Circular No. 09/2003/TT-NHNN guiding the implementation of certain provisions under Decree No. 55/2001/NĐ-CP dated August 23, 2001 of the Government on Management, Provision, and Use of the Internet

CIRCULAR

OF THE STATE BANK OF VIETNAM YEAR

GUIDELINES FOR IMPLEMENTING CERTAIN PROVISIONS OF GOVERNMENT DECREE NO. 55/2001/NĐ-CP OF AUGUST 23, 2001 ON MANAGEMENT, SUPPLY AND USE OF THE INTERNET

REGARDING MANAGEMENT, SUPPLY AND USE OF THE INTERNET

________________________

Pursuant to Article 17 and 36 of Government Decree No. 55/2001/NĐ-CP dated August 23, 2001 on management, supply and use of the Internet, the State Bank of Vietnam guides the implementation of certain specific contents regarding the management, supply and use of Internet services in the banking sector as follows:

I. GENERAL PROVISIONS

1. SCOPE OF REGULATION AND APPLICABLE SUBJECTS.

a. These Circulars guide certain contents regarding the management, supply and use of Internet application services in the banking sector according to Government Decree No. 55/2001/NĐ-CP dated August 23, 2001 of the Prime Minister.

b. Applicable Subjects

Organizations and units operating in the banking field providing Internet application services in the banking field.

Organizations, units, and individuals using Internet application services in the banking field.

2. TERMS USED IN THESE CIRCULARS ARE UNDERSTOOD AS FOLLOWS.

a. The State Bank of Vietnam's information network and business database system is an internal network of the State Bank exclusively for business applications serving the operation and activities of the State Bank. Information and databases on this network are protected under confidentiality regulations and are not transmitted over the Internet.

b. The Internet equipment system is a collection of electronic, telecommunication, computer devices and other auxiliary equipment including both hardware and software established at a specific location with a defined address and scope by the subjects (as stipulated in Clause 1, Section I of these Circulars) for direct use in accordance with the law to provide and use Internet services.

c. Intranet is a system of information connected by Internet communication protocols (IP) and uses a unified address system within an organization or unit to provide various services and applications for users.

d. Internet application services in the banking field are services using the Internet to provide banking services to users.

II. SPECIFIC PROVISIONS

1. The provision and use of Internet application services in the banking sector shall be carried out through contracts in accordance with the provisions of the law and in line with the actual business conditions of the unit.

2. Contracts for the provision and use of Internet application services in the banking sector must be documented in writing. Based on the provisions of the law on contracts and the provisions on the management, supply and use of Internet services, organizations and units providing Internet application services in the banking sector have the responsibility to develop and issue model contracts to implement uniformly within their units.

3. Organizations and units operating in the banking field wishing to provide Internet application services must obtain permission from the Governor of the State Bank of Vietnam with the following conditions:

a. Clear purpose;

b. Design of the information network with complete equipment facilitating convenient inspection and control to ensure safety and confidentiality of information;

c. A technical staff team corresponding to the requirements of the system;

d. Compliance with regulations on the supply and use of Internet application services.

4. Organizations and units operating in the banking field that have their own internal information networks (Intranet) must establish a Management Board for the use of Intranet and Internet. The Head of the Management Board is appointed by the Unit Leader. The Management Board for the provision and use of Intranet and Internet services only has authority and responsibility for units and individuals within its management scope.

5. RIGHTS AND RESPONSIBILITIES OF THE MANAGEMENT BOARD FOR THE USE OF INTRANET AND INTERNET

a. Rights:

Decide on types and contents of information on the Intranet managed according to current regulations;

Examine and certify units and individuals meeting the conditions to build Intranet and/or connect to the Internet;

Suspend units and individuals violating Internet management and use regulations in the banking field;

Propose disciplinary action against units and individuals who violate regulations.

b. Responsibilities:

Be responsible to the Unit Leader for managing and using Intranet and Internet in accordance with current legal regulations;

Specify technical conditions to ensure information security for computer networks connected to the Internet.

6. Information networks and business databases of units and individuals in the banking system shall not be directly connected to the Internet. When there is a need, a separate network (or node) must be established, information must be encrypted, effective technical measures must be taken to prevent intrusion, theft, and destruction of specialized information systems and databases, while controlling the exchange of information.

7. RIGHTS AND RESPONSIBILITIES OF ORGANIZATIONS AND UNITS OPERATING IN THE BANKING FIELD PERMITTED TO PROVIDE INTERNET APPLICATION SERVICES.

a. Rights:

Proactively establish technical systems to provide Internet application services to members as specified in the license.

Permitted to use Internet application services appropriate to the needs and tasks of the unit according to planning and regulations on Internet resource management.

Use administrative and technical measures to manage exploitation and use, provision of Internet application services under their management.

Decide to temporarily suspend service provision or limit service provision in emergency situations to ensure national security, upon request of competent state agencies.

b. Responsibilities:

Complete procedures to obtain permission from Internet service management agencies to operate and comply with current legal regulations on electronic press information activities.

Expand Internet application services in banking operations must be approved by the Governor of the State Bank of Vietnam.

Bear full responsibility for damages and risks caused by Internet use.

Strictly control units and individuals using and providing Internet application services that are prohibited or not yet permitted to use or provide.

Guide users of Internet application services to comply with regulations on the exploitation and use of Internet application services in accordance with the provisions of the law.

Fulfill all terms and conditions stipulated in the contract signed with the participating service users for Internet application services.

Issue procedures for exploiting Internet services within the scope of management of the unit.

Disseminate and guide affiliated units and individuals using Internet application services in the banking industry to implement this Circular and related documents.

8. Rights and obligations of organizations, units, and individuals using Internet application services

a. Rights

Exploit and use Internet application services in the banking industry according to agreements between the parties.

Lodge complaints and be compensated when their legitimate rights are violated in accordance with the provisions of the law.

b. Obligations

Ensure the safety and security of the Internet equipment system. Strictly manage passwords, personal information, and protect the Internet equipment system.

Ensure the contents provided, stored, and transmitted when using Internet application services.

Provide information to network management agencies about unauthorized access or access to Internet application services in the banking industry that have not been permitted or are prohibited.

Cooperate and facilitate state agencies in implementing measures to ensure the safety of the Internet equipment network, information security, and investigation and prevention of computer crimes in Internet activities.

Pay service fees for Internet application services according to agreements between the parties.

9. The Banking Technology Information Department shall be responsible for reviewing, evaluating, monitoring, and recommending to the Governor technical conditions ensuring that organizations and units in the banking sector provide Internet application services in the banking sector.

III. IMPLEMENTATION PROVISIONS

1. This Circular takes effect fifteen days from the date of publication in the Official Gazette. Previous provisions contrary to this Circular cease to be effective.

2. The Head of the State Bank of Vietnam Office, the Director of the Banking Technology Information Department, the Heads of units under the State Bank of Vietnam, the Directors of provincial and centrally-administered city branches of the State Bank of Vietnam, the Heads of organizations and units providing Internet services in the banking sector, and the General Managers (Directors) of credit institutions are responsible for implementing this Circular.

3. Any issues encountered during implementation should be promptly reported to the State Bank of Vietnam for study and resolution.