Thailand SEC Proposes Five-Year Data Retention for Crypto Transfers

Under the draft notification, licensed operators must implement robust risk management systems capable of identifying suspicious financial activity. The requirements extend beyond standard platform-to-platform transfers to include interactions with self-hosted wallets, where firms must verify that the customer holds legitimate control over the external address. For the first two years of the mandatory retention period, operators must ensure all transaction data remains immediately accessible for regulatory inspection.

The initiative follows extensive coordination between the SEC and Thailand’s Anti-Money Laundering Office. By enforcing mandatory information sharing—including details on transferors, transferees, and intermediary service providers—authorities aim to trace the financial routes of digital assets more effectively. This move aligns Thailand with international standards set by the Financial Action Task Force, mirroring similar regulatory tightenings observed recently in South Korea and Taiwan.

Regulators have sought public and industry feedback on the framework, which builds upon a prior consultation held in early 2026. This push for transparency coincides with broader efforts to clean up the domestic digital asset sector, including ongoing investigations into stablecoin flows and past reporting irregularities at major local exchanges. The SEC maintains that these controls are essential to prevent the misuse of crypto services without imposing disproportionate burdens on compliant businesses.