Decision No. 56/1999/QD-NHNN on the issuance of regulations on the construction, issuance, use, and management of Security Code in electronic fund transfer transactions of the State Bank.

               DECISION OF THE GOVERNOR OF THE STATE BANK OF VIETNAM

||| Regarding the issuance of regulations on the construction, issuance, use, and management of encryption keys in electronic fund transfer payments by the State Bank

|||

----------------

||| GOVERNOR OF THE STATE BANK

||| - Based on the Law on the State Bank of Vietnam No. 01/1997/QH10 dated December 12, 1997;

||| - Based on the Ordinance on Protection of State Secrets dated October 28, 1991;

- Pursuant to Decree No. 15/CP dated March 2, 1993 of the Government on the tasks, powers, and responsibilities of state management of ministries and ministerial-level agencies;

||| - Based on Decision No. 681/TTg dated November 15, 1994 of the Prime Minister regarding the list of state secrets in the banking sector;

||| - Based on Decision No. 196/TTg dated April 1, 1997 of the Prime Minister regarding the use of data information on carriers for accounting and payment purposes by banks and credit organizations;

||| - Pursuant to the proposal of the Director of the Accounting and Finance Department of the State Bank;

Pursuant to …;

Article 1. ||| Attached hereto is the "Regulation on the construction, issuance, use, and management of encryption keys in electronic fund transfer payments by the State Bank."

Article 2. This Decision shall take effect fifteen days from the date of signature.

Article 3. ||| The Heads of the Office, Directors of the Accounting and Finance Department, the Director of the Banking Information Technology Department, Heads of Departments, Heads of Units under the State Bank of Vietnam, Directors of Branches of the State Bank, and Directors of Provincial and Municipal State Bank Branches shall be responsible for implementing this Decision.

                                                                                                                

REGULATIONS ON THE CONSTRUCTION, ISSUANCE, USE, AND MANAGEMENT OF ENCRYPTION KEYS IN ELECTRONIC FUND TRANSFER PAYMENTS BY THE STATE BANK

(Issued together with Decision No. 56/1999/QĐ-NHNN2 dated February 12, 1999 of the Governor of the State Bank)

I - GENERAL PROVISIONS

Article 1. Encryption keys used in electronic fund transfer payments within the State Bank system (hereinafter referred to as encryption keys) are an application of information technology used to protect and control payment data when transmitting and receiving through computer networks between units of the State Bank.

Article 2. Encryption keys issued by the State Bank of Vietnam to individuals specified in Article 7 of these Regulations have the value of authenticating the authority, responsibility, and functions and duties of those individuals when performing fund transfer control work according to the technical procedures for electronic fund transfers within the State Bank system promulgated together with Decision No. 469/1998/QĐ-NHNN2 dated December 31, 1998 of the Governor of the State Bank.

Article 3. Encryption keys fall under the category of state secrets in the banking sector classified as "SECRET."

Individuals providing and installing software programs serving the construction, issuance, use, and management of encryption keys must commit to protecting state secrets according to the Regulation on the protection of state secrets in banking activities promulgated together with Decision No. 299/QĐ-NH4 dated November 26, 1994 of the Governor of the State Bank.

Article 4. Strictly prohibited are units and individuals attempting to decode, steal, buy, sell, disclose, duplicate, and illegally destroy encryption keys; using the protection of encryption keys to conceal violations of the law.

II - CONSTRUCTION OF ENCRYPTION KEYS

Article 5. The Director of the Accounting and Finance Department is responsible for selecting and deciding on the method and procedure for constructing encryption keys. When necessary, the Director of the Accounting and Finance Department may designate individuals who meet the required qualifications and character to assist in constructing encryption keys.

Article 6. The construction of the Security Key Code must be carried out in accordance with the following regulations:

1. It must be organized in a secure location; computers, printers, and other technical equipment used for constructing the Security Key Code must be strictly managed and used separately to ensure good technical condition and security;

2. Strictly adhere to the established construction procedures;

3. Construction and duplication of the Security Key Code must not exceed the specified quantity;

4. After completion, the Security Key Code must be registered in the logbook tracking constructed Security Key Codes, the logbook tracking newly constructed Security Key Codes (not yet distributed), and new Security Key Codes constructed, which shall be directly retained and stored under confidential document regulations by the Director of the Accounting and Finance Department. Any documents, drafts, and notes serving the construction of the Security Key Code, as well as trial and defective Security Key Codes, must be immediately destroyed along with the deletion and loss of recovery capability of the Security Key Code from any form within the computer and other information carriers to ensure accuracy, security, and confidentiality.

III - DISTRIBUTION AND MANAGEMENT OF SECURITY KEY CODE DISTRIBUTION

Article 7. The subjects eligible for distribution of the Security Key Code include:

1. Heads and Deputy Heads of the Interbank Payment Organization (Accounting and Finance Department);

2. Heads and Deputy Heads of Accounting and Payment Departments of State Bank units participating in electronic fund transfer payments within the State Bank system (hereinafter referred to as electronic fund transfer units);

3. Directors or Deputy Directors in charge of accounting work at electronic fund transfer units (if necessary).

For some electronic fund transfer units that have large payment transfers, additional personnel for fund transfer control may be required. In such cases, the Director or Head of the unit may select one or two individuals with good character and professional expertise to perform fund transfer control duties and submit a written request to the State Bank of Vietnam (Accounting and Finance Department) for consideration of the issuance of the Security Key Code.

Article 8. Procedures for the distribution of the Security Key Code:

1. To obtain the distribution of the Security Key Code, the Director or Head of the electronic fund transfer unit must submit a written request for the issuance of the Security Key Code along with a list of their unit's personnel to the State Bank of Vietnam (Accounting and Finance Department).

2. The Director of the Accounting and Finance Department is responsible for reviewing the list of personnel proposed by the electronic fund transfer unit for the issuance of the Security Key Code. The review is based on the subject, application procedure, and need for the Security Key Code at each electronic fund transfer unit. If the conditions for issuing the Security Key Code are met, the Director of the Accounting and Finance Department or the person designated by the Director to assist will process the issuance of the Security Key Code for each individual according to the request of the Director or Head of the electronic fund transfer unit.

Article 9. The Accounting and Finance Department and electronic fund transfer units must maintain a logbook listing personnel who have been issued the Security Key Code within their management scope. This logbook and the attached written request from the unit proposing the issuance of the Security Key Code, including the list of personnel, shall be kept by the Head of Regulations (Accounting and Finance Department) and the Head of Accounting and Payment (electronic fund transfer unit).

Article 10. The reissuance of the Security Key Code shall only be carried out in cases where the Security Key Code is damaged due to objective reasons such as the carrier containing the Security Key Code being damaged during transportation or experiencing technical malfunctions, etc. Upon discovering that the Security Key Code is damaged, the recipient must report this to the Director or Head of the Unit to request a letter proposing the State Bank of Vietnam (Accounting and Finance Department) to reissue the Security Key Code. The Director or Head of the Unit must immediately retrieve the damaged Security Key Code for handling according to regulations.

IV - USE AND MANAGEMENT OF SECURITY KEY CODE USAGE

Article 11. The Security Key Code shall only be used for encrypting and decrypting - controlling payment data when transferring and receiving funds through computer networks between units of the State Bank of Vietnam as stipulated in the Technical Procedures for Electronic Fund Transfer Operations within the State Bank System issued together with Decision No. 469/1998/QĐ-NHNN2 dated December 31, 1998 of the Governor of the State Bank of Vietnam.

Article 12. The person to whom the Security Key Code is issued may only use it when performing or authorized to perform fund transfer control tasks at their unit. Strictly prohibited is the disclosure or transfer of the Security Key Code to others under any circumstances by the person to whom the Security Key Code is issued.

When using the Security Key Code, the user must not reveal the password or method of using the Security Key Code. Computers and equipment used for the Security Key Code must be arranged and placed in hidden locations so that when (the person) uses the Security Key Code, others cannot observe the password or usage actions.

Article 13. Users of the Security Key Code must strictly adhere to the usage rules and procedures for the Security Key Code as instructed to ensure accuracy, safety, and confidentiality.

V - SUSPENSION OF USE, RECOVERY, AND CHANGE OF SECURITY KEY CODE

Article 14. The Security Key Code will be suspended from use, recovered, and changed in the following cases:

1. The Security Key Code has been reported lost, misplaced, disclosed, or suspected to have been disclosed;

2. The person to whom the Security Key Code is issued transfers to another job or is suspended from work;

3. The Security Key Code has expired (changed periodically).

Article 15. The Director or Head of the Electronic Fund Transfer Unit is responsible for suspending the use - by administrative measures, and immediately recovering the Security Key Code issued to personnel in their unit when:

1. Discovering that the Security Key Code is lost, misplaced, disclosed, or suspected to have been disclosed: In this case, they must immediately notify the Accounting and Finance Department, prepare a Record identifying the cause or responsible person (the responsible person must sign the Record), then report in writing to the State Bank of Vietnam (Accounting and Finance Department);

2. The person to whom the Security Key Code is issued transfers to another job or is suspended from work: In this case, the person to whom the Security Key Code is issued must immediately return the Security Key Code they are keeping and using to the Director or Head of the Unit. The Director or Head of the Unit is responsible for recovering the Security Key Code, notifying and reporting in writing to the State Bank of Vietnam (Accounting and Finance Department) to take appropriate measures;

3. Receiving notification from the Accounting and Finance Department regarding the suspension of use and change of the Security Key Code.

Article 16. The Director of the Accounting and Finance Department is responsible for:

1. Suspending the use of the Security Key Code - by technical means, upon receipt of notification from the electronic fund transfer unit about the loss, misplacement, disclosure, or suspicion of disclosure of the Security Key Code, and in the case where the person to whom the Security Key Code is issued transfers to another job or is suspended from work.

2. Changing the Security Key Code: After a period of use, the Security Key Code must be changed (changed periodically). When changing the Security Key Code, the Accounting and Finance Department must notify relevant units and individuals to proceed with the recovery of the old Security Key Code and issuance of a new one. The Director or Head of the Electronic Fund Transfer Unit is responsible for supervising the change of the Security Key Code at their unit.

Article 17. The unit where the security code key is recovered shall be responsible for storing it to handle it according to regulations. In cases where the security code key must be recovered but cannot be recovered, the unit must prepare a Record to determine the cause and the person responsible (if any), then immediately report in writing to the State Bank of Vietnam (Accounting and Finance Department) to take appropriate measures.

VI - HANDOVER, TRANSPORTATION, STORAGE AND DESTRUCTION OF SECURITY CODE KEYS

Article 18. The handover and transportation of security code keys between construction, issuance, and recovery stages shall be carried out according to the following provisions:

1. Methods of handover and transportation of security code keys:

- Direct handover;

- Handover via confidential mail;

- Handover via computer networks among State Bank units

2. All direct handovers of security code keys between constructors, secretaries, recipients, collectors, etc., must be recorded in a logbook, signed by both parties, and directly handed over at the workplace as stipulated by the head of the unit.

3. When sending security code keys through confidential mail: The Accounting and Finance Department and electronic payment units must maintain a "Security code key sent" logbook for tracking, verification, and performing the following procedures:

3.1. Issue a Sending Form: Security code keys sent must have a sending form attached, placed in an envelope, and on the form, the degree of confidentiality and urgency must be stamped according to regulations for confidential documents.

3.2 Enveloping: Security code keys sent must have their own envelopes, not mixed with regular document envelopes. The envelope paper must be durable, difficult to tear, waterproof, and opaque, folded diagonally, and sealed with strong adhesive. Security code keys sent must be sent in two envelopes:

- Inner envelope: clearly marked with the number and symbol of the security code key, recipient's name, stamped with "Confidential," and the phrase "Only the named person may open this envelope," then sealed.

- Outer envelope: marked like regular documents, stamped with the uppercase letter "C" (without the "Confidential" stamp).

The Accounting and Finance Department and electronic payment units are responsible for monitoring, inspecting, and verifying with the receiving unit or individual to prevent loss or errors.

4. For receiving security code keys through confidential mail: Security code keys received must be entered into the "Confidential Documents Received" logbook for tracking and reported immediately to the Director or Head of the unit before transferring to the recipient. The recipient must return the Sending Form to the sender on the same day of receipt.

5. Handover of security code keys via computer networks between State Bank units applies only to the issuance of security code keys and can only be implemented when technical conditions ensure accuracy, safety, and confidentiality. The Accounting and Finance Department, electronic payment units, and individuals receiving security code keys must maintain a logbook for tracking and strictly perform inspections and verifications to prevent loss or errors.

Article 19. The storage and preservation of security code keys shall be carried out according to the following regulations:

1. Newly constructed security code keys, issued but unused security code keys, currently used security code keys, and those awaiting processing after recovery must all be logged, stored, and preserved securely by relevant units and individuals according to the regime for confidential documents.

2. When not in use or unused, security code keys must be carefully stored and preserved in locked safes or cabinets, ensuring safety, and kept at the place of work.

Article 20. The security code key is invalidated after its use has been suspended.

1. The Director of the Accounting and Finance Department shall be responsible for guiding units transferring electronic funds and related individuals to carry out necessary procedures to invalidate the security code key.

2. The invalidation of the security code key shall be directly carried out by the Director of the Accounting and Finance Department or a person designated by the Director of the Accounting and Finance Department to assist, and must ensure that the security code key (which has been invalidated) cannot be reused.

3. The Accounting and Finance Department must maintain a record of invalidated security code keys.

VII-PENALTY FOR VIOLATIONS

Article 21. Units or individuals violating any of the provisions stipulated in Article 4 of this Regulation; losing the security code key; using the security code key in violation of regulations or using it to embezzle state assets and violating other provisions of this Regulation shall be subject to disciplinary action, administrative handling, or criminal prosecution depending on the nature and severity of the violation, and must bear material compensation responsibility for any damages caused according to the provisions of the Law.

VIII-IMPLEMENTATION PROVISIONS

Article 22. The Director of the Accounting and Finance Department shall be responsible for:

1. Managing the construction, issuance, modification, and guidance on the use of security code keys in electronic fund transfers within the State Bank system;

2. Guiding and inspecting the implementation of the Regulation on the construction, issuance, use, and management of security code keys in electronic fund transfers within the State Bank.

Article 23. The Director or Head of a unit of the State Bank participating in electronic fund transfers within the State Bank system shall be responsible for managing and supervising the use of security code keys at their own unit in accordance with this Regulation.

Article 24. Amendments and supplements to this Regulation shall be decided by the Governor of the State Bank.