DPO Radio
AesirX ComplianceOne | Decree 341 Vietnam Civil Cryptography
ACTIVE
Decree 341/2026/NĐ-CP – Civil Cryptography
Vietnam's civil-cryptography licensing, conformity and cross-border regime
Read the licence conditions, the dossier clocks, the eight official forms and the annex exclusion list against the signed text.
Decree 341/2026/NĐ-CP: Scope and Current Status
Decree 341/2026/NĐ-CP was issued by the Government on 1 September 2026 and took effect the same day under Điều 17. There is no grace period. It runs to 19 articles in five chapters with three annexes, was made on the proposal of the Minister of National Defence, and details điểm a khoản 1, điểm c khoản 2 and khoản 3 Điều 28 together with khoản 3 Điều 29 of Cybersecurity Law 116/2025/QH15.
The issuing authority is Ban Cơ yếu Chính phủ, the Government Cipher Committee, under the Ministry of National Defence. Several published summaries of this decree named the Ministry of Public Security instead. The signed text does not: Ban Cơ yếu Chính phủ receives the dossiers, appraises them and issues both the business licence and the import/export licence. The Ministry of Public Security appears in one place only, and that place is the dual-use seam described further down.
The decree governs civil-cryptographic products and services, the conditions for trading them, their export and import, and the competence, dossier and procedure for issuing, amending, supplementing, suspending and revoking the two licences. A civil-cryptographic product is hardware, software, documentation and technical or professional cryptographic equipment used to protect information outside the scope of state secrets. Three services are named: protecting information using civil-cryptographic products, assessing civil-cryptographic products, and security and cybersecurity consulting using civil-cryptographic products.
Who it applies to is three-limbed under Điều 2 khoản 1: Vietnamese agencies, organisations and individuals; foreign agencies, organisations and individuals in Vietnam, together with persons of Vietnamese origin whose nationality is undetermined who live in Vietnam and hold a căn cước certificate; and foreign agencies, organisations and individuals directly participating in or related to civil-cryptography activity in Vietnam.
Whether any particular product or service falls inside the regime is a determination against Điều 3 and Phụ lục I in a specific deployment. This page describes the instrument. It does not tell any reader that they are in scope or out of it, and neither does the product.
How Decree 341 Relates to the Vietnam Cybersecurity Law 2025
Law 116/2025/QH15 made civil cryptography a conditional business activity and delegated the conditions, the procedures and the licensing competence to the Government. Decree 341 is that instrument on the civil-cryptography side, and it sits beside the cybersecurity products-and-services decree rather than inside it: Decree 332/2026/NĐ-CP governs cybersecurity products and services and excludes civil cryptography, which runs under this regime.
Điều 2 khoản 2 splits ministerial competence. The Ministry of National Defence manages cybersecurity for military and defence tasks; the Ministry of Public Security manages it for Army units carrying on civil or economic activity within its competence; where the two overlap, a joint coordination regulation settles it.
Decree 341 prescribes no monetary fines of its own. Điều 16 khoản 4 routes violations found on inspection to handling under the law generally, so monetary exposure is read from Decree 330/2026/NĐ-CP with its individual-versus-organisation attribution rule, not from this decree.
Decree 341 and Decree 211/2025 – Both Active
Decree 341 contains no repeal clause. Điều 17 states its commencement and nothing else; the word bãi bỏ does not appear anywhere in the instrument, and Nghị định 211/2025/NĐ-CP is not named in it. Decree 211/2025 remains active.
So both instruments stand. Which one governs a given licence, product or filing is a legal-analysis question that belongs to counsel, and it is not one this page, this product, or any summary of either decree can settle. ComplianceOne shows both as active where both are installed, keeps each instrument's obligations and citations under its own name, and derives no conclusion from the overlap. Anyone presenting Decree 341 as the replacement for Decree 211/2025 is asserting a lineage the signed text does not support.
Technical Provisions and Compliance Obligations
| Provision | What It Establishes | Operational Implication |
|---|---|---|
| Điều 3 | The product definition and the three civil-cryptographic services; information protection, product assessment, and security and cybersecurity consulting using such products. | Service lines are in scope on their own footing, not only manufactured products |
| Điều 4 khoản 1 | A business licence is required to trade any product or service on the Phụ lục I conditional list. | Trading a listed item without the licence is the primary exposure |
| Điều 4 khoản 2 | Products must be inspected and conformity-certified before they circulate on the market. | Circulation is gated on a certificate, and the certificate is evidence somebody must hold |
| Điều 4 khoản 3–4 | Business licence term of 10 years; a fee is payable under the law on fees and charges. | The renewal calendar is a decade long, which is exactly how it gets forgotten |
| Điều 4 khoản 5 | Dual-use products carrying both civil-cryptographic and cybersecurity features are licensed by the Ministry of Public Security, after Ban Cơ yếu Chính phủ's written opinion on the cryptographic feature. | Two authorities, in sequence, for one product |
| Điều 5 khoản 1 | Four licence conditions: at least two technical staff with a university degree or above in electronics-telecommunications, information technology, mathematics or information security; one management or operating officer with such a degree, or another degree plus a security or information-safety training certificate; equipment and facilities matching the scope supplied; and a technical plan conforming to standards and technical regulations. | Condition evidence is human and technical, and it must stay true after issue |
| Điều 5 khoản 2–3 | Dossier on Mẫu số 01 with qualification copies and a technical plan on Mẫu số 03; one set, filed in person, by post or through the National Public Service Portal, to Ban Cơ yếu Chính phủ, digitally signed when filed online | The filing channel is the organisation's choice; the recipient is not |
| Điều 6 | Amendment covers a change of name or of legal representative only, on Mẫu số 02, and the original paper licence is returned within 2 working days of issue. | A change of representative is a filing, not an internal note |
| Điều 7 | Supplementation covers changing or adding products or services, on Mẫu số 02 with a technical plan for the added items. | A new product line reopens the licence |
| Điều 8 | Suspension of up to 6 months on three grounds; revocation on six, including no service deployed within 1 year of issue without good reason; the decision goes to the business-registration authority and to customs. | Consequences travel outside the cryptography regulator |
| Điều 9 | Import/export licence for products on Phụ lục II, issued by Ban Cơ yếu Chính phủ, term 3 years; the annex applies only where the HS code, the goods description and the cryptographic technical-characteristic description all coincide. | Three fields must agree, and an HS code alone decides nothing |
| Điều 10 | Three import/export conditions: hold the business licence; imported products certified and conformity-declared; the subject and purpose of use must not harm national defence, national security or social order and safety. | The purpose of use is a licence condition, not a formality |
| Điều 11 | Seven revocation grounds for the import/export licence, including no import or export at all within the term unless a suspension was notified; after revocation the enterprise recalls the named products. | Dormancy is itself a ground |
| Điều 12 khoản 1 | Six duties of the trading enterprise, including quality conforming to declared standards before circulation, creating, retaining and keeping confidential customer information together with the name, type, quantity and purpose of use supplied, managing technical and technology solution files, refusing supply on discovering unlawful use or a breach of the agreed commitments, and cooperating with competent state agencies on professional measures on request. | The customer-information duty is retention and confidentiality at once |
| Điều 12 khoản 1 điểm e | Annual report to Ban Cơ yếu Chính phủ before 31 December, on Mẫu số 07, covering trading, import and export, and consolidated customer information. | A December date that consolidates customer data needs an owner well before December |
| Điều 12 khoản 2 | User duties: honour the commitments on key management, transfer, repair, maintenance and destruction; provide key-related information to competent state agencies on request; cooperate on crime-prevention measures. | Users carry duties even where they trade nothing |
| Điều 12 khoản 2 điểm d | A user of civil-cryptographic products not supplied by a licensed enterprise declares them to Ban Cơ yếu Chính phủ on Mẫu số 08, except foreign diplomatic and consular missions and the representative offices of intergovernmental international organisations in Vietnam. | Buying outside the licensed channel creates a filing duty of its own |
| Điều 13 | Ban Cơ yếu Chính phủ assists the Minister of National Defence, issues and withdraws both licences, builds the two annex lists, designates and manages conformity-assessment bodies, and decides unilateral recognition of foreign or international conformity-assessment results. | Foreign conformity results are recognisable by decision, never automatically |
| Điều 16 | Inspection grounds, three content limbs, competence with the head of Ban Cơ yếu Chính phủ and its civil-cryptography management agency, and minutes recording results and any violation. | The minutes are the record that matters afterwards |
| Điều 17–18 | Effective 1 September 2026, no repeal clause; licences issued before 1 July 2026 remain valid to their stated term; dossiers received before that date and still undecided, and those filed from it up to commencement, are decided under this decree. | Transition is read per licence and per dossier |
Two units appear inside one article, and they are not the same unit. The business-licence decision runs in days; the dossier steps around it run in working days. Read each row for the unit it states.
| Obligation | Timeline | Reference |
|---|---|---|
| Decree takes effect | 1 September 2026, the day of issue | Điều 17 |
| Business licence validity | 10 years | Điều 4 khoản 3 |
| Authority checks dossier validity | 1 working day | Điều 5 khoản 4 |
| Applicant completes an incomplete dossier | 3 working days | Điều 5 khoản 4 |
| Written refusal with reasons | 3 working days | Điều 5 khoản 4 |
| Appraisal and issue of the business licence | 12 days; stated as days, not working days | Điều 5 khoản 4 |
| Amended licence issued | 5 working days, after a 1 / 2 / 1 working-day dossier cycle | Điều 6 khoản 2–3 |
| Original paper licence returned after amendment | 2 working days from issue | Điều 6 khoản 3 |
| Supplemented licence issued | 9 working days, after a 1 / 2 / 1 working-day dossier cycle | Điều 7 khoản 3 |
| Import/export licence issued | 6 working days, after a 1 / 1 / 1 working-day dossier cycle | Điều 10 khoản 2–3 |
| Import/export licence validity | 3 years | Điều 9 khoản 2 |
| Suspension period | Up to 6 months | Điều 8 khoản 1 |
| Revocation for non-deployment | No service deployed within 1 year of issue, without good reason | Điều 8 khoản 2 |
| Annual report to the authority | Before 31 December | Điều 12 khoản 1 điểm e |
| Prior licences remain valid | Issued before 1 July 2026, to their stated term | Điều 18 khoản 1 |
Phụ lục III prescribes eight forms, Mẫu số 01 through Mẫu số 08, and all eight are carried with their titles from the signed source.
| Form | Purpose | Filed by |
|---|---|---|
| Mẫu số 01 | Application for the business licence. | The enterprise |
| Mẫu số 02 | Application to amend or supplement the business licence. | The enterprise |
| Mẫu số 03 | Technical plan; characteristics and parameters, product standards and technical regulations, service standards and quality, technical measures and solutions, warranty and maintenance. | The enterprise |
| Mẫu số 04 | The business licence itself. | Issued by the authority |
| Mẫu số 05 | Application for the import or export licence. | The enterprise |
| Mẫu số 06 | The import/export licence itself. | Issued by the authority |
| Mẫu số 07 | Annual report on trading, import and export, and consolidated customer information. | The enterprise |
| Mẫu số 08 | Declaration of use of civil-cryptographic products not supplied by a licensed enterprise. | The organisation or individual using them |
Mẫu số 04 and Mẫu số 06 are issued by the head of Ban Cơ yếu Chính phủ. They are carried as documents an organisation receives and files, and no workflow invites anyone to complete their own licence.
Does This Catch Us? The Phụ lục I Exclusion List
This is most readers' first question, and the honest answer starts in the same place every time: Phụ lục I carries a twelve-row exclusion list, and that list is the operative test. The annex names seven product categories: key generation, management and storage; protection of stored data; protection of data exchanged over networks; protection of IP traffic; protection of analogue and digital voice; protection of radio information; and protection of fax and telegraph, plus the three services of Điều 3. Then it removes the following from the conditional list.
| # | Excluded from the conditional-business list |
| 1 | Operating systems, browsers and software with pre-integrated cryptographic components where protection by cryptography is not the main function, widely used and installable by the user without vendor support. |
| 2 | Widely used information-technology products in the same posture; tablets, DVD players, digital cameras, cameras and similar consumer electronics. |
| 3 | Mobile phones without end-to-end encryption capability. |
| 4 | General-access smart cards and their readers and writers. |
| 5 | Copyright and ownership protection products, across four listed features. |
| 6 | Products whose only function is identity authentication, with no encryption function. |
| 7 | Products using cryptographic technique for remote access and device administration. |
| 8 | Widely used self-encrypting drives. |
| 9 | Products using cryptographic technique for monitoring, preventing and detecting network attacks. |
| 10 | Trusted platform module integrated circuits for device identification, information authentication and password protection. |
| 11 | Products using cryptographic technique for wireless access protection. |
| 12 | Products specially designed for terminal-side use in the medical field. |
Three of these decide most real cases: row 6, where authentication carries no encryption function; row 9, where cryptography is used to detect and prevent attacks rather than to protect the information itself; and row 1, where a product contains cryptography but protection by cryptography is not what the product is for. They are the rows an operator will otherwise decide from memory, at speed, in a procurement conversation.
Read them, then take the answer to counsel. A determination against Phụ lục I turns on what a product does in a specific deployment, and it has consequences – a licence obligation, a conformity gate before circulation, an import or export licence – that follow from being wrong in either direction. ComplianceOne does not classify a product against this annex, does not conclude that a licence is required, and shows nothing that could be mistaken for either.
The Dual-Use Seam
A product can carry both civil-cryptographic and cybersecurity features. Điều 4 khoản 5 and Điều 9 khoản 4 handle that case, and they hand it to a different authority: the Ministry of Public Security issues the cybersecurity business licence and the cybersecurity import/export licence for such a product, and it must first take Ban Cơ yếu Chính phủ's written opinion on the cryptographic feature. Dual-use products carrying civil-cryptographic features also have to meet civil-cryptography standards and technical regulations.
Two consequences worth stating plainly. The sequence matters; the written opinion precedes issue, so a plan that treats the two authorities as parallel will stall. And neither regime is the whole answer on its own: reading only the cybersecurity products decree, or only this one, produces a confident half-picture of a dual-use product's obligations.
Import and Export: A Three-Part Test
Phụ lục II lists products subject to import/export licensing as rows pairing an HS code with a goods description and a description of the cryptographic technical characteristic. Under Điều 9 khoản 3 điểm a the annex applies only where all three coincide with the row. An HS code that matches while the description or the cryptographic characteristic does not is not a match, and a customs classification is not a licensing determination.
Where the HS code disagrees with the national import and export list, Điều 9 khoản 3 điểm b resolves it under customs law. Several Phụ lục II rows carry the note that the product has both civil-cryptographic and cybersecurity features and is therefore licensed by the Ministry of Public Security after Ban Cơ yếu Chính phủ's written opinion.
ComplianceOne carries the test and its citation. It performs no matching against the annex and returns no verdict on a shipment.
How ComplianceOne Supports Decree 341 Compliance
Decree 341 is in the product as regulatory content. Its obligations, article citations, procedures, dossier steps, statutory clocks with the unit each states, the annex positions and the eight official forms are readable, can be mapped to controls and to obligations with a named owner and a due date, and take evidence through the modules that already carry every other installed Vietnamese instrument. The annual 31 December report, the licence terms, the conformity duty before circulation and the Mẫu số 08 declaration become dated work with owners rather than facts somebody remembers. Exposure conversations route to Decree 330 with the attribution rule attached, because this decree prices nothing itself.
What does not exist in the product today, said plainly so nobody meets it first in a demo:
- No conformity-certificate register. A certificate under Điều 4 khoản 2 is held as evidence against the obligation. There is no record type of its own carrying the assessing body, the certificate reference, the standard applied and the expiry date as fields.
- No product classification record against Phụ lục I. Nothing on any screen says a product is inside or outside the annex, and nothing derives it. The list and its exclusions are readable; the determination is a human one and stays outside the product.
- No dual-use referral state. Where the seam applies, an organisation records that fact for itself against the obligation; there is no register that tracks the written opinion from one authority to a licence from another.
- No import/export matching. The three-part test is carried as content. Nobody's shipment is screened by the platform.
The last three are boundaries at least as much as gaps. ComplianceOne is not a Vietnamese licensed cryptographic service provider, is not a conformity-assessment body, holds no licence and applies for none, and does not connect to Ban Cơ yếu Chính phủ, the Ministry of Public Security, customs or the National Public Service Portal.
Related Modules
Program Governance
Turns the licence, conformity, reporting and declaration duties into obligations with named owners and dates.
Explore Program Governance
Compliance Forms
Keeps the eight official forms beside clearly labelled internal working templates.
Explore Compliance Forms
Monitoring Programs
Carries the 31 December report, the licence renewal horizon and recurring condition reviews.
Explore Monitoring Programs
Risk Assessment
Tracks unlicensed-trading, condition-lapse and circulation-without-conformity exposure with citations.
Explore Risk Assessment
Audit Trail
Preserves determinations, filings, inspection minutes and evidence history.
Explore Audit TrailCompliance Readiness Checklist
Organizations assessing their position under Decree 341 should confirm:
See Decree 341 Compliance in Action
See how ComplianceOne carries a licensing decree with its conditions, its two clock units, its official forms and the annex exclusions the scope question turns on.
Ronni K. Gothard Christiansen - Technical Privacy Engineer & CEO
Technical Compliance Expert, 32+ Years Open Source Advocate, X-BoD Open Source Matters Inc.
Frequently Asked Questions
Yes. It was issued on 1 September 2026 and took effect the same day under Điều 17, with no grace period. Licences issued before 1 July 2026 keep their stated term, and dossiers filed around that date are decided under this decree's conditions and procedure.
Ban Cơ yếu Chính phủ, the Government Cipher Committee under the Ministry of National Defence, issues both the 10-year business licence and the 3-year import/export licence. The Ministry of Public Security issues licences only for dual-use products carrying both civil-cryptographic and cybersecurity features, and only after Ban Cơ yếu Chính phủ has given a written opinion on the cryptographic feature. Summaries naming the Ministry of Public Security as the general licensing authority for civil cryptography do not match the signed text.
The decree carries no repeal clause and does not name Decree 211/2025 anywhere, so both instruments are active. Which one governs a given licence, product or filing is a legal question for counsel. ComplianceOne shows both and resolves neither.
No. The seven categories, the three services and the twelve exclusion rows are readable in the platform with their wording, and the determination is made by people and recorded by them. No screen, export or report states that a product is inside or outside the annex.
A Phụ lục II row applies only where the HS code, the goods description and the cryptographic technical-characteristic description all coincide with it. An HS-code match on its own is not a match. Where the HS code disagrees with the national import and export list, customs law resolves it.
Điều 12 khoản 2 điểm d requires a user of civil-cryptographic products not supplied by a licensed enterprise to declare them to Ban Cơ yếu Chính phủ on Mẫu số 08. The exception is narrow: foreign diplomatic and consular missions and the representative offices of intergovernmental international organisations in Vietnam. Whether a specific product is a civil-cryptographic product for this purpose is the determination discussed above.
Next Steps
Start a Compliance Pilot
Test the licence conditions, the dossier clocks, the reporting duties and the annex readings your team will have to defend.
Discuss Your Compliance Needs
Review your scope questions, your dual-use products and the evidence your current licences already depend on.
The evolution of Aesir is Aesir + 
(the Norse symbol for Necessity)"Needed in order to achieve a particular result"
♥Join the AesirX Privacy Newsletter. Stay Informed. Stay Compliant.
