AesirX ComplianceOne | Decree 94/2025 Controlled Testing in Banking

Decree 94/2025/NĐ-CP: Scope and Current Status

The mechanism covers three kinds of Fintech solution: credit scoring, data sharing through an open application programming interface, and peer-to-peer lending. Credit institutions and foreign bank branches may take part in credit scoring and open-API solutions. Peer-to-peer lending is open to Fintech companies only: Article 2 Clause 1 excludes it for credit institutions and foreign bank branches.

Each solution is assessed against written criteria. A Fintech company files on one dossier track, and a Fintech company offering peer-to-peer lending files on a second. The State Bank decides every application. The testing period is up to two years.

Which rules apply to which dossier

The 2025 text is the base. Decree 382/2026/NĐ-CP, in force on 6 October 2026, changes several periods and filing rules. Its Article 14 Clause 1 keeps the 2025 procedure for a dossier whose receipt the State Bank confirmed in writing before 6 October 2026.

Dossier confirmed before 6 October 2026. The 2025 appraisal applies: 90 working days (Article 10 Clause 3 for a Fintech solution; Article 13 Clause 3 for peer lending). Decree 382 does not state a transition for the later adjustment, extension and completion requests, so their 2025 reviews of 30, 45 and 30 working days are an open point for counsel, not a settled rule.
Dossier confirmed on or after 6 October 2026. The 2026 rules apply: appraisal of 80 calendar days for a Fintech solution and 90 calendar days for peer lending (Decree 382 Article 4 Clause 2 and Article 7 Clause 2); adjustment, extension and completion reviews of 25 working days each (Decree 382 Article 8, Article 10, Article 11). The 2026 filing set is one set and one USB for the listed channels (Article 4 Clause 1; Article 7 Clause 1).

The State Bank's written confirmation of a complete set is the date that separates the two appraisal regimes. Check the confirmation date on your own file before applying either row.

How Decree 94/2025 Relates to the Banking Overlays

The duties an organisation carries

Filing. For a dossier filed under the 2025 text: two sets of the dossier and six CD or USB copies of the full set, sent by post or delivered to the State Bank's one-stop desk (Article 10 Clause 1). For a dossier filed after 6 October 2026: one set and one USB for postal, service-provider, authorised-person and in-person filing (Decree 382 Article 4 Clause 1). If the State Bank asks for a supplement, the applicant has five working days to supply it.
Reporting. Quarterly operating indicators on Appendix IV, due by the 15th of the first month of the next quarter. A preliminary assessment on Appendix V within 15 days after half the testing period has run, and a results assessment at least 90 days before the period ends.
Incidents. An interruption to service, or a serious risk, is reported to the State Bank within 24 hours of its detection (Article 15 Clause 7). The text does not define either term in Article 3, so the trigger is undefined and an organisation takes its own reading with counsel. A written report on Appendix VI follows within three working days after the risk-handling and incident-remediation measures are complete.
Explanations. When the State Bank finds information missing, wrong, erroneous or unsuitable (thiếu, lỗi, sai hoặc không phù hợp), the organisation explains promptly and sends accurate information again (Article 14 Clause 1 point a).
Changes. A change to a tested solution waits for State Bank approval. A Fintech company reports a change of legal representative or general director within 30 days.
Customers. Risk warnings, accurate information, protection of customer data, a complaints process with a five-working-day response, and compensation as the agreement and the law provide.

Explore the Banking, Fintech and Payments Overlay

Technical Provisions and Compliance Obligations

Extension, stop and completion

An extension request is filed at least 90 days before the testing period ends, and each extension runs at most one year, twice at most. The State Bank may stop testing on the grounds Article 19 lists. After a stop the organisation carries out its exit plan, tells its customers at least 30 days before the stop for grounds a and b (at once for grounds c, d, đ, e, g and h), settles their rights within six months and reports the outcome.

A completion certificate is issued on one of two grounds in Article 21 Clause 1. Under (a), an official legal regulation for the Fintech solution has been completed and is in force: the organisation is granted the certificate and then follows the law in force at the time of completion. Under (b), testing has been assessed as not violating current law and the solution is not a conditional business activity. The application is filed on Form No. 11 (Mẫu số 11) with the Appendix V report (Article 21 Clause 2).

What the decree leaves open

The text does not define the terms of the 24-hour incident clock (Article 15 Clause 7): "sự cố gây gián đoạn hoạt động" and "rủi ro nghiêm trọng" are undefined in Article 3. An organisation should take its own reading with counsel.

How ComplianceOne Supports Decree 94/2025 Compliance

Built for Dates and Reports You Can Check

A reporting clock is only as good as its record. ComplianceOne keeps each application's dates, its reports and the evidence each rests on in one place.

A date that has not been entered is shown as missing. The check lists it, so the gap is closed by the organisation before the State Bank reads the file.

Each change to a record is written to an audit log with a timestamp, so who prepared a report, and when it changed, can be shown to a reviewer.

The State Bank decides every application. ComplianceOne holds the dates and the evidence, and does not replace the appraisal or the State Bank's decision.