What changed in recent months, and what it means for Chinese outbound investors
This briefing explains the developments most relevant to Chinese companies investing into the six core Southeast Asian jurisdictions (Singapore, Malaysia, Indonesia, Thailand, Vietnam and the Philippines), together with Laos, for the period 16 August to 15 October 2026. It is published every two months and covers the two months preceding publication. For each item we set out what has changed, how it shifts the position that applied before, and what it means in practice for Chinese investors.
Headlines this period —Three developments stand out. Vietnam's seven cybersecurity decrees of 19 August make the personal data and cybersecurity laws that took effect on 1 January and 1 July enforceable, with fines of up to 5% of Vietnamese revenue. Indonesia's new Manpower Protection Law, passed on 6 October and not yet published in official form, is reported to raise severance, shorten fixed-term contracts and narrow outsourcing, with a year to prepare once promulgated. And resource policy has hardened at both ends of the region: the Philippines has ordered priority access to critical-mineral ore for domestic processors, Laos is moving to prohibit raw-mineral exports, and Indonesia has tightened the rules on a miner using its own group's contractors. For anyone building digital infrastructure, Singapore has legislated to bring data centres and cloud service providers under licence from a date yet to be fixed, and Thailand put data-centre policy under a national committee, with key rules still in draft in mid-October.
1. Singapore
1.1. Singapore brings data centres and cloud under licence
On 7 October 2026, Parliament passed the Digital Infrastructure Bill (Bill No. 20/2026), which was introduced on 8 September 2026 after a public consultation in July. It will be administered by the Infocomm Media Development Authority (IMDA) and will come into force on a date to be notified by the Minister. No date has been fixed, but the Government expects to bring the Act into force in stages in 2027, once the subsidiary legislation, energy-efficiency thresholds and codes of practice have been developed with industry.
The new Act, once in force, will create two licensing regimes. The first is for security and resilience: co-location and cloud data centres with a critical IT load of at least 10 megawatts, and major cloud providers whose infrastructure or platform revenue from Singapore users has averaged at least S$100 million over three years, must be licensed and must manage security risks, maintain business-continuity plans and report incidents and outages. The second is for environmental sustainability: every data centre with a critical IT load of at least 3 megawatts must meet minimum facility-level energy-efficiency requirements from the outset and report annually; equipment-level IT-efficiency requirements, which expressly extend to customer-installed equipment, and water-efficiency requirements may be prescribed later. Commitments made under the Government's Data Centre - Call for Application exercises — low-carbon energy, electricity imports, limits on specified energy sources — can be made enforceable licence conditions. Penalties for specified breaches run to S$1 million or 10% of the licensee's annual turnover in Singapore, whichever is higher, and an unlicensed operator faces a fine of up to S$100,000 and a further fine of up to S$10,000 for each day the offence continues after conviction. A licence may not be transferred without IMDA's written approval, and a licensee must notify IMDA within seven days after becoming aware that any person has become or ceased to be a 5% controller, or has acquired the data-centre business as a going concern. The regime reaches operators located outside Singapore, which must appoint a person in Singapore to accept service. Existing operators will have six months from commencement to apply, and may continue operating while IMDA considers their application. Until now, Singapore had no statutory licensing of data centres or cloud services. The Cybersecurity Act was amended in 2024 to cover major foundational digital infrastructure providers, but those provisions have not yet been brought into force and deal only with cybersecurity. Operational resilience was not regulated by statute, and sustainability commitments were contractual.
What this means for Chinese investors —Most Chinese-owned data-centre operators will fall within the 3-megawatt regime, which the Government expects to cover about 70 data centres. The larger Chinese cloud providers may also reach the S$100 million threshold. IMDA has said it will clarify which entity has effective control of a data centre and should hold the licence. Two consequences follow for transactions once the Act commences. First, any transfer of the licence, for example on a sale of the data-centre business, will require IMDA's approval. Second, the licensee must notify IMDA within seven days of becoming aware that a person has become or ceased to be a 5% controller, adding a data-centre-specific regulatory step to deals. For operations, the green-energy commitments that were negotiated to obtain capacity can become licence conditions carrying turnover-based fines, and equipment-level efficiency requirements, once prescribed, will extend expressly to customers' equipment as well as the operator's. With commencement expected in 2027, the six-month window should be planned for now.
Also in Singapore —On 1September 2026, the Monetary Authority of Singapore (MAS) published draft amendments to the Payment Services Act 2019 to implement its stablecoin framework, introducing a new stablecoin issuance licence for single-currency stablecoins pegged to the Singapore dollar or a G10 currency. Issuers would need full reserve backing and par redemption, would be prohibited from paying interest, and could issue jointly with a foreign co-issuer supervised under a regime MAS considers substantially equivalent. The consultation closed on 16 October 2026. On 19 August 2026, MAS announced a tax exemption for qualifying profit-related returns, such as carried interest, arising from the provision of fund management services to qualifying funds managed by Singapore-based fund managers, expected to apply from the year of assessment 2027 (income earned in 2026). Further details, including the exemption’s scope and conditions, are to be announced at Budget 2027, and not every carried-interest arrangement should be assumed to qualify. MAS also announced a hedge-fund investment programme and a new ONE Pass track for senior investment professionals. A consultation by the Ministry of Law and the Intellectual Property Office of Singapore on artificial intelligence and the intellectual property regime, including whether the computational data analysis exception that permits text and data mining for model training is sufficiently clear, closes on 22 October 2026.
2. Malaysia
2.1. Malaysia's Budget 2027: a 5% rate for regional hubs for up to 30 years, and cheaper foreign-currency borrowing
The Prime Minister tabled Budget 2027 in the Dewan Rakyat on 9 October 2026. The measures are proposals until they are legislated, but several are directly relevant to foreign groups. If enacted as proposed, from 1 January 2027 the Global Services Hub incentive would be enhanced: new hub companies pay 5% on qualifying income, existing Principal Hub and Global Services Hub companies pay 5% on income above a three-year baseline (and 15% up to it), and incentive periods are granted in five-year blocks for up to 30 years, against a current maximum of 10 to 15 years. Global Services Hub companies carrying on treasury and fund-management activities would obtain withholding-tax exemption on interest under onshore cash-pooling arrangements (centralised management of group bank balances) and stamp-duty exemption on intercompany loan agreements in foreign currency under those arrangements, for applications received by MIDA from 1 January 2027. Separately, stamp duty on foreign-currency loans from Malaysian banks, currently 0.5% of the amount, would be capped at RM2,000 for facilities up to RM100 million and RM5,000 above that, for agreements executed from 1 January 2027.
On the cost side, the minimum wage would rise from RM1,700 to RM2,000 a month from June 2027 (with micro, small and medium enterprises below RM50 million in sales (MSMEs) exempt), and from the year of assessment 2028 companies other than MSMEs may deduct salary expenses only if the salaries are paid through financial institutions or cashless instruments permitted under the Employment Act, a measure the Government has presented as directed at undocumented foreign labour. The green technology incentives would be extended to 31 December 2030 but re-tiered: renewable-energy systems integrated with battery or energy-storage systems would join the top tier for own-use assets, green buildings and energy efficiency would be removed from that allowance, and the solar-leasing income-tax exemption closes to new applications after 31 December 2026., The Budget also announced an E-Commerce Bill, noted below.
What this means for Chinese investors —For a Chinese group choosing where to put its ASEAN headquarters, treasury or shared-service centre, the enhanced hub incentive would be fairly generous, and the stamp-duty changes would lower the cost of funding Malaysian operations in US dollars or renminbi, whether from a Malaysian bank or, for a hub company's onshore cash pooling, from within the group. For Chinese manufacturers the picture is mixed: the wage floor would rise, and from 2028 salaries paid in cash would cease to be deductible, so that tax deductibility would be used to enforce payroll compliance. Chinese groups installing renewable-energy systems with battery storage for their own use would gain from the re-tiered green allowance; solar-leasing businesses would lose an exemption and should file before year-end.
Also in Malaysia —The Cross-Border Insolvency Act 2026 (Act 877), adopting the UNCITRAL Model Law, came into operation on 28 August 2026, with a threshold order protecting Malaysian creditors' claims of up to RM200,000 and new court rules in force from 3 September. A foreign liquidator or administrator may now apply to the Malaysian High Court for recognition, a stay and other relief. The Competition (Amendment) Bill and Competition Commission (Amendment) Bill, passed in July and reported in our last issue, were not listed as Acts on the Federal Legislation portal on 15 October; the Competition Commission continues to enforce under the existing Act and, by a decision dated 21 September, imposed a RM1.18 million bid-rigging penalty on six enterprises. A reminder on the electricity amendments reported in August: the transitional window for existing cross-border electricity participants to apply for the new section 22D licence closes six months after the 1 July 2026 commencement, at the turn of the year. The Government announced that an E-Commerce Bill will be tabled at the next parliamentary sitting, and is considering whether the Bill should license e-commerce platform operators, including those operating from overseas and offering services to consumers in Malaysia, with consumer protection and platform accountability as its stated aims. The Personal Data Protection Department issued a consultation on 5 October 2026 on an AI and personal-data framework, open until 23 October, and the Minister of Digital has said that drafting of an AI Governance Bill is complete, for tabling by the end of 2026 or, at the latest, the first quarter of 2027.
3. Thailand
3.1. Thailand exempts seven service businesses from foreign-business licensing
On 28 August 2026 the Ministry of Commerce published in the Royal Gazette Ministerial Regulation (No. 5) B.E. 2569 prescribing service businesses that do not require a foreign business licence, together with a companion regulation on brokerage and agency businesses. Both are in force. This brings into force the service-business part of the reform we reported at Cabinet-approval stage in our June issue; the remaining element, the removal of agricultural-futures trading from the restricted list, requires a Royal Decree. Under the Foreign Business Act, a company that is at least half foreign-owned needs a Foreign Business Licence before carrying on any service business caught by the catch-all "other service businesses" in List 3, and obtaining one typically takes several months. The Ministry may exempt specific services by regulation; this is the fifth such regulation.
Seven categories are now exempt (eight in our last issue, which counted securities and derivatives separately): telecommunications services provided without the operator's own network (Type 1 licensees); treasury centres approved under exchange-control law; intra-group administrative, human-resources and IT management services between related companies that meet the ownership and management-control tests; domestic debt guarantees between related companies, with a higher relationship threshold; leasing of part of premises for ATMs, financial-service kiosks and vending machines for employees; petroleum-drilling services under direct contracts with concessionaires and production-sharing or service contractors; and specified securities and derivatives activities, including lending to finance securities purchases, reverse-repurchase transactions, and dealer, adviser and fund-manager services where the underlying falls outside the Derivatives Act. The exemption removes only the Foreign Business Act requirement. Sector licences — from the telecommunications regulator, the Bank of Thailand or the Securities and Exchange Commission — continue to apply.
What this means for Chinese investors —As we noted in June, the practical gain is real but bounded: Chinese groups that already run treasury, shared-service or intra-group financing functions in Thailand under Board of Investment promotion (an International Business Centre or similar) have long had a Foreign Business Act exemption through that route. The change matters most for groups that did not want, or did not qualify for, BOI promotion and had therefore either waited months for a licence or sought Thai majority partners for a function that is purely internal. Those groups can now hold the treasury centre, shared-service centre or guarantor at 100%. Asset-light Chinese telecommunications operators gain a cleaner entry route. The intra-group exemption is narrow: it covers related companies as defined in the regulation, not affiliates generally, so a group should check that each Thai entity in the service chain passes the shareholding or common-director test before relying on it.
3.2. Thailand extends nominee enforcement to existing companies and notifies their embassies
Our last issue reported Registrar's Order No. 2/2569, which from 1 August 2026 requires documentary proof of the Thai shareholders' funds when a company with minority foreign ownership is incorporated. In this period the Department of Business Development (DBD) turned from new registrations to existing companies. On 7 September 2026 it published the results of a screen of over 100,000 companies, based on land records supplied by the Department of Lands, which found that 36,277 foreign-invested companies hold 1,064,265.38 rai (2,554,236 Chinese acres) of land in aggregate, representing approximately 23.62 per cent of the land held by entities in Thailand by area size. The DBD said it would send data to and work with the Department of Lands, provincial governors, the Department of Special Investigation, the police, the Anti-Money Laundering Office, the Board of Investment and the Industrial Estate Authority. On 30 September 2026 the DBD announced that it had sent data on more than 100,000 companies with foreign directors or shareholders, covering 48 nationalities, to 43 embassies, asking for their cooperation in ensuring that their nationals comply. The Director-General has said that inclusion in the data does not mean that a company has acted illegally.
These steps are enforcement of the existing law. Under section 36 of the Foreign Business Act, a Thai national who assists a foreigner to operate a business in breach of the Act, and the foreigner, face imprisonment of up to three years, a fine of THB 100,000 to THB 1,000,000, or both, and a court order to cease the arrangement.
What this means for Chinese investors —The July statement that launched the campaign designated Chonburi, Rayong, Chiang Mai, Chiang Rai, Surat Thani, Phuket and Krabi as high-risk provinces. A 49/51 structure that was set up years ago, and that holds the land on which a Chinese-invested factory stands, is now being examined on the basis of land records as well as on its next filing. The Department of Provincial Administration (DOPA), the Land Office, the Royal Thai Police, the Board of Investment and the Industrial Estate Authority, among others, will be sharing information across agencies. Groups should establish now, for each Thai company holding land, who funded the Thai shareholders and whether that can be documented, and may hear from embassies as well as from the Thai registrar.
3.3. Thailand sets up a national committee on data-centre policy; key rules were still in draft in mid-October
A Prime Minister's Office regulation published in the Royal Gazette on 13 August 2026 set up a Data Center Business Policy Committee, chaired by a Deputy Prime Minister, with the Secretary-General of the National Economic and Social Development Council as its secretary. Under the regulation, once the Cabinet adopts policies, standards or guidelines the Committee proposes, the agencies concerned are to act in accordance with them when they approve, permit, grant investment promotion or provide services. At its first meeting, on 4 September, the Committee approved a draft policy under which a data centre using more than 2 MW is treated as an “industrial-type” business and its measures cover data centres in operation, under construction and awaiting approval. On 23 September it approved in principle an initial requirement for data centres of 0.5 MW or more to notify the Ministry of Digital Economy and Society, and on 1 October it endorsed draft minimum technical requirements by electricity load. Two of the Committee's subcommittees then took up drafts. On 9 October the environment subcommittee considered a draft code of practice for operators covering the stages from before construction to operation. On 15 October the economic subcommittee considered adding setbacks, by volume of backup fuel, from homes, schools, hospitals and temples, except inside industrial estates. At that meeting the Minister of Digital Economy and Society said that the minimum requirements are for a licence application only, that meeting them would not mean immediate permission, and that a highest-score criterion would also be considered.
Under Board of Investment Announcement No. Sor. 3/2569, from 15 July 2026 a data-centre project needs the approval of a screening subcommittee before it can file for investment promotion. The condition also reaches applications pending on that date and amendments that raise a project's IT load by more than 30 per cent. On 15 July 2026 the National Energy Policy Council approved a policy under which data-centre users in the large-business tariff class would post security for grid use from the point of applying for a grid capacity check, together with a water-management plan approved by the Ministry of Natural Resources and Environment. That class covers a peak demand of 1,000 kW or more, or a three-month average above 250,000 units a month. The Council assigned the Energy Regulatory Commission (ERC) to take the implementing steps. The ERC held a public hearing from 19 September to 18 October 2026 on draft principles for a licence category for selling electricity to data centres. Under the principles, the licence would attach to the supplier, and suppliers already selling to data centres would have 180 days to apply. On ownership, a ministerial regulation published on 28 August 2026 added type-one telecommunications service to the services that need no foreign business licence.
Other rules were in draft on the dates given. A draft ministerial regulation on data-centre buildings, would treat every data centre as a controlled-use building in tiers by size and give existing buildings a year to upgrade. A bill for a Digital Infrastructure Service Business Act, filed by members of the House of Representatives and received on 8 July 2026, completed its public hearing on 17 September. As drafted, it would require a ministerial licence for commercial data-centre, cloud and digital-platform services and the storage in Thailand of personal data of Thai nationals and certain other data.
What this means for Chinese investors —The measures adopted or proposed so far reach existing as well as new projects: the screening condition applies to applications pending on 15 July, and the draft policy the Committee approved on 4 September covers data centres in operation and under construction. A new project should plan around the requirements on the record so far: screening approval before any promotion filing; the grid capacity check, at which security would be posted under the policy approved on 15 July; and the Committee's minimum requirements, endorsed in draft on 1 October, including the backup-fuel setbacks considered on 15 October, which as considered would not apply inside an industrial estate.
Also in Thailand —The Trade Competition Commission opened a consultation on 22 September 2026, closing on 21 October, on three draft notifications that would lower the single-firm “dominance” threshold from 50% market share and THB 1 billion turnover to 33% and THB 500 million, halve the merger-notification threshold from THB 1 billion to THB 500 million, lower the monopoly turnover threshold for prior permission to the same figure, and add a separate test for platform and fast-moving markets in which market share and turnover would not be applied. Examples of other factors to be considered in such cases include barriers to entry and purchasing power. The Securities and Exchange Commission's eleven notifications permitting Thai-listed crypto exchange-traded funds, initially limited to Bitcoin and Ethereum and with custody only at Thai-regulated custodians, take effect on 16 October 2026. From 15 September 2026 the visa-free stay was cut from 60 to 30 days, confined to 60 countries and territories, and limited to two land-border entries a year; Chinese nationals lose the 60-day stay and now travel under the bilateral mutual visa exemption (30 days).
4. Indonesia
4.1. Indonesia passes a stand-alone labour law raising severance and limiting fixed-term and outsourced work
On 6 October 2026 the House of Representatives passed the Manpower Protection Law (Undang-Undang Pelindungan Ketenagakerjaan), a 23-chapter, 313-article statute that carves the labour rules out of the Job Creation Law. It answers Constitutional Court Decision 168/PUU-XXI/2023, which required a separate manpower law by 31 October 2026. As at the date of this briefing the law has not been promulgated or numbered and the official text has not been published, so the following is drawn from press reports of the text as passed and from statements by officials and unions. The law is reported to take effect one year after promulgation.
As reported, fixed-term contracts are capped at four years (an initial two years plus two one-year extensions), down from five under the current rules. Outsourcing is confined to five support categories — cleaning, catering, security, support services in mining and oil and gas, and worker transport — narrower than the six categories in Minister of Manpower Regulation No. 7 of 2026, which we reported in June and which carries a transition period to 30 April 2028; how the regulation's transition period interacts with the new law's one-year lead time will only be clear from the final text. The 0.5-times severance multiplier that applied to dismissals for efficiency, losses and similar reasons is removed, so the minimum multiplier becomes 1; dismissals must go through bipartite negotiation, mediation and the Industrial Relations Court, with wages paid until a final ruling. A new mandatory severance reserve fund, separate from the existing social-security schemes, is created, with the contribution rate left to a Government Regulation. Internships are capped at six months, and employers may not withhold employees' diplomas. Business associations warned during the debate of the cost and investment impact.
What this means for Chinese investors —For Chinese-invested smelting, manufacturing, EV and construction operations in Indonesia that use fixed-term and outsourced labour, the new law, as reported, would raise the cost of both and narrow the room to restructure. The reserve-fund contribution rate is not yet known. The one-year lead time is the opportunity: existing fixed-term and outsourcing arrangements should be mapped against the new categories and term limits, severance provisions in financial models revised, and workforce plans for any anticipated downsizing brought forward, because dismissal on efficiency grounds is expected to become harder and more expensive once the law applies. We will report the final text and the implementing regulations as they issue.
4.2. Indonesia tightens the rules on miners using their own group's contractors
On 18 September 2026 the Minister of Energy and Mineral Resources issued Decree No. 365.K/MB.01/MEM.B/2026 on the approval of the use of subsidiaries and affiliates in mineral and coal mining services. It took effect on issue and revokes a 2010 Director-General's decision that had governed the question for sixteen years.
Holders of mining business licences (IUP and IUPK), and by extension contract-of-work and coal-contract holders, must use licensed mining-services companies and must prioritise those located in the same regency or city as the mine. They are prohibited from engaging their own subsidiaries or affiliates for mining services without the Minister's approval. Affiliation is defined widely: direct shareholding, or one or more common beneficial owners. Approval is available only where the licence holder is carrying out a government assignment — a national strategic project, construction of processing and refining facilities or coal development, or supply of domestic mineral and coal needs — and is tied to the contractor's own licence and its validity. The Minister decides within 14 working days of a complete application; for licences issued by a governor, the governor decides. The decree contains no express transition period for existing contracts, and the coal-mining association has said it is still studying implementation. Under Article 137A of Government Regulation No. 96 of 2021, as amended by Government Regulation No. 39 of 2025, the Minister could approve the use of an affiliate where there was no other mining-services company in the area, or none able or willing to do the work.
What this means for Chinese investors —Some Chinese nickel and coal groups in Indonesia run mining through an affiliated contractor that shares an ultimate owner with the licence holder. That model appears to need fresh ministerial approval, available only to those building smelters or performing another government assignment; others may face re-tendering to local contractors, although the decree is silent on existing contracts. Because affiliation is tested by common beneficial ownership rather than by direct shareholding, the usual layering of holding companies is unlikely to take an arrangement outside the rule. Groups should inventory every mining-services contract in Indonesia, identify which counterparties share a beneficial owner, and decide whether to apply, restructure or re-tender before the question is raised in an inspection.
Also in Indonesia —Government Regulation No. 33 of 2026, implementing the Personal Data Protection Law, was promulgated on 16 July 2026 but only became publicly available in late August; it takes effect on 16 January 2027. It requires records of processing, data protection impact assessments for high-risk processing, a data protection officer where any of the statutory triggers is met, breach notification within 72 hours regardless of severity, and a three-tier regime for cross-border transfers — an adequacy list, binding safeguards such as standard clauses or binding corporate rules, or the data subject's consent subject to limited conditions — with fines of up to 2% of annual revenue that may be imposed without prior warning. The supervisory authority has still to be established and the adequacy list and standard clauses do not yet exist. Minister of Finance Regulation No. 71/2026 and Director-General of Taxes Decision KEP-239/PJ/2026 open a penalty-relief window. Unpaid administrative penalties for late or corrected returns and late payments can be waived in full on application if the return is filed or the tax paid between 8 October and 31 December 2026, by half if by 31 March 2027 and by a quarter if by 30 June 2027. The principal must be settled by the relevant date, the taxpayer must confirm that the lapse was inadvertent, and no legal challenge may be pending.
5. Vietnam
5.1. Vietnam makes its cybersecurity and data rules enforceable, with fines of up to 5% of revenue
On 19 August 2026 the Government of Vietnam issued seven decrees implementing the Law on Cybersecurity No. 116/2025/QH15, which we reported in our last issue. All took effect the same day, except the decree on false information, which took effect on 5 October 2026. Two of them matter most to foreign businesses. Decree No. 333/2026/ND-CP sets out the detailed rules under the Law, and Decree No. 330/2026/ND-CP is the first penalty schedule for breaches of the personal data protection rules and a new one for the cybersecurity rules.
Three things that Decree 333 does are worth flagging. First, it lists the data that must be stored in Vietnam — service-account names, service usage time, credit-card information, e-mail addresses, most recent login and logout IP address, registered phone numbers, and the personal information of, and data created by, users in Vietnam — and requires domestic enterprises to store that data in Vietnam. For foreign providers of telecommunications, cloud storage, e-commerce, online payment, social-network, online-game and similar services, the decree clarifies the localisation duty that we described in August as a positive obligation under the Law: the duty to store data locally and to open a branch or representative office in Vietnam is triggered only after the Ministry of Public Security has notified the company that its services are being used for unlawful acts and has requested cooperation in writing three times within six months without result; once the Minister issues a decision, the company has 12 months to comply. Data must be kept for at least 24 months and system logs for at least 12 months. Second, every digital account must be verified with a Vietnamese mobile number (or, for users without one, a personal identification number or other lawful electronic ID), and anyone livestreaming for commercial purposes must verify with a personal identification number. Third, platforms must remove unlawful content and hand over user data within 24 hours of a request, with shorter deadlines in emergencies.
Decree 330 supplies the penalties that the Personal Data Protection Law, in force since 1 January 2026, had been missing. It applies to foreign organisations processing the data of Vietnamese citizens even with no presence in Vietnam. Cross-border transfers made without the impact assessment dossier, or with the data flow concealed or misdeclared, that lead to the leak or loss of the personal data of at least 10,000 Vietnamese citizens attract fines of between 1% and 5% of the previous year's revenue in Vietnam, in bands that rise with the number of people affected; unlawful sale or purchase of personal data is fined at two to ten times the proceeds; other data-protection breaches are capped at VND 3 billion. The authorities may also suspend cross-border transfers for six to twelve months, order processing to stop and require deletion. Before 19 August, the Cybersecurity Law and Decree 53/2022 contained a similar localisation mechanism, and no decree yet set the penalties for breaches of the Personal Data Protection Law.
What this means for Chinese investors —Chinese platforms, fintech, gaming and cloud providers serving Vietnam are likely the businesses most directly affected by Decree 333, and the account-verification rule reaches directly into e-commerce and livestream-selling models that depend on fast, low-friction sign-up. The wider exposure is the data flow between a Vietnamese subsidiary and its Chinese headquarters: HR files, customer records and vehicle or device data sent to China without the required dossiers are now exposed to a fine and, where data of 10,000 or more Vietnamese citizens is leaked or lost, a penalty measured as a percentage of Vietnamese revenue, and to a suspension power. Three practical steps follow. Confirm that the impact assessment and cross-border transfer dossiers required under the Personal Data Protection Law have actually been filed, because they are likely to be the first thing an inspector asks for. Check that account sign-up flows can verify a Vietnamese phone number. And make sure that someone in the Vietnamese entity can answer a written request from the Ministry of Public Security within 24 hours (or 3 hours in case of emergencies), because that is the deadline Decree 333 sets.
5.2. Vietnam rewrites the licensing gateway for foreign retailers and e-commerce platforms
On 3 September 2026 the Government issued Decree No. 342/2026/ND-CP on the purchase and sale of goods and related activities by foreign investors and foreign-invested enterprises. It takes effect on 18 October 2026 and replaces Decree No. 09/2018/ND-CP, which had governed the Business Licence and Retail Outlet Licence regime since 2018. It also answers the question we left open in August, when Decree 292/2026 freed foreign-invested enterprises to export their own products but left the business-licence regime for foreign-invested trading to be dealt with separately.
The architecture is familiar — a Business Licence for distribution and certain other activities, a Retail Outlet Licence for each shop, and an economic needs test (a case-by-case assessment of whether a further outlet is justified) for outlets beyond the first — but at least four things change. Licensing moves from the provincial Department of Industry and Trade to the provincial People's Committee. A national-security consultation is introduced: the licensing authority must obtain the opinions of the Ministry of Public Security and the Ministry of National Defence where the investor comes from a country that is not a treaty partner of Vietnam, including when it seeks to trade in goods or services not yet committed under treaties; where a foreign investor controls an organisation that owns an intermediary e-commerce platform, an e-commerce social network or a large integrated e-commerce platform; or where the investor applies for, or already holds, a large outlet portfolio (100 outlets under 500 square metres, 50 outlets of 500 to under 3,000 square metres, or 30 outlets of 3,000 square metres or more). Reporting becomes semi-annual rather than annual. And a licence may now be revoked where the company is administratively sanctioned three times in twelve months for breaching it. On the liberalising side, the Business Licence of a treaty-country investor, for lines committed under treaties, now expressly runs for as long as its enterprise registration, and the economic needs test applies only to investors from countries outside treaties in which Vietnam has committed to abolish it. A target that becomes foreign-invested through an acquisition may keep its outlets running for up to twelve months but must apply for Retail Outlet Licences within 30 days of the M&A approval.
What this means for Chinese investors —China is a WTO member and a treaty partner of Vietnam, so Chinese retailers and distributors benefit from the licence term tied to enterprise registration for committed lines. The security consultation is the new variable. Any Chinese group that controls a large e-commerce marketplace or social-commerce platform serving Vietnam, or that is building a large physical retail footprint, should assume that its next licence application will be reviewed by the public security and defence ministries, within 14 working days from receipt of a complete and valid dossier. Three sanctions in a year can now cost the licence, so staying within the licensed trading activities has become a licensing matter. Acquirers of Vietnamese retail chains should build the 30-day filing deadline into the closing timetable.
Also in Vietnam —Law No. 24/2026/QH16 of 24 August 2026, effective 1 March 2027, cuts the list of conditional business lines from 198 to 137 while keeping data intermediary and data-exchange services, crypto-asset services and personal-data processing services, listed since 1 July 2026, and adding visa-support services of authorised business establishments. Decree No. 384/2026/ND-CP of 9 October 2026, effective 1 January 2027, sets binding criteria for labelling goods made and sold in Vietnam as of Vietnamese origin: a change of tariff heading at the four-digit level or Vietnamese value content of at least 30%, with simple assembly and packaging excluded and the burden of proof on the trader. Decree 292/2026, reported in our last issue, took effect on 5 September 2026; the Ministry of Industry and Trade's Circular 48/2026/TT-BCT detailing it covers used goods, tariff-rate quotas and rough diamonds but contains no list of goods caught by the forced-labour import prohibition.
6. The Philippines
6.1. The Philippines declares critical minerals a national priority and orders priority access to ore for domestic processors
On 18 August 2026 President Marcos signed Executive Order No. 122, establishing a national policy framework for the critical minerals industry. It takes effect on publication. Critical minerals are defined as minerals that are essential inputs for, among others, clean-energy transition technologies, advanced manufacturing, digital infrastructure and national defence; the Department of Environment and Natural Resources must issue a Philippine Critical Minerals List within 30 days of effectivity and update it periodically. All critical mineral projects are declared national priority projects, and the companies undertaking them are treated as contractors of the State.
At least three provisions matter commercially. First, a "use-it-or-lose-it" rule: critical-mineral tenements in material non-compliance with approved timelines, work programmes or commitments, without force majeure or similar justification, are subject to cancellation or other sanctions, with cancellation taking effect immediately on issuance. Second, the Department of Trade and Industry and the Board of Investments must promote downstream processing, develop an incentives offer sheet consistent with the CREATE law, and grant domestic mineral processing plants priority access to mineral ores at a fair, market-based price, with the benchmark set by the Mining Industry Coordinating Council. Third, the Council is reorganised under the co-chairmanship of the environment and finance secretaries, with a work plan due within 90 days and responsible-sourcing standards based on environmental, social and governance criteria. The order does not ban raw-ore exports and does not change foreign-ownership rules. Before it, the Council operated under a 2012 order.
What this means for Chinese investors —China is the largest market for Philippine nickel ore. Priority access for domestic processors, at a price the Council will benchmark, favours in-country processing over ore export, and the responsible-sourcing standards, formulated and adopted by the Council, are likely to track the supply-chain requirements of the Philippines' security partners. A Chinese buyer that depends on Philippine ore should model a future in which a domestic plant has priority access to it; a Chinese investor that has been considering a processing plant may find the policy environment has moved in its favour, with the Board of Investments directed to develop an incentives offer sheet. Any Chinese-held critical-mineral tenement that is behind its work programme should be brought into compliance now, because cancellation takes effect immediately on issuance.
Also in the Philippines —The Supreme Court's Rule on the Civil Forfeiture of POGO-Related Assets (assets related to Philippine offshore gaming operators) took effect on 24 August 2026, shortly after the implementing rules of the Anti-POGO Act were signed. Forfeiture of buildings, equipment and proceeds linked to offshore gaming may proceed without any criminal charge, on a probable-cause finding and a preservation order made without hearing the owner, with judgments immediately executory; innocent owners, lenders and purchasers who are not parties to the case must file a verified petition within 15 calendar days of the completion of the posting of a judgment or be barred. The Bureau of Internal Revenue's Revenue Memorandum Circular No. 98-2026 of 22 September 2026 requires large taxpayers, e-commerce businesses and users of computerised accounting systems to issue structured electronic invoices from registered software on or before 31 December 2026; micro taxpayers in each category are exempt. The implementing guidelines under Executive Order No. 119 on government data classification and residency are due within 120 days of the order taking effect on 15 July 2026.
7. Laos
7.1. Laos moves to end raw-mineral exports and freezes new rare-earth approvals
On 7 October 2026, at the second ordinary session of the National Assembly, the Minister of Industry and Commerce announced a new direction for the mining sector. Under the announced policy, all new mining projects would be required to build processing plants and raw-ore exports from new projects would be prohibited; new rare-earth approvals are frozen; gold, copper, bauxite and potash producers would be legally tied to domestic smelting or processing; and raw exports of gypsum, barite, antimony, cobalt, tungsten and nickel are to be phased out by 2030. Investor screening is to be tightened, with proof of technical and financial capacity, disclosure of ultimate beneficial owners and a prohibition on nominee ownership. Real-time mine-gate weighing systems linked to the tax system are to be installed. A Prime Minister's order is in draft, a ministry roadmap is due by the end of 2026, and a revised Minerals Law is to go to the National Assembly in early 2027. None of this is yet law, although a Prime Minister's order of March 2025 (No. 06/PM) already suspends approval of new metallic-mineral projects.
Two earlier instruments already apply to mining concessionaires. Decree No. 112, in force since 16 June 2026, imposes administrative penalties for late payment of state land-lease and concession fees and of royalties — 10%, 20% and 30% of the outstanding amount per month for first, second and subsequent violations, where the agreement sets no other penalty — and penalties of 200% to 400% of the royalty for incorrect declaration of the quantity, quality or category of minerals, together with, in serious cases, seizure of assets, suspension of licences and termination of the concession. And the new Income Tax Law No. 88/NA, published in the Official Gazette on 19 June 2026 and in force from 1 July 2026, confirms a 35% corporate rate for mining concessionaires and mineral exporters, introduces transfer-pricing rules and a 15% domestic minimum top-up tax for multinational groups (the global minimum tax applied locally), caps net interest deductions at 20% of EBITDA (earnings before interest, tax, depreciation and amortisation) and raises withholding tax on service fees to 10%.
What this means for Chinese investors —Chinese investors hold significant positions in Lao rare earths and potash, and in gold and copper. The Lao press has itself observed that the policy risks a revenue shortfall, a chill on investment and claims by investors, and the Minister acknowledged steep logistical hurdles — which suggest that existing concession terms may be revisited; one Chinese-listed group had already suspended a rare-earth project in Xieng Khouang in August, citing policy requirements for rare-earth development. The nominee prohibition and beneficial-owner disclosure would, if enacted, reach nominee holding structures in Lao mining. Investors with existing concessions should establish whether they will be grandfathered, bring royalty declarations and concession-fee payments fully current under Decree 112, and consider whether an integrated extraction-and-processing proposal would secure their position under the new criteria.
7.2. Laos tightens central-bank approval of offshore loans
As Laos is new to this briefing, we include a decision from just before the period: on 5 August 2026 the Bank of the Lao PDR issued Decision No. 707/BOL on the management of cross-border borrowing, effective on signing and reported at the end of August. A Lao-resident company or individual must obtain prior approval from the central bank's Foreign Exchange Management Department before receiving or providing any direct offshore loan, including loans from shareholders and group companies, and the regime also covers indirect financing such as offshore bonds, trade credit and guarantees. A commercial bank may not credit the proceeds or process repayments without the approval. Borrowing is capped at 75% of the borrower's total capital where its revenue is in foreign currency and 50% where it is in kip; above that, specific approval and hedging arrangements are needed. The loan and repayment currency must match. At least 10% of the proceeds must be converted into kip on arrival, except for restructuring loans. Review takes 15 working days (extendable for loans of US$50 million or more), the signed agreement must be filed within ten working days, and borrowers report monthly. Borrowing or lending without approval may attract a fine of 10% of the loan agreement value, and banks that process unapproved loans are fined LAK 20 million per transaction.
Offshore borrowing was already subject to central-bank approval, but without leverage caps or lender-eligibility tests.
What this means for Chinese investors —Chinese-invested hydropower, special economic zone, mining and logistics projects in Laos include projects funded by parent-company loans and Chinese bank facilities, and some Lao subsidiaries may be thinly capitalised, that is, funded largely by debt rather than share capital. New intercompany loans, parent guarantees and, on the face of the Decision, credit of more than a year need prior approval, and the leverage cap means that a subsidiary with kip revenue and a large shareholder loan may be unable to draw further without raising its registered capital — which, under the Ministry of Industry and Commerce's 2025 rules, must then be paid in within a year. Read together with the new Income Tax Law's 20%-of-EBITDA interest cap and transfer-pricing powers, the shareholder-loan model for funding Lao operations is now constrained on both the regulatory and the tax side, and groups should revisit the debt-equity mix of each Lao entity.