Circular No. 134/2017/TT-BTC guiding electronic transactions on the securities market

CIRCULAR

Guidelines for electronic transactions on the securities market

Pursuant to the Securities Law dated June 29, 2006;

Pursuant to the Law Amending and Supplementing Certain Provisions of the Securities Law dated November 24, 2010;

Pursuant to the Law on Electronic Transactions dated November 29, 2005;

Pursuant to the Law on Information Technology dated June 29, 2006;

||| Pursuant to the Cybersecurity Law dated November 19, 2015;

Pursuant to Decree No. 58/2012/NĐ-CP dated July 20, 2012 of the Government detailing and guiding the implementation of certain provisions of the Securities Law and the Law amending and supplementing certain provisions of the Securities Law;

Pursuant to Decree No. 60/2015/NĐ-CP dated June 26, 2015 of the Government amending and supplementing certain provisions of Decree No. 58/2012/NĐ-CP dated July 20, 2012 of the Government detailing and guiding the implementation of certain provisions of the Securities Law and the Law amending and supplementing certain provisions of the Securities Law;

Pursuant to Decree No. 42/2015/NĐ-CP dated May 5, 2015 of the Government on derivative securities and the derivative securities market;

Pursuant to the Government Decree No. 27/2007/NĐ-CP dated February 23, 2007 on electronic transactions in financial activities;

Pursuant to Decree No. 156/2016/NĐ-CP dated November 21, 2016 of the Government amending and supplementing certain provisions of Decree No. 27/2007/NĐ-CP dated February 23, 2007 of the Government on electronic transactions in financial activities;

Pursuant to Decree No. 87/2017/NĐ-CP dated July 26, 2017, issued by the Government, stipulating the functions, tasks, powers, and organizational structure of the Ministry of Finance;

At the proposal of the Chairman of the State Securities Commission;

The Minister of Finance issues this Circular guiding electronic transactions on the securities market.

PART I
GENERAL PROVISIONS

Article 1. Scope of Regulation

This Circular guides online securities trading activities, electronic information exchange on the securities market, and other activities related to electronic transactions on the securities market.

Article 2. Applicability

The objects subject to this Circular include:

1. State Securities Commission, Stock Exchange, Vietnam Securities Depository.

2. Organizations and individuals participating in securities trading and activities on the securities market through electronic means, including:

a) Issuing organizations, listed organizations, organizations conducting over-the-counter trading, public companies;

b) Securities companies, fund management companies, investment securities companies;

c) Representative offices, branches of foreign securities companies in Vietnam; representative offices, branches of foreign fund management companies in Vietnam;

d) Commercial banks, branches of foreign banks that are members of the bond market or the derivative securities market, supervisory banks, depositary members, clearing members, distributors of fund certificates;

đ) Investors;

e) Other organizations and individuals participating in securities trading and activities on the securities market through electronic means.

Article 3. Explanation of Terms

Strategic multi-purpose hydropower plant

1. Online securities trading activity is the activity of securities trading carried out through information technology systems and the Internet, telecommunications networks, or other open networks, including: Securities trading between investors and organizations providing online securities trading services; securities trading between trading members and the Stock Exchange; securities-related transactions between depositary members, clearing members and the Vietnam Securities Depository.

2. Online securities trading system is a system serving the management and execution of online securities trading activities, including: Hardware equipment, software, databases, telecommunications networks, Internet, computer networks.

3. Electronic document in the securities field is a data message about electronic transactions on the securities market created, sent, received, and stored electronically.

4. Electronic order ticket is a data message recording the information of an investor's trading order placed through the online securities trading system at a specific time which can only be accessed by that investor through access authentication and order placement.

5. Two-factor authentication is a method of authentication requiring two factors to prove the correctness of an identity. Two-factor authentication relies on information that the user knows such as PINs, secret keys, together with information that the user possesses such as smart cards, tokens, mobile phones, or biometric characteristics of the user to verify the identity.

6. Network information security is the protection of information and information systems on the network from unauthorized access, use, disclosure, interruption, modification, or destruction to ensure the integrity, confidentiality, and availability of information.

8. Order placement phone number is the phone number registered by the investor with the organization providing online securities trading services to place securities trading orders.

9. Online securities trading service is a service provided by organizations providing online securities trading services to investors to open accounts, place orders, make requests for securities transactions, or receive transaction results through the Internet or telephone.

10. Organization providing online securities trading services is a securities company, fund management company, and fund certificate distributor providing online securities trading services.

11. Depositary member is a securities company or commercial bank operating in Vietnam that has been granted a registration certificate for securities depositary operations by the State Securities Commission and approved by the Vietnam Securities Depository to become a depositary member.

12. Clearing member is a securities company, commercial bank, or branch of a foreign bank that performs clearing and settlement of derivative securities transactions.

Article 4. Principles for electronic transactions on the securities market

Electronic transactions on the securities market must ensure principles of accuracy, fairness, transparency, clarity, security, efficiency, and compliance with the Law on Electronic Transactions, the Law on Cybersecurity, guiding documents, and other relevant laws.

Chapter II
ELECTRONIC SECURITIES TRADING ACTIVITIES

Section 1
REQUIREMENTS FOR SERVICES, TECHNICAL INFRASTRUCTURE, SECURITY AND CONFIDENTIALITY
AND DATA STORAGE

Article 5. Requirements for services

1. For the Securities Exchange and the Vietnam Securities Depository:

a) Establish and promulgate regulations for connecting the online securities trading system, procedures for handling incidents, system backups, risk management during online securities trading activities in accordance with the Law on Electronic Transactions, the Law on Cybersecurity, implementing guidelines, and provisions of this Circular;

b) Ensure the provision of public, fair, transparent, secure, and efficient online securities trading services to members using the same type of service.

2. For securities companies providing online securities trading services:

a) Directly provide online securities trading services to investors;

b) Build an electronic information website with a registered domain name on the Internet to provide online securities trading services. Programs and applications used for online securities trading must be uploaded or integrated onto this electronic information website;

c) Issue procedures for implementing online securities trading services including: daily operation monitoring procedures; registration and cancellation procedures for online securities trading services; incident handling procedures; system and data backup procedures; risk control procedures in the provision of online securities trading services to investors, and other procedures in accordance with the Law on Electronic Transactions, the Law on Cybersecurity, implementing guidelines, and provisions of this Circular, specifying the responsibilities of participants in these procedures;

d) Arrange staff with qualifications and certificates in software management, system management, and cybersecurity to manage and monitor the operations of the online securities trading system to ensure continuous and smooth operation;

đ) The provision and use of online securities trading services with investors must be evidenced by a contract or terms of the securities trading account opening agreement, which specifically stipulates the methods of online securities trading, potential risks when conducting online securities trading as provided in Clause 1, Article 15 of this Circular, compensation responsibilities of each party in case of risk, and other responsibilities related to online securities trading activities;

e) Record information about investors' transaction requests on the online securities trading system. This information must be stored for retrieval according to time, login session, transaction results, pre- and post-transaction balances for the investor's account;

g) Notify investors of the results of executed trading orders immediately after the orders are matched on the online securities trading system.

3. Fund management companies and fund certificate distributors providing online securities trading services must comply with the requirements set forth in points a, b, c, đ, e, and g of Clause 2 of this Article.

Article 6. Requirements for infrastructure and technical systems of online securities trading

1. For securities companies providing online securities trading services:

a) The online securities trading system must be physically separated from other business systems of the company to ensure network information security, reduce risks, and avoid conflicts between systems;

b) Equip dedicated servers for the online securities trading system, not using personal computers as servers and not sharing with servers of other units or companies. Dedicated information technology equipment for the online securities trading system must have backups;

c) The area where the online securities trading system is placed must meet security, environmental, and system safety conditions: A separate area, equipped with electronic locks or equivalent devices to control entry and exit, surveillance cameras; dedicated fire alarm and extinguishing systems; air conditioning systems, temperature and humidity monitoring and control; dedicated uninterruptible power supply and backup generator systems; lightning protection systems;

d) Companies may lease space for the online securities trading system at data centers (Data Centers). These data centers must comply with legal regulations on Data Center operations. The online securities trading system located at Data Centers must have solutions to prevent illegal access and exploitation of data;

g) Apply technical or management measures to establish limits on buying and selling securities according to legal provisions for investors participating in online securities trading services. These limits must be communicated to investors on the online securities trading website and there must be a approval process for changes to these limits;

2. For fund management companies and fund certificate distributors providing online securities trading services, they must meet the requirements stipulated in points a, b, and e Clause 1 and Clause 3 of this Article;

3. Securities Exchanges, Vietnam Securities Depository, and organizations providing online securities trading services must have contingency plans for the online securities trading system and provide alternative trading methods in case the online securities trading system encounters issues;

Article 7. Provisions on information security and data storage of organizations providing online securities trading services

1. Electronic websites and email systems of organizations providing online securities trading services must be verified by digital certificates;

2. The online securities trading system must be established to prevent unauthorized access to internal business systems through online trading activities and must have system permissions divided among business units that potentially conflict of interest according to internal control procedures;

3. Software applications must be reviewed and scanned for security vulnerabilities before being put into operation and have a report evaluation documented in a memorandum. The operational environment for the online securities trading software system must be separated from the testing environment and software development environment. Regularly conduct network information security risk assessments of the online securities trading system once every year;

4. The online securities trading system must have technical solutions to ensure network information security and data system confidentiality;

5. Electronic documents, electronic order forms, electronic data, and recordings of customer call orders, including cancellation orders, must be stored in their original form for at least ten (10) years;

6. Customer information using online trading services, transaction orders, and information exchanged on the system must be encrypted during transmission and at the application level, and be secured according to legal provisions except when required by competent state management agencies.

Article 8. Provisions on Authentication

1. Authentication solutions applied in online securities transactions must have a minimum level of security equivalent to multi-factor authentication solutions, including:

a) Two-factor authentication solution;

b) Authentication solution using digital certificates;

c) Other authentication solutions permitted by law and consistent with the regulations of the competent authority.

Article 9. Provisions on Electronic Order Forms

2. An order cancellation form must include information about the order number, cancellation volume, and cancellation confirmation.

4. In fund certificate transactions, electronic order forms must ensure all required information according to the laws governing fund certificate transactions and comply with the provisions of Clause 3 of this Article.

Section 2
REGISTRATION, WITHDRAWAL OF APPROVAL
PROVIDING ONLINE SECURITIES TRADING SERVICES

Article 10. Subjects Registering to Provide Online Securities Trading Services

The subjects registering to provide online securities trading services are securities companies that are members of the Stock Exchange, have connected to the Stock Exchange's trading system, and do not fall under the following circumstances:

1. Currently undergoing dissolution, bankruptcy, suspension of operations, or trading suspension to terminate membership status at the Stock Exchange.

2. Having had brokerage business revoked or currently undergoing procedures to revoke brokerage business.

3. Under special supervision or supervision.

4. Other cases of suspended operations as stipulated by law.

Article 11. Documents for Registering to Provide Online Securities Trading Services

The documents for registering to provide online securities trading services include:

1. Application for providing online securities trading services according to the form prescribed in Appendix No. 01 issued together with this Circular.

2. List of names and resumes of system management experts for online securities trading according to the form prescribed in Appendix No. 02 issued together with this Circular.

3. Report on the design of the online securities trading system according to the form prescribed in Appendix No. 03 issued together with this Circular.

4. Certified copy of the approval document and inspection record of the online securities trading system of the Stock Exchange for trading members.

Article 12. Procedure for Approval to Provide Online Securities Trading Services

The securities company shall prepare the dossier in accordance with Article 11 of this Circular and choose the method to handle the procedure with the State Securities Commission through the online public service system of the State Securities Commission or submit the dossier directly or through postal services.

1. Within five (05) working days from the date of receipt of the dossier in accordance with Article 11 of this Circular, in case the dossier needs to be supplemented or amended, the State Securities Commission shall issue a document requesting supplementation or written explanation for cases where the dossier is not valid.

2. Within ten (10) working days from the date of receipt of the document requesting amendment or supplementation of the dossier issued by the State Securities Commission, the securities company must complete the dossier according to the requirements and send it to the State Securities Commission. After this period, if the securities company does not supplement the dossier as required, the State Securities Commission has the right to refuse approval.

3. Within twenty (20) working days from the date of receipt of a complete and valid dossier, the State Securities Commission shall examine and decide on the approval to provide online securities trading services for the securities company. In case of refusal, the State Securities Commission must reply in writing and specify the reasons.

Article 13. Revocation of Approval Decision, Suspension of Provision of Online Securities Trading Services

1. In case the securities company is temporarily suspended from operations or its securities brokerage activities are suspended or all its activities are halted, the securities company must suspend the provision of online securities trading services until such conditions are resolved.

2. The securities company's approval decision to provide online securities trading services will be revoked in the following cases:

a) It has registered to withdraw securities brokerage business and received the approval of the State Securities Commission;

b) Its securities brokerage business has been withdrawn;

c) It has lost its membership status with the Stock Exchanges;

d) It has been merged, divided, or consolidated;

đ) It has been dissolved, declared bankrupt, or had its establishment and operation license revoked;

e) It fails to maintain or comply with the provisions set out in Clause 2 of Article 5, Clause 1 and Clause 3 of Article 6, Article 7, Clause 1 of Article 8, and Clause 3 of Article 9 of this Circular;

g) The registration dossier for providing online securities trading services contains false information;

h) Other cases due to management authority requirements or the company's voluntary application to stop providing online securities trading services.

3. A securities company whose approval decision to provide online securities trading services is revoked in accordance with points b, c, e, and g of Clause 2 of this Article may re-register to provide such services.

4. A securities company whose approval decision to provide online securities trading services is revoked in accordance with Clause 2 of this Article must maintain and ensure the data retention period of the online securities trading system to fulfill its obligations under the law.

5. The procedure for revoking the approval decision to provide online securities trading services of a securities company shall be carried out in accordance with the guidelines of the State Securities Commission.

Section 3
REPORTING AND DISCLOSURE OF INFORMATION IN ONLINE SECURITIES TRADING ACTIVITIES
ONLINE SECURITIES TRADING ACTIVITIES

Article 14. Provisions on Reporting in Online Securities Trading Activities

1. Securities companies approved to provide online securities trading services shall submit to the State Securities Commission the following reports:

a) Annual report on online securities trading activities according to the form prescribed in Appendix No. 04 issued together with this Circular within thirty (30) days from the end of the year;

b) Reports accompanied by related documents when upgrading or changing the online securities trading system: Core system changes, trading method changes, information technology personnel changes, system location changes according to the form prescribed in Appendix No. 08 issued together with this Circular. The deadline for submitting the report is seven (07) working days after the securities company implements upgrades or changes.

2. Stock Exchanges shall submit to the State Securities Commission the following reports:

a) Annual report on the online securities trading system according to the form prescribed in Appendix No. 05 issued together with this Circular within thirty (30) days from the end of the year;

b) Report on changes in technical standards regulations for exchange trading members. The reporting deadline is seven (07) working days after the change occurs.

3. The Vietnam Securities Depository shall submit to the State Securities Commission an annual report on the situation of online securities trading according to the form prescribed in Appendix No. 06 issued together with this Circular within thirty (30) days from the end of the year.

4. Within twenty-four (24) hours from the occurrence of serious incidents related to the online securities trading system, the Stock Exchange, the Vietnam Securities Depository, and the securities company must submit reports according to the form prescribed in Appendix No. 07 issued together with this Circular.

5. Fund management companies and fund certificate distributors must report to the State Securities Commission the documents prescribed in Clause 3, Article 11 of this Circular at least five (05) working days before implementing the online securities trading system for investors; submit an annual report on online securities trading activities according to the form prescribed in Appendix No. 04 issued together with this Circular within thirty (30) days from the end of the year.

6. Reports must be submitted electronically through electronic information exchange systems as directed by the State Securities Commission.

Article 15. Disclosure of Information in Online Securities Trading Activities

1. The official website and application software serving online securities trading for investors of securities companies, fund management companies, and fund certificate distributors must disclose provisions regarding online securities trading services and potential risks that may occur when investors conduct online securities transactions. Risks include:

a) During transmission over the Internet, trading orders may be suspended, interrupted, delayed, or contain data errors;

b) Identification of organizations or investors may not be accurate, security errors may occur;

c) Market prices and other securities information may have errors or discrepancies;

d) Risks that may arise from investor order authentication methods;

e) Other risks deemed necessary to disclose by competent state management agencies, securities companies, fund management companies, and fund certificate distributors.

2. Stock Exchanges shall publish on their official websites the relevant laws concerning electronic trading in the securities market and regulations governing electronic trading activities issued by the Stock Exchanges.

3. The Vietnam Securities Depository shall publish on its official website a list of permitted online securities trading products and services; relevant laws concerning electronic trading in the securities market and regulations governing electronic trading activities issued by the Vietnam Securities Depository.

4. The State Securities Commission shall post on its official website a list of securities companies authorized to provide online securities trading services, procedures, and regulations regarding the registration for providing online securities trading services, and a list of securities companies whose approval to provide online securities trading services has been revoked.

Chapter III
ELECTRONIC INFORMATION EXCHANGE ACTIVITY

Article 16. Provisions on electronic information exchange activities

1. The content of electronic information exchange includes information exchanged through the Internet or related private networks concerning the following activities:

a) Public offering of securities, registration of securities, custody of securities, listing, trading registration, and securities trading;

b) Management activities of organizations and individuals as prescribed in Clause 2, Article 2 of this Circular;

c) Information disclosure activities on the securities market;

d) Other activities related to the securities market as prescribed by securities laws.

2. Organizations providing electronic information exchange services shall be responsible for:

a) Establishing an electronic information website on the Internet serving as an entry point for electronic information exchange services;

b) Securing information for users registered to use the service and ensuring the safety of the electronic information exchange system;

c) Issuing regulations guiding electronic information exchange services.

3. Participants in electronic information exchange who register to use the service shall comply with the regulations guiding the electronic information exchange service issued by the organization providing such service.

4. The use of digital certificates and digital signatures in electronic information exchange activities shall be carried out in accordance with the provisions of the law on electronic transactions in financial activities.

Chapter IV
RESPONSIBILITIES OF AUTHORITIES, ORGANIZATIONS, AND INDIVIDUALS PARTICIPATING IN ELECTRONIC TRADING ACTIVITIES ON THE SECURITIES MARKET

Article 17. Responsibilities of organizations and individuals participating in electronic trading activities on the securities market

1. Comply with regulations in securities trading and securities market activities.

2. Comply with regulations on protecting information in electronic trading activities and regulations on security protection, personnel, and data systems.

3. Maintain complete records, documents, and certificates related to online securities trading activities of the company. Prepare and confirm registration forms for online securities trading services with accurate information, make amendments and supplements to the forms when inaccurate information is discovered, and ensure that important contents are not omitted according to the regulations. Maintain information reported in accordance with the law.

4. Securities companies may not provide online securities trading services without the approval of the State Securities Commission or when the approval decision has been revoked.

5. Report accurately and fully within the time limit prescribed by law or as required by the State Securities Commission.

Article 18. Supervision and inspection of electronic trading activities on the securities market

1. The State Securities Commission shall be responsible for supervising and inspecting periodically or irregularly the Stock Exchange, Vietnam Securities Depository, securities companies, fund management companies, fund distribution agents, and other organizations and individuals regarding their implementation of electronic trading activities on the securities market as prescribed or when incidents occur affecting investors' rights and the safety of the securities market.

2. The Stock Exchange and Vietnam Securities Depository shall be responsible for coordinating to supervise the online securities trading activities of organizations providing online securities trading services and related organizations as requested by the State Securities Commission.

3. Organizations and individuals participating in electronic trading activities on the securities market shall be responsible for promptly providing full information, data, and relevant documents on electronic trading activities upon request from competent authorities.

Chapter V
IMPLEMENTING PROVISIONS

Article 19. Effective Date

This Circular takes effect from the date of January 2018 and replaces Circular No. 87/2013/TT-BTC dated June 28, 2013, issued by the Minister of Finance guiding electronic trading activities on the securities market.

Article 20. Implementation

1. Within six (06) months from the date this Circular takes effect, securities companies already approved by the State Securities Commission to provide online securities trading services before the effective date of this Circular shall be responsible for completing the online securities trading system to ensure compliance with service requirements, technical infrastructure, security protection, authentication, and data storage requirements as prescribed in this Circular.

2. The State Securities Commission shall guide and issue technical standards for the application of information technology in electronic trading activities on the securities market.

3. The State Securities Commission, the Stock Exchange, Vietnam Securities Depository, and organizations and individuals participating in electronic trading activities on the securities market shall be responsible for implementing this Circular.