Circular No. 50/2024/TT-NHNN dated October 31, 2024 on providing for security and confidentiality during provision of online banking services

THE STATE BANK OF VIETNAM --------	THE SOCIALIST REPUBLIC OF VIETNAM Independence - Freedom - Happiness ---------------
No. 50/2024/TT-NHNN	Hanoi, October 31, 2024

CIRCULAR

PROVIDING FOR SECURITY AND CONFIDENTIALITY DURING PROVISION OF ONLINE BANKING SERVICES

Pursuant to the Law on the State Bank of Vietnam dated June 16, 2010;

Pursuant to the Law on Cyberinformation Security dated November 19, 2015;

Pursuant to the Law on Cybersecurity dated June 12, 2018;

Pursuant to the Law on E-Transactions dated June 22, 2023;

Pursuant to the Law on Credit Institutions dated January 18, 2024;

Pursuant to the Government’s Decree No. 102/2022/ND-CP dated December 12, 2022 defining the functions, tasks, powers and organizational structure of the State Bank of Vietnam;

At the proposal of the Director General of the Information Technology Department;

The Governor of the State Bank of Vietnam hereby promulgates a Circular providing for security and confidentiality during provision of online banking services.

Chapter I

GENERAL PROVISIONS

Article 1. Scope and regulated entities

1. Scope

This Circular provides for requirements for ensuring security and confidentiality during provision of online banking services, including:

a) Banking activities and other business activities of credit institutions and foreign bank branches;

b) Provision of intermediary payment services;

c) Credit information activities.

2. Regulated entities

This Circular applies to credit institutions, foreign bank branches and intermediary payment service providers and credit information companies (below collectively referred to as “units”).

Article 2. Definitions and terms

For the purposes of this Circular, the terms below shall be construed as follows:

1. “online services in the banking sector” (hereinafter referred to as “online banking services”) include the services specified in clause 1 Article 1 of this Circular provided online by units to clients to conduct electronic transactions (hereinafter referred to as “transactions”), excluding direct transactions at units accepting payment via point-of-sale terminals or via Quick Response Code (QR Code) displayed by clients.

2. “online banking system” means a structured combination of hardware, software, databases, communication and network system, and security and confidentiality system used to produce, transmit, collect, process, store and exchange digital information serving the management and provision of online banking services, which is established, administered and operated by a unit or a hired third party.

3. “online banking application software” means application software providing online banking services.

4. “mobile banking application software” means online banking application software installed on mobile devices.

5. “online payment transaction” means a transaction conducted by electronic means via online banking system.

6. “client” may be an organization or individual using online banking services.

7. “Straight-Through Processing” means a method of automatic two-way exchange of information, data and documents through a secure connection between the client’s information system and the online banking system.

8. “electronic transaction authentication” (hereinafter referred to as “transaction authentication”) means a form of authentication by electronic means to express the client’s acceptance of data messages in an electronic transaction.

9. “end-to-end encryption” means a mechanism by which information is securely encrypted at the original point before being sent and is decrypted only after being received at the destination point in the process of information exchange between applications or devices in a system in order to limit the risk of information exposure or leakage on transmission lines.

10. “database management system” means software designed for management, storage, retrieval and execution of queries on data within a database.

Article 3. General principles of ensuring security and confidentiality of the information system during provision of online banking services

1. Online banking systems must comply with regulations on ensuring information system security at level 3 or higher in accordance with regulations of law on assurance of information system security by levels; for information systems providing switching services and electronic clearing services, they must comply with regulations on assurance of information system security at level 4 or higher; comply with TCVN 11930:2017 (Information technology - Security techniques - Basic requirements for securing information according to security levels) and regulations of the State Bank of Vietnam (hereinafter referred to as “SBV”) on information system security in banking operations.

2. Confidentiality and integrity of client information must be ensured; availability of the online banking system must be ensured to provide services in an uninterrupted manner.

3. Client's transactions must be classified and assessed in terms of their minimum risk level by groups of clients, their behaviors, transaction type, transaction limit (if any) and compliance with relevant laws. On that basis, the unit shall provide appropriate forms of transaction authentication to the clients for their choice by way of complying with at least the following regulations:

a) Applying at least one of the authentication forms specified in clauses 3 through 9 Article 11 of this Circular upon changing the client's identification information;

b) Applying at least one or combination of transaction authentication forms according to this Circular. In case a legislative document providing guidance on the services specified in clause 1 Article 1 of this Circular stipulates the form of transaction authentication, such legislative document shall be complied with;

c) For multi-step transactions, transaction authentication is required for the final step of approval.

4. The online banking system must have its security and confidentially inspected and assessed on an annual basis.

5. Risks, possibility of occurrence and causes of risks must be regularly identified to promptly adopt measures to prevent, control and manage risks during provision of online banking services.

6. Information technology (IT) infrastructure and equipment for provision of online banking services must be protected by copyright and of clear origin. For equipment which is about to reach the end of its life cycle and is no longer supported by manufacturers, the unit shall plan to upgrade or replace it as notified by the manufacturers, ensuring that equipment is able to be come with a new software version. Pending the upgradation or replacement, the unit must take measures to enhance the security and confidentiality of the online banking system.

7. Regarding systems providing electronic payment gateway services, payments- and collections-on-behalf-of services, the regulations set out in clauses 7, 9 and 10 Article 7 and Section 2 Chapter II of this Circular are not required to be complied with.

8. Every online banking systems may operate and provide services to clients only when its security and confidentiality are ensured in accordance with this Circular and relevant regulations of law.

Chapter II

SPECIFIC PROVISIONS

Section 1. TECHNICAL INFRASTRUCTURE OF THE ONLINE BANKING SYSTEM

Article 4. Network, communication, security and confidentiality systems

Each unit shall establish network, communication, security and confidentiality systems that satisfy the following minimum requirements:

1. Security and confidentiality solutions should be in place, containing at least:

a) Application firewall or equivalent protection solutions;

b) Database firewall or equivalent protection solutions;

c) Solutions for prevention against denial-of-service attacks (DoS), distributed denial of service attack (DDoS) for systems directly providing services on the Internet;

d) Information security event management and analysis system.

2. Client information (client identification information, clients’ transaction information) must not be stored in the Internet connection zone and demilitarized zone (DMZ).

3. Policies should be in place to minimize services and gateways connected to the online banking system.

4. Any inbound connection to the online banking system for administration is permitted only when it is impossible to establish connection from the internal network and ensure safety and the following regulations shall be complied with:

a) The connection is approved by a competent authority after considering its purpose and method;

b) There must be a secure remote access management and system administration plan such as using a virtual private network or equivalent solution;

c) Connecting devices must come with software that ensures security and confidentiality;

d) At least two of the authentication forms specified in clauses 1, 3, 4, 7, 8 and 9 Article 11 of this Circular are applied when logging in the system;

dd) Securely encrypted communication protocols must be used and passwords must be not saved in utility software.

5. The high availability and uninterrupted service provision of network connection lines for service provision must be ensured.

Article 5. Server system and system software

1. Requirements for a server:

a) Its monthly average usage, including a central processing unit (CPU), internal memory (RAM), data storage devices, devices for retrieving data upon data storage or transmission, is up to 80% of its design capacity;

b) The online banking system must have a backup server that ensures high availability;

c) It is logically or physically separated from other servers serving professional operations;

d) It must be checked, the operating system must be hardened, and patches must be updated regularly.

2. Each unit shall make a list of software permitted to be installed in servers, and ensure that such list is updated and inspected at least once every 06 months and strictly complied with.

Article 6. Database management system

1. The database management system must have security and access management mechanism in order to protect the data therein.

2. The online banking system must have a backup database for disaster discovery which is able to replace the main database and ensure the completeness and integrity of clients’ transaction data.

3. The database management system must be checked and hardened, and patches must be updated regularly.

4. Units must take measures to supervise and log access to the database and manipulations upon access to the database.

Article 7. Online banking application software

1. Security and confidentiality requirements must be determined before developing software, and satisfied in the process of development (analysis, design, development, testing), official operation and maintenance of the software. Documents on software security and confidentiality must be systemized, stored and synchronously updated upon changes to the system, and strictly controlled through limited access.

2. Every unit shall control software source codes in accordance with at least the following requirements:

a) For software source codes developed by the unit itself:

(i) On a periodic basis or when there is any change in the application software, the unit must check source codes to remove malicious codes and security vulnerabilities. The personnel performing the check must be independent of the personnel developing the software source codes;

(ii) Appoint specific individuals responsible for managing source codes of online banking application software;

(iii) Source codes must be kept safely in at least two geographically separate locations, and measures must be in place to protect their integrity.

b) For outsourced software source codes:

(i) The unit must request the supplier to sign a commitment that the software source code is legitimate and genuine; commit to implementing agreements on editing the source code upon software warranty and maintenance;

(ii) In case of source code handover, before the handover, the unit shall request the supplier to check, handle and fix security vulnerabilities in the source code. After the source code is handed over, the unit shall comply with the provisions set forth under point a of this clause;

(iii) In case the unit is not handed the source code, when signing the handover record, it must request the supplier to scan and remove malicious codes and sign a commitment that the application software does not contain malicious codes.

3. Online banking application software must be inspected and tested before official operation, satisfying at least the following requirements:

a) Prepare and approve plans and scenarios for testing online banking application software, explicitly stating safety and confidentiality conditions to be satisfied;

b) Detect and eliminate errors and frauds that may occur when inputting data;

c) Assess and scan to detect technical vulnerabilities and weaknesses. Assess the capacity for prevention of attacks, including but not limited to Injection (SQL, Xpath, LDAP), Cross-site Scripting (XSS), Cross-site Request Forgery (XSRF), Server-Side Request Forgery (SSRS), Brute-Force, and such confidentiality-related errors as access control errors; identification and authentication errors; encryption errors; design errors, insecure configurations; logging and security monitoring errors;

d) Record errors and process of fixing errors, especially security and confidentiality-related errors, in the software inspection and testing reports;

dd) Inspect and test security and confidentiality features on popular browsers (for online banking application software provided via website platform) and operating system software of mobile devices (for Mobile Banking application software); provide mechanisms for checking and immediate notification to clients when running applications on browsers or mobile device’s operating system software versions which have undergone safety inspection and testing.

4. Before deploying new online banking application software, a unit shall assess the risks of the deployment process to related professional operations and IT systems, and prepare and implement plans to minimize these risks.

5. Each unit shall manage changes of online banking application software versions according to following requirements:

a) Documents on the analysis of the impacts of the change of application software on the existing system and other related systems of the unit must be formulated and approved by the competent authority before implementation;

b) Software versions, including also source codes developed by the unit itself or handed over by the supplier, must be managed in a centralized manner, stored and kept confidential and a mechanism must be in place to grant privilege to each member and record logs during manipulation of files;

c) Information on versions (update time, persons updating such versions, instructions for updating and other relevant information on such versions) must be stored;

d) The upgradation of versions must rely on testing results and be approved by competent authorities.

6. Compulsory functions of online banking application software:

a) Applying end-to-end encryption to all data transmitted online or data exchanged between online banking application software and related equipment;

b) Ensuring the integrity of transaction data; promptly detecting, warning, and preventing all unauthorized modifications, or adopting appropriate measures to handle such unauthorized modifications to ensure the accuracy of transaction data in the process of transaction processing and data storage;

c) Controlling transaction sessions: The system must automatically apply session timeout in a case where a user has been inactive for a certain period of time prescribed by the unit or apply other protective measures;

d) Having the function of hiding passwords or PINs used to log in the system;

dd) Having the function of disabling automatic login;

e) Where the e-transaction account prescribed in clause 1 Article 9 of this Circular uses a PIN or password as a form of authentication, the online banking application software must have functions to control the PIN and password;

(i) Requesting the client to change the PIN or password in case the client is granted a default PIN or password for the first time;

(ii) Notifying the client when the PIN or password is about to expire;

(iii) Invalidating the PIN or password when it expires; requesting the client to change the expired PIN or password when the client uses the PIN or password to log in;

(iv) Invalidating the PIN or password in case the PIN or password is entered incorrectly repeatedly more than a certain number of times specified by the unit (but not more than 10 times) and notifying the client;

(v) The unit shall only regrant the PIN or password at the client’s request and must verify and identify the client before the regrant to prevent fraud and forgery.

g) With regard to a client being an organization, the application software shall be designed in a manner to ensure that every online payment transaction is conducted in two steps as follows: creation and approval of the transaction. For a client being a business household or micro-enterprise applying a simple accounting regime, the transaction is not required to be conducted by separating the two aforesaid steps;

h) Having the function of notifying the first login to the online banking application software or the login to the online banking application software on a device different from the one last used to log in the online banking application software via SMS or other channels registered by the client (phone, email, etc.), except where an institutional client: logs in on devices that have been used for registration for use of services; or logs in using at least one of the authentication forms specified in clauses 3, 4, 5, 7, 8, and 9 Article 11 of this Circular.

7. Online banking application software must have the function of online storage of information about the devices that perform clients’ transactions, transaction logs, transaction authentication logs for at least 03 months and backup for at least 01 year, including:

a) Device identification information:

(i) For mobile devices: unique identifiers (e.g., IMEI or Serial number or WLAN MAC or Android ID or other identification information);

(ii) For computers: unique identifiers (such as the MAC address or a combination of computer-related information that can uniquely identify a computer).

b) Transaction logs, including at least transaction code, client name, transaction initiation time, transaction type, transaction value (if any);

c) Transaction authentication logs, including at least transaction authentication form and transaction authentication time. In case of biometric authentication, the unit shall store the client's biometric information when performing the transaction for at least the 10 most recent transactions of that client.

8. Requirements for straight-through processing (STP):

a) The unit shall only provide online banking services by STP method for institutional clients. The unit is shall select, appraise, supervise, manage and reach an agreement with the clients when providing online banking services by STP method;

b) Online banking application software must have the function of authenticating the connection with the institutional client’s software to prevent fraud and forgery;

c) The application of the regulations in points c, dd, e, g, and h clause 6 and point a clause 7 of this Article is optional.

9. Card issuers providing online payment services using bank cards must have online banking application software which has at least the following features:

a) Permitting or not permitting online payment;

b) Setting limits on daily online payment using bank cards;

c) Permitting or not permitting overseas payments at point-of-sale terminals and automated teller machines;

d) Permitting clients to register to choose between proactively confirming or agreeing to let the card issuer confirm all or part of online payment transactions using bank cards (online card payment transactions) in case of applying the authentication form as prescribed in clause 10 Article 11 of this Circular.

10. Online banking application software must have the function of notifying clients of transactions occurring via SMS or email or mobile banking application software or other communication channels registered by clients.

Article 8. Mobile banking application software

Mobile banking application software provided by each unit must comply with Article 7 of this Circular and the following requirements:

1. The software must be registered and managed on the official application store of the mobile operating system provider and explicit installation instructions must be available on the unit's website so as for clients to download and install the mobile banking application software. In case the mobile banking application software is not registered and managed on the official application store of the mobile operating system provider for objective reasons, the unit must adopt a method of providing instructions for, notifying, supporting the installation of the mobile banking application software to ensure security and confidentiality for clients and report to SBV (the Information Technology Department) before providing the service.

2. Protective measures must be taken to minimize the reverse engineering of the source code.

3. Measures shall be in place to prevent interference in the data exchange flow on the mobile banking application and between the mobile banking application and the server providing online banking services.

4. Solutions must be adopted to prevent, combat and detect unauthorized interference in the mobile banking application installed on clients’ mobile devices.

5. The password-saving feature is not permitted.

6. For individual clients, there must be a function of verifying a client when they first log in or when they log in on a device different from the one last used to log in the online banking application software. The client verification includes at least the following:

a) The match with SMS OTP or Voice OTP via the client's registered phone number or Soft OTP/Token OTP;

b) The match with biometric information as prescribed in clause 5 Article 11 of this Circular in case the specialized legal document related to the service provided on the mobile banking application software stipulates the collection and storage of clients' biometric information.

Section 2. AUTHENTICATION OF ELECTRONIC TRANSACTIONS VIA ONLINE BANKING SYSTEM

Article 9. Access to online banking application software

1. Every registered user of online banking application software must be identified by the unit and granted an e-transaction account. The e-transaction account comprises username and at least one of the forms of authentication specified in clauses 1 to 9 of Article 11 of this Circular.

2. Each client shall access online banking application software by using their e-transaction account issued by the unit or using Single Sign-On method through the e-transaction account of another information system that has been integrated by the unit registered by the client.

Article 10. Transaction authentication

1. For online payment transactions:

a) For payment transactions using checking accounts or e-wallets or money transfers from debit cards or identified prepaid cards, the unit shall classify transactions by their type specified in the Appendix 01 to this Circular and apply the authentication form specified in the Appendix 02 to this Circular, except for the regulations set out under points b, c, d and dd of this clause;

b) For payment transactions conducted using STP method, the unit shall confirm the transactions using at least one of the authentication forms specified in clauses 7, 8, and 9 Article 11 of this Circular;

c) For online card payment transactions (excluding money transfer transactions), the unit shall classify transactions according to the transaction type groups specified in Appendix 03 to this Circular and apply the authentication forms specified in the Appendix 04 to this Circular;

d) For transactions in which the unit automatically debits checking accounts, automatically debits e-wallets or automatically makes payments from the clients’ cards as agreed upon with clients, the transaction authentication specified in points a and c clause 1 of this Article is not required;

dd) For online payment transactions on the National Public Service Portal and payments to the state budget, the transaction authentication specified in points a and c clause 1 of this Article is not required.

2. For services registered for automatic payments from checking accounts, e-wallets and cards of clients, the unit must apply at least one of the authentication forms specified in clauses 3 to 9 Article 11 of this Circular.

3. For other transactions, in addition to the transactions specified in clauses 1 and 2 of this Article, the unit shall, by way of risk assessment and compliance with relevant laws, select an appropriate form of authentication prescribed in Article 11 of this Circular to provide it to registered users and shall be responsible for its selection.

4. Where a client is a person with disability, the unit shall, based on its conditions and supply capacity, provide appropriate forms of authentication and instruct them in their selection. It is not required to apply the regulations in clauses 1, 2, and 3 of this Article but is required to ensure that the check is carried out and the client's consent is confirmed when conducting any transaction in accordance with the law on e-transactions and this Circular.

Article 11. Authentication forms

1. Password-based authentication: A client uses a password which is a string of characters used to confirm their access to an information system, application or service or to confirm their transactions. The authentication by password must meet the following requirements:

a) A password must have at least 08 characters and contain at least the following: numbers, uppercase letters, lowercase letters;

b) The maximum validity period of the password is 12 months. For the default password, the maximum validity period is 30 days.

2. PIN (Personal Identification Number) authentication: It refers to a form of authentication based on a password which is created from a string of digits. PIN authentication (except for PINs attached to physical cards) must meet the following requirements:

a) A PIN must be at least 06 characters long;

b) The maximum validity period of the PIN is 12 months. For the default PIN, the maximum validity period is 30 days.

3. One Time Password (OTP) authentication: It is a form of authentication based on a password which can only be used once and is valid for a certain period of time, including the following forms:

a) SMS OTP is a form of authentication based on an OTP sent via short message services (SMS) or messages via basic telecommunications services on the Internet. An SMS OTP must meet the following requirements:

(i) The OTP sent to a client must be attached with a notification so as for them to understand its purposes;

(ii) The OTP must be valid for up to 05 minutes.

b) Voice OTP is a form of authentication based on an OTP sent via a voice call or call via basic telecommunications services on the Internet. Voice OTP must meet the following requirements:

(i) The OTP sent to a client must be attached with a notification so as for them to understand its purposes;

(ii) The OTP must be valid for up to 03 minutes.

c) Email OTP is a form of authentication based on an OTP sent via email. An email OTP must meet the following requirements:

(i) The OTP sent to a client must be attached with a notification so as for them to understand its purposes;

(ii) The OTP must be valid for up to 05 minutes.

d) OTP matrix card is a form of OTP authentication determined from a 2-dimensional table (rows, columns) in which every row or column corresponds to an OTP. An OTP matrix card must meet the following requirements:

(i) The OTP matrix card must be valid for up to 01 year from the date of registration;

(ii) The OTP must be valid for up to 02 minutes.

dd) Soft OTP is a form of authentication based on an OTP generated by software installed on the client's mobile device. Soft OTP software may be standalone software or integrated with mobile banking application software.

Soft OTP is classified into 02 types: (i) Basic Soft OTP: The OTP is randomly generated over time and synchronized with the online banking system; (ii) Advanced Soft OTP: The OTP is generated in combination with the code of each transaction. Upon conducting a transaction, the online banking system generates a transaction code to notify the client or transmit it to the Soft OTP software. The client or the Soft OTP software automatically enters the transaction code in the Soft OTP software in order for the latter to generate an OTP.

A Soft OTP must meet the following requirements:

(i) In case the Soft OTP software is independent from the mobile banking application software, it must be registered and managed by the unit on the official application store of the mobile operating system provider and explicit installation instructions must be available on the unit's website so as for clients to download and install the Soft OTP software;

(ii) The Soft OTP software must require activation before use. The Soft OTP activation code shall be provided by the unit to clients and can only be used for activation on a single mobile device. The activation code must have an expiration date;

(iii) The Soft OTP software must have an access control function. If the Soft OTP attempt limit (but not more than 10 attempts) is exceeded, access to the Soft OTP software will be automatically blocked. The unit shall unlock the Soft OTP software only when the client so requests and identify the client before unlocking in order to prevent fraud and forgery.

(iv) In case the soft OTP software is independent of the mobile banking application software, it must have the function of verifying individual clients before permitting them to use it for the first time or before they use it on a device different from the device last used. The verification shall include at least the following: (i) the match with SMS OTP or voice OTP via the phone number registered by the client, (ii) and match with the client's biometric information;

(v) The OTP must be valid for up to 02 minutes.

e) OTP Token is a form of authentication based on an OTP generated by a specialized device. OTP Token is classified into 02 types: (i) Basic OTP Token: The OTP is randomly generated over time and synchronized with the online banking system; (ii) Advanced OTP Token: The OTP is generated in combination with the code of each transaction. When performing a transaction, the online banking system generates a transaction code to notify the client, the client enters the transaction code in the OTP Token so that the device can generate an OTP. The OTP Token must be valid for up to 02 minutes.

4. Two-channel authentication: It refers to an authentication form whereby a client conducts a transaction, the online banking system sends a request for transaction authentication to the client's mobile device via a voice call or call via basic telecommunications service on the Internet or via USSD (Unstructured Supplementary Service Data) message code or via specialized software and the client shall respond directly through the connected channel to confirm whether the transaction is conducted. The authentication request required by this form must be valid for up to 05 minutes.

5. Biometric authentication: It is the process of making comparison to ensure that the biometric information of the client conducting a transaction matches their biometric information collected and stored at the unit as per the regulations imposed by SBV's Governor. Biometric authentication must meet the following minimum requirements:

a) In case of applying the face matching method:

(i) Its accuracy shall be determined according to international standards (or equivalent) as follows: The false reject rate and false accept rate shall meet the requirement of < 5% and < 0.01% respectively according to the FIDO Biometric Requirements (applicable to a set of at least 10,000 samples);

(ii) It has the ability to detect biometric spoofing attacks of live objects (Presentation Attack Detection - PAD) according to international standards (such as NIST Special Publication 800-63B Digital Identity Guidelines: Authentication and Lifecycle Management or ISO 30107 - Biometric presentation attack detection or FIDO Biometric Requirements) to prevent fraud and spoofing through images, videos and 3D masks.

b) In case of applying other methods of biometric information matching, it is required to ensure prevention of spoofing and fraud according to equivalent standards;

c) The Presentation Attack Detection - PAD prescribed in point a of this clause which is deployed by the unit itself or provided by a third party must be certified by a biometric organization/laboratory accredited by the FIDO Alliance;

d) If a client fails to authenticate using biometric authentication after too many attempts (specified by the unit but not more than 10 attempts): the biometric authentication function will be blocked and such function shall only be unblocked after the client sends a request and is identified in order to prevent fraud and spoofing;

dd) The time limit for biometric authentication is up to 03 minutes.

6. Device-based biometric authentication: It refers to the process of making comparison to ensure that the biometric information of the client conducting a transaction matches the biometric information of the client stored on their mobile device. Device-based biometric authentication must meet the following minimum requirements:

a) Activation is permitted only after the client’s consent has been obtained and the client has conducted at least one successful transaction by applying another form of authentication;

b) The time limit for biometric authentication is up to 02 minutes.

7. FIDO (Fast IDentity Online) authentication is a form of authentication according to the standard for transaction authentication using asymmetric key algorithms (including private keys used to generate digital signatures, and public keys used to validate digital signatures) issued by the FIDO Alliance. FIDO authentication must meet the following requirements:

a) The private key is securely stored on the client's device. The client uses PIN authentication or biometric authentication on their device to access and use the private key when conducting transactions;

b) The public key is securely stored at the unit and linked to the client's e-transaction account;

c) The solution deployed by the unit itself or provided by a third party must be certified by an organization accredited by the FIDO Alliance.

8. E-signature authentication: It is specified under regulations of law on e-signatures (excluding secure e-signatures specified in clause 9 of this Article).

9. Secure e-signature authentication is the form of authentication based on e-signature which may be a secured e-signature or a digital signature or a foreign e-signature recognized in Vietnam in accordance with the law on e-signatures.

10. Authentication form based on risk assessment for online card payment transactions according to EMV 3-D Secure (hereinafter referred to as “EMV 3DS authentication”). The EMV 3-D authentication must meet the requirement: Card issuers, acquirers and merchants must implement the EMV 3-D Secure.

11. Authentication through operations showing the client's authentication of a data message when performing a transaction such as clicking accept, approve, send or similar operations on the online banking application software. Such authentication form must meet the following requirements:

a) Authentication operations must be logged so as to retrieve information related to these authentication operations;

b) Clients must be organizations that have logged in the online banking application software using the authentication forms as prescribed in this Article, except for clauses 1, 2, 6, and 10.

Section 3. OPERATION MANAGEMENT

Article 12. Management of personnel in charge of administration and operation of online banking systems

1. Each unit shall assign personnel to supervise and monitor operations of its online banking system, detect and handle technical incidents and cyberattacks.

2. Each unit shall assign personnel to receive information and support clients, and promptly contacting clients upon detection of unusual transactions.

3. The personnel in charge of administration, supervision and operation of the online banking system shall participate in annual training courses to update knowledge about security and confidentiality.

4. The grant of accounts with online banking system administrator privilege must be monitored and supervised by a division independent from the account grant division.

Article 13. Management of operations of the operating environment of online banking systems

1. Any unit is not permitted to install or store application development software and source codes in the operating environment.

2. The administration, supervision and operation must meet the following requirements:

a) Personnel in charge of administration, supervision and operation shall only be permitted to install allowed software on their computers and must install anti-malware software; these computers must frequently update malware identification patterns and not permit the automatic disabling of anti-malware software;

b) System administration, supervision and operation connections must be established through intermediate servers or secure and controlled centralized administration systems and must not be established directly from the computers of the personnel in charge of administration, supervision and operation;

c) An account with administrator privilege shall be granted for a limited period of time that is just enough to finish the task and revoked immediately at the end of the working session;

d) It is required to take measures to monitor the use of accounts with administrator, supervisor and operator privilege and provide warnings when there is any unusual impact on the database or applications.

3. Every unit shall tailor a policy for computers used for administration, supervision and operation of its online banking system; these computers may only be connected to the online banking system or other information systems of the unit in service of the administration, supervision and operation.

Article 14. Management of technical vulnerabilities and weaknesses

A unit shall manage vulnerabilities and weaknesses of its online banking system with the following basic contents:

1. Taking measures to prevent, combat and discover illegal changes to the online banking application software.

2. Establishing mechanisms to detect, prevent and combat intrusion into or cyberattacks to the online banking system.

3. Cooperating with regulatory bodies and IT partners in promptly obtaining information on incidents and circumstances regarding information security and confidentiality to take appropriate preventative measures.

4. Updating information on published vulnerabilities related to system software, database management system, and application software from the Common Vulnerability Scoring System - version 4 (CVSS, v4.0 or equivalent).

5. Scanning vulnerabilities and weaknesses of the online banking system at least once a year or when receiving information related to new vulnerabilities and weaknesses. For system components directly connected to the Internet, scanning vulnerabilities and weaknesses at least once every 03 months. Assessing the level of impact and risk of each discovered technical vulnerability and weakness of the system and proposing solutions and plans for handling thereof.

6. Updating security patches or prompt preventive measures based on the level of impact and risk:

a) For a vulnerability rated critical: Within 01 day for system components directly connected to the Internet; within 01 month for remaining components after the vulnerability is announced or discovered.

b) For a vulnerability rated high: Within 01 day for system components directly connected to the Internet; within 02 months for remaining components after the vulnerability is announced or discovered.

c) For a vulnerability rated medium or low: Within the time limit decided by the unit.

Article 15. Systems for supervising and monitoring operations of online banking systems

1. Each unit shall establish a system for supervising and monitoring operations of its online banking system. The system for supervising and monitoring operations of the online banking system must fully collect logs of the components of the online banking system to detect and investigate unusual events or cyberattacks.

2. Each unit shall develop criteria and software to warn unusual transactions based on time, geographical location, transaction frequency, transaction money (if any), number of incorrect login attempts exceeding the prescribed limit, and other unusual signs.

Article 16. Assurance of uninterrupted operations

Each unit shall develop a disaster prevention system and processes and scenarios to ensure uninterrupted operations of its online banking system in accordance with SBV’s regulations on security and confidentiality of the information technology system in banking operations. In addition, the unit shall:

1. Analyze and identify circumstances likely to cause information insecurity and disruption of operations of the online banking system. Identify and assess each circumstance with high and medium level of risk and possibility of occurrence at least once every 06 months. Make a list of circumstances with high, medium, acceptable and low level of risk and possibility of occurrence.

2. Prepare plans, including processes and scenarios, for remedying circumstances with high and medium level of risk and possibility of occurrence as prescribed in clause 1 of this Article. Determine the maximum downtime to restore the system and database for a plan to handle each circumstance. Disseminate the plan to relevant personnel so as for them to clearly understand their tasks in each circumstance.

3. Provide human and financial resources and technical equipment to organize drills of plans for handling circumstances with a high level of risk and possibility of occurrence at least once every year.

4. Formulate plans and hold drills to ensure uninterrupted business operations, store related documents and assess drill results.

Section 4. PROTECTION OF CLIENTS’ INTERESTS

Article 17. Information about online banking services

1. Each unit shall publicize information about online banking services, ensure that clients have access to information before or at the time of registering to use the services, at least including:

a) Method of providing the services, method of accessing the online banking services corresponding to each access equipment;

b) Transaction limit (if any) and transaction authentication forms;

c) Equipment required to use the services, conditions applicable to the equipment used;

d) Risks related to the use of online banking services.

2. Each unit shall inform clients about terms of the agreement on provision and use of online banking services, at least containing:

a) Rights and obligations of clients when using online banking services;

b) Types of client data that the unit collects, purposes of using client data and the unit’s responsibility for ensuring confidentiality of client data in accordance with law, except where the unit and the client have reached another agreement on the protection of client data in accordance with law;

c) Undertaking to maintain uninterrupted operations of the online banking system, at least including one-time service interruption time, total service interruption time in one year, except for force majeure events or cases of system maintenance and upgradation notified by the unit;

d) Other details regarding its online banking services (if any).

3. The unit shall not send SMS or emails to clients containing hyperlinks to access websites unless otherwise requested by the client.

Article 18. Instructing clients in use of online banking services

1. Units shall develop processes and manuals for installation and use of software, applications and equipment for conducting online banking transactions, instruct clients in applying such processes and using such manuals.

2. Units shall instruct clients in taking measures to ensure safety and confidentiality when using online banking services, including at least the following:

a) Protecting passwords, PINs and OTPs and not sharing equipment storing such information;

b) Principles of creating and changing passwords and PINs of e-transaction accounts;

c) Not using public computers to access the online banking system or conduct transactions; not using public Wi-Fi when using online banking services;

d) Not saving usernames and passwords, PINs on browsers;

dd) Logging out from online banking application software after use;

e) Identifying and taking actions against circumstances of website and online banking application software phishing;

g) Fully installing security patches for operating systems and mobile banking application software; considering installing anti-malware software and updating the latest malware identification pattern on personal devices used to conduct transactions;

h) Selecting authentication forms with the level of security and confidentiality in accordance with regulations and in a manner that suit clients' need for transaction limits;

i) Issuing warnings of the risks related to the use of online banking services;

k) Not using unlocked mobile devices to download and use online banking application software or OTP generator software;

l) Not installing strange software, unlicensed software or software of unknown origin;

m) Promptly notifying the unit when detecting unusual transactions;

n) Immediately notifying the unit of the loss of or damage to OTP generators, phone numbers receiving SMS, devices storing keys used to generate e-signature; cases of fraudulence or suspicious fraudulence; or attacks or suspicious attacks by hackers.

3. Units must provide clients with information about their focal points for receiving information, hotlines and instructions on the process and methods for cooperation in handling errors and incidents in the course of using online banking services.

4. Units must provide clients with explanation for specific cases in which the units will contact them, methods and means of communication during the clients' use of online banking services.

Article 19. Ensuring confidentiality of client information

Each unit shall apply measures to ensure security and confidentiality of client data, comprising at least the following:

1. Ensuring security and confidentiality of client data in accordance with law.

2. Storing information used to authenticate client transactions including passwords, PINs, and biometric information by using encryption or concealment measures to ensure confidentiality.

3. Granting access to client data to personnel in charge of accessing such data according to their functions and tasks; and taking measures to monitor each access.

4. Taking measures to manage access to equipment and devices used to store client data to prevent the risk of exposure and leakage of data.

5. Notifying clients of any incident that causes client data exposure or leakage, and promptly reporting it to SBV (the Information Technology Department).

Chapter III

IMPLEMENTATION CLAUSE

Article 20. Reporting regime

Every unit providing online banking services shall submit written reports to SBV (the Information Technology Department) as follows:

1. Report on provision of online banking services:

a) Time limit for submitting the report: At least 10 working days before the official provision of online banking services;

b) Details of the report:

(i) Website address or application store;

(ii) The official date of provision;

(iii) Solutions for verifying clients accessing online banking services; forms of transaction authentication applicable to each type of transaction and transaction limit (if any);

(iv) Copies of certificates of security and confidentiality assurance, spoofing and fraud prevention prescribed in clauses 5 and 7 Article 11 of this Circular.

2. Ad hoc report at SBV's request.

Article 21. Responsibilities of units affiliated to SBV

1. The Information Technology Department shall carry out monitoring and inspection, and cooperate with related units to resolve difficulties arising from implementation of this Circular.

2. The Banking Supervision Agency shall inspect and supervise the implementation of this Circular and impose penalties for violations in accordance with law.

3. SBV branches of provinces and cities shall inspect and supervise the implementation of this Circular by local intermediary payment service providers (except for the National Payment Corporation of Vietnam - NAPAS) and impose penalties for violations in accordance with law.

Article 22. Effect

1. This Circular comes into force from January 01, 2025, except for the cases specified in clauses 2, 3 and 4 of this Article.

2. Point b clause 1 of Article 4, point d clause 9 of Article 7 and clause 4 of Article 8 come into force from July 01, 2025.

3. Point b clause 1 of Article 10 comes into force from January 01, 2026.

4. Point c clause 5 of Article 11, point c clause 7 of Article 11 and point b (iv) clause 1 of Article 20 come into force from July 01, 2026.

5. The following documents shall cease to have effective from the effect date of this Circular:

a) Circular No. 35/2016/TT-NHNN dated December 29, 2016 of SBV’s Governor;

b) Circular No. 35/2018/TT-NHNN dated December 24, 2018 of SBV’s Governor.

6. Article 25 of the Circular No. 09/2020/TT-NHNN dated October 21, 2020 of SBV’s Governor is repealed.

Article 23. Transitional clauses

1. For services registered for automatic payments from checking accounts, e-wallets and cards of clients before the effective date of this Circular shall continue to be rendered until the expiry of the signed agreements; in case the agreements do not specify an expiry date, they shall continue to be implemented until December 31, 2026. The amendment and extension of such agreements must comply with clause 2 Article 10 of this Circular.

2. Passwords and PINs that are in use before the effective date of this Circular shall continue to be used until the client changes them or until the end of their validity period. From the effective date of this Circular, any change of passwords and PINs must comply with clauses 1 and 2 Article 11 of this Circular.

Article 24. Organizing implementation

Chief of Office, Director General of Information Technology Department and heads of units affiliated to SBV, Chairpersons of Boards of Directors, Chairpersons of Board of Members, Directors General (Directors) of credit institutions, foreign branch banks, intermediary payment service providers and credit information companies are responsible for the implementation of this Circular./.

PP. THE GOVERNOR THE DEPUTY GOVERNOR Pham Tien Dung

APPENDIX 01

CLASSIFICATION OF ONLINE PAYMENT TRANSACTIONS
(Enclosed with the Circular No. 50/2024/TT-NHNN dated October 31, 2024 of the Governor of the State Bank of Vietnam)

No.	Description	Category A	Category B	Category C	Category D
I	Individual client
1	Group I.1: - Money transfer between payment accounts, debit cards, identified prepaid cards (hereinafter referred to as “cards”) of a client in a payment service provider. - Money transfer between e-wallets of a client in an intermediary payment service provider.	All transactions.
2	Group I.2: - Transactions including payments of lawful goods and services processed by payment service providers and intermediary payment service provider or at payment acceptors selected, appraised, supervised and managed by payment service providers and intermediary payment service providers	Any transaction that satisfies the following condition: G + T ≤ VND 5 million.	Any transaction that satisfies the following conditions: (i) G + T > VND 5 million. (ii) G + T ≤ VND 100 million.	Any transaction that satisfies the following conditions: (i) G + T > VND 100 million. (ii) G + T ≤ VND 1.5 billion.	Any transaction that satisfies the following condition: G + T > VND 1.5 billion.
3	Group I.3: - Money transfer between checking accounts, cards, e-wallets of different account holders, card holders and e-wallet owners. - Money transfer between accounts, cards, and e-wallets opened at different payment service providers, card issuers and intermediary payment service providers. - E-wallet cash-in1. - E-wallet cash-out.	Any cash-in or cash-out between an e-wallet and VND account of an e-wallet owner at the affiliated bank according to regulations of law that satisfies the following conditions: (i) G ≤ VND 10 million. (ii) G + Tksth ≤ VND 20 million.	Any transaction (except cash-in or cash-out between an e-wallet and VND account of an e-wallet owner at the affiliated bank according to regulations of law) that satisfies the following conditions: (i) G ≤ VND 10 million. (ii) G + Tksth ≤ VND 20 million.	Any transaction that satisfies one of the following conditions: 1. 1. Any transaction that satisfies the following conditions: (i) G ≤ VND 10 million. (ii) G + Tksth > VND 20 million. (iii) G + T ≤ VND 1.5 billion. 2. 2. Any transaction that satisfies the following conditions: (i) G > VND 10 million. (ii) G ≤ VND 500 million. (iii) G + T ≤ VND 1.5 billion.	Any transaction that satisfies one of the following conditions: 1. 1. Any transaction that satisfies the following conditions: (i) G ≤ VND 10 million. (ii) G + Tksth > VND 20 million. (iii) G + T > VND 1.5 billion. 2. 2. Any transaction that satisfies the following conditions: (i) G > VND 10 million. (ii) G ≤ VND 500 million. (iii) G + T > VND 1.5 billion. 3. 3. Any transaction that satisfies the following condition: G > VND 500 million.
4	Group I.4: Outbound interbank transfer2.			Any transaction that satisfies the following conditions: (i) G ≤ VND 200 million. (ii) G + T ≤ VND 1 billion.	Any transaction that satisfies one of the following conditions: 1. 1. Any transaction that satisfies the following conditions: (i) G ≤ VND 200 million. (ii) G + T > VND 1 billion. 2. 2. Any transaction that satisfies the following condition: G > VND 200 million.
II	Institutional client3
1	Group II.1: Money transfer between checking accounts or e-wallets of the same client in a payment service provider or intermediary payment service provider.		All transactions.
2	Group II.2: - Money transfer between checking accounts and e-wallets of different account holders and e-wallet owners. - Money transfer between accounts and e-wallets opened at different payment service providers and intermediary payment service providers. - Transactions including payments of lawful goods and services processed by payment service providers and intermediary payment service provider or at payment acceptors selected, appraised, supervised and managed by payment service providers and intermediary payment service providers - E-wallet cash-in1. - E-wallet cash-out.			Any transaction that satisfies the following conditions: (i) G + T ≤ VND 1 billion. (ii) G + T ≤ VND 10 billion.	Any transaction that satisfies one of the following conditions: 1. 1. Any transaction that satisfies the following conditions: (i) G ≤ VND 1 billion. (ii) G + T > VND 10 billion. 2. 2. Any transaction that satisfies the following condition: G > VND 1 billion.
3	Group II.3: Outbound interbank transfer2.			Any transaction that satisfies the following conditions: (i) G ≤ VND 500 million. (ii) G + T ≤ VND 5 billion.	Any transaction that satisfies one of the following conditions: 1. 1. Any transaction that satisfies the following conditions: (i) G ≤ VND 500 million. (ii) G + T > VND 5 billion. 2. 2. Any transaction that satisfies the following condition: G > VND 500 million.

Notes:

G: Value of the transaction.

T_ksth: Total value of Category A and Category B transactions of each category of transactions performed on a checking account or a card (including e-wallet cash-in) or an e-wallet (excluding e-wallet cash-in) of a client at a payment service provider or intermediary payment service provider, excluding checking account auto-debit, e-wallet auto-debit and card auto-debit transactions. T_ksth shall be zero (0) at the beginning of the day or immediately after the client has a transaction in the day which is authenticated by an authentication method for Category C or Category D transactions.

T: Total value of each category of transactions performed in a day (on a checking account (including e-wallet cash-in) or an e-wallet (excluding e-wallet cash-in) of a client at a payment service provider or intermediary payment service provider, excluding checking account auto-debit, e-wallet auto-debit and card auto-debit transactions.

(1) In case of e-wallet cash-in from the e-wallet owner's VND account at an affiliated bank, the transaction classification shall rely on the checking account linked to the e-wallet.

(2) Converted limit is based on exchange rate at the time of transaction.

(3) In case the client is a business household or a micro-enterprise applying a simple accounting regime, transactions of such business household or micro-enterprise are classified similarly to transactions of an individual client.

APPENDIX 02

ONLINE PAYMENT TRANSACTION AUTHENTICATION
(Enclosed with the Circular No. 50/2024/TT-NHNN dated October 31, 2024 of the Governor of the State Bank of Vietnam)

No.	Transaction	Minimum online payment transaction authentication form
		Individual client	Institutional client
1	Category A transaction	- Password or PIN (if authenticated at the login step, authentication is not required at the transaction step).	- Password or PIN (if authenticated at the login step, authentication is not required at the transaction step).
2	Category B transaction	- SMS OTP or Voice OTP or Email OTP; - Or OTP Matrix Card; - Or basic or advanced Soft OTP/ Token OTP; - Or two-channel; - Or device-based biometric authentication1; - Or FIDO; - Or e-signatures; - Or secure e-signatures.	- SMS OTP or Voice OTP or Email OTP; - Or OTP Matrix Card; - Or matching the device-based biometric information of the legal representative or the individual authorized by the legal representative (if any).
3	Category C transaction	- OTP sent via SMS/Voice or basic Soft OTP/Token OTP or e-signatures, - And biometric authentication.	- Basic Soft OTP/ Token OTP; - Or two-channel; - Or e-signatures.
4	Category D transaction	- Advanced Soft OTP/Token OTP or FIDO or secure e-signatures, - And biometric authentication.	- Advanced Soft OTP/ Token OTP; - Or FIDO; - Or secure e-signatures.

Notes:

- Details about authentication forms are specified in Article 11 of this Circular.

- Category D transaction authentication form may be used to authenticate Category A, B and C transactions.

- Category C transaction authentication form may be used to authenticate Category A and B transactions.

- Category B transaction authentication form may be used to authenticate Category A transactions.

- In case the client is a business household or a micro-enterprise applying a simple accounting regime, the transaction authentication form to be applied is similar to that applied to an individual client. Regarding the form of biometric authentication and the form of device-based biometric authentication, the biometric information used for comparison is that of the legal representative or the individual authorized by the legal representative (if any).

(1) In case the client has signed into the Online Banking app using device-based biometric authentication, this biometric authentication shall not be used during transactions in the same sign-in session.

APPENDIX 03

CLASSIFICATION OF ONLINE CARD PAYMENT TRANSACTIONS
(Enclosed with the Circular No. 50/2024/TT-NHNN dated October 31, 2024 of the Governor of the State Bank of Vietnam)

No.	Description	Category E transaction	Category F transaction	Category G transaction
1	Transactions including payments of lawful goods and services processed by payment service providers or at merchants selected, appraised, supervised and managed by payment service providers and intermediary payment service providers.	Any transaction that satisfies the following condition: G + T ≤ VND 5 million.	Any transaction that satisfies the following conditions: (i) G + T > VND 5 million. (ii) G + T ≤ VND 100 million.	Any transaction that satisfies the following conditions: G + T > VND 100 million.

Notes:

G: Value of the transaction.

T: Total value of transactions performed in a day on a client's active card at a card issuer, excluding transactions in which the card user automatically makes payments from the card by agreement with the client.

APPENDIX 04

ONLINE CARD PAYMENT TRANSACTION AUTHENTICATION
(Enclosed with the Circular No. 50/2024/TT-NHNN dated October 31, 2024 of the Governor of the State Bank of Vietnam)

No.	Transaction	Minimum online card payment transaction authentication form
1	Category E transaction	Password or PIN (if authenticated at the login step, authentication is not required at the transaction step).
2	Category F transaction	- SMS OTP or Voice OTP or Email OTP; - Or OTP Matrix Card; - Or Basic Soft OTP/ Token OTP; - Or device-based biometric authentication1; - Or two-channel.
3	Category G transaction	- Advanced Soft OTP/ Token OTP; - Or FIDO; - Or e-signatures/ secure e-signatures; - Or EMV 3DS.

Notes:

- Details about authentication forms are specified in Article 11 of this Circular.

- Category G transaction authentication form may be used to authenticate Category E and F transactions.

- Category F transaction authentication form may be used to authenticate Category E transactions.