DPO Radio

AesirX ComplianceOne | Decree 382 Controlled Testing in Banking

Overview Image

Decree 382/2026/NĐ-CP: Scope and Current Status

Decree 382/2026/NĐ-CP of the Government was issued and took effect on 6 October 2026. It amends Decree 94/2025/NĐ-CP on the controlled testing mechanism in banking. That mechanism lets credit institutions, foreign bank branches and Fintech companies test a solution under State Bank supervision. Peer-to-peer lending is open to Fintech companies only (Decree 94 Article 2 Clause 1).

The decree changes what an applicant files, how the State Bank checks it, and how each later change to a test is reviewed. It took effect on the day it was issued. It states no fine.

What changes for an applicant:

  • Filing channels. A dossier may go by the postal public service, through a service provider or an authorised person, in person at the State Bank's one-stop desk, or online through the National Public Service Portal. Each channel is permitted. None is required.
  • The qualification test. The legal representative and the general director must hold a listed university degree, or have at least two years' management experience in finance, banking, payment intermediation or information technology. Neither may belong to a category the law prohibits.
  • Records the State Bank retrieves. The State Bank retrieves the criminal record of the legal representative and general director from the criminal-record database. If it cannot obtain the record, or the record is incomplete or inaccurate, it asks the authority that manages the database, not the applicant. For personnel credentials and corporate standing documents, the State Bank retrieves what it can, and asks the applicant to supplement the dossier only where it cannot obtain the information, or the information is incomplete or inaccurate.
  • Appraisal periods. The State Bank appraises a Fintech solution dossier within 80 days, and a peer-to-peer lending dossier within 90 days, from its written confirmation that the set is complete.
  • Reviews of later changes. An adjustment, a stop, an extension and a completion each go to the State Bank on its own form. Each is reviewed within 25 working days.
  • One explanation. When the State Bank asks for an explanation, the organisation may send one. For an admission dossier, if none is sent within 45 days of the request, the State Bank returns the dossier. For an adjustment or an extension the window is 7 working days, after which the dossier is returned. For a stop review, if none is sent within 7 working days, the State Bank decides the stop and revokes the certificate of participation.

Dossiers the State Bank had confirmed complete before 6 October 2026 keep the appraisal period and procedure of the earlier law. Their legal representative and general director are appraised under the new test. A dossier received but not yet confirmed is judged for completeness under the reduced list.

The decree repeals Decree 94 Article 9(3) and Article 12(3) (Article 3(1) and Article 6(1)). In Decree 94's signed text, those clauses list the resolution of the board, members' council, shareholders or owner approving the solution proposal, for a Fintech solution and for peer-to-peer lending. Since 6 October 2026 that resolution is no longer a listed dossier component. Forms 01–03 still require the number and date of the relevant resolution or approval document. Keep that approval and complete those form references; the resolution itself is no longer filed as a separate dossier component. The qualification test applies to the company applicants the two amended clauses name: the Fintech company applying to test a Fintech solution, and the company applying to test peer-to-peer lending.

Overview Image

How Decree 382 Relates to the Banking Overlays

Decree 94/2025 sets the controlled testing mechanism. Decree 382 changes its clauses, its filing channels and its annexes, and replaces its Appendix I with twelve official forms. For the filing, the amendment changes the documents and the channels the procedure uses. It also states which clauses of Decree 94 are repealed (Article 3(1) and Article 6(1)): the two clauses that listed the board or owner resolution as a dossier component. Forms 01–03 continue to cite the resolution or approval document by number and date, so retain it internally and complete those references. Article 13(2) also ends the specified Resolution 24/2026/NQ-CP dossier rules (Appendix I.7, Section 1, Subsection D, items VI–XI) from 6 October 2026, including the credit-scoring and Open API procedures.

The base rules, and which periods apply to which dossier, are on the Decree 94 page.

The decree amends Decree 94. It also ends, from 6 October 2026, listed provisions of Nghị quyết 24/2026/NQ-CP (Article 13(2)), which is not reproduced here. The text does not show whether those provisions reach the payment-sector obligations on the banking, fintech and payments overlay, so they are not described as unchanged.

Technical Provisions and Compliance Obligations

ProvisionWhat It RequiresOperational Implication
Article 1(1)A dossier may be filed by postal service, through a service provider or authorised person, in person, or online through the National Public Service Portal.Choose a channel. None is mandatory.
Article 4(1) and Article 7(1)One set of the dossier and one USB go with the request where the dossier is sent by postal service, a service provider, an authorised person or in person. The text does not state the USB for online filing.Check the channel before you assemble the copies.
Article 2 and Article 5The legal representative and general director hold a listed university degree, or at least two years' management experience in the listed fields, and do not belong to a category the law prohibits.Keep the degree or experience evidence for each person with the dossier.
Article 1(2)The State Bank retrieves the criminal record of the legal representative and general director from the criminal-record database. If retrieval fails or the record is incomplete, the State Bank asks the authority that manages the database.The applicant is not asked for the criminal record on that path.
Article 3(3)–(4) and Article 6(2)–(3)The personal record statement is dated no more than six months before filing. Credentials and corporate documents are retrieved where the State Bank can, and copies are supplied where it cannot.Date each personal record statement. Hold the registration certificate and licences ready in case retrieval fails.
Article 3(2)The Fintech solution description sets out a simulation model or demonstration, the prospective customer group, and a technical explanation of the information system. It shows the security level and the criteria Decree 94 cross-refers to.Prepare the description with the system's security level. The Decree 94 criteria are not reproduced here.
Article 4(2) and Article 7(2)The State Bank appraises within 80 days (Fintech solution) or 90 days (peer-to-peer lending), with ministry comments and any on-site inspection.Track the State Bank's dates and the ministries' replies.
Article 4(2) and Article 7(2)One explanation and completed dossier may be sent, once. Sending it is permitted, not required. If sent, it states what changed and answers the points raised.Decide whether to explain. If you do, answer each point and keep the record of what you sent.
Articles 8 to 11An adjustment, stop, extension or completion is filed on Form No. 05, 07, 09 or 11. A stop, an extension or a completion carries a test-results report under Appendix V.Keep the test-results report and, for a stop, the stop plan ready.
Article 14Dossiers confirmed complete before 6 October 2026 keep the earlier period. Their legal representative is appraised under this decree. Unconfirmed dossiers are judged under the reduced list.Record the date of the State Bank's written confirmation for each registration.

ObligationTimelineReference
State Bank appraisal of a Fintech solution dossier80 days from written confirmation of a complete setArticle 4(2)
State Bank appraisal of a peer-to-peer lending dossier90 days from written confirmation of a complete setArticle 7(2)
Ministry comments on the appraisal20 days from the State Bank's requestArticle 4(2), Article 7(2)
Designation of ministry officers for an on-site inspection7 days from the State Bank's requestArticle 4(2), Article 7(2)
Notice of an on-site inspection to the organisationAt least 5 days before it takes placeArticle 4(2), Article 7(2)
Review of an adjustment, a stop, an extension or a completion25 working days from receipt of the applicationArticles 8 to 11
Explanation the State Bank asks for during an adjustment, stop or extension review7 working days; then an adjustment or extension dossier is returned, and a stop is decided with the certificate revokedArticles 8 to 10
Return of an admission dossier if no explanation is sent45 daysArticle 4(2), Article 7(2)

The decree's Appendix I sets out twelve official forms, Form No. 01 to Form No. 12.

FormTitleWho completes it
Form No. 01Application for a certificate of participation, for credit institutions and foreign bank branchesThe organisation
Form No. 02Application for a certificate of participation, for a Fintech company testing a Fintech solutionThe organisation
Form No. 03Application for a certificate of participation, for a Fintech company testing a peer-to-peer lending solutionThe organisation
Form No. 04Certificate of participation in the controlled testing mechanismThe State Bank
Form No. 05Application for adjustment of the test solutionThe organisation
Form No. 06Decision on adjustment of the test solutionThe State Bank
Form No. 07Application to stop the testThe organisation
Form No. 08Decision to stop the test and revoke the certificate of participationThe State Bank
Form No. 09Application to extend the test periodThe organisation
Form No. 10Decision to extend the test periodThe State Bank
Form No. 11Application for a certificate of completion of the testThe organisation
Form No. 12Certificate of completion of the testThe State Bank
Overview Image

How ComplianceOne Supports Decree 382/2026 Compliance

Once Decree 382 is in your workspace, the twelve forms sit in the Form Catalog with their official numbers and titles. Each filing can then be prepared from the same record.

Missing fields, before you file. A form instance lists the required fields still empty. You see the gap before the application goes to the State Bank, not after.

Who completes which section. Section routing assigns each section of a form to a department and an owner.

A filing case for each registration. A form links to the filing case it belongs to, and attaches to the dossier it supports.

A draft submission package. The forms of a dossier can be assembled into a package. The package starts as a draft.

Dates on the deadline list. The decree sets the 80-day, 90-day and 25-working-day periods. Once the decree is in your workspace, the deadline views list them.

An audit trail. Form changes are written to an audit log with a timestamp.

ComplianceOne records what your organisation prepared and checked. It does not decide eligibility, retrieve records from any national database, submit anything to the State Bank, approve admission or issue a certificate. The State Bank decides, and you send each application through the channel you choose.

Built for Filings You Can Check

A filing is only as good as its evidence. ComplianceOne keeps the forms, the open fields and the review dates beside the evidence each one rests on.

A field still empty is shown as empty. The check lists it before the application is sent, so the gap is closed by the organisation, not discovered by the State Bank.

Each form change is written to an audit log with a timestamp. Who prepared a section, and when it changed, can be shown to a reviewer.

The decision stays with the State Bank. ComplianceOne shows the evidence for each application and does not replace the appraisal.

Background Image

See Decree 382/2026 Compliance in Action

See how ComplianceOne helps banks and Fintech companies prepare controlled-testing applications, manage official forms, track review dates and keep supporting evidence linked to each filing.

Demo Image
Ronni K. Gothard Christiansen

Ronni K. Gothard Christiansen - Technical Privacy Engineer & CEO

Technical Compliance Expert, 32+ Years Open Source Advocate, X-BoD Open Source Matters Inc.

Or contact via

ronni@aesirx.io+84 909 500 760

Frequently Asked Questions

No. The State Bank appraises the dossier under the decree. ComplianceOne shows the required fields that are still empty and who holds each section of the form.

No. You send the application through the channel you choose: postal service, a service provider, an authorised person, the one-stop desk or the National Public Service Portal. ComplianceOne keeps the forms you prepared.

The text attaches the one-set-and-USB rule to postal, service-provider, authorised-person and in-person filing. It does not state the rule for online filing. Confirm the practice with counsel before you file online.

No. One explanation is permitted, not required. The window depends on the dossier. For an admission dossier, if none is sent within 45 days, the State Bank returns the dossier. For an adjustment or an extension, the window is 7 working days and the dossier is then returned. For a stop review, if none is sent within 7 working days, the State Bank decides the stop and revokes the certificate of participation. If you send one, state what changed and answer each point.

No longer as a listed component. The decree repeals Decree 94 Article 9(3) and Article 12(3), the clauses that listed the resolution of the board, members' council, shareholders or owner approving the solution proposal. The approval still needs to exist: Forms 01–03 cite its number and date. Keep it internally and complete those references, without adding the resolution itself as a separate dossier component.

Next Steps

Icon Image

Start a Compliance Pilot

Test your filing forms, evidence and review dates for one controlled-testing registration.

Icon Image

Discuss Your Compliance Needs

Review which application you will file, which forms it needs, and which of its dates you need to track.