Thailand SIM Card Rules 2026: New NBTC Requirements for Foreigners

What the New Thailand SIM Card Rules Change

On 15 May 2026, the NBTC published a notification on measures for the prevention and suppression of technology crime in the Government Gazette. The instrument took effect the following day and amends an earlier NBTC notification issued in August 2025. Its legal foundation is the Emergency Decree on Measures for the Prevention and Suppression of Technology Crime B.E. 2566 (2023), which the government later strengthened in 2025.

In practice, the regulator is closing the gaps that scam syndicates have exploited for years. Anonymous and bulk-registered SIM cards have powered call-centre fraud, fake investment schemes, and money-mule networks across the region. The updated rules therefore attack the problem at its source: the point where a customer registers a SIM, activates it, and connects it to a mobile network.

Four elements of the Thailand SIM card rules carry the most weight for foreigners. First, non-Thai nationals now face a hard cap on the number of SIM cards they can register. Second, identity verification has become stricter and largely passport-based. Third, the user must activate every newly registered SIM within a fixed window. Finally, telecom operators must block devices and users associated with technology crime at the network level.

The Three-SIM Limit for Non-Thai Nationals

The headline change for the expat community is a registration cap. Under the updated framework, a person without Thai nationality may hold a maximum of three SIM cards per service provider. The limit applies per operator, so the practical ceiling depends on how many networks an individual chooses to use.

This cap targets a genuine abuse pattern. Fraud operations have long relied on individuals registering dozens of SIM cards that were then resold or fed into automated calling systems. By limiting registrations, the NBTC reduces the supply of “clean” numbers available to scam networks while still leaving ordinary residents with enough lines for personal and work use.

For most expats, three SIM cards per operator is more than sufficient. However, the rule does create friction for specific groups. Long-term residents who manage multiple devices, separate business and personal lines, or maintain data-only SIMs for tablets and routers should audit what they currently hold. Anyone approaching the cap may need to consolidate numbers or spread registrations across operators in a deliberate way.

Why this affects more foreigners than it appears

The cap counts every SIM registered under your identity, including older numbers you may have forgotten. Expats who have lived in Thailand for several years often accumulate inactive SIM cards from previous phones, short-term promotions, or travel. Those dormant registrations still count. Consequently, a routine new purchase can unexpectedly hit the limit unless old lines are formally cancelled.

Identity Verification: Why Your Passport Now Matters More

Identity verification sits at the centre of the new Thailand SIM card rules. For non-Thai nationals, the passport is now the primary registration document. Operators must check it against reliable sources and confirm that the person presenting it is genuinely its holder.

Where a passport is unavailable, the rules permit limited alternatives. These include travel documents or certificates of identity issued by a foreign government, supported by additional Thai government-issued documents. Pink identification cards for non-Thai nationals and white cards for people without registered status are also recognised in defined circumstances.

Two further requirements deserve attention. Customers must generally complete registration in person at an operator’s branch or an authorised dealer, which ends fully remote sign-ups for many users. In addition, operators must build identity verification systems, including biometric checks, and obtain NBTC approval before those systems go live. Thailand is therefore moving toward biometric, liveness-based verification at the counter rather than a simple photocopy of a document.

This direction mirrors a broader regulatory theme. The same logic underpins Thailand’s advertiser identity verification rules for social media platforms and the wider push for verified digital identities across regulated services.

The 60-Day SIM Activation Deadline

The reform also introduces a strict activation window. Both Thai and non-Thai users must activate a registered SIM card within 60 days of registration. The deadline applies to everyone, so foreigners receive no special treatment here.

Missing the window does not automatically void the registration, but it does trigger an extra step. A user who fails to activate in time must return in person to re-verify their identity, confirming that they are the same individual who originally registered the number. Only after that re-verification will the operator activate the SIM.

This matters most for travellers and newcomers who buy a SIM on arrival and then delay setup. It also affects companies that purchase SIM cards in advance for future hires or new devices. A box of unactivated corporate SIM cards left in a drawer for three months will require staff to physically re-verify each line, which is an avoidable administrative cost.

SIM Box Devices, Blacklists, and Network-Level Enforcement

The 2026 rules push enforcement deep into the network itself. Operators must prevent SIM box and gateway devices capable of holding four or more SIM cards from connecting to mobile networks, unless the device holds a licence under the Radio Communications Act.

SIM boxes are the engine room of large-scale fraud. They let criminals route thousands of calls and messages through ordinary mobile numbers, disguising overseas scam traffic as local calls. By blocking unlicensed multi-SIM hardware at the network level, the NBTC removes a key piece of infrastructure rather than chasing individual scam calls after the fact.

Blacklisting reinforces this. Operators must refuse to register additional numbers for individuals listed in a technology-crime database maintained by the Royal Thai Police. The regulator can also order operators to suspend services quickly when a number is linked to fraud. As a result, a SIM connected to criminal activity can lose connectivity within hours rather than weeks.

What the Thailand SIM Card Rules Mean for Foreign-Owned Businesses

For international companies in Thailand, the new rules create real operational obligations. Connectivity is rarely the responsibility of a single department, so the impact spreads across HR, IT, procurement, and compliance functions.

Corporate SIM fleets and employee devices

Many foreign-owned businesses issue mobile lines to staff. Where a SIM card sits under an employee’s personal identity, the three-SIM cap and the activation deadline now apply to that individual. Companies should consider registering corporate lines under the company’s juristic-person identity where the operator allows it, and they should maintain a clear register of which SIM belongs to which person and device.

Procurement timing and onboarding

The 60-day activation rule changes how companies should buy SIM cards. Bulk purchasing well ahead of need now risks forced re-verification. A better approach is to align SIM procurement with actual onboarding dates, so new hires activate their lines promptly after registration.

Data retention and privacy exposure

Operators must collect and retain more identity data, including passport details and biometric records. Businesses that handle this information indirectly, for example by collecting employee documents to arrange corporate lines, take on a privacy duty under the Personal Data Protection Act. Holding passport scans without a clear retention policy is a quiet but real compliance risk.

How the Thailand SIM Card Rules Fit a Wider Anti-Scam Strategy

The SIM card reform does not stand alone. It is one pillar of an aggressive, multi-agency campaign against online fraud that has reshaped Thai digital regulation over the past two years.

Other pillars are already visible. Thailand has introduced know-your-customer rules for online advertising, requiring platforms to verify paying advertisers. Banks, meanwhile, have gained faster powers to freeze accounts suspected of fraud, which is why the question of unfreezing a Thai bank account has become a frequent concern for innocent account holders caught in the net.

Read together, these measures show a clear regulatory philosophy. Thailand is attacking fraud across the whole chain: the SIM that places the call, the platform that hosts the advertisement, and the bank account that receives the money. Foreign residents and businesses should expect verification, traceability, and data retention to become the default across every regulated service.

Practical Compliance Steps for Expats and Companies

Compliance with the Thailand SIM card rules is straightforward once you treat a mobile number as a regulated record. The following steps reduce the risk of disruption.

Individual expats should take the following actions:

• Audit every SIM card currently registered under your name and formally cancel lines you no longer use.
• Keep your passport valid, and update your telecom records promptly after any passport renewal.
• Activate any newly registered SIM card well within the 60-day window.
• Register new lines in person, and keep proof of registration in case re-verification is later required.

Foreign-owned businesses should go further:

• Map which corporate SIM cards are registered to the company and which sit under employee identities.
• Align SIM procurement with onboarding so that staff activate lines promptly instead of stockpiling them.
• Confirm that any multi-SIM routers, IoT modules, or gateway devices are properly licensed.
• Adopt a written retention and disposal policy for passport scans and other identity data.

Conclusion: Staying Connected and Compliant

Thailand’s 2026 SIM card reform is best understood as a maturing of digital governance rather than a barrier to legitimate users. The three-SIM cap, passport-based verification, the 60-day activation deadline, and network-level enforcement all share one purpose: making fraud harder while keeping honest connectivity intact.

For most expats, the practical burden is modest. For foreign-owned businesses, however, the Thailand SIM card rules touch procurement, HR, data protection, and IT governance at once. Companies that build the new requirements into routine processes will avoid disruption. Those that ignore them may face blocked registrations, disconnected lines, and unnecessary privacy exposure. A measured, well-documented response is the surest way to stay both connected and compliant.

Frequently Asked Questions

Authoritative references: National Broadcasting and Telecommunications Commission (NBTC) and the Ministry of Digital Economy and Society.