DPO Radio
AesirX ComplianceOne | Securities and Capital Markets Data
ACTIVE
SECURITIES AND CAPITAL MARKETS DATA OVERLAY
Connect Disclosure, Reporting, Retention, Client-Asset, and Inspection Evidence For Securities-Market Operations
Run the disclosure calendar, authority reporting, record retention, client-asset segregation proof, internal-control documentation and inspection responses in one place.
Why This Overlay Matters
If you are a securities-market participant in Vietnam, you need to show, event by event, what you reported, what you disclosed, and what you kept. The rules come from Securities Law 54/2019/QH14 and its implementing Decree 155/2020/NĐ-CP, both effective 1 January 2021.
Together they set:
- the disclosure regime;
- the periodic and extraordinary reporting calendar;
- duties to retain records and produce them on request;
- client-asset segregation and confidentiality rules;
- internal-control and financial-safety expectations;
- IT-system duties;
- the duty to cooperate with inspections.
The overlay is optional. It is built for public companies, public bond issuers, securities companies, fund management companies, foreign securities branches, depository and clearing members, supervisory banks and payment banks. You use it directly once your securities-market scope is confirmed. Other organisations can add it for reference.
Securities work mixes market disclosure with client files, settlement records, governance minutes, practitioner registers and authority correspondence. Each event needs one connected trail: the trigger, the report, the disclosure made at the same time, the acknowledgement and the record you keep.
What the Securities Overlay Covers
Dimension
Coverage
Instruments
Securities Law 54/2019/QH14 and Decree 155/2020/NĐ-CP, both effective 1 January 2021. Later amendments are listed under Legal Status and Amendments below
Who it is for
Public companies, public bond issuers, securities companies, fund management companies, foreign branches, depository and clearing members, supervisory banks and payment banks
Obligation themes
Ten themes across the two instruments: disclosure, reporting, retention, recordkeeping and dossier discipline, client assets, confidentiality, internal control and financial safety, IT systems, inspection cooperation, and registration clocks
Reporting calendar
Deadlines from 24 hours (incidents, plan changes, foreign-listing events) through working-day windows and 6-month cycles, to the annual practitioner report due before 20 January
Retention
The payment bank's settlement data: kept for at least 10 years and produced within 48 hours. Also disclosed information, client files, clearing vouchers and governance minutes
Fines
Fine schedules are in Decree 156/2020/NĐ-CP, which this overlay does not cover. Article 132(3)–(5) of the Securities Law sets statutory caps only, and ComplianceOne cites them with that attribution
Set-up
Optional. Direct use after your securities-market scope is confirmed, or reference-only
Official filing templates vary by procedure and by the version of the authority's system. ComplianceOne gives you internal evidence records instead of copies of official forms it has not verified.
Legal Status and Amendments
Both instruments are active, and both have been amended since they took effect. Before you quote any deadline, threshold or template figure from the original text, check it against the amending instrument.
| Instrument | Date | Status |
|---|---|---|
| Securities Law 54/2019/QH14 | Passed 26 November 2019; effective 1 January 2021 under Article 134(1) | Active. Amended by Law 56/2024/QH15. ComplianceOne follows the enacted 2019 text and records the amendment |
| Decree 155/2020/NĐ-CP | Issued 31 December 2020; effective 1 January 2021 | Active. Amended by Decree 245/2025/NĐ-CP of 11 September 2025. ComplianceOne follows the verified 2020 text and records the amendment |
| Decree 156/2020/NĐ-CP | — | Sets the securities fine schedules, as amended. Not covered by this overlay |
The Securities and Capital Markets Instrument Stack
Securities Law 54/2019/QH14
ActiveThe Securities Law of 26 November 2019 is the base of the stack. For data operations it sets:
- the disclosure chapter;
- retention, client-asset and confidentiality duties for intermediaries and market infrastructure;
- internal-control and financial-safety duties;
- the payment bank's settlement-data condition;
- the duty to cooperate with inspections.
Decree 155/2020/NĐ-CP – Amended by Decree 245/2025/NĐ-CP
ActiveThe implementing decree of 31 December 2020 fills in the detail:
- the dossier rules for every filing;
- the use-of-proceeds reporting cycle;
- corporate-governance reporting deadlines;
- the practitioner register;
- depository and clearing master data;
- online-trading and incident-response duties;
- registration deadlines.
Decree 156/2020/NĐ-CP – Where the Fine Schedules Live
Fines for each securities violation are set by Decree 156/2020/NĐ-CP, not by this overlay.
The Securities Law sets only the statutory caps, in Article 132(3)–(5):
- for insider dealing and market manipulation under Article 12(2)–(3), up to 10 times the illicit gain from the violation. Where there is no illicit gain, or 10 times the gain comes to less than 3,000,000,000 VND, the maximum is 3,000,000,000 VND;
- for any other securities violation, a maximum of 3,000,000,000 VND;
- both maximums apply to organisations. For an individual who commits the same violation, the maximum is half the organisation's.
Law 56/2024/QH15 reworded Article 12(3) to cover market manipulation in general terms. It did not amend Article 132.
ComplianceOne cites those caps with that attribution and records no scheduled fine amount.
The Ten-Theme Obligation Map
ComplianceOne groups the duties of both instruments into ten themes, each with accountable owners and evidence:
| Theme | What it covers |
|---|---|
| Disclosure | Periodic disclosures by entity type, extraordinary trigger events, ownership-threshold and insider-transaction disclosure, and reporting to the authority while disclosing at the same time |
| Reporting | Use-of-proceeds cycles, buyback report-and-disclose steps, governance reporting, fund and supervisory-bank reports, and market-incident reports with remediation plans |
| Retention | Disclosed information, client files, settlement and clearing vouchers, ownership registers and governance meeting minutes |
| Recordkeeping and dossier discipline | One original set in Vietnamese, certified translations and consular legalisation for foreign documents, windows for amendment requests, and completion deadlines on every filing |
| Client assets | Keeping each client's assets apart from the institution's own, at the securities company, fund manager, depository member, clearing member and market-infrastructure levels |
| Confidentiality | Client information may be released only with the client's consent or on a competent authority's request, and lawful access requests must be served |
| Internal control and financial safety | Internal-control and risk-management systems, financial-safety indicators, and the warning, control and special-control statuses that follow non-compliance |
| IT systems | Backup databases, online-trading safeguards, depository connectivity requirements and the secured-transactions registry |
| Inspection cooperation | Information demands from the authority, the written refusal of unlawful or irrelevant requests, and duties to produce records while keeping them confidential |
| Registration clocks | Listing and trading registration after an offering, public-company status changes, foreign-ownership notifications and depository master-data updates |
The Reporting Calendar
Each deadline becomes a monitored period and a task with a named owner. The deadlines run in tiers:
- 24-hour clocks: market-affecting incidents reported to the authority with a remediation plan; approved changes to a use-of-proceeds plan disclosed with reasons; governance-model changes after a general-meeting decision; foreign-listing events.
- Working-day windows: use-of-proceeds progress disclosed within 5 working days after each 6-month mark. Buyback content disclosed within 7 working days of the authority's notice, with trading only after a further 7. Practitioner reports within 5 working days and employer notices within 2. Depository member-data changes within 5.
- Periodic cycles: the 6-month use-of-proceeds report until the proceeds are fully disbursed, the 6-month governance report, semi-annual reviewed and annual audited financial statements, and the financial-safety-ratio report (reviewed at 30 June, audited at 31 December).
- Fixed annual dates: the practitioner-usage report for the previous year, filed before 20 January.
- Registration clocks: 15-day and 30-day listing, trading and share-registration windows after an offering closes or public-company status is confirmed.
The Flagship Retention Pair: 10 Years, 48 Hours
Payment banks carry the only explicit retention period in either instrument. Under Article 69(2)(g) of the Law, a commercial bank chosen to settle securities transactions must:
- keep transaction-settlement data for at least 10 years; and
- produce it to the State Securities Commission or the depository corporation within 48 hours of a request.
These are two different capabilities. The 10-year floor is a retention rule that has to survive system changes, migrations and vendors. The 48-hour window is a production capability you have to demonstrate. That is why ComplianceOne treats it as a tested duty with drill evidence, not a policy statement.
Every other retention duty in the stack, covering disclosed information, client files, clearing vouchers and governance minutes, points to general law rather than a number. Each is recorded with the rule it actually rests on.
How ComplianceOne Supports Securities-Market Operations
Start from your market roles. Record which roles you hold: issuer, intermediary, fund manager, member, supervisory bank or payment bank. Every duty follows from a role. Obligation mappings then link each of the ten themes to its owners, records and evidence, so a review starts from the duty and ends at the proof.
Run the calendar as tasks. Every 24-hour, working-day, 6-month and before-20-January deadline becomes a monitored period and task. Each has its owner, its trigger and evidence that the report went to the authority with its matching disclosure. Report and disclosure sit on one record, so whether both happened has one answer.
Keep retention where the data lives. The payment bank's duty is held as a retention rule plus a production-readiness record with drill evidence. Client files, settlement vouchers and governance minutes each carry the duty they rest on.
Track authority demands. Inspection demands and requests to produce information are tracked as authority interactions. Where the Law allows a written refusal of an unlawful or irrelevant demand, the refusal is recorded with its reasons.
You decide and file; ComplianceOne keeps the evidence. It records what you reported and disclosed and what the authority replied. Disclosure decisions, filings and investment or market-conduct advice stay with you and your advisers.
Related Modules
Data Mapping
Maps client files, settlement records, retention rules and processing activities.
Explore Data Mapping
Audit Trail
Keeps the history of reports, disclosures, acknowledgements and corrections.
Explore Audit Trail
Compliance Forms
Organises filing records, report covers and production-response evidence.
Explore Compliance Forms
Monitoring Programs
Runs the reporting calendar as owned periods, tasks and readiness checks.
Explore Monitoring ProgramsCompare The Difference
Without Structured Framework Operations
With ComplianceOne
Disclosure and reporting clocks live in separate spreadsheets per team.
Run one calendar across disclosure, reporting, and registration clocks.The report to the authority and the simultaneous disclosure drift apart.Keep the report, the disclosure, and the acknowledgement on one record.Retention duties are asserted in policy but unproven in production.Hold retention rules beside the data and drill the production windows.Inspection responses start from scattered mailboxes and screenshots.Answer authority demands from connected, owned, append-only evidence.Built for Securities and Capital Markets Compliance Operations
One record per disclosure event. The trigger, the report to the authority, the market disclosure and any later correction stay together. When an inspector asks what you reported, when and to whom, the answer was recorded at the time.
No integration needed. ComplianceOne keeps evidence around your dealings with the State Securities Commission, an exchange or the depository corporation without connecting to them. Your trail is complete without depending on any market system.
Retention you can prove. Each duty holds the rule, the data location and the owner. For the payment bank's settlement data, it also holds drill evidence that the 48-hour production window works.
See Securities Compliance Operations in Action
See how ComplianceOne connects disclosure, reporting, retention, client-asset and inspection evidence for securities-market roles.
Ronni K. Gothard Christiansen - Technical Privacy Engineer & CEO
Technical Compliance Expert, 32+ Years Open Source Advocate, X-BoD Open Source Matters Inc.
Frequently Asked Questions
Confirmed securities-market participants: public companies, public bond issuers, securities companies, fund management companies, foreign securities branches, depository and clearing members, supervisory banks and payment banks. Organisations outside that scope, such as a corporate group preparing for a listing, can add it for reference.
On 1 January 2021, under Article 134(1) of Law 54/2019/QH14. You may see 1 July 2020 quoted elsewhere, but the enacted text sets 1 January 2021. Decree 155/2020/NĐ-CP took effect on the same day.
No. It connects to no authority or market-infrastructure system, sends nothing, and files no disclosure, report or registration. It organises the evidence of what you prepared, reported, disclosed and received back, with the accountable owner on each record.
No. Decree 155/2020 names specific numbered templates, including the use-of-proceeds report forms Form No. 01 (Mẫu số 01) and Form No. 02 (Mẫu số 02), and the practitioner notification forms Form No. 86 (Mẫu số 86) and Form No. 87 (Mẫu số 87). ComplianceOne names them but does not recreate any until it is checked against its source. Instead it gives you internal records, each labelled as internal: a disclosure filing record, a periodic report filing cover and an information-production response log.
Fines for each violation are set in Decree 156/2020/NĐ-CP, as amended, which this overlay does not cover. The only amounts stated here are the statutory caps in Article 132(3)–(5) of the Securities Law. For insider dealing and market manipulation under Article 12(2)–(3), the maximum is 10 times the illicit gain, or 3,000,000,000 VND where there is no gain or 10 times the gain is lower. For any other violation, it is 3,000,000,000 VND. These maximums apply to organisations, and an individual's maximum is half the organisation's. No other figure is recorded or should be quoted.
Decree 245/2025/NĐ-CP of 11 September 2025 amends Decree 155/2020. ComplianceOne's requirements follow the verified 2020 text and record the amendment. Check any deadline, threshold or template reference against the amending decree before quoting it. The same applies to the Law's amendment by Law 56/2024/QH15.
No. It organises compliance duties, calendars and evidence. Decisions about any investment, security, transaction, disclosure or market conduct, and the legal reading behind them, stay with your organisation and its advisers.
Next Steps
Start a Compliance Pilot
Test the disclosure calendar, retention rules, and inspection-response evidence for one market role.
Discuss Your Compliance Needs
Review your market roles, reporting calendar, retention landscape, systems, and authority-facing workflows.
The evolution of Aesir is Aesir + 
(the Norse symbol for Necessity)"Needed in order to achieve a particular result"
♥Join the AesirX Privacy Newsletter. Stay Informed. Stay Compliant.
