To determine when outsourcing falls within the scope of Thai law, with respect to a licensed securities company under the Securities and Exchange Act B.E. 2535 (1992), all of the following elements must be met:

• It is an operational function for the undertaking of a securities business or a function having a direct connection to the undertaking of a securities business of the financial institution.
• The financial institution has an obligation to perform the function, but the function has been outsourced to another entity.
• The cloud service provider has the power to control, manage or decide how to perform the outsourced function. If the financial institution must still take key decisions on the operation of the function, this will not be considered outsourcing (e.g., it might be considered to be using services from a vendor).