Decree No. 165/2018/ND-CP on electronic transactions in financial activities

DECREE

On electronic transactions in financial activities

_________

On the basis of Law on Government Organization dated June 19, 2015;

On the basis of Law on Electronic Transactions November 29, 2005;

At the proposal of the Minister of Finance;

The Government promulgates the Decree on electronic transactions in financial activities.

PART I

GENERAL PROVISIONS

Article 1. Scope of Regulation

This Decree stipulates matters related to electronic transactions in financial activities.

Article 2. Applicability

1. Agencies, organizations, and individuals are the managers of information systems serving electronic transactions in financial activities.

2. Agencies, organizations, and individuals participating in electronic transactions in financial activities.

3. Agencies, organizations, and individuals with the need to search for and verify information about electronic transactions in financial activities of other agencies, organizations, and individuals within the scope permitted by law.

Article 3. Explanation of Terms

In this Decree, the following terms are understood as follows:

1. "Electronic transaction in financial activities" means an electronic transaction between agencies, organizations, and individuals in various business operations such as state budget, state fund, tax, fee, surcharge, other revenues of the state budget, state reserve, public assets, state financial funds, financial investment, corporate finance, cooperative finance, customs, accounting, state management of prices, securities, financial services, accounting services, auditing services, insurance business, and other financial services under the jurisdiction of the Ministry of Finance. The implementation of these business operations shall be carried out in accordance with the provisions of specialized laws.

2. "Specialized laws" means laws on the state budget; taxes; fees and surcharges; management and use of state capital for production and business at enterprises; public debt management; customs; state reserves; public assets; accounting; prices; securities; independent auditing; insurance business; and other financial laws.

3. "Electronic document in financial activities" (hereinafter referred to as "electronic document") means information created, sent, received, and stored electronically when conducting electronic transactions in financial activities; including documents, reports, contracts, agreements, transaction information, administrative procedure implementation information, and other types of information and data as prescribed by specialized laws.

4. "Agency, organization, or individual initiating an electronic document" means the agency, organization, or individual that creates or sends an electronic document before it is retained, but does not include intermediaries transferring the electronic document. The determination of the agency, organization, or individual initiating an electronic document is regulated in Clause 2, Article 16 of the Law on Electronic Transactions.

5. "Manager of the information system serving electronic transactions in financial activities" (hereinafter referred to as "manager of the information system") means the agency, organization, or individual having direct authority to manage the information system serving electronic transactions in financial activities.

6. "Financial agency" refers to one of the following agencies:

a) The Ministry of Finance and its subordinate agencies and units under the Ministry with functions of managing state administration in sectors and fields under the jurisdiction of the Ministry of Finance;

b) Specialized agencies advising on state management in the field of finance under People's Committees at all levels (local financial agencies).

7. "Intermediary service in electronic transactions in financial activities" means a service representing (partially or entirely) another agency, organization, or individual to perform sending; receiving; storing; supporting the creation, processing of electronic documents; confirming the execution of electronic transactions by the parties involved in electronic transactions.

8. "Invalidating an electronic document" means a measure to render an electronic document unusable on the information system.

9. "Destroying an electronic document" means a measure to eliminate an electronic document from the information system so that it cannot be accessed or referenced to the information contained therein.

10. "Sealing an electronic document" means a measure to ensure the integrity of the information contained in the electronic document, preventing unauthorized modification, copying, illegal movement, invalidation, or destruction from the start to the end of the sealing process.

11. "Information system serving electronic transactions in financial activities" (hereinafter referred to as "information system") means an information system as prescribed in Clause 8, Article 4 of the Law on Electronic Transactions provided and used to conduct electronic transactions in financial activities.

12. "Authentication" means verification on the information system to ensure that the person conducting the electronic transaction is authorized to carry out the transaction or to check the digital signature on the electronic document according to the law on digital signatures.

13. "Authentication code" means a string of characters (numbers, letters, symbols, special characters) generated or recorded by the information system to be attached to the person conducting the electronic transaction each time they conduct a transaction to serve authentication purposes.

14. "Biometric authentication" means authentication performed using human biological characteristics with a very low rate of coincidence (recognized by science and technology at the time this measure is applied).

15. "Identification code of an electronic document" means a barcode or series of numbers and letters attached to an electronic document to uniquely identify the electronic document on the information system, serving the purpose of querying information about the electronic document.

Article 4. Principles of electronic transactions in financial activities

1. Agencies, organizations, and individuals participating in electronic transactions in financial activities must comply with the principles stipulated in Article 5 of the Law on Electronic Transactions; the provisions of specialized laws and related legal regulations.

2. Electronic transactions in financial activities that are administrative procedures must comply with the legal provisions on administrative procedures and online public services.

3. The use of digital certificates and digital signatures in electronic transactions in financial activities must comply with the legal provisions on digital signatures and digital signature certification services.

Chapter II

SPECIFIC PROVISIONS

Article 5. Legal value of electronic documents

1. Electronic documents must meet all requirements for state management and be consistent with the provisions of specialized laws. The form of presentation, creation, sending, receiving electronic documents, and the legal value of electronic documents shall be carried out in accordance with the Law on Electronic Transactions.

2. An electronic document has the value of an original when it is implemented through one of the following measures:

a) The electronic document is digitally signed by the agency, organization, or individual creating the electronic document and the agency, organization, or individual responsible according to the provisions of specialized laws.

b) The information system has measures to ensure the integrity of the electronic document during transmission, receipt, and storage on the system; records the agency, organization, or individual who created the electronic document and the agency, organization, or individual responsible who participated in processing the electronic document and applies one of the following methods to verify the agency, organization, or individual who created the electronic document and the agency, organization, or individual responsible who participated in processing the electronic document: verification by digital certificate, verification by biometric identification, verification from two factors or more including one-time authentication code or random authentication code.

c) Other measures agreed upon by the parties involved in the transaction, ensuring data integrity, authenticity, non-repudiation, and compliance with the provisions of the Law on Electronic Transactions.

Article 6. Conversion from paper documents to electronic documents

1. Methods of converting from paper documents to electronic documents:

a) Paper documents are converted into electronic form by scanning and transferring them into files on the information system, or

b) The content of paper documents is converted into data to be stored in the information system.

2. Electronic documents converted from paper documents must meet the following conditions:

a) Fully reflect the content of the paper document;

b) The individual or agency, organization implementing (or responsible for) the conversion of paper documents into electronic documents must sign digitally on the electronic document after the conversion from the paper document or be verified by one of the verification methods provided for in point b, Clause 2, Article 5 of this Decree.

3. Electronic documents converted from paper documents have the same value as paper documents except where otherwise provided by specialized laws.

Article 7. Conversion from electronic documents to paper documents

1. Agencies, organizations, and individuals may print electronic documents they create and manage, and the information system managers may print electronic documents of agencies, organizations, and individuals under their management from the information system for storage, information comparison, or presentation to competent authorities for information inspection or provision to other agencies, organizations requiring information verification within the scope prescribed by law.

2. Agencies, organizations, and individuals may request the information system manager to confirm the implementation of electronic transactions in paper form for presentation to competent authorities for information inspection about the document or provision to other agencies, organizations, and individuals requiring information verification within the scope prescribed by law. When this request and confirmation are made at state agencies, they must comply with the provisions, procedures, and processes for providing information under the law on access to information.

3. Paper documents converted from electronic documents must meet the following conditions:

a) Fully and accurately reflect the content of the electronic document;

b) Contain information indicating that the document has been processed on the information system and the name of the information system or the name of the information system manager;

c) Have a unique identifier for the electronic document to facilitate information search and verification or the name and signature of the person performing the conversion;

d) Have the seal of the agency, organization conducting the conversion if required by law or agreed upon between the parties to the transaction.

đ) Be accessible at any time during the normal operation of the information system.

4. Paper documents converted from electronic documents have the same value as electronic documents except where otherwise provided by specialized laws.

Article 8. Amending electronic documents

1. The amendment of electronic documents before they have been officially approved or transmitted for electronic transactions shall be carried out according to the management procedures of the agency, organization, or individual that created the document or manages the information system.

2. The amendment of electronic documents after they have been officially approved or transmitted for electronic transactions must be redone from the creation stage and ensure compliance with the relevant laws of the specialized field.

3. The information system must record the person who made the amendment, the time of the amendment, and other related information about the amendment of electronic documents.

Article 9. Storing electronic documents

1. Electronic documents shall be stored in accordance with the provisions of the specialized laws, suitable for the electronic storage environment and conditions, and relevant regulations on storage under the law.

2. Agencies and units storing electronic documents must ensure the conditions stipulated in Clause 1 of Article 15 of the Law on Electronic Transactions.

Article 10. Revoking the validity of electronic documents

1. An electronic document is revoked under one of the following conditions:

a) The document is revoked according to the process and regulations of the unit creating or processing the electronic document based on compliance with the provisions of the specialized laws.

b) The document is revoked based on the agreement and confirmation of the parties involved in the transaction. This confirmation is expressed in one of the following ways: A document signed by the parties involved in the transaction or their authorized representatives (if it is an electronic document, the legal effect is applied according to Article 5 of this Decree); a request to revoke the document from one party involved in the transaction and acceptance of the revocation request by the remaining parties through an email or data message created on the same information system that generated or stored the electronic document, verified by one of the methods accepted for electronic documents as provided in Article 5 of this Decree.

2. An electronic document that has had its validity revoked must be marked, recorded with the time and the person who revoked it on the information system, and notified to the relevant parties.

3. An electronic document that has had its validity revoked must be stored for the purpose of serving state agencies' inquiries within the retention period prescribed by the specialized laws.

4. When an electronic document is revoked, the corresponding paper document converted from this electronic document (if any) also loses its validity and ceases to be usable.

Article 11. Destroying electronic documents

1. Electronic documents and paper documents converted from electronic documents that have exceeded the retention period as prescribed may be destroyed if there is no contrary decision from the competent state authority.

2. The destruction of electronic documents must not affect the integrity of undestroyed electronic documents and must ensure the normal operation of the information system.

3. The information system must record the destruction of electronic documents in a list including information about the time and the person who destroyed the electronic document, and store this list on the system, ready for necessary inquiries.

Article 12. Sealing of electronic evidence

1. The authority to seal electronic evidence shall be carried out in accordance with the provisions of the law on sealing documents and evidence for the purpose of inspection, audit, investigation.

2. Sealing of electronic evidence must ensure:

a) Not affecting the normal operation of the information system and the production and business activities of organizations and individuals;

b) Being able to restore the integrity of sealed electronic evidence at the organization's or individual's information system after the sealing period has expired;

c) Determining access and changes to the content of sealed electronic evidence;

d) The information system must mark sealed electronic evidence and record the time and person who seals the electronic evidence.

3. After the competent state agency decides and implements sealing measures, organizations and individuals are not permitted to access, exploit, copy, modify, or use this electronic evidence in their own information systems for transactions or other purposes.

Article 13. Provisions for Information Systems

1. The information system must be guaranteed to be accurate in time and synchronized according to Vietnam Standard Time (ISO 8601). It is encouraged to use time stamp services provided by organizations in accordance with the law on digital signatures and digital signature certification services for types of documents where the creation or processing time of the document is bound by specialized legal regulations or may cause disputes over interests and legal issues among transaction parties.

2. The information system serving the creation and processing of electronic documents must have the function of converting electronic documents into paper documents to serve the purposes specified in Clauses 1 and 2 of Article 7 of this Decree.

3. The information system must have the ability to store electronic documents or provide access to stored electronic documents in a separate storage system. In cases where the information system is upgraded or technology is changed, the information system manager is responsible for providing access to electronic documents created or stored on the information system before the upgrade or technology change.

4. The information system of financial agencies and related state agencies must have the capability to connect and exchange electronic documents in accordance with the Government's regulations on implementing the e-Government. The information systems of other agencies and organizations must have the capability to connect and exchange electronic documents with the financial agency's information system in accordance with specialized management laws.

5. The legal representative of the agency or organization using the information system to automatically sign electronic documents is responsible under the law for the electronically signed documents.

Article 14. Ensuring Safety in Electronic Transactions in Financial Activities

1. If the information system manager collects personal information of transaction participants, they must comply with the Cybersecurity Law, the Cybersecurity Protection Law, and relevant laws regarding personal information protection.

2. The information system manager must ensure safety and security for the information system and transactions of transaction participants in accordance with the law on cybersecurity, at least applying the following measures:

a) Determine the level and implement corresponding information system security solutions in accordance with the Cybersecurity Law and Decree No. 85/2016/NĐ-CP dated July 1, 2016 of the Government on ensuring information system security by level. In cases where the information system manager is non-state organizations, only determine the security level of the system and equip minimum protective measures for the system that meet the requirements of the corresponding level as prescribed by the Ministry of Information and Communications, without being required to go through procedures for review and approval of the level.

b) Connections from agencies, organizations, and individuals to the information system must be encrypted. Websites or portals serving electronic transactions in financial activities must use digital certificates to secure information during transmission and prevent forgery.

Article 15. Use of intermediary services in electronic transactions

1. Telecommunications service providers operating mobile communication networks and the Internet, and businesses providing digital signature certification services may provide intermediary services in financial electronic transactions.

2. Agencies, organizations, and individuals may select intermediary service providers that meet their needs for conducting financial electronic transactions.

3. Agencies, organizations, and individuals using intermediary services and intermediary service providers must enter into agreements or contracts specifying the responsibilities and authorities of each party within the scope permitted by law.

Article 16. Verification of Information on Electronic Transactions in Financial Activities

1. Authorities with jurisdiction, when inspecting, auditing, or investigating according to specialized laws, and agencies responsible for administrative procedures, if necessary, may verify information on electronic transactions of agencies, organizations, and individuals through one of the following methods:

a) Using an electronic confirmation of the results of electronic transactions sent by the system administrator to agencies, organizations, and individuals in the form of a file or email.

b) Observing on-site the results of information queries conducted by agencies, organizations, and individuals on the information system.

c) Using the feature provided by the system administrator to electronically query information about electronic documents.

d) Connecting, transmitting data, and exchanging information with financial agencies to obtain information on electronic transactions of entities involved in administrative procedures. This provision applies to agencies responsible for administrative procedures.

2. Inspection, audit, investigation agencies, and agencies handling administrative procedures may only request agencies, organizations, and individuals to present paper documents converted from electronic documents if verification cannot be carried out through any of the methods specified in Clause 1 of this Article.

Chapter III

IMPLEMENTING PROVISIONS

Article 17. Responsibilities of System Administrators Serving Electronic Transactions in Financial Activities

1. Comply with the provisions of this Decree.

2. Organize support for the implementation of transactions on the information system through one or a combination of several methods: directly, via telephone, email, website, or electronic portal, and other technologies.

3. Provide information on financial electronic transactions within the scope of the information system managed by the system administrator to competent management agencies for inspection, audit, and investigation of financial activities, and to agencies, organizations, and individuals seeking to verify information within the scope prescribed by law, as stipulated in Article 16 of this Decree and related laws.

4. Directly or authorize subsidiary units or branches to confirm paper documents converted from electronic documents upon request of agencies, organizations, and individuals participating in transactions on the information system under the management of the system administrator, in accordance with the law.

5. Maintain confidentiality of personal information, business information, and agency and organization information on the information system under the management of the system administrator, in accordance with the law.

6. Ensure the security of the information system, participate in emergency response activities, handle, and rectify incidents in accordance with laws on ensuring cybersecurity and cyber security, and the provisions of this Decree.

7. Agencies, organizations, and individuals leasing technical infrastructure from another business to provide financial electronic transactions must ensure coordination with the leasing company to fully fulfill the responsibilities stipulated in Clauses 1 to 6 of this Article.

Article 18. Responsibilities of agencies, organizations, and individuals participating in or using the results of electronic transactions in financial activities

1. Agencies, organizations, and individuals participating in electronic transactions in financial activities shall be responsible for managing and keeping secret means and information serving digital signing or authentication; immediately notifying the system management authority when such means or information are lost or disclosed.

2. Agencies, organizations, and individuals participating in electronic transactions with financial agencies shall be responsible for informing the financial agency of their contact address via electronic means and maintaining stability to facilitate information exchange during participation in electronic transactions with the financial agency; in case of change in the address, the organization or individual shall notify the financial agency of the new address.

3. Agencies, organizations, and individuals using the results of electronic transactions in financial activities shall be responsible for recognizing and using electronic vouchers according to the legal value of the electronic vouchers.

4. Adhering to other relevant provisions of this Decree.

Article 19. Responsibilities of the Ministry of Finance

1. Developing and implementing a roadmap for applying electronic transactions between agencies, organizations, and individuals and financial agencies under the Ministry of Finance; establishing connections and exchanging information on electronic transactions in financial activities between financial agencies under the Ministry of Finance and other ministries, agencies, and organizations in accordance with the goals and programs of the Government on e-Government, consistent with actual conditions and legal regulations.

2. Directing and organizing the dissemination, popularization, and education on legal regulations regarding electronic transactions in financial activities.

3. Guiding, inspecting, and auditing the implementation of legal regulations concerning electronic transactions in financial activities.

4. Resolving complaints, denunciations, and suggestions from agencies, organizations, and individuals regarding electronic transactions in financial activities.

Article 20. Responsibilities of local financial agencies

1. Developing and implementing a roadmap for applying electronic transactions between agencies, organizations, and individuals and local financial agencies (online public services in finance at the locality level).

2. Implementing and coordinating with the Ministry of Finance to disseminate, popularize, and educate on legal regulations regarding electronic transactions in financial activities within the jurisdiction managed by local financial agencies.

Article 21. Transitional Provisions

1. Enterprises that have provided intermediary services in electronic transactions in financial activities prior to the effective date of this Decree may continue to provide intermediary services in electronic transactions in financial activities in accordance with this Decree.

2. During the period before being issued a government-specific digital certificate by the service provider of government-specific digital signature certification, budget-using units may use public digital certificates to conduct electronic transactions with financial agencies for transactions requiring digital signatures. After obtaining a government-specific digital certificate from the service provider of government-specific digital signature certification, budget-using units shall be responsible for using this certificate instead of the public digital certificate and notifying the relevant financial agency about the change in digital certificates.

Article 22. Implementation Provisions

1. This Decree takes effect from February 10, 2019.

Decision No. 27/2007/NĐ-CP dated February 23, 2007, on electronic transactions in financial activities and Decision No. 156/2016/NĐ-CP dated November 21, 2016, amending and supplementing certain articles of Decision No. 27/2007/NĐ-CP dated February 23, 2007, on electronic transactions in financial activities shall cease to be effective from the date this Decree comes into effect.

3. The Ministers, Heads of ministerial-level agencies, Heads of government-affiliated agencies, Chairpersons of provincial People's Committees under central cities are responsible for implementing this Decree./.