AesirX ComplianceOne | Decree 69/2024/NĐ-CP on eID and Authentication

What Decree 69 Declares as a Trust Regime

Decree 69 is one of the instruments that declares a trust regime to ComplianceOne. The platform reads the regime from the regulatory frameworks an organization has installed rather than carrying the decree in the product itself, so an amendment reaches customers as a content update.

The regime names 19 regulated identity attribute types, spanning both individuals and organizations – from the personal identification number, date of birth, facial image, and fingerprint through to an organization's name, establishment date, head-office address, tax code, and enterprise code. Eight of the 19 are marked restricted. Each attribute type also carries the verification methods the decree permits for it, so a record shows not only what was verified but by which of the ten declared means.

Four authentication levels are declared and ranked, level 01 through level 04, as the decree states them at Article 20: combinations of authentication factors, with biometric factors entering at the third level. The ranking is declared rather than inferred from the names, so nothing in the platform assumes a numbering direction.

The decree also declares one trust service type – the electronic authentication service, a conditional business line whose eligibility application is made on form XT01 – and six submission means. Two of those are the portals the decree names explicitly, the National Public Service Portal and the Ministry of Public Security's own; they are declared separately rather than collapsed into one, because the decree names two.

Where Decree 69 Evidence Is Recorded

The important thing about the identity register is what it does not hold. A regulated identity attribute is recorded without its value, and without a hash of one. There is no field for a personal identification number, a date of birth, or a tax reference. A hash would not help here: these values sit in small, structured domains that can be reversed by generating candidates until one matches, so a stored hash would hold a recoverable identity number under a name that reads as safe.

What the record holds instead is the evidence that a verification happened; which attribute type, asserted by which issuer, checked by which of the decree's methods, when, to what result, with a protected attachment where the underlying document lives. That is what a supervising authority asks for, and it is sufficient to answer them.

Verification and authentication events sit on one timeline against the identity they belong to, each carrying its method, its result, its time, and the assurance level claimed. Where a recorded level exceeds what the method supports, the platform marks the discrepancy rather than silently correcting it, because the organization may have a reason and the record should carry both the claim and the disagreement.

A dossier filed to the Ministry of Public Security is recorded as an electronic submission; the channel that carried it, the hash of the payload sent, the receipt that came back, and any later amendment. ComplianceOne records that a filing was made; it does not transmit one.