Circular No. 36/2012/TT-NHNN on equipping, managing, operating, and ensuring the safety of automatic teller machine (ATM) operations

CIRCULAR

Regulations on equipping, managing, operating, and ensuring the safety of Automated Teller Machine (ATM) operations

DECREE NO. 80/2016/NĐ-CP DATED JULY 1, 2016 AMENDING AND SUPPLEMENTING CERTAIN PROVISIONS OF DECREE NO. 101/2012/NĐ-CP DATED NOVEMBER 22, 2012 OF THE GOVERNMENT ON CASHLESS PAYMENTS

________

Pursuant to the Law on the State Bank of Vietnam No. 46/2010/QH12 dated June 16, 2010;

On the basis of the Law on Credit Organizations No. 47/2010/QH12 dated June 16, 2010;

On the basis of the Law on Electronic Transactions No. 51/2005/QH11 dated November 29, 2005;

On the basis of Decree No. 35/2007/NĐ-CP dated March 8, 2007 of the Government on electronic transactions in banking activities;

Pursuant to Decree No. 96/2008/NĐ-CP dated August 26, 2008 of the Government stipulating the functions, tasks, powers, and organizational structure of the State Bank of Vietnam;

At the proposal of the Payment Department Director;

The Governor of the State Bank of Vietnam issues this Circular regulating the requirements, procedures, and responsibilities for equipping, managing, operating, and ensuring the safety of ATM operations,

Article 1. Scope of Regulation

This Circular stipulates the requirements, procedures, and responsibilities related to the equipping, managing, operating, and ensuring the safety of ATM operations.

Article 2. Applicability

The objects subject to this Circular are organizations providing payment services that equip ATMs (hereinafter referred to as organizations providing payment services) and units related to the equipping, managing, operating, and ensuring the safety of ATM operations.

1. Develop a plan for equipping, organizing operation, maintenance, and monitoring of ATM activities, ensuring:

a) Having sufficient infrastructure systems, backup systems, management software to ensure smooth, stable, and safe ATM operations.

b) Establishing internal regulations on information security policies, operational procedures, risk management, maintenance, repair, control, and monitoring of ATM activities.

c) Having sufficient personnel with the necessary skills, expertise, and ethics to manage and operate ATM activities safely and effectively.

2. Develop plans and arrange ATM networks reasonably to ensure good customer cash withdrawal needs.

4. Organizations providing payment services must submit their plans and regulations as stipulated in Clause 1, Clause 2, and Clause 3 of this Article to the State Bank of Vietnam (through the Payment Department) at least 15 days before implementation.

1. The location of ATMs must be convenient, well-lit, and ensure security and safety for customers transacting at ATMs. Power supply for the ATM room and ATM operation must comply with national technical and electrical safety standards. ATMs must have a backup power source to prevent card swallowing incidents when there is a sudden loss of main power.

3. The State Bank branch in the area must confirm in writing the registration of installation, relocation, or termination of ATM operations (according to Form No. 2 attached hereto) within five working days from receipt of the registration document from the organization providing payment services.

4. For cases involving relocation of ATMs outside the province or city, organizations providing payment services must terminate ATM operations in the old area to register for installation in the new area.

5. Organizations providing payment services must update changes in information about installation, relocation, or termination of ATM operations on their official website.

Article 5. Provisions on management and operation of ATMs

Organizations providing payment services must ensure:

3. Maintain a customer support department available 24/24 hours a day and 7/7 days a week so that customers can contact at any time.

5. Monitor the cash reserve levels at ATMs to ensure they have sufficient funds to meet customer withdrawal needs.

In cases where the ATM location is within the city center, town, or central district of a county where the organization providing payment services has a cash replenishment unit, the organization must perform cash replenishment to ensure that the ATM downtime due to lack of funds does not exceed four working hours during working hours and one day outside working hours. For other cases, the organization must perform cash replenishment to ensure that the ATM downtime due to lack of funds does not exceed eight working hours during working hours and one day outside working hours.

6. Monitor, detect, and promptly handle any transaction errors to ensure accurate processing of customer transactions. Compensate customers promptly for any losses caused by errors, mistakes, or failures resulting from the organization's negligence.

7. Receive, process, or coordinate in handling customer inquiries and complaints immediately. The maximum period for resolving inquiries, complaints, and responding to customers for intra-network ATM transactions is five working days from the date of receipt of the customer's complaint. The maximum period for resolving inquiries, complaints, and responding to customers for inter-network ATM transactions (excluding international transactions) is seven working days from the date of receipt of the customer's complaint.

3. The ATM must have a guide symbol showing how to insert the card into the card reader at the card insertion position.

4. The ATM must allow customers to conduct transactions in at least two languages: Vietnamese and English.

5. The ATM transaction receipt must be clear and legible, printed in either Vietnamese or English based on the customer's choice. The minimum information on the receipt must include: the name of the organization providing payment services that equipped the ATM, the name or number of the ATM, type of transaction, transaction code, date and time of the transaction, amount of the transaction, transaction fee, final balance (for intra-network transactions).

There must be a reminder for customers not to forget their card or money after using the ATM. If the ATM is set up to dispense cash after returning the card, the organization providing payment services must instruct customers to wait for a certain period to receive the cash after the ATM returns the card, to prevent delays due to slow network speed.

8. The ATM must record and store complete transaction logs and related information to meet the requirements for inquiry, inspection, and dispute resolution.

The ATM transaction log must be clear and easy to read. The minimum information on the ATM transaction log must include data such as: name or number of the ATM; card number; transaction code; transaction date; transaction time; transaction amount; number of banknotes issued according to each denomination; for successful transactions, the log must show the amount dispensed by the machine.

Transaction data and ATM transaction logs must be ensured to be complete and stored in accordance with legal regulations on storage.

Service providers have the responsibility to:

2. Equip ATMs with surveillance cameras and devices to prevent card information duplication and theft within six months from the date this Circular takes effect.

Store surveillance footage obtained from cameras for a minimum of 100 days. In cases where there are requests for review, complaints, or to assist in criminal investigations by law enforcement agencies, images must be provided and stored according to the retention period for handling complaint review files in card usage.

4. Implement measures to secure and prevent the exposure or copying of PIN codes when customers enter their PINs at ATMs.

5. Regularly monitor and supervise ATM transactions and notify customers of suspicious fraudulent transactions.

6. Provide and encourage customers to use transaction control services, account balance inquiries (such as SMS banking, Internet banking) to help customers self-monitor their accounts.

8. Service providers shall agree and cooperate with each other in sharing information about crimes related to ATM operations to promptly and effectively prevent and combat such crimes.

Article 8. Provisions on ATM inspection, maintenance, and repair

Service providers have the responsibility to:

1. Develop and implement periodic plans for inspecting, maintaining, and repairing ATMs.

2. Ensure the safety of ATMs and cash within ATMs during maintenance and repair.

3. When conducting inspections, maintenance, and repairs of ATMs, pay attention to electrical safety, fire prevention, detection, removal, and prevention of unauthorized devices installed to steal card information.

4. Inspection, maintenance, and repair of ATMs must be recorded in a logbook.

1. Mobile ATMs are ATMs that can be regularly or periodically moved to one or several locations to serve customers with specific services during certain periods.

To deploy new mobile ATMs, service providers must submit to the State Bank of Vietnam (through the Payment Department) one set of application documents for deploying mobile ATMs, including:

a) A document requesting the State Bank of Vietnam's approval for deploying mobile ATMs.

b) A plan for equipping, organizing operation, maintenance, repair, and monitoring of mobile ATMs.

c) Internal policies and procedures regarding information security, operational processes, risk management, maintenance, repair, control, and monitoring of mobile ATMs.

5. Service providers must ensure the safety of equipment and wireless network connections.

6. Service providers must take preventive measures against fake mobile ATMs and guide customers on identifying features.

2. Payment service providers shall report on the implementation of upgrading their ATM systems; any unusual issues that may cause risks or security breaches in their own ATM systems and those of other payment service providers to the State Bank of Vietnam (through the Payment Department).

Article 11. Responsibilities of Units under the State Bank of Vietnam

2. Banking inspection and supervision agencies shall be responsible for inspecting and supervising compliance with the provisions of this Circular by payment service providers; handling violations within their authority and notifying the Payment Department.

b) Inspecting, supervising, and handling violations related to ATM operations in their jurisdiction: Regularly or as necessary, organizing comprehensive inspections or selecting some ATMs for inspection, preparing inspection records for ATMs (according to Model No. 3 attached to this Circular). When discovering ATMs that do not meet the conditions specified in this Circular, they must require payment service providers to temporarily cease ATM operations, take corrective measures; handle violations within their authority.

c) Promptly reflecting any difficulties, incidents arising to the State Bank of Vietnam (through the Payment Department) for coordinated resolution.

Article 12. Effective Date

This Circular takes effect from March 1, 2013.

Article 13. Implementation Organization

The Director of the Office, the Head of the Payment Department, the Heads of relevant units under the State Bank of Vietnam, the Governors of the State Bank branches in provinces and centrally-administered cities, the General Directors (Directors) of payment service providers, and related organizations and individuals are responsible for implementing this Circular.