Thailand Orders Self-Hosted Wallet Checks Under Crypto Travel Rule

Thailand Travel Rule Starts Feb. 27

The implementation date gives operators almost six months to build or adapt systems for exchanging information, assessing counterparties and monitoring transfers. The SEC said the runway is intended to support preparation for transmitting, receiving and reviewing the required data.

The announcement describes four central duties. Operators need written policies and procedures for transfer risk, customer and counterparty information, due diligence on counterparties and any intermediary operator, and checks that the other service provider is qualified.

For platform-to-platform transfers, the ordering operator must transmit originator and beneficiary information with the transfer order to the beneficiary operator. The public summary does not list each required field, a technical messaging standard or how operators should handle a receiving platform that cannot accept the data.

The framework follows the international model maintained by the Financial Action Task Force. FATF describes the Travel Rule as a requirement for virtual-asset service providers to securely obtain, hold and transmit originator and beneficiary information, alongside customer due diligence, record keeping and suspicious-transaction reporting.

Thailand’s announcement says its measures align with FATF standards, but it is a national rule with its own effective date and supervisory process. The SEC named Notification No. Sor Thor. 9/2026, dated Aug. 25, as the related legal instrument.

Self-Hosted Wallet Checks Are Not a Ban

The most visible requirement covers transfers between a regulated operator and a self-hosted wallet. In those cases, the operator must verify ownership of or control over the wallet, according to the SEC.

The announcement does not prescribe one verification method. It does not say whether operators should use a signed message, a small test transaction, blockchain analytics, a wallet connection or additional documents, leaving a major implementation question for platforms and customers before February.

It also does not say that customers must surrender wallet credentials. Control can be demonstrated without sharing a private key, and the SEC’s public summary contains no instruction to collect seed phrases. Users should treat any request for a recovery phrase as a security warning rather than a normal compliance step.

The rule’s scope is also narrower than a direct obligation on every wallet owner. The stated duties attach to licensed digital-asset business operators when they transfer or receive assets for customers. A purely peer-to-peer transfer that does not use a covered operator is not described as creating a direct filing duty for the individuals involved.

That distinction differs from the boundary in the proposed U.S. stablecoin customer-identification rule, which treats many secondary transfers as outside the issuer’s direct customer relationship. Thailand is addressing the regulated transfer intermediary and explicitly adds checks when that intermediary connects to a self-hosted wallet.

Exchanges Get a Five-Year Record Duty

Thai operators must retain the information accompanying every digital-asset transaction for at least five years and keep it in a form that the supervisory authority can promptly retrieve or inspect. The SEC’s summary provides no value threshold for that retention duty.

The record requirement may make transaction screening more consistent across local operators, while also increasing the amount of identity and transfer data they store. The announcement does not specify encryption, breach-notification or deletion controls beyond the minimum retention period, so platform-level privacy and security practices remain important implementation details.

SEC Secretary-General Pornanong Budsaratragoon said the rule is intended to reduce the risk that licensed operators are used for money laundering, terrorist financing and technology-related crime. She also linked the standards to greater confidence in Thailand’s digital-asset market and better connectivity with international markets.

Crypto sentiment was positive but cooler as the policy was released. Alternative.me’s Fear and Greed Index read 63, classified as greed, on Sept. 2, down from 69 the previous day and up from 28 one month earlier.

The next details to watch are operator guidance on wallet-control verification, the exact data fields and messaging standards, treatment of failed or incomplete checks, and AMLO’s related regulations. Daily Crypto Briefs’ 2026 crypto policy guide tracks how regulators are shifting from broad anti-money-laundering goals toward operational rules for exchanges, issuers and wallet-connected services.

Until those implementation materials appear, the confirmed change is clear: Thai crypto businesses have a Feb. 27 deadline to add counterparty checks, self-hosted-wallet verification, transfer-data transmission and five-year records to their regulated workflows.