The key regulation relating to outsourcing is the Notification of the Capital Market Supervisory Board No. TorThor. 60/2561 re: Rules, Conditions and Procedures for Outsourcing Functions related to Business Operations with Third Parties ("Outsourcing Regulation"). Financial institutions can outsource any of their functions provided that they will not as a result be considered to be a shell business with no operations.

In outsourcing any function other than a "central utility function," the cloud service provider must have the prescribed qualifications, such as being ready and able with respect to personnel and operating systems to ensure that the service provider's operational functions are in line with relevant regulations. Moreover, it must be solvent and a going concern financially. In addition, the cloud service provider must be monitored on a regular basis and prepare a due diligence report on the outsourced activity. The financial institution also needs to ensure that the Office of the Securities and Exchange Commission of Thailand ("SEC") can carry out on-site inspections of the cloud service provider upon request.

A "central utility function" is defined as a function related to a business operation that, in the event that a service provider ceases to provide services might affect the overall capital market because there are few service providers or a replacement of another service provider cannot be arranged immediately. Currently, the functions that are considered central utility functions by the SEC are e-payment for settlement of securities transactions and fund service platform functions.