Overview of inbound M&A

When companies are considering inbound acquisitions in Thailand, the principal considerations investors need to be aware of are the restrictions on the business activities that can be undertaken by foreign entities.

The legislation relating to foreign investment and M&A transactions in Thailand is the Foreign Business Act 1999 (FBA). The operation of certain businesses in Thailand by foreign nationals is restricted by the FBA under the administration of the Ministry of Commerce (MOC). For the purpose of the FBA restrictions, a ‘foreigner’ is classified as a foreign individual, a company incorporated outside Thailand, or a company incorporated in Thailand that is 50 per cent or more owned by foreign individuals or foreign companies.

The FBA sets out three lists of business categories in which the participation of foreign nationals is either prohibited or restricted. Foreign nationals are prohibited from participating in the businesses specified in List 1, which includes antiques trading, broadcasting, farming and forestry. Foreign nationals are restricted from participating in businesses specified in List 2 unless they obtain a foreign business license (FBL) from the Thai Cabinet (which is practically impossible). List 2 includes activities related to national safety, agriculture, arts and culture, natural resources and the environment. Foreign nationals are also restricted from participating in the businesses specified in List 3 unless they obtain an FBL from the Director-General of the Department of Business Development, the MOC, which may be possible depending on the business. List 3 comprises a total of 21 categories of restricted businesses in which Thais are not yet ready to compete with foreigners, including accountancy, engineering, construction (with certain exceptions), retailing and wholesaling (with certain exceptions), advertising, hotel operation (excluding hotel management), tour guiding, sale of food and beverages, and the catch-all category ‘other services’. Certain service businesses are exempt from the FBA by virtue of Ministerial Regulations Nos. 1, 2 and 3 such as: commercial banking business and related businesses of commercial banks, bank representative offices, life and non-life insurance business (though banking and insurance legislation contains specific foreign ownership restrictions), securities business and other businesses under the law on securities, asset management company business and business where a government unit or state enterprise is a party.
Foreigners and foreign-controlled companies are also prohibited to own land in Thailand.

If a foreign entity has obtained an investment promotion certificate from the Thailand Board of Investment (BOI) (which usually comes with 5-8 years tax holidays and customs tax exemption etc.), or is eligible under a treaty to which Thailand is a party, such as the Treaty of Amity between the United States and Thailand, the ASEAN Framework Agreement on Services or the ASEAN Comprehensive Investment Agreement, an FBL is not required to be obtained but instead a foreign business certificate is required, which would usually be granted as a matter of course. An entity wishing to enjoy protection under a treaty must be incorporated in Thailand and have no less than 50% of its share capital held by US or ASEAN nationals or a company incorporated under the laws of a US state or ASEAN country. More than half of the directors of the juristic person and the authorised directors must also be US or ASEAN nationals.

Thai competition law

Thai competition law is governed by the Trade Competition Act B.E. 2560 (2017) (TCA), which came into force on 5 October 2017 and superseded the Trade Competition Act BE 2542 (1999). The TCA introduced a number of new measures, including the transformation of the Trade Competition Commission (TCC) into an agency independent of any government department and the imposing of harsher penalties for violations of the act. However, the TCA does not apply to certain industries that are governed by specific legislation on trade competition, i.e. telecommunications, broadcasting and television, insurance, energy and the financial sector.

Under the TCA, mergers which may result in a business operator having either a monopoly or dominant market power require approval from the TCC before closing (pre-merger filing) and mergers which may potentially result in a substantial reduction in competition in the relevant market require post-merger notification to the TCC within seven days. Mergers that fall under the jurisdiction of the TCA are: amalgamations; acquisitions of shares having 25 per cent or more of the total voting rights of a listed public company; or the acquisition of shares having more than 50 per cent of the total voting rights of a private company and a non-listed public company; and the acquisition of assets which make up more than 50 percent of the total asset value of another business operator. Internal restructurings of the same economic entity do not require clearance.

Failure to obtain prior approval from the TCC is subject to an administrative fine of up to 0.5 per cent of the value of the transaction. The TCC may issue an order to a business operator to suspend, cease, or vary a merger where it has sufficient evidence to believe that there has been a violation of the pre-merger filing requirement. Any person who suffers loss from the violation of the pre-merger filing requirement by a business operator may claim damages. Furthermore the business operator which fails to submit a post-merger notification will be subject to an administrative sanction which is a fine not exceeding THB 200,000 and a daily fine not exceeding THB 10,000 throughout the period of the violation. Directors, managers or persons responsible for the operation of the company may be liable to the same fine.

To date, there has only been one incident in which fines were imposed for non-compliance with the post-merger notification obligation, but no official details were disclosed to the public.

A significant merger occurred in Thailand in 2020 with the Charoen Pokphand Group (CP)’s acquisition of Tesco’s Thai operations. This attracted widespread interest, not only because the deal value was THB 338,445 million (approximately USD 10,576 million) but also because CP is a key manufacturer of agricultural products, processed agricultural products and consumer products from upstream to downstream operations, and it operates nearly 12,000 branches of 7-Eleven convenience stores and 134 branches of the Siam Makro wholesale chain. The acquisition added approximately 2,000 of Tesco’s combined hypermarket and smaller stores to CP’s expanding business empire. The acquisition was only approved by a narrow majority of the TCC members, with those members who were opposed to the deal making public statements on their own perspectives. Moreover, this merger has raised many concerns of future abuse of power, especially among consumers, and the Foundation for Consumers is preparing to file a petition to the central administrative court on 15 March 2021 on the grounds that the TCC’s ruling is contrary to the objectives of the TCA.

The TCA also regulates any operation of business operators that may unfairly restrict trade competition, prohibiting (1) abuses of dominant market power; (2) restrictive agreements between business operators (especially between competitors in the same market); and (3) unfair trade practices. The TCC has issued some subordinate legislation and guidelines to provide clarification on the prohibited activities, and it has also issued guidelines to prevent unfair trade practices in relation to specific industries such as modern trade, franchising, and online food delivery businesses, as well as other subordinate legislation with regard to the granting of credit terms to small and medium-sized enterprises (SME).

The TCA imposes criminal liability of imprisonment of not exceeding two years or fines of not exceeding 10 percent of the business operator’s turnover in the year in which the offense was committed, which apply to both abuse of dominant market power and restrictive agreements between competitors in the same market. For restrictive agreements between business operators which are not competitors, the TCA imposes an administrative fine of up to 10 per cent of their respective turnovers during the year of the offense. In addition, any person who suffers losses from the violation of the prohibitions under the TCA is entitled to claim damages from the violator.

To date, as there have only been a few precedent enforcement cases overseen by the TCC, clarifications and amendments of the provisions of the TCA and its subordinate legislation are still required, as evidenced by the clarification of the previously ambiguous definition of a business operator with power over the market in the subordinate legislation issued on 22 September 2020, as well as the amendment of the heavily criticized provisions regarding franchise expansion in the subordinate legislation on 25 September 2020. However, in light of the active approach of the TCC, we may assume that Thai competition law will see more significant developments and positive changes in the years to come.

Personal Data Protection Act

The Personal Data Protection Act (2019) (PDPA) was promulgated in order to protect natural persons from the unauthorized or unlawful collection, use, or disclosure of their personal data. The PDPA came into force on 27 May 2019, but since the spread of the COVID-19 virus has hindered the preparation processes for both public and private sector participants, the Thai government has provided exemptions and postponed the enforcement of the PDPA to 31 May 2021, although minimum security standards already apply: data controllers must inform their staff and relevant parties of the importance of personal data protection, and certain administrative, technical and physical safeguards must be implemented.


  1. sets out requirements with respect to the collection, use and disclosure of information related to an identifiable person, directly or indirectly, (excluding deceased persons) (personal data);
  2. imposes duties on the persons who collect and use the personal data (data controller) and persons who process the collected personal data pursuant to the order of the controller (data processor) in order to provide adequate security for the collected data;
  3. imposes penalties on any violator; and
  4. establishes a regulator to oversee and promote compliance with this law (the Personal Data Protection Committee (PDPC)).

The PDPA established the PDPC, with an expert committee and a sub-committee under the PDPC. Pursuant to section 16 of the PDPA, the duties of the PDPC include:

  1. determining measures or procedures for the protection of personal data;
  2. issuing notifications or regulations;
  3. announcing criteria for protection procedures as well as the protection of data that is transferred out of the country; and
  4. preparing the master plan to support and protect personal data.

The PDPA also established the Office of the Personal Data Protection Committee, a state agency which acts as the center for academic services for the protection of personal data, together with a supervisory board.

Many requirements of the PDPA will be covered by sub-regulations, which remain to be announced and implemented by the PDPC. In February 2021, the regulator conducted a public hearing on the draft sub-regulations with plans to launch the following sub-regulations by June 2021:

  1. criteria and methods for obtaining consent;
  2. notifications regarding the processing of personal data;
  3. proper data protection methods for the processing of sensitive personal data;
  4. criteria and protections for the transfer of data overseas;
  5. personal data activities records, methods for data subject requests, and reports on personal data breach;
  6. safety measures for data processing;
  7. data protection officers; and
  8. procedures regarding complaints and administrative enforcement.

The penalties set out under the PDPA for non-compliance include both criminal and civil penalties. Criminal penalties include imprisonment for up to one year and/or fines up to THB 1 million. Furthermore, if the violation is caused by the instruction or omission of a director or person who is responsible for a company, he/she could also be subject to the same penalties under the PDPA. Civil liabilities include punitive damages of up to twice the amount of any actual damages. Civil damages may also be claimed under a class action lawsuit. Additionally, the expert committee of the PDPC is authorized to order administrative fines of up to THB 5 million against any violator.

If a data controller or a data processor is outside of Thailand, the PDPA applies to the collection, use or disclosure of personal data of subjects who are in Thailand, where the activities of the data controller or data processor are (i) the offering of good or services to data subjects who are in Thailand, regardless of whether the payment is made by the data subject and (ii) the monitoring of the data subject’s behavior, where the behavior takes place in Thailand.

Pursuant to section 28 of the PDPA, if the data controller sends or transfers personal data to a foreign country, the data controller must comply with the rules on transfers as prescribed by the PDPC (currently unspecified) and ensure that the destination country or international organization that receives such data has adequate data protection standards as determined by the PDPC (currently unspecified). There are exceptions, for example, such as data transfers with the consent of the data subject.

Most companies that collect personal data in the course of their business will be regarded as controllers or processors and will be required to comply with the PDPA.

Veeranuch Thammavaranucupt
Weerawong Chinnavat & Partners