CIRCULAR

Guidelines for electronic transactions on the securities market

_________________________

Pursuant to the Securities Law dated June 29, 2006;

Pursuant to the Law on Electronic Transactions dated November 29, 2005;

Pursuant to the Law on Information Technology dated June 29, 2006;

Pursuant to Decree No. 27/2007/NĐ-CP dated February 23, 2007 of the Government on electronic transactions in financial activities;

Pursuant to Decree No. 118/2008/NĐ-CP dated November 27, 2008, of the Government stipulating the functions, tasks, powers, and organizational structure of the Ministry of Finance;

The Ministry of Finance guides the implementation of certain contents of Decree No. 27/2007/NĐ-CP dated February 23, 2007 of the Government on electronic transactions in the securities market as follows:

This technical regulation sets out technical requirements, testing methods, sampling procedures; management requirements; responsibilities of organizations and individuals producing, trading, and importing cigarettes.

Thông tư này quy định chi tiết khoản 4 Điều 38 Luật Thủy sản số 18/2017/QH14 đã được sửa đổi, bổ sung tại điểm c khoản 21 Điều 14 Luật số 146/2025/QH15.

This Circular stipulates principles and procedures for organizing electronic transactions in online securities trading activities, electronic information exchange related to public offering of securities, securities custody, listing of securities; management activities of securities companies, fund management companies, investment securities companies; information disclosure activities and other activities related to the securities market as prescribed in the Securities Law.

 2. Scope of Regulation

The scope of regulation includes the State Securities Commission (SSC), Stock Exchange (SE), Central Depository Corporation (CDC), issuers, listed entities, securities companies, fund management companies, investment securities companies, joint-stock companies, investors, and other intermediaries that choose to conduct securities and securities market activities electronically.

In this technical regulation, the following terms are understood as follows:

3.1. Electronic Transactions in the Securities Field These are transactions in securities and securities market activities and services carried out through electronic means, including: public offering of securities, securities custody, securities listing; management activities of securities companies, fund management companies, investment securities companies; information disclosure activities and other activities related to the securities market as prescribed in the Securities Law.

3.2. Electronic Documents in the Securities Field These are data messages about securities business activities created, sent, received, and stored through electronic means in online securities trading activities; electronic information exchange related to public offering of securities, securities custody, securities listing; management activities of securities companies, fund management companies, investment securities companies; information disclosure activities and other activities related to the securities market as prescribed in the Securities Law.

3.3. Electronic Order Form This is a data message recording customer transaction orders placed through a system (of the securities company where the customer has opened a trading account) at a specific time, which can only be accessed by the customer through login and order placement passwords.

4. Principles of Electronic Transactions in the Securities Field

4.1. The implementation of electronic transactions in the securities field must comply with the principles of clarity, fairness, honesty, safety, effectiveness, and conformity with Article 5 of the Law on Electronic Transactions No. 51/2005/QH11.

4.2. Organizations providing electronic transaction services in the securities field must meet the conditions prescribed in Section I.1 Part II of Circular No. 78/2008/TT-BTC on electronic transactions in financial activities.

4.3. Individuals and organizations using electronic transaction services in the securities field must meet the conditions prescribed in Section I.2 Part II of Circular No. 78/2008/TT-BTC on electronic transactions in financial activities.

II. SPECIFIC CONTENTS

5. Online Securities Trading Activities

5.1. Service Requirements

5.1.1. Online securities trading service is a service provided by securities companies to investors for opening accounts, placing orders, making requests for securities transactions, or receiving transaction results through the Internet or telephone.

5.1.2. Securities eligible for online trading services are those traded on the Stock Exchange.

5.1.3. Securities companies must create an electronic information page with a defined address on the Internet serving as an entry point for online trading services.

5.1.4. Investors who open an account according to the law on the electronic information page of a securities company may access online trading services after registration and completion of necessary legal procedures.

When conducting online securities trading, investors may use electronic order forms, which must meet all standards prescribed in Article 5 of Decree No. 27/2007/NĐ-CP on electronic transactions in financial activities.

5.1.5. Securities companies must directly provide online trading services to investors; they are not allowed to delegate or hire unauthorized organizations through service fee payment arrangements.

5.1.6. Securities companies must establish a process for implementing online trading services consistent with the Law on Electronic Transactions and sign a written contract with customers clearly defining both parties' legal responsibilities, including liability for compensation in case of risk. Securities companies must also disclose risks related to investors in the form of a "Risk Disclosure Statement" attached to the contract.

5.1.7. Securities companies must store and ensure the integrity of original electronic documents, electronic order forms, electronic data, and recordings of customer order calls for at least ten years.

5.1.8. Securities companies have the responsibility to protect the information of organizations and individuals participating in online trading in accordance with the law. Securities companies are not permitted to publish on their legitimate electronic business pages programs or systems related to account money, securities, identification information, and other investor data.

5.1.9. Securities companies providing online trading services must offer alternative trading methods for customers using online trading services.

5.1.10. Securities companies have the responsibility to regularly provide comparison documents regarding electronic transaction activities to investors using online trading services.

5.1.11. A securities company shall not provide online trading services for the transfer of financial resources, the transfer and entrustment of buying and selling of securities.

5.1.12. Securities companies must disclose relevant risks on the "Risk Disclosure Statement," on their official electronic information website, and within customer application software. The disclosed risks include the following:

a. During transmission over the Internet, trading orders may be suspended, interrupted, delayed, or contain data errors;

b. Identification of organizations or investors may be inaccurate, security breaches may occur;

c. Market prices and other securities information may contain errors or discrepancies;

d. Other risks that securities regulatory authorities and securities companies consider necessary to disclose.

5.1.13. Securities companies participating in online trading service operations must annotate the effective time or delay time of listed securities price tables when sending them to customers. If securities companies provide securities information to customers, they must disclose the source of the information.

5.2. Technical Requirements

5.2.1. Securities companies must implement comprehensive and strict technical solutions to ensure that the online trading service system is technically isolated from other business systems; prevent unauthorized access to the company's internal business systems through online trading activities.

5.2.2. Securities companies must technically isolate all information data of non-subscribed online trading service investors from the online trading service system; establish internal restriction systems.

5.2.3. The online trading service system must have technical solutions to ensure system safety, backup data storage, and malfunction recovery to guarantee the technical integrity, completeness, and accuracy of customer data.

5.2.4. Securities companies must assign staff with sufficient qualifications to manage and monitor the activities of the online trading service system. Securities companies must have a team of employees meeting the professional requirements for information technology such as operating system management, database management, security technology, and network management.

5.2.5. The online trading service system must have functions or means for real-time management and preventing illegal access. The system must reasonably retain daily log information and check the main software backups of the online trading service system such as the network operation system, database management system, and network management system.

5.2.6. Customer information using online trading services, trading orders, and other sensitive information must be appropriately encrypted during transmission over the Internet.

5.2.7. Securities companies must apply reliable technical or management measures to accurately identify online investors; prevent fraudulent customers or fraudulent securities companies.

5.2.8. Securities companies must apply technical or management measures to set transaction limits for each investor participating in online trading services according to legal regulations.

5.2.9. Major technical equipment related to secure data transmission and identification in the online trading service system must undergo testing and certification for safety by competent state management agencies. Online trading services must use digital signatures; in cases where there is no public digital signature verification service, parties involved in transactions may agree in writing to use electronic signatures to ensure safety during the transaction process.

5.2.10. Software related to system security and core business operations must be entrusted with program source passwords and necessary compilation environments to an independent organization recognized by the relevant parties.

5.3. Procedures for Registering the Provision of Online Securities Trading Services

5.3.1. Securities companies providing online securities trading services must be members of the Stock Exchange and must register for approval with the Securities Commission.

5.3.2. The registration dossier for providing online securities trading services includes:

a. An application form to participate in providing online securities trading services bearing the official seal of the company and a commitment to comply with current legal regulations;

b. A list of names and resumes of the company's system management experts who meet the technical expertise requirements specified in Clause 5.2.4 of this Circular;

c. A list of branches participating in online securities trading services business, including contact addresses, names of contacts, and communication methods;

d. A sample contract for online securities trading services with customers, which must clearly specify the risks and other documents related to online securities trading services;

đ. A summary analysis report and a system design report related to the online securities trading service system. Main contents include: technical standards and implementation strategies for technical standards regarding network structure, real-time management, identification, encryption during data transmission, digital signatures, network segmentation, risk prevention, network communication methods, network access methods, network structure and function diagrams;

e. A system testing report including the maximum capacity of the system, response and latency indicators, fault tolerance, reliability, and important configuration data related to the system;

g. A contingency plan for system malfunctions, information transmission, alternative trading methods, and measures related to data and system recovery;

h. Certificates regarding the safety and quality of the system;

i. The electronic website address for accessing the company's online securities trading service;

k. The risk management plan of the company in implementing the online trading service, including technical, managerial, and service measures for controlling risks related to the online trading service;

l. Technical documentation on network access equipment, network integration equipment, software systems, hardware, and other relevant devices.

5.3.3. Within forty-five days from the date of receiving complete and valid application files, the Securities Commission will issue decisions to reject or approve the provision of online securities trading services. In case of rejection, the Securities Commission must provide a written response stating the reasons.

5.3.4. Securities companies approved to provide online securities trading services must submit to the Securities Commission and the Stock Exchange any documents and reports related to system upgrades and changes, such as major upgrades to the operational system of the online securities trading service, significant repairs to the business management system, or operating a technical system and stock trading principles at a branch that has not previously provided online trading services. The report submission deadline is a minimum of seven working days before the securities company implements the upgrade or change.

5.3.5. Securities companies approved to provide online securities trading services must submit an annual report to the Securities Commission on their online securities trading activities by January 31 of the following year.

5.3.6. The Securities Commission and the Stock Exchange have the responsibility to publish on their websites lists of securities companies that meet the conditions and are permitted to provide online securities trading services.

6. Electronic information exchange activities

6.1. Electronic information exchange activities involve the exchange of information through the Internet between market regulatory organizations (including the Securities Commission, the Stock Exchange, the Securities Depository Center), securities companies, fund management companies, investment securities companies, and registered users.

6.2. Registered users can send their own disclosure data and receive feedback information from the securities market regulatory authorities through their registered addresses.

6.3. Registered users of the electronic information exchange service include:

a. Public companies, organizations registering for securities issuance;

b. Organizations and individuals conducting securities registration and custody;

c. Organizations registering for securities listing;

d. Organizations applying to establish securities companies, fund management companies, and investment securities companies;

đ. Other related organizations and individuals.

6.4. Registered users of the electronic information exchange service must submit registration applications and complete other necessary procedures to be able to use any electronic information exchange services on the websites of market regulatory organizations.

6.5. Market regulatory organizations are responsible for issuing specific procedures for the electronic information exchange service and, if necessary, signing a written contract with registered users. This contract must clearly state the legal responsibilities of both parties and potential risks to customers when using the service provided by the service provider.

6.6. Regulatory agencies must establish an electronic information website on the Internet serving as an entry point for the electronic information exchange service.

6.7. Service providers of the electronic information exchange service are responsible for ensuring customer information security.

6.8. Information and data transmitted through the electronic information exchange system must comply with the provisions set forth in Article 4 of Decree 27/2007/ND-CP regarding electronic transactions in financial activities.

6.9. Procedures for providing electronic information exchange services in the securities sector must follow the regulations stipulated in Section V.A.2 Part II of Circular 78/2008/TT-BTC on electronic transactions in financial activities.

III. VIOLATION HANDLING

Organizations and individuals participating in electronic transactions in the securities sector who violate laws, depending on the nature and degree of violation, will be subject to administrative penalties, compensation for damages, or criminal liability according to the provisions of Decree 27/2007/ND-CP, the Securities Law, and other relevant legal regulations.

IV. IMPLEMENTATION

1. This Circular takes effect 45 days from the date of issuance.

2. Securities companies that have provided online securities trading services must complete the approval registration procedures with the Securities Commission within six months from the effective date of this Circular.

3. The Securities Commission, the Stock Exchange, the Securities Depository Center, issuers, listed organizations, securities companies, fund management companies, investment securities companies, and related organizations and individuals are responsible for implementing this Circular.