Thailand Sets Deadline for Strict Travel Rule Implementation

Developed in coordination with Thailand’s Anti-Money Laundering Office (AMLO), the SEC's framework aligns the nation with the Financial Action Task Force’s Recommendation 16: the crypto Travel Rule. The finalized notification outlines several significant elements for operators:

• Five-Year Record Retention: Digital asset businesses must retain detailed transaction records for at least five years. Crucially, during the first two years, this data must be kept in a format that supervisory authorities can retrieve and inspect immediately.
• Anti-Smurfing Measures: In a move that more and more jurisdictions are beginning to adopt, all transfers will require at least some level of identification regardless of size, which avoids the ‘smurfing’ issue where bad actors break up larger payments into multiple smaller ones to evade detection. 
• 30,000 THB Threshold: While all basic transfers require standard recipient identification, transactions valued at 30,000 baht (approximately $900) or above will trigger enhanced data collection. Senders will need to provide the recipient's province or city and country; if the recipient is a legal entity, a registration number must also be provided.
• VASP Due Diligence: Operators are now required to examine the counterparty VASPs and intermediaries involved in the transfer route, ensuring they meet equivalent AML standards.

The most contested and consequential element of Thailand’s new regime is the crackdown on self-hosted (or unhosted) wallets, where users hold their own private keys. When digital assets arrive at or leave a regulated platform for a self-hosted wallet, Thailand’s SEC will require the operator to verify that the customer actually owns or has the authority to control that specific wallet address. This requirement effectively closes the oversight gap that previously allowed peer-to-peer transfers to operate in the shadows. However, this move introduces a level of friction. Unlike exchange-hosted wallets, private wallets inherently lack Know Your Customer (KYC) data. The practical challenge for Thai exchanges will be building robust proof-of-control verification processes that can withstand strict regulatory scrutiny, especially for transactions exceeding the 30,000 baht threshold.

Thailand’s approach mirrors the aggressive posture seen in neighboring jurisdictions like South Korea, which is also expanding its own Travel Rule protocols. Accumulating detailed transfer and counterparty records for half a decade will carry significant data privacy implications, but regulators have framed this as a necessary trade-off for tracing financial routes and intercepting technology-related crimes.

Operators will soon have to deal with a vast archive of user and counterparty data in a highly sensitive, regulated material, marrying strict AML checks with the data minimization and security demands of Thailand's Personal Data Protection Act (PDPA).

With the February 2027 deadline looming, operators have a relatively short window to build or integrate compliant data-sharing systems, and many may be concerned with the consequences of failing to meet the deadline or adopting sub-standard procedures. Fortunately, Blockpass provides a secure, user-centric identity verification system designed to handle complex Travel Rule demands seamlessly. With a range of solutions, VASPs can automate Customer Due Diligence (CDD) and instantly adapt to the changing needs of not only Thailand’s jurisdiction, but any other around the world. Blockpass allows businesses to verify identities and ownership without the risk and hassle that companies would face trying to adapt to the situation by themselves.

With zero setup costs, Blockpass keeps business in compliance with the latest global requirements and safe from bad actors, while ensuring legitimate users face minimal friction and facilitating a smooth experience for all.