|
THE STATE BANK OF VIETNAM
-------
|
THE SOCIALIST REPUBLIC OF VIETNAM
Independence - Freedom - Happiness
---------------
|
|
No. 50/2024/TT-NHNN
|
Hanoi, October 31, 2024
|
CIRCULAR
PROVIDING FOR SECURITY AND CONFIDENTIALITY DURING PROVISION
OF ONLINE BANKING SERVICES
Pursuant to the Law on
the State Bank of Vietnam dated June 16, 2010;
Pursuant to the Law on
Cyberinformation Security dated November 19, 2015;
Pursuant to the Law on
Cybersecurity dated June 12, 2018;
Pursuant to the Law on
E-Transactions dated June 22, 2023;
Pursuant to the Law on
Credit Institutions dated January 18, 2024;
Pursuant to the
Government’s Decree No. 102/2022/ND-CP dated December 12, 2022 defining the
functions, tasks, powers and organizational structure of the State Bank of
Vietnam;
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
The Governor of the
State Bank of Vietnam hereby promulgates a Circular providing for security and
confidentiality during provision of online banking services.
Chapter
I
GENERAL
PROVISIONS
Article
1. Scope and regulated entities
1. Scope
This Circular provides
for requirements for ensuring security and confidentiality during provision of
online banking services, including:
a) Banking activities and
other business activities of credit institutions and foreign bank branches;
b) Provision of
intermediary payment services;
c) Credit information
activities.
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
This Circular applies to
credit institutions, foreign bank branches and intermediary payment service
providers and credit information companies (below collectively referred to as
“units”).
Article
2. Definitions and terms
For the purposes of this
Circular, the terms below shall be construed as follows:
1. “online services in
the banking sector” (hereinafter referred to as “online banking services”) include
the services specified in clause 1 Article 1 of this Circular provided online
by units to clients to conduct electronic transactions (hereinafter referred to
as “transactions”), excluding direct transactions at units accepting payment
via point-of-sale terminals or via Quick Response Code (QR Code) displayed by
clients.
2. “online banking
system” means a structured combination of hardware, software, databases,
communication and network system, and security and confidentiality system used
to produce, transmit, collect, process, store and exchange digital information
serving the management and provision of online banking services, which is
established, administered and operated by a unit or a hired third party.
3. “online banking
application software” means application software providing online banking
services.
4. “mobile banking
application software” means online banking application software installed
on mobile devices.
5. “online payment
transaction” means a transaction conducted by electronic means via online
banking system.
6. “client” may be
an organization or individual using online banking services.
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
8. “electronic
transaction authentication” (hereinafter referred to as “transaction
authentication”) means a form of authentication by electronic means to
express the client’s acceptance of data messages in an electronic transaction.
9. “end-to-end
encryption” means a mechanism by which information is securely encrypted at
the original point before being sent and is decrypted only after being received
at the destination point in the process of information exchange between
applications or devices in a system in order to limit the risk of information
exposure or leakage on transmission lines.
10. “database
management system” means software designed for management, storage,
retrieval and execution of queries on data within a database.
Article
3. General principles of ensuring security and confidentiality of the
information system during provision of online banking services
1. Online banking systems
must comply with regulations on ensuring information system security at level 3
or higher in accordance with regulations of law on assurance of information
system security by levels; for information systems providing switching services
and electronic clearing services, they must comply with regulations on
assurance of information system security at level 4 or higher; comply with TCVN
11930:2017 (Information technology - Security techniques - Basic requirements
for securing information according to security levels) and regulations of the
State Bank of Vietnam (hereinafter referred to as “SBV”) on information system
security in banking operations.
2. Confidentiality and
integrity of client information must be ensured; availability of the online
banking system must be ensured to provide services in an uninterrupted manner.
3. Client's transactions
must be classified and assessed in terms of their minimum risk level by groups
of clients, their behaviors, transaction type, transaction limit (if any) and
compliance with relevant laws. On that basis, the unit shall provide
appropriate forms of transaction authentication to the clients for their choice
by way of complying with at least the following regulations:
a) Applying at least one
of the authentication forms specified in clauses 3 through 9 Article 11 of this
Circular upon changing the client's identification information;
b) Applying at least one
or combination of transaction authentication forms according to this Circular.
In case a legislative document providing guidance on the services specified in
clause 1 Article 1 of this Circular stipulates the form of transaction
authentication, such legislative document shall be complied with;
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
4. The online banking
system must have its security and confidentially inspected and assessed on an
annual basis.
5. Risks, possibility of
occurrence and causes of risks must be regularly identified to promptly adopt
measures to prevent, control and manage risks during provision of online
banking services.
6. Information technology
(IT) infrastructure and equipment for provision of online banking services must
be protected by copyright and of clear origin. For equipment which is about to
reach the end of its life cycle and is no longer supported by
manufacturers, the unit shall plan to upgrade or replace it as notified by the
manufacturers, ensuring that equipment is able to be come with a new software
version. Pending the upgradation or replacement, the unit must take measures to
enhance the security and confidentiality of the online banking system.
7. Regarding systems
providing electronic payment gateway services, payments- and
collections-on-behalf-of services, the regulations set out in clauses 7, 9
and 10 Article 7 and Section 2 Chapter II of this Circular are not required to
be complied with.
8. Every online banking
systems may operate and provide services to clients only when its security and
confidentiality are ensured in accordance with this Circular and relevant
regulations of law.
Chapter
II
SPECIFIC
PROVISIONS
Section
1. TECHNICAL INFRASTRUCTURE OF THE ONLINE BANKING SYSTEM
Article
4. Network, communication, security and confidentiality systems
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
1. Security and
confidentiality solutions should be in place, containing at least:
a) Application firewall
or equivalent protection solutions;
b) Database firewall or
equivalent protection solutions;
c) Solutions for
prevention against denial-of-service attacks (DoS), distributed denial of
service attack (DDoS) for systems directly providing services on the Internet;
d) Information security
event management and analysis system.
2. Client information
(client identification information, clients’ transaction information) must not
be stored in the Internet connection zone and demilitarized zone (DMZ).
3. Policies should be in
place to minimize services and gateways connected to the online banking system.
4. Any inbound connection
to the online banking system for administration is permitted only when it is
impossible to establish connection from the internal network and ensure safety
and the following regulations shall be complied with:
a) The connection is
approved by a competent authority after considering its purpose and method;
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
c) Connecting devices
must come with software that ensures security and confidentiality;
d) At least two of the
authentication forms specified in clauses 1, 3, 4, 7, 8 and 9 Article 11 of
this Circular are applied when logging in the system;
dd) Securely encrypted
communication protocols must be used and passwords must be not saved in utility
software.
5. The high availability
and uninterrupted service provision of network connection lines for service
provision must be ensured.
Article
5. Server system and system software
1. Requirements for a
server:
a) Its monthly average
usage, including a central processing unit (CPU), internal memory (RAM), data
storage devices, devices for retrieving data upon data storage or transmission,
is up to 80% of its design capacity;
b) The online banking
system must have a backup server that ensures high availability;
c) It is logically or
physically separated from other servers serving professional operations;
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
2. Each unit shall make a
list of software permitted to be installed in servers, and ensure that such
list is updated and inspected at least once every 06 months and strictly
complied with.
Article
6. Database management system
1. The database
management system must have security and access management mechanism in order
to protect the data therein.
2. The online banking system
must have a backup database for disaster discovery which is able to replace the
main database and ensure the completeness and integrity of clients’ transaction
data.
3. The database
management system must be checked and hardened, and patches must be updated
regularly.
4. Units must take
measures to supervise and log access to the database and manipulations upon
access to the database.
Article
7. Online banking application software
1. Security and
confidentiality requirements must be determined before developing software, and
satisfied in the process of development (analysis, design, development,
testing), official operation and maintenance of the software. Documents on
software security and confidentiality must be systemized, stored and
synchronously updated upon changes to the system, and strictly controlled
through limited access.
2. Every unit shall
control software source codes in accordance with at least the following
requirements:
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
(i) On a periodic basis
or when there is any change in the application software, the unit must check
source codes to remove malicious codes and security vulnerabilities. The
personnel performing the check must be independent of the personnel developing
the software source codes;
(ii) Appoint specific
individuals responsible for managing source codes of online banking application
software;
(iii) Source codes must
be kept safely in at least two geographically separate locations, and measures
must be in place to protect their integrity.
b) For outsourced
software source codes:
(i) The unit must request
the supplier to sign a commitment that the software source code is legitimate
and genuine; commit to implementing agreements on editing the source code upon
software warranty and maintenance;
(ii) In case of source
code handover, before the handover, the unit shall request the supplier to
check, handle and fix security vulnerabilities in the source code. After the
source code is handed over, the unit shall comply with the provisions set forth
under point a of this clause;
(iii) In case the unit is
not handed the source code, when signing the handover record, it must request
the supplier to scan and remove malicious codes and sign a commitment that the
application software does not contain malicious codes.
3. Online banking
application software must be inspected and tested before official operation,
satisfying at least the following requirements:
a) Prepare and approve
plans and scenarios for testing online banking application software, explicitly
stating safety and confidentiality conditions to be satisfied;
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
c) Assess and scan to
detect technical vulnerabilities and weaknesses. Assess the capacity for
prevention of attacks, including but not limited to Injection (SQL, Xpath,
LDAP), Cross-site Scripting (XSS), Cross-site Request Forgery (XSRF),
Server-Side Request Forgery (SSRS), Brute-Force, and such
confidentiality-related errors as access control errors; identification and
authentication errors; encryption errors; design errors, insecure
configurations; logging and security monitoring errors;
d) Record errors and
process of fixing errors, especially security and confidentiality-related errors,
in the software inspection and testing reports;
dd) Inspect and test
security and confidentiality features on popular browsers (for online banking
application software provided via website platform) and operating system
software of mobile devices (for Mobile Banking application software); provide
mechanisms for checking and immediate notification to clients when running
applications on browsers or mobile device’s operating system software versions
which have undergone safety inspection and testing.
4. Before deploying new
online banking application software, a unit shall assess the risks of the
deployment process to related professional operations and IT systems, and
prepare and implement plans to minimize these risks.
5. Each unit shall manage
changes of online banking application software versions according to following
requirements:
a) Documents on the
analysis of the impacts of the change of application software on the existing
system and other related systems of the unit must be formulated and approved by
the competent authority before implementation;
b) Software versions,
including also source codes developed by the unit itself or handed over by the
supplier, must be managed in a centralized manner, stored and kept confidential
and a mechanism must be in place to grant privilege to each member and record
logs during manipulation of files;
c) Information on
versions (update time, persons updating such versions, instructions for
updating and other relevant information on such versions) must be stored;
d) The upgradation of
versions must rely on testing results and be approved by competent authorities.
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
a) Applying end-to-end
encryption to all data transmitted online or data exchanged between online
banking application software and related equipment;
b) Ensuring the integrity
of transaction data; promptly detecting, warning, and preventing all
unauthorized modifications, or adopting appropriate measures to handle such
unauthorized modifications to ensure the accuracy of transaction data in the
process of transaction processing and data storage;
c) Controlling
transaction sessions: The system must automatically apply session timeout in a
case where a user has been inactive for a certain period of time prescribed by
the unit or apply other protective measures;
d) Having the function of
hiding passwords or PINs used to log in the system;
dd) Having the function
of disabling automatic login;
e) Where the
e-transaction account prescribed in clause 1 Article 9 of this Circular uses a
PIN or password as a form of authentication, the online banking application
software must have functions to control the PIN and password;
(i) Requesting the client
to change the PIN or password in case the client is granted a default PIN or
password for the first time;
(ii) Notifying the client
when the PIN or password is about to expire;
(iii) Invalidating the
PIN or password when it expires; requesting the client to change the expired PIN
or password when the client uses the PIN or password to log in;
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
(v) The unit shall only
regrant the PIN or password at the client’s request and must verify and
identify the client before the regrant to prevent fraud and forgery.
g) With regard to a
client being an organization, the application software shall be designed in a
manner to ensure that every online payment transaction is conducted in two
steps as follows: creation and approval of the transaction. For a client being
a business household or micro-enterprise applying a simple accounting regime,
the transaction is not required to be conducted by separating the two aforesaid
steps;
h) Having the function of
notifying the first login to the online banking application software or the
login to the online banking application software on a device different from the
one last used to log in the online banking application software via SMS or
other channels registered by the client (phone, email, etc.), except where an
institutional client: logs in on devices that have been used for registration
for use of services; or logs in using at least one of the authentication forms
specified in clauses 3, 4, 5, 7, 8, and 9 Article 11 of this Circular.
7. Online banking
application software must have the function of online storage of information
about the devices that perform clients’ transactions, transaction logs,
transaction authentication logs for at least 03 months and backup for at least
01 year, including:
a) Device identification
information:
(i) For mobile devices: unique
identifiers (e.g., IMEI or Serial number or WLAN MAC or Android ID or other
identification information);
(ii) For computers:
unique identifiers (such as the MAC address or a combination of
computer-related information that can uniquely identify a computer).
b) Transaction logs,
including at least transaction code, client name, transaction initiation time,
transaction type, transaction value (if any);
c) Transaction
authentication logs, including at least transaction authentication form and
transaction authentication time. In case of biometric authentication, the unit
shall store the client's biometric information when performing the transaction
for at least the 10 most recent transactions of that client.
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
a) The unit shall only
provide online banking services by STP method for institutional clients. The
unit is shall select, appraise, supervise, manage and reach an agreement with
the clients when providing online banking services by STP method;
b) Online banking
application software must have the function of authenticating the connection
with the institutional client’s software to prevent fraud and forgery;
c) The application of the
regulations in points c, dd, e, g, and h clause 6 and point a clause 7 of this
Article is optional.
9. Card issuers providing
online payment services using bank cards must have online banking application
software which has at least the following features:
a) Permitting or not
permitting online payment;
b) Setting limits on
daily online payment using bank cards;
c) Permitting or not
permitting overseas payments at point-of-sale terminals and automated teller
machines;
d) Permitting clients to
register to choose between proactively confirming or agreeing to let the card
issuer confirm all or part of online payment transactions using bank cards
(online card payment transactions) in case of applying the authentication form
as prescribed in clause 10 Article 11 of this Circular.
10. Online banking
application software must have the function of notifying clients of
transactions occurring via SMS or email or mobile banking application software
or other communication channels registered by clients.
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
Mobile banking
application software provided by each unit must comply with Article 7 of this
Circular and the following requirements:
1. The software must be
registered and managed on the official application store of the mobile
operating system provider and explicit installation instructions must be
available on the unit's website so as for clients to download and install the
mobile banking application software. In case the mobile banking application
software is not registered and managed on the official application store of the
mobile operating system provider for objective reasons, the unit must adopt a
method of providing instructions for, notifying, supporting the installation of
the mobile banking application software to ensure security and confidentiality
for clients and report to SBV (the Information Technology Department) before
providing the service.
2. Protective measures
must be taken to minimize the reverse engineering of the source code.
3. Measures shall be in
place to prevent interference in the data exchange flow on the mobile banking
application and between the mobile banking application and the server providing
online banking services.
4. Solutions must be
adopted to prevent, combat and detect unauthorized interference in the mobile
banking application installed on clients’ mobile devices.
5. The password-saving
feature is not permitted.
6. For individual
clients, there must be a function of verifying a client when they first log in
or when they log in on a device different from the one last used to log in the online
banking application software. The client verification includes at least the
following:
a) The match with SMS OTP
or Voice OTP via the client's registered phone number or Soft OTP/Token OTP;
b) The match with
biometric information as prescribed in clause 5 Article 11 of this Circular in
case the specialized legal document related to the service provided on the
mobile banking application software stipulates the collection and storage of
clients' biometric information.
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
Article
9. Access to online banking application software
1. Every registered user
of online banking application software must be identified by the unit and
granted an e-transaction account. The e-transaction account comprises username
and at least one of the forms of authentication specified in clauses 1 to 9 of
Article 11 of this Circular.
2. Each client shall
access online banking application software by using their e-transaction account
issued by the unit or using Single Sign-On method through the e-transaction
account of another information system that has been integrated by the unit
registered by the client.
Article
10. Transaction authentication
1. For online payment
transactions:
a) For payment
transactions using checking accounts or e-wallets or money transfers from debit
cards or identified prepaid cards, the unit shall classify transactions by
their type specified in the Appendix 01 to this Circular and apply the
authentication form specified in the Appendix 02 to this Circular, except for
the regulations set out under points b, c, d and dd of this clause;
b) For payment
transactions conducting using STP method, the unit shall confirm the
transactions using at least one of the authentication forms specified in
clauses 7, 8, and 9 Article 11 of this Circular;
c) For online card
payment transactions (excluding money transfer transactions), the unit shall
classify transactions according to the transaction type groups specified in
Appendix 03 to this Circular and apply the authentication forms specified in
the Appendix 04 to this Circular;
d) For transactions in
which the unit automatically debits checking accounts, automatically debits
e-wallets or automatically makes payments from the clients’ cards as agreed upon
with clients, the transaction authentication specified in points a and c clause
1 of this Article is not required;
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
2. For services
registered for automatic payments from checking accounts, e-wallets and cards
of clients, the unit must apply at least one of the authentication forms
specified in clauses 3 to 9 Article 11 of this Circular.
3. For other
transactions, in addition to the transactions specified in clauses 1 and 2 of
this Article, the unit shall, by way of risk assessment and compliance with
relevant laws, select an appropriate form of authentication prescribed in
Article 11 of this Circular to provide it to registered users and shall be
responsible for its selection.
4. Where a client is a
person with disability, the unit shall, based on its conditions and supply
capacity, provide appropriate forms of authentication and instruct them in
their selection. It is not required to apply the regulations in clauses 1, 2,
and 3 of this Article but is required to ensure that the check is carried out
and the client's consent is confirmed when conducting any transaction in
accordance with the law on e-transactions and this Circular.
Article
11. Authentication forms
1. Password-based
authentication: A client uses a password which is a string of characters used
to confirm their access to an information system, application or service or to
confirm their transactions. The authentication by password must meet the
following requirements:
a) A password must have
at least 08 characters and contain at least the following: numbers, uppercase
letters, lowercase letters;
b) The maximum validity
period of the password is 12 months. For the default password, the maximum
validity period is 30 days.
2. PIN (Personal
Identification Number) authentication: It refers to a form of authentication
based on a password which is created from a string of digits. PIN
authentication (except for PINs attached to physical cards) must meet the
following requirements:
a) A PIN must be at least
06 characters long;
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
3. One Time Password
(OTP) authentication: It is a form of authentication based on a password which
can only be used once and is valid for a certain period of time, including the
following forms:
a) SMS OTP is a form of authentication based on an OTP sent via short
message services (SMS) or messages via basic telecommunications services on the
Internet. An SMS OTP must meet the following requirements:
(i) The OTP sent to a
client must be attached with a notification so as for them to understand its
purposes;
(ii) The OTP must be
valid for up to 05 minutes.
b) Voice OTP is a
form of authentication based on an OTP sent via a voice call or call via basic
telecommunications services on the Internet. Voice OTP must meet the following
requirements:
(i) The OTP sent to a
client must be attached with a notification so as for them to understand its
purposes;
(ii) The OTP must be
valid for up to 03 minutes.
c) Email OTP is a form
of authentication based on an OTP sent via email. An email OTP must meet the
following requirements:
(i) The OTP sent to a
client must be attached with a notification so as for them to understand its
purposes;
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
d) OTP matrix card
is a form of OTP authentication determined from a 2-dimensional table (rows,
columns) in which every row or column corresponds to an OTP. An OTP matrix card
must meet the following requirements:
(i) The OTP matrix card
must be valid for up to 01 year from the date of registration;
(ii) The OTP must be
valid for up to 02 minutes.
dd) Soft OTP is a form of
authentication based on an OTP generated by software installed on the client's
mobile device. Soft OTP software may be standalone software or integrated with
mobile banking application software.
Soft OTP is classified
into 02 types: (i) Basic Soft OTP: The OTP is randomly generated over
time and synchronized with the online banking system; (ii) Advanced Soft
OTP: The OTP is generated in combination with the code of each transaction.
Upon conducting a transaction, the online banking system generates a
transaction code to notify the client or transmit it to the Soft OTP software.
The client or the Soft OTP software automatically enters the transaction code
in the Soft OTP software in order for the latter to generate an OTP.
A Soft OTP must meet the
following requirements:
(i) In case the Soft OTP
software is independent from the mobile banking application software, it must
be registered and managed by the unit on the official application store of the
mobile operating system provider and explicit installation instructions must be
available on the unit's website so as for clients to download and install the
Soft OTP software;
(ii) The Soft OTP
software must require activation before use. The Soft OTP activation code shall
be provided by the unit to clients and can only be used for activation on a
single mobile device. The activation code must have an expiration date;
(iii) The Soft OTP software
must have an access control function. If the Soft OTP attempt limit (but
not more than 10 attempts) is exceeded, access to the Soft OTP software will be
automatically blocked. The unit shall unlock the Soft OTP software only when
the client so requests and identify the client before unlocking in order to
prevent fraud and forgery.
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
(v) The OTP must be valid
for up to 02 minutes.
e) OTP Token
is a form of authentication based on an OTP generated by a specialized device.
OTP Token is classified into 02 types: (i) Basic OTP Token: The OTP is randomly
generated over time and synchronized with the online banking system; (ii) Advanced
OTP Token: The OTP is generated in combination with the code of each
transaction. When performing a transaction, the online banking system generates
a transaction code to notify the client, the client enters the transaction code
in the OTP Token so that the device can generate an OTP. The OTP Token must be
valid for up to 02 minutes.
4. Two-channel
authentication: It refers to an authentication form whereby a client conducts a
transaction, the online banking system sends a request for transaction
authentication to the client's mobile device via a voice call or call via basic
telecommunications service on the Internet or via USSD (Unstructured
Supplementary Service Data) message code or via specialized software and the
client shall respond directly through the connected channel to confirm whether
the transaction is conducted. The authentication request required by this form
must be valid for up to 05 minutes.
5. Biometric
authentication: It is the process of making comparison to ensure that the
biometric information of the client conducting a transaction matches their
biometric information collected and stored at the unit as per the regulations
imposed by SBV's Governor. Biometric authentication must meet the following
minimum requirements:
a) In case of applying
the face matching method:
(i) Its accuracy shall be
determined according to international standards (or equivalent) as follows: The
false reject rate and false accept rate shall meet the requirement of < 5%
and < 0.01% respectively according to the FIDO Biometric Requirements
(applicable to a set of at least 10,000 samples);
(ii) It has the ability
to detect biometric spoofing attacks of live objects (Presentation Attack
Detection - PAD) according to international standards (such as NIST Special
Publication 800-63B Digital Identity Guidelines: Authentication and Lifecycle
Management or ISO 30107 - Biometric presentation attack detection or FIDO
Biometric Requirements) to prevent fraud and spoofing through images, videos
and 3D masks.
b) In case of applying
other methods of biometric information matching, it is required to ensure
prevention of spoofing and fraud according to equivalent standards;
c) The Presentation Attack
Detection - PAD prescribed in point a of this clause which is deployed by the
unit itself or provided by a third party must be certified by a biometric
organization/laboratory accredited by the FIDO Alliance;
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
dd) The time limit for
biometric authentication is up to 03 minutes.
6. Device-based
biometric authentication: It refers to the process of making comparison to
ensure that the biometric information of the client conducting a transaction
matches the biometric information of the client stored on their mobile device.
Device-based biometric authentication must meet the following minimum
requirements:
a) Activation is
permitted only after the client’s consent has been obtained and the client has
conducted at least one successful transaction by applying another form of
authentication;
b) The time limit for
biometric authentication is up to 02 minutes.
7. FIDO (Fast IDentity
Online) authentication is a form of authentication according to the standard
for transaction authentication using asymmetric key algorithms (including
private keys used to generate digital signatures, and public keys used to
validate digital signatures) issued by the FIDO Alliance. FIDO authentication
must meet the following requirements:
a) The private key is
securely stored on the client's device. The client uses PIN authentication or
biometric authentication on their device to access and use the private key when
conducting transactions;
b) The public key is
securely stored at the unit and linked to the client's e-transaction account;
c) The solution deployed
by the unit itself or provided by a third party must be certified by an
organization accredited by the FIDO Alliance.
8. E-signature
authentication: It is specified under regulations of law on e-signatures
(excluding secure e-signatures specified in clause 9 of this Article).
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
10. Authentication form
based on risk assessment for online card payment transactions according to EMV
3-D Secure (hereinafter referred to as “EMV 3DS authentication”). The
EMV 3-D authentication must meet the requirement: Card issuers, acquirers and
merchants must implement the EMV 3-D Secure.
11. Authentication
through operations showing the client's authentication of a data message
when performing a transaction such as clicking accept, approve, send or similar
operations on the online banking application software. Such authentication form
must meet the following requirements:
a) Authentication
operations must be logged so as to retrieve information related to these
authentication operations;
b) Clients must be
organizations that have logged in the online banking application software using
the authentication forms as prescribed in this Article, except for clauses 1,
2, 6, and 10.
Section
3. OPERATION MANAGEMENT
Article
12. Management of personnel in charge of administration and operation of online
banking systems
1. Each unit shall assign
personnel to supervise and monitor operations of its online banking system,
detect and handle technical incidents and cyberattacks.
2. Each unit shall assign
personnel to receive information and support clients, and promptly contacting
clients upon detection of unusual transactions.
3. The personnel in
charge of administration, supervision and operation of the online banking
system shall participate in annual training courses to update knowledge about
security and confidentiality.
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
Article
13. Management of operations of the operating environment of online banking
systems
1. Any unit is not
permitted to install or store application development software and source codes
in the operating environment.
2. The administration,
supervision and operation must meet the following requirements:
a) Personnel in charge of
administration, supervision and operation shall only be permitted to install
allowed software on their computers and must install anti-malware software;
these computers must frequently update malware identification patterns and not
permit the automatic disabling of anti-malware software;
b) System administration,
supervision and operation connections must be established through intermediate
servers or secure and controlled centralized administration systems and must
not be established directly from the computers of the personnel in charge of
administration, supervision and operation;
c) An account with
administrator privilege shall be granted for a limited period of time that is
just enough to finish the task and revoked immediately at the end of the
working session;
d) It is required to take
measures to monitor the use of accounts with administrator, supervisor and
operator privilege and provide warnings when there is any unusual impact on the
database or applications.
3. Every unit shall
tailor a policy for computers used for administration, supervision and
operation of its online banking system; these computers may only be connected
to the online banking system or other information systems of the unit in
service of the administration, supervision and operation.
Article
14. Management of technical vulnerabilities and weaknesses
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
1. Taking measures to
prevent, combat and discover illegal changes to the online banking application
software.
2. Establishing
mechanisms to detect, prevent and combat intrusion into or cyberattacks to the
online banking system.
3. Cooperating with
regulatory bodies and IT partners in promptly obtaining information on
incidents and circumstances regarding information security and confidentiality
to take appropriate preventative measures.
4. Updating information
on published vulnerabilities related to system software, database management
system, and application software from the Common Vulnerability Scoring System -
version 4 (CVSS, v4.0 or equivalent).
5. Scanning
vulnerabilities and weaknesses of the online banking system at least once a
year or when receiving information related to new vulnerabilities and
weaknesses. For system components directly connected to the Internet, scanning
vulnerabilities and weaknesses at least once every 03 months. Assessing the
level of impact and risk of each discovered technical vulnerability and
weakness of the system and proposing solutions and plans for handling thereof.
6. Updating security
patches or prompt preventive measures based on the level of impact and risk:
a) For a vulnerability
rated critical: Within 01 day for system components directly connected to the
Internet; within 01 month for remaining components after the vulnerability is
announced or discovered.
b) For a vulnerability
rated high: Within 01 day for system components directly connected to the
Internet; within 02 months for remaining components after the vulnerability is
announced or discovered.
c) For a vulnerability
rated medium or low: Within the time limit decided by the unit.
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
1. Each unit shall
establish a system for supervising and monitoring operations of its online
banking system. The system for supervising and monitoring operations of the
online banking system must fully collect logs of the components of the online
banking system to detect and investigate unusual events or cyberattacks.
2. Each unit shall
develop criteria and software to warn unusual transactions based on time,
geographical location, transaction frequency, transaction money (if any),
number of incorrect login attempts exceeding the prescribed limit, and other
unusual signs.
Article
16. Assurance of uninterrupted operations
Each unit shall develop a
disaster prevention system and processes and scenarios to ensure uninterrupted
operations of its online banking system in accordance with SBV’s regulations on
security and confidentiality of the information technology system in banking
operations. In addition, the unit shall:
1. Analyze and identify
circumstances likely to cause information insecurity and disruption of
operations of the online banking system. Identify and assess each circumstance with
high and medium level of risk and possibility of occurrence at least once every
06 months. Make a list of circumstances with high, medium, acceptable and low
level of risk and possibility of occurrence.
2. Prepare plans,
including processes and scenarios, for remedying circumstances with high and
medium level of risk and possibility of occurrence as prescribed in clause 1 of
this Article. Determine the maximum downtime to restore the system and database
for a plan to handle each circumstance. Disseminate the plan to relevant
personnel so as for them to clearly understand their tasks in each
circumstance.
3. Provide human and
financial resources and technical equipment to organize drills of plans for
handling circumstances with a high level of risk and possibility of occurrence
at least once every year.
4. Formulate plans and
hold drills to ensure uninterrupted business operations, store related
documents and assess drill results.
Section
4. PROTECTION OF CLIENTS’ INTERESTS
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
1. Each unit shall
publicize information about online banking services, ensure that clients have
access to information before or at the time of registering to use the services,
at least including:
a) Method of providing
the services, method of accessing the online banking services corresponding to
each access equipment;
b) Transaction limit (if
any) and transaction authentication forms;
c) Equipment required to
use the services, conditions applicable to the equipment used;
d) Risks related to the
use of online banking services.
2. Each unit shall inform
clients about terms of the agreement on provision and use of online banking
services, at least containing:
a) Rights and obligations
of clients when using online banking services;
b) Types of client data
that the unit collects, purposes of using client data and the unit’s
responsibility for ensuring confidentiality of client data in accordance with
law, except where the unit and the client have reached another agreement on the
protection of client data in accordance with law;
c) Undertaking to
maintain uninterrupted operations of the online banking system, at least
including one-time service interruption time, total service interruption time
in one year, except for force majeure events or cases of system maintenance and
upgradation notified by the unit;
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
3. The unit shall not
send SMS or emails to clients containing hyperlinks to access websites unless otherwise requested by the client.
Article
18. Instructing clients in use of online banking services
1. Units shall develop
processes and manuals for installation and use of software, applications and
equipment for conducting online banking transactions, instruct clients in applying
such processes and using such manuals.
2. Units shall instruct
clients in taking measures to ensure safety and confidentiality when using
online banking services, including at least the following:
a) Protecting passwords,
PINs and OTPs and not sharing equipment storing such information;
b) Principles of creating
and changing passwords and PINs of e-transaction accounts;
c) Not using public
computers to access the online banking system or conduct transactions; not
using public Wi-Fi when using online banking services;
d) Not saving usernames
and passwords, PINs on browsers;
dd) Logging out from
online banking application software after use;
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
g) Fully installing
security patches for operating systems and mobile banking application software;
considering installing anti-malware software and updating the latest malware
identification pattern on personal devices used to conduct transactions;
h) Selecting
authentication forms with the level of security and confidentiality in
accordance with regulations and in a manner that suit clients' need for
transaction limits;
i) Issuing warnings of
the risks related to the use of online banking services;
k) Not using unlocked
mobile devices to download and use online banking application software or OTP
generator software;
l) Not installing strange
software, unlicensed software or software of unknown origin;
m) Promptly notifying the
unit when detecting unusual transactions;
n) Immediately notifying
the unit of the loss of or damage to OTP generators, phone numbers receiving
SMS, devices storing keys used to generate e-signature; cases of fraudulence or
suspicious fraudulence; or attacks or suspicious attacks by hackers.
3. Units must provide
clients with information about their focal points for receiving information,
hotlines and instructions on the process and methods for cooperation in
handling errors and incidents in the course of using online banking services.
4. Units must provide
clients with explanation for specific cases in which the units will contact
them, methods and means of communication during the clients' use of online
banking services.
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
Each unit shall apply
measures to ensure security and confidentiality of client data, comprising at
least the following:
1. Ensuring security and
confidentiality of client data in accordance with law.
2. Storing information
used to authenticate client transactions including passwords, PINs, and
biometric information by using encryption or concealment measures to ensure
confidentiality.
3. Granting access to
client data to personnel in charge of accessing such data according to their
functions and tasks; and taking measures to monitor each access.
4. Taking measures to
manage access to equipment and devices used to store client data to prevent the
risk of exposure and leakage of data.
5. Notifying clients of
any incident that causes client data exposure or leakage, and promptly
reporting it to SBV (the Information Technology Department).
Chapter
III
IMPLEMENTATION
CLAUSE
Article
20. Reporting regime
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
1. Report on provision of
online banking services:
a) Time limit for
submitting the report: At least 10 working days before the official provision
of online banking services;
b) Details of the report:
(i) Website address or
application store;
(ii) The official date of
provision;
(iii) Solutions for
verifying clients accessing online banking services; forms of transaction
authentication applicable to each type of transaction and transaction limit (if
any);
(iv) Copies of
certificates of security and confidentiality assurance, spoofing and fraud
prevention prescribed in clauses 5 and 7 Article 11 of this Circular.
2. Ad hoc report at SBV's
request.
Article
21. Responsibilities of units affiliated to SBV
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
2. The Banking
Supervision Agency shall inspect and supervise the implementation of this
Circular and impose penalties for violations in accordance with law.
3. SBV branches of
provinces and cities shall inspect and supervise the implementation of this
Circular by local intermediary payment service providers (except for the National
Payment Corporation of Vietnam - NAPAS) and impose penalties for violations in
accordance with law.
Article
22. Effect
1. This Circular comes
into force from January 01, 2025, except for the cases specified in clauses 2,
3 and 4 of this Article.
2. Point b clause 1 of
Article 4, point d clause 9 of Article 7 and clause 4 of Article 8 come into
force from July 01, 2025.
3. Point b clause 1 of
Article 10 comes into force from January 01, 2026.
4. Point c clause 5 of
Article 11, point c clause 7 of Article 11 and point b (iv) clause 1 of Article
20 come into force from July 01, 2026.
5. The following
documents shall cease to have effective from the effect date of this Circular:
a) Circular No.
35/2016/TT-NHNN dated December 29, 2016 of SBV’s Governor;
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
6. Article 25 of the
Circular No. 09/2020/TT-NHNN dated October 21, 2020 of SBV’s Governor is
repealed.
Article
23. Transitional clauses
1. For services
registered for automatic payments from checking accounts, e-wallets and cards
of clients before the effective date of this Circular shall continue to be
rendered until the expiry of the signed agreements; in case the agreements do
not specify an expiry date, they shall continue to be implemented until
December 31, 2026. The amendment and extension of such agreements must comply
with clause 2 Article 10 of this Circular.
2. Passwords and PINs
that are in use before the effective date of this Circular shall continue to be
used until the client changes them or until the end of their validity period.
From the effective date of this Circular, any change of passwords and PINs must
comply with clauses 1 and 2 Article 11 of this Circular.
Article
24. Organizing implementation
Chief of Office, Director
General of Information Technology Department and heads of units affiliated to
SBV, Chairpersons of Boards of Directors, Chairpersons of Board of Members,
Directors General (Directors) of credit institutions, foreign branch banks,
intermediary payment service providers and credit information companies are
responsible for the implementation of this Circular./.
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
APPENDIX 01
CLASSIFICATION OF ONLINE PAYMENT TRANSACTIONS
(Enclosed with the Circular No. 50/2024/TT-NHNN
dated October 31, 2024 of the Governor of the State Bank of Vietnam)
No.
Description
Category A
Category B
Category C
Category D
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
Individual
client
1
Group
I.1:
- Money
transfer between payment accounts, debit cards, identified prepaid cards
(hereinafter referred to as “cards”) of a client in a payment service
provider.
- Money
transfer between e-wallets of a client in an intermediary payment service
provider.
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
2
Group
I.2:
- Transactions
including payments of lawful goods and services processed by payment service
providers and intermediary payment service provider or at payment acceptors
selected, appraised, supervised and managed by payment service providers and
intermediary payment service providers
Any
transaction that satisfies the following condition:
G + T ≤
VND 5 million.
Any
transaction that satisfies the following conditions:
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
(ii) G
+ T ≤ VND 100 million.
Any
transaction that satisfies the following conditions:
(i) G +
T > VND 100 million.
(ii) G
+ T ≤ VND 1.5 billion.
Any
transaction that satisfies the following condition:
G + T
> VND 1.5 billion.
3
Group
I.3:
- Money
transfer between checking accounts, cards, e-wallets of different account
holders, card holders and e-wallet owners.
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
- E-wallet
cash-in1.
- E-wallet
cash-out.
Any
cash-in or cash-out between an e-wallet and VND account of an e-wallet owner
at the affiliated bank according to regulations of law that satisfies the
following conditions:
(i) G ≤
VND 10 million.
(ii) G
+ Tksth ≤ VND 20 million.
Any
transaction (except cash-in or cash-out between an e-wallet and VND account
of an e-wallet owner at the affiliated bank according to regulations of law)
that satisfies the following conditions:
(i) G ≤
VND 10 million.
(ii) G
+ Tksth ≤ VND 20 million.
Any
transaction that satisfies one of the following conditions:
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
(i) G ≤
VND 10 million.
(ii) G
+ Tksth > VND 20 million.
(iii) G
+ T ≤ VND 1.5 billion.
2. 2.
Any transaction that satisfies the following conditions:
(i) G
> VND 10 million.
(ii) G
≤ VND 500 million.
(iii) G
+ T ≤ VND 1.5 billion.
Any
transaction that satisfies one of the following conditions:
1. 1.
Any transaction that satisfies the following conditions:
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
(ii) G
+ Tksth > VND 20 million.
(iii) G
+ T > VND 1.5 billion.
2. 2.
Any transaction that satisfies the following conditions:
(i) G
> VND 10 million.
(ii) G
≤ VND 500 million.
(iii) G
+ T > VND 1.5 billion.
3. 3.
Any transaction that satisfies the following condition:
G >
VND 500 million.
4
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
Outbound
interbank transfer2.
Any
transaction that satisfies the following conditions:
(i) G ≤
VND 200 million.
(ii) G
+ T ≤ VND 1 billion.
Any
transaction that satisfies one of the following conditions:
1. 1.
Any transaction that satisfies the following conditions:
(i) G ≤
VND 200 million.
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
2. 2.
Any transaction that satisfies the following condition:
G >
VND 200 million.
II
Institutional
client3
1
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
Money
transfer between checking accounts or e-wallets of the same client in a
payment service provider or intermediary payment service provider.
All
transactions.
2
Group
II.2:
- Money
transfer between checking accounts and e-wallets of different account holders
and e-wallet owners.
- Money
transfer between accounts and e-wallets opened at different payment service
providers and intermediary payment service providers.
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
- E-wallet
cash-in1.
- E-wallet
cash-out.
Any
transaction that satisfies the following conditions:
(i) G +
T ≤ VND 1 billion.
(ii) G
+ T ≤ VND 10 billion.
Any
transaction that satisfies one of the following conditions:
1. 1.
Any transaction that satisfies the following conditions:
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
(ii) G
+ T > VND 10 billion.
2. 2.
Any transaction that satisfies the following condition:
G >
VND 1 billion.
3
Group
II.3:
Outbound
interbank transfer2.
Any
transaction that satisfies the following conditions:
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
(ii) G
+ T ≤ VND 5 billion.
Any
transaction that satisfies one of the following conditions:
1. 1.
Any transaction that satisfies the following conditions:
(i) G ≤
VND 500 million.
(ii) G
+ T > VND 5 billion.
2. 2.
Any transaction that satisfies the following condition:
G >
VND 500 million.
Notes:
G: Value
of the transaction.
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
T: Total
value of each category of transactions performed in a day (on a checking
account (including e-wallet cash-in) or an e-wallet (excluding e-wallet
cash-in) of a client at a payment service provider or intermediary payment
service provider, excluding checking account auto-debit, e-wallet auto-debit
and card auto-debit transactions.
(1) In
case of e-wallet cash-in from the e-wallet owner's VND account at an affiliated
bank, the transaction classification shall rely on the checking account linked
to the e-wallet.
(2)
Converted limit is based on exchange rate at the time of transaction.
(3) In case
the client is a business household or a micro-enterprise applying a simple
accounting regime, transactions of such business household or micro-enterprise
are classified similarly to transactions of an individual client.
APPENDIX 02
ONLINE PAYMENT TRANSACTION AUTHENTICATION
(Enclosed with the Circular No. 50/2024/TT-NHNN dated October 31, 2024 of
the Governor of the State Bank of Vietnam)
No.
Transaction
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
Individual client
Institutional client
1
Category
A transaction
- Password
or PIN (if authenticated at the login step, authentication is not required at
the transaction step).
- Password
or PIN (if authenticated at the login step, authentication is not required at
the transaction step).
2
Category
B transaction
- SMS
OTP or Voice OTP or Email OTP;
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
- Or
basic or advanced Soft OTP/ Token OTP;
- Or
two-channel;
- Or
device-based biometric authentication1;
- Or
FIDO;
- Or
e-signatures;
- Or secure
e-signatures.
- SMS
OTP or Voice OTP or Email OTP;
- Or
OTP Matrix Card;
- Or
matching the device-based biometric information of the legal representative
or the individual authorized by the legal representative (if any).
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
Category
C transaction
- OTP
sent via SMS/Voice or basic Soft OTP/Token OTP or e-signatures,
- And
biometric authentication.
- Basic
Soft OTP/ Token OTP;
- Or
two-channel;
- Or
e-signatures.
4
Category
D transaction
- Advanced
Soft OTP/Token OTP or FIDO or secure e-signatures,
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
- Advanced
Soft OTP/ Token OTP;
- Or
FIDO;
- Or secure
e-signatures.
Notes:
- Details
about authentication forms are specified in Article 11 of this Circular.
- Category
D transaction authentication form may be used to authenticate Category A, B and
C transactions.
- Category
C transaction authentication form may be used to authenticate Category A and B
transactions.
- Category
B transaction authentication form may be used to authenticate Category A
transactions.
- In case
the client is a business household or a micro-enterprise applying a simple
accounting regime, the transaction authentication form to be applied is similar
to that applied to an individual client. Regarding the form of biometric
authentication and the form of device-based biometric authentication, the
biometric information used for comparison is that of the legal representative
or the individual authorized by the legal representative (if any).
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
APPENDIX 03
CLASSIFICATION OF ONLINE CARD PAYMENT TRANSACTIONS
(Enclosed with the Circular No. 50/2024/TT-NHNN dated October 31, 2024 of
the Governor of the State Bank of Vietnam)
No.
Description
Category E transaction
Category F transaction
Category G transaction
1
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
Any
transaction that satisfies the following condition:
G + T ≤
VND 5 million.
Any
transaction that satisfies the following conditions:
(i) G +
T > VND 5 million.
(ii) G
+ T ≤ VND 100 million.
Any
transaction that satisfies the following conditions:
G + T
> VND 100 million.
Notes:
G: Value
of the transaction.
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
APPENDIX 04
ONLINE CARD PAYMENT TRANSACTION AUTHENTICATION
(Enclosed with the Circular No. 50/2024/TT-NHNN dated October 31, 2024 of
the Governor of the State Bank of Vietnam)
No.
Transaction
Minimum online card payment transaction authentication
form
1
Category
E transaction
Password
or PIN (if authenticated at the login step, authentication is not required at
the transaction step).
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
Category
F transaction
- SMS
OTP or Voice OTP or Email OTP;
- Or
OTP Matrix Card;
- Or
Basic Soft OTP/ Token OTP;
- Or
device-based biometric authentication1;
- Or
two-channel.
3
Category
G transaction
- Advanced
Soft OTP/ Token OTP;
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
- Or
e-signatures/ secure e-signatures;
- Or
EMV 3DS.
Notes:
- Details
about authentication forms are specified in Article 11 of this Circular.
- Category
G transaction authentication form may be used to authenticate Category E and F
transactions.
- Category
F transaction authentication form may be used to authenticate Category E
transactions.