Decree No. 94/2025/NĐ-CP on the Controlled Testing Mechanism in the Banking Sector

DECREE

Regulations on Controlled Testing Mechanism in the banking sector

 _____________

On the basis of Law on Government Organization dated February 18, 2025;

Pursuant to the Law on the State Bank of Vietnam dated June 16, 2010;

Pursuant to the Law on Credit Institutions dated January 18, 2024;

At the proposal of the Governor of the State Bank of Vietnam;

The Government issues this Decree to regulate the Controlled Testing Mechanism in the banking sector. 

PART I

GENERAL PROVISIONS

Article 1. Scope of Regulation

1. This Decree stipulates the Controlled Testing Mechanism in the banking sector (hereinafter referred to as the Controlled Testing Mechanism) for the implementation of new products, services, and business models through the application of financial technology solutions (hereinafter referred to as fintech solutions).

2. Financial technology solutions (abbreviated as fintech solutions) participating in testing under the Controlled Testing Mechanism include:

a) Credit scoring;

b) Data sharing via open application programming interfaces (Open API);

c) Peer-to-peer lending.

Article 2. Applicability

1. Credit institutions and foreign bank branches as prescribed in the Law on Credit Institutions (this point does not apply to point c, Clause 2, Article 1 of this Decree).

2. Fintech companies.

3. Competent state agencies.

4. Customers and other organizations and individuals related to the Controlled Testing Mechanism.

Article 3. Explanation of Terms

In this Decree, the following terms are understood as follows:

1. A fintech company (abbreviated as fintech company) is an organization that is not a credit institution or foreign bank branch, legally established or registered for business operations within the territory of Vietnam; independently supplying fintech solutions or providing such solutions to the market through cooperation with credit institutions or foreign bank branches.

2. Organizations participating in the Controlled Testing Mechanism are credit institutions, foreign bank branches, and fintech companies that have been granted a Certificate of Participation in the Controlled Testing Mechanism by the State Bank of Vietnam (hereinafter referred to as the State Bank).

3. Peer-to-peer lending solution is a technology information application provided by a peer-to-peer lending company to connect information and support the conclusion of contracts between borrowers and lenders on a digital platform. The currency used in the peer-to-peer lending solution is the Vietnamese Dong.

4. A peer-to-peer lending company is a fintech company providing peer-to-peer lending solutions to customers.

5. An open application programming interface (Open Application Programming Interface - Open API) is a set of standardized APIs that can be used by computer systems of various credit institutions, foreign bank branches, fintech companies, and third parties to send service requests to the credit institution or foreign bank branch sharing that Open API system.

6. Credit scoring is a technology information system application of credit institutions, foreign bank branches, or fintech companies aimed at rating the creditworthiness of an individual or organization to assist credit institutions or foreign bank branches in making credit decisions.

7. Customer is an organization or individual having contractual relations and directly using fintech solutions of participating organizations in the Controlled Testing Mechanism.

8. Customers using peer-to-peer lending solutions provided by a peer-to-peer lending company include: Lender is a legal entity (including credit institutions and foreign bank branches) established in accordance with Vietnamese law, Vietnamese citizens; Borrower is a legal entity (excluding credit institutions and foreign bank branches) established in accordance with Vietnamese law, Vietnamese citizens.

Article 4. Objectives of the Testing Mechanism

1. Promote innovation and modernization in the banking sector, thereby realizing the goal of financial inclusion for individuals and businesses in a transparent, convenient, safe, efficient manner with low costs.

2. Create a testing environment to assess risks, costs, and benefits of Fintech solutions; support the development of Fintech solutions that meet market needs, legal frameworks, and regulatory requirements.

3. Minimize risks to customers when using Fintech solutions provided by organizations participating in the Testing Mechanism.

4. The results of implementing Fintech solution trials shall be used as practical grounds for relevant state agencies to study, build, and improve legal frameworks and regulatory provisions if necessary.

Article 5. Principles for Reviewing Organizations Participating in the Testing Mechanism

To ensure fairness, objectivity, transparency, and openness, the review of organizations participating in the Testing Mechanism shall be conducted based on the following basic principles:

1. The review process for organizations participating in the Testing Mechanism ensures transparency regarding criteria, conditions, evaluation procedures, and selection processes.

2. Participation in the Testing Mechanism does not guarantee that participating organizations will meet business and investment conditions stipulated by law.

3. Credit institutions, foreign bank branches, and Fintech companies that do not have a need to participate in the Testing Mechanism or have not been reviewed for participation shall operate and comply with current laws governing enterprises, investments, and other related laws.

Article 6. Duration, Space, and Scope of Testing

1. The maximum duration for testing Fintech solutions is two years from the date the State Bank issues the Certificate of Participation in the Testing Mechanism, depending on each specific solution and field. The testing period may be extended according to Article 20 of this Decree.

The validity period of the Certificate of Participation in the Testing Mechanism shall not exceed the validity period (if any) of the establishment license or business registration certificate of the participating organization.

2. Testing Space:

The implementation of Fintech solution trials is limited within the territory of Vietnam and shall not involve cross-border testing.

3. Testing Scope:

a) Organizations participating in the Testing Mechanism are only allowed to provide Fintech solutions within the scope specified in the Certificate of Participation in the Testing Mechanism;

b) Depending on the Fintech solution and the specific proposal of the organization applying to participate in the Testing Mechanism in the Application Form for Participation in the Testing Mechanism, the opinions of relevant ministries and the State Bank shall determine the testing scope of the Fintech solution trial in the Certificate of Participation in the Testing Mechanism;

c) Peer-to-peer lending companies are only permitted to implement peer-to-peer lending solutions within the testing scope specified in the Certificate of Participation in the Testing Mechanism issued by the State Bank in accordance with this Decree. Peer-to-peer lending companies participating in the Testing Mechanism are not allowed to engage in other business activities not mentioned in the Certificate of Participation in the Testing Mechanism, nor can they self-provide collateral for customer loans, act as customers, or supply peer-to-peer lending solutions to pawnshops.

Article 7. Principles for Establishing and Submitting Registration Files for Participation in the Testing Mechanism, Adjusting Testing Solutions, Stopping Testing, Extending Testing Periods, and Requesting Issuance of a Completion Testing Certificate

1. The file must be established in Vietnamese. In cases where documents issued, notarized, or certified by competent authorities of foreign countries are involved, they must be legalized according to Vietnamese law (except in cases exempted from legalization under Vietnamese law on legalization) and translated into Vietnamese.

2. Copies of the files and documents must be certified copies or copies made from original registers or accompanied by the originals for comparison as stipulated by law; in cases of online submission, procedures for administrative transactions in the electronic environment shall be followed.

3. Self-prepared personal history declarations must have signatures authenticated according to the law.

4. The file may be sent via postal service (postal service) or directly submitted to the One-Stop Service Unit of the State Bank of Vietnam or submitted online at the State Bank of Vietnam’s Public Service Portal or the National Public Service Portal.

5. Organizations requesting issuance of a Participation Testing Mechanism Certificate, adjusting testing solutions, stopping testing, extending testing periods, and issuing a Completion Testing Certificate must bear full responsibility under the law for the accuracy and truthfulness of the provided information.

Chapter II

REGISTRATION AND ISSUANCE OF PARTICIPATION TESTING MECHANISM CERTIFICATE

Section 1

FOR FINTECH SOLUTIONS AS PROVIDED IN POINTS A AND B, CLAUSE 2, ARTICLE 1

Article 8. Conditions and Criteria for Participation in the Testing Mechanism

1. Credit institutions that do not belong to credit institutions currently under special control according to the Law on Credit Institutions and foreign bank branches will be considered for issuance of a Participation Testing Mechanism Certificate when the FinTech solution meets the following criteria:

a) It is a solution with technical and operational content for which current legal regulations do not provide specific guidance for implementation and application;

b) It is an innovative solution bringing benefits and added value to service users in Vietnam, particularly those supporting and promoting financial inclusion goals;

c) It has designed and built a risk management framework to limit negative impacts on the banking system and banking-currency-exchange activities; it has developed plans to handle and mitigate risks occurring during the testing process; it has developed consumer protection plans;

d) It has been thoroughly reviewed and evaluated by the organization participating in the Testing Mechanism across all aspects of its functions, utility, and effectiveness;

e) It is feasible to supply to the market after completing the testing process.

2. FinTech companies will be considered for issuance of a Participation Testing Mechanism Certificate when the FinTech solution meets the criteria set forth in Clause 1 of this Article and satisfies the following conditions:

a) It is a legal entity established and operating legally within the territory of Vietnam; it is not undergoing division, separation, merger, consolidation, conversion, dissolution, or bankruptcy according to the law;

b) The法定代表人、总经理（经理）必须具有经济学、工商管理、法律或信息技术专业本科及以上学历，并且至少有两年在金融或银行领域担任管理者或经营者的经验，且不属于法律规定禁止的对象。

3. Organizations participating in the Testing Mechanism are responsible for ensuring that they maintain all necessary conditions throughout their participation in the Testing Mechanism.

Article 9. Documents for Registration to Participate in the Testing Mechanism

1. Application for issuance of Participation Certificate in the Testing Mechanism according to Form No. 01 attached as Appendix I to this Decree for credit institutions and foreign bank branches; Application for issuance of Participation Certificate in the Testing Mechanism according to Form No. 02 at Appendix I attached to this Decree for Fintech companies.

2. Documentation describing the organizational structure and management when implementing the registered Fintech solution for testing.

3. Resolution of the Board of Members, Board of Directors, General Shareholders' Meeting, or relevant document of the authorized representative of the owner, in accordance with the Articles of Association, regarding approval of the project describing the registered Fintech solution to participate in the Testing Mechanism.

4. Project describing the registered Fintech solution to participate in the Testing Mechanism, including simulation model or trial demonstration (Demo) of the solution; potential customer group; compliance with all criteria specified in Clause 1, Article 8, detailed in Appendix II attached to this Decree.

5. Testing plan, including: Expected testing period, space, and scope; estimated budget for testing activities; resources participating in testing; principles for exchanging and reporting to the State Bank during the testing phase; termination of testing ensuring feasibility to complete obligations within a maximum period of six months from the date of decision to stop testing.

6. Personnel files: Curriculum vitae (within six months prior to submission of the application), copies of certificates proving the qualifications and professional expertise of the legal representative, General Director (Director), Deputy General Director (Deputy Director), and key staff members responsible for implementing the Fintech solution testing.

7. Copies of documents proving that the organization applying to participate in the Testing Mechanism has been established and operates legally, including: License for establishment or equivalent documents; Articles of Association; Investment Certificate of foreign investors (if applicable).

Article 10. Procedures and Formalities for Registration to Participate in the Testing Mechanism

1. In case the application is sent via postal service (mail service) or submitted directly to the One-Stop Service Unit of the State Bank, the organization applying to participate in the Testing Mechanism shall submit two sets of application documents and six CDs (or six USBs) storing scanned copies of the full application package requesting issuance of the Participation Certificate in the Testing Mechanism as stipulated in Article 9 of this Decree.

2. Within five working days from the date of receipt of the application, the State Bank shall issue a confirmation letter acknowledging receipt of the complete and valid application or request the organization applying to participate in the Testing Mechanism to supplement and perfect the application components. The time for supplementation and perfection of the application components will not be counted towards the review period.

Within five working days from the date the State Bank issues a request for supplementation and perfection of the application components, if the organization applying to participate in the Testing Mechanism does not resubmit the application or the supplemented application does not meet the requirements, the State Bank shall return the application to the organization applying to participate in the Testing Mechanism.

3. Within ninety working days from the date of issuing the confirmation letter acknowledging receipt of the complete and valid application, the State Bank shall coordinate with relevant ministries to conduct a review of the application, including on-site inspection if necessary.

Based on receiving a complete and valid application, the State Bank shall send a request for comments from relevant ministries. Within fifteen working days from the date the State Bank sends the request, relevant ministries shall submit their comments on the application to the State Bank.

If on-site inspection is required, the State Bank shall request relevant ministries to assign personnel to join the on-site inspection team. Within five working days from the date the State Bank sends the request, relevant ministries shall submit their assignment letters to the State Bank. On-site inspections must be notified to the organization applying to participate in the Testing Mechanism at least three working days before the inspection takes place at the organization's office.

If the application requires clarification or completion, the State Bank shall request the organization applying to participate in the Testing Mechanism to provide explanations and complete the application. The organization applying to participate in the Testing Mechanism is allowed to submit explanations and complete the application once.

After thirty working days from the date the State Bank requests explanations and completion of the application, if the organization applying to participate in the Testing Mechanism does not resubmit the explanation and completed application, the State Bank shall return the application to the organization applying to participate in the Testing Mechanism. The time for providing explanations and completing the application will not be counted towards the review period.

Upon receipt of the supplemented and completed application from the organization applying to participate in the Testing Mechanism, the State Bank shall send a request for comments from relevant ministries. Within ten working days from the date the State Bank sends the request, relevant ministries shall submit their comments on the application to the State Bank.

4. After the review period specified in Clause 3 of this Article ends, the State Bank shall issue a Participation Certificate in the Testing Mechanism to organizations whose applications meet the conditions and criteria set forth in Article 8 of this Decree. In case of rejection, the State Bank shall reply in writing and specify the reasons.

5. Within ninety days from the date the State Bank issues the Participation Certificate in the Testing Mechanism, the organization issued the Participation Certificate shall implement the Fintech solution within the scope specified in the Participation Certificate.

Section 2

FOR LENDING SOLUTIONS

Article 11. Conditions and criteria for participation in the Testing Mechanism

1. A peer-to-peer lending solution shall be considered for issuance of a Certificate to participate in the Testing Mechanism when the solution meets the criteria stipulated in Clause 1, Article 8 of this Decree and the following criteria:

a) Measures must be in place to determine and manage the maximum outstanding debt for one borrower at the peer-to-peer lending solution provided by the company, report and extract real-time information about the borrower to the National Credit Information Center to ensure compliance with the maximum outstanding debt for one borrower at the peer-to-peer lending solution provided and the maximum outstanding debt for one borrower across all participating peer-to-peer lending solutions in the Testing Mechanism;

b) The disbursement, repayment of loans, interest, and fees for customer transactions at the peer-to-peer lending solution must be conducted through the customer's transaction account at a credit institution, foreign bank branch, or electronic wallet at a payment service provider organization;

c) Measures must be in place to ensure that the term of the contract between the borrower and the lender using the peer-to-peer lending solution participating in the Testing Mechanism does not exceed two years.

2. A Fintech Company registering to test a peer-to-peer lending solution shall be considered for issuance of a Certificate to participate in the Testing Mechanism when the solution meets the criteria stipulated in Clause 1 of this Article and satisfies the following specific conditions:

a) It is a business legally established and operating on the territory of Vietnam; it is not a foreign-invested enterprise; it is not undergoing division, spin-off, merger, acquisition, conversion, dissolution, or bankruptcy according to the provisions of the law;

b) The法定代表人、总经理（经理）of the Company must be a Vietnamese citizen; have no criminal record; not have been administratively punished in the financial, banking, and cybersecurity sectors; not simultaneously be the owner, manager of a financial services, banking, pawnshop, multi-level marketing business; not be the head of a loan syndicate, clan, association, or community, or a member of the Board of Directors, member of the Board of Members, member of the Supervisory Board, General Manager (Manager), Deputy General Manager (Deputy Manager), and equivalent positions in credit institutions, foreign bank branches, payment service provider organizations;

c) The法定代表人、总经理（经理）of the Company must hold a bachelor's degree or higher in economics, business administration, law, information technology, and have at least two years of experience as a manager or operator in the financial and banking sector, and not belong to the prohibited categories under the law;

d) Meet the standards for human resources, physical facilities, and technology for the digital platform implementing the peer-to-peer lending solution, ensuring the following minimum requirements:

The information technology system and information storage system must be located within the territory of Vietnam, operate safely and continuously, with an independent backup technical system to ensure uninterrupted operation in case of incidents, especially technical and technological incidents.

Customer data and information of all related parties must be updated, stored, and shared on a highly secure digital platform, ensuring transparency and openness among participating parties while also protecting the information of participating parties from unrelated parties according to the law.

Test and evaluate the information technology system before putting it into operation.

The technical staff team must have professional expertise in the field they are responsible for, ensuring safe and continuous operation of the system.

3. Peer-to-peer lending companies participating in the Testing Mechanism are responsible for ensuring that they maintain all conditions and criteria during their participation in the Testing Mechanism.

Article 12. Documents for Registration to Participate in the Testing Mechanism

The documents for registration to participate in the Testing Mechanism for a Fintech Company that has registered to test peer-to-peer lending solutions include the following specific documents:

1. Application form for participation according to Model No. 03 attached as Appendix I to this Decree.

2. Documentation describing organizational structure and management when implementing the peer-to-peer lending solution registered to participate in the Testing Mechanism.

3. Resolution of the Board of Members, Board of Directors, Shareholders' Meeting, or relevant document from the authorized representative of the owner, consistent with the provisions of the Articles of Association regarding approval of the project describing the peer-to-peer lending solution registered to participate in the Testing Mechanism.

4. Project describing the peer-to-peer lending solution registered to participate in the Testing Mechanism, which is detailed in Appendix III attached to this Decree.

5. Testing plan, including: Expected testing period, scope, and geographical area, estimated budget for testing activities, expected resources participating in testing, principles for exchanging information and reporting to the State Bank during the testing phase; ensuring feasibility to fulfill obligations to customers and related parties after the decision to terminate testing.

6. Personnel files: Curriculum vitae, Criminal Record Certificate (within six months prior to submission of the application), copies of certificates proving qualifications and professional expertise of the legal representative, General Director (Director); document from the authorized representative of the entity where the legal representative, General Director (Director) has worked confirming position and tenure, or copy of document proving position and tenure at the entity.

7. Copies of documents proving the establishment and lawful operation of the Fintech Company, including: Business License or equivalent document, Articles of Association.

Article 13. Procedure and Formalities for Registration to Participate in the Testing Mechanism

1. In case the documents are sent via postal service or directly submitted to the One-Stop Service Unit of the State Bank, the organization registering to participate in the Testing Mechanism shall submit two sets of documents and six CDs (or six USBs) storing complete scanned copies of the documents requesting issuance of the Participation Certificate in accordance with Article 12 of this Decree.

2. Within five working days from the date of receipt of the application, the State Bank shall issue a confirmation letter acknowledging receipt of the complete and valid application or request the organization applying to participate in the Testing Mechanism to supplement and perfect the application components. The time for supplementation and perfection of the application components will not be counted towards the review period.

Within five working days from the date the State Bank issues a request for supplementation and perfection of the application components, if the organization applying to participate in the Testing Mechanism does not resubmit the application or the supplemented application does not meet the requirements, the State Bank shall return the application to the organization applying to participate in the Testing Mechanism.

3. Within ninety working days from the date of issuing the confirmation letter acknowledging receipt of the complete and valid application, the State Bank shall coordinate with relevant ministries to conduct a review of the application, including on-site inspection if necessary.

Based on receiving a complete and valid application, the State Bank shall send a request for comments from relevant ministries. Within fifteen working days from the date the State Bank sends the request, relevant ministries shall submit their comments on the application to the State Bank.

If on-site inspection is required, the State Bank shall request relevant ministries to assign personnel to join the on-site inspection team. Within five working days from the date the State Bank sends the request, relevant ministries shall submit their assignment letters to the State Bank. On-site inspections must be notified to the organization applying to participate in the Testing Mechanism at least three working days before the inspection takes place at the organization's office.

If the application requires clarification or completion, the State Bank shall request the organization applying to participate in the Testing Mechanism to provide explanations and complete the application. The organization applying to participate in the Testing Mechanism is allowed to submit explanations and complete the application once.

After thirty working days from the date the State Bank requests explanations and completion of the application, if the organization applying to participate in the Testing Mechanism does not resubmit the explanation and completed application, the State Bank shall return the application to the organization applying to participate in the Testing Mechanism. The time for providing explanations and completing the application will not be counted towards the review period.

Upon receipt of the supplemented and completed application from the organization applying to participate in the Testing Mechanism, the State Bank shall send a request for comments from relevant ministries. Within ten working days from the date the State Bank sends the request, relevant ministries shall submit their comments on the application to the State Bank.

4. After the review period specified in Clause 3 of this Article ends, the State Bank issues the Participation Certificate for organizations whose applications meet the conditions and criteria stipulated in Articles 8 and 11 of this Decree. In case of rejection, the State Bank will provide a written response stating the reasons.

5. Within ninety days from the date of issuance of the Participation Certificate by the State Bank, the organization receiving the Participation Certificate shall implement the peer-to-peer lending solution within the scope defined in the Participation Certificate.

Chapter III

SUPERVISION DURING THE TESTING PERIOD AND CONCLUSION OF THE TESTING PERIOD

Article 14. Supervision and Inspection Activities During the Testing Period

1. The State Bank carries out supervision over organizations participating in the Testing Mechanism through the following activities:

a) Monitoring the testing activities of organizations participating in the Testing Mechanism through the following methods:

Collecting documents, information, and data from the following sources: reports and information provided by organizations participating in the Testing Mechanism in accordance with Article 15 of this Decree; documents, information, and data collected through on-site inspections of organizations participating in the Testing Mechanism; information provided by other competent state agencies; information provided by organizations and individuals related to the Testing Mechanism; other information sources requested by the State Bank to serve supervisory purposes.

Evaluating the reasonableness of documents, information, and data; in cases where missing, erroneous, incorrect, or unsuitable documents, information, and data are discovered, requiring organizations participating in the Testing Mechanism to promptly report and submit accurate information.

Summarizing, analyzing collected documents, information, and data, evaluating, and inspecting them.

b) Evaluating the testing activities of organizations participating in the Testing Mechanism and Fintech solutions participating in the Testing Mechanism

Based on the collected documents, information, and data as stipulated in point a of Clause 1 of this Article, the State Bank evaluates the testing activities of organizations participating in the Testing Mechanism and Fintech solutions participating in the Testing Mechanism.

c) Warning and recommending

In case potential risks are identified during the testing process, the State Bank issues a warning and recommendation letter to organizations participating in the Testing Mechanism.

2. The State Bank collaborates with relevant state agencies to conduct on-site inspections of organizations participating in the Testing Mechanism upon management requirements or when additional documentation, information, and data need to be gathered due to risk-related issues.

In case on-site inspection is required, the State Bank requests relevant ministries to assign staff to join the on-site inspection team in writing within five working days from the date of the State Bank's request. Relevant ministries must send the State Bank a document assigning staff to join the on-site inspection team within five working days from the date of the State Bank's request. On-site inspections must be notified to organizations participating in the Testing Mechanism at least three working days before the inspection takes place at their office location.

Article 15. Reporting and Information Provisioning System

1. The State Bank has the right to request organizations participating in the Testing Mechanism to provide information related to the testing process on a regular and ad hoc basis. Based on its assessment of necessity, the State Bank may require participating organizations to develop software and monitoring tools for reporting and providing information.

2. Organizations participating in the Testing Mechanism are responsible for regularly reporting and providing ad hoc information about the testing process, emerging risks, and the results of testing implementation to the State Bank as prescribed. Participating organizations must be responsible for developing software and monitoring tools according to the State Bank's requirements and independently establish corresponding reporting indicators in accordance with the characteristics of the Fintech solutions participating in the Testing Mechanism as stipulated in this Decree.

3. Reports shall be presented in electronic document form. Electronic document reports shall be in the form of electronic data files or transmitted electronically through computer networks or sent via physical carriers, bearing the electronic signature of the authorized representative of the reporting organization in accordance with the designated symbols, transmission codes, and file structure specified by the State Bank. Electronic document reports shall be submitted to the State Bank through one of the following methods:

a) Sending through the email system;

b) Sending through the State Bank’s reporting information system (hereinafter referred to as the reporting information system);

c) Software and monitoring tools developed by participating organizations according to the State Bank's requirements.

4. Participating organizations are responsible for submitting quarterly reports on operational indicators of the Fintech solutions participating in the Testing Mechanism as set out in Appendix IV attached to this Decree through the reporting information system. The quarter-end reporting period runs from the first day of the quarter to the last day of the quarter; the latest submission deadline for the report is the 15th day of the first month of the next quarter.

5. Within 15 days from when half of the testing period specified in the Participation Certificate for the Testing Mechanism or the document approving the extension of the testing period has been implemented, participating organizations are responsible for submitting an initial evaluation report on the deployment results of the Fintech solutions participating in the Testing Mechanism as set out in Appendix V attached to this Decree through the reporting information system.

6. At least 90 days before the end of the testing period, participating organizations are responsible for submitting an evaluation report on the testing results as set out in Appendix V attached to this Decree through the reporting information system. In cases where participating organizations have a need to adjust the testing solution, terminate testing, extend the testing period, or obtain a Completion Testing Certificate, participating organizations must submit an evaluation report on the testing results in accordance with the procedures and formalities for processing applications to adjust the testing solution, terminate testing, extend the testing period, or obtain a Completion Testing Certificate.

7. Upon discovering incidents causing operational disruptions or serious risks, participating organizations must immediately report to the State Bank via the email address [email protected] within 24 hours from the time of risk or incident discovery, including information about the time of risk or incident discovery, a brief description of the risk or incident, and submit a written report according to Appendix VI attached to this Decree within three working days after completing risk management measures or incident resolution through the State Bank’s reporting information system.

8. In cases of changes to the legal representative, General Director (Director), participating organizations that are Fintech companies must submit a written report to the State Bank and provide documentation proving that the legal representative, General Director (Director) meets the conditions for participating in the Testing Mechanism as stipulated in Point b Clause 2 Article 8 for solutions specified in Point a, Point b Clause 2 Article 1 of this Decree, and Clause 2 Article 11 for peer-to-peer lending solutions within 30 days from the date of change.

9. Peer-to-Peer Lending Companies are responsible for reporting customer credit information (including borrowers and lenders) to the National Credit Information Center as decided by the Governor of the State Bank. The National Credit Information Center is permitted to use credit information from peer-to-peer lending solutions in the Testing Mechanism to build a national credit information database, serving the management needs of the State Bank and the business operations and risk management of credit institutions, foreign bank branches, peer-to-peer lending companies, and other organizations as decided by the Governor of the State Bank.

Article 16. Protection of Customers

To protect the rights and legitimate interests of customers during the testing process, organizations participating in the Testing Mechanism shall be responsible for:

1. Issuing and providing to customers guidelines on risk warnings when using Fintech solutions during the testing period.

2. Notifying customers about the use of Fintech solutions currently participating in the testing process; ensuring the provision of accurate, complete, and truthful information regarding the testing solution, service fees, and customer rights and obligations for each type of solution.

3. Ensuring the safety and confidentiality of customer information during and after the use of Fintech testing solutions, except where information is provided upon request of competent state agencies as prescribed by law.

4. Issuing regulations on protecting customer information when storing and transmitting through security mechanisms, encryption, anonymization, and data masking. In cases where the organization collects, uses, or transfers customer information, it must obtain the customer's consent and only transfer information to third parties with the customer's permission or at the request of competent state agencies; technical measures must be taken to confirm the customer's permission to provide information to third parties.

5. Establishing and ensuring compliance with internal procedures and risk control measures that may lead to unauthorized access or use of personal data, fraud, and theft of personal information of customers.

6. Regularly assessing risks and ensuring the implementation of preventive risk measures during the testing process, and promptly notifying customers of any changes in the risk level of Fintech solutions participating in the Testing Mechanism.

7. Establishing mechanisms and setting up points of contact for handling customer complaints. In case of disputes or complaints, organizations participating in the Testing Mechanism shall be responsible for:

a) Receiving and taking measures to address all written inquiries and complaints from customers via call centers, online platforms, or email within five working days from the date of receipt of the inquiry or complaint from the customer;

b) Compensating customers according to agreements and legal provisions.

Article 17. Adjustment of Testing Solutions

1. When there is an adjustment to Fintech solutions participating in the Testing Mechanism, organizations participating in the Testing Mechanism must submit a procedure to request an adjustment of the testing solution and can only implement the adjustment after obtaining the State Bank's approval.

2. Procedure for Handling

The organization submits to the State Bank the Request for Adjustment of Testing Solution Form No. 05 attached as Appendix I to this Decree and the Project describing the testing solution after adjustment.

Within thirty working days from the date of receipt of the Request for Adjustment of Testing Solution, the State Bank will conduct an evaluation of the testing process.

If necessary, the State Bank will send a letter requesting comments from relevant ministries. Within ten working days from the date of receipt of the State Bank's letter, relevant ministries will submit their comments to the State Bank.

If additional explanations or clarifications are required, the State Bank will issue a letter requesting the organization to explain and perfect the dossier. The organization is permitted to submit an explanation and perfect the dossier once. After seven working days from the date the State Bank issues the request for explanation and perfecting the dossier, if the organization does not resubmit the explanation and supplementary dossier, the State Bank will return the dossier to the organization. The time spent on explanations and perfecting the dossier is not included in the processing time.

Based on the Project describing the testing solution after adjustment, actual monitoring conditions, and comments and observations from relevant ministries (if any), the State Bank will decide on the adjustment of the testing solution or reject it in writing and specify the reasons.

Article 18. Termination of Testing Period

The State Bank shall base on the evaluation report of the testing results submitted by participating organizations in the Testing Mechanism, the monitoring and supervisory process, comments and observations from relevant ministries (if any) to develop subsequent handling plans after the termination of the testing period, including: terminating the testing and recovering the Participation Certificate in the Testing Mechanism, extending the testing period, or certifying the completion of the testing.

Article 19. Suspension of Testing and Recovery of Participation Certificate in the Testing Mechanism

1. The State Bank shall consider suspending testing and recovering the Participation Certificate in the Testing Mechanism issued to a participating organization in any of the following cases:

a) Expiration of the testing period specified in the Participation Certificate in the Testing Mechanism or expiration of the extended testing period without further extension as prescribed in Article 20 of this Decree and not falling under the circumstances for issuance of a Completion Certificate as prescribed in Article 21 of this Decree;

b) A participating organization submits a Request for Suspension of Testing to the State Bank according to Form No. 07 attached as Appendix I to this Decree;

c) A participating organization dissolves its business or goes bankrupt as prescribed by law and submits a Request for Suspension of Testing to the State Bank according to Form No. 07 attached as Appendix I to this Decree;

d) Within ninety days from the date of issuance of the Participation Certificate in the Testing Mechanism, the participating organization does not commence testing except in cases of force majeure;

đ) Risks appear during the monitoring and inspection process that, according to the assessment of competent state agencies, are serious, capable of causing significant risks and actual damage to customers or financial market instability; technical incidents that cannot be resolved, violations of relevant laws when there is a final judgment, enforcement decision, administrative penalty decision that has taken effect;

e) After fifteen days from the date the State Bank issues a notification to a participating organization regarding violation of one of the conditions and criteria for participation in the Testing Mechanism as prescribed in Articles 8 and 11 of this Decree and must take corrective measures but fails to do so;

g) A participating organization violates the contents of the Participation Certificate in the Testing Mechanism during the testing process;

h) Peer-to-peer lending companies fail to implement maximum debt management measures for one borrower at the peer-to-peer lending solution.

2. Procedure for Handling

a) In the case prescribed in point a, Clause 1 of this Article, the State Bank decides to suspend testing and recover the Participation Certificate in the Testing Mechanism upon the termination of the testing period;

b) In the case prescribed in point b, Clause 1 of this Article:

The participating organization submits a Request for Suspension of Testing according to Form No. 07 attached as Appendix I to this Decree; a report evaluating the testing results according to Appendix V attached to this Decree; a plan to suspend testing sent to the State Bank.

Within thirty working days, the State Bank conducts a review and evaluation of the entire testing process.

If necessary, the State Bank sends a document to seek comments and suggestions from relevant ministries. Within ten working days from the date of receipt of the State Bank's request, the relevant ministries send their comments and suggestions to the State Bank.

If the file requires explanation and clarification, the State Bank requests the organization to provide explanations and complete the file. The organization registered to participate in the Testing Mechanism is allowed to submit explanations and complete the file once. If within seven working days from the date the State Bank requests explanations and completion of the file, the organization does not return the explanatory and completed file, the State Bank decides to suspend testing and recover the Participation Certificate in the Testing Mechanism.

If the organization submits an explanatory and completed file, based on the monitoring and tracking of the testing process and comments and suggestions from relevant ministries (if any), the State Bank decides to suspend testing and recover the Participation Certificate in the Testing Mechanism. The time for explanation and completion of the file is not included in the processing time.

c) In the case prescribed in point c, Clause 1 of this Article:

Within seven working days from the date of passing the resolution to dissolve the business according to the Law on Enterprises or receiving the bankruptcy declaration decision from the People's Court as prescribed by the law on bankruptcy, the participating organization submits a Request for Suspension of Testing according to Form No. 07 attached as Appendix I to this Decree to the State Bank.

Within ten working days from the date of receipt of the Request for Suspension of Testing from the organization, the State Bank decides to suspend testing and recover the Participation Certificate in the Testing Mechanism;

d) Within seven working days from the date recording the cases prescribed in points d, đ, e, g, h of Clause 1 of this Article, the State Bank sends a notification to the participating organization about suspension of testing. Within fifteen working days from the date of receipt of the State Bank's notification, the participating organization submits an explanation.

If the participating organization does not submit an explanation or the content of the explanation is not reasonable, within five working days, the State Bank decides to suspend testing and recover the Participation Certificate in the Testing Mechanism.

If the participating organization submits an explanation, within thirty working days, the State Bank conducts a review and evaluation of the entire testing process. If necessary, the State Bank sends a document to seek comments and suggestions from relevant ministries. Within ten working days from the date of receipt of the State Bank's request, the relevant ministries send their comments and suggestions.

Based on the monitoring and testing process, as well as comments from relevant ministries (if any), the State Bank decides to terminate the testing and reclaim the Certificate of Participation in the Testing Mechanism or issue a response document to the participating organization regarding the continuation of the testing.

3. Upon receiving the decision to terminate testing from the State Bank, the participating organization shall be responsible for:

a) Immediately implementing the plan to end the testing;

b) Timely notifying customers about the termination of testing at least 30 days before officially withdrawing from the Testing Mechanism in cases specified in points a and b of Clause 1 of this Article; notifying customers about the termination of testing immediately upon receipt of the State Bank's Decision to Terminate Testing in cases specified in points c, d, đ, e, g, and h of Clause 1 of this Article;

c) Ceasing to introduce and provide Fintech solutions for new customers; publicly announcing on the official website of the participating organization the termination of testing;

d) Ensuring customer rights and having a complaint resolution and compensation mechanism for customers in cases where customers suffer losses due to the organization's withdrawal from the Testing Mechanism;

đ) The organization terminating testing of the solution as stipulated in point a and point b of Clause 2 of Article 1 of this Decree shall be responsible for resolving all rights and obligations towards customers and related parties within a maximum period of six months from the date of the State Bank's Decision to Terminate Testing. Peer-to-peer lending companies terminating peer-to-peer lending testing shall continue to resolve all rights and obligations towards customers and related parties after the date of the State Bank's Decision to Terminate Testing.

e) Reporting in writing to the State Bank on the results of resolving customer rights and obligations after ending the testing within five days from the completion of resolving customer rights and obligations.

4. The termination of testing by participating organizations does not imply non-compliance with investment and business conditions under the law at the time of termination. Organizations bear full responsibility for reviewing and complying with current laws governing business operations, investments, and other related laws.

Article 20. Extension of Testing Period

1. At least 90 days before the end of the testing period, the participating organization wishing to extend the testing period shall complete the extension procedure.

2. Procedure for Handling

The participating organization shall submit the Request for Extension of Testing Period Form No. 09 attached as Appendix I to this Decree; report the testing results according to Appendix V attached to this Decree to the State Bank.

Within 45 working days from the date of receipt of the Request for Extension of Testing Period and the evaluation report of the testing results, the State Bank will conduct a comprehensive assessment of the entire testing process.

If necessary, the State Bank will send a document seeking comments from relevant ministries. Within 15 working days from the date of receipt of the State Bank's request, the relevant ministries shall submit their comments to the State Bank.

In case additional explanations or clarifications are required, the State Bank will issue a document requesting the organization to provide explanations and complete the file. The organization is permitted to submit explanations and complete the file once. After seven working days from the date the State Bank requests explanations and file completion, if the organization fails to return the explanation and completed file, the State Bank will return the file to the organization. The time taken for explanations and file completion will not be included in the processing time.

Based on the testing result report (including the usefulness of the solution), actual supervision situation, and comments from relevant ministries (if any), the State Bank will decide to extend the testing period or reject it in writing and specify the reasons.

3. Each extension of the testing period shall not exceed one year and may be extended up to two times.

Article 21. Certification of Completion of Testing

1. The State Bank shall issue a Certificate of Completion of Testing to participating organizations under the Testing Mechanism in the following cases:

a) When the formal legal provisions for Fintech solutions have been completed and become effective, the participating organization under the Testing Mechanism shall be issued a Certificate of Completion of Testing and shall operate in accordance with the applicable laws at the time of completion of testing;

b) When the implementation of the Fintech solution being tested by the participating organization under the Testing Mechanism is assessed as not violating current legal regulations and the Fintech solution is not considered a conditional business activity, the participating organization under the Testing Mechanism shall be issued a Certificate of Completion of Testing and may deploy to the market in compliance with the applicable laws at the time of completion of testing.

2. Procedures for Processing:

Participating organizations under the Testing Mechanism shall submit to the State Bank an Application for Issuance of a Certificate of Completion of Testing according to Form No. 11 attached as Appendix I to this Decree and a report on the results of the testing according to Appendix V attached to this Decree.

Within thirty working days, the State Bank shall conduct a comprehensive evaluation of the entire testing process. If necessary, the State Bank shall send a document seeking comments from relevant ministries. Within ten working days from the date of receipt of the document requested by the State Bank, the relevant ministries shall submit their comments to the State Bank.

Based on the report on the results of the testing (including the usefulness of the solution), actual monitoring conditions, and comments and observations from relevant ministries (if any), the State Bank shall issue a Certificate of Completion of Testing to participating organizations under the Testing Mechanism or issue a document rejecting it and stating the reasons.

3. The Certificate of Completion of Testing for Fintech solutions participating in the testing mechanism is only valid within the scope of this Decree and does not serve as certification of compliance with investment and business conditions for participating organizations.

Chapter IV

RESPONSIBILITIES OF THE PARTIES INVOLVED

Article 22. Responsibilities of Participating Organizations under the Testing Mechanism

1. Shall bear full responsibility under the law for the accuracy, completeness, and truthfulness of the information provided in the application for participation in the Testing Mechanism; shall be responsible for all activities during the operation and deployment of the Fintech solution testing process. Comply fully with the provisions of this Decree, related laws, and the contents of the Certificate of Participation in the Testing Mechanism during the testing period.

2. Shall implement reporting procedures as prescribed in this Decree and as required by competent state authorities.

3. Shall provide complete, transparent, and accurate information to customers and other relevant organizations and individuals regarding the Testing Mechanism. Adhere to legal regulations on advertising and communication.

4. Shall be responsible for providing inaccurate, untruthful, or incomplete information to customers, except where it is proven that all measures prescribed by law have been taken to verify the accuracy, completeness, and truthfulness of the information.

5. Shall proactively self-monitor and regularly assess risks during the testing process, frequently review and detect suspicious signs related to illegal activities, promptly report to competent state authorities. Cooperate closely with the State Bank and other competent state authorities during the testing process when required.

6. Shall establish internal procedures and regulations, including: Procedures for implementation and delegation of authority, responsibilities of individuals and departments in building and operating, deploying testing to ensure traceability and accountability of relevant individuals and departments; Procedures for handling incidents; Regulations on risk management and internal control; Regulations on information storage and customer data security, mechanisms to prevent personal data leaks; Regulations on the responsibilities of participating organizations in resolving disputes between parties related to the provision of Fintech solutions; Regulations on preventing risks, inspecting, and supervising information technology systems and information storage systems, ensuring safe and continuous operation, developing timely response and remediation plans when incidents occur.

7. Shall fulfill responsibilities agreed upon with customers and other relevant organizations and individuals concerning the Testing Mechanism as stipulated in this Decree and related laws.

8. Peer-to-peer lending companies shall also have the following additional responsibilities:

a) Shall take measures to ensure that members of the Board of Directors, Management Board, and company employees are not allowed to participate as customers or guarantors for customer loans; shall not engage in fraudulent, deceptive, or theft of customer assets and related parties;

b) Shall take measures to check, reconcile, update, and verify customer information and data; shall take measures to prevent false, interfering, or altering information and data;

c) Shall provide complete information about contracts, loan details, rights, responsibilities, and legitimate interests of customers and related parties, types of interest rates and fees before customers enter into loan agreements and obtain confirmation from customers that they have been provided with complete information by the peer-to-peer lending company;

d) Contracts concluded between lenders and borrowers, between peer-to-peer lending companies and customers, and related parties must comply with current legal regulations.

d) Implement measures to manage the maximum debt ceiling for one borrower in peer-to-peer lending solutions provided by themselves; exploit information from the National Credit Information Center's database to ensure that at the time when customers (borrowers and lenders) enter into contracts, the borrower does not violate the maximum debt ceiling regulations for one borrower in one and all participating peer-to-peer lending solutions under the Testing Mechanism stipulated in point e, Clause 1, Article 24 of this Decree. In case a peer-to-peer lending company participating in the Testing Mechanism fails to fulfill this responsibility, the State Bank will consider terminating the testing process or not issuing a Certificate of Successful Testing to such a peer-to-peer lending company.

e) Publish information about the peer-to-peer lending company on its official electronic website. The peer-to-peer lending company must have an annual financial report audited independently and published on its official website.

g) Implement the storage of establishment files of the peer-to-peer lending company; internal regulations; business procedures; contracts concluded between the company, customers, and related parties; contracts concluded between borrowers and lenders; customer data and related party information according to the law. Information and data must be stored securely and confidentially; backed up; ensuring the completeness and integrity of information and data to serve inspection, verification, dispute resolution, complaints, and providing information upon request from competent state authorities.

Article 23. Responsibilities of Customers

1. Provide truthful and accurate information as required by organizations participating in the Testing Mechanism.

2. Recognize the risks arising from agreeing to use Fintech solutions undergoing testing and bear responsibility for any risks and losses that may occur during the testing period.

3. Cooperate with organizations participating in the Testing Mechanism in resolving their rights and responsibilities upon completion of the testing period.

4. Customers using peer-to-peer lending solutions shall perform the responsibilities stipulated in Clause 1, Clause 2, and Clause 3 of this Article and also undertake the following additional responsibilities:

a) Borrowers are responsible for providing accurate and complete information about the purpose of borrowing funds, committing to legally and properly use borrowed funds, ensuring the ability to repay both principal and interest as agreed in the loan contract. Borrowers are responsible for ensuring their debt level in one and all participating peer-to-peer lending solutions under the Testing Mechanism complies with the maximum debt levels specified in point e, Clause 1, Article 24 of this Decree. In case of violation, borrowers shall implement measures to reduce debt and are not allowed to borrow new funds through participating peer-to-peer lending solutions until compliance with the maximum debt levels specified in point e, Clause 1, Article 24 of this Decree is ensured.

b) Lenders are responsible for ensuring the legality of the source of funds for lending and not borrowing to lend again.

Ensure that the term of the contract between the borrower and lender in the peer-to-peer lending solution participating in the Testing Mechanism does not exceed two years.

Article 24. Responsibilities for Organizing Implementation

1. The State Bank of Vietnam

a) Based on receiving complete registration files from organizations wishing to participate in the Testing Mechanism, the State Bank shall take the lead and coordinate with relevant ministries to review the registration files for participation in the Testing Mechanism; assess compliance with criteria and conditions stipulated in this Decree to issue a Certificate of Participation in the Testing Mechanism for each specific case;

b) Receive and process adjustments to testing solutions, suspension of testing, and recovery of Certificates of Participation in the Testing Mechanism; extend testing periods, and issue Certificates of Completion of Testing;

c) Monitor implementation, provide guidance, and resolve issues during the testing period; warn when risks are detected for organizations participating in the Testing Mechanism;

d) Publicize the following information on the State Bank's electronic portal: the number of registration files for participation in the Testing Mechanism for each solution under consideration and review; the number of organizations participating in the Testing Mechanism; information on participating organizations including: name of the participating organization, Fintech solution participating in the Testing Mechanism, testing time, space, and scope; list of organizations granted Certificates of Completion of Testing; list of organizations whose testing has been suspended and Certificates of Participation in the Testing Mechanism revoked;

e) Take the lead in implementing inspections and supervision of the testing process of organizations participating in the Testing Mechanism;

f) The Governor of the State Bank decides the maximum loan amount for one borrower at one and all peer-to-peer lending solutions participating in the Testing Mechanism;

g) Guide peer-to-peer lending companies to connect, report, and verify customer credit information with the National Credit Information Center;

h) Annually compile and report to the Prime Minister on the results of implementing this Decree and propose policies for appropriate management in the next phase;

2. The Ministry of Science and Technology

a) Provide comments on registration files for Certificates of Participation in the Testing Mechanism as prescribed in Clause 3, Article 10 and Clause 3, Article 13 of this Decree, assessing compliance with technical standards and norms, and electronic transaction regulations for Fintech solutions participating in the Testing Mechanism;

b) Other responsibilities as stipulated in Clause 4 of this Article.

3. Ministry of Public Security

a) Provide comments on registration files for Certificates of Participation in the Testing Mechanism as prescribed in Clause 3, Article 10 and Clause 3, Article 13 of this Decree, assessing compliance with regulations on ensuring cybersecurity and system security levels for information systems used in Fintech solutions participating in the Testing Mechanism;

b) Other responsibilities as stipulated in Clause 4 of this Article.

4. Ministries and agencies within their functions and tasks shall be responsible for coordinating with the State Bank in the following areas:

a) Provide comments on compliance with conditions and criteria for registration files for participation in the Testing Mechanism; issuance of Certificates of Participation in the Testing Mechanism, Certificates of Completion of Testing, decisions to adjust testing solutions, suspend testing, and recover Certificates of Participation in the Testing Mechanism, decisions to extend testing periods; cooperate in on-site inspections during the review of registration files for Certificates of Participation in the Testing Mechanism upon request by the State Bank;

b) Inspect, manage, supervise, and guide resolution of issues during the testing period;

c) Summarize, evaluate results, and propose appropriate policies.

Chapter V

IMPLEMENTING PROVISIONS

Article 25. Effective Date

This Decree takes effect from July 1, 2025.

Article 26. Responsibility for Implementation

Ministers, Heads of ministerial-level agencies, Heads of agencies under the Government, Chairpersons of provincial People's Committees under the central city, related organizations, and individuals are responsible for enforcing this Decree.