Circular No. 34/2012/TT-NHNN on the development and maintenance of banking business software of the State Bank of Vietnam

CIRCULAR

Article 24Regulations on the development and maintenance of banking business software

of N |||the cooperative N |||at enterprises Vstrict N |||am

____________

 

Pursuant to the Law on Electronic Transactions No. 51/2005/QH11 dated November 29, 2005;

Pursuant to the Law on Information Technology No.No. 67/2006/QH11 June 29, 2006;

Pursuant to the Law on the State Bank of Vietnam No.No. No. 46/2010/QH12 dated June 16, 2010;

Pursuant to DecreeNo. No. 64/2007/NĐ-CP dated April 10, 2007 of the Government on the application of information technology in the activities of state agencies;"b) In addition to the lists of public services issued according to the provisions of Clause 2, Article 4 of this Decree, specialized agencies under provincial People's Committees shall report to the provincial People's Committee for decision-making on amending, supplementing, or issuing the list of public services funded by the state budget within their jurisdiction and consistent with the local budget capacity within the approved budget by the Provincial People's Assembly, and send it to the Ministry of Finance and relevant ministries and sectors for supervision during implementation."Pursuant to Decree No. 96/2008/NĐ-CP dated August 26, 2008 of the Government stipulating functions, tasks, powers, and organizational structure;

The Governor of the State Bank of Vietnam issues this Circular regulating the development and maintenance of banking business software of the State Bank of Vietnam."b) In addition to the lists of public services issued according to the provisions of Clause 2, Article 4 of this Decree, specialized agencies under provincial People's Committees shall report to the provincial People's Committee for decision-making on amending, supplementing, or issuing the list of public services funded by the state budget within their jurisdiction and consistent with the local budget capacity within the approved budget by the Provincial People's Assembly, and send it to the Ministry of Finance and relevant ministries and sectors for supervision during implementation."nh phủ qudefines functions, tasks, authorities and organizational structureof the Government stipulating functions, tasks, powers, and organizational structure of the Ministry of Home AffairsThis Circular takes effect from February 16, 2021, except for the provisions of Clause 2 of this Article.

At the proposal of the Director of the Information Technology Department;

1. This Circular regulates the responsibilities and authorities of units under the State Bank of Vietnam and third parties in the development and maintenance of banking business software of the State Bank of Vietnam (hereinafter referred to as the State Bank).

Chapter I

GENERAL PROVISIONS

Article 1.perioda) Clause 1 Article 15 regarding accountability;

2. Banking business software used for research and testing purposes by the State Bank is not within the scope of regulation of this Circular.

This Circular applies to units under the State Bank and third parties participating in the development and maintenance of banking business software for the State Bank.

Article 2. Applicability

Customized software

Article 3. Explanation of Terms

In this Circular, the following terms shall be understood as follows:

1. Software review by the Legal Department and submit for leadership signature to send for review is software developed according to specific requirements of an organization to meet its special needs and is used internally within that organization.

2. Commercial software is complete software registered with a brand name and mass-produced for market distribution.

3. Banking business software (hereinafter referred to as business software) is internal or commercial software applied in the operational activities of the State Bank to computerize part or all of those activities.

4. Software development is the creation of new or modification and supplementation of existing functions of business software.

5. Software maintenance involves work carried out to ensure stable operation of business software as designed.

6. Specialized unit for information technology of the State Bank of Vietnam is the Bureau of Computer Science.

7. Business lead unit is a unit under the State Bank assigned the task of establishing business procedures, organizing implementation, and managing business operations applied in business software.

8. Information technology lead unit is the Bureau of Computer Science or a unit under the State Bank entrusted by the Governor of the State Bank to organize equipment, manage development, and maintenance of business software on a case-by-case basis.

9. Software development b) To take the lead or coordinate with relevant agencies and units in developing plans for statistical surveys, using administrative data within the scope of management of the Ministry to collect and compile information under the agricultural and rural development statistical indicator system; unit is the IT lead unit or a third party directly responsible for developing business software.

10. Software maintenance organize credit institutions, foreign bank branches are responsible for organizing the implementation of this Circular.unit is the IT lead unit or a third party directly responsible for maintaining business software.

11. Using unit is the unit directly using business software.

12. Third party is an organization outside the organizational structure of the State Bank hired by the State Bank to directly develop or maintain business software.

13. Business process is a compilation of regulations governing the sequence, procedures, forms, and duties of organizations and individuals involved in the operational activities of the State Bank.

14. User requirement documentation is documentation describing the requirements for software from the business lead unit and the using unit.

15. Information technology infrastructure is a system of equipment including servers, workstations, communication networks, databases, security devices, software, and other necessary equipment serving the production, transmission, collection, processing, storage, and exchange of digital information.

Article 4. General Principles

1. Business software is developed based on the business requirements of the business lead unit and the using unit. Each business software must have a business lead unit responsible for business-related issues and an IT lead unit responsible for technical issues. After the warranty period, business software must be maintained to ensure long-term operation and exploitation.

2. The Bureau of Computer Science, units under the State Bank, and third parties must clearly define and strictly fulfill their responsibilities and authorities as prescribed during the development and maintenance of business software.

3. In cases where a unit is assigned multiple roles in the development and maintenance of a specific business software, that unit must issue a clear assignment of responsibilities among its departments according to the roles assigned and must ensure the principle of independence between the departments responsible for development, control, and approval of software development and maintenance.

Article 5. Orientation for software development

1. The specialized unit on information technology shall organize the planning and architecture of information technology application of the State Bank of Vietnam, including the content of orientation for information technology application.

2. The leading unit on information technology and the software development unit shall ensure that business software development complies with the orientation for information technology application of the State Bank of Vietnam.

Article 6. Ensuring Information Technology Infrastructure

1. The leading unit on information technology shall provide requirements for using information technology infrastructure to the specialized unit on information technology.

2. The specialized unit on information technology shall be responsible for providing full conditions for information technology infrastructure such as servers, database management systems, communication networks, security equipment for the deployment and operation of business software of the State Bank of Vietnam.

3. The specialized unit on information technology shall meet the requirements for using information technology infrastructure within the following deadlines:

a) Within thirty working days from the date of receipt of the request in cases where the shared information technology infrastructure of the State Bank of Vietnam is already available;

b) Within the necessary time period for equipping information technology infrastructure according to the regulations of the State Bank of Vietnam and laws on managing investment in information technology applications funded by state budget funds in cases where the information technology infrastructure has not been equipped or is insufficiently equipped.

Article 7. Qualification Conditions of the Leading Unit on Information Technology

The leading unit on information technology must have at least five staff members with a bachelor's degree in information technology and certificates of completion of courses on business investment and management of information technology applications as prescribed by the Government.

Article 8. Procedure for Developing Business Software

1. Stages of developing business software:

a) Planning;

b) Surveying user requirements;

c) System requirement analysis;

d) Software design;

đ) Programming;

e) Testing and trial of software;

g) Pilot implementation;

h) Training and instruction;

i) Packaging and handover of software;

k) Official implementation;

l) Software acceptance;

m) Operation support.

2. For business software developed based on urgent requirements approved by the Governor of the State Bank of Vietnam, the leading unit on information technology may decide to streamline the development procedure, which may exclude the stages specified in points a, b, g, and i of Clause 1 of this Article.

Chapter II

SPECIFIC PROVISIONS

Briefly describe technical improvements, production processes, raw materials, designs; new technology applications such as automation, digitalization, clean technology; management, marketing, distribution solutions; products winning awards or certifications related to innovation…):…ục 1

REGULATIONS ON BUSINESS SOFTWARE DEVELOPMENT

Article 9. Planning for Development of Business Software of the State Bank of Vietnam

1. Notification of Requirements for Developing Business Software

a) The using unit requesting the development of business software shall send the request to the leading business unit. The development of business software must arise from actual work needs and must ensure that the software can be used regularly after deployment;

b) The leading business unit shall review the rationality of the received requests according to Point a, Clause 1 of this Article, and no later than September 31 each year, the leading business unit shall compile and submit the request for developing business software (according to Form 01/PTBTPM) to the specialized unit on information technology for planning the software development of the next year.

2. Receiving and Evaluating Requests

a) Based on the request for software development, the specialized unit on information technology shall conduct technical feasibility analysis and cooperate with the leading business unit to refine the request if it contains inappropriate or unfeasible content;

b) Within ten working days from the date of receiving the complete request for software development from the leading business unit, the specialized unit on information technology shall issue a written response to the leading business unit regarding the reception and evaluation of the software development request.

3. Planning for Software Development

a) Annual Plan

Annually, based on the requests for software development from the leading business units, the specialized unit on information technology shall coordinate with the leading business units to unify the plan for each specific business software.

No later than October 31 each year, the specialized unit on information technology shall complete the Summary Table of Software Development Plan (according to Form 02/PTBTPM) for approval by the Governor of the State Bank of Vietnam.

b) Emergency Plan

In case the leading business unit sends an urgent request for software development not included in the approved plan, the specialized unit on information technology shall examine the content of the request and submit the adjusted plan for approval by the Governor of the State Bank of Vietnam.

c) Notification of Approved Plan

After the Governor of the State Bank of Vietnam approves the software development plan, the specialized unit on information technology shall notify relevant units to proceed with the provisions from Article 10 to Article 25 of this Circular.

4. Software Belonging to Projects or Programs

In cases where the request for business software belongs to a project or program of the State Bank of Vietnam that has been approved by authorized persons, such software does not need to be established and approved according to the provisions of Clauses 1, 2, and 3 of this Article, but the leading unit of the project or program must submit detailed contents of the software (according to Section II of Form 01/PTBTPM) to the specialized unit on information technology for consolidation.

Article 10. Construction of user requirement documentationầ1. The leading business unit shall be responsible for organizing the construction of the content of the user requirement documentation (in accordance with Model 03/PTBTPM).

2. The leading information technology unit shall be responsible for supporting the leading business unit in constructing the user requirement documentation to ensure its format, structure, and content.

3. The head of the leading business unit shall submit the user requirement documentation for approval by the Deputy Governor in charge and transfer the approved user requirement documentation to the leading information technology unit.

4. Within ten working days from the date of receipt of the approved user requirement documentation, the leading information technology unit shall prepare a report proposing the development method for the business software to be submitted for approval by the Deputy Governor in charge of information technology.

5. In case there is a need to supplement or amend the approved user requirement documentation, the leading business unit shall send the request for supplementation or amendment, which has been approved by the Deputy Governor in charge, to the leading information technology unit. The leading information technology unit shall assess the impact on the software development process of the request for supplementation or amendment of the user requirement documentation and propose a solution to be submitted for approval by the Deputy Governor in charge of information technology.

6. The leading information technology unit shall be responsible for managing and using the approved user requirement documentation according to the confidentiality level required by the leading business unit.

Article 11. Determination of Software Development Units

1. The leading information technology unit shall simultaneously be the software development unit for business software equipped through the method of self-construction by the State Bank. v|||

2. The leading information technology unit shall implement the equipment according to the regulations of the State Bank and laws on investment management of information technology to select the software development units for business software equipped through the procurement method.

Article 12. Detailed Plan for Software Development

1. Within fifteen working days after being determined, the software development unit shall be responsible for preparing a detailed plan for business software development including basic information such as content of work; start time; end time; human resources involved; and expected results. v|||

2. Within ten working days from the date of receiving the detailed plan for business software development, the leading information technology unit shall be responsible for reviewing and approving this plan and sending it to the specialized information technology unit and the leading business unit for coordination in implementation during subsequent project phases.

Article 13. Preparation of User Requirement Survey Report

1. The software development unit shall prepare a survey report on user requirements based on the user requirement documentation. If necessary, the software development unit may conduct surveys at the leading business unit and other user units to collect additional information.

2. The leading business unit and user units shall be responsible for coordinating and providing complete and timely information and documents as requested by the software development unit and shall confirm the user requirement survey report within ten working days from the date of receipt of the report.

3. The software development unit shall be responsible for managing and using the user requirement documentation and related documents during the survey process according to the requirements of the leading business unit, the leading information technology unit, and the laws on information security.

4. During the survey process, if there are new requirements or changes to the approved user requirement documentation, the leading business unit and the leading information technology unit shall follow the provisions of Clause 5, Article 10 of this Circular.

4. During the survey process, if there is a need for additional requirements or changes to the approved user documentation, the business unit in charge and the information technology unit shall implement in accordance with Clause 5 of Article 10 of this Circular.

Article 14. System Requirement Analysis

1. Based on user requirement documentation, survey reports, and related documents, the software development unit shall conduct user requirement analysis and develop system requirement analysis documentation.

2. For business application software that is commercial off-the-shelf (COTS) software, the system requirement analysis documentation shall be a document analyzing the differences between user requirements and existing features in the business application software.

3. The leading information technology unit and the leading business unit shall provide comments and agree on the technical and business solutions during the system requirement analysis process.

4. The system requirement analysis documentation must be approved by the leading information technology unit.

Article 15. Business Application Software Design

1. Based on the system requirement analysis documentation and related documents, the software development unit shall develop design documentation and implement software design.

2. For business application software that is COTS software, the software design documentation shall include system architecture descriptions, software functions, data organization, installation requirements, configuration, and other relevant technical documents.

3. The software design documentation must be approved by the leading information technology unit.

Article 16. Business Application Software Programming

1. Based on the software design documentation, the software development unit shall perform programming and develop related technical documentation.

2. For business application software that is COTS software, software programming involves modifying existing functions and developing new functions according to the software design documentation.

3. During the software programming process, the software development unit must internally test and trial the software before transferring it to the leading information technology unit for testing and trialing. The results of internal testing and trialing must be reflected in an internal testing and trialing report accompanied by a testing and trialing script.

4. The software development unit is responsible for developing installation guide documentation, user guide documentation, and other relevant technical documentation to support deployment, operation, transfer, warranty, and maintenance processes.

Article 17. Business Processes

1. Each business application software must have accompanying business processes, which must align with the approved user requirement documentation and design documentation.

2. Prior to software testing and trialing, the leading business unit is responsible for organizing the establishment and issuance of business processes for the software within its authority or submitting them to the Governor of the State Bank for approval and issuance.

Article 18. Testing and Trialing of Business Application Software

1. Testing and Trialing Scripts

a) The software development unit is responsible for developing testing and trialing scripts and submitting them to the leading information technology unit for review and approval.

b) Testing and trialing application scripts include functional testing and trialing scripts; performance testing and trialing scripts; security and confidentiality testing and trialing scripts; disaster recovery testing and trialing scripts; and may include other types of testing and trialing scripts based on the nature and characteristics of each software.

2. System Testing and Trialing Organization

The leading information technology unit is responsible for organizing, implementing, and preparing system testing and trialing reports according to the approved testing and trialing scripts.

3. User Acceptance Testing and Trialing Organization

a) The leading information technology unit is responsible for organizing user acceptance testing and trialing according to the approved testing and trialing scripts.

b) The leading business unit and the user unit are responsible for coordinating with the leading information technology unit to carry out user acceptance testing and trialing.

c) The results of the user acceptance testing and trialing process must be reflected in a user acceptance testing and trialing report confirmed by the leading business unit, the user unit, and the leading information technology unit.

Article 19. Pilot Implementation

1. Business software applicable to multiple units must undergo pilot implementation before widespread deployment.

2. The leading information technology unit shall organize the establishment and execution of a pilot implementation plan. The pilot implementation plan must clearly specify the content of the pilot implementation, the duration of the pilot implementation, and the specific responsibilities of each related unit during the pilot implementation including:

a) The leading information technology unit;

b) The leading business unit;

c) The software development unit;

d) Participating units using the software for the pilot implementation.

3. The leading information technology unit shall be responsible for organizing training for participating units in the pilot implementation.

4. Upon completion of the pilot implementation phase:

a) Participating units in the pilot implementation shall report the results of the pilot implementation and any required adjustments to the leading information technology unit;

a) The leading information technology unit shall prepare a report on the results of the pilot implementation along with any adjustment requests (if any) to send to the leading business unit and the software development unit for coordination. In cases where operational issues arise, the leading business unit and the leading information technology unit shall coordinate to resolve them.

b) The software development unit shall make adjustments to the software following the completion of the pilot implementation and update relevant modification documents (if any) to send to the leading information technology unit for review and acceptance of the adjusted software and related documents (if any) prior to training and instruction.

Article 20. Training and Instruction

1. The leading information technology unit shall establish and implement a training and instruction plan for participating units before the official deployment of business software. The training and instruction plan must clearly specify the responsibilities of each related unit during the training and instruction session:

a) The leading information technology unit;

b) The leading business unit;

c) The software development unit;

d) The user unit.

2. The leading business unit shall be responsible for coordinating with related units to ensure that user units have sufficient specialized knowledge during the official operation of the software.

3. User units shall be responsible for absorbing specialized knowledge to deploy and operate the software.

4. The leading information technology unit shall prepare a report on the results of the training and instruction sessions along with a summary of feedback from participating units to send to the leading business unit and the software development unit for coordination in adjusting the software and documentation (if necessary).

Article 21. Packaging and Handover of Business Software

1. The software development unit shall package the software, hand it over, and prepare a handover record with the leading information technology unit.

2. The packaging of the software must be organized according to each version, easily referenced, and include the following basic contents:

a) Technical and business documentation including:

- User requirement documentation;

- Survey reports;

- System requirements analysis documentation;

- Software design documentation;

- System installation and configuration documentation;

- User guides;

- Operation procedures;

- Business procedures;

- Troubleshooting documentation.

b) Software installation packages;

c) Source code of the software in cases where the software is self-developed or the State Bank requires source code provision in contracts with third parties;

d) Software maintenance procedures;

đ) Development and deployment tools for the software (if any).

3. The software development unit shall be responsible for supplementing packaged versions if there are changes during technical support, warranty, and maintenance of the software from the handover date.

4. The leading information technology unit shall be responsible for storing packaged software products in at least two different locations, ensuring safety.

Article 22. Official Deployment

1. The leading information technology unit shall establish and organize the implementation of the official deployment plan. The official deployment plan must clearly state the official deployment time and the specific responsibilities of each related unit during the official deployment including:

a) The leading information technology unit;

b) The leading business unit;

c) The software development unit;

d) The user unit.

2. Responsibilities of units upon completion of the official deployment phase:

a) The using unit shall notify the results of the official deployment at the unit to the leading information technology unit for consolidation and monitoring.

b) The leading information technology unit shall consolidate the official deployment report and send it to the software development unit to complete the software and notify the leading business unit to coordinate.

Article 23. Software Acceptance Testing

1. Software Acceptance Team

a) For software equipped through the method of self-construction by the State Bank, the leading information technology unit shall establish the Software Acceptance Team;

b) For software equipped through the procurement method, the project owner or the unit authorized by the project owner shall establish the Software Acceptance Team;

c) The Software Acceptance Team consists of staff from the leading information technology unit, the leading business unit, and other related units (if necessary).

2. The software development unit shall be responsible for preparing the conditions and supporting the acceptance testing process.

3. The Software Acceptance Team shall build and implement testing according to the acceptance testing scenario.

4. Upon completion of the acceptance testing process, the Software Acceptance Team shall prepare a report with the acceptance record and send it to the leading information technology unit. In cases where the software does not meet the requirements for business operations and technical aspects, the leading information technology unit shall continue to organize modifications and improvements to the software.

Article 24. Operational Support

1. The leading information technology unit shall be responsible for organizing guidance and support for the using units to handle technical issues and difficulties.

2. The leading business unit shall be responsible for organizing guidance and support for the using units to resolve business-related difficulties.

3. The using unit shall promptly reflect any difficulties and proposals related to business operations and technical aspects to the leading business unit and the leading information technology unit for consolidation, research, and resolution.

Article 25. Reporting on the Results of Business Software Development

1. The leading information technology unit shall be responsible for preparing a report on the results of the software deployment and sending it to the specialized unit for information technology within thirty days from the date of the official deployment of the business software.

2. The report on the results of the software deployment includes the following contents:

a) Achievements compared to set objectives;

b) Scope and actual deployment time;

c) Main functions of the software;

d) Scenarios and testing reports;

đ) Pilot deployment report, official deployment report;

e) Acceptance record, software handover record.

Briefly describe technical improvements, production processes, raw materials, designs; new technology applications such as automation, digitalization, clean technology; management, marketing, distribution solutions; products winning awards or certifications related to innovation…):…ục 2

SOFTWARE MAINTENANCE REGULATIONS

Article 26. Organization of Software Maintenance

The leading information technology unit shall be responsible for implementing software maintenance according to the maintenance procedures provided by the software development unit; shall bear legal responsibility for any decline in software quality or malfunctions due to non-compliance with the prescribed maintenance procedures.

Article 27. Determination of Software Maintenance Units

1. The main information technology unit shall be the software maintenance unit for business software if the main information technology unit has the capability to perform maintenance independently.

2. In cases where such conditions and capabilities are not met, the main information technology unit shall submit to the Governor of the State Bank of Vietnam a request to hire maintenance services for part or all of the business software. The selection of the software maintenance unit must be carried out simultaneously with the selection of the software development unit as stipulated in Clause 2, Article 11.

Article 28. Regular Maintenance of Business Software

1. The main information technology unit is responsible for developing a regular maintenance plan for the software. The regular maintenance plan includes the following key information:

a) Content of maintenance;

b) Implementation time;

c) Personnel implementing and related parties cooperating;

d) Other necessary contents.

2. The regular maintenance plan for software shall be sent to related parties for cooperation in implementation.

3. The software maintenance unit is responsible for building a regular maintenance script for the software, which shall be submitted to the main information technology unit for review and approval. Regular software maintenance activities include the following:

a) Checking the operation of the software;

b) Checking data backup and recovery;

c) Checking the security and confidentiality of the software;

d) Correcting any arising errors and improving the performance of the software;

đ) Checking the operational environment and issuing warnings about potential issues and methods of resolution.

4. After the maintenance unit completes regular maintenance, the main information technology unit is responsible for coordinating to check and confirm the results of regular maintenance through a report.

Article 29. Emergency Maintenance of Business Software

1. The main information technology unit is responsible for receiving requests for emergency software maintenance and sending them to the software maintenance unit for implementation.

2. If the maintenance request involves supplementing or upgrading the software, the main information technology unit shall implement according to the software development regulations set forth in Section 1, Chapter II of this Circular.

3. For maintenance requests that exceed the capacity of the software maintenance unit or for issues that cannot be resolved, the main information technology unit shall undertake:

a) Cooperating with the software maintenance unit to propose a solution;

b) Building a proposal to submit to the Governor of the State Bank of Vietnam for consideration and decision.

Article 30. Archiving Software Maintenance Records

1. The main information technology unit is responsible for organizing the archiving of maintenance records in accordance with the accounting record retention period regulations when the maintenance records are accounting vouchers or part of accounting vouchers. For other cases, maintenance records must be retained for at least five years.

2. Maintenance records include:

a) Plans, scripts, and regular maintenance reports;

b) Technical solutions and error handling reports;

c) Software packages and documentation related to completed maintenance activities;

d) Other relevant maintenance documents.

Article 31. Termination of Software Maintenance

1. Software maintenance ends when the business software is no longer used in practice.

2. In cases where the software is no longer used in practice but the third-party maintenance contract remains valid, the main information technology unit must report to the Governor of the State Bank of Vietnam on the plan to terminate the maintenance contract.

3. Upon termination of software maintenance, the main information technology unit shall archive the software. The archived software records include:

a) Technical and business documents as specified in Point a, Clause 2, Article 21 of this Circular;

b) Software installation packages;

c) Source code of the software in cases where it was developed internally or under the copyright of the State Bank of Vietnam;

d) Software data;

đ) Tools used for software development and deployment (if any);

e) Maintenance records.

Chapter III

IMPLEMENTING PROVISIONS

Article 32. Effective Date 1. This Circular takes effect from February 15, 2026; Circular No. 24/2013/TT-BKHCN dated September 30, 2013 of the Minister of Science and Technology on activities related to calibration, verification, testing of measuring instruments, and measurement standards shall cease to be effective from the date this Circular takes effect.

This Circular takes effect from February 10, 2013.

Article 33. Implementation Organization

1. The Information Technology Department is responsible for organizing the implementation of this Circular.

2. The Internal Audit Department is responsible for inspecting the implementation of this Circular by units under the State Bank of Vietnam.

3. Heads of units under the State Bank of Vietnam, provincial and municipal branches of the State Bank of Vietnam, and third parties within their functions and responsibilities are responsible for implementing this Circular.