Regional Watch · October 22, 2026
Criminal enterprises stole as much as US$114 billion from Asia-Pacific victims in 2025, according to a UN report released in July. That is more than triple the figure of two years earlier. Scam operations in this region are no longer a fringe crime. They are an industry, organised across borders and scaling fast.
Against that backdrop, in the space of one week, ASEAN welcomed a new five-year cyber strategy in Singapore and convened its ministers responsible for transnational crime in Manila to take on scam networks. The headlines read as unity. But ASEAN cybersecurity cooperation was never built to work like a single rulebook, and organisations that plan as if it does will find the gaps the hard way. Attackers already have.
A week that looked like unity
On 14 October, the 11th ASEAN Ministerial Conference on Cybersecurity in Singapore welcomed the ASEAN Cybersecurity Cooperation Strategy (ACCS) 2026–2030. Ministers called for faster operation of the ASEAN Regional CERT and its information sharing mechanism, timely sharing to disrupt cross border scam activity, interoperable technical standards, cooperation on securing AI systems, and preparation for quantum-safe migration. Singapore’s Minister Josephine Teo framed the case plainly: “A compromise in one country’s payment, telco or cloud provider does not always stop at the border.”
Six days later, the 20th ASEAN Ministerial Meeting on Transnational Crime opened in Makati City, with cybercrime, human trafficking and online scams on the agenda. The context is stark. Cambodia reported raiding 488 suspected scam locations and apprehending more than 20,000 people in the first half of 2026 alone. “No single nation can answer that alone,” said Philippine Interior Secretary Jonvic Remulla.
He is right. The harder question is what ASEAN, as an institution, can actually deliver.
Read the verbs
The Singapore Chairman’s Statement is a useful document, and it is worth reading closely. Participants welcomed, called for, encouraged and agreed to explore. Information sharing is to happen in line with each member’s national laws and with respect for its sovereignty over its data. The statement itself goes to the ASEAN Summit “for notation.”
None of that is a weakness of drafting. It is how ASEAN cybersecurity cooperation has always worked. The ACCS sets direction and builds trust between national CERTs. It does not create a regional regulator, a common breach notification rule, or a legal channel for a bank in one country to share fraud data with a telco in another. There is no ASEAN equivalent of the EU’s NIS2 or GDPR, and none is coming.
ASEAN was never designed to be a power
Writing in The Business Times this month, Leon Hadar put it bluntly: ASEAN “was never designed to be a power. It was formed to keep its members from fighting one another and to keep the great powers from dominating the region.” Its consensus-based decision-making, its principle of non-interference and the vast differences among its members “make coherent collective action a big challenge.”
Hadar’s point is not that ASEAN has failed. It is that the looseness is a feature, letting each member hedge and set its own course. Southeast Asia, he argues, is producing “a cluster of self-confident middle powers,” not a bloc.
Cyber governance is following the same pattern. Cisco’s ASEAN president, Tay Bee Kheng, made the commercial version of the argument in the same paper: “There’s nothing in common in Asean, except for one thing – rice.” Multinationals like to treat the region as one bloc because it is simpler. It is eleven economies, with different laws, priorities and levels of maturity.
Where ASEAN cybersecurity cooperation really happens
If the regional layer sets direction, the binding action is happening in three other places.
| Layer | Recent example | What it means for you |
|---|---|---|
| Regional | ACCS 2026–2030; ASEAN Plan of Action on Transnational Crime 2026–2035 | Direction of travel. Signals where national rules will go next (AI security, quantum-safe migration, IoT standards). Not binding. |
| National | Vietnam’s Law on Cybersecurity No. 116/2025/QH15 (in force 1 July 2026); Cambodia’s law on combating online scams (promulgated April 2026) | Where your obligations actually sit. Deadlines, localisation and penalties differ market by market. |
| Coalitions | Meta and the Royal Thai Police disabling 150,000+ scam centre accounts in a multi-country disruption operation (March 2026) | Where disruption actually happens: specific agencies, specific platforms, specific operations. |
The national layer is moving fastest, and it is diverging. Vietnam’s new law consolidates its 2018 Cybersecurity Law and 2015 Network Information Security Law, keeps data localisation, and requires covered providers to hand user information to the Ministry of Public Security within 24 hours of a request, or three hours in urgent cases. Cambodia’s new law sets prison terms for online scammers and up to life imprisonment for scam bosses whose operations cause deaths. Each is a serious national measure. Neither is an ASEAN measure.
The coalition layer is where results show up. The Meta and Thai police operation drew in partners from Singapore, the Philippines and Indonesia, but also from Japan, South Korea, Australia, the UK and Canada. Effective cooperation is being organised by whoever has the data and the mandate, not by regional membership.
The gap attackers use
Scam networks have no such constraints. They recruit in one country, operate from another, launder through a third and target victims everywhere. That is how a US$114 billion industry is built. Experts quoted by the South China Morning Post warn that agentic AI could let these groups “automate and scale their operations with unprecedented speed,” while the region still struggles with unwieldy rules on cross border data exchange.
The defender side has its own gap. Tay cited Cisco’s 2025 AI Readiness Index, and the numbers are worth stating side by side.
Attackers
Scaling now
Agentic AI lets scam groups “automate and scale their operations with unprecedented speed.”
ASEAN businesses
92% plan to deploy
AI agents within a year.
ASEAN businesses
Only 16% ready
Fully ready to leverage AI.
Criminals are adopting agentic AI at speed. Defenders are adopting it faster than they can govern it. That is a gap no ministerial statement will close.
What You Need to Know
- At the regional level, ASEAN cybersecurity cooperation under the ACCS 2026–2030 is a coordination framework, not an enforcement regime. It does not create shared legal obligations or data sharing rights.
- Binding cyber obligations in Southeast Asia sit at national level, and they are diverging, not converging.
- Operational disruption of scam networks is happening through bilateral and public-private coalitions, many of which reach well beyond ASEAN.
- Attackers operate regionally and are scaling with AI. Most defenders, and most rules, still operate one country at a time.
What You Need to Do
- Map obligations market by market. Replace any “ASEAN compliance” assumption with a per-country view of notification deadlines, localisation rules and authority request timelines. Vietnam’s three-hour urgent request window needs a playbook, not a policy.
- Build your own sharing channels now. Join the national CERT, sector ISAC and anti-scam programmes in each market you operate in, and agree the lawful basis for sharing fraud indicators with banks, telcos and platforms under each country’s data protection law before you need it.
- Run incident response for eleven jurisdictions. Test whether your team knows which regulator to notify, by when, and what data can leave the country during an investigation.
- Ask vendors for country-level proof. “ASEAN coverage” on a slide is not in-country presence, local data processing or a local response team. Ask market by market.
- Govern AI agents before you deploy them. Least-privilege access, approval gates for sensitive actions and full audit logs, set before the 92% becomes 100%.
- Read ASEAN frameworks as early warning. AI security, quantum-safe migration and IoT standards in the ACCS are likely to reappear in national rules. Start planning on that horizon.
One strategy, eleven rulebooks
The ACCS is worth having, and so is ASEAN cybersecurity cooperation more broadly. It builds the trust between national responders that makes faster cooperation possible, and it tells organisations where regulators are heading. But it will not do the work for you. In Southeast Asia, cyber resilience is still built country by country, partner by partner. The organisations that plan for eleven rulebooks, rather than one, will be the ones that are ready when an attack crosses a border.
This is the gap Logic Lock Group’s research is built for: country-level intelligence on regulation, vendors and threats across Southeast Asia, rather than a single regional average. For more on how data rules diverge across the region, see The Cost of Compliance vs. The Shifting Data Geography of SEA, and for the threat picture behind this post, our previous Regional Watch.
Sources
- Cyber Security Agency of Singapore, Chairman’s Statement of the 11th ASEAN Ministerial Conference on Cybersecurity, 14 October 2026.
- Cyber Security Agency of Singapore, Opening Remarks by Minister Josephine Teo at the 11th AMCC, 14 October 2026.
- Philippine Information Agency, DILG convenes ASEAN ministers against cybercrime, online scams, October 2026.
- Arab News, ASEAN ministers meet in Philippines to tackle cybercrime, scam hubs, 20 October 2026.
- Leon Hadar, The middle power moment arrives in South-east Asia – but not for Asean, The Business Times, 1 October 2026.
- Lionel Lim, The only common thing in S-E Asia is that we all eat rice: Cisco’s Asean president, The Business Times, 13 October 2026.
- Rajah & Tann Asia, Law on Cybersecurity comes into operation on 1 July 2026.
- Ghana News Agency (Xinhua), Cambodia’s new law on combating online scams promulgated, April 2026.
- Axios, Meta, Thai police shut down 150,000 scam accounts, 11 March 2026.
- South China Morning Post, ‘Fight fire with fire’: Southeast Asia urged to share data in war against scams, 6 October 2026.
