You have been asked to take a matter in three countries. Which parts can you actually do?

The Asia-Pacific Cross-Border Investigation Compliance Pack answers that in one table, then shows the working. Ten jurisdictions, with a declared review date on each and the source named where it is not the official register.

The problem this solves

Cross-border investigation work fails on the same question every time: is this activity licensed where I am about to do it? Practitioners expect that question to have two answers. It has three, and the third is the one that costs money.

Ask "is investigation licensed in Vietnam" and the honest answer is no. Act on that answer and you will miss that, since 1 July 2026, data analysis and aggregation and personal data processing are conditional business lines there, and that the statutory definition of processing expressly covers collection, analysis and aggregation. The work is licensed. It is simply not called investigation.

What is in it

• The decision matrix. Ten activities against ten jurisdictions, in two grids because the ASEAN seven and the wider Asia-Pacific three do not answer along the same axis: advertising, investigating for reward, foreign ownership, serious-crime matters, covert surveillance, location tracking, breach data, open-source aggregation, hosting the file abroad, and publishing findings. This is the part that does not exist anywhere else.
• A ten-point pre-engagement checklist to run before the engagement letter is signed, each item there because getting it wrong is expensive.
• Per-jurisdiction essentials with the section numbers: what triggers the licence, what the penalty is, and the specific traps, including Malaysia's bar on enquiring into a seizable offence and Indonesia's classification mismatch.
• Engagement-letter language covering scope, method, breach data, jurisdiction, lawful basis and reportable matters.
• A currency table with the verified date, the next review date, and the evidence for each interval.
• A stated list of the pack's own limits, because a compliance document that hides its gaps is worse than none.

Why this is not another summary

The strongest evidence for that discipline is Vietnam. Every instrument an English-language guide cites for Vietnam has been replaced, all within eighteen months:

A guide written eighteen months ago is wrong on all six. You can check the working yourself before you buy anything: the free jurisdiction pages carry the findings, the primary sources and the last-verified dates. The pack is what those pages cannot be: the operational layer that turns them into a go or no-go before you accept a matter.

Who it is for

• Licensed investigation agencies taking instructions that cross an Asia-Pacific border.
• Law firms instructing investigators regionally and needing to know what their instruction can lawfully ask for.
• Corporate risk, compliance and internal audit teams running enquiries across regional subsidiaries.
• Insurers and their appointed investigators handling claims with a regional element.

What it is not

Questions

Which states are covered?

Singapore, Malaysia, the Philippines, Thailand, Indonesia, Vietnam, Laos, Hong Kong, Japan and South Korea. Of the ASEAN member states, Brunei, Cambodia and Myanmar are not. Cambodia and Myanmar have a text source but no status register, and Brunei's Attorney General's Chambers site is currently not serving at all, so it cannot be started. Those three are covered by the update entitlement as they land, though on present evidence none of the three can be written to this pack's standard until that infrastructure exists.

What do the twelve months of updates include?

Every revision published in that period: new jurisdictions as they are written, and the scheduled reviews. Four of the ten are on a 180-day cycle rather than an annual habit. Three of those because their law is actually moving, and South Korea because the evidence behind it is thin and says so.

How is it delivered?

As a print-ready document you can keep on file and take into a matter. There is no login and no portal to lose access to.

Who am I contracting with?

For the pack, AI9OS.COM (UEN 53527859D), a Singapore sole proprietorship. What you are buying is a publication: research on what the law permits. It is not advice on your matter, and it is not an investigation.

If a matter needs licensed investigative work in Singapore, that is contracted separately with Spyrrus Tech Pte Ltd (UEN 202022197D), an affiliated company holding a private investigation agency licence under the Private Security Industry Act. The two are deliberately kept separate, and this page does not sell the second. If you need it, ask and you will be told plainly which of the two you are dealing with and why.

Why should I trust a one-person operation on this?

Do not, on assertion. Read a jurisdiction page first. Every claim on it cites the instrument and the provision, the sources are linked, the last-verified date is on the page, and where something could not be verified the page says so in the open. That is the same standard the pack is held to. If the free pages do not convince you, the pack will not either.

The two companion documents

Neither repeats the matrix. One of them is not sold on its own, and the reason is given rather than hidden.

• Asia-Pacific Cross-Border Due Diligence Pack. The workflow and the record, not a second licensing matrix: eight stages with the jurisdiction gate at stage two, an evidence register schema, what does not count as corroboration, six red lines, and a report structure in which "what was not done" is its own section. It asserts no register availability anywhere, and says so at the top. Built for all ten jurisdictions. Sold only with the compliance pack, because it is a companion to that matrix rather than a separate answer: the same jurisdictions, the same matter, the same reader. Buying it alone would leave you running a workflow whose first gate you cannot answer.
• AI-Assisted OSINT Evidential Discipline Pack. It contains no prompts, deliberately. Prompt wording is the least durable thing in this field and it is not what fails under examination. It carries the one rule, the four classes of material that may never enter a prompt with the pseudonymisation technique that preserves the analysis anyway, a ten-step contamination ladder, a nine-field logging schema, the five sourcing failure modes drawn from a real audit that found 63 defects in a delivered bundle, and a disclosure paragraph for when a regulator asks. The worked example deliberately records two model errors, because a log with no corrections in it is not evidence of a clean process. This one is sold on its own, because it answers a different question from a different reader: it is about method, not jurisdiction, and it is as useful to someone working one country as ten.

What it costs