DPO Radio

If you operate an important payment system, or you provide payment-intermediary services under a State Bank licence, you have reported under Circular 41/2024/TT-NHNN since 17 July 2024. Banks that cooperate with payment intermediaries report under it too. The State Bank issued it on 17 July 2024 and it replaced Circular 20/2018/TT-NHNN.
What it asks of you:
From 1 July 2027, Circular 47/2026/TT-NHNN amends Circular 41. It replaces Appendices II–VI and rewrites the inspection provisions (Article 7, and Article 12(2) for intermediaries), after which inspection procedure follows the Governor's rules. Three of its changes reach reporting:
The reporting deadlines and notices in Articles 15–17 and the four forms do not change. Circular 47 states no transitional rule for a period that runs across 1 July 2027.

Circular 41 is an optional banking addition for one activity: reporting to the State Bank as a supervised payment organisation. It sits beside the banking, fintech and payments overlay, which covers the customer due-diligence, account and card rules for the services you report on.
Its legal basis for payments is Decree 52/2024/NĐ-CP on non-cash payments. Circular 47/2026/TT-NHNN is a separate addition that amends it from 1 July 2027. Keep Circular 41 in your workspace when you add Circular 47: it still holds the deadlines and the forms, and the Supervisory Reporting register keeps computing due dates from its deadline records after 1 July 2027.
| Provision | What It Requires | What You Need |
|---|---|---|
| Articles 2–3, Appendix II | Three supervised roles: operator of an important payment system, payment intermediary, cooperating bank. A member of a system is not its operator. From 1 July 2027 every licensed switching or clearing provider operates that system | A record of which roles you hold |
| Article 15(1) | Reports are electronic files carrying the lawful representative's electronic signature, sent through a State Bank channel | The signed file and the receipt for every period |
| Article 15(2) | Deadlines for day, month, quarter, first six months and year, with the holiday roll-forward | A reporting calendar with an owner for every report |
| Article 16(1) | Operators report system data (Appendix IV), an operations report half-yearly and annually (Form No. 01), and an assessment every three years (Form No. 04) | Data owners, narratives and the three-yearly assessment on file |
| Articles 16(2), 17(2) | Notify an interruption of more than 30 minutes at once; file Form No. 03 within 3 working days of remediation | The detection time, the email sent, the remediation date and the report |
| Article 16(3) | Operators send process, risk-policy and membership-rule changes within 15 working days | The change, its date and the email sent |
| Article 17(1), Appendix VI | Intermediaries report for quarters I, II and III and for the year on Form No. 02 and Appendix VI, service by service | Per-service figures and the Form No. 02 narrative |
| Article 17(3) | E-wallet providers send each cooperating-bank contract within 3 working days of it taking effect | The contract, its effective date and the email sent |
| Article 17(4) | Intermediaries connect an online-monitoring tool to the State Bank from 1 October 2024 | A record of the connection and the guidance followed |
| Article 18 | Cooperating banks report on Appendix V under the statistical reporting regime; its indicators are monthly from 1 July 2027 | The regime's deadline, recorded with its source |
| Articles 6(2)(c), 11(2)(c), 7(1) | Explain and resend data the Supervision Unit finds wrong. For an operator, uncorrected data are grounds for an inspection | Every request, the root cause and the corrected data |
| Articles 11(1)(h), 17(5), 18(3) | Supply information the Supervision Unit requests | Each request, its reference, its owner, the deadline it states and when you answered |
| Articles 7, 12 | Support on-site inspection with documents, data and IT access | The inspection decision, the minutes, what you disclosed and who approved it |
| Articles 7(5), 9(2), 14(2) | Implement recommendations and report by the deadline set | Each recommendation, from inspection minutes or a supervision letter, its deadline and your report |
| Obligation | Timeline | Reference |
|---|---|---|
| Circular takes effect | 17 July 2024 | Article 25(1) |
| Online-monitoring tool (intermediaries) | 1 October 2024 | Article 25(2) |
| Daily report | 14:00 on the next working day, where an annex assigns a daily period | Article 15(2)(a) |
| Monthly report | 12th of the next month, where an annex assigns a monthly period (from 1 July 2027, an operator's monthly Appendix IV indicators) | Article 15(2)(b) |
| Quarterly report | 15th of the first month of the next quarter; intermediaries file for quarters I, II and III | Articles 15(2)(c), 17(1) |
| First-six-months report | 20 July | Article 15(2)(d) |
| Annual report | 20 January | Article 15(2)(đ) |
| Interruption of more than 30 minutes | Notify at once | Articles 16(2), 17(2) |
| Incident report (Form No. 03) | 3 working days after remediation | Articles 16(2), 17(2) |
| Operator change notice | 15 working days | Article 16(3) |
| E-wallet contract copy | 3 working days | Article 17(3) |
| Assessment report (Form No. 04) | Every 3 years; first due date and channel as the State Bank's guidance sets | Article 16(1)(c) |
| Information request | As the request sets; the Circular states no period | Articles 11(1)(h), 17(5), 18(3) |
| Recommendation report | As the recommendation sets | Articles 7(5), 9(2), 14(2) |
| Circular 47 amendment | 1 July 2027; online-monitoring indicators 1 October 2027 | Circular 47, Article 9 |
| Form / Annex | Official ID | Purpose | Required For |
|---|---|---|---|
| Operations report of an important payment system | Form No. 01 (Mẫu số 01) | Service quality, risks and incidents, membership, changes | Operators, half-yearly and annually |
| Payment-intermediary activity report | Form No. 02 (Mẫu số 02) | Results, service quality including complaint handling, risks, personnel | Intermediaries, quarters I–III and annually |
| Incident report | Form No. 03 (Mẫu số 03) | Time, description, cause, duration in minutes, remediation | Operators and intermediaries |
| Assessment report | Form No. 04 (Mẫu số 04) | Rating against the international principles for financial market infrastructures | Operators, every three years |
Appendix II lists the important payment systems; Appendices III–VI are indicator tables, not forms. From 1 July 2027 Circular 47 replaces Appendices II–VI; Appendix I and its four forms stay.

Once Circular 41 is added to your workspace, you work from twenty-two requirements. Eighteen are duties the Circular states, and four are recommended practice, labelled as such. You get the four annexed forms, Form No. 01–04, in the Form Catalog in Vietnamese and English, and five internal records: a reporting calendar, an interruption notice log, a change and contract submission record, a supervisory request log and a recommendation tracker. The day-to-day work happens in the Supervisory Reporting register, under Governance › Payments & eKYC Evidence.
The rules in force on the date you choose. The register opens on today's rules and has a Rules in force on date. Until 30 June 2027 it shows the Circular 41 annex sections your reporting roles reach. With Circular 47 also in your workspace, it shows the replacement annexes from 1 July 2027, and it tells you when a different set of rules begins. Beside that notice, What changes lists the values that change on the new date: the sections a role reaches, the inspection bases, the defect types, the periodicities and the commencement dates. It also lists the indicators you recorded whose periodicity or commencement the new set no longer declares. One register carries you across the amendment.
A reporting calendar of what your roles owe. The Reporting calendar tab lists each periodic report the roles you hold owe, period by period. Each row shows its due date, the deadline record the date came from and its state: not started, open, submitted or overdue. The calendar is worked out from the installed Circular and your checks each time you open it, so removing a role or updating the applicable reviewed calendar changes current calculations. A company-only closure does not change a statutory reporting date. A payment intermediary sees quarters I, II and III and the year, and no fourth-quarter report. A report the Circular gives no clock, such as the three-yearly Form No. 04 or the cooperating bank's statistical reporting, is listed without a date, with the reason.
A sourced due date for reports the Circular clocks. Each submission check records the report, the reporting period and its last day. Where Circular 41 states the clock for that period, ComplianceOne computes the due date from that deadline record. Article 15(2)(e) permits a move only for an official public holiday, Tết or a weekend. The reporting calendar uses a separately reviewed official schedule with its source, coverage, workweek and timezone. Company holidays do not extend the legal deadline. A sourced applicable official make-up working day counts as working. Missing or insufficiently covered calendar evidence leaves the adjusted date unconfirmed; it does not extend the filing duty. The check names the record the date came from. The date is fixed when the check is approved, and an unsent report past it reads Overdue in words. Where no installed record states a clock, you record the provision the deadline comes from, and ComplianceOne adds no date of its own.
The submission, recorded after approval. A check keeps who prepared the report, the signatory, the channel used, the date and time your organisation submitted, the signed-file and receipt references and the filled forms it covers. Circular 41's records make the signatory and the channel required to record a submission, and the preparer required to approve, and the register holds you to that. You record the submission after the check is approved without reopening the approval.
Separate company and statutory calendars. Settings keeps operational company closures separate from the sourced calendar these reporting clocks select. An authorised maintainer records the applicable official sources, weekend/workweek, public holidays, Tết and official make-up working days, with an explicit coverage and completeness decision. ComplianceOne checks the record and uses that declared basis; it does not supply or authenticate government schedules. A reviewed interval with no exceptions differs from an unconfigured empty calendar. Company holiday edits cannot extend these statutory dates. Approved checks keep their historical date and calendar evidence; current changes are shown separately, without rewriting the approval. Earlier approvals without calendar provenance say so. There is no reopen or replacement workflow for a historical approved check in this change.
Requests from the Supervision Unit. The Requests and corrections tab records each request: its kind, its reference, what it asks for, its owner and the deadline the request itself states. ComplianceOne computes no deadline for a request. Where the request states none, the record says so and never reads overdue. A request to explain and resend data also records the section, the defect type, the root cause and the correction, and an answer sent after the stated deadline shows as late.
Interruptions measured from the incident record. You record the interruption window once, on the incident: when the service stopped, when it came back and when remediation was completed. An immediate notice is owed once the interruption lasts longer than the 30-minute threshold in the installed record. The incident's own card says so to anyone who can read the register, and links to the notice. The register lists every such interruption with no notice recorded, and its overview counts them. The Form No. 03 incident report is due 3 working days after remediation is completed, counted from that record, not from detection or from closing the ticket. You record when the notice was sent, what it said and when the report went, and you link the filled Form No. 03, labelled official. A report past its due date reads Overdue.
Change and contract notices on their working-day clocks. On the Change and contract notices tab, an operator's process, risk-policy or membership-rule change is due 15 working days after the change. An e-wallet provider's cooperating-bank contract is due 3 working days after it takes effect. Both due dates are counted from the installed deadline records, and each notice keeps the date you sent it and its evidence.
Evidence files, bound to what they prove. You upload the signed report file, the receipt, the notice email or the report on a recommendation to the record it proves. That is a check, a notice, a request, a recommendation or an inspection. A file a record names cannot be deleted, and a file that is no longer held says so. A text reference still records material held elsewhere.
Recommendations that close on your report. The Recommendations tab lists every recommendation in one place: those from inspection minutes and those from a supervision letter, which needs no inspection record. Each keeps its source, reference, owner, deadline, the date your report was sent and the date you closed it internally. A recommendation from a supervision letter also keeps the measures taken and its evidence files; one from an inspection is recorded on the inspection, with the inspection's files. A recommendation with a deadline cannot be closed internally before its report is sent. An inspection cannot be closed while one of its recommendations with a deadline has no report date, and the register names the one still open.
Inspections with their decision and minutes. Each inspection records the reference of the inspection decision and the date it was received, and the reference of the minutes. Every change is kept in the audit trail.
Evidence packs an inspector can read. You can export one evidence pack per reporting period and one per inspection, as CSV, Excel, PDF or Word. The period pack lists the calendar rows with their state and due-date source, and the checks with who prepared, signed and sent them. It adds the requests, the recommendations, the linked incidents, the corrections and which holiday calendar the due dates used. The inspection pack adds the decision and the minutes. Files appear by name and SHA-256 fingerprint, never by content. Every record is labelled official or internal, and the file contains no calculated supervisory figure.
Forseti drafts, a person decides. In the Form Filler, Forseti AI can draft the narrative of a Form No. 01 or Form No. 02 for a person to accept or reject field by field. It does not read the register's records.
ComplianceOne records and evidences your reporting. It does not calculate your indicators, submit or transmit a report, connect to a State Bank system, supervise a payment system or certify that a report is complete, correct or received; you send the reports through the State Bank's systems.
Holds Forms No. 01–04 and the five internal records, labelled official or internal; the four forms open in the Form Filler, including Form No. 03's date-and-time fields, and a filled Form No. 03 links to its interruption notice
Explore Compliance FormsRecords the interruption window (start, end, remediation completed) that each notice and each Form No. 03 due date is read from, and states on the incident whether a notice is owed
Explore Incident OperationsHolds each cooperating-bank contract behind the e-wallet contract submission
Explore GovernanceAssigns report preparation, corrections and recommendations to owners
Explore Task ManagementKeeps every change to a report record, notice or recommendation for inspection
Explore Audit TrailOrganisations implementing Circular 41 compliance should confirm:
See how ComplianceOne keeps a supervised organisation's State Bank reports, interruption notices and inspection recommendations on their deadlines.

No. Your lawful representative signs each report, and it goes through the State Bank's own systems. ComplianceOne holds the submission check, the date you submitted, the signed-file and receipt references and the evidence you attach. It does not connect to a State Bank system.
No. It is the threshold that makes an interruption notifiable. Once an interruption passes 30 minutes, you notify at once. The 3-working-day clock for Form No. 03 starts when remediation is complete, not when the incident is detected.
No. From 1 July 2027 it amends Circular 41: it replaces Appendices II–VI and rewrites the inspection provisions (Articles 7 and 12(2)). The reporting deadlines, the notices and Forms No. 01–04 stay in Circular 41. Keep both in your workspace.
For one system, yes. From 1 July 2027 every organisation the State Bank licenses to provide financial switching or electronic clearing services is an operator of the switching and clearing system, where Circular 41 named one company. Each such operator files the operator's reports and notices for that system. The roles and the reports each role files do not change otherwise.
For an operator of an important payment system, yes. That has been the case since 2024 under Article 7(1): data the Supervision Unit finds wrong and that stay uncorrected are grounds for an on-site inspection. For payment intermediaries, the inspection grounds are in Article 12(1).
No. You produce the figures from your own systems. ComplianceOne keeps where each indicator's data comes from and who approved that, the signed-file and receipt references and the evidence you attach, and its evidence packs contain no calculated figure.
From the deadline records Circular 41 states, installed with it. A quarterly, half-yearly or annual report is due on the date the Circular gives, moved to the next working day only when it falls on an official public holiday, Tết or a weekend under Article 15(2)(e). The check names the record. The daily and monthly clocks apply only where an annex assigns that period. Where no installed record states a clock, you record the provision instead, and no date is computed.
No. It supplies no public-holiday list and does not verify one with the issuing authority. An authorised maintainer records the applicable official sources, weekend/workweek, public holidays, Tết and official make-up working days in a separate Settings calendar, with explicit coverage and completeness review. Company closures cannot extend Article 15(2)(e) deadlines. Missing, unreviewed, withdrawn or uncovered calendar evidence produces an unconfirmed adjusted date, rather than an assumed weekend-only answer. Users still owe the report and must resolve the legal deadline; missing software configuration gives no extension.
No. The Circular states no period for answering a request, so the deadline is the one the request states. You record it, and the register shows it and whether the answer went after it. Where the request states none, the record says so.
Circular 47 has no transitional clause. ComplianceOne reads a period under the rules in force on its last day, and says this is its reading, not the text. On that reading, the first-six-months 2027 report, due by 20 July 2027, uses Circular 41's annexes, and the 2027 annual report uses Circular 47's. Confirm the treatment with the State Bank before relying on it.

Test your reporting calendar, Supervision Unit requests, interruption notices and recommendation follow-up against Circular 41's deadlines and the official holiday and weekend rules.

Review which roles you hold, which reports you owe and what changes on 1 July 2027.