DPO Radio

AesirX ComplianceOne | Circular 41 Payment-System Supervision

Overview Image

Circular 41/2024/TT-NHNN: Scope and Current Status

If you operate an important payment system, or you provide payment-intermediary services under a State Bank licence, you have reported under Circular 41/2024/TT-NHNN since 17 July 2024. Banks that cooperate with payment intermediaries report under it too. The State Bank issued it on 17 July 2024 and it replaced Circular 20/2018/TT-NHNN.

What it asks of you:

  • Fixed reporting deadlines. Quarterly reports by the 15th of the next quarter's first month, the first-six-months report by 20 July and the annual report by 20 January. The Circular also sets a daily clock (14:00 the next working day) and a monthly one (the 12th). They apply only where an annex gives a report that period. None of the reports an organisation files under the annexes in force today has one; from 1 July 2027 an operator's monthly Appendix IV indicators fall due on the 12th. Intermediaries report for quarters I, II and III and for the year, with no separate fourth-quarter report. Article 15(2)(e) moves a reporting deadline to the next working day only when it falls on an official public holiday, Tết or a weekend. Company holidays do not extend the statutory deadline.
  • Electronic, signed reports. Each report is an electronic file carrying your lawful representative's electronic signature, sent to the State Bank through its reporting information system, its online-monitoring system or another electronic method it designates.
  • Immediate interruption notices. If an incident interrupts your system or service for more than 30 minutes, tell the Supervision Unit at once by email. File the incident report (Form No. 03) within 3 working days of finishing the fix.
  • Event notices. Operators send changes to processes, risk policy or membership rules within 15 working days. E-wallet providers send each cooperating-bank contract within 3 working days of it taking effect.
  • Inspection and recommendations. Give inspectors documents, data and access to your IT systems. Carry out their recommendations and report back by the deadline each one sets.

From 1 July 2027, Circular 47/2026/TT-NHNN amends Circular 41. It replaces Appendices II–VI and rewrites the inspection provisions (Article 7, and Article 12(2) for intermediaries), after which inspection procedure follows the Governor's rules. Three of its changes reach reporting:

  • More operators. Circular 41 named one company as the operator of the financial switching and electronic clearing system. From 1 July 2027 every organisation the State Bank licenses to provide financial switching or electronic clearing services is that system's operator, with the operator's reports and notices.
  • Monthly operator indicators. Some indicators in each section of the replaced Appendix IV are monthly; the rest stay first-six-months and year.
  • Monthly Appendix V. Every indicator in the replaced Appendix V is monthly, where Circular 41's were quarterly and annual. The cooperating bank still reports under the statistical reporting regime, so that regime sets its periods and deadlines.

The reporting deadlines and notices in Articles 15–17 and the four forms do not change. Circular 47 states no transitional rule for a period that runs across 1 July 2027.

Overview Image

How Circular 41/2024/TT-NHNN Relates to the Banking Overlays

Circular 41 is an optional banking addition for one activity: reporting to the State Bank as a supervised payment organisation. It sits beside the banking, fintech and payments overlay, which covers the customer due-diligence, account and card rules for the services you report on.

Its legal basis for payments is Decree 52/2024/NĐ-CP on non-cash payments. Circular 47/2026/TT-NHNN is a separate addition that amends it from 1 July 2027. Keep Circular 41 in your workspace when you add Circular 47: it still holds the deadlines and the forms, and the Supervisory Reporting register keeps computing due dates from its deadline records after 1 July 2027.

Technical Provisions and Compliance Obligations

ProvisionWhat It RequiresWhat You Need
Articles 2–3, Appendix IIThree supervised roles: operator of an important payment system, payment intermediary, cooperating bank. A member of a system is not its operator. From 1 July 2027 every licensed switching or clearing provider operates that systemA record of which roles you hold
Article 15(1)Reports are electronic files carrying the lawful representative's electronic signature, sent through a State Bank channelThe signed file and the receipt for every period
Article 15(2)Deadlines for day, month, quarter, first six months and year, with the holiday roll-forwardA reporting calendar with an owner for every report
Article 16(1)Operators report system data (Appendix IV), an operations report half-yearly and annually (Form No. 01), and an assessment every three years (Form No. 04)Data owners, narratives and the three-yearly assessment on file
Articles 16(2), 17(2)Notify an interruption of more than 30 minutes at once; file Form No. 03 within 3 working days of remediationThe detection time, the email sent, the remediation date and the report
Article 16(3)Operators send process, risk-policy and membership-rule changes within 15 working daysThe change, its date and the email sent
Article 17(1), Appendix VIIntermediaries report for quarters I, II and III and for the year on Form No. 02 and Appendix VI, service by servicePer-service figures and the Form No. 02 narrative
Article 17(3)E-wallet providers send each cooperating-bank contract within 3 working days of it taking effectThe contract, its effective date and the email sent
Article 17(4)Intermediaries connect an online-monitoring tool to the State Bank from 1 October 2024A record of the connection and the guidance followed
Article 18Cooperating banks report on Appendix V under the statistical reporting regime; its indicators are monthly from 1 July 2027The regime's deadline, recorded with its source
Articles 6(2)(c), 11(2)(c), 7(1)Explain and resend data the Supervision Unit finds wrong. For an operator, uncorrected data are grounds for an inspectionEvery request, the root cause and the corrected data
Articles 11(1)(h), 17(5), 18(3)Supply information the Supervision Unit requestsEach request, its reference, its owner, the deadline it states and when you answered
Articles 7, 12Support on-site inspection with documents, data and IT accessThe inspection decision, the minutes, what you disclosed and who approved it
Articles 7(5), 9(2), 14(2)Implement recommendations and report by the deadline setEach recommendation, from inspection minutes or a supervision letter, its deadline and your report

ObligationTimelineReference
Circular takes effect17 July 2024Article 25(1)
Online-monitoring tool (intermediaries)1 October 2024Article 25(2)
Daily report14:00 on the next working day, where an annex assigns a daily periodArticle 15(2)(a)
Monthly report12th of the next month, where an annex assigns a monthly period (from 1 July 2027, an operator's monthly Appendix IV indicators)Article 15(2)(b)
Quarterly report15th of the first month of the next quarter; intermediaries file for quarters I, II and IIIArticles 15(2)(c), 17(1)
First-six-months report20 JulyArticle 15(2)(d)
Annual report20 JanuaryArticle 15(2)(đ)
Interruption of more than 30 minutesNotify at onceArticles 16(2), 17(2)
Incident report (Form No. 03)3 working days after remediationArticles 16(2), 17(2)
Operator change notice15 working daysArticle 16(3)
E-wallet contract copy3 working daysArticle 17(3)
Assessment report (Form No. 04)Every 3 years; first due date and channel as the State Bank's guidance setsArticle 16(1)(c)
Information requestAs the request sets; the Circular states no periodArticles 11(1)(h), 17(5), 18(3)
Recommendation reportAs the recommendation setsArticles 7(5), 9(2), 14(2)
Circular 47 amendment1 July 2027; online-monitoring indicators 1 October 2027Circular 47, Article 9

Form / AnnexOfficial IDPurposeRequired For
Operations report of an important payment systemForm No. 01 (Mẫu số 01)Service quality, risks and incidents, membership, changesOperators, half-yearly and annually
Payment-intermediary activity reportForm No. 02 (Mẫu số 02)Results, service quality including complaint handling, risks, personnelIntermediaries, quarters I–III and annually
Incident reportForm No. 03 (Mẫu số 03)Time, description, cause, duration in minutes, remediationOperators and intermediaries
Assessment reportForm No. 04 (Mẫu số 04)Rating against the international principles for financial market infrastructuresOperators, every three years

Appendix II lists the important payment systems; Appendices III–VI are indicator tables, not forms. From 1 July 2027 Circular 47 replaces Appendices II–VI; Appendix I and its four forms stay.

Overview Image

How ComplianceOne Supports Circular 41 Compliance

Once Circular 41 is added to your workspace, you work from twenty-two requirements. Eighteen are duties the Circular states, and four are recommended practice, labelled as such. You get the four annexed forms, Form No. 01–04, in the Form Catalog in Vietnamese and English, and five internal records: a reporting calendar, an interruption notice log, a change and contract submission record, a supervisory request log and a recommendation tracker. The day-to-day work happens in the Supervisory Reporting register, under Governance › Payments & eKYC Evidence.

The rules in force on the date you choose. The register opens on today's rules and has a Rules in force on date. Until 30 June 2027 it shows the Circular 41 annex sections your reporting roles reach. With Circular 47 also in your workspace, it shows the replacement annexes from 1 July 2027, and it tells you when a different set of rules begins. Beside that notice, What changes lists the values that change on the new date: the sections a role reaches, the inspection bases, the defect types, the periodicities and the commencement dates. It also lists the indicators you recorded whose periodicity or commencement the new set no longer declares. One register carries you across the amendment.

A reporting calendar of what your roles owe. The Reporting calendar tab lists each periodic report the roles you hold owe, period by period. Each row shows its due date, the deadline record the date came from and its state: not started, open, submitted or overdue. The calendar is worked out from the installed Circular and your checks each time you open it, so removing a role or updating the applicable reviewed calendar changes current calculations. A company-only closure does not change a statutory reporting date. A payment intermediary sees quarters I, II and III and the year, and no fourth-quarter report. A report the Circular gives no clock, such as the three-yearly Form No. 04 or the cooperating bank's statistical reporting, is listed without a date, with the reason.

A sourced due date for reports the Circular clocks. Each submission check records the report, the reporting period and its last day. Where Circular 41 states the clock for that period, ComplianceOne computes the due date from that deadline record. Article 15(2)(e) permits a move only for an official public holiday, Tết or a weekend. The reporting calendar uses a separately reviewed official schedule with its source, coverage, workweek and timezone. Company holidays do not extend the legal deadline. A sourced applicable official make-up working day counts as working. Missing or insufficiently covered calendar evidence leaves the adjusted date unconfirmed; it does not extend the filing duty. The check names the record the date came from. The date is fixed when the check is approved, and an unsent report past it reads Overdue in words. Where no installed record states a clock, you record the provision the deadline comes from, and ComplianceOne adds no date of its own.

The submission, recorded after approval. A check keeps who prepared the report, the signatory, the channel used, the date and time your organisation submitted, the signed-file and receipt references and the filled forms it covers. Circular 41's records make the signatory and the channel required to record a submission, and the preparer required to approve, and the register holds you to that. You record the submission after the check is approved without reopening the approval.

Separate company and statutory calendars. Settings keeps operational company closures separate from the sourced calendar these reporting clocks select. An authorised maintainer records the applicable official sources, weekend/workweek, public holidays, Tết and official make-up working days, with an explicit coverage and completeness decision. ComplianceOne checks the record and uses that declared basis; it does not supply or authenticate government schedules. A reviewed interval with no exceptions differs from an unconfigured empty calendar. Company holiday edits cannot extend these statutory dates. Approved checks keep their historical date and calendar evidence; current changes are shown separately, without rewriting the approval. Earlier approvals without calendar provenance say so. There is no reopen or replacement workflow for a historical approved check in this change.

Requests from the Supervision Unit. The Requests and corrections tab records each request: its kind, its reference, what it asks for, its owner and the deadline the request itself states. ComplianceOne computes no deadline for a request. Where the request states none, the record says so and never reads overdue. A request to explain and resend data also records the section, the defect type, the root cause and the correction, and an answer sent after the stated deadline shows as late.

Interruptions measured from the incident record. You record the interruption window once, on the incident: when the service stopped, when it came back and when remediation was completed. An immediate notice is owed once the interruption lasts longer than the 30-minute threshold in the installed record. The incident's own card says so to anyone who can read the register, and links to the notice. The register lists every such interruption with no notice recorded, and its overview counts them. The Form No. 03 incident report is due 3 working days after remediation is completed, counted from that record, not from detection or from closing the ticket. You record when the notice was sent, what it said and when the report went, and you link the filled Form No. 03, labelled official. A report past its due date reads Overdue.

Change and contract notices on their working-day clocks. On the Change and contract notices tab, an operator's process, risk-policy or membership-rule change is due 15 working days after the change. An e-wallet provider's cooperating-bank contract is due 3 working days after it takes effect. Both due dates are counted from the installed deadline records, and each notice keeps the date you sent it and its evidence.

Evidence files, bound to what they prove. You upload the signed report file, the receipt, the notice email or the report on a recommendation to the record it proves. That is a check, a notice, a request, a recommendation or an inspection. A file a record names cannot be deleted, and a file that is no longer held says so. A text reference still records material held elsewhere.

Recommendations that close on your report. The Recommendations tab lists every recommendation in one place: those from inspection minutes and those from a supervision letter, which needs no inspection record. Each keeps its source, reference, owner, deadline, the date your report was sent and the date you closed it internally. A recommendation from a supervision letter also keeps the measures taken and its evidence files; one from an inspection is recorded on the inspection, with the inspection's files. A recommendation with a deadline cannot be closed internally before its report is sent. An inspection cannot be closed while one of its recommendations with a deadline has no report date, and the register names the one still open.

Inspections with their decision and minutes. Each inspection records the reference of the inspection decision and the date it was received, and the reference of the minutes. Every change is kept in the audit trail.

Evidence packs an inspector can read. You can export one evidence pack per reporting period and one per inspection, as CSV, Excel, PDF or Word. The period pack lists the calendar rows with their state and due-date source, and the checks with who prepared, signed and sent them. It adds the requests, the recommendations, the linked incidents, the corrections and which holiday calendar the due dates used. The inspection pack adds the decision and the minutes. Files appear by name and SHA-256 fingerprint, never by content. Every record is labelled official or internal, and the file contains no calculated supervisory figure.

Forseti drafts, a person decides. In the Form Filler, Forseti AI can draft the narrative of a Form No. 01 or Form No. 02 for a person to accept or reject field by field. It does not read the register's records.

ComplianceOne records and evidences your reporting. It does not calculate your indicators, submit or transmit a report, connect to a State Bank system, supervise a payment system or certify that a report is complete, correct or received; you send the reports through the State Bank's systems.

Related Modules

Compliance FormsCompliance Forms

Holds Forms No. 01–04 and the five internal records, labelled official or internal; the four forms open in the Form Filler, including Form No. 03's date-and-time fields, and a filled Form No. 03 links to its interruption notice

Explore Compliance Forms

Incident OperationsIncident Operations

Records the interruption window (start, end, remediation completed) that each notice and each Form No. 03 due date is read from, and states on the incident whether a notice is owed

Explore Incident Operations

GovernanceGovernance

Holds each cooperating-bank contract behind the e-wallet contract submission

Explore Governance

Task ManagementTask Management

Assigns report preparation, corrections and recommendations to owners

Explore Task Management

Audit TrailAudit Trail

Keeps every change to a report record, notice or recommendation for inspection

Explore Audit Trail

Compliance Readiness Checklist

Organisations implementing Circular 41 compliance should confirm:

You have recorded which of the three supervised roles you hold.

The separate statutory calendar records applicable official sources, public holidays, Tết, official make-up days, weekend/workweek and coverage; it is reviewed, and company closures are excluded.

Every report your roles owe is on the reporting calendar, and each check names its preparer, signatory and channel.

Each submitted report has its signed file and receipt on the check.

Every interruption of more than 30 minutes has a sent notice and a Form No. 03 on file.

Operator changes and e-wallet contracts are logged with their 15- and 3-working-day due dates.

Each Supervision Unit request has an owner and the deadline it states, and each figure it questioned has a root cause and a correction date.

Each recommendation, from an inspection or a supervision letter, has an owner, a deadline and a report date.

Before 1 July 2027 you have listed the indicators that Circular 47's new annexes change, and checked whether you become an operator of the switching and clearing system.

Background Image

See Circular 41 Compliance in Action

See how ComplianceOne keeps a supervised organisation's State Bank reports, interruption notices and inspection recommendations on their deadlines.

Demo Image
Ronni K. Gothard Christiansen

Ronni K. Gothard Christiansen - Technical Privacy Engineer & CEO

Technical Compliance Expert, 32+ Years Open Source Advocate, X-BoD Open Source Matters Inc.

Or contact via

ronni@aesirx.io+84 909 500 760

Frequently Asked Questions

No. Your lawful representative signs each report, and it goes through the State Bank's own systems. ComplianceOne holds the submission check, the date you submitted, the signed-file and receipt references and the evidence you attach. It does not connect to a State Bank system.

No. It is the threshold that makes an interruption notifiable. Once an interruption passes 30 minutes, you notify at once. The 3-working-day clock for Form No. 03 starts when remediation is complete, not when the incident is detected.

No. From 1 July 2027 it amends Circular 41: it replaces Appendices II–VI and rewrites the inspection provisions (Articles 7 and 12(2)). The reporting deadlines, the notices and Forms No. 01–04 stay in Circular 41. Keep both in your workspace.

For one system, yes. From 1 July 2027 every organisation the State Bank licenses to provide financial switching or electronic clearing services is an operator of the switching and clearing system, where Circular 41 named one company. Each such operator files the operator's reports and notices for that system. The roles and the reports each role files do not change otherwise.

For an operator of an important payment system, yes. That has been the case since 2024 under Article 7(1): data the Supervision Unit finds wrong and that stay uncorrected are grounds for an on-site inspection. For payment intermediaries, the inspection grounds are in Article 12(1).

No. You produce the figures from your own systems. ComplianceOne keeps where each indicator's data comes from and who approved that, the signed-file and receipt references and the evidence you attach, and its evidence packs contain no calculated figure.

From the deadline records Circular 41 states, installed with it. A quarterly, half-yearly or annual report is due on the date the Circular gives, moved to the next working day only when it falls on an official public holiday, Tết or a weekend under Article 15(2)(e). The check names the record. The daily and monthly clocks apply only where an annex assigns that period. Where no installed record states a clock, you record the provision instead, and no date is computed.

No. It supplies no public-holiday list and does not verify one with the issuing authority. An authorised maintainer records the applicable official sources, weekend/workweek, public holidays, Tết and official make-up working days in a separate Settings calendar, with explicit coverage and completeness review. Company closures cannot extend Article 15(2)(e) deadlines. Missing, unreviewed, withdrawn or uncovered calendar evidence produces an unconfirmed adjusted date, rather than an assumed weekend-only answer. Users still owe the report and must resolve the legal deadline; missing software configuration gives no extension.

No. The Circular states no period for answering a request, so the deadline is the one the request states. You record it, and the register shows it and whether the answer went after it. Where the request states none, the record says so.

Circular 47 has no transitional clause. ComplianceOne reads a period under the rules in force on its last day, and says this is its reading, not the text. On that reading, the first-six-months 2027 report, due by 20 July 2027, uses Circular 41's annexes, and the 2027 annual report uses Circular 47's. Confirm the treatment with the State Bank before relying on it.

Next Steps

Icon Image

Start a Compliance Pilot

Test your reporting calendar, Supervision Unit requests, interruption notices and recommendation follow-up against Circular 41's deadlines and the official holiday and weekend rules.

Icon Image

Discuss Your Compliance Needs

Review which roles you hold, which reports you owe and what changes on 1 July 2027.