ASEAN Fintech Regulation: Foreign Neobank Access by Jurisdiction

In October 2025, Timor-Leste joined the Association of Southeast Asian Nations at the bloc's summit in Kuala Lumpur, becoming the eleventh member state. This comes as regional payments interoperability continues to expand across Southeast Asia.

Merchants across several member states now accept cross-border QR payments from wallets in neighboring jurisdictions. Furthermore, central banks have committed to Project Nexus, a Bank for International Settlements initiative designed to connect national instant-payment systems through a shared regional architecture.

For foreign-owned neobanks and fintech firms considering the region, this integration has a clear ceiling. The interoperability layer connects national systems that continue to control who may issue local-currency accounts, hold customer funds, or connect directly to domestic settlement.

A wallet regulated in one country does not gain the right to serve customers in another simply because the two countries' payment rails are visible to each other.

The decisive variable for foreign entrants is the distance a jurisdiction permits between the customer-facing product and the licensed institution that holds the funds and clears the transactions. That distance is set by each member state through voting-control requirements, licensing categories, and rail-eligibility criteria that vary substantially. Foreign-ownership caps, taken alone, tend to underweight the operational dimensions where genuine autonomy is decided.

How ASEAN Regulates Foreign Neobank Access to Local Financial Systems

Cross-border QR corridors expand what admitted domestic nodes can do, while Project Nexus is designed to connect participating national instant-payment systems; neither creates a regional fintech passport under which one national license authorizes operation elsewhere.
The decisive regulatory variable is the distance a jurisdiction permits between a foreign firm's customer-facing brand and the licensed institution that holds the funds and clears the transactions.
Singapore and the Philippines allow licensed non-banks to approach infrastructural independence; Malaysia and Thailand pair non-bank operation with preserved local dependencies.
Indonesia's non-bank payments perimeter requires majority domestic voting control regardless of foreign economic ownership, making regulatory authority attach to the domestically controlled entity.
Vietnam, Cambodia, Laos, and Brunei lean more heavily on licensed-provider eligibility and regulatory discretion; Timor-Leste's smaller grid now includes licensed fintechs alongside banks.
Institutional portability, whether a fintech can change its underlying local partner without losing customer identifiers, KYC records, and accumulated consents, is the most consequential and least examined dimension.

The Layered Structure of Foreign Access

The useful frame for analyzing foreign fintech access in ASEAN is a layered one. It begins with interface control, or whether the foreign firm can contract with the customer directly, own the brand, and set pricing. Across the region, this dimension has generally been the most permissive.

The picture changes at the next layer, regulated liability. This concerns whether the foreign firm can hold customer funds itself under its own license or must route them through a locally licensed bank or e-money issuer. This is where the region's variation becomes substantive.

A firm that owns the brand while another institution carries the regulated liability or safeguards the balance has ceded a portion of its operational independence to that local partner.

The remaining dimensions concern operational reach. Compliance control asks who performs onboarding and transaction monitoring, and who bears legal responsibility for those functions. Grid access asks whether the firm can participate directly in national instant-payment, QR, and settlement systems or must connect through a sponsoring participant.

Institutional portability, the least examined dimension, asks whether the firm can change its underlying local partner without losing account identifiers, KYC records, or customer consents accumulated over time.

These dimensions do not co-vary neatly. A jurisdiction can be liberal on interface control while restrictive on regulated liability, or open on both while retaining restrictions on grid access. This is why aggregate metrics such as foreign-ownership percentages produce misleading rankings.

A jurisdiction that permits full foreign ownership of a firm operating through a sponsor bank may offer less effective autonomy than one that caps ownership at half but grants the licensee direct settlement access.

Three Regional Regimes

Read through this frame, the region divides into three broad regimes plus a residual category. The first regime, illustrated most fully by Singapore and, in a more graduated form, the Philippines, allows a licensed non-bank to approach substantial infrastructural independence.

In Singapore, a Major Payment Institution licensed under the Payment Services Act can be licensed for account issuance and e-money issuance. Eligible non-bank financial institutions can connect directly to the country's instant-payment systems once admitted as participants. The Monetary Authority of Singapore therefore allows a non-bank provider to move materially closer to the settlement layer without becoming a bank.

The Philippines applies similar logic in a more permissioned form. For purposes of registration as an operator of a payment system, the Bangko Sentral ng Pilipinas does not impose a foreign-ownership restriction, although activities such as e-money issuance require their own authorization. Qualifying non-bank electronic-money issuers can hold settlement accounts in the country's real-time gross settlement system.

The second regime pairs meaningful non-bank operation with preserved local institutional dependencies. Malaysia formally recognizes a white-label arrangement where a fintech partner carries the brand while an approved e-money issuer retains regulated responsibility for the underlying funds and operations.

The digital-bank framework published by Bank Negara Malaysia through a limited application process gives licensed digital banks substantially incumbent-parity access to the domestic grid once operational.

Thailand occupies a similar dual position with different mechanics. Non-bank e-money issuers can participate in wallet products connected to PromptPay, the country's national instant-payment system. However, prepaid funds remain subject to safeguarding requirements and material changes in control remain regulated.

The virtual-bank framework published by the Bank of Thailand uses a restricted licensing process aimed in part at serving unserved and underserved retail and SME customers.

The third regime is where foreign capital and technology can sit above the local grid while the regulated payment node itself remains domestically controlled. Indonesia illustrates this most fully.

Qualifying non-bank payment service providers must maintain at least 15% domestic share ownership and at least 51% domestic voting control under Bank Indonesia's payment-system framework. A foreign investor may hold most of the economic interest, but the regulated payment provider must satisfy Indonesia's domestic ownership and control requirements.

Across these three regimes, the operating model available to a foreign firm shifts substantially. In the first, the firm can be the licensed institution itself. In the second, it can control brand and interface while the local institution remains legally visible. In the third, the local partner cannot be a mere technical vendor.

The commercial calculation moves from license acquisition to license negotiation to structured domestic partnership.

Membership Markets and a Non-Comparable Case

The remaining ASEAN jurisdictions are best understood through partner eligibility, licensed-member access, and regulatory discretion. Vietnam's sandbox has been narrow in scope, concentrated on credit scoring, open-API data sharing, and peer-to-peer lending. Payment-intermediary services sit under a separate licensing regime administered by the State Bank of Vietnam.

Foreign firms can participate at the interface, technology, or orchestration layer, while regulated payment-intermediary functions require the relevant State Bank authorization.

Cambodia and Brunei operate on membership-based or sandbox-mediated access to national infrastructure. Cambodia's Bakong system, administered by the National Bank of Cambodia, provides broad interoperable connectivity. However, participation depends on membership through a regulated bank, financial institution, or payment-service provider.

Brunei's fintech sandbox, operated by the Brunei Darussalam Central Bank, is a regulator-mediated route toward substantive licensing, distinct from general market authorization.

Laos's Payment System Law recognizes non-bank legal entities as eligible providers subject to Bank of the Lao PDR authorization, so practical liberty depends on discretionary licensing decisions. Timor-Leste, the region's newest member, has a small and still-developing grid in which licensed fintech companies now operate alongside banks. The central bank has been introducing instant-payment infrastructure progressively.

In each of these jurisdictions, market access depends less on technical interoperability than on the status and permissions of the locally regulated participant.

Myanmar sits outside this comparative frame. The Financial Action Task Force has continued to identify the country as a high-risk jurisdiction subject to a call for action. FATF status, exchange controls, correspondent-banking constraints, and institutional fragility materially complicate any formal license analysis. Standard ASEAN expansion planning does not usefully extend to Myanmar under current conditions.

What Portability Buys

The most analytically distinct dimension across the region is institutional portability. It can be read as an allocation of institutional property rights between the foreign fintech and its local sponsor. When a foreign firm enters an ASEAN market through a sponsor relationship, the practical question is whether the customer relationship remains movable. Ownership of the interface does not by itself confer that mobility.

Portability turns on who controls the customer's payment identifier - the account number or QR alias by which the customer transacts - and who holds the authoritative KYC record. Whether customer consent to fund transfers, credit reporting, or third-party data sharing can be transferred to a replacement institution may turn on regulation, customer terms, and bilateral contract.

The same applies to safeguarded balances. Where prepaid funds are held with a specific safeguarding institution under a specific arrangement, migrating those balances collectively to a replacement institution can require customer authorization, regulatory approval, or both, depending on the structure. The fintech's own ledger may or may not be the legally controlling record; that record generally remains with the licensed institution underlying the product.

Regulatory frameworks in the region do not generally provide a clean answer to these sponsor-portability questions. Rules that facilitate portability between licensed providers do not necessarily govern substitution of the licensed institution underneath a fintech product. The terms of substitution between a fintech and its underlying sponsor are therefore often set at the point of the sponsor contract, before the entrant has customer volume or market position to negotiate from.

The economic weight of these questions accumulates over time. In early market entry, when the sponsor relationship is fresh and customer volume is small, the constraints feel manageable. As the customer base grows and the fintech's value increasingly resides in accumulated identifiers, KYC records, consents, and transaction history that may not be portable without the sponsor's cooperation, the cost of substitution rises. The sponsor's negotiating position strengthens correspondingly.

A foreign-owned neobank can therefore appear operationally independent while remaining structurally captive. Its brand, customer relationship, and pricing may be its own. Its access to safeguarded funds or deposits, payment identifiers, and settlement may not be. Whether these elements can be moved without rebuilding the product from scratch separates a sustainable regional strategy from one renewable only at the current sponsor's discretion.

Cross-border QR connectivity has expanded across ASEAN, while Project Nexus is intended to connect participating national instant-payment systems through a common architecture. What this integration delivers, at present, is amplification of the domestic node an entrant already holds. It does not deliver a regional passport under which one license authorizes operation elsewhere in the bloc.

For foreign neobanks and fintechs, the practical implication is that ASEAN market entry accumulates jurisdiction by jurisdiction. Effective autonomy depends on the specific licensing category obtained, the specific sponsor or licensed-partner relationship established, and the specific transferability rights negotiated at the outset.

The distance a jurisdiction permits between brand and balance sheet has become the operative regulatory question in the region.

The unresolved question concerns what happens as the shared payments layer deepens. If cross-border QR volumes continue to grow and Project Nexus proceeds toward live operation, the value of holding admitted domestic endpoints will rise. The competitive gap between firms that hold them and those that do not will widen.

The regulatory choice each ASEAN member has made about foreign access will then determine, more than it currently does, which firms can build a genuinely regional franchise.