The growth of the middle class, tech-savvy population and dynamic e-commerce ecosystems is fuelling the burgeoning fintech sector in Vietnam, accompanying mature geographies in the Asia-Pacific (APAC) such as China, Australia, and Singapore. Vietnam’s fintech market is witnessing the highest growth rate in ASEAN after Singapore and is predicted to reach a staggering USD18 billion by 2024.

As of June 2023, the State Bank of Vietnam (NHNN) has granted licences to 50 organisations to provide intermediary payment services. Specifically, in 2023, NHNN issued licences to five non-bank organisations, including two newly licensed entities: Mobicast Joint Stock Company and VETC Electronic Toll Collection Company Limited.

The Credit Institutions Law 2024, effective from July 2024, officially allows the pilot implementation of fintech solutions.

During the year 2023, NHNN submitted four proposals on the decree on the pilot mechanism for controlling financial technology (fintech) activities in the banking sector (sandbox). The latest proposal is Proposal No. 117/TTr-NHNN, dated 17 August 2023.

The most interesting development to watch out for in the next 12 months is a regulatory sandbox for fintech in seven fintech segments: 

• payment; 
• credit; 
• peer-to-peer (P2P) lending; 
• eKYC; 
• open API (application programming interface); 
• innovative technology application solutions such as blockchain; and 
• other services supporting banking operations (credit scoring, saving, crowd funding, etc). 

Additionally, within the banking sector, notable developments have occurred following the State Bank's initial circular on specific guidelines for electronic customer identification (eKYC) related to opening payment accounts. In 2023, two subsequent circulars from the State Bank came into effect, offering guidance on two electronic credit-granting methods. Circular No. 11/2022/TT-NHNN, effective from June 2023, addresses the prescription of online bank guarantees. Furthermore, in 2023 the State Bank of Vietnam (SBV) introduced Circular No. 08/2023/TT-NHNN, effective from 1 September 2023, on online lending by credit institutions.

A significant recent development impacting the fintech sector is the amended Law on Credit Institutions 2024, ratified by the National Assembly on 18 January 2024, and effective from 1 July 2024. This groundbreaking law approves new activities consistent with the digital transformation trend, such as online lending, electronic transactions, and the testing mechanism (Sandbox) for fintech in the banking sector. These activities are officially regulated in legal documents below the law level. According to this new law, the controlled testing mechanism in the banking sector serves as an environment for experimenting with technology applications and introducing new products, services, and business models within limited boundaries regarding scope, space, and implementation time. In principle, this regulation allows all new products, services, and business models in the banking sector to be deployed under the sandbox mechanism. While detailed regulations will be issued by the government later, this represents the most important legal foundation for completing the legal framework for the development of fintech fields and models in the future.

The primary business models prevalent among both new and established players can be categorised into two groups: those governed by specific legal regulations and those operating under a sandbox framework.

Models Governed by Specific Legal Regulations

The SBV has revised the current legislation to support credit institutions and banks applying new technologies during their operation. This includes guidance on various aspects such as cashless payment; intermediary services, the adoption of remote verification processes (namely e-KYC), digital lending, electronic guarantee and online opening of a personal accounts.

Among these advancements, mobile money has garnered significant attention and witnessed substantial progress. The Prime Minister approved a pilot programme for mobile money in Vietnam through Decision 316/QD-TTg on 9 March 2023 and Resolution 192/NQ-CP on 18 November 2023. This marks a significant stride in the development of payment systems utilising telecommunication accounts in Vietnam, with the pilot scheme extended until 31 December 2024.

Models under the Sandbox Scheme

As per the Law on Credit Institutions 2024, the controlled testing mechanism in the banking sector serves as an environment to test technology applications and introduce new products, services, and business models within defined limits in terms of scope, space, and implementation time. Organisations participating in this testing mechanism must meet specified conditions and criteria for approval, subject to supervision by competent state agencies. The government will provide detailed regulations and guidelines on approval criteria in the guiding decree. Through this regulation, the Law on Credit Institutions 2024 has opened the legal pathway for entities to introduce new offerings in the finance sector.

The draft decree regulating the controlled testing mechanism for financial technology activities in the banking sector allows for testing fintech solutions. These include credit granting on technology platforms, credit scoring, data sharing via an application programming interface (API), peer-to-peer lending (P2P Lending), application of blockchain technology, distributed ledger (Blockchain Technology, DLT) in banking activities, and the application of other technologies in banking operations. If products/services meet all conditions after the sandbox period, they may obtain official licences based on the assessment of the State Bank of Vietnam. This regulation in the Law on Credit Institutions is also in line with the provisions of the Law on Prevention of Money Laundering, effective March 2023, regarding the responsibilities of reporting subjects with existing products and services that apply innovative technology.

Regarding Insurtech, the legal framework has not yet been developed; however, for the first time, insurance enterprises are allowed to grant electronics certificates of compulsory insurance for civil liability of motor vehicle owners according to Decree 03/2021/ND-CP.

The legal framework for fintech in Vietnam is being developed at a rapid pace to meet demand. Payment intermediary regulations have been in place since 2012. In 2017, the SBV established a fintech steering committee. In 2018, the SBV proposed policies on the following five fintech-related vital issues to create a legal framework for fintech companies in Vietnam:

• the application of blockchain technology in the field of finance;
• managing Bitcoin and other cryptocurrencies in Vietnam;
• the research and management of mobilisation and P2P lending based on advanced technology;
• solutions for developing electronic know-your-customer identifiers in financial-banking services in Vietnam; and
• researching open application programming interfaces (APIs) to apply in the field of finance.

The Law on Credit Institutions 2024, effective from 1 July 2024, incorporates provisions related to the fintech sandbox, serving as the crucial legal foundation for acknowledging legal fintech activities in Vietnam. The proposed decree, addressing controlled testing mechanisms for financial technology operations in the banking sector (Fintech Sandbox), is expected to be released in 2024.

E-KYC

E-KYC has been officially regulated since the end of 2019 through Decree 87/2019/ND-CP. The Anti-Money Laundering Law, effective from March 2023, has legislated eKYC by eliminating face-to-face customer identification requirements. This law empowers credit institutions to leverage advanced technology, allowing them to verify customer identification information through external organisations or third parties.

Fintech companies with technologies for electronic customer identification can now officially use their solutions to offer eKYC services directly to credit institutions rather than merely providing technology solutions. The Law on Prevention of Money Laundering permits credit institutions to engage other organisations for customer information verification. It provides a crucial legal basis for fintech companies in Vietnam to register their business lines and offer e-KYC services to credit institutions, marking a newly recognised fintech service in Vietnam.

Moreover, through Decree 37/2021/ND-CP and Decree 59/2022/ND-CP on e-identification and e-authentication, e-KYC activities for credit institutions, telecom service providers, mobile operators, and organisations providing digital signature authentication services have received government support. This is facilitated by permission to access information in the National Population Database through the National Public Service Portal and the Ministry of Public Security Public Service Portal. With Decision No. 06/QD-TTg dated 6 January 2022, approving the scheme for applying population data, e-identification, and e-authentication in the national digital transformation from 2022-2025, some banking entities like Vietnam Foreign Trade Joint Stock Commercial Bank (NHTM) Joint Stock Commercial Bank for Investment and Development of Vietnam, and Vietnam Joint Stock Commercial Bank for Industry and Trade have collaborated with the Police Department for Administrative Management of Social Order (C06) - Ministry of Public Security to test an application solution for authenticating individuals through chip-embedded ID cards. This authentication system is being tested for customer identification operations at transaction counters and for customers depositing and withdrawing money at ATMs starting in May 2022.

Mobile Money

Mobile money is one of the government's sandbox models for driving innovation and providing strong motivation for the introduction of new technology and services into society. 

On 9 March 2021, the Prime Minister approved the two-year pilot application of mobile money, which allows the use of mobile phone credit to pay for small-value goods and services under Decision 316/QD-TTg. 

The most significant difference compared to e-wallets is that the mobile money service does not require a bank account to use and pay, as with e-wallets. In return, a maximum transaction for each mobile money account is VND10 million per month for all transactions - including withdrawals, transfers and payments - while the e-wallet limit is ten times higher than this amount: VND100 million a month. Mobile money is only accessible for domestic transactions, not cross-border ones. 

To be eligible to participate in the pilot, businesses need to have: 

• licences to provide intermediary e-wallet payment services; or 
• licences to establish a public mobile terrestrial telecommunications network using radio frequencies or have subsidiaries with permission from the parent company to use telecommunications, network and data infrastructure. 

To obtain the second licence, a foreign investor must enter into joint ventures with licensed telecommunications service providers in Vietnam and the capital contribution must not exceed 49% of the legal capital of the joint venture according to the WTO commitments. 

By the end of November 2023, the government issued Resolution No. 192/NQ-CP, extending the pilot implementation time for using telecommunications accounts to pay for small-value goods and services. Under this resolution, businesses approved by the State Bank of Vietnam can continue piloting telecommunications accounts for such payments until 31 December 2024. The State Bank of Vietnam is tasked with leading and collaborating with the Ministry of Information and Communications, the Ministry of Public Security, the Ministry of Justice, and relevant agencies to review, research, and report to competent authorities regarding the issuance of regulatory documents that may violate laws governing mobile money services before May 2024. 

P2P Lending

As outlined in the draft decree on regulations for the controlled testing mechanism for financial technology activities in the banking sector, peer-to-peer lending (P2P lending) is a technology-driven lending activity facilitated by fintech companies connecting borrowers with lenders. To be considered for a certificate of participation in the testing mechanism, a peer-to-peer lending company must be a legally established entity operating in Vietnam, not undergoing significant changes like division, separation, merger, conversion, business suspension, dissolution, or bankruptcy. Moreover, its Establishment Licence or Business Registration Certificate should not include pawnshop service business activities.

This draft provision suggests that businesses eligible for the sandbox mechanism must only be established in Vietnam, without specific restrictions on foreign ownership ratio or minimum legal capital conditions. Additionally, to be licensed for the sandbox scheme, the P2P lending solution must meet particular conditions outlined in the draft decree. The pilot period is a maximum of two years but can be extended multiple times, with each extension not exceeding one year.

Before officially being allowed to test under the Law on Credit Institutions 2024, in the absence of a comprehensive regulatory framework and with no explicit prohibition on such activities, companies engaged in P2P lending are adhering to general laws such as the Civil Code, the Law on Investment and the Law on Enterprise. Particularly, fintech companies usually obtain enterprise registration certificates with general business lines of supporting financial services that have not yet been classified to conduct their business under the Law on Investment, and the lending interest rate in civil transactions through P2P lending shall be agreed by the parties, but must not exceed 20% per year of the loan under the Civil Code 2015. 

The Law on Credit Institutions 2024 has, for the first time, recognised the sandbox scheme as a solution to address the lack of effective management and supervision mechanisms in P2P lending. This deficiency undermines operational quality and exposes investors to various risks due to the absence of a legal framework in the sector. These risks include information risk, lending risk, anti-money laundering risk, and cybersecurity risk.

Other Fintech Solutions

According to the draft decree outlining regulations for the controlled testing mechanism in the banking sector's financial technology activities, financial technology solutions (fintech solutions) represent innovative and modern advancements in financial services through technology applications. A fintech company without a credit institution or foreign bank branch status possesses an establishment licence or legal business registration in Vietnam. These companies independently provide fintech solutions or collaborate with credit institutions and foreign bank branches to offer such solutions.

Beyond P2P lending, the fintech solutions eligible for testing within such mechanism include credit granting on technology platforms, credit scoring, data sharing via an application programming interface (API), application of blockchain and distributed ledger technology (Blockchain Technology, DLT) in banking activities, and application of other technologies in banking operations. The draft decree welcomes all fintech applications in the market to register for the sandbox scheme, aligning with the testing mechanism's goals: promoting innovation and modernisation in the banking sector and achieving financial inclusion with transparency, convenience, efficiency, and low costs.

While the draft decree is notably open to the fintech market in Vietnam, fintech companies should be aware of limitations. Participation in the testing mechanism does not guarantee granting an official operating licence, nor does it automatically endorse fintech solutions for market supply. Additionally, the State Bank determines the maximum number of organisations approved to join the testing mechanism, considering their ability to review documents and supervise capacity periodically by actual market development conditions.

With respect to the statutory models, the fee charged for customers on payment intermediary services is governed by Decree 101/2012/ND-CP, which sets forth that the providers of services must fix and post their service charges at their discretion. In the case of unpredictable banking activities, the SBV shall provide a mechanism for determining the charges for payment services and charges for payment intermediary services. Until recently, the SBV has not officially interfered in service charges for payment intermediary services.

According to the Law on Credit Institutions 2024 and the draft decree on the sandbox scheme, specific standards for imposing service fees on customers for Fintech Solutions, such as P2P lending or blockchain technology, DLT, or mobile money, are not currently in place. However, organisations participating in the sandbox mechanism must compensate customers for damages resulting from errors within the mechanism and cover related legal costs if damages are proven to originate from the organisation's subjective reasons for participating in the sandbox mechanism.

According to Vietnamese law, legacy players are considered to be credit institutions or payment intermediaries. The differences in regulations between fintech and legacy players can be categorised into five groups:

• Licence mechanism: Fintech Solutions, although legally recognised, is only allowed to participate in a sandbox scheme, not obtain an official operating licence, even for telecommunications businesses or mobile money activities. On the other hand, credit institutions or payment intermediaries require official licensing.
• Scope of operations: Fintech Solutions operates with a broad scope, almost without strict limits, as long as they align with the goals of the sandbox scheme. Legacy players' activities are regulated more precisely and in detail.
• Subject: fintech companies only need to be legal entities established in Vietnam, with no restrictions on foreign ownership or legal capital. In contrast, mobile money players must be telecommunications businesses licensed as payment intermediaries. Legacy players, like credit institutions, face strict limits on capital ownership ratio, services provided, and personnel structure.
• Term: Fintech Solutions, being licensed for testing, has a relatively short term, expected to be a maximum of two years, extendable many times, each time not exceeding one year. In contrast, the term for banks is up to 99 years, non-bank credit institutions up to 50 years, and payment intermediary organisations up to ten years.
• Legal representatives: fintech companies, once licensed for testing, are kept from changing their legal representatives; otherwise, they may cease testing. Legacy players do not have this restriction, but when changing legal representatives, the new representatives need to meet legal standards and obtain approval from the State Bank of Vietnam.

The Law on Credit Institutions 2024, effective from 1 July 2024, officially recognises the sandbox scheme, which applies to all fintech solutions aligning with the sandbox mechanism's goals.

The government is expected to issue the decree on the sandbox scheme in 2024. Fintech companies are considered for a Certificate of Participation in the Testing Mechanism based on specific criteria, including being a legal entity established and operating legally in Vietnam. The proposed fintech solution must meet the following requirements:

• It is a solution not regulated in any legal documents or needs clear instructions for implementation.
• It is an innovative solution that brings benefits and added value to service users in Vietnam, primarily supporting the goal of financial inclusion.
• It has a risk management framework, limiting negative impacts on the banking system, currency, and foreign exchange activities.
• It has been implemented by an organisation participating in the Testing Mechanism, with a comprehensive review and evaluation.
• It is a feasible solution for market supply after completing the testing process. Projects must demonstrate a solution simulation model, scope, expected testing duration, and potential customer group. The test plan should clarify the scope, duration, expected funding, participating resources, and reporting principles to the State Bank during the testing period, including a sandbox termination plan.

As per current legal regulations, including the Law on Credit Institutions 2024 and the draft decree on the sandbox scheme, the State Bank of Vietnam (SBV) will play a central role in granting or revoking licences for most fintech solutions. This encompasses intermediary payment services, trial licences with mobile money, P2P Lending, and other Fintech Solution players, with the SBV responsible for supervising the operation of such players. 

In addition, the fintech industry participants are generally regulated by the following main regulators, with their objectives.

The Ministry of Public Security

The Ministry of Public Security shall coordinate with the State Bank to assess and evaluate the conditions and criteria related to the Ministry of Public Security's state management function, to ensure monetary policy, social order, safety, and customer rights are prioritised, and to proactively detect and investigate instances of fintech-related law violations. 

The Ministry of Information and Communications

The Ministry of Information and Communications is the focal point for research and development of fintech. It helps grant a certificate of technical eligibility to operate and store information of fintech, and comments on applications for a pilot licence for fintech operations related to technical standards. 

The Ministry of Planning and Investment

The Ministry of Planning and Investment is the focal point in studying and building conditions on charter capital and ownership structure conditions for companies operating a fintech business. 

The Ministry of Science and Technology

The Ministry of Science and Technology comments on the application documents for fintech relating to technical standards and co-ordinates with the Ministry of Information and Communications to research and develop a set of technical standards, and review the operating mechanism of the fintech models proposed by enterprises to issue a certificate of technology eligibility and technology solutions. 

The Ministry of Finance, and the Ministry of Industry and Trade, Ministry of Justice

The ministries' obligations are to co-ordinate with the SBV to consider and give opinions on applications filed for a pilot licence for fintech operations.

There is a variety of outsourcing services, including consultancy, financial technology, and secret customer service testing services.

Circular 13/2018/TT-NHNN of the SBV regulates the internal control system of commercial banks and branches of foreign banks, clearly explaining: “Outsourcing is the commercial bank/foreign bank’s branch (hereinafter referred to as the client) making an agreement in writing (an outsourcing contract) on hiring another enterprise, credit institution or foreign bank’s branch (hereinafter referred to as the contractor) to carry out one or multiple activities (including data processing or some steps of the business process) in the bank’s stead, in accordance with the law."

Therefore, commercial banks must have the principle agreement of outsourcing contracts to protect the ownership, keep confidential the information in databases and customer information, and the right to terminate the outsourcing contract. The contracts with an outsourced party must have a plan to maintain operations and at least include: 

• loss of important documents and databases; 
• a breakdown in the information technology system; and 
• force majeure events.

Fintech providers are mainly liable as gatekeepers in the area of anti-money laundering (AML) and anti-terrorism. Fintech providers who provide intermediary payment services, mobile or electronic money or e-banking/financial services are subject to the Vietnam Law on Anti-Money Laundering and Decree 101/2012/ND-CP on payment intermediaries businesses. For these subjects, they are subject to a plethora of duties to collect information, carry out KYC, reporting to authorities and, most importantly, to screen for suspicious and high-value transactions and then report to the SBV if the authenticity and purpose of those transactions are in doubt. 

Furthermore, per the draft decree on the sandbox scheme, fintech companies partaking in the test must develop and implement plans to prevent, manage, and address risks. These plans should encompass, at a minimum, the following elements:

Establishment of a process and department responsible for preventing money laundering and terrorist financing in compliance with legal provisions.

Measures for identifying, periodically reviewing, and managing partners when entering contracts and during the testing phase.

Strategies for identifying suspicious transactions and signs associated with criminal activities and legal violations during testing.

Comprehensive scenarios and plans for handling technical incidents.

Implementation of a back-up technical system to ensure data security and uninterrupted operations.

Adoption of a data model and catalogue to standardise shared data, minimising confusion and disputes among participating parties.

Inclusion of other risk management plans and responses that may arise throughout the testing process, covering credit risk, liquidity risk, cyber attack risk, customer information security risk, fraud, and related matters.

The subjects are also obliged to report to a specialised authority on anti-terrorism (as well as the SBV) if they discover transactions to blacklisted persons or that the parties in the transactions are related to terrorism or terrorist organisations.

According to the draft decree on the sandbox scheme, fintech companies licensed for testing may be required to halt testing if certain risks are deemed severe by relevant authorities. These risks include potential harm to customers, instability in the financial and monetary market, technical issues that cannot be resolved, violations of legal regulations resulting in judgments or administrative sanctions in effect, or changes in key aspects such as legal representative, division, separation, consolidation, merger, or business conversion. While businesses sometimes need to change legal representatives due to unforeseen events like the death or health issues of the current representative, for fintech companies, such changes may lead to suspending their sandbox license.

The three types of non-financial service laws with the most implications are those on data protection and cybersecurity, anti-money laundering and electronic transactions. 

Regarding anti-money laundering, on 28 April 2023, the government issued Decree 19/2023/ND-CP elaborating some articles of the Law on Anti-Money Laundering.

Regarding data protection and cybersecurity, fintech businesses are subject generally to the Law on Cyber-information Security 2015 as controllers of personal data. They are therefore subject to a plethora of duties in relation to their collection, storage and usage of data, including requirements to collect information only when consented to by the data subject, use data collected only within the scope of consent, and have the duty to have adequate systems in place to protect the collected data. Naturally, they also have the obligation to ensure confidentiality of the collected data. Specific obligations for payment intermediaries and financial institutions (such as banks or credit companies) are also provided under Article 23 of Decree 101/2012/ND-CP and Article 14 of the Law on Credit Institutions 2010 respectively. 

Regarding the Law on Electronic Transactions, the greatest implications are regarding the recognition of e-contracts and regulation of e-signatures. The latter is especially specific, in which legacy players that are parties that accept e-signatures are subject to certain obligations, including to take necessary measures to verify the reliability of an e-signature before accepting it, and to take necessary measures to verify the legal validity of an e-certificate and limitations with respect to the e-certificate in the event that such e-certificate is used to certify an e-signature.

The new Law on Electronic Transactions 2023 was issued on 22 June 2023 and will take effect on 1 July 2024. Such new law introduces the new concept of “digital signature”, which is an electronic signature that can ensure authenticity, integrity and undeniability but fails to ensure the secrecy of the data message.

In practice, for certain fintech providers in the payment intermediaries sector, there are specialist consultants whose reports are required to be submitted together with the licensing dossiers. These include specialist technical consultants who carry out the technical acceptance report of the fintech providers’ system for the regulators’ review, and penetration test service providers for reviewing the fintech providers’ system safety.

There is no regulation to categorise unregulated/regulated products and services in Vietnam.

The Vietnam Law on Anti-Money Laundering 2022 effected from 1 March 2023 imposes obligations on entities carrying out a number of activities, including those that (i) provide payment services; (ii) issue instruments of assignment, credit cards, debit cards, money orders or electronic money; and/or (iii) provide insurance services and investment operation related to life insurance; activities that may be considered fintech in nature. The main obligations for these enterprises would include: 

• customer identification and information collecting (KYC process); and 
• reporting of suspicious transactions. 

Customer identification and information collecting are highly detailed, and include detailed regulations on cases where customer identification is required, the type of customer information to be collected and identified, and measures to verify customer identification information; classifying customers based on risk factors. The enterprise will consequently have to apply appropriate anti-money laundering measures, corresponding to the risk levels of customers. There are also special obligations regarding politically exposed persons. 

Regarding reporting responsibilities, the law specifically stipulates the reporting responsibilities of reporting subjects when performing various types of large-value transactions (ie, more than VND400 million), suspicious transactions and large-value electronic money transfers. In addition, the law sets out basic suspicion signs, and creates a legal basis for reporting subjects to identify suspicious transactions in order to take necessary anti-corruption measures.

As per the draft decree on the sandbox scheme, fintech companies involved in the test must establish processes and dedicated departments to prevent money laundering and terrorist financing, aligning with legal provisions.

Robo-advisers are automated financial tools that utilise algorithms to conduct investment analyses and provide advice to customers.

As of now, robo-advisers are predominantly employed within the securities sector. In Vietnam, TCWealth, launched by TCBS Securities Corporation, introduced the first robo-adviser in 2017. Subsequently, other players such as Finhay, Smart Robo, iBroker, i-Invest, and Investment Robot Advisor have entered the market.

While robo-advisers currently operate without specific regulatory frameworks, it is essential to note that legal requirements relevant to the specific sector that uses robo-advisers would apply.

In Vietnam, the financial investment sector is adapting to the growth of robo-advisers, with TCWealth and Finhay being the prominent ones.

TCWealth provides detailed cash flow descriptions and creates plans based on individual income, investment duration, and risk tolerance. Meanwhile, Finhay offers five portfolio options ranging from safe to risky investments, connecting users to funds like Bao Viet and VietFund Management with a minimum investment of VND50,000 (equivalent USD2.00).

These robo-advisers provide low-cost advice, catering to small investors. Legacy players are striving to offer similar low-cost robo-adviser services to reach a wider customer.

The rules for best execution of customer trades would apply to the securities company, regardless of it using human or robo-advisers. 

Under Circular 121/2022/TT-BTC, general requirements include: 

• investment advice must be made on a reasonable and appropriate basis by using reliable and logical analysis;
• investment recommendations must relate and correspond to analyses of securities and stock markets;
• customers must be kept well informed of the risks implications;
• customers’ information must be kept confidential; and
• investment advice must be relevant to the investment objectives and financial health of the customers. 

However, these rules are very general, and without specific guidance. So, it remains unclear how algorithms employed by robo-advisers would be deemed to meet these criteria. 

In Vietnam, lending activities can be classified into:

• lending activities of credit institutions, which are regulated by the Law on Credit Institutions, Circular 39/2016/TT-NHNN and Circular 06/2023/TT-NHNN and relevant laws; and
• lending activities of non-credit institution lenders, which are regulated by the Civil Code.

Regarding loans provided by credit institutions, the basic eligibility requirements for a loan are set out for individuals and legal entities without difference under Article 7 of Circular 39/2016/TT-NHNN. From the legal perspective, there are almost no differences between the provisions of loans for specific types of borrowers except that (i) small and medium-sized enterprises, and (ii) enterprises operating in some economic fields and sectors (such as agriculture development and sectors applying hi-tech) enjoy incentives on loan interests as directed by the SBV over periods of time according to Article 13 of Circular 39/2016/TT-NHNN and Decision 1125/ QD-NHNN dated 16 June 2023. Especially, in 2023, SBV has introduced new instructions for credit institutions to provide online lending towards individual and entity customers. For individual customer registering loans for living purposes, the total loan must not exceed VND100,000,000 (one hundred million). In addition, for loans to be provided by credit institutions, SBV added new restricted loan purposes, “loans used for sending money to deposit accounts”.

In terms of loans provided by non-credit institution lenders, through emerging P2P lending and online lending platforms and applications, non-credit institution lenders can easily provide loans online after the enactment of the Law on Credit Institutions 2024 and the implementation of the sandbox scheme. Generally, lenders and borrowers participating in such platforms are individuals, and the loans to be provided are small consumer loans with no different conditions for different borrowers. Most fintech companies only play the role of intermediaries establishing the environment and connecting online lenders to borrowers, without directly providing the loans. However, there are some fintech companies that directly provide online loans to borrowers in the form of salary advances based on the labour contract of the borrower, such as WeWay and VuiApp. Accordingly, borrowers may request a fintech company to provide a salary advance. By the end of the month, the employer, instead of paying a salary to the borrower, will pay to the fintech company.

For loans to be provided by credit institutions, lenders have the duty to carry out assessment of loan applications and a customer’s ability to satisfy loan requirements as prescribed by Article 17 of Circular 39/2016/TT-NHNN and Circular 06/2023/TT-NHNN. In the course of such assessment, the credit institution can use the internal credit rating system associated with information available at the National Credit Information Centre of Vietnam and other communication channels.

Regarding online loans from non-bank lenders, concerning online loans from non-bank lenders, as per the draft decree on the sandbox scheme, peer-to-peer lending companies are required to establish rules and procedures for customer identification (KYC) during their participation in the testing mechanism. Additionally, they must implement internal control and audit mechanisms suitable for the nature and scale of their operations. Presently, many fintech companies are applying various underwriting solutions using scorecards, transaction history data, assessment from professional rating service providers, AI and big data, etc, on their P2P lending platforms.

Under the Law on Credit Institutions, the sources of funds for a loan include the following:

• lender-raised capital;
• taking deposits;
• issuing certificates of deposit, treasury bills and promissory notes;
• borrowing capital from the SBV; and
• borrowing capital from credit institutions and financial institutions.

According to Article 108.1 and Article 112.1 of the Law on Credit Institutions, finance companies and finance leasing companies are not allowed to take deposits from individuals to fund their loans. 

Concerning loans from non-credit institutions, as outlined in the draft decree on the sandbox scheme, when applying for a sandbox licence a peer-to-peer lending company needs to showcase its resources well suited for implementing fintech solutions and introduce them to the market. These resources encompass capital, including equity and mobilised funds, expected resources, and implementation costs. Currently, most non-bank online loans on P2P platforms are sourced from individual investors' funds.

The procedures for the arrangement of loan syndication are currently provided in Circular 42/2011/TT-NHNN and can be summarised as follows:

• the customer sends the proposal for loan syndication to a credit institution;
• the credit institution issues an invitation for loan syndication to other credit institutions;
• the invited institutions review and reply in writing to accept or refuse to participate in the loan syndication; and
• based on the reply of the invited institutions, the credit institution that acts as a head in the arrangement shall convoke meetings of members to discuss matters relating to the provision of loan syndication.

It should be noted that Circular 42/2011/TT-NHNN only governs the provision of syndicated loans by credit institutions to customers. 

With respect to online lending, a syndication of loans has not taken place in the banking or non-banking sectors. As per the draft decree on the sandbox scheme, there are currently no regulations governing pool lending within the testing mechanism. However, pool lending might be implemented in P2P lending platforms/applications in the near future. 

At present, payment transactions in Vietnam are processed through several payment systems, including: 

• the national payment system operated and managed by the SBV, including electronic/paper clearance and interbank electronic payment systems (IBPS); 
• the bank card switching and clearing system; 
• the securities clearing and settlement system currently being operated by the Bank of Investment and Development of Vietnam (BIDV); and 
• the internal and bilateral payment systems operated and managed by credit institutions. 

With respect to international payment transactions, they are processed through international SWIFT and Western Union remittance services.

Under Article 25 of Decree 101/2012/ND-CP, only providers of payment services (banks and other credit institutions) can organise and operate internal payment systems. Intermediary payment service providers (including payment processors) use existing payment rails and do not create or implement a new one.

Concerning mobile money, based on Decision 316/QD-TTg and Resolution 192/NQ-CP, enterprises conducting pilot services for mobile money are permitted to transfer funds between customers' mobile money accounts within the pilot enterprise's system. This includes transfers between the customer's mobile money account and their bank payment account and between the mobile money account and the e-wallet offered by the pilot enterprise.

International payments are regulated by laws on foreign currency management and international agreements on payments to which Vietnam is a signatory, as provided in Article 3 of Decree 101/2012/ND-CP. Under the Ordinance on Foreign Exchange Control, cross-border payments are basically classified into two main groups:

• current transactions; and 
• capital transactions. 

Each type of transaction is subject to specific requirements, but all of them must be made via an authorised credit institution.

Regarding individual Cross-Border Payments, it's possible through Visa and Master cards with a straightforward process that doesn't require providing specific details about the purpose of the money transfer. However, the transaction limit must adhere to the card's issued limit. Typically, foreign fintech technology companies (established abroad) continue to offer cross-border services to individuals in Vietnam, receiving payments through Visa and Master card channels. This falls into a grey area of foreign exchange payment regulations because, unlike other payment channels through credit institutions in foreign currencies, proving the purpose of money transfer is often complex and stringent.

Generally, Vietnam does not have a specific set of rules regulating fund administrators acting as the service provider outsourced by the fund manager to carrying out all administrative functions for a fund. 

For a securities fund manager, under Article 12.1 of Circular 99/2020/TT-BTC, securities fund manager may only be allowed to outsource its administrative operations to (i) a depository bank; (ii) a supervisory bank; or (iii) the Vietnam Securities Depository and Clearing Corporation (VSDC). 

VSDC is a government agency under the State Securities Commission (SCC) - the central State authorities administering the securities market, including the operations of fund management companies. Depositary bank and supervisory bank are licensed credit institution in Vietnam which have registered their securities-related activities with the SSC. Both of these banks are subject to stringent statutory requirements under the laws on credit institutions and the laws on securities. 

Vietnamese laws provide no mandatory contractual terms between the fund managers and fund administrators for their outsourcing and authorisation relationship. Instead, Vietnamese laws impose various obligations on the fund administrators regarding their operations and transactions. 

Generally, the parties may not contract out these obligations. 

With regard to financial instruments, in Vietnam only domestic securities trading markets - the Vietnam Stock Exchange (VNX), the Hanoi Stock Exchange (HNX) and the Ho Chi Minh Stock Exchange (HSX) - are permissible under the laws. The VNX has recently been established on the basis of restructuring the operating HNX and HSX. In particular, the VNX, which owns 100% of the charter capital of HSX and HNX, currently plays the role of supervising and managing the other two stock exchanges. 

Currently, the HSX and HNX operate platforms for the trading of listed stocks, bonds and exchange-traded fund certificates, but the difference is in requirements for listing (the HSX has higher standards). The HNX also operates a separate trading system for public companies’ stocks that have not been qualified for listing, which is called Upcom. In addition, listed closed-end fund certificates and covered warrants are traded through the HSX’s system, while the HNX is handling derivatives transactions.  

However, the types of securities traded on the HNX and the HSX will be restructured for the purpose of specialisation. In particular: 

• from July 2025, the HSX will be the only trading market for listed shares, fund certificates and covered warrants, and shares of registered organisations; and 
• from July 2025, the HNX will be the only trading market for bonds and derivatives transactions. 

After the enactment of the Law on Credit Institutions 2024 and the implementation of the sandbox scheme, Vietnamese laws will have specific regulations on the trading platforms of other financial instruments, such as P2P lending.  

State authorities may view foreign exchanges and other trading platforms dealing with cryptocurrency or digital assets as spontaneous and illegal. 

Under the Civil Code, an asset is defined as including objects, money, valuable papers and property rights, and is classified into immovable and movable assets. In general, Vietnamese laws do not have different regulatory regimes for different classes of assets. However, with respect to cryptocurrency and other digital assets, it is still unclear whether they can be considered “assets” under Vietnamese laws due to contradictory views on this matter as well as a lack of guiding regulations.  

On 15 June 2021, the government issued Decision 942/QD-TTg, which, among others, directed that the SBV begins working on a pilot project for virtual currencies based on blockchain technology. The Ministry of Finance (MOF) also formed a group conducting an in-depth study of cryptocurrencies to close the gap between technologies and legislation. In addition, the Ministry of Information and Communications has collected opinions and prepared a draft for a Law on Digital Technology Industry. According to the summary report of comments for the draft of the Law on Digital Technology Industry, digital assets such as cryptocurrencies, NFTs, videos, images and social media accounts are expected to be recognised, with the ownership protected. Moreover, the draft also sets out a sandbox mechanism on the purchase, sale and exchange of digital assets; mechanisms to manage the purchase, sale and transfer of digital assets; and measures to protect and ensure the interests of organisations and individuals that create, develop and own digital assets on digital environments, especially cross-border platforms. The Draft Law on Digital Technology Industry has been submitted to the government and transferred to the National Assembly for inclusion in the 2023 plan.  

Nonetheless, at the time of writing, a defined legal framework for virtual assets, including cryptocurrencies, remains absent.

Vietnam is in the period known as the “golden population structure”, which means the majority of the population are young, dynamic people who are highly adaptable to new technology. As a result, investment in cryptocurrency in Vietnam has grown relatively fast with the emergence of exchanges (eg, Binance, BitcoinVn, Remitano). Nevertheless, Vietnam still lacks a legal framework for cryptocurrency as well as digital assets (see 7.2 Regulation of Different Asset Classes), even though it has made several efforts to regulate this space. As an example, in Decision 1225/QD-TTg, dated 21 August 2017, the Prime Minister approved a project to complete the legal framework for the management of digital assets and related activities. The due date for proposed amendments or legislative documents on cryptocurrency was August 2018, but it was not met.  

Cryptocurrency is considered an illegal means of payment in Vietnam under Decree 80/2016/ND-CP. In addition, due to recent crypto-related frauds causing millions of US dollars of damages to investors, the authorities have started to be concerned about the negative effect of the emergence of cryptocurrency exchanges.  

In Directive 10/CT-TTg dated 11 April 2018, the Prime Minister requested the relevant authorities to strengthen the management of crypto-related activities and initial coin offerings (ICOs). Pursuant to this directive, the SBV issued Directive 02/CT-NHNN dated 13 August 2018, which requires credit institutions and providers of intermediary payment services not to provide payment services or conduct other activities related to cryptocurrency transactions for customers due to “the risks of money laundering, financing of terrorism, fraud and tax evasion”. As per the upcoming draft case law No. 17 of the Supreme People's Court, the Vietnamese court system does not acknowledge virtual currency as a legal commodity or asset. The court has dismissed the Vietnamese tax authority's decision to collect personal income tax from individuals earning income through buying and selling virtual currencies in Vietnam. 

Regardless of the above, to keep up with Industrial Revolution 4.0, the SBV is studying the capability for the issuance of digital currency, which might be put under control of the government as fiat currency according to Decision 2617/QD-NHNN dated 28 December 2018.

The Laws on Securities and other associated regulations set out clear listing standards for stocks, bonds and other eligible securities to be listed on the stock exchanges (HNX and HSX) or to be registered in a centralised trading system (Upcom). Vietnamese laws have not established standards for the listing of cryptocurrency or other digital assets due to the lack of a legal framework (see 7.2 Regulation of Different Asset Classes and 7.3 Impact of the Emergence of Cryptocurrency Exchanges). 

With respect to the stock market, under Article 3.3 of Circular 120/2020/TT-BTC, the VNX is responsible for issuing regulations on trading for the trading systems/platforms it manages. Such regulations provide the order handling rules applicable to the relevant system, such as kinds of trading orders, confirmation or rejection of securities transactions, change or cancellation of orders and principles on matching orders (priority on price or time). Securities firms (ie, members of securities trading markets) are responsible for checking the validity and legitimacy of the investor's trading orders before inputting orders into the securities trading system.  

Vietnamese laws have not established order handling rules for the trade of cryptocurrency or other digital assets (due to the lack of a legal framework; see 7.2 Regulation of Different Asset Classes and 7.3 Impact of the Emergence of Cryptocurrency Exchanges).

Authorities have shown significant interest in the growth of peer-to-peer trading platforms. With the enactment of the Law on Credit Institutions 2024 and the implementation of the sandbox scheme, these platforms can officially apply for a trial licence, allowing operations for a period of two years, with the possibility of extension. 

Accordingly, a regulatory document providing (i) the activities of P2P lending platforms; (ii) the lenders allowed to participate in the platforms; (iii) the conditions for the establishment of a company operating P2P lending platforms; and (iv) other matters related to the activities of such platforms is expected to be issued in the near future. 

Under the Law on Securities and its guiding regulations: 

• securities firms have the duty to execute a customer’s orders quickly and accurately, and must prioritise the execution of customers' orders before their own orders; and 
• fund management firms have the duty to act for the best interests of customers. 

In line with the draft decree on the sandbox scheme, fintech technology companies engaged in testing must establish and communicate regulations safeguarding the rights of their service users or customers. These regulations encompass various aspects, such as the responsibilities of participating organisations towards customers (ensuring the protection of personal information, addressing disputes and complaints, etc) and the rights granted to customers (including the right to safety, accurate information, compensation for damages, lodging complaints, and receiving advice and support).  

In the absence of regulations applicable to cryptocurrency and other digital assets, the best execution of customer trades relating to the trade of digital assets has not been recognised under Vietnamese laws.

In Vietnam, securities firms that are trading members will place orders directly on the stock exchange for account holders. Brokerage service fees paid by account holders to securities firms relating to purchases or sales of listed and registered shares, funds certificates, and covered warrants shall be limited to a certain amount per transaction or to a percentage based on the total transaction value.

Article 5 of the Law on Securities provides the basic principles for the securities market’s activities and operations, including “fairness, publicity and transparency”. For the purpose of ensuring market integrity and preventing market abuse, Article 12 of the Law on Securities also sets out prohibited acts, including disclosing false or misleading information, insider trading, exploiting the market to create sham supply or demand, or other acts to manipulate securities prices.  

Per the draft decree on the fintech scheme, fintech technology companies involved in the pilot programme must guarantee transparency and publicity of data and information for all customers and related parties. Furthermore, these companies must ensure they notify customers comprehensively, accurately, clearly, and publicly about their company's information and services. 

The market integrity principles have not been provided by the laws for the trade of cryptocurrency and other digital assets (due to the lack of a legal framework; see 7.2 Regulation of Different Asset Classes and 7.3 Impact of the Emergence of Cryptocurrency Exchanges).

High-frequency and algorithmic trading, known as HFT, is a form of algorithmic transaction with a high and fast turnaround speed that uses powerful computer programs to execute a large number of transactions in less than a second. 

In 2020, the MOF issued Circular 120/2020/TT-BTC providing guidance for trading on the securities market, which allows investors, among others, to place buy and sell orders at one time, for intraday transactions.  

However, under Circular No. 13/2017/TT-BTC and Circular No. 73/2020/TT-BTC, the use of HFT and Algorithmic Trading for placing orders has not been permitted. Therefore, under Official Letter 0614/UBCK-CNTT dated 31 August 2023, the State Securities Commission has requested investors to stop creating and implementing HFT, so as to stabilise the stock trading system. 

There are no regulations regarding whether companies participating in investments with their own assets and using High-Frequency Trading (HFT) need to register as market makers. 

Under Decree 95/2018/ND-CP regulating the securities industry, “market maker” refers to an organisation appointed by the Ministry of Finance to exercise and perform its rights and duties in the issuance and trading of government debt instruments in domestic market. 

Under Article 26.2 of Decree 95, the following requirements for a market maker must be met: 

• must be a commercial bank or a securities company that is duly established and has operated under the laws of Vietnam for at least three years; 
• the owner’s equity reported on duly audited financial statements must not be lower than the minimum charter capital prescribed by relevant laws (VND3 trillion for a commercial bank; VND10–165 billion for a securities company); 
• the applicant must have purchased and traded government debt instruments on the primary and secondary market with the minimum quantity prescribed by the Ministry of Finance in each period. 

As such, Vietnamese laws only regulate market makers within the scope of government debt issuance and trading, and lawmakers have not yet issued regulations on market makers in a broader sense. 

Due to the lack of regulations on HFT, there is no such regulatory distinction provided for the funds and dealers engaging in HFT. 

Due to the lack of regulations on HFT, there is no such regulation on programmers and programming involving the development and creation of trading algorithms and other electronic trading tools. 

Decentralised Finance (DeFi) is a blockchain-based financial system that operates without relying on central financial intermediaries like banks or insurance companies. DeFi utilises smart contracts to record information between parties and automate financial transactions such as lending, borrowing, and cryptocurrency investments. 

DeFi resembles P2P in lending/borrowing activities, but in DeFi, transactions are recorded by smart contracts, eliminating the need for third-party intermediaries. This differs from P2P, which relies on third parties to connect borrowers and lenders. Nevertheless, Vietnam currently lacks a specific legal framework for DeFi lending/borrowing functions. 

The DeFi platform not only includes lending/borrowing activities but also involves investing in cryptocurrencies and other digital assets like tokens and derivatives.  

Vietnam, via Decree 80/2016/ND-CP and Circular 5747/NHNN-PC, does not recognise Bitcoin and virtual currencies as legal means of payment. Transactions involving digital currencies are prohibited.  

Consequently, in Vietnam there is no legal ground to confirm legality and oversight of DeFi’s crypto investment function. 

A few financial research platforms have emerged in Vietnam’s market. Given that official regulations governing these platforms have not been issued, companies operating the platforms may only need to register appropriate business lines without obtaining any other sub-licences or approvals from authorities. For participants, in order to use the research platform, they just need to register with a platform provider to create an account and no registration with authorities is required. 

However, if the activities of these platforms may include personal information collection and processing, under Decree 13/2020/ND-CP dated 17/4/2023, the processing and transfer of personal data is subject to registration with the relevant authority. 

There are no regulations relating to this sector to date. 

There are no regulations relating to this sector to date.

Insurtechs help transform the ways in which insurance companies engage with policyholders. Many industry participants have employed advanced technology to facilitate their underwriting processes.  

While the Law on Insurance Business 2022 and Circular 67/2023/TT-BTC allow insurance companies to provide their services and products entirely online, there are certain limitations on the insurance products.  

Particularly, providing insurance products entirely online may be restricted to the following:  

• micro-insurance, health insurance, term life insurance with a term exceeding one year, and other insurance products with a term of one year or less, for which the insurer’s policy does not require physical appraisal or risk assessment prior to entering into an insurance policy; and 
• health insurance, term life insurance with a term of one year or less, motor vehicle insurance, trip and tourism insurance. 

Of note, in some cases of partial execution of insurance service and product provision process online for products, the consulting service must be performed directly or in the form of a recorded call between an insurer, branch of foreign non-life insurer, mutual micro-insurer, insurance broker, or insurance agent with the policyholder. This requirement may cause difficulty for the insurtechs. 

Insurers offering online insurance products will also be subject to other requirements, including, but not limited to, IT infrastructure and notification obligations.  

There are various insurance products currently available in the market. However, from regulatory perspective, there are only three types of insurance: life insurance, health insurance and non-life insurance.  

Life insurance is a class of insurance provided to cases where the insured is alive or dead, while non-life insurance means a class of property, civil liability and insurances other than life insurance. Health insurance is a newly added category in Law on Insurance Business 2022. Health insurance focuses on the healthcare benefits of the insured, instead of the insured’s vital status inherent in life insurance. Depending on the object, field and scope of the insurance, different types of insurance are treated differently. 

As for the insurtechs, full online insurance may be deployed for certain products only, as specified under 10.1 Underwriting Process. For other types of insurance, the insurance policy can only be provided partly online. 

Other than the above, the legal requirements for insurtechs should generally be applicable across all types of insurance.  

Regtech providers are not subject to specific regulations in Vietnam. The applicability of relevant legal requirements depends on the specific areas in which Regtech operates, such as eKYC, corporate governance, risk administration, and reporting obligations. 

Regtech is recognised as a component of the banking sector's digitalisation plan under Decision 810/QD-NHNN dated 11 May 2021. However, despite acknowledging the benefits of Regtech, the State Bank of Vietnam expresses concerns about potential interference by third-party Regtech service providers in the banking system, where accuracy and confidentiality are of utmost importance. 

When engaging third-party technology service providers, financial service firms often impose the following contractual requirements on their service providers:  

• confidentiality obligations; 
• compliance with data protection and storage rules; 
• maintenance of an adequate and consistent IT system aligned with the financial service firms' systems, such as the core banking system;  
• maximum downtime period; and 
• special requirements for cloud services. 

Under Circular 09/2020/TT-NHNN, if the financial service firm is a credit institution, the above terms, among others, would be mandatorily required to be incorporated into the service agreement between the credit institution and the third-party service provider.  

In October 2022, a seminar led by the Vietnam Banks Association and the Vietnam Blockchain Association discussed blockchain's role in finance and banking. Notable banks like HSBC Vietnam, TPBank, and Vietcombank shared their experiences on blockchain trials initiated since 2019. 

A key takeaway from the seminar was HSBC Vietnam's report on the benefits of blockchain in reducing the processing time of Letters of Credit from five to ten days to just one day. Vietcombank also utilised blockchain in its digital banking system, VCB Digibank, particularly in the VCB Rewards programme. This application has significantly improved the management of their loyalty programme, making it more efficient and user-friendly. Similarly, TPBank has embraced blockchain, using RippleNet to expedite international money transfers. This strategic move by TPBank has considerably shortened transaction times, meeting the growing need for fast and effective global payments. Notably, RippleNet's foundation on blockchain technology marks a major advancement in the acceleration of blockchain-based payment solutions across global markets, setting a precedent for future financial innovations.  

While Vietnam has not officially established any legal regulations on blockchain, it remains a prominent topic of discussion among regulators in the Fintech sector. There have been proposals to govern blockchain within the Vietnamese sandbox; however, the operational rules for the Vietnamese sandbox are still in draft form.  

Previously, the Vietnam Blockchain Association was established under Decision 343/QD-BNV, approved by the Ministry of Home Affairs on 27 April 2022. This association has become the first official organisation dedicated to uniting enthusiasts and researchers of blockchain technology throughout Vietnam, highlighting the technology's significant developmental potential in the country. 

At the meeting on 28 December 2023 chaired by the Prime Minister and the National Committee on Digital Transformation's Chairman, summarising the activities of 2023 and outlining key directions and tasks for 2024 of the Committee, the Ministry of Information and Communications was urgently tasked with finalising and proposing strategies for the development of blockchain applications.  

Blockchain assets are not categorised as financial instruments. Certain blockchain assets, like Bitcoin, Litecoin, and other virtual currencies, are not recognised as legal tender and are not considered a valid means of payment in Vietnam. 

In Vietnam, there are no legitimate issuers of blockchain assets. 

Blockchain asset trading platforms are not legally recognised in Vietnam. Previously, a company attempted to register a Bitcoin trading website with the Ministry of Industry and Trade in accordance with Vietnamese laws on e-commerce. However, the Ministry of Industry and Trade rejected the registration on the grounds that Bitcoin is not categorised as either goods or services within the Vietnamese current legal framework. 

There is legal framework for blockchain investment funds in Vietnam. 

Vietnam has no specific laws on both blockchain and virtual currencies. 

There is currently no clear legal framework for DeFi in Vietnam.  

The Crypto Market Report for Vietnam in 2022 indicates that DeFi projects are still in their early stages of development in the country, with notable initiatives like Kyber Network and Rikkei Finance, even though their legal status has not yet been officially recognised by the government. 

Currently, NFTs are generally not classified under any of the four asset categories specified in the Civil Code 2015. Transactions involving NFTs are not considered asset transfers, and therefore profits from NFT transfers are not currently subject to taxation, which leads to a significant loss of tax collection of the government.  

However, NFTs are not yet regulated within the legal framework due to being a relatively new technology, and government authorities have not reached a consensus on how to categorise NFTs as assets. Additionally, if NFTs were to be officially recognised as assets, it would require significant amendments and additions to numerous legal documents.

There are no legal regulations in Vietnam on open banking; however, this may change. Indeed, the Vietnamese government is actively promoting competent agencies to develop a legal framework on open banking. 

Indeed, in 2017 the Governor of the State Bank established a Steering Committee for Fintech in accordance with Decision No 328/QD-NHNN dated 16 March 2017. One of the core tasks of the Committee is researching, building connections and sharing data through open APIs. This is a start and could result in developments in open banking in the foreseeable future. 

Furthermore, according to the plan for digital transformation of the banking industry by 2025, looking forward to 2030 (issued under Decision No 810/QD-NHNN dated 11 May 2021 of the SBV Governor), developing a regulation on the collection, exploitation, processing and sharing of customer data with third parties, towards the development of open banking, is one of the tasks and solutions to facilitate the digital transformation process in the banking sector. 

As per the Anti-Money Laundering Law, reporting entities can verify customer information through a third party or engage a service provider for customer information verification. Credit institutions are now permitted to integrate with the national population database. Furthermore, under the draft decree on the sandbox scheme, fintech solutions, including credit scoring and data sharing through application programming interfaces, are eligible for testing in the banking sector. These developments are fostering the rapid emergence of open banking, especially following the enactment of the Law on Credit Institutions 2024 and the sandbox scheme. 

Currently, despite the absence of a specific legal framework for open banking, several banks, such as VietinBank, Agribank, BIDV, VPBank, Techcombank, and Vietcombank, have initiated open banking practices by offering APIs to connect with payment intermediaries, e-commerce platforms, and utility service providers (electricity, water, aviation, etc). 

It is undeniable that the development of open banking enhances convenience for customers and brings many opportunities for banks. However, the implementation of open banking also entails a number of risks, including the risk of unsecured customer data, and the risk of cyber attacks due to the increased duration and number of connections between the bank and third parties. In addition, customers may take the risk of infringing and stealing their data through the process of collecting and processing the data of third parties. 

Not only customers but also banks may face difficulties in maintaining data quality and accuracy, and challenges in data analysis and mining, data standardisation and junk data removal, etc. In addition, banks also need to pay attention to ensuring data safety and customer information security in the network environment, which is one of their statutory obligations. 

Fraud is the term which refers to deceptive activities aiming to cause financial harm to others. Common forms of fraud include: 

• stealing personal information to open unauthorised accounts, accessing digital wallets, or conducting illicit transactions; 
• defrauding cryptocurrency and digital wallets by creating valueless digital currencies through electronic wallets to legitimise the exchange of those digital currencies. 

Vietnamese law lacks specific definitions of fraud in the fintech/financial sector, but various legal provisions cover the following aspects.

Criminal Code

The Criminal Code identifies and imposes penalties for crimes related to fraud, such as the crime of obtaining property by fraud, the appropriation of property using a computer network, telecommunications network or electronic device. Under the Criminal Code 2015, to be considered guilty of fraud the following requirements must be met: 

• one must (possess the intent to deceive and misappropriate others’ property to retain ownership, usage, or disposal rights; 
• employ deceptive tactics such as misrepresentation;  
• the victim believes in the deception, resulting in harm. 

Civil Code

The Civil Code regulates the requirement for compensation for damages caused by fraudulent activities. 

While clear definitions and regulations regarding fraud in fintech/financial services may not be explicit, the extensive provisions outlined in current laws can be applicable to fraudulent activities within the fintech/financial services sector. 

Regulators in Vietnam are currently focusing on several key types of fraud: 

traditional fraudulent behaviour: under Article 174 Of Criminal Code 2015, it is called the crime of obtaining property by fraud;

regulators are concerned about the increasing sophistication of online fraud and tactics used to steal online banking credentials or personal information. Therefore, Criminal Code 2015 stipulates the crime of appropriation of property using a computer network, telecommunications network or electronic device (Article 290).