Decree No. 117/2018/ND-CP on keeping confidential, providing customer information of credit institutions and foreign bank branches

DECREE

Regarding the maintenance of confidentiality and provision of customer information for credit institutions and foreign bank branches

Pursuant to the Law on Government Organization dated June 19, 2015;

Pursuant to the Law on Credit Institutions dated June 16, 2010;

Pursuant to the Law amending and supplementing certain articles of the Law on Credit Institutions dated November 20 sửa một số Điều của Luật các tổ chức tín dụng ngày 20 tháng 11 2017;

Based on the Deposit Insurance Law dated June 18, 2012;

At the proposal of the Governor of the State Bank of Vietnam;

The Government issues this Decree on the maintenance of confidentiality and provision of customer information for credit institutions and foreign bank branches. về bảo mật, cung cấp thông tin khách hàng của tổ chức tín dụng, chi nhánhngân hàng nước ngoài.

PART I

GENERAL PROVISIONS

Article 1. Scope of Regulation

Article 1. This Decree stipulates the maintenance of confidentiality and provision of customer information for credit institutions and foreign bank branches, except for cases provided for in Clauses 2, 3, and 4 of this Article.

Clause 2. The maintenance of confidentiality and provision of customer information for credit institutions and foreign bank branches where such information falls within the list of state secrets shall be carried out in accordance with the provisions of the law on protecting state secrets.

Clause 3. The maintenance of confidentiality and provision of customer information for credit institutions and foreign bank branches to the State Bank of Vietnam shall be carried out in accordance with the Law on the State Bank, the Law on Credit Institutions 2010, amended and supplemented in 2017, and guiding documents of the Law on the State Bank and the Law on Credit Institutions 2010, amended and supplemented in 2017.

Clause 4. The maintenance of confidentiality and provision of customer information for credit institutions and foreign bank branches to agencies, organizations, and individuals for use in anti-money laundering; anti-terrorism purposes shall be carried out in accordance with the provisions of the law on anti-money laundering; anti-terrorism.

Article 2. Applicability

This Decree applies to the following entities:

1. Credit institutions and foreign bank branches.

2. Customers of credit institutions and foreign bank branches.

3. State agencies, other organizations, and individuals who are provided customer information by credit institutions and foreign bank branches.

4. Agencies, organizations, and individuals related to the provision of customer information by credit institutions and foreign bank branches.

Article 3. Explanation of Terms

In this Decree, the following terms are understood as follows:

Article 1. Customer information of credit institutions and foreign bank branches (hereinafter referred to as customer information) is information provided by customers, information arising during the process where customers request or are provided banking services, products, and services by credit institutions and foreign bank branches in their permitted activities, including customer identification information and the following information: account information, deposit information, entrusted asset information, transaction information, information about organizations and individuals acting as guarantors at credit institutions and foreign bank branches, and other relevant information.

Article 2. Customer identification information includes the following information:

Point a. For individual customers: full name, signature sample, electronic signature, date of birth, nationality, occupation, place of permanent residence registration address, current place of residence, overseas residence registration address for foreigners, telephone number, email address, identification card number or citizen identity card number or passport number (visa information for individual customers who are foreigners) of the customer or of the legal representative or authorized representative (collectively referred to as the authorized representative) and other relevant information;

Point b. For organizational customers: full trading name, abbreviated name, business license or establishment decision, business registration certificate or equivalent document; headquarters address, telephone number, fax number, email address, and the information specified in Point a of this Clause of the authorized representative and other relevant information.

Article 3. Account information of customers includes customer identification information and the following information: account name, account number, account balance, information related to customer deposits, withdrawals, transfers, and receipts, and other relevant information.

Article 4. Deposit information of customers includes customer identification information and the following information: information related to customer deposits, balances of various types of deposits according to the law of customers at credit institutions and foreign bank branches, and other relevant information.

Article 5. Entrusted asset information of customers is information about customers' assets (objects, money, securities, property rights) entrusted at credit institutions and foreign bank branches, information about customers' assets managed and stored by credit institutions and foreign bank branches according to the law, including customer identification information and the following information: type of asset name, asset value, proof of ownership or usage rights or legitimate interests in assets of customers and other relevant information.

Article 6. Transaction information of customers is information generated from transactions between customers and credit institutions and foreign bank branches, including customer identification information and the following information: transaction documents, transaction time, number of transactions, transaction value, transaction balance, and other relevant information.

Article 7. State agencies with authority to request the provision of customer information (hereinafter referred to as state agencies) are units and organizations under the organizational structure of the Socialist Republic of Vietnam's State that have the right to request credit institutions and foreign bank branches to provide customer information to perform their assigned functions and tasks in accordance with the law.

Article 8. Other organizations are organizations that are not state agencies as stipulated in Clause 7 of this Article.

Article 4. Principles for Maintaining Confidentiality and Providing Customer Information

1. Customer information of credit institutions and foreign bank branches must be kept confidential and may only be provided in accordance with the Law on Credit Institutions 2010, amended and supplemented in 2017, this Decree, and relevant laws.

2. Credit institutions and foreign bank branches shall not provide customer authentication information when accessing banking services, including secret key codes, biometric data, customer access passwords, and other customer authentication information to any agency, organization, or individual, except with the written or other form of consent from the customer as agreed upon with that customer.

3. State agencies, other organizations, and individuals may request credit institutions and foreign bank branches to provide customer information only for purposes, contents, scopes, and authorities as prescribed by law or with the customer's consent and must bear responsibility for requesting such information provision.

4. State agencies, organizations, and individuals must maintain confidentiality of customer information, use customer information for the intended purpose when requesting it, and not provide it to third parties without the customer's consent, except as required by law.

5. Agencies, organizations, and individuals must store and preserve customer information, customer information request files, and information exchange records in accordance with legal provisions on recordkeeping and preservation.

Article 5. Internal Regulations on Maintaining Confidentiality, Storing, and Providing Customer Information

1. Credit institutions and foreign bank branches shall base their internal regulations on maintaining confidentiality, storing, and providing customer information on legal provisions and this Decree, and implement them uniformly within the credit institution or foreign bank branch.

2. Internal regulations on maintaining confidentiality, storing, and providing customer information must include at least the following contents:

a) Procedures and processes for receiving, processing, and providing customer information; procedures and processes for storing and protecting customer information confidentiality;

b) Supervision, inspection, and handling of violations of internal regulations on maintaining confidentiality, storing, and providing customer information;

c) Delegation of authority, powers, and obligations of units and individuals in maintaining confidentiality, storing, and providing customer information.

Chapter II

 SPECIFIC PROVISIONS

Section 1

CUSTOMER INFORMATION CONFIDENTIALITY AND INFORMATION PROVISION TO STATE AGENCIES

Article 6. Forms of Requesting and Providing Customer Information

1. Forms of requesting and providing customer information:

a) Indirect form: requests and provision of customer information are carried out through postal service organizations or via electronic means, telecommunications networks, and computer networks.

Requests and provision of customer information via electronic means, telecommunications networks, and computer networks must comply with legal provisions on electronic transactions, guidelines of credit institutions and foreign bank branches, and be consistent with technical conditions of the parties involved;

b) Direct form: requests and provision of customer information are conducted at the headquarters of credit institutions and foreign bank branches and through representatives of the parties.

2. Exchange of customer information:

a) For indirect forms through postal service organizations: the handover and receipt of mail containing customer information must be recorded in a logbook and monitored between credit institutions, foreign bank branches, and postal service organizations;

b) For indirect forms through electronic means, telecommunications networks, and computer networks: transmission, receipt, provision, and storage of customer information must ensure security and comply with procedures and formalities stipulated by laws on electronic transactions, cybersecurity, and guidelines of credit institutions and foreign bank branches;

c) For direct forms: exchanges of customer information must be documented in a protocol, bearing the seal and signature of the authorized person according to the delegation of credit institutions and foreign bank branches, and the signature of the representative receiving customer information.

Article 7. Time limit for providing customer information

1. In cases where relevant laws specifically stipulate the time limit for providing customer information to state agencies, the time limit for providing customer information shall be the time limit prescribed in such relevant laws from the date of receiving complete application files for providing customer information as stipulated in Article 9 of this Decree.

2. In cases where relevant laws do not specifically stipulate the time limit for providing customer information to state agencies, the time limit for providing customer information shall be carried out according to the agreement between credit organizations, foreign bank branches and state agencies or according to internal regulations of credit organizations, foreign bank branches but shall not exceed the following maximum time limits:

a) 10 working days from the date of receiving complete application files for providing customer information as stipulated in this Decree for simple and readily available customer information.

b) 25 days from the date of receiving complete application files for providing customer information as stipulated in this Decree for complex and non-readily available customer information.

Article 8. Procedures and formalities for providing customer information

1. When requiring customer information, state agencies shall send credit organizations, foreign bank branches the application file for requesting customer information as stipulated in this Decree.

2. Upon receiving the request for providing customer information, credit organizations, foreign bank branches shall act as follows:

a) In cases where the application file for requesting customer information is complete as stipulated in this Decree, credit organizations, foreign bank branches shall collect and provide customer information to state agencies in accordance with the requirements and time limits stipulated in Article 7 of this Decree.

In cases where the information is provided directly to the representative of the state agency, credit organizations, foreign bank branches must require the representative to present their identity card or citizen identification card or passport for verification before transferring the customer information;

b) In cases where the application file for requesting customer information is incomplete as stipulated in this Decree, within three working days from the date of receiving the application file for requesting customer information, credit organizations, foreign bank branches shall request state agencies or representatives to supplement the necessary information and documents in accordance with the provisions of this Decree.

3. In cases of refusing to provide customer information as stipulated at point b, Clause 1, Article 14 of this Decree or delaying the provision of customer information due to force majeure, within five working days from the date of receiving the application file for requesting customer information, credit organizations, foreign bank branches must issue a notification letter to state agencies stating the reasons for refusal or delay in providing customer information.

Article 9. Application File for Requesting Customer Information

1. The request for providing customer information signed by the individual authorized as stipulated in Article 10 of this Decree shall contain the following contents:

a) Specific legal basis stipulating the authority to request customer information;

b) Reason and purpose for requesting customer information, clearly stating the relationship of the customer with the purpose of requesting customer information;

c) Content, scope of customer information, time limit for providing;

d) Form of request and provision of customer information; form of the document providing information (copy, printout, soft copy and other forms as prescribed by law);

đ) Full name; identity card number or citizen identification card number or passport number; address, telephone number of the representative receiving customer information in cases where the information is provided in the manner prescribed in point b, Clause 1, Article 6 of this Decree;

e) Other content of the request (if any).

2. Documents issued by the competent authority and consistent with the relevant laws to prove the reason and purpose for requesting customer information (inspection decision, inspection decision, audit decision, indictment decision, judgment, enforcement decision, prosecution decision, compulsory execution decision, penalty decision or equivalent documents).

3. The documents stipulated in Clause 2 of this Article shall not apply to requests for providing customer information by state agencies for purposes of collecting information, materials, evidence to serve the handling of reports on criminal offenses, recommendations for prosecution; national security protection; preventing and combating violations of law as prescribed by law.

Article 10. Authority to Sign Documents Requesting Customer Information

Documents requesting customer information must be signed by the following individuals:

1. The General Inspector of the Government, Deputy General Inspector of the Government; Heads of Inspectors, Deputy Heads of Inspectors of ministries; Heads of Inspectors, Deputy Heads of Inspectors of provinces; Heads of Inspectors, Deputy Heads of Inspectors of departments; Heads of Inspectors, Deputy Heads of Inspectors of districts; Heads, Deputy Heads of agencies assigned to perform specialized inspection functions, Inspection Team Leaders; members of inspection teams as prescribed by laws on inspection.

2. The State Auditor General, Deputy State Auditor General, Sectoral State Auditor General, Regional State Auditor General, Audit Team Leaders, Audit Group Leaders, State Auditors who are members of audit teams as prescribed by laws on state auditing.

3. Procurator Generals, Deputy Procurator Generals, Prosecutors of People's Procuracy at all levels, Military Procuracy at all levels as prescribed by laws on people's procuracies.

4. Chief Justices, Deputy Chief Justices, Judges, Judicial Assistants of the Supreme People's Court, Higher People's Courts, Provincial People's Courts, District People's Courts, City People's Courts, Central Military Court, Military Region Military Court, and equivalent courts, Military Area Military Court as prescribed by laws on courts.

5. Heads, Deputy Heads of investigation agencies within the investigation system; Heads, Deputy Heads of agencies assigned tasks to conduct certain investigative activities as prescribed by laws on criminal investigation agencies.

6. Heads, Deputy Heads of business units within the public security force, armed forces as prescribed by laws on the public security force, armed forces.

7. Heads, Deputy Heads of enforcement agencies, enforcement officers currently organizing enforcement as prescribed by laws on enforcement.

8. Directors, Deputy Directors of the General Department of Customs; Directors, Deputy Directors of the Anti-Smuggling Investigation Department; Directors, Deputy Directors of the Post-Customs Clearance Supervision Department; Directors, Deputy Directors of Provincial, Inter-Provincial, and City Customs Departments; Branch Directors, Deputy Branch Directors of Customs Branches; Branch Directors, Deputy Branch Directors of Post-Customs Clearance Supervision Branches as prescribed by laws on customs.

9. Directors, Deputy Directors of the General Taxation Department; Division Chiefs, Deputy Division Chiefs of the Inspection Division of the General Taxation Department; Directors, Deputy Directors of Tax Departments; Branch Chiefs, Deputy Branch Chiefs of Tax Branches as prescribed by laws on tax management.

10. Other individuals of state agencies prescribed by relevant laws to have authority to sign state agency documents requesting financial institutions, foreign bank branches to provide customer information.

Section 2

CONFIDENTIALITY AND DISCLOSURE OF CUSTOMER INFORMATION TO OTHER ORGANIZATIONS, INDIVIDUALS

Article 11. Circumstances for Disclosing Customer Information

1. Financial institutions and foreign bank branches may only disclose customer information to other organizations or individuals under one of the following circumstances:

a) Other organizations or individuals with the right to request financial institutions and foreign bank branches to provide customer information as specifically provided in codes, laws, and resolutions of the National Assembly.

b) With the written consent of the customer or by another form agreed upon with the customer.

2. Financial institutions and foreign bank branches are responsible for providing customer information to the customer themselves or their legally authorized representatives.

Article 12. Maintaining Confidentiality and Providing Customer Information

1. The form of requesting, providing customer information; the deadline for providing customer information; the procedure and formalities for providing customer information by credit organizations and foreign bank branches to other entities and individuals as stipulated in point a, Clause 1, Article 11 of this Decree shall be implemented in accordance with the provisions of the Code, Law, and resolutions of the National Assembly and guiding documents of the Code, Law, and resolutions of the National Assembly.

2. In cases where the Code, Law, and resolutions of the National Assembly and guiding documents of the Code, Law, and resolutions of the National Assembly do not specify the form of requesting, providing customer information; the deadline for providing customer information; the procedure and formalities for providing customer information by credit organizations and foreign bank branches to other entities and individuals as stipulated in point a, Clause 1, Article 11 of this Decree, it shall be carried out as follows:

a) The form of requesting, providing customer information; the deadline for providing customer information; the procedure and formalities for providing customer information shall be implemented according to the provisions of Article 6, Clause 2, Article 7, and Article 8 of this Decree;

b) The dossier for requesting the provision of customer information shall be implemented according to the internal regulations of credit organizations and foreign bank branches;

c) The form of requesting, providing; the deadline; the procedure, formalities, and dossier for requesting the provision of customer information on insured deposits to deposit insurance organizations shall be implemented according to the provisions of the Deposit Insurance Law, this Decree, and the guidance of deposit insurance organizations.

3. The form of requesting, providing customer information; the deadline for providing customer information; the procedure, formalities, and dossier for requesting the provision of customer information by credit organizations and foreign bank branches to entities and individuals as stipulated in point b, Clause 1, and Clause 2, Article 11 of this Decree shall be implemented according to agreements with customers and in compliance with the internal regulations of credit organizations and foreign bank branches.

Section 3

RIGHTS, OBLIGATIONS, AND RESPONSIBILITIES OF CUSTOMERS, AUTHORITIES, ORGANIZATIONS, AND INDIVIDUALS IN MAINTAINING CONFIDENTIALITY AND PROVIDING CUSTOMER INFORMATION

Article 13. Rights and Obligations of Customers

1. Customers have the following rights:

a) To request credit organizations and foreign bank branches to provide their own customer information according to the agreement between the parties and in compliance with the law;

b) To lodge complaints, initiate lawsuits, and claim compensation for damages in accordance with the law in cases where state agencies, other organizations, individuals, credit organizations, and foreign bank branches provide or use customer information in violation of the law.

2. Customers have the obligation to comply with the provisions of this Decree and the guidance of credit organizations and foreign bank branches regarding the provision of customer information.

Article 14. Rights and Responsibilities of Credit Organizations and Foreign Bank Branches

1. Credit organizations and foreign bank branches have the following rights:

a) To request state agencies, other organizations, and individuals to supplement information and documents required for providing customer information in accordance with the provisions of this Decree;

b) To refuse to provide customer information to state agencies, other organizations, and individuals for requests to provide customer information that violate the law, this Decree, or requests for overlapping information that does not fall within the scope of customer information retained by credit organizations and foreign bank branches as stipulated by the law.

2. Credit organizations and foreign bank branches have the following responsibilities:

a) To provide customer information truthfully, completely, promptly, and accurately to the intended recipient and within the scope of the requested information;

b) To ensure the safety and confidentiality of customer information during the process of providing, managing, using, and storing customer information;

c) To resolve customer complaints regarding the provision of customer information in accordance with the law;

d) To organize supervision, inspection, and handling of violations of internal regulations on maintaining confidentiality, storing, and providing customer information;

đ) To bear responsibility in accordance with the law for cases of violating the provisions of this Decree and related laws.

Article 15. Rights and responsibilities of state agencies, other organizations, and individuals

1. State agencies, other organizations, and individuals have the right to request the provision of customer information from credit institutions and foreign bank branches in accordance with the provisions of this Decree and relevant laws.

2. State agencies, other organizations, and individuals shall be liable under the law for disclosing customer information and using customer information for purposes not in accordance with the law and this Decree.

Chapter III

IMPLEMENTING PROVISIONS

Article 16. Transitional Provisions

For requests for the provision of customer information before the effective date of this Decree, credit institutions and foreign bank branches shall provide customer information in accordance with the legal provisions in effect at the time of the request for information.

Article 17. Effective Date

1. This Decree takes effect from November 1, 2018.

2. This Decree replaces Government Decree No. 70/2000/NĐ-CP dated November 21, 2000 on keeping confidential, storing, and providing information related to deposits and entrusted assets of customers.

Article 18. Implementation Organization

Ministers, Heads of ministerial-level agencies, Heads of government-affiliated agencies, Chairpersons of provincial People's Committees under central cities, credit institutions, foreign bank branches, and related organizations and individuals are responsible for implementing this Decree./.