DPO Radio
AesirX ComplianceOne | Circular 83 Vietnam Banking Internal Controls
ACTIVE
Circular 83/2025/TT-NHNN Banking Internal Controls
Internal controls for commercial banks and foreign bank branches
The State Bank's internal-control rules for banks, in force since 1 July 2026. Prepare the four annual State Bank reports, keep the working records behind them, and track the reporting windows and the obligations phased to 2028.
Circular 83/2025/TT-NHNN: Scope and Current Status
If you run a commercial bank or a foreign bank branch in Vietnam, Circular 83/2025/TT-NHNN sets how your internal control system must be organised, run, reported and audited. The State Bank of Vietnam issued it on 31 December 2025, and it has applied since 1 July 2026.
What it asks of you:
- Three independent lines of defence, with a board-level and executive structure responsible for the control system.
- Control activities across every business process, including credit granting and proprietary trading.
- Risk management by risk type: credit, market, operational, liquidity, concentration, interest-rate risk in the banking book and model risk, with an internal capital adequacy assessment.
- A management information system that collects, processes, stores and supplies the information management decisions rely on.
- Internal audit under the supervisory board, with an annual plan and reporting.
- Four annual reports to the State Bank, and an ad-hoc report after each ad-hoc internal audit.
Some obligations are phased. Credit-risk and market-risk stress testing and risk data management apply by 1 January 2028 at the latest. For models used in the internal ratings-based (IRB) approach, model-risk management applies from 1 July 2026 if the bank began its IRB transition before that date, or from the start of a later IRB transition. Full model-risk management applies to all banks by 1 January 2028 (Article 74(3)). Until 31 December 2027, a bank may measure interest-rate risk in the banking book on either of the two indicators; from 1 January 2028 it must use both. A bank that adopts any of these earlier must notify the State Bank within 10 days.
From 1 July 2026, Circular 83 repealed Circular 13/2018/TT-NHNN, Circular 40/2018/TT-NHNN and Article 3 of Circular 09/2024/TT-NHNN. A commercial bank under special control does not have to meet the internal capital adequacy assessment rules. Circular 83 sets no fines of its own.
How Circular 83 Relates to the Banking Overlays
Circular 83 is the internal-control foundation of the banking overlays. It is a separate optional overlay built for banks and foreign bank branches.
The banking, fintech and payments overlay goes beyond it, into anti-money-laundering due diligence, payment services, onboarding evidence and retention decisions. Circulars 46/2026 and 47/2026 add the State Bank's credit-information and payment-supervision amendments. A bank usually works with Circular 83 and one or more of these side by side.
Circular 83 rests on the Law on the State Bank of Vietnam and the Law on Credit Institutions. Organisations outside its scope can add it for reference, as a model of good internal-control governance.
Technical Provisions and Compliance Obligations
| Provision | What It Requires | What You Need |
|---|---|---|
| Articles 1–2 | Applies to commercial banks and foreign bank branches. A commercial bank under special control is exempt from the capital adequacy assessment rules in Section 9 of Chapter III | A recorded decision on whether you are in scope, and on which parts apply |
| Article 4(2) | Three independent lines of defence in the internal control system | A responsibility matrix showing which units own controls, which oversee them and which audit them |
| Article 8 | A management information system to collect, process, store and supply information, including risk data and internal reports | A review record of the system, its data sources, reliability, confidentiality and backup |
| Article 9(2)–(3) | Annual reports on control activities (Appendix I), risk management (Appendix II), internal capital adequacy (Appendix III) and internal audit (Appendix IV), plus ad-hoc internal audit reports | Each report prepared, approved and sent within its window, with proof of sending |
| Article 9(4) | The board or members' council approves the Appendix I report, the supervisory board approves Appendix IV, and the General Director approves Appendices II and III | A named approver for each report. At a foreign bank branch, the General Director approves Appendices I–III |
| Article 9(6) | Reports go to the State Bank in person, by post or online where available | A record of the channel used and the date sent |
| Article 10 | An internal rule on keeping internal-control records, available to auditors, inspectors and supervisors | Your own retention rule. The Circular points to the banking-sector archive periods and states none of its own |
| Articles 20–21 | Risk limits, and risk review before a new product or a new market | A limit register and a new-product review record |
| Article 40 | Outsourcing: scope and dependency, approval authority, due diligence, contract safeguards, continuity plans and monitoring | An outsourcing register, due diligence, a contract checklist and continuity evidence for each arrangement |
| Articles 64–73 | Internal audit principles, standards, annual plan, scope, powers and reporting | An internal audit plan, engagement records, a findings register and corrective actions |
| Article 74 | Effect from 1 July 2026, phased obligations to 1 January 2028, and repeal of the earlier circulars | A plan for each phased obligation and, if you adopt one early, the notice to the State Bank |
| Obligation | Timeline | Reference |
|---|---|---|
| Circular takes effect | 1 July 2026 | Article 74(1) |
| Appendix I, II and III reports | Within 90 days of the end of the financial year | Article 9(3)(a) |
| Appendix IV internal audit report | Within 60 days of the end of the financial year. A foreign bank branch that ran no internal audit that year sends none | Article 9(3)(b) |
| Ad-hoc internal audit report | Within 7 working days of the end of the ad-hoc audit | Article 9(3)(b) |
| Credit-risk and market-risk stress testing, risk data and model risk | By 1 January 2028 at the latest | Article 74(2)–(3) |
| Both interest-rate-risk indicators | From 1 January 2028 | Article 74(4) |
| Notice of early adoption of a phased obligation | Within 10 days of adopting it | Article 74(5) |
The four State Bank reports are the Circular's official forms:
| Report | Official ID | Purpose | Approved by |
|---|---|---|---|
| Annual self-assessment of control activities | Appendix I | Results of your own review of control activities | Board or members' council |
| Annual risk management report | Appendix II | Risk appetite, limits, material risks and risk management capacity | General Director |
| Annual internal capital adequacy assessment report | Appendix III | Capital planning under base and stressed scenarios | General Director |
| Annual or ad-hoc internal audit report | Appendix IV | Audit plan execution, findings and follow-up | Supervisory board |
Appendices V and VI are methodologies, not forms. Appendix V sets out how to measure interest-rate risk in the banking book, and Appendix VI how to determine certain capital indicators. ComplianceOne keeps both as guidance to read.
The working records behind the reports are AesirX templates and are labelled as internal working documents, never as State Bank forms.
How ComplianceOne Supports Circular 83 Compliance
Add Circular 83 from the Sector Overlays catalog, directly if you are a bank or foreign bank branch, or for reference. Once it is added, it appears with your other frameworks, with its requirements, guidance and reporting windows.
Fill the four State Bank reports. Appendices I–IV open as official forms carrying their identifiers, each with sections for the report's content and a sign-off. Check the finished draft against the appendix before your approver signs it.
Keep the working records in one place. Internal templates cover governance, the three-lines matrix, delegated authority, conflicts of interest, risk appetite and limits, material risks, the management information system, State Bank submissions, remediation, internal audit and outsourcing. Each is marked as an internal working document.
See every reporting window. The 90-day, 60-day and 7-working-day windows sit with the framework, each naming the reports it applies to.
Plan the 2028 obligations. Credit-risk and market-risk stress testing and risk data management have a 1 January 2028 final date. Check model-risk management against your IRB transition date: its earlier triggers already apply, before the 2028 final date. If you adopt one early, you mark it early-implemented on the Circular with its date, and ComplianceOne shows the day the 10-day notice to the State Bank is due, counted from that date. ComplianceOne does not send the notice.
Keep outsourcing oversight with your vendors. Record your providers in the Governance vendor register, and complete the outsourcing register, due diligence, contract checklist and continuity templates for each material arrangement.
ComplianceOne holds the records and the reports you prepare. It does not calculate capital, stress-test outcomes or interest-rate risk, and it does not send anything to the State Bank.
Built for Reports Your Approvers Can Sign
The four annual reports are prepared on official forms carrying the State Bank's identifiers, with the records behind them one step away. Approvers sign a draft they can check.
Official and internal documents never blur. The reports carry their official identifiers; your working records are marked as yours.
The 2028 obligations stay visible while they are still phased. An early adoption is recorded with its date and who recorded it, beside the 10-day notice window.
Related Modules
Compliance Forms
Holds the four Appendix I–IV reports as official forms and the internal working templates behind them
Explore Compliance Forms
Localization
Adds Circular 83 as an optional banking overlay and shows its requirements, guidance, reporting windows and phased obligations
Explore Localization
Governance
Keeps the providers your outsourcing arrangements depend on, for the oversight Article 40 asks of you
Explore Governance
Audit Trail
Keeps a dated record of each early-adoption decision and who made it, beside the rest of your compliance history
Explore Audit TrailCompliance Readiness Checklist
If you are a bank or foreign bank branch working under Circular 83, confirm that:
See Circular 83 Compliance in Action
See how ComplianceOne prepares the Appendix I–IV reports, keeps the working records behind them and tracks the obligations phased to 2028.
Ronni K. Gothard Christiansen - Technical Privacy Engineer & CEO
Technical Compliance Expert, 32+ Years Open Source Advocate, X-BoD Open Source Matters Inc.
Frequently Asked Questions
Commercial banks and foreign bank branches in Vietnam. A commercial bank under special control is exempt from the internal capital adequacy assessment rules. Other organisations can add the overlay for reference, without taking on its obligations.
From 1 July 2026 it repealed Circular 13/2018/TT-NHNN on internal control systems, Circular 40/2018/TT-NHNN, which amended it, and Article 3 of Circular 09/2024/TT-NHNN.
The Appendix I, II and III reports are due within 90 days of the end of your financial year, and the Appendix IV internal audit report within 60 days. An ad-hoc internal audit report is due within 7 working days of the audit's close.
You must notify the State Bank within 10 days of starting. In ComplianceOne you mark the obligation early-implemented with the date you started, and ComplianceOne shows the day the notice is due, counted from that date. ComplianceOne does not send the notice. Keep the notice itself on the early-implementation notification record.
No. It holds the Appendix V and VI calculation methods as reference records and the Appendix III report as a form, but the calculations, stress tests and models stay in your own systems. ComplianceOne records their results and who approved them.
Next Steps
Start a Compliance Pilot
Test the four annual reports, your three-lines matrix and your outsourcing records against Circular 83.
Discuss Your Compliance Needs
Review your scope, report approvers, financial-year windows and the obligations you face by 1 January 2028.
The evolution of Aesir is Aesir + 
(the Norse symbol for Necessity)"Needed in order to achieve a particular result"
♥Join the AesirX Privacy Newsletter. Stay Informed. Stay Compliant.
