-agency AML coordination now demands Travel-Rule readiness at the point of application, not merely as a post-licence enhancement. Capital adequacy expectations have also been clarified through SEC notifications that set out solvency testing, reserve segregation and financial reporting obligations in greater detail. Industry observers expect these trends to continue tightening through 2026 and beyond.

Licence Types: Exchange, Broker, Dealer

The SEC classifies digital asset business operators into several categories. The three core licence types relevant to trading and intermediation are the exchange, broker and dealer licences. Additional categories custodial wallet provider, digital asset advisor and digital asset fund manager exist but fall outside the primary scope of this guide.

Quick decision table: which licence fits which business model

Licence Type	Core Activity	Typical Business Model
Exchange	Operating a matching engine / trading venue where buyers and sellers trade digital assets	Centralised exchange, order-book platform
Broker	Acting as agent to facilitate or execute trades on behalf of clients	Brokerage app, agency desk, robo-advisory with execution
Dealer	Buying and selling digital assets on own account / as principal	OTC desk, market maker, proprietary trading platform

An applicant’s business model determines which Thai SEC digital asset licence (or combination) it must obtain. Some operators may require more than one licence for example, an exchange that also provides brokerage services.

Who Can Apply Core Eligibility Checklist

Before preparing a full application, prospective applicants should confirm that they meet the threshold eligibility criteria established by SEC consolidated announcements and the Emergency Decree.

Thai-incorporated entity: The applicant must be a company incorporated in Thailand either a private limited company or a public company limited. No offshore entity may hold the licence directly.
Local director and responsible persons: At least one director and key responsible persons must meet residency and identification requirements set by the SEC, ensuring local accountability.
Shareholding structure: Restrictions apply to mixing certain licence types within the same corporate group. Nominee shareholding arrangements are flagged and may trigger enhanced scrutiny or disqualification.
Minimum capital and financial standing: Applicants must demonstrate paid-up capital at or above the required threshold (see Capital section below) and present audited financial history where available.
Fit-and-proper criteria: Directors, executives and significant shareholders must have clean compliance backgrounds no disqualifying criminal convictions, regulatory sanctions or bankruptcy records.

Foreign operator note: Where a non-Thai parent company or foreign shareholders are involved, additional documentation is required. This typically includes enhanced background disclosures and regulator comfort letters from home-country supervisors.

Capital, Prudential and Solvency Expectations for Exchanges, Brokers & Dealers

Capital adequacy is a cornerstone of the Thai SEC digital asset licence framework. The SEC expects applicants not only to meet minimum paid-up capital thresholds but to demonstrate ongoing solvency, liquidity projections and reserve adequacy throughout the life of the licence.

Minimum capital and paid-up capital bands

Specific minimum capital requirements differ by licence type. SEC notifications set out the applicable thresholds. Exchange operators face the highest capital bands, reflecting the systemic importance and custody responsibilities inherent in operating a trading venue. Brokers and dealers typically face lower but still material capital requirements. In all cases, the SEC reviews audited financial statements, capital injection plans and forward-looking liquidity projections as part of the substantive assessment. Applicants without three years of audited financial history must present alternative evidence of financial robustness, such as parent-company guarantees or escrow arrangements where permissible.

Financial reporting, internal control and reserve segregation

Licensed operators must maintain strict segregation between client funds and proprietary (house) funds. The SEC mandates periodic financial reporting including balance-sheet filings and solvency ratio calculations and may require operators to hold reserves in specified instruments. Insurance or backstop arrangements for client-asset protection are increasingly expected, particularly for exchange licensees that hold significant custody balances. Applicants should prepare internal-control frameworks that demonstrate segregation, reconciliation procedures and escalation protocols before submission.

Prudential governance

Board composition matters. The SEC expects an independent risk officer, an internal audit function and a board that includes independent directors with relevant financial-services or technology experience. Compliance officer appointments must be disclosed at application stage. The practical effect is that applicants with thin governance structures for example, single-director start-ups will need to recruit or appoint additional qualified personnel before the SEC will proceed with substantive review.

AML/KYC & Transaction Monitoring Requirements (AMLO Coordination)

Customer due diligence standard and enhanced

All digital asset business operators must implement a risk-based customer due diligence (CDD) programme aligned with AMLO requirements. Standard CDD applies to all customers at onboarding. Enhanced due diligence (EDD) is mandatory for high-risk categories: politically exposed persons, customers from high-risk jurisdictions, unusually large or complex transactions, and accounts with opaque beneficial-ownership structures. Continuous transaction monitoring and automated alert systems must be in place, and suspicious transaction reports (STRs) must be filed with AMLO within prescribed timeframes.

Travel Rule and transaction data standards

Since 2024, the SEC and AMLO have jointly reinforced expectations that licensed operators must comply with the Travel Rule attaching ordering and beneficiary information to digital asset transfers above prescribed thresholds. Applicants must demonstrate, at the point of licence application, that their technology stack can support Travel-Rule data transmission, receipt and storage. This typically requires integration with a Travel-Rule compliance vendor or development of an in-house protocol compatible with industry messaging standards.

Custody & Wallet Management (Technical & Governance Expectations)

On-chain custody vs omnibus custodial arrangements

The SEC draws a clear line between self-custody models and omnibus custodial structures. Regardless of model, licensees must implement robust key-management standards. Hardware security modules (HSMs) are effectively a baseline requirement for key storage. Cold-wallet and hot-wallet segregation must be documented, with clearly defined policies on maximum hot-wallet exposure, replenishment triggers and signing authority. Multi-signature or threshold-signature schemes are strongly preferred for high-value custody.

SEC wallet and key management guidance

Under recent SEC guidance, applicants must submit architecture diagrams showing how digital assets are stored, transferred and recovered. Key-rotation schedules, disaster-recovery procedures, signing-policy documents and evidence of penetration testing are reviewed during the substantive assessment phase. Applicants that outsource custody to third-party providers must demonstrate due diligence on the provider’s controls and include the arrangement in their risk-management framework.

Documentation Checklist

The following evidence package forms the backbone of a Thailand crypto licence application. Applicants should treat this as a minimum the SEC may request additional materials during review.

Corporate documents: Certificate of incorporation, memorandum and articles of association, shareholder register, organisational chart and corporate group structure diagram.
Financial evidence: Audited accounts (three years if available), proof of paid-up capital, bank reference letters and capital-injection plans.
Governance and compliance: Board member CVs and fit-and-proper declarations, compliance manual, internal policies covering AML/CFT, conflicts of interest, market conduct and complaints handling.
Technology and security: System architecture diagrams, penetration-test summary reports, custody and key-management diagrams, disaster-recovery and business-continuity plans, and SOC 2 or ISO 27001 certificates where available.
Operations and market: Business plan with financial projections, liquidity-provisioning arrangements, AML system screenshots, sample regulatory reporting templates and staffing plans.

Evidence quality what the SEC checks first

Completeness is the single most common gating factor. The SEC’s initial completeness review rejects submissions that are missing mandatory documents, contain untranslated foreign-language materials without certified Thai or English translations, or lack apostilles on overseas documents. Applicants should folder and index every document according to the SEC’s prescribed structure and include a cover schedule cross-referencing each requirement to the supporting evidence.

How to Apply 9 Practical Steps

Pre-check and eligibility confirmation Conduct an internal gap analysis against the eligibility checklist. Identify shortfalls in capital, governance, technology or documentation. Estimated time: 1–2 weeks.
Company formation and board appointments If the applicant entity does not yet exist, incorporate a Thai limited company and appoint qualifying directors and a compliance officer. This step can run in parallel with documentation preparation. Estimated time: 2–6 weeks.
Prepare documentation Compile corporate, financial, governance, technology and operational evidence per the checklist above. Engage auditors, penetration-test providers and AML-system vendors as needed. Estimated time: 4–8 weeks.
Pre-application consultation with the SEC While optional, a preliminary meeting with the SEC is strongly recommended to clarify expectations, identify potential issues and confirm the applicable submission window. Scheduling varies.
Submit application File via the SEC’s licensing system during an open submission window. The SEC conducts an initial completeness check within approximately 5–10 business days.
SEC substantive review The regulator reviews the application in depth, issues requests for clarification, may conduct technical tests or virtual/on-site inspections, and assesses governance and compliance readiness. Typical timeline: 2–4 months, depending on complexity.
Conditional approval and licensing conditions The SEC may issue conditional approval subject to remedial actions (e.g., capital top-up, additional policy revisions, technology enhancements).
Final approval and licence issuance Once conditions are met and fees paid, the licence is formally issued by the SEC with the concurrence of the Minister of Finance.
Post-licence onboarding The operator enters the supervisory regime: periodic reporting, regulator inspections and live technical certification before commencing operations.

Approximate total timeline: 3–9 months. Well-prepared Thai incumbents with complete documentation tend toward the lower bound; complex, foreign-sponsored applications typically require 6–9 months or longer.

Typical Costs & Timeline Estimate

The SEC’s own licensing fees are typically modest relative to the total cost of achieving and maintaining compliance. The material expenditures lie in capital provisioning, technology build-out, legal and compliance preparation and ongoing operational costs. The following table presents indicative market ranges:

Cost Category	Indicative Range (USD)
Incorporation & company formation	$2,000 – $10,000
Legal & compliance documentation	$10,000 – $75,000
AML/KYC tooling & transaction monitoring	$20,000 – $150,000
Security & custody build (or certified provider)	$50,000 – $300,000
Ongoing annual costs (auditor, reporting, compliance salaries)	$80,000 – $250,000+

These figures are indicative and market-dependent. Actual costs vary with the scope of the licence sought, the applicant’s existing infrastructure and whether custody is built in-house or outsourced. SEC application fees themselves are a fraction of these sums applicants should budget for the full compliance ecosystem, not just the regulatory filing.

Quick Comparison Exchange vs Broker vs Dealer

Criterion	Exchange	Broker	Dealer
Core function	Operates trading venue / matching engine	Executes trades as agent for clients	Trades on own account as principal
Custody responsibility	Typically holds client assets in custody	May hold client assets temporarily or route to exchange	Holds own-book positions; may not custody client assets
Client-money segregation	Mandatory strict segregation required	Mandatory where client funds are held	Focus on proprietary capital management
Minimum capital band	Highest	Moderate	Moderate to high (risk-weighted)
Primary prudential / AML focus	System integrity, custody, market surveillance, AML	Best execution, client suitability, AML	Position limits, counterparty risk, AML
Typical applicant	Centralised exchange platform	Brokerage app, trading intermediary	OTC desk, market maker

Thailand vs common ASEAN/offshore approaches: Thailand stands out for its strong multi-agency AML coordination (SEC + AMLO + BOT), strict wallet and key-management expectations, and mandatory Travel-Rule readiness at the application stage. Compared to some offshore jurisdictions that offer faster, lighter-touch licensing, the Thai regime demands more upfront investment but provides a higher degree of regulatory credibility and market access within the ASEAN region.

Top 8 Reasons Applications Are Delayed or Refused With Remediation Steps

Incomplete documentation or poor translations: Missing documents or untranslated materials trigger immediate rejection at the completeness-check stage. Remediation: Engage certified translators, prepare an indexed evidence folder, and cross-reference every SEC requirement to a specific document.
Weak custody and key-management controls: Vague or undocumented custody arrangements are a frequent deficiency. Remediation: Produce detailed architecture diagrams, HSM specifications, cold-wallet SOPs, multi-signature policies and a third-party security audit report.
Insufficient capital or unrealistic financial projections: Applicants that present thin capitalisation or optimistic-to-the-point-of-implausible revenue forecasts face delays. Remediation: Prepare a capital-injection plan, secure escrow arrangements or parent-company guarantees where permissible, and commission an independent financial review.
AML gaps and missing Travel-Rule readiness: The SEC now expects Travel-Rule capability at application, not merely a roadmap. Remediation: Integrate a Travel-Rule compliance vendor, produce pilot-test evidence and document the end-to-end data flow for ordering and beneficiary information.
Unsuitable shareholder structure or undisclosed nominees: Nominee shareholding arrangements or opaque beneficial-ownership chains trigger enhanced scrutiny. Remediation: File clean shareholder declarations, conduct enhanced background checks on all significant shareholders and disclose the full corporate group chart.
Weak governance or inexperienced board: Boards lacking financial-services or technology experience signal risk to the regulator. Remediation: Recruit experienced independent directors, appoint a qualified compliance officer and submit detailed CVs with verifiable track records.
Inadequate technology and security evidence: Failure to produce penetration-test reports, disaster-recovery plans or SOC/ISO certifications. Remediation: Commission a penetration test from a reputable firm, document DR/BCP procedures and obtain at least one recognised security certification.
Non-compliance with ongoing reporting or pre-conditions: Some applicants receive conditional approval but fail to satisfy conditions within the prescribed period. Remediation: Assign a dedicated project manager to track conditions, set internal deadlines ahead of SEC deadlines and maintain a live remediation register.

Next Steps

Obtaining an SEC digital asset licence in Thailand demands rigorous preparation across legal, financial, technical and governance dimensions. The licensing bar has risen significantly since 2024, and the likely practical effect is that only well-capitalised, compliance-mature applicants will progress efficiently through the SEC’s review process. Founders and operators who invest early in gap analysis, documentation quality and custody architecture will shorten their timelines and reduce the risk of costly delays or rejections. Download the “SEC Digital Asset Licence Thailand Application Checklist” (PDF) to benchmark your readiness against every requirement covered in this guide, and explore how GLE regional experts can support your application strategy.

Sources

FAQs

Is cryptocurrency legal in Thailand?

Yes. The SEC regulates digital asset businesses under the Emergency Decree on Digital Asset Businesses B.E. 2561 and its subsequent amendments. Trading and digital asset services are legal when operated under a valid licence. Unlicensed platforms soliciting Thai users may be blocked or subject to enforcement action.

What are the requirements for a Thailand digital asset exchange licence?

Applicants must be a Thai-incorporated company with adequate paid-up capital and solvency evidence, robust AML/KYC and transaction-monitoring systems, custody and key-management controls meeting SEC standards, a qualified and fit-and-proper board and senior management team, and complete technical and security documentation. Full details appear in the Key Requirements and Capital sections above.

How much does a crypto licence in Thailand cost?

The SEC’s own application fees are a relatively small component of total costs. Material expenditures include capital provisioning, technology and AML tooling, legal and compliance preparation, security infrastructure and ongoing operational costs. Indicative market ranges are set out in the Timelines & Costs section above. Actual costs depend on licence type and the applicant’s existing infrastructure.

Can foreigners operate crypto services in Thailand?

Foreign investors can participate in a Thai digital asset business, but the licensed entity must be incorporated in Thailand. Foreign shareholders and operators must meet enhanced disclosure requirements, fit-and-proper standards and additional documentation obligations. Nominee structures are flagged and may result in application refusal. See the Eligibility checklist above for details.

How long does the SEC digital asset licence application take in Thailand?

Typical end-to-end timelines range from approximately 3 months for simple, well-documented cases to 6–9 months (or longer) for complex or foreign-sponsored applications. The timeline depends heavily on the completeness of the initial submission, the applicant’s technical readiness and the volume of clarification requests from the SEC.

What is the Travel Rule and how does it affect Thai crypto licence applicants?

The Travel Rule requires licensed operators to attach ordering and beneficiary information to digital asset transfers above prescribed thresholds. The SEC and AMLO jointly enforce this obligation. Applicants must demonstrate Travel-Rule compliance capability — typically through vendor integration or an in-house protocol — at the time of licence application, not merely as a future enhancement.