DPO Radio
AesirX ComplianceOne | Circular 50/2024 Online Banking Security Vietnam
ACTIVE
Circular 50/2024/TT-NHNN Online Banking Safety and Security
The State Bank's security rules for online banking
Keep the security duties, the transaction-confirmation rules and the reports of Circular 50/2024/TT-NHNN in one framework, with the dates Circular 77/2025/TT-NHNN sets, including the provider-class dates for its Articles 3 and 10. In force since 1 January 2025.
Circular 50/2024/TT-NHNN: Scope and Current Status
If your organisation (a credit institution, foreign bank branch, payment intermediary, mobile-money provider or credit information company) provides online banking, these are the security duties it must meet. Some of them changed in 2026, so the dates matter as much as the duties.
The State Bank of Vietnam issued Circular 50/2024/TT-NHNN on 31 October 2024. It applies to credit institutions, foreign bank branches, payment intermediary service providers and credit information companies that provide online banking. From 1 March 2026, Circular 77/2025 extends it to mobile-money service providers as well. Its general effective date is 1 January 2025.
All staged commencement dates under Circular 50 and Circular 77 have passed. The current rules include biometric presentation-attack-detection certification (Circular 77 Article 7(1)) and the relevant certification copies in the pre-launch report. Circular 50 also ends Circulars 35/2016 and 35/2018 and repeals Article 25 of Circular 09/2020.
Circular 77/2025/TT-NHNN amends it. Its Article 10 replaces the annexes that classify payments and set their confirmation methods (Annexes 01, 02 and 04). The date depends on the customers you serve:
- Individual customers only: 1 March 2026 (by exclusion, from Article 12(1) of Circular 77).
- Individuals and organisations: 1 July 2026.
- Organisations only: 1 October 2026.
Circular 77's current amendments include confirmation when identity details change, revised annexes, PAD biometric certification and the revised electronic-signature methods. Under Article 11(8), as amended by Circular 77 Article 7(2), PGP replaces the general electronic-signature method. Article 11(9), amended by Circular 77 Article 7(3), requires a digital signature or a recognised foreign electronic signature for the safe electronic-signature method.
Circular 50 Article 23 allows earlier payment-account, e-wallet and card auto-debit registrations to continue to the end of their agreed term, or to 31 December 2026 where no term is set. Circular 77 Article 9 provides that mobile-money auto-debit registrations made before the Circular took effect continue to the end of their agreed term, or to 31 December 2026 where no term is set. Amendments, additions and extensions must follow Article 10(2). Circular 77 Article 6(3) applies that confirmation rule to mobile-money auto-debits.
Technical Provisions and Compliance Obligations
The table lists what each group of Articles requires and what your organisation does about it. The duties are yours. The platform records your work against them and does not perform them.
| Article | What it requires | What your organisation does |
|---|---|---|
| Article 3 | The system must meet information-system security level 3 or higher, or level 4 or higher for a system providing financial switching or electronic clearing, and the TCVN 11930:2017 standard. Its security must be tested and assessed every year. A level determined under Law 86/2015/QH13 is kept from 1 July 2026, and the system must meet the conditions, standards and cybersecurity protection measures for that level under Law 116/2025/QH15 within 12 months from that date (Law 116/2025/QH15 Article 45(1)); the Law does not state the last day. | Record the security level, the law it was determined under, and each annual assessment with its findings and their closure. |
| Article 3 and Article 10 | Classify each payment into the Annex 01 groups, and apply the Annex 02 confirmation method for its class. Card payments follow Annex 03 and Annex 04. | Decide and document the classification in your own systems. The annex tables are held as guidance; the platform does not classify transactions. |
| Article 4 and Article 6 | Protect the network with firewalls, DoS and DDoS defence and security event management. Keep a disaster-recovery database that can replace the primary one. | Your network and database teams own these controls. Record their review dates. |
| Article 7 | Encrypt data sent over the network or exchanged with related devices, end to end. Under Circular 77, application security testing must address the applicable OWASP requirements for web and mobile banking applications. The previous Circular 50 wording identified additional examples of attack techniques and vulnerability classes. These remain useful considerations for security testing, but they should not be described as a separately preserved mandatory list under the amended provision. Assess the deployment risk of each release. Keep device, transaction and confirmation logs online for three months and backed up for one year. | Keep the test records, the release risk assessments and the log retention settings with each change. |
| Article 8 | Register Mobile Banking in the official app store or, where that is not possible for an objective reason, give installation guidance and report to the State Bank's Information Technology Department before the service starts. Protect the app against reverse engineering and tampering. Review the security of the versions customers may install every three months (Circular 77, Article 5). | Record each three-monthly review and each version's release date. |
| Article 11 | A secret-code password of at least eight characters with digits and both letter cases, valid for no more than 12 months. An SMS OTP valid for no more than five minutes. A two-channel request valid for no more than five minutes. EMV 3-D Secure for card payments. | Configure your authentication methods. ComplianceOne does not issue or run them. |
| Article 12 and Article 19 | Assign staff to monitor the system and handle incidents. Protect customer data, and encrypt or mask confirmation secrets when stored. Notify each affected customer and the State Bank if customer data is exposed. | Name the owners. Record each incident and each notice given. |
| Article 14 | Track published vulnerabilities. Scan internet-facing components every three months and the rest at least once a year. Patch within the set periods. | Track each vulnerability as a task with its patch date. |
| Article 15 | Collect complete logs from each component, and alert on abnormal transactions. | Your monitoring systems do this. ComplianceOne does not monitor transactions. |
| Article 16 | Build a disaster-recovery system and continuity scenarios. Review each continuity situation, ranked from high to low, every six months, and rehearse the response for high-risk situations at least once a year. | Schedule the reviews and the drills as tasks, and keep the records. |
| Article 17 | Publish service information before or at the point of registration. Do not send SMS or email containing a hyperlink unless the customer asks for it. | Your messaging systems enforce the hyperlink rule. ComplianceOne does not send or screen your messages. |
| Article 20 | Send a written pre-launch report to the State Bank's Information Technology Department at least 10 working days before launch, with the certificates that Article 11(5)(c) and Article 11(7)(c) name (biometric matching and FIDO). The current pre-launch report includes the relevant biometric-matching and FIDO certification copies required by Article 20(1)(b)(iv), including the amended PAD requirement. Provide an ad hoc report when the State Bank asks for one. | Your organisation files both reports. ComplianceOne does not file them, and does not work out the due date of the pre-launch report. |
| Article 23 and Article 24 | Auto-debit registrations made before the Circular took effect continue: a fixed-term agreement to the end of its term, and a no-fixed-term agreement until 31 December 2026. Circular 77 Article 9 adds mobile-money accounts. The named leaders of each organisation are responsible for implementing the Circular. | Decide the auto-debit position for each agreement: a fixed-term agreement at its term end, a no-fixed-term agreement by 31 December 2026. Record who the named leaders are. |
The timelines below are the periods the signed text states. Each one is stated in the framework record.
| Obligation | Timeline | Reference |
|---|---|---|
| Pre-launch report to the State Bank | At least 10 working days before launch | Article 20(1)(a) |
| Annual security assessment | Every year | Article 3(4) |
| Review of the approved software list | Every six months | Article 5(2) |
| Review of each continuity situation, ranked by risk | Every six months | Article 16(1) |
| Continuity drill for high-risk situations | Every year | Article 16(3) |
| Security training for system-administration and operations staff | Every year | Article 12(3) |
| Online logs kept online, then backed up | Three months online, one year backed up | Article 7(7) |
| Vulnerability scan of internet-facing components | Every three months | Article 14(5) |
| Patch a critical vulnerability | One day (internet-facing); one month (other) | Article 14(6)(a) |
| Patch a high-rated vulnerability | One day (internet-facing); two months (other) | Article 14(6)(b) |
| Mobile Banking app version review | Every three months | Circular 77, Article 5 |
| Password or PIN maximum validity | 12 months | Article 11(1)(b) and (2) |
| Default password validity | 30 days | Article 11(1)(b) and (2) |
| SMS OTP validity | Five minutes | Article 11(3)(a) |
| Two-channel confirmation request validity | Five minutes | Article 11(4) |
| Auto-debit transition ends for no-fixed-term agreements (fixed-term agreements run to the end of their term) | 31 December 2026 | Article 23(1) |
Forms and Data Requirements
The signed text assigns no official form to this Circular. Its Annexes 01 to 04 are classification and confirmation tables, carried as guidance, not as forms to file.
How ComplianceOne Supports Circular 50/2024/TT-NHNN Work
ComplianceOne keeps this framework on your record, and your work around it, in one place. It does not perform your organisation's duties.
- The framework record. Under Localization, the framework's tabs show its requirements, deadlines, procedures, annex guidance and risk areas, each with its article. The Fines & Risks tab lists its three risk areas. The signed text states no monetary fine, so none is recorded.
- The sector overlay. The Circular is listed in the sector overlay catalogue as a banking instrument, with its status and dates.
- Tasks and the calendar. Track each duty you act on as a task, with an owner and a due date. The task calendar shows the dates you set.
- Vendor reviews. Where a third party supports your straight-through processing, its review is recorded under vendor risk.
- Incidents and the audit trail. Record an incident and each breach notice under Incidents. The audit trail records each change to them.
What ComplianceOne Does Not Do Under This Circular
Most of these duties sit inside your systems. A platform cannot take them over, and ComplianceOne does not try to.
- It does not classify your payments, choose their confirmation methods or confirm a customer's payment.
- It does not run your authentication methods: SMS, voice, email, matrix, soft and token OTP, biometric matching, FIDO or EMV 3-D Secure.
- It does not file the pre-launch report or any ad hoc report, and it does not compute the due date of either.
- It holds no State Bank approval, certification or security certificate. The pre-launch report needs such certificates from your organisation.
- It does not guarantee the availability of your service. Article 17(2)(c) makes your organisation's commitment to interruption times its duty, and Article 16 makes continuity your duty.
- It does not send or screen your SMS or email messages for hyperlinks.
- This Circular has no operational register in ComplianceOne yet. Its requirements and deadlines are on the framework record. The platform does not compute your due dates from them.
Built for Keeping Circular 50 Work on the Record, Not in Email
A duty with a date needs an owner and a trail. Each duty you act on becomes a task with an owner and a due date. Overdue tasks show on the task list, so nothing depends on who remembers.
The Circular's periods sit on the framework's record beside each article they come from. You decide which of them become tasks. The platform does not invent a due date for you.
A customer-data exposure is recorded once, as an incident. Its breach notices are kept under Incidents, and the audit trail keeps who changed them and when.
Where a third party supports your straight-through processing, its review is kept with the provider it covers, so the file is complete when an examiner asks for it.
Related Modules
Localization
The framework record: requirements, deadlines, procedures, annex guidance and risk areas, each with its article.
Explore Localization
Task Management
Track each duty and each deadline you act on as a task, with an owner and a due date.
Explore Task Management
Vendor Risk
Record the review of a third party that supports straight-through processing.
Explore Vendor Risk
Incident Response
Record a customer-data exposure and each breach notice given.
Explore Incident Response
Audit TrailCompliance Readiness Checklist
Organisations implementing Circular 50/2024/TT-NHNN should confirm:
See Circular 50/2024 Compliance in Action
Ready to see how ComplianceOne keeps Circular 50/2024 duties, dates and records in one place? Request a demo tailored to your organisation's needs.
Ronni K. Gothard Christiansen - Technical Privacy Engineer & CEO
Technical Compliance Expert, 32+ Years Open Source Advocate, X-BoD Open Source Matters Inc.
Frequently Asked Questions
No. Compliance is your organisation's own work. ComplianceOne holds the framework's text, its requirements and deadlines, and the tasks, incidents and audit trail around your work.
Circular 77 Article 3 and Article 10 apply by provider class. For those, the date depends on the customers you serve: 1 March 2026 for individual customers only (by exclusion, from Article 12(1) of Circular 77), 1 July 2026 for individuals and organisations, and 1 October 2026 for organisations only. Every other Circular 77 amendment, including Article 6, applies from 1 March 2026 for every provider.
Circular 50 Article 2(11), inserted by Circular 77 Article 2, defines a new organisational customer and lists organisations it does not include. Point (e) of that list, Circular 50 Article 2(11)(e), is other organisations your organisation selects. An organisation that your organisation selects under point (e) is not treated as a new organisational customer, and your organisation bears full responsibility for the risks of that selection. In that case, your organisation must also ensure that the customer is accurately verified, and it bears full responsibility for customer identification. For a selection under point (e), record the verification and the organisation’s responsibility for the risks of its selection.
No. Article 21(2), as replaced by Circular 77 Article 8, refers violations to the law. The signed text states no monetary fine.
Circular 50 Article 23 allows earlier payment-account, e-wallet and card auto-debit registrations to continue to the end of their agreed term, or to 31 December 2026 where no term is set. Circular 77 Article 9 provides that mobile-money auto-debit registrations made before the Circular took effect continue to the end of their agreed term, or to 31 December 2026 where no term is set. Amendments, additions and extensions must follow Article 10(2). Circular 77 Article 6(3) applies that confirmation rule to mobile-money auto-debits.
No. ComplianceOne holds no State Bank approval or certification. Your organisation files the pre-launch report, with the certificates that Article 11(5) and (7) name (biometric matching and FIDO).
Next Steps
Start a Compliance Pilot
Set up the Circular's requirements, deadlines and your first tasks in a pilot workspace.
Discuss Your Compliance Needs
Talk through your provider class, your Circular 77 dates and the auto-debit position with our team.
The evolution of Aesir is Aesir + 
(the Norse symbol for Necessity)"Needed in order to achieve a particular result"
♥Join the AesirX Privacy Newsletter. Stay Informed. Stay Compliant.
