The government relations playbook for Southeast Asia

GR in SEA is not lobbying in the Western sense. It is the operating permission layer — understanding which ministries matter for your sector, how to navigate regulatory uncertainty before it becomes a crisis, and how to structure a company so that regulatory risk stays manageable. Most founders either ignore it until they have a problem or hire a PR agency when they need an operator.

What GR in SEA actually is.

In Washington or Brussels, government relations means lobbying — hiring firms to influence legislation, funding think tanks that shape policy, and placing allies in regulatory positions. In Southeast Asia, GR means something more fundamental: it is the function that keeps your operating license current, manages the relationship between your business model and the regulatory bodies that can disrupt it, and ensures that when a ministry official wants to understand what your company does, someone credible picks up the phone.

This is not a peripheral activity for technology companies in SEA. Indonesia's communications ministry (Kominfo, now Komdigi) can block access to platforms quickly — as it did in 2022, when several major gaming and payment services were briefly blocked for missing a registration deadline. Thailand's BOT and SEC have moved aggressively to regulate fintech products that they view as competing with licensed banking activities. Vietnam's data localisation rules have forced foreign tech companies to restructure their architectures at significant cost. The Philippines' BSP and IC have parallel approval requirements for insurtech products that can stall a launch for many months if the regulatory engagement is not begun early.

The companies that navigate this well share a common trait: they began engaging the relevant regulatory bodies before they needed anything. They contributed to public consultations. They attended industry working group sessions. They sent product briefings to ministry officials explaining what their technology does in plain language. They made it easy for regulators to understand them — and by making it easy, they built the goodwill that converted into expedited approvals, early warning of regulatory changes, and the informal access that turns a potential shutdown into a constructive conversation.

The ministry map: who matters for your sector.

Every sector in Southeast Asia has a primary regulator, a secondary regulator, and usually a third body that has adjacent authority and will assert it if you become large enough to be worth noticing. Founders often map the primary regulator correctly and ignore the others until they create a problem.

For fintech and payments in Indonesia: OJK (Otoritas Jasa Keuangan) is the primary financial services regulator, Bank Indonesia is the payments system regulator, and the communications ministry (Kominfo, renamed Komdigi in 2024) has authority over digital infrastructure including apps. You need relationships with all three because payment and e-money products are licensed by Bank Indonesia, lending and investment products by OJK, your app must register as an electronic system operator with Komdigi, and your data practices fall under the Personal Data Protection Law. Missing any one of these is a compliance gap that will surface at the worst possible moment — typically when you are in the middle of a fundraise or an acquisition discussion.

For edtech in Vietnam: the Ministry of Education and Training is the primary regulator, but the ministry responsible for digital platforms and content (the former Ministry of Information and Communications, merged into the Ministry of Science and Technology in 2025) also has authority, and the Ministry of Industry and Trade has authority over e-commerce if your platform transacts. For content-heavy platforms, the Authority of Broadcasting and Electronic Information (ABEI) has approval authority over content categories. An edtech company that obtains MOET approval without mapping these other requirements risks a content flag from a government review body triggering a suspension that takes months to clear.

For healthtech in the Philippines: the Food and Drug Administration (FDA) regulates medical devices and diagnostics, the Department of Health has authority over health information systems, the Insurance Commission regulates health benefit plans, and the National Privacy Commission has jurisdiction over health data. A telemedicine platform operating in the Philippines touches all four bodies. Founders who build the regulatory map in year one can sequence their compliance investments correctly. Founders who discover it in year two can spend months and significant legal fees catching up.

Regulatory sandboxes: how to use them and how not to.

Most SEA regulators have established fintech or technology regulatory sandboxes over the past five years. MAS in Singapore, OJK in Indonesia, BOT/SEC in Thailand, BSP in the Philippines, BNM in Malaysia, and SBV (State Bank of Vietnam) have all launched some form of sandbox mechanism. The theory is that sandboxes allow innovative products to operate under relaxed rules while regulators develop a permanent framework. The practice is more complicated.

Sandbox approval is not a right — it is a judgment call made by a regulator who needs to believe that your product serves a genuine public interest, that you are a credible operator capable of protecting consumers, and that the eventual fully-licensed version of your product is one they want to see exist. Regulators in SEA receive many more sandbox applications than they approve, and the applications that succeed are typically from companies that have already built a relationship with the regulator before applying, have a clearly articulated theory of how their product benefits the regulator's mandate, and have shown that they understand the regulatory constraints they are asking for relief from.

The other sandbox reality: approval does not guarantee the path to full licensing is clear. A sandbox period can end before the permanent licensing framework is complete, leaving the company in a legal grey zone. Sandbox entry should be accompanied by explicit conversations with the regulator about what the post-sandbox pathway looks like, what milestones trigger progress toward full licensing, and what the regulator's timeline is for codifying the permanent framework.

Hiring for GR: operators, not advisors.

The most common GR hiring mistake in SEA is confusing advisors with operators. A GR advisor — typically a former government official or a consultant with regulatory expertise — can tell you what the landscape looks like, who the key decision-makers are, and how the formal process works. This is valuable intelligence. It is not GR execution.

GR execution requires someone who attends the industry consultation meetings that the ministry runs, who has informal relationships with the mid-level officials who actually draft the regulations (not just the senior officials who sign them), who manages your regulatory filing calendar with the same rigor as a finance team manages cash flow, and who can pick up the phone when there is an informal signal that a regulatory change is coming that affects your business.

In Indonesia, the most effective GR hires for technology companies have typically come from within the regulated sector — former OJK examiners, former Bank Indonesia analysts, or senior compliance officers from Indonesian banks who have already built the relationships that matter. They command salaries of roughly 250-400 million IDR ($16,000-$26,000 USD) annually at manager level, significantly more at director level. This is not a cost item you defer. For a fintech company in Indonesia with a licence-dependent business model, the GR hire is as critical as the engineering hire.

Structuring for regulatory risk.

Beyond the relationship layer, GR has a structural dimension: how you incorporate, where you hold the operating license, and how you have structured the entity that touches the regulated activity. Most founders treat this as a legal question — and it is — but it is also a GR question, because regulators have opinions about corporate structures that affect how they treat your license applications.

In Indonesia, a foreign company operating a financial services product through a PT PMA (foreign-owned limited liability company) structure faces a different regulatory relationship than one that has localised its operating entity into a fully Indonesian-owned structure with a foreign technical services agreement. Regulators can be more comfortable supervising an entity they see as genuinely Indonesian, and that comfort can show up in how licence applications and examinations go. Where the operating entity can legitimately be separated from the IP and technology entity, this two-entity architecture is worth discussing with specialist counsel specifically for its GR implications.

In Vietnam, data localisation requirements under the Law on Cybersecurity and Decree 53/2022/ND-CP, alongside the personal data rules in Decree 13/2023/ND-CP, require that certain categories of data — including user personal data and data critical to national security — be stored on servers located in Vietnam. The compliance pathway for this requirement is not purely technical; it requires engagement with the relevant authorities on your data architecture and a formal notification or approval process depending on your data category. Companies that handle this engagement proactively avoid the disruption faced by companies that discover it reactively.

• 01
  Map all three regulators for your sector, not just the primary one. Every regulated technology product in SEA touches at least three regulatory bodies. Build the full map in month one, before your legal team starts filing anything. The secondary and tertiary regulators are typically where the compliance surprises come from, because founders over-invest in the primary relationship and ignore the others until they assert authority.
• 02
  Attend public consultations as a company, not a legal proxy. Ministries in Indonesia, Thailand, and Vietnam run public consultations on regulatory changes that are open to industry participants. Send your country lead, not your law firm. The visibility you build by showing up with product knowledge and a clear company perspective is worth more than the legal memo your law firm would have submitted. Regulators remember the companies whose operators showed up in person.
• 03
  Hire a GR operator before you apply for your first license. Not after you file, not after you encounter a problem — before you file. In Indonesia, Thailand, and the Philippines, the informal conversations that happen before a formal application determine how the formal application is received. A GR operator who has existing relationships at the relevant ministry can surface the informal requirements — format preferences, unstated completeness standards, timing considerations — that are not in the public filing guidelines.
• 04
  Brief your regulator on your product before you launch it. Schedule a briefing with the relevant ministry or regulatory body 60-90 days before your product launch. Not to get approval — just to explain what your product does, how it protects consumers, and how it complies with existing regulations. This briefing serves two purposes: it demonstrates transparency, which builds goodwill, and it surfaces any regulatory concerns early enough to address before they become a problem at launch.
• 05
  Treat your regulatory filing calendar as a revenue-critical system. License renewals, regulatory reporting submissions, and compliance certifications have deadlines. In SEA, missing a filing deadline triggers consequences that are disproportionate to the oversight — fines, license suspensions, and in some cases forced shutdowns that require months and significant legal costs to reverse. Assign ownership, build calendar reminders 60 days out, and treat the filing calendar with the same rigor as your financial close process.
• 06
  Join the relevant industry association for your sector in each market. AFTECH (Indonesia), Thai Fintech Association (Thailand), FinTech Alliance Philippines, and equivalent bodies for other sectors host regular working group sessions attended by ministry officials. Membership is inexpensive. Participation in working groups is where informal regulatory intelligence is shared — the draft circular that is circulating before it is published, the ministry's current enforcement priorities, the interpretation of an ambiguous regulation that the industry has agreed on. This intelligence is not available anywhere else.

Frequently asked questions.