Circular No. 38/2013/TT-BCT stipulates technical solutions and technical requirements.

CIRCULAR

Regulations on technological solutions and technical requirements

in trading activities through Commodity Trading Centers

_____________

Pursuant to Decree No. 95/2012/NĐ-CP dated November 12, 2012, of the Government, detailing the functions, tasks, powers, and organizational structure of the Ministry of Industry and Trade;

Pursuant to Decree No. 158/2006/NĐ-CP dated December 28, 2006 of the Government detailing the Law on Trade regarding trading activities through Commodity Trading Centers;

Pursuant to Decree No. 52/2013/NĐ-CP dated May 16, 2013 of the Government on E-commerce; The Minister of Industry and Trade issues this Circular on technological solutions and technical requirements in trading activities through Commodity Trading Centers as follows.

1. This Circular stipulates technological solutions and technical requirements in trading activities through Commodity Trading Centers.

PART I
GENERAL PROVISIONS

Article 1. Scope of Regulation and Applicability

2. The scope of application includes Commodity Trading Centers in Vietnam, members, Settlement Centers, Delivery Centers, and other organizations and individuals related to trading activities through Commodity Trading Centers in Vietnam.

1. Information technology systems serving trading activities through Commodity Trading Centers include infrastructure equipment for information technology, application software, electronic transaction information boards, and websites supporting trading activities.

Article 2. Interpretation of Terms

2. Information technology infrastructure includes servers, personal computers, printers, network devices, storage devices, display devices, transmission systems, lightning protection systems, power generation and distribution systems, and other equipment serving trading activities.

3. An electronic website for commodity transactions through Commodity Trading Centers is an electronic website established to provide information related to the activities of Commodity Trading Centers.

4. Application software is software developed and installed in a suitable environment to conduct transactions and related business operations in trading activities through Commodity Trading Centers.

5. An electronic transaction information board is a board displaying information from Commodity Trading Centers including: volume of bids to buy, volume of bids to sell, bid prices to buy, bid prices to sell, matched volume, matched price, closing price of the previous session, opening price of the current session, daily price change compared to the opening price of the current session; displayed on screens, electronic websites, or other display devices of Commodity Trading Centers.

Article 3. General Requirements for Information Technology Systems

1. Commodity Trading Centers, members of Commodity Trading Centers, Settlement Centers, and Delivery Centers must equip Information Technology Systems serving trading activities through Commodity Trading Centers in accordance with the provisions of this Circular.

2. Information Technology Systems must be maintained and upgraded regularly, promptly correcting technical errors to ensure the system is ready to serve transactions on Commodity Trading Centers and provide information to customers.

3. Information Technology Systems must be designed to ensure information security and safety.

4. Information Technology Systems must be designed to ensure the ability to isolate, detect, and promptly handle incidents.

5. Commodity Trading Centers must ensure the capability to connect and exchange data with the Ministry of Industry and Trade when required.

6. In case of an incident involving Information Technology Systems that cannot be resolved within 24 (twenty-four) hours, Commodity Trading Centers and their members shall comply with the following regulations:

a) Immediately notify members and customers about the status of the Information Technology System incident;

b) Secure and ensure the integrity of all databases at the time of transaction interruption;

c) Transactions will continue immediately after the Information Technology System incident is resolved;

e) Retain all reports in both paper and electronic form of the incident investigation and resolution process;

g) Report the Information Technology System incident and measures to improve and correct technical errors to the Ministry of Industry and Trade.

7. In cases where an Information Technology System incident affects customer rights, Commodity Trading Centers shall bear responsibility in accordance with the law.

7. In the event that an information technology system incident affects the interests of customers, the Commodity Exchange shall be liable in accordance with the provisions of the law.

Article 4. Requirements for the Information Technology System for the Commodity Exchange

1. The information technology system must be designed to ensure centralized information and data related to transaction details, payment information, goods delivery information, customers, and members operating on the Commodity Exchange.

2. The Commodity Exchange must have a technical staff with sufficient qualifications to manage, operate, and monitor the information technology system including network management, operation system management, information technology system security, and database management.

3. The Commodity Exchange must establish an electronic information website with a specific address on the Internet to publish information according to current regulations and comply with the provisions set out in Section 3 Chapter II of this Circular.

4. The Commodity Exchange must develop technical and operational documentation for the information technology system at the Commodity Exchange, including the following types:

a) Survey design documents and technical descriptions of the system;

b) Self-inspection and evaluation documents by the unit or confirmed by specialized agencies responsible for certification that the system design meets safety standards for operation;

c) Regulations on management procedures for using the network system, backup solutions, system operations, and ensuring information security and safety.

Chapter II
REQUIREMENTS FOR THE INFORMATION TECHNOLOGY SYSTEM

Section 1
TECHNICAL REQUIREMENTS FOR INFRASTRUCTURE INFORMATION TECHNOLOGY

Article 5. General requirements for server systems and network infrastructure

1. The Commodity Exchange, trading members of the Commodity Exchange, Payment Center, and Goods Delivery Center must equip server systems for the information technology system:

a) Servers must have configurations suitable for software installed on the servers and services provided by those servers;

b) Application software must be maintained to operate on the servers;

c) Server systems must be located at a specific address within the territory of Vietnam.

2. Server systems must ensure stable operation and have at least one backup server always ready in case of failure of the main system.

3. Server systems must have a backup solution for business application data, transaction data, and customer data on the Commodity Exchange. Backup devices must be dedicated.

4. Network systems must have at least two transmission lines from different service providers, one main line and one backup line which must be used promptly when the main line fails to ensure continuous information flow.

5. Server systems and network infrastructure must have the capability to upgrade and expand the system.

Article 6. General requirements for ensuring information security and safety with infrastructure information technology

1. The Commodity Exchange, trading members of the Commodity Exchange, Payment Center, and Goods Delivery Center must have measures to ensure information security and safety for the information technology system; ensuring the integrity, confidentiality, and availability of transaction information; ensuring the confidentiality of organizational and customer information on the Commodity Exchange.

2. Access to the system must be authorized to each department and individual user to protect different levels of information. Servers must be configured to log all intrusions.

3. The information technology system must have security measures to manage user access. The system must have the ability to organize and search for data.

4. Information stored on magnetic tapes, optical discs, hard drives, and other storage devices must be physically protected under secure and safe conditions. Based on the technical characteristics of each type of storage device, appropriate re-storage methods should be established.

Article 7. Technical requirements for the infrastructure of information technology at the Commodity Exchange

1. Firewalls must be used to prevent direct attacks on important system information, controlling information entering and exiting the Commodity Exchange's system.

2. Intrusion detection and prevention devices must be installed to block unauthorized connections to critical resources if the firewall is bypassed.

3. Anti-virus software and anti-spyware software must be used on all servers, workstations, and at connection ports with open networks.

4. The network system must be divided into different zones based on usage purpose, user type, and security policies for each zone.

5. Regular backup measures for the information technology infrastructure system must be implemented to ensure data recovery within twenty-four hours from the time of occurrence of an incident. Daily backups must be conducted.

6. Secure storage devices for databases and application software must be equipped, organized, and utilized to ensure safety and operation according to technical requirements.

Section 2
REQUIREMENTS FOR APPLICATION SOFTWARE

Article 8. General requirements for application software

1. Application software at the Commodity Exchange, Commodity Exchange members, Settlement Center, and Goods Delivery Center must comply with legal regulations regarding commodity trading through the Commodity Exchange and meet operational conditions and business management requirements on the Commodity Exchange.

2. The selected technological solutions for building application software must meet the market expansion capabilities of the Commodity Exchange.

3. Application software must undergo rigorous testing before being put into operation, both for the initial version and updates. The Commodity Exchange must record each test session.

4. Users of application software at the Commodity Exchange and Commodity Exchange members must comply with software copyright requirements as stipulated by law.

Article 9. General technical feature requirements for application software

1. There must be a function to log all transactions, payments, and deliveries in the minimum business process for a period of one year.

2. Trading software must have the capability to control access to business operations during transactions, ensuring compliance with procedures and preventing errors.

3. Application software must have logging functions to serve transaction verification by users, checking the data accessed, modified, and the times of access and extraction.

4. User monitoring data includes user accounts and access times to the system; creation and modification times of data, and last control times.

5. The database of application software must be structured to allow the system to quickly and accurately update, aggregate, select, process, and transmit information.

Article 10. General requirements for ensuring information security of application software

1. Application software must ensure role-based access control for each user. Each user’s tasks and permissions must be clearly defined. Unauthorized users cannot access others' work.

2. For application software with online trading functions, there must be mechanisms to control access, authenticate users, secure data transmission, ensure data integrity, and prevent repudiation.

3. User passwords stored must be encrypted. Exchanging unencrypted (plain text) user passwords is strictly prohibited under all circumstances except for single-use passwords. Printing or sending passwords to users within the system must be secured.

4. Application software must have backup and recovery functions for transaction data and other information within twenty-four hours from the time of technical incidents.

5. Before putting application software into operation, it must be ensured that the software has been tested to detect and fix security vulnerabilities and newly arising errors.

Article 11. Requirements for application software for Commodity Trading Exchanges

1. Application software on the system of Commodity Trading Exchanges must be developed and operate independently, not shared with other Trading Exchanges, members, organizations, or units.

2. Application software of Commodity Trading Exchanges must ensure features to serve transaction management, payment, contract monitoring, delivery; storing member and customer information; connecting and exchanging transactions with Trading Exchange members and other business processes that the Trading Exchange is permitted to implement according to the law.

3. The electronic order matching system must have a transaction verification mechanism, returning transaction results to users:

a) Transaction results must include information about transaction time, transaction volume, transaction price, transaction direction, traded commodity, customer code;

b) Information exchange must ensure the authenticity of the sender, data security during transmission, data integrity, and prevention of denial.

4. Application software must have a function to link and display information on the electronic transaction information board.

5. Application software before being put into use must have a clear description of origin, technical features, and specific user manuals including system design analysis, user requirement documentation, usage instructions, software testing records.

6. The development and implementation of application software solutions must be concurrent with data processing, synchronized integration with hardware devices, network communication solutions, and cybersecurity measures of the Commodity Trading Exchange.

Article 12. Requirements for application software for trading members of Commodity Trading Exchanges

1. Application software of trading members on Commodity Trading Exchanges must meet the operational requirements stipulated by the Commodity Trading Exchanges, including:

a) Detailed management of commodity transactions, account balance control, commodity account, payment transactions, information, customer lists;

b) Management of transactions and operations that members are permitted to conduct on Commodity Trading Exchanges.

2. Application software of trading members on Commodity Trading Exchanges must ensure smooth transaction capabilities and connectivity with Commodity Trading Exchanges.

3. For self-developed software by members for customer use, it must ensure safety and security requirements for customer information and comply with regulations set by the Commodity Trading Exchanges.

Section 3
REQUIREMENTS FOR ELECTRONIC INFORMATION WEBSITES

Article 13. General requirements for electronic information websites

1. Commodity Trading Exchanges and members of Commodity Trading Exchanges must deploy electronic information websites using the national domain name ".vn".

2. Electronic information websites built on the technological platforms of commercial products must have the software copyright of those products.

3. On electronic information websites, contact information for Commodity Trading Exchanges and members of Commodity Trading Exchanges must be published.

4. Electronic information websites must be stored on servers at the company or at Vietnamese web hosting service providers.

5. The electronic information website of Commodity Trading Exchanges must provide, but not limited to, the following information:

a) Trading price index on total commodity volume traded each day, including opening price, closing price, highest price, lowest price, and matched prices for each type of commodity traded through the Commodity Trading Exchange;

b) Matching order transaction results, including the type of goods, quantity of goods matched between buy and sell orders, and other contents as prescribed in the Operating Regulations;

c) Other information as prescribed in the Operating Regulations of the Commodity Trading Exchange.

Article 14. Requirements for Safety and Security of Electronic Information Sites

1. Electronic information sites must have the capability to monitor and track changes in content and control rights of the system.

2. The electronic information site system must regularly update patches for software components of the electronic information site including operating systems, database systems, firewalls.

3. Electronic information sites must be inspected, maintained, and searched for security vulnerabilities on a regular basis.

4. For electronic information sites that conduct transactions through networks, the transaction content section must be separated and placed on a separate server at the Commodity Exchange. Transaction information, accounts, and passwords must be encrypted to ensure confidentiality for customers.

Article 15. Requirements for Backup and Recovery

1. Electronic information sites must be backed up regularly, daily, including both software and databases storing content information.

2. In case of incidents, electronic information sites must be restored within no more than 24 (twenty-four) hours from the time of the incident.

Section 4
SYSTEM MANAGEMENT AND TRANSACTION SUPERVISION

Article 16. System Management and Supervision of Transactions of the Commodity Exchange

1. The Ministry of Industry and Trade has the responsibility and takes the initiative to build the system for managing and supervising transactions of the Commodity Exchange. The minimum database content must include the following:

a) Data on transaction results, payments, and delivery of goods on the Commodity Exchange;

b) Data on entities under management according to laws on the Commodity Exchange and requirements of the Ministry of Industry and Trade;

c) Data on trading accounts of customers at the Commodity Exchange;

d) Data on goods registered for transactions on the Commodity Exchange.

2. Data stored on the system of the Ministry of Industry and Trade must be updated, compiled, and stored scientifically, accurately, and securely, serving as a reference base for commodity exchanges, enterprises, organizations, and authorized units.

3. The Ministry of Industry and Trade is responsible for periodically or randomly inspecting the information technology system of the Commodity Exchange to assess compliance with legal regulations by enterprises.

Article 17. Data Exchange and Reporting Systems of the Commodity Exchange

1. The information technology systems of commodity exchanges and members of commodity exchanges must be designed to meet the requirements for information exchange and reporting by the Ministry of Industry and Trade.

2. The information technology systems of commodity exchanges must be designed to exchange information with members of the commodity exchange, customers, matched orders, registered goods on the exchange, and other information as required by the Ministry of Industry and Trade.

Chapter III
IMPLEMENTATION

Article 18. Effective Date

1. This Circular takes effect from February 20, 2014.

2. Commodity exchanges, members of commodity exchanges, and related units and organizations that have been licensed and are currently operating are responsible for completing their information technology systems in accordance with the guidelines set forth in this Circular within a period not exceeding 180 (one hundred eighty) days from the date the document becomes effective.

3. During the implementation of this Circular, if any issues arise, commodity exchanges or related organizations and individuals shall promptly report them to the Ministry of Industry and Trade for review and resolution./.