Consolidated Document number 40/VBHN-NHNN on the provision, management, operation, and ensuring the safety of automatic transaction machines

STATE BANK OF VIETNAM VIETNAM -------	SOCIALIST REPUBLIC OF VIET NAM Independence - Freedom - Happiness ---------------
Number: 40/VBHN-NHNN	Hanoi, the 12th the day of July 2016

CIRCULAR

REGULATIONS ON THE INSTALLATION, MANAGEMENT, OPERATION AND SAFETY GUARANTEE OF AUTOMATED TELLER MACHINE ACTIVITIES

Circular No. 36/2012/TT-NHNN dated December 28, 2012 of the Governor of the State Bank of Vietnam on the installation, management, operation and safety guarantee of automated teller machine activities took effect from March 1, 2013, amended and supplemented by: for Circular No. 20/2016/TT-NHNN dated June 30, 2016 of the Governor of the State Bank of Vietnam amending and supplementing some articles of Circular No. 36/2012/TT-NHNN dated December 28, 2012 on the installation, management, operation and safety guarantee of automated teller machine activities and Circular No. 39/2014/TT-NHNN dated December 11, 2014 guiding intermediary payment services, taking effect from July 1, 2016.

Pursuant to the Law on Electronic Transactions No. 51/2005/QH11 dated November 29

Pursuant to the Law on the State Bank of Vietnam No. 46/2010/QH12 dated June 16, 2010;

On the basis of the Law on Credit Organizations No. 47/2010/QH12 dated June 16, 2010;

2005; the Pursuant to Decree No. 96/2008/NĐ-CP dated August 26

On the basis of Decree No. 35/2007/NĐ-CP dated March 8, 2007 of the Government on electronic transactions in banking activities;

2008 of the Government stipulating the functions, tasks, powers and organizational structure of the State Bank of Vietnam; the The Governor of the State Bank of Vietnam promulgates this Circular stipulating the requirements, procedures and responsibilities for the installation, management, operation and safety guarantee of automated teller machines (Automated Teller Machine - abbreviated as ATM).

At the proposal of the Payment Department Director;

This Circular stipulates the requirements, procedures and responsibilities for the installation, management, operation and safety guarantee of ATMs.

Article 1. Scope of Regulation

The subjects to which this Circular applies are organizations providing payment services that have installed ATMs (hereinafter referred to as organizations providing payment services) and units related to the installation, management, operation and safety guarantee of ATMs.

Article 2. Applicability

Article 3. Initial Installation of the ATM System

When initially installing the ATM system (excluding mobile ATMs), the organization providing payment services shall be responsible for:

2

1. Developing a project for the installation, operation, maintenance, and supervision of ATM activities, ensuring sufficient infrastructure systems, backup systems, and management software meeting technical security requirements for banking card service equipment as prescribed by the State Bank of Vietnam to ensure smooth, stable, and safe ATM operations.

2. Establishing internal regulations on information security policies, operational procedures, risk management, maintenance, repair, control, and supervision of ATM activities.

3. Developing plans and arranging ATM networks

to ensure good satisfaction of customer cash withdrawal needs. Clause 7. Consistency of data according to observation factors involves examining surface meteorological observation data between one factor and other factors at the same time and location. 4. Submitting the project and documents under Clause 1, Clause 2, and Clause 3 of this Article to the State Bank of Vietnam (through the Payment Department) at least 15 working days before implementation.

Article 4. Installation, Change of Location, Change of Time, and Termination of ATM Activities

1. When installing an ATM, the organization providing payment services shall be responsible for ensuring that the ATM location is convenient, adequately lit, and secure for customers to conduct transactions; electricity supply for the room housing the ATM and for the ATM operation must comply with national standards on electrical engineering and safety; the ATM must have a backup power source or a function to automatically return the card to the customer to prevent the ATM from swallowing the customer's card when there is a sudden power outage.

3

2. Within 10 working days prior to the implementation of installation, change of location, change of time, or termination of ATM activities, the organization providing payment services must notify in writing according to Model No. 1 (for fixed ATMs) or Model No. 2 (for mobile ATMs) attached to this Circular to the State Bank branch in the province or centrally-administered city where the ATM will be installed (hereinafter referred to as the State Bank branch).

3. In cases where the ATM location changes to a different province or centrally-administered city, the organization providing payment services must notify the termination of ATM activities in the old area and notify the installation of ATMs in the new area.

the organization providing payment services must update information about installation, change of location, change of time, and termination of ATM activities on

4. Organization ATM management and its official electronic website. system the organization providing payment services must ensure compliance with the installation and physical safety requirements for ATMs as prescribed by the State Bank of Vietnam

5. Organization security requirements for equipment serving banking card payments. for security for equipment serving bank card payment transactions.

Article 5. Provisions on management and operation of ATMs

Organizations providing payment services must ensure:

1.4 The service time for customers of the ATM system is 24/24 hours per day and 7/7 days per week. For ATMs installed at locations where customers can only access the ATM during certain times, the service time of the ATM depends on the installation location and must be posted at the ATM location as well as on the official website of the organization providing payment services.

2.5 Arrange personnel to promptly address ATM malfunctions. In cases where an ATM stops operating (or is expected to stop operating) for more than 24 hours, the organization must report to the local State Bank branch on the next working day following the occurrence (or expectation) of the ATM stopping operation for more than 24 hours and inform customers widely through appropriate means.

3. Maintain a customer support department available 24/24 hours per day and 7/7 days per week so that customers can contact them at any time.

4.6 Coordinate with card switching organizations to ensure inter-bank ATM transactions are carried out smoothly and safely.

5. Monitor the cash reserve level at ATMs, ensuring that ATMs have sufficient funds to meet customer withdrawal needs.

In cases where the ATM location is within the urban area, town center, or county center where the cash replenishment of the organization providing payment services takes place, unit the organization providing payment services must perform cash replenishment to ensure that the ATM runs out of money not exceeding four working hours and not exceeding one day outside working hours. otherwise, the service provider must continue to fund to ensure time In other cases, the organization providing payment services must perform cash replenishment to ensure that the ATM runs out of money not exceeding eight working hours and not exceeding one day outside working hours.

6. Monitor, detect, and promptly handle faulty transactions, ensuring accurate transaction processing for customers. Compensate customers promptly for losses caused by errors, mistakes, or incidents resulting from the organization's failure.

7. Receive, process, or coordinate with others to process customer requests for inquiries and complaints immediately. The maximum period for handling inquiries, complaints, and responding to customers regarding intra-network ATM transactions is five working days from the date of receiving the customer's complaint. The maximum period for handling inquiries, complaints, and responding to customers regarding inter-network ATM transactions (excluding international transactions) is seven working days from the date of receiving the customer's complaint. in the Field of Teachers and Educational Institution Managers that the processing time for intra-network ATM transactions is five working days from the date of receipt of the customer's complaint. The maximum period for handling inquiries, complaints, and responding to customers for inter-network ATM transactions (excluding international transactions) is seven working days from the date of receipt of the customer's complaint.

Article 6. Specific provisions for ATMs

1.9 At the ATM location, the telephone number and contact address of the ATM management and operation unit must be posted for customers to know how to contact when encountering issues during transactions; procedures and deadlines for inquiries and complaints.

8

At the ATM location, there must be instructions or symbols indicating the types of cards accepted for payment, customer guides for using ATMs, the name or number of the ATM, services provided at the ATM, related fees; these contents should be displayed in printed form or on the ATM screen.

At the location where the ATM is placed, there must be instructions or symbols for customers to identify accepted card types, customer guides for using ATMs, the name or number of the ATM, services provided at the ATM, related fees; these contents are displayed in printed form or on the ATM screen.

2.10 (Repealed)

3. ATMs must have guidance symbols showing how to insert cards into the card reader at the card insertion position.

4. ATMs must allow customers to conduct transactions in a minimum of two languages: Vietnamese and English.

5. ATM transaction receipts must be clear and easy to read, printed in either Vietnamese or English according to the customer's choice. The information on the receipt must include at least: the name of the organization providing payment services that equipped the ATM, the name or number of the ATM, type of transaction, transaction code, date and time of transaction execution, amount of transaction, transaction fee, final balance (for intra-network transactions).

6. There must be a reminder for customers not to forget their cards or money after completing an ATM transaction. If the ATM is set up to dispense cash after returning the card, the organization providing payment services must instruct customers to wait for a certain period to receive the cash after the ATM returns the card, to prevent delays due to slow network speed.

7.11 Organizations providing payment services may not impose a lower limit for a single cash withdrawal at ATMs than 5 million VND for intra-network transactions and 3 million VND for inter-bank transactions.

8. ATMs must record and store complete transaction logs and related information to meet requirements for inquiries, inspections, and dispute resolution.

ATM transaction logs must be clear and easy to read. The information on ATM transaction logs must minimally include data such as: name or number of the ATM; card number; transaction code; transaction date; transaction time; transaction amount; number of banknotes issued according to each denomination; for successful transactions, the log must show the amount dispensed by the machine.

Transaction data and ATM transaction logs must be ensured to be complete and stored in accordance with legal regulations on storage.

Article 7. Provisions on ensuring safety and security for ATM operations

Payment service providers shall be responsible for:

1. Adhering to current regulations on ensuring safety and security of the system in banking operations. Securing customer data and information during processing, transmission, and storage of data.Public Key Cryptography Standard (PKCS#1) 2. Equipping ATMs with surveillance cameras and devices to prevent card information duplication and theft within six months from the date this Circular takes effect.

3. Retaining surveillance footage obtained from cameras for a minimum of 100 days. In cases where there are requests for review, complaints, or to assist in criminal investigations by law enforcement agencies, images must be provided and retained according to the retention period for customer complaint investigation records.

4. Implementing measures to secure, prevent exposure, or copying of PIN codes when customers enter PINs at ATMs.

5. Regularly monitoring and supervising ATM transactions and informing customers of suspicious fraudulent transactions.

6. Providing and encouraging customers to use transaction control services, account balance inquiries (such as SMS banking, Internet banking) to help customers monitor their accounts themselves.

7. Providing information to law enforcement agencies and related organizations in preventing and combating crimes related to ATM operations and investigating and handling high-tech crimes, theft, robbery, and destruction of ATMs.

8. Payment service providers shall agree and cooperate with each other in sharing information about crimes related to ATM operations to promptly and effectively prevent and combat such crimes. ||| 9. Meeting other security requirements for ATM systems as stipulated by the State Bank of Vietnam regarding safety and security for bank card payment equipment.

Article 8. Provisions on inspecting, maintaining, and servicing ATMs II - Trade Fairs 1. Establishing and implementing regular inspection, maintenance, and servicing plans for ATMs.

2. Ensuring safety for ATMs and cash within ATMs during maintenance and servicing.

3. Paying attention to electrical safety, fire prevention, detection, removal, and prevention of unauthorized installations aimed at stealing card information when conducting inspections, maintenance, and servicing of ATMs.

4. Inspection, maintenance, and servicing of ATMs must be recorded in a logbook.

Payment service providers shall be responsible for:

Article 9. Provisions for mobile ATMs

1. Mobile ATMs are ATMs that can be regularly or periodically moved to one or several locations to serve customers during specific periods with certain services.

2. When initially deploying mobile ATMs, payment service providers shall be responsible for:

a) Developing a proposal for equipping, organizing operation, maintenance, servicing, and monitoring the activities of mobile ATMs, including clearly defining the content of activities (expected services, types of customers); total number of mobile ATM vehicles, number of ATMs per vehicle; operating area; time for using mobile ATMs to serve customers.

b) Developing internal policies on information security, operational procedures, risk management procedures, maintenance, servicing, control, and monitoring of mobile ATMs. in the Field of Teachers and Educational Institution Managers c) Submitting the proposal and internal policies under Points a and b of this Clause to the State Bank of Vietnam (through the Payment Department) at least 15 working days before implementation.

d) If there are changes to the contents of the proposal and internal policies under Points a and b of this Clause, payment service providers shall submit the documents to the State Bank of Vietnam before implementation.

4. Payment service providers shall deploy mobile ATMs in accordance with the submitted proposal to the State Bank of Vietnam and ensure compliance with general ATM regulations.

5. Payment service providers must ensure the safety of equipment and wireless network connections.

Payment service providers shall take preventive measures against fake mobile ATMs and guide customers on identifying features.

7. Quarterly (before the fifth day of the first month of the next quarter), payment service providers shall report on the deployment status of mobile ATM services according to Model No. 4 attached to this Circular.

d) In case of changes to the contents of the proposal and internal regulations under Points a and b of this Clause, organization the service provider shall submit documentation MANAGEMENT AND USE OF DEPOSITS AT THE ENVIRONMENT PROTECTION FUND for to the State Bank of Vietnam before implementation.

3.15 (Repealed)

4.16 Service providers deploying mobile ATMs must comply with the content of the proposal submitted to the State Bank of Vietnam and ensure compliance with general regulations on ATMs.

5. Service providers must ensure the safety of devices and wireless network connections.

6. Organization service providers shall take measures to prevent the forgery of mobile ATMs and guide customers on distinguishing features.

7.17 Quarterly (before the fifth day of the first month of the next quarter), organization the service provider shall report on the deployment status of mobile ATM services according to Model No. 4 attached to this Circular.

Article 10. Information and Reporting

1. Payment service providers and branches of the State Bank of Vietnam must report according to the statistical reporting system of the State Bank of Vietnam and when there is an urgent request from the competent authority as prescribed by law.

2. Organization payment service providers report on the implementation of upgrading system ATMs; unusual issues that may cause risks, loss of security in system their own ATMs and for the ATM systems of other payment service providers for to the State Bank of Vietnam (through the Payment Department).

Article 11. Responsibilities of Units under the State Bank of Vietnam

1. The Payment Department shall be responsible for reviewing and coordinating with relevant units inspection requirements when initially equipping the ATM system as stipulated in Article 3 of this Circular and providing opinions on cases where payment service providers have not fully met these requirements; serving as the focal point for receiving reports, compiling for the operating situation of the ATM network; serving as the focal point for coordinating with the police and related organizations in preventing and combating ATM-related crimes; quarterly summarizing the overall situation and reporting to the leadership of the State Bank, and reporting urgently when there are abnormal developments.

2. The Banking Inspection and Supervision Authority shall be responsible for inspecting and supervising compliance with the provisions of this Circular by payment service providers; handling violations within its jurisdiction and informing the Payment Department.

3. Branches of the State Bank in the locality where payment service providers install ATMs shall be responsible for:

a) Confirming the registration for installation, change of location, cessation of ATM operations in the locality by payment service providers.

b) Inspecting, supervising, and handling violations related to ATM activities in the locality: Regularly or when necessary organization inspecting all or selecting some ATMs in the locality for inspection, preparing an inspection record for ATMs according to Model No. 3 attached to this Circular. In case of discovering that payment service providers in the locality are not complying with the provisions of this Circular, handle the violation within its jurisdiction.

In Hanoi and Ho Chi Minh City, the Banking Inspection and Supervision Bureau shall take the lead in coordinating with the State Bank branch in inspecting, supervising, and handling violations related to ATM activities in the locality as well as in crime prevention and control work, and simultaneously inform the results to the State Bank branch.

c) Promptly reflecting any difficulties, incidents arising to the State Bank of Vietnam (through the Payment Department) for coordination in handling.

d) Quarterly (before the 5th day of the first month of each quarter), reporting the operating situation of the ATM network in the locality according to Model No. 5 attached to this Circular.

Article 12. Effective Date

20

This Circular takes effect from March 1, 2013.

Article 13. Organizations area

The Director of the Office, the Head of the Payment Department, the Heads of relevant units under the State Bank of Vietnam, the Governors of the State Bank branches in provinces and centrally-administered cities, the General Directors (Directors) of payment service providers and related organizations and individuals are responsible for implementing this Circular.

ANNEX

APPLICATION FORMS; INSTALLATION CONFIRMATION FORMS, LOCATION CHANGE, TERMINATION OF ATM OPERATIONS AND INSPECTION RECORD FORM FOR ATMS

21
(Annexed to Circular No. 36/2012/TT-NHNN dated December 28, 2012 of the Governor of the State Bank of Vietnam on the provision, management, operation, and ensuring the safety of automatic teller machine activities)

Model No. 122

……..(1)…….. -------	SOCIALIST REPUBLIC OF VIET NAM Independence - Freedom - Happiness ---------------
No.: … Regarding Installation/Change of Location, Time/Termination of ATM Operations	…(2)…, date … month … year …

Dear: State Bank branch …(2)…

Based on business needs, …(1)… hereby informs about the installation/change of location, time/termination of ATM operations in the province/city …(2)… as follows:

1. For installation/termination of ATM operations:

- Name or serial number of ATM:

- Serial number of ATM:

- Type of ATM: …(3)…

- Address:

- Managed by: …(4)…

- Date of installation/termination of ATM operations:

- Operating period: …(5)…

2. For change of ATM location:

- Name or serial number of ATM (old and new):

- Serial number of ATM:

- Type of ATM:

- Address (old and new):

- Managed by: …(4)… (old and new)

- Start date of using the new location:

- Operating period: …(5)…

3. For installation/change of ATM location:

…(1)… has fully complied with the provisions of the Circular on the provision, management, operation, and ensuring the safety of automatic teller machine activities as follows:

+ Equipment installed at the ATM: (specifically: Example: Surveillance camera; device to prevent card information copying and theft; ...)

+ Ensuring electrical safety; backup power supply; necessary lighting: (Specify in detail)

+ Fully complying with other regulations on the provision, management, operation, and ensuring the safety of ATM activities: (Specify in detail)

4. …(1)… hereby commits to ensure:

- Being responsible for the accuracy of the contents in this notification.

- Strictly implementing the provisions of the Circular on the provision, management, operation, and ensuring the safety of automatic teller machine activities and related laws. Managing ATM operations safely and smoothly and being responsible for all risks associated with ATMs.

Place of Receipt: - As above; - Payment Department; - Banking Inspection and Supervision Authority; - File.

LEGAL REPRESENTATIVE (Signature and stamp)

- Instructions for filling in information:

(1): Name of the payment service provider installing, changing location, or terminating ATM operations in the locality.

(2): Name of the province/city directly under the Central Government.

(3): Type of ATM such as Diebold, Wincor...

(4): Name of the payment service provider directly managing the ATM in the locality.

(5): For ATMs with limited operating hours, such as ATMs installed in supermarkets, office buildings, shopping centers...

Form No. 223

……..(1)…….. -------	SOCIALIST REPUBLIC OF VIET NAM Independence - Freedom - Happiness ---------------
No.: … Regarding Deployment/Change of Location, Time/Termination of Mobile ATM Operations	…(2)…, date … month … year …

Dear: State Bank branch …(2)…

Based on business needs, …(1)… hereby informs about the deployment/change of location, time/termination of mobile ATM operations in the province/city …(2)… as follows:

1. For deployment/termination of mobile ATM operations:

- Number of mobile ATMs deployed/terminated (number of vehicles, number of ATMs):

- Name or serial number of mobile ATM:

- Serial number of mobile ATM:

- Type of mobile ATM: …(3)…

- License plate number of mobile ATM:

- Managed by: …(4)…

- Services provided:

- Time of deployment/termination of mobile ATM operation:

- Reason for deploying mobile ATM (specify concretely): …(5)…

- Location of operation/termination of operation: ...(6)...

- Duration of operation: ...(7)...

2. For changes in location and duration of mobile ATM:

- Name or serial number of mobile ATM:

- Serial number of mobile ATM:

- Type of mobile ATM:

- License plate number of mobile ATM:

- Managed by: …(4)…

- Time to start changing time and location of mobile ATM:

- Place of operation (old and new): ...(6)...

- Duration of operation (old and new): ...(7)...

...(1)... commits to ensure:

- Responsibility for the accuracy of the contents in this letter.

- Deploying mobile ATM operations according to the specified locations and times.

- Strictly implementing regulations stipulated in Circulars on equipping, managing, operating, and ensuring the safety of automatic teller machine operations and related laws. Organizing the safe and smooth management of mobile ATM operations and bearing full responsibility for all risks associated with mobile ATMs./.

Place of Receipt: - As above; - Payment Department; - Banking Inspection and Supervision Authority; - File.

LEGAL REPRESENTATIVE (Signature and stamp)

- Instructions for filling in information:

(1): Name of the payment service provider organization in the area where the mobile ATM is deployed, changed in time and location, or terminated.

(2): Name of the province/city directly under the Central Government.

(3): Types of ATMs such as Diebold, Wincor...

(4): Name of the payment service provider organization directly using the mobile ATM in the area.

(5): Specify the reason for deploying mobile ATM.

(6), (7): In case the mobile ATM operates at multiple different locations, compile a list of locations and operating times of the mobile ATM (hours, days, months, years) corresponding to each location where the payment service provider organization deploys the mobile ATM service (can be compiled in table form).

Model No. 324

STATE BANK OF VIETNAM VIETNAM PROVINCIAL BRANCH, CITY... -------	SOCIALIST REPUBLIC OF VIET NAM Independence - Freedom - Happiness ---------------
	……., day … month … year …

RECORD OF ATM INSPECTION

Name of the payment service provider organization:…

Full name of the representative of the payment service provider organization …
Position...

Name or number of ATM:…

Manufacturer:…

Location of ATM:…

Full name of the inspector: …Position:…

Inspection Content: evaluate the level of compliance with requirements for ATMs.

Inspection Results:

Serial number	Inspection Content	Compliant	Non-compliant	Remarks
1	Camera equipment
2	Equipment to prevent card information copying and theft
3	Electrical safety (grounding wires, standard wiring, electrical design, leakage...)
4	Electricity source (Backup power supply, backup generator...)
5	Necessary instructions and guidance for customers
6	Cash replenishment time, fund status
7	Other content

Concluding opinion:

.........................................................................................................................................

.........................................................................................................................................

.........................................................................................................................................

.........................................................................................................................................

REPRESENTATIVE OF THE ORGANIZATION PROVIDING PAYMENT SERVICES (Sign and write full name)

INSPECTOR (Sign and write full name)

Model No. 425

REPORTING UNIT NAME -------	SOCIALIST REPUBLIC OF VIET NAM Independence - Freedom - Happiness ---------------
No.: …	……., day … month … year …

REPORT ON THE IMPLEMENTATION SITUATION OF MOBILE ATM SERVICES

QUARTER …. YEAR …….

Respected: Payment Department - State Bank of Vietnam

I. General figures

No.	License plate number of mobile ATM vehicle	Name or number of mobile ATM	Serial number of mobile ATM	Branch name deploying mobile ATM	Deployment address of mobile ATM	Time of mobile ATM deployment (day, month, year)	Number of transactions generated (items)	Value of transactions generated (million dong)
1	…
		…
		…
		…
		…
2	…

II. Report on transaction data through mobile ATM

Unit: Items/million dong

No.	Transaction type	Quantity	- The book value of the security is determined according to the Accounting System of the State Bank and the guidance document of the State Bank on the accounting treatment of foreign securities investment operations.
1.	Generated transactions*
	1. Supplementing Point 6a following Article 6 of Circular No. 02/2019/TT-BVHTTDL dated July 5, 2019 of the Minister of Culture, Sports and Tourism on the procedures for legal expertise regarding copyright and related rights as follows:
	b.
	c.
	d. Others
	Total
2.	Transactions with disputes, complaints
3.	Fraudulent transactions discovered

(*): Statistics based on the types of services mentioned in the proposal for equipping, organizing operation, maintenance, and monitoring of mobile ATM activities (only statistics financial transactions, not statistics non-monetary value transactions such as inquiries, statements...).

III. Evaluation of the implementation situation of mobile ATM services.

IV. Recommendations, proposals (if any).

Place of Receipt: - As above; - File.

LEGAL REPRESENTATIVE (Signature and stamp)

Model No. 526

STATE BANK OF VIETNAM VIETNAM STATE BANK UNIT … -------	SOCIALIST REPUBLIC OF VIET NAM Independence - Freedom - Happiness ---------------
	……., day … month … year …

REPORT ON ATM OPERATIONS IN THE AREA

QUARTER ….. YEAR ……

Respected: Payment Department

1. ATM Operation Situation

The situation of ATM operations and management, inspection, supervision, and handling of violations related to ATM operations in the area:

a. Regarding the assurance of ATM service quality

b. Regarding the assurance of ATM operation security and safety (specify relevant incidents, if any).

2. Public opinion: issues of concern reflected in the media related to ATM services in the area and measures to address them.

3. Difficulties and recommendations.

Place of Receipt: - As above; - File.

DIRECTOR (Signature and stamp)

Place of Receipt: - SBV Leadership; - OFFICE OF THE GOVERNMENT (FOR PUBLICATION IN THE GAZETTE); - Website of the State Bank; - To be filed: Office, PC3 (2)

CERTIFIED CONSOLIDATED DOCUMENT DIRECTOR DEPUTY DIRECTOR Nguyen Dong Tien