Southeast Asia Bimonthly Regulatory Briefing — June 2026

What changed this month, and what it means for Chinese outbound investors

This newsletter explains the developments most relevant to Chinese companies investing into the Core 6 Southeast Asian jurisdictions (Singapore, Malaysia, Indonesia, Thailand, Vietnam and the Philippines) for the period 1 May to 15 June 2026. For each item we set out what has changed, what it does, how it shifts the position that applied before, and what it means in practice for Chinese investors. Every item has been verified against the relevant official portal or gazette; full citations, effective dates and a cross-country comparison are in our Verification Memorandum of the same date.

1. Indonesia, Philippines, Malaysia: Export Nationalization, Labor Tightening, Exit Simplification, and Tax Filing Cut-off

Indonesia channels coal, palm-oil and ferroalloy exports through a single state-owned exporter

On 20 May 2026 the Indonesian government promulgated Government Regulation No. 24 of 2026 (PP No. 24/2026), which took effect on 1 June 2026 and requires full migration to the new system by 31 December 2026. Issued under the Ministry of Trade, the regulation is marked "Berlaku" — in force — on Indonesia's official legal-information portal, and it reorders how three of the country's largest export commodities reach world markets.

What the regulation does is narrow, but consequential. It requires that all exports of coal, palm oil and ferroalloys be conducted through a single designated state-owned exporter — reported to be PT Danantara Sumberdaya Indonesia, an entity in the Danantara sovereign-investment stable. In plain terms, that designated exporter becomes the only legal channel through which these goods may leave the country, and it also sets the price at which they are sold. It does not merely add a licence or a reporting step; it inserts a state monopoly between the producer and the overseas buyer. These are not marginal commodities: Indonesia is the world's largest exporter of all three, and together they account for roughly a quarter of the country's total 2025 exports. A limited carve-out is contemplated for holders of certain existing Government contracts, but the framework otherwise applies across the board.

The shift in the regulatory landscape is sharp. Until now, Indonesian producers and traders sold these commodities directly to foreign buyers under their own contracts — negotiating their own pricing, arranging their own financing, and standing as the seller of record on every shipment. That direct route now closes. Because the state exporter becomes the seller of record and the price-setter, the existing architecture of direct off-take agreements, receivables financing and prepayment structures no longer matches the legal reality on the ground. Delivery, force-majeure, change-of-law and pricing clauses in legacy contracts will all need to be revisited, and where long-term direct-supply arrangements are disrupted there is a real prospect of contractual disputes and even investment-treaty or arbitration exposure. The regulation as promulgated is a framework: the commercial detail — the SOE's structure, the precise export procedures, the pricing and margin mechanics, and the transition rules — awaits implementing regulations that have not yet been issued.

This is the single most disruptive development in the region this month, and its trajectory points clearly toward deeper resource-nationalism, with the commodity list a candidate for future expansion (critical minerals are the obvious next frontier). The legal status is settled — the regulation is in force, with high confidence — even though the operational fine print is still pending.

What this means for Chinese investors — For Chinese off-takers, traders and resource financiers, this is the month's most urgent item. Anyone holding direct coal, palm-oil or ferroalloy offtake from Indonesia — or financing it through prepayments or receivables — should immediately map their exposure: identify which contracts route around the new state exporter, pressure-test delivery, pricing, force-majeure and change-of-law clauses against the prospect of a forced restructuring, and open a channel to the designated SOE before the 31 December 2026 migration deadline bites. Because the regulation is in force but the commercial mechanics await implementing rules, the practical move now is to preserve contractual rights and document the change-of-law position carefully, while monitoring the follow-on regulations (and any expansion of the commodity list to critical minerals) before committing to new long-term supply or financing structures.

Indonesia and the Philippines tighten the rules on outsourced labour and foreign hires

Two labour-administration changes landed in the region within weeks of each other, and together they raise the cost and lead time of putting people to work in Indonesia and the Philippines. On 30 April 2026, Indonesia's Ministry of Manpower (Kemnaker) brought into force Minister of Manpower Regulation No. 7 of 2026 (Permenaker 7/2026), the new framework governing outsourcing — in Indonesian, alih daya, the practice of staffing part of your operation through a third-party labour provider rather than hiring the workers directly. A little over a month later, on 9 June 2026, the Philippine Department of Labor and Employment (DOLE) brought into force Administrative Order No. 199, series of 2026, which reorganises how foreign nationals obtain the Alien Employment Permit (AEP), the licence a foreigner must hold to work lawfully in the country.

The Indonesian rule does three things that bite. First, it narrows the field: outsourcing is now confined to six defined categories of 'supporting' services, so any function that does not fall within them can no longer lawfully be contracted out and must instead sit on the company's own payroll. Second, it formalises the paperwork: the outsourcing arrangement must be documented in a written agreement containing prescribed mandatory content and registered with the local manpower office within three working days. Third — and most consequentially — it makes the user company, the client that engages the labour provider, legally responsible for ensuring that the provider actually delivers workers' wages and statutory entitlements; failures are met with a ladder of progressive administrative sanctions that climbs as far as restrictions on the company's business activities and licences. The Philippine change is narrower but practically significant: it strips the AEP function out of DOLE's regional offices and centralises all processing — both first-time applications and renewals — at the DOLE Central Office (the Bureau of Local Employment) in Manila.

The shift in each case is real. In Indonesia, outsourcing had been used broadly across many functions, and the legal exposure for unpaid wages or unremitted social-security contributions sat largely with the labour provider; a client could, in practice, hold the contract at arm's length. That arm's-length comfort is gone — liability now reaches up the chain to the company benefiting from the labour, and the permitted uses of outsourcing have been deliberately compressed to six categories. Recognising how disruptive that re-scoping is, the regulation grants a two-year transition window running to 30 April 2028, during which existing arrangements must be brought into line. In the Philippines, AEPs were previously processed locally by the DOLE regional office covering the place of work, which was convenient but uneven; from 9 June those regional offices have ceased the function entirely and every file now routes through Manila. The centralisation is openly tied to clamping down on permit abuse linked to offshore-gaming (POGO) operations, so applicants should expect not just a single national queue but closer central scrutiny of the labour-market justification for each foreign hire.

The practical consequence in both jurisdictions is the same: labour-related compliance now carries more cost, more documentation and longer lead times than it did a quarter ago, and the burden has shifted onto the investor rather than the local intermediary.

What this means for Chinese investors — For Chinese investors, this is a two-front compliance task with hard deadlines. In Indonesia, any manufacturing, mining or services operation that relies on outsourced labour should map every outsourced role against the six permitted categories now, pull non-conforming functions back onto direct payroll, re-paper and register all outsourcing agreements within the three-working-day window, and — because the user company is now on the hook for the provider's wage and social-security compliance — build active vendor-monitoring into the contract and into operations, all before the 30 April 2028 transition closes. In the Philippines, treat the Manila centralisation as a real bottleneck: file AEP applications and renewals earlier than before to absorb the single national queue, ensure the labour-market justification for each foreign hire is well documented to withstand tighter central scrutiny, and avoid letting any incumbent foreign employee's permit lapse during the transition.

Philippines: a faster, lighter business exit (BIR RMC 47-2026) — plus a hard 30 June stamp-duty deadline in Malaysia

On 19 May 2026 the Philippine Bureau of Internal Revenue (the BIR, the country's national tax authority) issued Revenue Memorandum Circular No. 47-2026, which took effect immediately on issuance. The Circular is an implementing measure under the Ease of Paying Taxes Act (Republic Act No. 11976), and its subject is something every foreign investor eventually confronts: how to formally close a company and cancel its tax registration. It applies expressly to all business taxpayers on the BIR's rolls, domestic and foreign alike.

In practical terms, the Circular re-engineers the de-registration process in three ways. First, applications may now be filed electronically — through the BIR's Taxpayer Registration-Related Application (TRRA) portal or its Online Registration and Update System (ORUS) — rather than only across an RDO (Revenue District Office) counter. Second, the documentary burden is pared back to essentials: the application form, surrender of the original registration papers and permits, an ending-inventory list and an inventory of unused invoices. Third, and most usefully, penalties for non-filing stop accruing once a complete application is lodged: the tax-form types are immediately tagged 'deregistered', which closes the door on new open cases. For 'micro' taxpayers — those whose preceding-year gross sales were no more than PHP 3,000,000 (at an indicative RMB 0.128 to the peso, about RMB 384,000; the same applies below) or whose gross assets on retirement are no more than PHP 8,000,000 (about RMB 1.02 million) — tax clearance now issues within three working days of a complete submission, with no mandatory closure audit.

The shift here is real. Until now, winding up a Philippine entity was an open-ended, audit-heavy affair: clearance could drag on indefinitely, and because penalties for unfiled returns kept accruing throughout, a dormant subsidiary left in limbo quietly accumulated liabilities. The Circular replaces that with a defined, largely electronic path on which the penalty clock stops at the point of complete filing. But the relief is calibrated by size. Any entity above the micro thresholds — which is where most foreign-owned operating subsidiaries sit — and any taxpayer already under an open Letter of Authority (an LOA, the BIR's formal audit mandate) must still clear an audit before the registration can be cancelled. The three-working-day headline is genuine, but it is a micro-taxpayer benefit, not a universal one.

Running alongside this, one regional diary item demands attention precisely because of its date. Malaysia's Stamp Duty Special Voluntary Disclosure Programme (SVDP 2026) closes on 30 June 2026. Under the programme, instruments that were never stamped or were stamped late (the waiver covers only instruments executed between 1 January 2023 and 31 December 2025, regularised within the 1 January to 30 June 2026 window) can be regularised through the LHDN e-Stamp system with a full, 100% waiver of the late-stamping penalty, and instruments so regularised are not subsequently audited absent fraud. Once the window shuts, that penalty relief is gone.

What this means for Chinese investors — For Chinese investors the two items pull in opposite directions on timing. In the Philippines, exit and group-rationalisation friction has genuinely fallen — closing a dormant or surplus subsidiary is now cheaper and faster, and the penalty bleed stops the moment a complete application goes in — but build your exit timeline around the audit, not the three-day headline, because any operating sub above the PHP 3M / PHP 8M micro thresholds, or any entity already under an open LOA, still has to clear a closure audit first. In Malaysia, the clock is the point: this is the month's most time-critical action. Sweep your Malaysian deal files now for any unstamped or late-stamped instrument executed between 2023 and 2025 — share transfers, agreements, security documents — and regularise it through e-Stamp before 30 June 2026 to lock in the 100% penalty waiver; after that date the relief is unavailable and the ordinary penalty regime resumes.

2. Vietnam: Merger Thresholds Double, Penalties Harden, and AI Decree Goes Cross-Border

Vietnam doubles its merger-filing thresholds while putting real teeth into competition enforcement

On 18 May 2026 the Vietnamese Government issued Resolution No. 66.18/2026/NQ-CP, which sharply raises the financial thresholds that trigger a mandatory merger notification. The new ceilings take effect on 1 July 2026 and apply on an interim basis until 28 February 2027, when they are due to sunset unless made permanent. In the same window the Government brought Decree No. 102/2026/ND-CP into force on 20 May 2026, overhauling the penalties for getting competition compliance wrong. The two instruments pull in opposite directions — one lightens the filing burden, the other makes the consequences of a misstep far heavier — and they have to be read together.

Under Vietnam's merger-control regime, a transaction must be notified to the competition authority, and cleared before completion, if it crosses any one of several thresholds. Resolution 66.18 doubles the three financial triggers. The threshold based on a party's total Vietnamese assets or revenue rises to VND 6,000 billion (approximately USD 228 million; USD figures converted at the rate used throughout this briefing), up from VND 3,000 billion, and the deal-value threshold rises to VND 2,000 billion (approximately USD 76 million).

Crucially, the third trigger — a combined market share of 20% or more in the relevant market (the parties' total share once they are added together, abbreviated 'CMS') — is left untouched, as are the separate, lower thresholds that apply to the finance, insurance and securities sectors.

The practical effect is to thin out the population of deals that need clearing. Until 1 July, an acquisition with a Vietnamese asset or revenue footprint above VND 3,000 billion was caught; from that date the line moves to VND 6,000 billion, so a whole tier of mid-sized transactions that previously required a filing will no longer need one — unless the 20% combined-share trigger still bites, or the deal sits in one of the lower-threshold regulated sectors. Timing therefore becomes decisive: a filing lodged before 1 July is assessed against the old, lower numbers, while any deal closing inside the 1 July 2026 to 28 February 2027 window must be re-tested against the new ones.

While fewer deals will need filing, the price of misjudging that question has gone up and become far more predictable. Previously, sanctions for failing to notify or for 'gun-jumping' — closing or integrating a deal before the required clearance is obtained — were calculated as a percentage of turnover and were both uncertain in amount and inconsistently applied. Decree 102/2026 replaces that with fixed monetary penalty bands of up to VND 2 billion per party, and arms the authority with powers it did not meaningfully wield before: it can revoke a clearance already granted and order divestiture of a completed transaction where a party has provided false or falsified information, forced others to do so, or concealed or destroyed information that resulted in a distorted outcome. A failure-to-notify problem that once carried fuzzy, turnover-linked exposure now carries a hard number and a genuine risk of unwinding the deal.

What this means for Chinese investors — For Chinese investors the message is two-sided: fewer Vietnamese deals will require a merger filing, but the cost of getting the filing analysis wrong is now a fixed, certain sum backed by clear unwinding powers. The right response is to run a rigorous threshold analysis at signing rather than treating filing as a formality — test all three triggers, not just deal size, because the unchanged 20% combined-share trigger and the lower finance/insurance/securities thresholds will continue to catch deals that fall below the new VND 6,000 billion line. Document that analysis contemporaneously so the decision not to file is defensible, watch the 1 July 2026 effective date closely (filing before it locks in the old lower thresholds; closing after it forces a re-test), and keep the 28 February 2027 sunset on the calendar in case the thresholds revert.

Vietnam: AI Decree 142/2026 takes effect and reaches across the border — foreign AI providers are now in scope without a local entity

On 1 May 2026 Vietnam's Government brought Decree No. 142/2026/ND-CP into force, the first implementing decree under the Law on Artificial Intelligence (Law No. 134/2025/QH15, itself in force since 1 March 2026). The Law set the architecture; this Decree is the first piece of machinery that makes it operational, and it does so with a feature that should command the attention of every Chinese technology group selling into Vietnam: it applies expressly across the border.

In practical terms, the Decree sorts AI systems into three tiers by the level of risk they pose — high, medium and low — and attaches obligations to each. For medium- and high-risk systems, the provider must give the Ministry of Science and Technology (MST, the line ministry for technology policy) advance notice before deployment. Crucially, that notification runs on a self-declaration basis: the provider classifies its own system and files its own declaration, rather than waiting for a license or a government pre-approval. Separately, AI-generated content must be labelled as such, so that users can tell when they are interacting with, or consuming output from, a machine. The Decree is also deliberately light on intrusion into proprietary technology: it does not require providers to hand over source code, model weights or training data, which is a meaningful protection for anyone whose commercial value sits in exactly those assets.

The shift this represents is best understood against what came before. Until the Law on AI and this Decree, Vietnam had no dedicated, horizontal AI statute — AI activity was governed only obliquely, through general laws on cybersecurity, data and e-transactions, and there was no risk-tiering, no pre-deployment notification step, and no labelling duty specific to AI. Most consequentially, there was no express statement that the regime reached providers outside Vietnam. That gap is now closed. By stating its extraterritorial application on the face of the Decree, Vietnam has made clear that a foreign company supplying an AI system to the Vietnamese market is caught even if it has no subsidiary, branch or other registered presence in the country. The trigger is serving the market, not being established in it.

The picture is not yet complete, and the missing piece matters. The list of systems that count as 'high-risk' is to be issued separately by the Prime Minister, and that list is still pending. Until it appears, the precise outer edge of the heaviest obligations cannot be drawn with certainty — a system that looks medium-risk today could be reclassified upward once the list lands. The labelling duty and the basic notification framework, however, are live now and should be treated as present compliance obligations, not future ones.

What this means for Chinese investors — For Chinese technology and AI investors, this is directly on point and the single most important takeaway is jurisdictional: you do not need a Vietnamese entity to be regulated. Any group offering AI products or services into Vietnam — chatbots, generative tools, recommendation or scoring engines, embedded AI features in a wider platform — should now inventory those systems, classify each against the high/medium/low tiers, and prepare to file an MST self-declaration before deploying anything that falls in the medium or high band. Because the model is self-declaration rather than pre-approval, the realistic risk is not being blocked at the gate but getting the classification wrong and being exposed later, so the classification analysis should be documented and defensible. Build the AI-content labelling requirement into product and UX now, since it already bites. And keep a close watch for the Prime Minister's high-risk-system list: it will define the perimeter of the heaviest obligations, and a system you have treated as medium-risk may need to be re-papered the moment that list is published. The comparatively investor-friendly design — self-declaration, and no forced disclosure of source code, weights or training data — is a genuine plus, but it is the cross-border reach that changes the planning calculus.

3. Thailand: nine foreign-business categories to shed their licensing requirement — and a new power pre-condition for data centres

On 12 May 2026 the Thai Cabinet approved in principle a package that would lift the Foreign Business Licence requirement from nine categories of business now restricted to foreigners. Absent special privileges, the Foreign Business Licence (FBL) is the permission any foreign person (including any company with 50% or more foreign ownership) must obtain from the Ministry of Commerce before it may operate in a long list of "restricted" activities under the Foreign Business Act B.E. 2542 (1999) — a discretionary, multi-month approval that has long been the single biggest friction point for foreign operators in Thailand. The package removes eight service and agency activities and agricultural-futures trading with physical delivery from the restricted list. This is a Cabinet decision in principle only and the drafts are still under review by the Council of State (Thailand's legislative-drafting and review body) and have not yet been published in the Royal Gazette, which means none of it is yet in force.

In practice the impact is modest. Treasury, shared-services and intra-group financing functions are already run 100% foreign through BOI (Board of Investment) promotion — an IBC (international business centre) or a TISO (trade and investment support office) — which carries its own FBA exemption, so for groups structured that way the reform changes little. Its value is for operations sitting outside the BOI-promoted route, and as a signal of Thailand trimming FBA friction. The development to plan around is the data-centre power pre-condition below.

Running alongside this, a second and unrelated change is already operating. From 30 March 2026 the BOI — Thailand's investment-promotion authority — requires every data-centre application for BOI incentives (promotion category 8.2.1) to come with a written confirmation from the Energy Regulatory Commission (ERC) that sufficient electricity supply is available for the project. In effect, grid capacity has become a documented pre-condition of the incentive application rather than a problem to be solved after approval. The detailed ERC procedure and the criteria it will apply have not yet been issued, so the precise evidentiary bar remains open — but the gate itself is live now, against the backdrop of the data-centre and hyperscale boom that has become Thailand's dominant inbound-investment theme. It should be read together with the separate watch item on the NBTC's proposal to reclassify data-centre services from Type 1 to Type 3 telecom (which would carry a Thai-majority ownership condition) — the two together mark a quieter, restrictive counter-current beneath the headline liberalisation.

What this means for Chinese investors — For Chinese groups, the FBA reform is welcome but should modest in practice. The treasury, shared-services and intra-group financing functions it frees are the ones regional operators already run 100% foreign through BOI promotion — an IBC or a TISO — which carries its own FBA exemption; for groups already structured that way it changes little. Its real value is for operations outside the BOI-promoted route, which currently need a standalone FBL, and as a signal that Thailand is willing to trim FBA friction. Treat the timing with discipline: this is in-principle only, so plan around the eventual Royal Gazette date, not the 12 May Cabinet approval (estimated one to three months for the Ministerial Regulation and two to four months for the Royal Decree). The more immediate, hard-edged item is the data-centre power pre-condition: anyone weighing a data-centre, hyperscale or EV-related investment in Thailand — particularly in the EEC — now needs ERC confirmation of electricity supply built into the BOI application, so engage the ERC and the utilities early, treat grid readiness as a gating diligence item, and read it together with the NBTC Type 1-to-Type 3 telecom-reclassification watch when sizing the risk to any data-centre ownership structure.

4. Singapore: a new online-safety regime arrives and the first wave of company-law reform lands

Two distinct reforms reshaped the Singapore legal landscape this period, and although they sit in different corners of the statute book they share a common thread — the state moving from soft guidance to hard, enforceable duties. The first is the Online Safety (Relief and Accountability) Act 2025 ("OSRAA"), enacted on the recommendation of the Ministry of Law and the Ministry of Digital Development and Information, which commences on 29 June 2026 together with a newly created Online Safety Commission. The second is the first tranche of the Corporate and Accounting Laws (Amendment) Act 2025 — passed by Parliament on 5 November 2025 and amending the Companies Act 1967 — which took effect on 6 May 2026, with further tranches to follow.

What OSRAA actually does is create a set of statutory torts: civil wrongs, defined by statute, that a person harmed online can sue over directly. The Act fixes duties on three categories of actor — a "Communicator" (whoever posts the offending content), an "Administrator" (whoever runs the group or page where it appears), and a "Platform" (the underlying service itself) — to address a defined list of online harms. A victim who establishes a breach can obtain real court remedies, including damages and injunctions ordering the material taken down. Larger services, and those with greater reach into the Singapore population, carry additional obligations on top, most notably statutory response-time requirements for acting on complaints. The Online Safety Commission stands behind this as the body administering and enforcing the regime.

The before-and-after is the point. Until 29 June 2026, online-harm remedies in Singapore were piecemeal — a patchwork of content-removal directions issued by regulators under the broadcasting and online-communications codes, plus whatever a claimant could squeeze out of defamation or harassment law. There was no single, purpose-built civil cause of action a harmed individual could bring directly against the poster, the group administrator and the platform, and no statutory clock forcing platforms to respond. OSRAA replaces that gap with a dedicated, litigable framework: the duty is now express, the defendant classes are named, the remedies are court-ordered, and for sizeable platforms the response window is a legal obligation rather than a matter of goodwill.

The company-law tranche works the same shift in the corporate sphere. Selective share buy-backs — where a company repurchases shares from some shareholders but not all — now require two-tier 75% approval: separate special resolutions from all shareholders excluding the seller, and from the affected class excluding the seller, closing a route by which a controller could previously push a selective buy-back through on a single shareholder vote. The maximum fine for breach of a director's duty rises fourfold, from S$5,000 to S$20,000 (at roughly RMB 5.35 to the Singapore dollar, about RMB 26,750 and RMB 107,000 respectively). And every audit report must now name the individual public accountant responsible for it, putting a personal signature behind the firm's opinion. Each change tightens accountability — of controllers, of directors, and of auditors — and together they signal the direction of the tranches still to come.

What this means for Chinese investors — For Chinese investors the two reforms call for action on two different levels. If you back or operate a digital platform, social-media service or content business with a Singapore user base, OSRAA is a genuinely new compliance-and-litigation exposure: from 29 June 2026 you can be sued directly under named statutory duties, so build those duties into product design, content-moderation workflows and — for larger platforms — the complaint-handling clock now, before commencement, rather than retrofitting them after the first claim lands. At the corporate level, if you hold or are acquiring a Singapore company, refresh the governance basics: re-paper your selective buy-back approval mechanics to satisfy the two-tier 75% test, brief directors that the price of a duty breach has quadrupled, and expect named-accountant audit reports. With further tranches signalled, treat 6 May 2026 as the start of a moving target and keep a watching brief.

5. Malaysia: a consumer-credit licensing regime, enforceable online-safety codes, and a higher listing bar all land at once (May–June 2026)

Three distinct Malaysian reforms took effect within a fortnight of each other, each changing the rules of entry in a different sector. First, on 1 June 2026 Part V of the Consumer Credit Act 2025 (Act 873) came into force, and with it a brand-new regulator: the Consumer Credit Commission, known by its Malay acronym SKP (Suruhanjaya Kredit Pengguna). The companion Consumer Credit (Fees) Regulations 2026 followed on 5 June 2026. In plain terms, Malaysia has, for the first time, drawn a single licensing perimeter around the previously unregulated corners of consumer lending. Businesses offering buy-now-pay-later (BNPL), leasing or factoring must now hold an SKP licence to operate; those in debt collection, impaired-loan acquisition or debt management must register with the SKP. A six-month transition window runs from 1 June 2026, so incumbents have until the end of November to come into the system.