DPO Radio
AesirX ComplianceOne | Circular 47/2026/TT-NHNN Payment-System Supervision Data
UPCOMING
Circular 47/2026/TT-NHNN Payment-System Supervision Data
Supervisory data lineage and inspection readiness for payment systems
The State Bank's amendment to its payment-system supervision rules, in force from 1 July 2027. Know where every supervisory figure comes from, check it before it is sent, log what the supervisor flags, and keep the evidence of an on-site inspection in one register.
Circular 47/2026/TT-NHNN: Scope and Current Status
If you operate an important payment system, cooperate with payment intermediaries as a bank, or provide payment-intermediary services in Vietnam, Circular 47/2026/TT-NHNN changes what you report and how you can be inspected. The State Bank of Vietnam issued it on 24 September 2026.
It takes effect in two steps:
- 1 July 2027 for the whole Circular except the online-monitoring indicators.
- 1 October 2027 for the online-monitoring indicators: section 3 of Appendix III and section 3.3 of Appendix IV. Their data may lag by no more than 5 minutes.
What changes for you:
- Inspection on more grounds. An operator of an important payment system can now also be inspected under the State Bank's plan or at the Governor's request. Supplied data that stay missing, erroneous or inconsistent and uncorrected remain a ground for inspection, as they have been under Circular 41/2024 since 2024.
- Your IT systems are in scope. That operator must provide personnel and equipment so inspectors can examine information and data on its IT systems.
- Replaced reporting appendices. The list of important payment systems and the indicator tables for operators, cooperating banks and payment intermediaries are replaced in full.
- More operators of the switching and clearing system. Circular 41/2024 named one company as its operator. The replaced Appendix II names every organisation the State Bank licenses to provide financial switching or electronic clearing services, so each holds the operator role for section 3 of Appendix IV, with the operator's reports and notices.
- Monthly periods. Some indicators in each section of the replaced Appendix IV are monthly; the rest stay first-six-months and year. Every indicator in the replaced Appendix V is monthly, where Circular 41/2024's were quarterly and annual; the cooperating bank still reports under the statistical reporting regime. Appendix VI stays quarterly and annual.
- Revised indicators for intermediaries. The replaced table for payment intermediaries covers services, partners and merchants, incident hours, fraud-affected transactions, guarantee accounts and named top-merchant lists.
- Archiving and secrecy. Supervisory documents, information and data are archived under the law on archives and kept secret under the banking secrecy rules. No retention period is stated.
- The data-defect trigger reaches operators of important payment systems only. For payment intermediaries, only the inspection procedure changes.
Circular 47 amends Circular 41/2024/TT-NHNN on supervision of important payment systems and payment-intermediary services. It does not replace it. Circular 41/2024 still sets the submission deadline, channel and template, which Circular 47 does not change, and which role files which report. Circular 47 has no transitional clause for a period that runs across 1 July 2027.
How Circular 47/2026/TT-NHNN Relates to the Banking Overlays
Circular 47 is an optional banking addition for one activity: supervisory reporting to the State Bank and the on-site inspection that can follow it. It sits beside the banking, fintech and payments overlay, which covers payment services, due diligence and onboarding evidence.
You work from two texts: Circular 41/2024 for the supervision regime, and Circular 47 for what now changes in it. Both are in ComplianceOne: Circular 41/2024 carries the reporting deadlines, the notices and the four official forms, and each Circular 47 record names the Circular 41/2024 provision it changes. Keep both in your workspace. Explore Circular 41 Supervisory Reporting
The Circular rests on Decree 52/2024/NĐ-CP on non-cash payments, the Law on the State Bank and the Law on Credit Institutions. The top-merchant lists payment intermediaries report can name individuals, so the Personal Data Protection Law may also apply to them.
Technical Provisions and Compliance Obligations
| Provision | What It Requires | What You Need |
|---|---|---|
| Article 2, amending Article 7(1) | Unscheduled on-site inspection of an important-payment-system operator, where data it supplied are missing, erroneous, wrong or inconsistent and not corrected, or where a risk issue needs more data | A record of each data defect the supervisor flagged, its root cause, the correction and the date corrected data were supplied |
| Article 2, amending Article 7(3) | The operator arranges personnel and equipment for inspection of information and data on its IT systems within the inspection scope | Inspection evidence: scope, personnel, equipment, access approvals per system, and the data disclosed with its secrecy classification |
| Article 3, amending Article 12(2) | Inspection of payment intermediaries follows the Governor's rules and the law on specialised inspection | Inspection evidence you can produce under that procedure. The data-defect trigger is not extended to intermediaries |
| Article 1, adding Article 4a | Supervisory documents, information and data are archived under the law on archives and kept secret under the banking law on information secrecy | Your own archiving and secrecy practice for supervisory copies. The Circular states no period and does not say it reaches your own copies |
| Article 8, replacing Appendices II–VI | A new list of the four important payment systems, naming every licensed switching or clearing provider as that system's operator, and replaced indicator tables for each system operator (Appendices III and IV), cooperating banks (Appendix V) and payment intermediaries (Appendix VI). Some Appendix IV indicators and every Appendix V indicator are monthly | An inventory of the indicators your role reports, each with its periodicity and the date it applies from |
| Article 9(2); Appendix III section 3 and Appendix IV section 3.3 | Online-monitoring indicators, fed continuously with no more than 5 minutes' latency, from 1 October 2027 | A reporting pipeline of your own that meets the latency, and the lineage of each indicator it feeds |
| Articles 4–7, amending Articles 19, 21 and 22 and adding Articles 21a–21b | Information exchange among the Supervision Unit, the SBV Inspectorate, regional branches, the credit-institution supervision department and the anti-money-laundering department | Nothing new of your own: these provisions direct State Bank units |
| Obligation | Timeline | Reference |
|---|---|---|
| Circular takes effect | 1 July 2027 | Article 9(1) |
| Online-monitoring indicators take effect | 1 October 2027 | Article 9(2) |
| Online-monitoring data latency | No more than 5 minutes | Appendix III note (4); Appendix IV note (9) |
| Reporting periodicity | Stated per indicator, from continuous to yearly | Appendices III–VI |
| Submission deadline and channel | Set by Circular 41/2024; Circular 47 states none | Circular 41/2024 |
| Correction of flagged data | No period is stated | Article 2 |
| Archiving of supervisory data | No period is stated | Article 1 |
| A reporting period that runs across 1 July 2027 | No transitional rule is stated. ComplianceOne reads a period under the annexes in force on its last day, as its own reading | Article 9 |
The Circular states two dates and one latency, and no other numeric period. ComplianceOne computes no correction window and no retention period. The submission due date comes from Circular 41/2024. With it in your workspace, the Supervisory Reporting register computes the date from Circular 41/2024's own deadline records. With Circular 47 alone, you record the provision the deadline comes from, and no date is computed.
Forms and Data Requirements
The Circular prescribes no submission form. The replaced appendices are indicator tables: code, name, description and periodicity. The submission template stays in Circular 41/2024.
Every record ComplianceOne supplies for Circular 47 is an internal template and is labelled as one:
- Supervisory indicator lineage, one entry per indicator.
- Pre-submission completeness and consistency check.
- Supervisory data correction log.
- On-site inspection evidence record.
- Service interruption indicator record.
- Complaint and fraud indicator reconciliation.
How ComplianceOne Supports Circular 47 Compliance
Once Circular 47 is added to your workspace, the Supervisory Reporting page in Payments & eKYC Evidence reads the reporting roles and replacement annexes it defines for any date from 1 July 2027. Set Rules in force on to a date from then to prepare today. Before that date the page shows the Circular 41/2024 set, when Circular 41/2024 is in your workspace, and it tells you when the Circular 47 set begins. ComplianceOne shows the Circular as upcoming; it takes effect on 1 July 2027.
What changes on 1 July 2027, listed.
Beside the notice of the new set, What changes lists every value that changes between two dates. That covers the sections a role reaches, the inspection bases, the defect types, the interruption causes, the periodicities and the commencement dates. It also lists the indicators you recorded whose periodicity or commencement the new set no longer declares, so you know which to review before the switch.
Scope set by your reporting role.
You record which roles your organisation holds: important-payment-system operator, cooperating bank or payment intermediary. Each role brings in only the indicator sections it reports. Choosing the role is your decision. From 1 July 2027 the operator role reaches every organisation licensed for financial switching or electronic clearing, and the installed
Circular's guidance says so.
Lineage for every indicator.
Each indicator carries its source system, data owner, calculation rule, linked registers, an evidence reference and a named approver. An indicator with no source or owner reads Not recorded and is counted as a gap, never shown as a breach. Only the named approver can approve it, and any later edit clears the approval.
A reporting calendar across the switch.
With Circular 41/2024 in your workspace, the Reporting calendar tab lists each periodic report your roles owe, with its due date, the deadline record it came from and its state. It reads each period under the rules in force on the period's last day. So the first-six-months 2027 report, due by 20 July 2027, follows Circular 41/2024's annexes. From July 2027 an operator's monthly Appendix IV indicators appear month by month, due on the 12th of the next month. The dates come from Circular 41/2024's deadline records, adjusted using the separately reviewed applicable official calendar recorded in Settings. Its sources, workweek/timezone, exceptions and covered dates are visible; company closures cannot extend the Article 15(2)(e) deadline. Missing or uncovered calendar evidence leaves the adjusted date unconfirmed and does not extend the filing duty. Approved checks keep their historical date and basis, while current recalculation is shown separately. Circular 47 does not amend Article 15. With Circular 47 alone, no report is given a due date.
A check before each submission.
For each section and period you record the completeness confirmation, the cross-indicator checks, and the complaint and fraud counts reported beside the counts in your registers. A person enters both counts. Each interruption row names an incident from your incident register, with the hours counted by a person. With Circular 41/2024 in your workspace, the due date is computed from its deadline record for the period and named beside it. With Circular 47 alone, you record the provision the deadline comes from, and no due date is computed. A check cannot be approved while counts differ without an explanation. The check also keeps who prepared the report, the signatory, the channel, when your organisation submitted it, and the signed file and receipt as evidence files, recorded after approval without reopening it.
Requests and what the supervisor flagged.
Each correction names the indicators from your inventory, the defect type, the dates notified and supplied, the root cause, the correction and whether the lineage was updated. The corrected data cannot be dated before the notice. The inspection-trigger warning appears only for the operator role the Circular applies it to. With Circular 41/2024 in your workspace, the same tab also records the Supervision Unit's information requests, each with its reference, owner and the deadline the request states. ComplianceOne computes no deadline for a request.
Evidence of each on-site inspection.
Each inspection records its basis, notice, decision and minutes references, scope, personnel and equipment, access approvals per system, systems examined, data disclosed with its secrecy classification, the handling decision and its recommendations. An inspection cannot be closed until access approvals and classified disclosures are recorded, and until every recommendation with a deadline has its report date. A recommendation from a supervision letter is recorded on its own, with no inspection, and the Recommendations tab lists both kinds with their deadlines and report dates. Each inspection, and each reporting period, exports as an evidence pack with every record labelled official or internal and no calculated figure.
Notices across the switch. From 1 July 2027 the roles in Circular 47 carry the same notice duties as before: the interruption notice for operators and payment intermediaries, the operator change notice and the e-wallet contract copy. Their clocks stay in Circular 41/2024.
ComplianceOne records what your organisation produced and checked. It does not calculate indicators, submit data to the State Bank, connect to any State Bank system, supervise any payment system or certify that a report is complete, correct or received.
Related Modules
Incident Response
Holds the incident each interruption row names, so the hours counted sit beside the incident's own reference, title and dates
Explore Incident Response
Audit Trail
Keeps every change to a reporting role, a lineage, a pre-submission check, a correction or an inspection, with who approved it and when
Explore Audit TrailCompliance Readiness Checklist
If you are preparing for Circular 47, confirm that:
See Circular 47 Compliance in Action
See how ComplianceOne scopes indicators by reporting role, holds the lineage of each figure, and keeps the evidence of an on-site inspection.
Ronni K. Gothard Christiansen - Technical Privacy Engineer & CEO
Technical Compliance Expert, 32+ Years Open Source Advocate, X-BoD Open Source Matters Inc.
Frequently Asked Questions
It changes who is an operator, and some periods. Every organisation licensed for financial switching or electronic clearing becomes an operator of that system, where Circular 41/2024 named one company. Some Appendix IV indicators and every Appendix V indicator become monthly. Which role files which report does not change, and the cooperating bank's Appendix V still follows the statistical reporting regime.
Circular 47 has no transitional clause. ComplianceOne reads a period under the annexes in force on its last day, and says this is its reading, not the text. On that reading, the first-six-months 2027 report, due by 20 July 2027, uses Circular 41/2024's annexes, and the 2027 annual report uses Circular 47's, although half its period ran under the earlier ones. Confirm the treatment with the State Bank before relying on it.
No. It amends and supplements Circular 41/2024/TT-NHNN and replaces its Appendices II–VI. Circular 41/2024 remains the working instrument and still sets the submission deadline, channel and template. Cite each obligation to both the amending article and the provision it changes.
The ground for inspection over uncorrected data reaches only operators of important payment systems. It has done so since Circular 41/2024 (Article 7(1)); Circular 47 keeps it and adds inspection under the State Bank's plan or at the Governor's request. For payment intermediaries, Circular 47 changes only the inspection procedure, which now follows the Governor's rules and the law on specialised inspection. ComplianceOne shows the data-defect warning only to organisations that record the operator role.
No. It does not calculate indicators, submit or transmit data, or connect to any State Bank system, and it does not meet the 5-minute online-monitoring latency for you. It records where each figure comes from, what was checked before it was sent, what was corrected and what was shown to inspectors.
The Circular states no period. It says supervisory documents, information and data are archived under the law on archives and kept secret under the banking secrecy rules, and does not say whether that reaches your own copies. Record the practice you decide on and the basis for it.
From 1 October 2027, three months after the rest of the Circular. They are section 3 of Appendix III, for the national interbank electronic payment system, and section 3.3 of Appendix IV, for financial switching and electronic clearing systems. Their data may lag by no more than 5 minutes.
Next Steps
Start a Compliance Pilot
Test your indicator inventory against your reporting role, the lineage behind each figure, and the evidence an on-site inspection would ask for.
Discuss Your Compliance Needs
Review which reporting roles you hold, which indicators you report from 1 July 2027, and which are online-monitoring indicators due from 1 October 2027.
The evolution of Aesir is Aesir + 
(the Norse symbol for Necessity)"Needed in order to achieve a particular result"
♥Join the AesirX Privacy Newsletter. Stay Informed. Stay Compliant.
