Circular No. 18/2024/TT-NHNN on bank card activities

CIRCULAR

Regulations on bank card activities

Pursuant to the Law on the State Bank of Vietnam dated June 16, 2010;

Pursuant to the Law on Credit Institutions dated January 18, 2024;

Pursuant to Decree No. 102/2022/NĐ-CP dated December 12, 2022 of the Government stipulating the functions, tasks, powers, and organizational structure of the State Bank of Vietnam;

Pursuant to Decree No. 52/2024/NĐ-CP dated May 15, 2024 of the Government on non-cash payments;

At the proposal of the Payment Department Director;

The Governor of the State Bank of Vietnam issues this Circular regulating bank card activities.

PART I
GENERAL PROVISIONS

Article 1. Scope of Regulation

This Circular regulates bank card activities (hereinafter referred to as cards) including: issuance, use, payment, switching, electronic settlement, and transaction clearing of cards.

Article 2. Applicability

1. Card issuing organizations.

2. Payment card organizations.

3. Service providers of intermediary payment services.

4. Accepting units.

5. Cardholders.

6. Other organizations and individuals related to card activities.

Article 3. Explanation of Terms

In this Circular, the following terms are understood as follows:

1. A bank card is a means of payment issued by a card issuing organization to conduct card transactions under the conditions and terms agreed upon by the parties.

2. A debit card allows the cardholder to conduct card transactions within the amount and overdraft limit (if any) on the cardholder's payment account opened at the card issuing organization.

3. A credit card allows the cardholder to conduct card transactions within the credit limit granted according to the agreement with the card issuing organization.

4. A prepaid card allows the cardholder to conduct card transactions within the value of money loaded onto the card corresponding to the amount prepaid to the card issuing organization.

Prepaid cards include: named prepaid cards (containing cardholder identification information) and unnamed prepaid cards (without cardholder identification information).

5. A co-branded card is a card simultaneously bearing the brand of a domestic card switching organization and the brand of an international card organization or a card switching organization of another country.

6. A physical card is a card having a tangible form, typically made of plastic material, equipped with an electronic chip for storing card data, and containing information printed on the card as prescribed in Article 11 of this Circular.

7. An intangible card is a card that does not exist in a tangible form but exists in an electronic format and displays card information as prescribed in Article 11 of this Circular. Intangible cards may be printed as physical cards by the card issuing organization upon agreement between the card issuing organization and the cardholder.

8. A card transaction is the use of a card to conduct payment transactions, cash withdrawals, and other services provided by the card issuing organization and payment card organizations in accordance with the law.

9. A fictitious payment transaction at an accepting unit is the use of a card to pay for goods and services without the actual occurrence of sales or supply of goods and services.

10. A domestic card transaction is a card transaction where the card is issued by a card issuing organization in Vietnam and used to conduct card transactions at ATMs and point-of-sale terminals in Vietnam.

11. A counterfeit card is a card not issued by a card issuing organization but contains genuine card and cardholder information.

12. Fraudulent or counterfeit card transactions are transactions conducted using counterfeit cards or cards used in violation of agreements.

13. A cardholder is an individual or organization provided with a card for use by a card issuing organization, including primary cardholders and secondary cardholders.

14. A primary cardholder is an individual or organization whose name is recorded in the contract for card issuance and use with the card issuing organization.

16. A card issuing organization (TCPHT) is a credit institution or foreign bank branch authorized to issue cards in accordance with Clause 1 of Article 8 of this Circular.

17. A payment card organization (TCTTT) is a credit institution or foreign bank branch authorized to process card payments in accordance with Clause 1 of Article 20 of this Circular.

18. An intermediary payment service provider (TCTGTT) includes: card switching organizations; electronic settlement organizations for card transactions and TCTGTTs cooperating with TCTTTs.

19. A card switching organization is a TCTGTT that performs switching of card transactions for TCPHTs, TCTTTs, TCTGTTs cooperating with TCTTTs, international card organizations, and accepting units according to written agreements between the parties.

20. An electronic settlement organization for card transactions is a TCTGTT that performs electronic settlement of financial obligations arising from card transactions for TCPHTs, TCTTTs, TCTGTTs cooperating with TCTTTs, international card organizations, and accepting units according to written agreements between the parties.

21. An accepting unit (ĐVCNT) is a unit that accepts payment for goods and services through cards.

22. An international card organization (TCTQT) is an organization established and operating abroad in accordance with foreign laws, which has agreements with TCPHTs, TCTTTs, card switching organizations, and/or relevant parties to cooperate on bank card activities involving cards with TCPHT codes issued by TCTQTs or cards with TCPHT codes from other countries, in compliance with Vietnamese laws and international commitments.

23. Personal Identification Number (PIN) is a secret code issued by a TCPHT to a cardholder or created by the cardholder according to procedures specified by the TCPHT for use in card transactions.

25. An automatic teller machine (ATM) is a device that cardholders can use to perform one or more transactions such as depositing, withdrawing cash, transferring funds, paying bills for goods and services, checking account information, changing PIN, inquiring about card information, or other transactions as prescribed by law.

26. Bank Identification Number (BIN) is a series of digits, including the following types of BIN: BIN identifying the issuing bank as prescribed by the State Bank of Vietnam (hereinafter referred to as the State Bank) under the Regulation on issuance, use, and management of BINs for bank cards; BIN issued by the acquiring bank; and BIN of another country. In cases where the card has a BIN issued by the acquiring bank or a BIN of another country, the issuance, use, and management of BINs shall be carried out in accordance with the regulations of the acquiring bank or the country issuing the BIN.

27. A card issuance and usage agreement is a written agreement between the issuing bank and the cardholder regarding the issuance and use of the card.

28. A card payment agreement is a written agreement between the acquiring bank and the merchant or with the acquiring bank, gateway service provider (if any), concerning the acceptance of payments for goods and services using cards.

29. The basic standard for domestic chip cards is the Basic Standard TCCS 01:2018/NHNNVN on Technical Requirements for Contact Domestic Payment Chip Cards in Vietnam and TCCS 02:2018/NHNNVN on Technical Requirements for Contactless Domestic Payment Chip Cards in Vietnam, announced by the Governor of the State Bank pursuant to Decision No. 1927/QĐ-NHNN dated October 5, 2018, and any subsequent amendments, supplements, or replacements.

Article 4. Currency Used in Card Transactions

1. Within the territory of Vietnam:

a) Cash withdrawal transactions must be conducted in Vietnamese Dong;

b) For other card transactions:

(i) The transaction currency is Vietnamese Dong. Where foreign exchange may be used for transactions according to laws governing foreign exchange management, the transaction currency will be Vietnamese Dong or Vietnamese Dong and foreign currency;

(ii) The payment currency is Vietnamese Dong. Merchants can only accept payments in Vietnamese Dong from the acquiring bank;

c) In cases requiring conversion from foreign currency to Vietnamese Dong, the exchange rate between Vietnamese Dong and foreign currency shall be agreed upon by the parties in compliance with the regulations of the State Bank.

2. Outside the territory of Vietnam:

When conducting card transactions outside the territory of Vietnam, cardholders must settle accounts with the issuing bank in Vietnamese Dong at an exchange rate agreed upon by the parties in compliance with the regulations of the State Bank.

Article 5. Card Service Fees

1. Only the issuing bank is entitled to collect fees from cardholders based on the published Card Service Fee Schedule, ensuring:

a) The Card Service Fee Schedule must clearly specify the types of fees and the applicable rates for each type of card and service;

b) The Card Service Fee Schedule of the issuing bank must comply with legal provisions, be publicly posted, and provided to cardholders before use and whenever changes occur;

c) The methods, deadlines for notification, and provision of fee information to cardholders must be specifically stipulated in the card issuance and usage agreement. The period from notification to implementation of fee changes must be at least seven days;

d) The issuing bank is not allowed to charge any additional fees beyond those specified in the published Card Service Fee Schedule.

2. The acquiring bank agrees with merchants and gateway service providers on the collection of fees. The sharing of fees among the issuing bank, acquiring bank, gateway service provider, and international card organization shall be determined by mutual agreement in compliance with legal provisions.

Article 6. Risk Management and Asset Losses in Card Business

1. The Issuing Bank shall establish and utilize reserves to manage credit risks in card business in accordance with the Government's regulations on establishing and utilizing reserves for managing credit risks.

2. For other types of risks in card business, the Issuing Bank and the Payment Network shall handle asset losses arising therefrom in accordance with the financial regime applicable to credit institutions and foreign bank branches under the law.

Article 7. Card Recall

Cards shall be recalled in the following cases:

1. Counterfeit cards.

2. Cards used illegally.

3. To serve investigations and prosecution of crimes as prescribed by law.

4. Other cases of card recall agreed upon in the card issuance and usage contract.

Chapter II
CARD ISSUANCE

Article 8. Card Issuing Organizations

1. Card issuing organizations include:

a) Commercial banks, cooperative banks, and foreign bank branches that issue cards when their card service provision activities are recorded in the License issued by the State Bank;

b) Policy banks that issue cards in accordance with the Government's regulations and this Circular;

c) Financial holding companies and consumer finance companies that issue credit cards when their credit card issuance activities are recorded in the License issued by the State Bank.

2. The Issuing Bank must comply with the Domestic Chip Card Foundation Standards when issuing cards with BINs granted by the State Bank.

3. The Issuing Bank must establish internal regulations on card issuance and usage to ensure compliance with this Circular and relevant laws.

4. The Issuing Bank must use BINs granted by the State Bank, except as provided for in Clause 5 of this Article.

5. Issuing Banks permitted to engage in foreign exchange operations may enter into agreements with the Payment Network to issue cards with BINs granted by the Payment Network.

6. The Issuing Bank shall not agree with other organizations to limit or prevent the issuance of co-branded cards.

Article 9. Card Issuance Procedures

1. Agreements on card issuance and usage must be established in a card issuance and usage contract in accordance with this Circular and relevant laws. The contents of the contract shall be implemented in accordance with Article 12 of this Circular.

a) In the case of individual customers who are Vietnamese citizens, the Issuing Bank shall require the customer to provide identity documents to identify the customer: Citizen Identity Card or Identity Card or Electronic Identity Card (through accessing an electronic identification account level 02) or Identity Card;

b) In the case of individual customers who are Vietnamese origin persons without confirmed nationality, the Issuing Bank shall require the customer to provide identity documents to identify the customer: Certificate of Identity;

c) In the case of individual customers who are foreigners, the Issuing Bank shall require the customer to provide identity documents to identify the customer: Passport and entry visa or documents equivalent to a visa or documents proving exemption from entry visa; or electronic identity (through accessing an electronic identification account level 02) (if available). The Issuing Bank shall require the customer to provide necessary documents to verify the period of residence in Vietnam such as work permit or documents issued by competent authorities certifying the period of residence in Vietnam;

d) In the case of corporate customers, the Issuing Bank shall require the customer to provide information, documents, and data to identify the customer in accordance with the law on anti-money laundering and this Article, including documents, information, and data of the legal representative of the organization or authorized representative of another organization (hereinafter referred to as the authorized representative).

3. The collection and storage of customer documents, information, and data must meet the following requirements:

a) Paper documents must be original or certified copies or copies made from the original book or copies accompanied by the original for comparison in accordance with the law. In the case of presenting the original for comparison, the Issuing Bank must certify the copy and bear responsibility for the accuracy of the copy compared to the original;

b) For electronic documents, information, and data, the Issuing Bank must check, compare, confirm, and store them in accordance with the law on electronic transactions;

c) In the case of documents, information, and data specified in points a and b of this clause being in a foreign language, the Issuing Bank may agree with the customer on translating or not translating into Vietnamese but must ensure the following principles:

(i) The Issuing Bank must check, control, and bear responsibility for confirming the content of foreign-language documents, information, and data to ensure they meet the required information provided in this Circular;

(ii) Foreign-language documents, information, and data must be translated when requested by competent authorities;

d) Documents, information, and data as stipulated in Clause 2 of this Article must remain valid and within their validity period throughout the card issuance and usage process.

4. When issuing debit cards, the Issuing Bank must require the primary cardholder to have a settlement account opened at the Issuing Bank.

5. The Issuing Bank must specify the validity period of the card, wherein the validity period for named prepaid cards shall not exceed three years. Prior to renewing the card for the customer, the Issuing Bank must implement measures to re-authenticate and verify the customer in accordance with the law on anti-money laundering and this Circular.

6. At least fifteen days before the planned issuance of a new type of card or changes to the design of previously issued cards, the Issuing Bank must notify the State Bank about the card design in accordance with Form 01 attached to this Circular. Within fifteen days from the date of ceasing to issue additional previously issued cards, the Issuing Bank must notify the State Bank in writing for monitoring and management.

7. The Issuing Organization shall base on its own supply capacity and conditions to guide customers with disabilities through the procedures for issuing cards while ensuring the collection of sufficient documentation, information, and data to verify customer identification information in accordance with laws on anti-money laundering and this Circular.

8. In cases where customers are found to be using false or illegal documents, information, or data, or if they are listed in the blacklist under laws on anti-money laundering, the Issuing Organization must report to the competent authority and handle the situation in accordance with the law.

9. The Issuing Organization may issue debit cards, credit cards, and prepaid identifiable cards for individual or organizational cardholders via electronic means. Procedures for issuing cards via electronic means shall be carried out in accordance with the provisions of this Article and Article 10 of this Circular.

Article 10. Issuance of Cards via Electronic Means

1. The Issuing Organization must establish and promulgate internal regulations on the process and procedures for issuing cards via electronic means in compliance with this Circular, laws on anti-money laundering, electronic transactions, personal data protection, ensuring customer information security and the safe operation of the Issuing Organization, including at least the following steps:

(i) Biometric data stored in the encrypted information storage section of the citizen identity card or verified citizen card issued by the police agency or through the verification of the individual's electronic identity account created by the Electronic Identification and Authentication System; or

(ii) Biometric data that has been collected and checked (ensuring the accurate match between the individual's biometric data with the biometric data in the encrypted information storage section of the citizen identity card or verified citizen card issued by the police agency or with the individual's biometric data through the verification of their electronic identity account created by the Electronic Identification and Authentication System);

c) Displaying warnings to customers about prohibited actions during the issuance and use of electronically issued cards; implementing measures to confirm that customers have read all warning contents fully;

d) Providing customers with the contract for card issuance and usage according to the provisions of Article 12 of this Circular and technical measures to implement the confirmation of acceptance as stipulated in point b, Clause 2 of this Article;

đ) Notifying the name of the Issuing Organization, the name or trademark of the card (if applicable), the card number, the validity period of the card, the cardholder's name, the scope and functions of card usage, and prohibitions under the law when using the card to the customer.

2. The Issuing Organization may decide on methods, forms, and technologies to identify and verify customers for the purpose of issuing cards via electronic means; it bears responsibility for any risks arising (if any) and must meet the following minimum requirements:

a) Methods, forms, and technologies selected by the Issuing Organization must comply with standards on security, safety, and confidentiality as prescribed by the State Bank;

c) Storing and preserving detailed information and data for identification purposes throughout the card issuance and usage process, such as: customer identification information; customer biometric factors; audio, video, recorded images, recordings; transaction phone numbers; transaction logs. Information and data must be securely stored, backed up, and maintained to ensure completeness and integrity of the data for inspection, verification, dispute resolution, complaints, and providing information upon request from competent state management authorities. The retention period shall be implemented in accordance with laws on anti-money laundering;

d) During the implementation of card issuance via electronic means, the Issuing Organization must regularly self-inspect and evaluate the level of security and confidentiality of electronic authentication solutions; if signs of security breaches in technology solutions are detected, the service must be immediately suspended to upgrade, modify, and perfect the solutions.

4. Credit issuance through credit cards and overdraft debit cards, in addition to complying with the provisions of this Article, must also be carried out in accordance with the provisions of Article 14 of this Circular.

Article 11. Information on the card

1. The information printed on the physical card must include the following elements:

a) The name of the Issuing Organization (abbreviated name or trade mark of the Issuing Organization). In cases where the card bears the abbreviated name or trade mark of multiple organizations (including the Issuing Organization, organizations cooperating with the Issuing Organization to issue cards, card switching organizations, central organizations, and related units), the abbreviated name or trade mark of the cooperating organization must not be larger than that of the Issuing Organization, and the information on the card must clearly indicate in Vietnamese that this card is issued by the Issuing Organization;

b) The name or trade mark of the card switching organization of which the Issuing Organization is a member (abbreviated name or trade mark of the card switching organization), except in cases where the card does not have the feature of conducting transactions through the card switching service of the card switching organization;

c) The name or trade mark of the card (if applicable);

2. In addition to the information specified in Clause 1 of this Article, the Issuing Organization may specify additional information to be printed on the card, provided that such information complies with the provisions of the law.

3. When issuing co-branded cards, the Issuing Organization must ensure that the placement of the trade marks of the Vietnamese card switching organization and the central organization or the card switching organization of another country does not discriminate among organizations (the trade marks must be of equal size and placed on the same side of the card).

Article 12. Contract for Card Issuance and Usage

1. The contract for card issuance and usage must include at least the following contents:

a) Contract number;

b) Date (day, month, year) of contract establishment;

d) Contents regarding the rights and obligations of the parties;

đ) Provisions on fees (types of fees, changes to fees);

e) Provision of information and methods of notification by the Issuing Organization to the cardholder about card issuance, account balance, transaction history, and other necessary information;

g) Agreement on credit provision to the cardholder, including limits (payment limit, cash withdrawal limit, and other limits), changes to the usage limit, overdraft limit (for debit cards), and credit limit; interest rate, method of calculating interest in credit activities according to the regulations of the Governor of the State Bank, order of recovering principal and interest (for credit cards and debit cards with overdraft facilities); credit period, purpose of credit, repayment period, minimum repayment amount, repayment method, late payment fee (if applicable). The agreement on credit provision to the cardholder can be stated in the contract for card issuance and usage or in a separate agreement;

i) Cases of temporary suspension, refusal of payment, temporary cessation of card transactions;

k) Cases of card retrieval or invalidation during use (including cases where the Issuing Organization discovers that customers are using fake documents, impersonating others to obtain cards or using cards for fraudulent, deceptive purposes or illegal activities, and other cases in accordance with the law);

l) Cases of refunding unused amounts on the card;

m) Implementation of security measures in card usage and cases of lost cards or exposure of card information;

n) Method of receiving dispute resolution requests and complaints; deadline for handling dispute resolution requests and complaints and the handling of dispute resolution results according to Article 19 of this Circular;

o) Force majeure cases;

p) Processing of personal data of customers and related persons according to this Circular or personal data provided by customer organizations; provision of information to third parties to serve the provision of card services to cardholders or to handle suspected fraudulent, counterfeit, or illegal activities;

2. For anonymous prepaid cards, the Issuing Organization must have regulations and terms regarding the issuance and use of anonymous prepaid cards and make them public to customers. The Issuing Organization must have a written agreement with the party requesting the issuance of anonymous prepaid cards, the minimum content of which includes: information of the party requesting card issuance, quantity of cards issued, card limit, topping up the card, scope of card usage, validity period of the card.

Article 13. Card Limits

1. The Issuing Bank shall agree with the cardholder on payment limits, transfer limits, cash withdrawal limits, and other limits applicable to the use of cards for the cardholder in accordance with this Circular, current laws on foreign exchange management, and related laws.

2. For the limit on withdrawing foreign currency cash abroad, a card may withdraw a maximum amount of foreign currency cash equivalent to thirty million Vietnamese dong in one day.

4. For prepaid cards, the Issuing Bank shall specify the balance limit, additional top-up limit, and transaction limit; ensure that the balance on any anonymous prepaid card at any time does not exceed five million Vietnamese dong; and the total transaction limit (including cash withdrawal transactions, transfer transactions, and payment transactions for goods and services) on any named prepaid card shall not exceed one hundred million Vietnamese dong in one month.

Article 14. Credit Granting through Cards

1. Credit granting through credit cards must meet the following requirements:

a) It must be carried out according to the card issuance and usage contract and other agreements between the Issuing Bank and the cardholder regarding credit granting (if any);

b) The Issuing Bank must have internal regulations on credit granting through credit cards (including regulations on electronic credit granting through credit cards if applicable) in compliance with laws on ensuring safety in credit granting activities, specifying details on the target group, credit limits (including credit limits, cash withdrawal limits, and other limits), conditions, credit period, repayment period, restructuring of repayment periods, minimum repayment amount, interest rate applied, interest calculation method during credit granting activities as stipulated by the Governor of the State Bank of Vietnam, the order of recovering principal and interest, late fees, procedures for applying measures to recover overdue debts, deadlines for applying each measure to handle overdue debts, purposes of credit granting, and the review and decision-making process for credit granting through cards according to the principle of clearly defining responsibilities between the review and decision-making stages, and measures to recover debts to ensure the responsibility of departments within the Issuing Bank during the debt recovery process;

c) For credit granting through cards under the circumstances specified in Clause 2 of this Article, the Issuing Bank must have at least information on the lawful purpose of capital use and the financial capability of the customer before deciding to grant credit;

d) For credit granting through cards not under the circumstances specified in Clause 2 of this Article, the Issuing Bank must require customers to provide information, documents, and data proving their financial capability, feasible capital usage plans, lawful purposes of capital use, and information about related parties before deciding to grant credit;

đ) Information about related parties of the customer as specified in point d of this clause includes the following:

(i) Information about related parties who are individuals, including: full name; individual identification number; nationality, passport number, date of issue, place of issue for foreigners; relationship with the customer;

(ii) Information about related parties who are organizations, including: name, business registration code, main office address of the enterprise, business registration certificate number or equivalent legal documents; legal representative, relationship with the customer;

e) The Issuing Bank shall consider and decide to grant credit through credit cards to cardholders who fully meet the following conditions:

(i) The cardholder is an individual belonging to the category specified in Clause 1 of Article 15 of this Circular;

(ii) The cardholder is an organization belonging to the category specified in Clause 2 of Article 15 of this Circular and not within the category prohibited from receiving credit as stipulated in Article 134 of the Law on Credit Institutions;

(iii) The cardholder has a feasible capital usage plan (not required for the case specified in Clause 2 of this Article), lawful purpose of capital use, and sufficient financial capability to repay principal, interest, and fees fully and on time;

g) The Issuing Bank shall agree with the customer on the application or non-application of security measures to fulfill debt obligations as prescribed by law;

h) The credit card limit for individuals as specified in Clause 1 of Article 134 and point đ of Clause 1 of Article 135 of the Law on Credit Institutions is as follows:

(i) In the case of issuing a secured credit card: the credit limit granted to the cardholder shall be determined by the Issuing Bank according to its internal regulations on credit granting through credit cards and shall not exceed one billion Vietnamese dong;

(ii) In the case of issuing an unsecured credit card: the credit limit granted to the cardholder shall not exceed five hundred million Vietnamese dong.

2. The credit grant through cards with small value amounts as specified in Clause 2 of Article 102 of the Law on Credit Institutions is a credit grant not exceeding four hundred million Vietnamese dong.

3. Overdraft lending for debit cards of the Issuing Bank must comply with the State Bank of Vietnam's regulations on lending activities of credit institutions and bank branches to customers.

4. Credit granting through credit cards and overdraft lending for debit cards of the Issuing Bank must comply with the restrictions and limits on credit granting as stipulated in Articles 135 and 136 of the Law on Credit Institutions and guidelines issued by the State Bank of Vietnam.

5. The Issuing Bank shall implement the retention of credit files in accordance with the Law on Credit Institutions; the retention period for credit files shall comply with the legal provisions on record keeping.

6. The credit card issuer has the right and obligation to inspect and supervise the use of credit through cards and repayment by customers as stipulated in Clause 1, Article 102 of the Law on Credit Institutions; to take measures to inspect and supervise the use of cards and repayment by customers to ensure the full and timely recovery of principal, interest, and fees according to the agreement, the proper use of cards for credit through cards as prescribed in Clause 2, Article 102 of the Law on Credit Institutions and Clause 2 of this Article; it has the right to request customers to report on the use of credit through cards and provide documents and data proving that credit through cards have been used for their intended purposes.

Chapter III
USE OF CARDS

Article 15. Subjects eligible to use cards

1. For individual cardholders:

a) Individuals aged 18 years or older with full capacity for civil conduct under the provisions of the law may use debit cards, credit cards, and prepaid cards.

b) Individuals aged 15 years or older but under 18 years old who have not lost or been restricted in their capacity for civil conduct may use debit cards, credit cards, and prepaid cards.

Secondary cardholders must use cards as specifically designated by the primary cardholder but within the following scope:

a) Individuals aged 18 years or older with full capacity for civil conduct under the provisions of the law may use debit cards, credit cards, and prepaid cards.

b) Individuals aged 15 years or older but under 18 years old who have not lost or been restricted in their capacity for civil conduct may use debit cards, credit cards, and prepaid cards.

c) Individuals aged 6 years or older but under 15 years old who have not lost or been restricted in their capacity for civil conduct may use debit cards and prepaid cards upon written consent from their legal representative (the primary cardholder).

5. Cardholders must provide complete, accurate, and timely information, documents, and data as required by the credit card issuer to verify and identify customers before entering into a contract for card issuance and use, and during the card usage period, cardholders are responsible for the truthfulness of the information, documents, and data provided.

6. When using overdraft credit cards or debit cards, cardholders must use funds for the agreed purpose and fully and promptly repay the credit card issuer for all principal, interest, and fees arising from the use of the card according to the contract concluded with the credit card issuer.

7. The credit card issuer shall implement necessary measures to update, inspect, review, reconcile, and identify customers during the card usage period.

Article 16. Scope of Card Usage

1. Named debit cards and prepaid cards may be used to perform card transactions as agreed between the cardholder and the credit card issuer.

3. Anonymous prepaid cards may only be used to pay for lawful goods and services at point-of-sale terminals within Vietnam; they may not be used to perform card transactions via electronic means and may not be used to withdraw cash.

4. Secondary cards issued to secondary cardholders under 15 years old may not be used to withdraw cash and may only be used to pay for lawful goods and services consistent with the agreed usage scope between the credit card issuer and the primary cardholder.

5. Cards may be used to pay for lawful goods and services as prescribed by Vietnamese law, including purchases made abroad.

a) Biometric data stored in the encrypted information storage section of the citizen identity card or the verified citizen card issued by the police authority or through the verification of the named electronic account created by the Electronic Identification and Authentication System; or

b) Biometric data collected and verified (ensuring the match between the cardholder's biometric data and the biometric data in the encrypted information storage section of the verified citizen identity card or citizen card issued by the police authority or with the cardholder's biometric data through the verification of the named electronic account created by the Electronic Identification and Authentication System); or

c) Biometric data collected through direct face-to-face meetings with the cardholder in cases where foreign nationals do not use electronic identities or Vietnamese nationals whose citizenship status cannot be determined; or

d) Biometric data of the cardholder stored in the National Population Database when using a citizen identity card without an encrypted information storage section.

Article 17. Ensuring security, safety, and confidentiality in the use of cards

1. Issuing organizations:

a) Shall be responsible for managing risks when issuing various types of cards;

b) Shall disseminate and guide customers on card services, correct procedures for using cards, potential risks when using cards, and how to handle incidents, prohibited behaviors when using cards, and the responsibilities of cardholders for violations;

c) Shall implement measures to ensure transaction security, prevent risks associated with card usage according to risk management principles in electronic banking activities; secure information related to card activities; ensure that the infrastructure and technical systems serving the issuance and payment of cards operate smoothly and safely;

d) Shall establish and maintain a 24/7 hotline to promptly receive and process information reported by cardholders;

đ) Shall cooperate with card issuers, card switching organizations, and electronic settlement organizations to implement necessary measures to ensure security in card activities; manage risks associated with other parties according to risk management principles in electronic banking activities;

g) Shall have measures to control card usage within agreed limits and amounts between the issuing organization and the cardholder as stipulated in this Circular;

h) Shall develop a set of criteria to identify suspicious cards indicative of fraud, deception, or legal violations (hereinafter referred to as the Set of Criteria) based on the reasons for suspicion in Appendix No. 02 issued together with this Circular. The issuing organization must regularly review, amend, supplement, and update the Set of Criteria based on information, documents, and data collected during the issuance and use of cards;

(i) Regulations on transaction scope and limits according to different levels of risk categorized by customer type, including specific risk management measures for customers under 18 years old;

(ii) Cases requiring updates and re-verification of customer identification information, including cases as specified in point n of this clause;

(iii) Cases where transactions should be refused or temporarily suspended through electronic means;

k) Regulations on verifying and matching cardholder identification information with the State Bank's system for managing, monitoring, and preventing fraud in payment activities and lists of suspicious customers provided by the Ministry of Public Security and other competent authorities (if available) to apply appropriate risk management measures;

l) Shall provide information on suspicious fraudulent or counterfeit cards to competent authorities investigating card-related crimes; inspect, review, or coordinate with competent authorities to update lists of cards that need to be refused payment or are suspected of being counterfeit for card issuers and payment service providers; coordinate with competent authorities and relevant parties in preventing and combating card-related crimes and investigating and handling crimes discovered using cards according to the law;

m) The issuing organization shall regularly warn and guide customers about criminal methods and schemes in card issuance and use; guide the protection of information and safe card usage;

n) The issuing organization shall re-verify customer identification information and promptly apply anti-money laundering laws in the following situations:

(i) Customers exhibit suspicious signs as defined by the Anti-Money Laundering Law;

(ii) The issuing organization has grounds to doubt the legality and validity of customer documents, information, and data collected during the signing of card issuance and use contracts and during the use of cards;

(iii) Cardholder information is included in the State Bank's system list of suspicious fraud and deception or in lists of suspicious customers provided by the Ministry of Public Security and other competent authorities (if available);

(iv) Card and cardholder information is inconsistent or does not match information from competent authorities;

o) Regulations on documents and certificates related to overseas card transactions and implementing checks and storage of documents and certificates in accordance with laws on foreign exchange management and electronic transactions;

p) Shall closely monitor and be responsible for ensuring that overseas card transactions comply with the purposes and usage limits prescribed in this Circular and conform to foreign exchange management regulations;

q) The issuing organization shall track the validity period of identity documents and residence duration certificates of customers as stipulated in Clause 2, Article 9 of this Circular; notify customers at least 30 days before the expiration date of their identity documents and residence duration certificates to request timely updates and supplements; suspend card transactions for customers whose identity documents and residence duration certificates have expired.

3. The Card Issuing Organization:

a) Coordinate with the TCPHPs, card switching organizations, electronic settlement organizations for card transactions, card acquiring organizations that cooperate with the Card Issuing Organization, card network providers, relevant authorities, and other related parties in preventing and combating crimes related to card activities;

b) Require card network providers to provide documentation proving their business operations are lawful when signing contracts with them. The Card Issuing Organization must establish criteria for selecting card network providers and conduct initial and periodic (quarterly or annually) evaluations and classifications of entities requiring acceptance of card payments in accordance with their business characteristics and industries;

c) Implement strict measures to monitor card network providers, particularly those installing wireless card acceptance devices. In cases where violations are detected or there is a basis to believe that card network providers are engaging in prohibited acts as stipulated in the Decree on non-cash payment transactions, such as conducting fictitious card transactions, transferring card acceptance equipment to others for use, accepting card payments without a card payment agreement, or improperly using card acceptance equipment of the Card Issuing Organization in Vietnam or abroad, the Card Issuing Organization shall report to the competent authority responsible for receiving reports of criminal offenses, recommendations for prosecution, or other relevant authorities to coordinate monitoring, handling, and considering appropriate preventive measures, including terminating or requesting the card acquiring organization cooperating with the Card Issuing Organization to terminate the card payment agreement with such card network provider. terminate the card payment agreement with that card network provider.

4. Card network providers must fully implement all technical procedures and security measures for protecting cardholder information, detecting fraud, and counterfeiting in card payments as guided by the Card Issuing Organization and shall be liable for any damages if they fail to comply with the Card Issuing Organization's regulations.

5. When participating in agreements regarding bank card activities, the TCPHPs, Card Issuing Organizations, card acquiring organizations that cooperate with the Card Issuing Organization, and card switching organizations must agree on the responsibility of the parties to comply with legal provisions on foreign exchange management, personal data protection, individual privacy rights, document confidentiality, card information, transaction information, and cardholder account information.

6. The Card Issuing Organization, when cooperating with card acquiring organizations to provide intermediary payment services through cards, must ensure compliance with the provisions of this Circular and the Circular regulating intermediary payment service activities.

Article 18. Handling in case of card loss or disclosure of card information

1. Upon losing the card or disclosing card information, the cardholder must immediately notify the TCPHP.

2. Upon receiving notification from the cardholder, the TCPHP must immediately lock the card and coordinate with related parties to take necessary operational measures to prevent potential losses, while also informing the cardholder. After locking the card, the TCPHP must complete the processing of the received notification within five working days for cards with BIN issued by the State Bank or ten working days for cards with BIN issued by the Central Bank from the date of receipt of the cardholder's notification.

3. In cases where the card is misused causing damage, the TCPHP and the cardholder shall determine liability and negotiate the resolution of consequences. If both parties cannot reach an agreement, the resolution shall be carried out in accordance with the law.

Article 19. Review and handling of complaints during the use of cards

1. When discovering errors or suspecting errors in card transactions, the cardholder has the right to request the Issuing Bank to review. The Issuing Bank shall specify the minimum period within which the cardholder may request a review or lodge a complaint against the Issuing Bank, not less than 60 days from the date of occurrence of the transaction subject to the review or complaint.

2. The Issuing Bank shall be responsible for processing requests for review and complaints of the cardholder in accordance with at least the following provisions:

a) Applying at least two methods to receive information on reviews and complaints through a call center (with recording, operating 24 hours a day, 7 days a week) and through legitimate points of transaction of the Issuing Bank; ensuring verification of basic information provided by the cardholder to the Issuing Bank;

b) Issuing templates for review and complaint requests (in paper and electronic form) for the cardholder to use when requesting a review or complaint. In cases where information is received through the call center or online channels, the Issuing Bank requires the cardholder to provide necessary information to verify the customer, taking measures to store the information provided by the customer as a basis for reviewing and handling complaints. In cases where the cardholder authorizes another person to make a review or complaint request, the cardholder shall comply with the provisions of the law on authorization;

c) The Issuing Bank must immediately take measures to lock the card when requested by the cardholder due to suspicion of fraud or loss and shall be responsible for all financial losses of the customer occurring after the time the customer requests the card to be locked;

d) The Issuing Bank shall be responsible for resolving requests for review and complaints and informing the results of the review and complaint to the cardholder within the following time limits:

(i) For cards with BIN issued by the State Bank, the time limit for processing requests for review and complaint must be specifically agreed upon with the customer in the card issuance and usage contract and shall not exceed 30 working days from the date of receipt of the first review and complaint request of the cardholder according to one of the reception forms specified in point a of this clause;

(ii) For cards with BIN issued by the Joint Stock Commercial Bank, the time limit for processing requests for review and complaint must be specifically agreed upon with the customer in the card issuance and usage contract.

3. Handling the results of review and complaint:

a) Within a maximum of 05 working days from the date of notification of the result of the review and complaint to the customer, the Issuing Bank shall implement compensation for the cardholder in accordance with the agreement and current legal regulations for losses arising that are not due to the fault of the cardholder and/or do not fall under the force majeure cases agreed upon in the contract. In cases where losses arise due to the fault of related parties (card issuer, payment gateway provider, joint stock commercial bank, service provider), the party at fault shall compensate the Issuing Bank in accordance with the agreement between the parties in compliance with the law;

b) In cases where the deadline for processing requests for review and complaint as agreed in the card issuance and usage contract has expired without determining the cause or fault of which party, within the next 15 working days, the Issuing Bank shall negotiate with the cardholder on the resolution plan or temporarily compensate the loss to the cardholder until there is a final conclusion by the competent authority distinguishing the fault and responsibility of the parties;

c) In cases where the Issuing Bank, the cardholder, and related parties cannot reach an agreement or disagree with the result of the resolution of the review and complaint request, the dispute resolution shall be carried out in accordance with the law.

5. The Issuing Bank must have solutions to enable the cardholder to search online for information, progress, and results of the review and complaint process.

Chapter IV
CARD PAYMENTS AND SETTLEMENT OF CARD TRANSACTIONS

Article 20. Payment Card Organizations

1. Payment card organizations include:

a) Commercial banks, cooperative banks, and foreign bank branches that are permitted to process payment cards when providing card services as recorded in the License issued by the State Bank;

b) Policy banks that may implement payment card processing in accordance with Government regulations and this Circular.

2. Payment card organizations authorized to conduct foreign exchange operations may provide payment card services with BINs issued by the Central Bank and those from other countries.

3. Payment card organizations must cooperate with relevant parties to establish procedures and processes for payment card transactions, clearly defining each transaction handling step and the responsibilities of all involved parties, ensuring compliance with this Circular and current regulations on electronic banking activities; managing and operating equipment serving payment card transactions to ensure safety and continuous operation.

4. Payment card organizations must comply with domestic chip card standards applicable to automatic teller machines and point-of-sale acceptance devices.

5. Payment card organizations shall handle payment card transactions based on agreements between the organization and card switching organizations, payment service providers, central banks, and international card organizations with which they collaborate and other relevant parties regarding payment card procedures and processes.

6. When collaborating with international card organizations and merchants, payment card organizations must adhere to the provisions of the Circular on providing non-cash payment services and the Circular on intermediary payment service activities.

7. Payment card organizations must display the name (abbreviated name or trade mark) of the card switching organization of which they are members on their automatic teller machines and point-of-sale acceptance devices.

8. Payment card organizations may not discriminate between payment cards with BINs issued by the State Bank and those with BINs issued by central banks and international card organizations; they may not agree with other organizations to limit or prevent the acceptance of co-branded card transactions.

9. Payment card organizations must cooperate with card switching organizations with which they collaborate to ensure the assessment, selection, and supervision of merchants in compliance with the provisions of this Circular and the Circular on intermediary payment service activities.

Article 21. Merchant Acceptance Units

1. Merchant acceptance units must comply with the provisions on merchant acceptance units in the Circular on providing non-cash payment services.

2. Merchant acceptance units have the responsibility to provide transaction receipts and invoices related to payment card transactions and goods/services provided at their premises according to legal requirements, payment card organizations, payment service providers, and card switching organizations with which they collaborate, or in necessary cases to prove the legitimacy of goods/services provided for payment card transactions.

Article 22. Card Switching Organizations and Electronic Settlement Organizations for Card Transactions

1. The switching and electronic settlement of card transactions with BINs issued by the State Bank between card switching organizations and payment card organizations are carried out through card switching organizations and electronic settlement organizations for card transactions licensed by the State Bank.

2. The switching of domestic card transactions with BINs issued by central banks and international card organizations between card switching organizations and payment card organizations must be conducted through a gateway operated by a card switching organization licensed by the State Bank. 3. The electronic settlement of card transactions with BINs issued by central banks and international card organizations is carried out according to agreements between card switching organizations, payment card organizations, and relevant parties.

4. Card switching organizations and electronic settlement organizations for card transactions must agree with member organizations participating in such activities on standards, rules, operational procedures, and other regulations concerning card switching and electronic settlement activities in compliance with legal provisions.

5. Card switching organizations and electronic settlement organizations for card transactions must directly connect their systems with card switching organizations, payment card organizations, and international card organizations according to agreements among the parties, ensuring safe and continuous provision of switching services and other services to participating member organizations and international card organizations, and complying with relevant legal provisions.

5. The card switching organization and the electronic settlement organization for card transactions shall directly connect their systems with the National Payment Switching Center (TCPHT), the State Bank of Vietnam (TCTTT), and the International Commercial Banks (TCTQT) in accordance with agreements among the parties, ensuring the safe and continuous provision of switching services and other services to member organizations and international commercial banks participating in the connection, and complying with relevant legal provisions.

Article 23. International Card Organization

1. The International Card Organization (ICO) shall enter into agreements with card switching organizations licensed by the State Bank to implement the provisions set forth in Clause 2, Article 22 of this Circular.

2. The ICO shall not impose restrictions on card issuing organizations and card payment organizations for the purposes of:

a) Unfair treatment of brands printed on cards of affiliated or card issuance cooperation organizations;

b) Limiting the choice of card switching organizations by card users through fee regulations or other obligations.

Article 24. Settlement of Results of Card Transaction Clearing

Financial obligations arising from card transaction clearing settlements between card issuing organizations and card payment organizations must be settled at an organization permitted by the State Bank.

Article 25. Refusal to Process Card Payments

1. Card issuing organizations, card payment organizations, and card acquiring organizations that cooperate with card payment organizations and merchants must refuse to process card payments in the following cases:

a) Using the card to conduct fraudulent transactions at merchants and card transactions prohibited under the Decree on non-cash payments;

b) The card has been reported lost by the cardholder;

c) The card has expired;

d) The card has been blocked.

2. Card issuing organizations, card payment organizations, and card acquiring organizations that cooperate with card payment organizations and merchants may refuse to process card payments when there is suspicion regarding the honesty or purpose of the cardholder's transactions according to laws on anti-money laundering.

3. Card issuing organizations, card payment organizations, and card acquiring organizations that cooperate with card payment organizations and merchants may refuse to process card payments according to agreements in the following cases:

a) The balance of the payment account, the card balance, credit limit, or overdraft limit remaining (if applicable) is insufficient to cover the payment amount;

b) The cardholder violates the regulations of the card issuing organization in agreements between the cardholder and the card issuing organization leading to the refusal of card payment.

4. Card issuing organizations have the responsibility to notify in writing or via data messages about card payment refusal cases stipulated in Clauses 1, 2, and 3 of this Article to card payment organizations; upon receiving notifications in writing or via data messages from domestic card issuing organizations, foreign card issuing organizations, or international card organizations about card payment refusal cases stipulated in Clauses 1, 2, and 3 of this Article, card payment organizations have the responsibility to notify card acquiring organizations that cooperate with card payment organizations and merchants.

5. Notifications about card payment refusal (including those from foreign card issuing organizations and international card organizations) take effect from the time the relevant party to the card payment transaction receives the notification in writing or via data message. After the relevant party has received the notification and still processes the card payment resulting in the misuse of the card, the determination of liability shall be agreed upon by the parties involved.

Chapter V
REPORTING AND PROVIDING INFORMATION

Article 26. Reporting

1. Card issuing organizations, card payment organizations, card switching organizations, and electronic clearing organizations for card transactions shall submit periodic reports in accordance with statistical reporting systems and regulations of the State Bank.

3. Card issuing organizations, card payment organizations, and card acquiring organizations have the responsibility to report to the State Bank in the following cases:

a) At the specific request of the State Bank of Vietnam to serve state management purposes;

b) When unusual developments occur in card operations that may affect the operational status of card issuing organizations and card payment organizations.

Article 27. Provision of Information

1. Payment Card Issuing Organizations (TCPHT), Payment Service Providers (PSP), Card Network Operators (CNO), and International Card Organizations (ICO) shall cooperate with PSPs, card switching organizations, electronic transaction settlement organizations, and ICOs to ensure the confidentiality of card information, cardholders, and card transactions, and provide such information only upon request from cardholders, competent state agencies, or as prescribed by law.

2. TCPHT, PSP, and ICOs shall agree on the sharing of information related to card activities in accordance with the provisions of the law.

3. ICOs shall be responsible for providing information related to card transactions with BINs issued by ICOs at the request of the State Bank of Vietnam to perform state management functions.

4. TCPHT shall provide information about cards at the request of the State Bank of Vietnam to perform state management functions.

Chapter VI
IMPLEMENTATION ORGANIZATION

Article 28. Effective Date

1. This Circular shall take effect from July 1, 2024, except for the provisions in Clause 2 and Clause 3 of this Article.

2. Articles 9, 10, 12 (except for the provision in Point g Clause 1) and Clause 1 of Article 17 (except for the provision in Point q) of this Circular shall take effect from October 1, 2024.

3. Clause 3 of Article 13, Clause 6 of Article 16, Point q Clause 1 of Article 17, and Clause 5 of Article 19 of this Circular shall take effect from January 1, 2025. For payment card issuing organizations that are credit institutions under special control, the provisions in Clause 6 of Article 16, Point q Clause 1 of Article 17, and Clause 5 of Article 19 of this Circular shall take effect from July 1, 2025.

4. Circular No. 19/2016/TT-NHNN dated June 30, 2016, of the Governor of the State Bank of Vietnam on bank card operations, amended and supplemented by: Circular No. 30/2016/TT-NHNN dated October 14, 2016, of the Governor of the State Bank of Vietnam amending and supplementing certain Circulars on payment service supply and payment intermediary services; Circular No. 26/2017/TT-NHNN dated December 29, 2017, of the Governor of the State Bank of Vietnam amending and supplementing certain articles of Circular No. 19/2016/TT-NHNN dated June 30, 2016, of the Governor of the State Bank of Vietnam on bank card operations; Circular No. 41/2018/TT-NHNN dated December 28, 2018, of the Governor of the State Bank of Vietnam amending and supplementing certain articles of Circular No. 19/2016/TT-NHNN dated June 30, 2016, of the Governor of the State Bank of Vietnam on bank card operations; Circular No. 28/2019/TT-NHNN dated December 25, 2019, of the Governor of the State Bank of Vietnam amending and supplementing certain articles of Circular No. 19/2016/TT-NHNN dated June 30, 2016, of the Governor of the State Bank of Vietnam on bank card operations; Circular No. 22/2020/TT-NHNN dated December 31, 2020, of the Governor of the State Bank of Vietnam amending and supplementing certain articles of Circular No. 19/2016/TT-NHNN dated June 30, 2016, of the Governor of the State Bank of Vietnam on bank card operations; Circular No. 17/2021/TT-NHNN dated November 16, 2021, of the Governor of the State Bank of Vietnam amending and supplementing certain articles of Circular No. 19/2016/TT-NHNN dated June 30, 2016, of the Governor of the State Bank of Vietnam on bank card operations shall cease to be effective from the date this Circular takes effect, except for the provisions in Article 10, Article 10a, Article 13 (except for Point g Clause 1 of Article 13), and Clause 1 of Article 18 which remain effective until September 30, 2024; Point g Clause 1 of Article 13 ceases to be effective from July 1, 2024.

Article 29. Transitional Provisions

1. For physical card models printed before July 1, 2024, TCPHT may continue to use them until December 31, 2024.

2. For customers who have cards issued before October 1, 2024, TCPHT shall coordinate with customers to update and supplement customer documentation, information, and data to comply with the provisions of Clause 2 of Article 9 and Article 12 of this Circular, to be completed by January 1, 2026.

1. The Payment Department shall be responsible for monitoring, inspecting, and coordinating with relevant units to address any issues arising during the implementation of this Circular.

2. Banking inspection and supervision agencies, State Bank of Vietnam Branches in provinces and cities shall be responsible for inspecting and supervising the implementation of this Circular and handling violations within their authority.

3. The Director of the Office, Heads of the Payment Department, Heads of relevant units under the State Bank of Vietnam, credit institutions, foreign bank branches, Card Network Operators, and other related organizations and individuals shall be responsible for implementing this Circular./.

 

 

LIST CARD, HOLDER CARD

SUSPICION OF FRAUD DECEPTION, FORGERY, VIOLATION OF LAWS

(Month.... Year......)

Note:

- Time to submit report: Before the 10th of each month.

- Method to submit report: By electronic means as directed by the State Bank of Vietnam.

Instructions for compiling the table:

- In Column (3): Clearly indicate the type of identity document by number (1, 2, 3, 4, 5, 6, 7) corresponding as follows: 1.Citizen Identification Card; 2.Identification Card; 3.Identity Card; 4.Passport; 5.Citizen Identification Certificate; 6.Electronic Account for Authentication; 7.Other documents.

- In Column (6): Clearly indicate "M" for male gender, "F" for female gender.

- In Column (9),(10): Clearly indicate “GN” for debit card, “TD” for credit card, “TT” for prepaid identified card respectively at columns 9 and 10.

- In Column (14): Clearly indicate one or more reasons by number (1, 2, 3, 4, 5, 6, 7, 8, 9) corresponding as follows:

1. Debit card linked to payment account, e-wallet listed in the suspicious fraud, forgery, violation of lawslist of payment accounts, e-wallets;;

2. Information, documents, data provided by the cardholder when entering into the contract for issuance and use of the card and during the use of the card do not match the information of that individual in the National Population Database;

3. The card is listed in advertisements, purchases, sales, exchanges on websites, online groups;

4. The card generates transactions with unusual locations, times, frequencies;;

5. Transaction amounts, quantities are large, unusual and inconsistent with the profession, age, residential address, transaction history, behavior, etc., of the cardholder;;

6. Multiple incorrect PIN, OTP, card information entries;

7. Customer included in the warning list of the State Bank, Police Agency or other competent authority; abroad8. Void transactions at

acceptance unit, card transactions at acceptance unit operating illegally in foreign countries according to the law or acceptance unit in listed in the suspicious fraud, forgery list of acceptance units; Clearly indicate the status of the card by number (1, 2, 3, 4list of payment accounts, e-wallets;;

9. Other signs: note specific details (footnote) for this information.

- In Column (15): ) corresponding to the following contents: 1., 5Active; . Suspended transactions, 23. Temporarily locked; 4. Reclaimed; 5. Expired (Signature, write clearly Full Name).