Thailand’s National Broadcasting and Telecommunications Commission (NBTC) officially published the Measures for Telecommunications Operators to Prevent Technological Crimes in the Royal Gazette on 29 August 2025, commonly known as the eight measures to combat technological crimes. The regulation took effect immediately upon publication.
The new regulation introduces mandatory Sender‑Name registration. All outbound A2P SMS may only use sender IDs that have completed official registration. A2P SMS sent by unregistered sender identifiers will be intercepted and controlled. Foreign enterprises cannot directly apply for ID registration with the regulator; applications must be processed via licensed local Thai aggregation service providers.
The regulation explicitly imposes content security review obligations on telecom operators. If an A2P SMS contains a web link, operators must verify the authenticity and validity of the link before message delivery, and block phishing and malicious URLs. Operators are also required to classify all A2P SMS sources, distinguishing domestic and overseas traffic, and deploy SMS firewalls to filter international traffic in real time. For all international SMS originating outside Thailand that pass filtering, operators must apply risk warning prefixes +697 and +698, and enable call blocking functions for end users.
A tiered real-name re-verification mechanism applies to SIM card management. Newly issued SIM cards must complete identity verification within 7 days. SIM cards registered after 1 January 2024 require secondary verification within 90 days. Existing older SIM cards shall finish information re-verification within one year. The new rules also limit the number of SIM cards for foreign nationals: foreigners may register a maximum of three SIM cards per operator with valid passports. Tourist-specific SIM cards have a maximum validity period of 60 days and cannot be extended by recharge; re-registration is required upon expiry.
Telecom operators must build regular risk control systems to continuously monitor abnormal usage patterns across calls, location and device dimensions. Upon receiving regulatory notices, mobile numbers must be suspended within 24 hours, and other communication services shut down within 3 working days at the latest. For hardware controls, gateways and SIM‑Box devices supporting four or more SIM cards simultaneously must be registered with NBTC; unregistered equipment is prohibited from connecting to Thailand’s telecom networks.
NBTC officials stated that fraud techniques keep evolving, and post-event interception alone cannot fully eradicate the problem. Operators are required to strictly implement all controls and carry out regular public anti-scam campaigns. This policy shifts the governance model from post-incident remediation to pre-emptive risk prevention. It directly defines market access rules for Thailand’s A2P SMS industry, and narrows the operating space for fraudulent criminal groups through supplementary clauses covering numbers, devices and overseas calls.
