VIETNAM OPENS FINTECH SANDBOX: KEY REQUIREMENTS FOR ELIGIBLE COMPANIES
Admin - 20/05/2025

Than Trong Ly - Partner

Nguyen Thi My Linh - Junior Associate

 

On 29 April 2025, the Government of Vietnam officially promulgated Decree No. 94/2025/ND-CP (“Decree 94”), the first legal instrument establishing a controlled regulatory sandbox mechanism (“Sandbox”) in the banking sector, which takes effect from 01 July 2025. This Decree establishes a crucial legal framework for Fintech operations, allowing financial technology companies (“Fintech Companies”) to pilot new products and services not yet specifically regulated under the existing legal system, under the close supervision of the State Bank of Vietnam (“SBV”) to mitigate risks to the financial system and users. This article outlines the legal conditions, application requirements and key notes for Fintech Companies considering participation in the Sandbox pursuant to Decree 94.

 

Conditions, application dossier and procedure for Fintech Companies to participate in the Sandbox

 

No.

Content

Credit Scoring / Open API Data Sharing

 

Peer-to-Peer Lending (“P2P Lending”)

1.

Conditions for the Fintech Companies[1]

 

  1. Legally established and operating in Vietnam;

 

  1. Not undergoing division, separation, merger, consolidation, conversion, dissolution or bankruptcy as prescribed by laws;

 

  1. Conditions for the Legal Representative and General Director (or Director):

 

  • Must hold a university degree or higher in economics, business administration, law or information technology; and

 

  • Must have at least 2 years of managerial experience in financial or banking organizations, and must not fall under disqualified persons as prescribed by laws.

 

 

In respect of P2P Lending, Fintech Companies shall additionally be required to satisfy the following specific conditions:

 

  1. Must not be a foreign-invested enterprise;

 

  1. Additional conditions applicable to the Legal Representative and the General Director (or Director):

 

  • Must be a Vietnamese national;

 

  • Must have no criminal record or administrative sanctions in finance, banking, or cybersecurity fields;

 

  • Must not concurrently be an owner or manager of financial service, banking, pawn or multi-level marketing businesses (MLM);

 

  • Must not be the owner of informal rotating credit groups such as “hụi”, “họ”, “biêu”, or “phường”, nor hold positions as a member of the Board of Directors, Members’ Council, Supervisory Board, General Director (or Director), Deputy General Director (or Deputy Director), or equivalent titles in any credit institution, foreign bank branch or payment intermediary service provider;

 

  • Must meet the required standards on personnel, infrastructure, and technology systems for the digital platform used to implement the P2P Lending solution.

 

2.

Conditions for the Fintech Solution[2]

 

  1. Address technical or operational matters not yet specifically regulated under the current legal framework;

 

  1. Demonstrate innovation and the potential to generate benefits and added value for users, particularly through solutions that promote financial inclusion;

 

  1. Establish a risk management framework, including measures for risk mitigation, resolution, and consumer protection;

 

  1. Undergo a comprehensive internal review and assessment by the applicant organization in terms of operations, functionality, utility, and effectiveness; and

 

  1. Demonstrate feasibility for market deployment.

 

 

In the case of P2P Lending activities, the following additional conditions must be satisfied:

 

  1. Must include measures to manage the maximum outstanding loan amount per borrower;

 

  1. Disbursement, repayment of principal, interest, and fees must be conducted via customers’ bank accounts or e-wallets;

 

  1. Must be in place to ensure that the term of the loan agreement between the borrower and the lender using the P2P Lending solution does not exceed 02 years.

 

3. 

Application dossier[3]

 

  1. Application for the Certificate of Participation in the Sandbox (the “Certificate”), using Form No. 02 or Form No. 03 of Appendix I Decree 94;

 

  1. Documentation describing the organizational structure and governance for implementation;

 

  1. Approval letter issued by a competent authority for the Fintech solution proposal;

 

  1. Detailed Fintech solution proposal;

 

  1. Testing plan;

 

  1. Personnel dossier; and

 

  1. Certified copies of documents relating to the incorporation and business operation of the enterprise.

 

4. 

Application procedure [4]

  1. Submit 02 sets of application dossiers and 06 CDs (or 06 USBs) to the SBV;

 

  1. Within 05 working days from the date of receipt, SBV shall issue a written confirmation of complete submission or request for additional documents, if necessary;

 

  1. Within 90 working days, SBV shall coordinate with relevant ministries to appraise the application, including on-site inspection if required, and either issue the Certificate or provide a written refusal; and

 

  1. Within 90 days from the date of issuance of the Certificate by SBV, the enterprise shall commence implementation of the solution.

 

Testing duration, scope and geographical limitations[5]

 

The duration of participation in the Sandbox shall be determined by the SBV based on the nature of each specific solution and sector, but shall not exceed 02 years from the issuance date of the Certificate, unless extended in accordance with applicable regulations. The testing period must not exceed the remaining validity of the Establishment License or Enterprise Registration Certificate of the enterprise. Accordingly, Fintech Companies must ensure they retain valid legal operating status for at least the duration of the proposed testing period to avoid rejection of the application or interruption during implementation. Furthermore, Fintech Companies may only implement their Sandbox solutions within the territory of Vietnam. Cross-border testing is not permitted and the solutions may only be offered within the scope specified in the Certificate.

 

Fintech Companies engaged in P2P Lending are subject to certain additional restrictions aimed at mitigating systemic financial risks. In particular, they are prohibited from (i) providing guarantees or security for customer loans; and (ii) acting as borrowers or providing P2P Lending platforms to pawnshop businesses.

 

Reporting obligations and information disclosure [6]:

 

STT

Report/Event

Deadline

Submission Method

Note

1. 

Quarterly periodic report on the operational indicators of the solution

No later than the 15th day of the first month of the subsequent quarter

The reporting information system of the SBV

Using the template provided in Appendix IV Decree 94. The quarterly reporting period shall be calculated from the 1st day of the first month to the last day of the final month of the quarter.

2. 

Interim evaluation report during the testing period

Within 15 days from the date on which half of the testing period has been completed

 

Using the template provided in Appendix IV Decree 94

3. 

Final evaluation report on the testing results

 

At least 90 days prior to the end of the testing period

 

For the purposes of extension, termination, modification, or application for the Certificate of Completion of the testing phase

 

4.

Ad-hoc report in the event of significant risks or incidents

  1. Submit an email within 24 hours from the time of detection; and

 

  1. Submit a written report within 03 working days after the incident has been resolved

 

Email: tt@sbv.gov.vn

 

 

 

The reporting information system of the SBV

 

 

 

 

 

Using the template provided in Appendix VI Decree 94

5.

Change of Legal Representative or General Director (or Director)

Within 30 days from the effective date of the change

By written submission, accompanied by supporting documents evidencing compliance with the conditions set forth in Decree 94

 

 

6.

Customer credit information report (applicable to P2P Lending)

As decided by the Governor of the SBV

Vietnam National Credit Information Center (CIC)

 

 

Suspension and termination of the testing phase[7]

 

The SBV shall have the authority to consider the suspension of the testing phase and revoke the Certificate if deemed necessary under circumstances specified in Article 19 Decree 94. Fintech Companies are required to prepare an exit strategy from the outset, as set out in the application dossier, to ensure that, upon being requested to cease participation, they can fully discharge all obligations to customers and relevant parties. Immediately upon receiving the SBV’s decision on the suspension, the Fintech Companies must cease marketing and offering its Fintech solution to new customers and publicly announce the termination of the testing phase on its official website.

 

Data privacy and information security[8]

 

Throughout the Sandbox period, Fintech Companies shall be responsible for ensuring the security and confidentiality of customer information during and after the use of their Fintech solutions. This includes the establishment of internal regulations on data protection during storage and transmission (such as encryption, anonymization and consent-based third-party sharing), prevention of unauthorized access, fraud, or theft of personal data, as well as conducting periodic risk assessments and promptly notifying customers in the event of any change in the level of risk. Any collection, use or transfer of customer information must be based on the customer’s consent or pursuant to a request from a competent authority.

 

Conclusion

 

Decree No. 94/2025/ND-CP marks a significant milestone in establishing a regulatory framework for the pilot implementation of Fintech activities in Vietnam. It creates a legal basis for pioneering Fintech Companies to deploy new service models in a lawful and controlled environment. However, to effectively seize this opportunity, Fintech Companies must proactively study the provisions of Decree 94 and the relevant guidelines issued by the SBV, develop appropriate technological solutions, prepare comprehensive application dossiers and ensure their operational capacity throughout the entire testing period.

 

Here is our advice on Vietnam opens Fintech Sandbox: Key requirements for eligible companies. If you are interested or need legal advice regarding these requirements, do not hesitate to contact us for timely and in-depth support. Please visit our DIMAC Website and other News Category to get the latest updates on legal advice and market experience sharing.

 


[1] Article 8.2 và 11.2 Decree 94

[2] Article 8.1, Article 11.1 Decree 94

[3] Article 9, Article 12 Decree 94

[4] Article 10, Article 13 Decree 94

[5] Article 6.1 Decree 94

[6] Article 15 Decree 94

[7] Article 19 Decree 94

[8] Article 16 Decree 94

Copyright@2018 DIMAC. All Rights Reserved

Follow us

facebook.comLinkedintwitter.comyoutube.com