|
THE STATE BANK
OF VIETNAM
--------
|
THE SOCIALIST
REPUBLIC OF VIETNAM
Independence - Freedom - Happiness
---------------
|
|
No.
64/2024/TT-NHNN
|
Hanoi, December
31, 2024
|
CIRCULAR
ON
IMPLEMENTATION OF OPEN APPLICATION PROGRAMMING INTERFACE IN BANKING SECTOR
Pursuant to the Law on State Bank of Vietnam
dated June 16, 2010;
Pursuant to the Law on Credit Institutions dated
January 18, 2024;
Pursuant to the Law on Electronic Transactions
dated June 22, 2023;
Pursuant to the Law on Cybersecurity dated
November 19, 2015;
Pursuant to Decree No. 52/2024/ND-CP dated May
15, 2024 of the Government on cashless payments;
Pursuant to Decree No. 13/2023/ND-CP dated April
17, 2023 of the Government on protection of personal data;
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
At the request of the Director General of the
Department of Information Technology;
The Governor of the State Bank of Vietnam
promulgates the Circular on implementation of Open Application Programming
Interface in banking sector.
Chapter I
GENERAL REGULATIONS
Article 1. Scope
1. This Circular promulgates regulations on implementation
of Open Application Programming Interface in banking sector.
2. This Circular does not regulate the connection
and processing of state secret data. The processing of state secret data shall
be in accordance with the law.
3. This Circular does not regulate the direct
connection and resolution of data between:
a) The information system of banks and the
information system of organizations via Application Programming Interface to
serve internal affairs of those organizations;
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
Article 2. Regulated entities
1. Commercial banks, cooperative banks, foreign
bank branches (hereinafter referred to as “banks”).
2. Relevant organizations and individuals in
implementation of services via Application Programming Interface in banking
sector
Article 3. Definitions
For the purposes of this Circular, the terms below
shall be construed as follows:
1. Application Programming Interface (hereinafter
referred to as “API”) is an interface that allows communication between
software applications within an organization or between organizations.
2. Open API in banking sector (Open API) is a
collection of APIs provided by banks to third parties for direct connection and
data processing to provide services to customers. Open API includes basic Open
API and other Open APIs
3. Open API testing system is the information
system of banks provided to third parties to test Open APIs before official
implementation.
4. Customers are
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
5. Third party is an organization or another bank
that has a contractual agreement with the bank to connect, process data through
Open APIs to provide services to customers.
6. Customer consent is the clear, voluntary
expression affirming a customer’s permission for the processing of the his/her
personal data.
Article 4. General principles
Banks, customers, third parties (hereinafter
referred to as parties) shall comply with following principles during
implementation of Open API:
1. Comply with the law on protection, provision of
customer data and protection of personal data. The processing of personal data
of a customer serves only the respective customer, unless otherwise prescribed
by law.
2. Data during processing shall be managed, stored,
exploited, and used for the intended purpose as prescribed in the contract between
parties and in accordance with the law.
3. Data during processing shall be continuously
updated and accurate. In case of discrepancies, timely corrections and
adjustments shall be implemented according to the agreement between parties.
Chapter II
SPECIFIC REGULATIONS ON
IMPLEMENTATION OF OPEN API
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
Article 5. Principles of
implementation of Open API
1. When implementing basic Open APIs prescribed in Article
6 of this Circular, banks shall comply with regulations in Appendices 01 and 02
attached to this Circular.
2. When implementing Open APIs other than those
prescribed in Article 6 of this Circular according to practical needs and in
accordance with the law, banks shall comply with regulations in Appendix 02
attached to this Circular.
3. Banks shall only implement Open API prescribed
in point c clause 1 Article 6 for third parties which are banks and payment
intermediary service providers.
Article 6. List of Open APIs
1. The list of basic Open APIs includes following
groups:
a) Open APIs for querying exchange rates and
interest rates of banks including API for retrieval of data on interest rates,
API for retrieval of exchange rates;
b) Open APIs for querying data of customers
including: API for authorization and consent, API for retrieval of access code,
API for refresh of access code, API for revocation of access code, API for
retrieval of account list, API for retrieval of account data, API for retrieval
of transaction history;
c) Open APIs for payment initiation, e-wallet
cash-in, and e-wallet cash-out including:
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
(ii) Open APIs for e-wallet cash-in
including: API for e-wallet deposit, API for OTP confirmation, API for update
of confirmation status of e-wallet deposit via Decoupled Flow, API for
retrieval of confirmation status of e-wallet deposit via Decoupled Flow, API
for e-wallet deposit confirmation, API for retrieval of transaction status;
(iii) Open API for e-wallet cash-out.
2. The detailed list of Open APIs in clause 1 of
this Article is promulgated in Appendix 01 attached to this Circular.
Article 7. List of technical standards
1. The technical standards for implementing Open
API include architecture standards, data standards, and security standards.
2. The technical standards for implementing Open
API in banking sector is promulgated in Appendix 02 attached to this Circular.
Article 8. Contracts between
banks and third parties
The bank and the third party shall enter into a
contract on implementing Open API including following content:
1. Commitment to data security including an
agreement to ensure safety and security of data during data processing via Open
API provided by the bank.
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
3. The third party’s responsibility to notify the
bank when they detect any personnel violating cybersecurity network during
implementation of Open API.
4. Information on Open API services provided
to customers.
5. Information on Open API service fees for
customers (if any).
6. Terms regarding the evaluation and
classification of the information system of third parties, which connects and
transmits data via Open API, in accordance with regulations on assurance of
information system security at different levels of the Government.
7. Access rights of third parties during
implementation of Open API.
8. Termination clause.
Article 9. Disclosure of
information on Open API
Before connecting and processing data with the
third parties, banks shall disclose information on Open AI on their official
websites including the following content:
1. Information on Open API testing system.
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
Section 2. RIGHTS AND
RESPONSIBILITIES OF BANKS AND THIRD PARTIES
Article 10. Rights of banks
1. Request third parties to provide information
related to connection and processing data via Open API.
2. Other rights as prescribed in the contract with
the third parties.
Article 11. Responsibilities
of banks
1. Complete information technology infrastructure
for connection and processing data via Open API.
2. Formulate and complete guidelines on connection
and processing data.
3. Ensure the quality of data during the
implementation of Open API. Timely notify the third parties in case of data
discrepancies, and collaborate with the third parties to correct and adjust
them promptly.
4. Ensure cybersecurity of the information system
implementing Open API in accordance with level 3 of the Government on levels of
information system security and of the State Bank of Vietnam on the information
system in banking sector.
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
Search the data that customers have allowed the
third party to process.
b) Withdraw their consent in accordance with the
law.
6. Set a time limit of up to 180 days for accessing
customer data after obtaining customer consent, except in cases where there is
another agreement between customers and banks.
7. Provide information on the progress of
implementation of Open API to the State Bank of Vietnam (through the Department
of Information Technology) upon request.
8. Collaborate with the third parties based on
agreements and with competent authorities in resolving issues or disputes
during the implementation of Open API.
9. Implement a technological solution to limit the
number of automated queries for customer information from third parties.
10. Take responsibility in selecting, appraising,
supervising and managing the third parties.
11. Update or revoke the right to access to the
data of the third parties in accordance with contract changes.
12. Supervise access activities:
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
b) Record a comprehensive log of all Open AI
usage of the third-parties at least 03 months and store the data for at least
01 year for inspection (if necessary).
Article 12. Rights and
responsibilities of third parties
1. The third parties have the following rights
according to contracts or agreements with banks and customers.
2. Responsibilities of third parties:
a) Provide tools and fuctions for customers to:
(i) Search the data that customers have allowed the
third party to process.
(ii) Withdraw their consent in accordance with the
law.
b) Notify the customers on clauses, requirements
for using the services and provide guidelines for customers to use the services.
c) Issue procedures for risk management, customer
care, complaint resolution, dispute resolution, assurance of continuous
operation, and use of services when providing services to customer.
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
dd) Promptly notify the banks if there are
incidents related to information technology or information security when
implementing Open API. The method and time of notification shall be in
accordance with the agreement between banks and third parties.
e) Timely notify the banks in case of data
discrepancies, and collaborate with the banks to correct and adjust them
promptly. The method and time of notification shall be in accordance with the
agreement between banks and third parties
Chapter III
IMPLEMENTATION CLAUSE
Article 13. Responsibilities
of the Department of Information Technology
1. Take charge, collaborate with relevant units
affiliated to the State Bank of Vietnam to resolve issues during the implementation
of this Circular.
2. Supervise, consolidate, report the Governor of
the State Bank of Vietnam the implementation status of banks in accordance with
this Circular.
3. Inspect banks implementing this Circular.
Article 14. Effect
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.
Article 15. Transitional
provision
Banks that have already connected and directly
processed data with third parties via API or Open API to provide services to
individual customers before the effective date of this Circular must:
1. Formulate a list of APIs, Open APIs that they
are implementing and a detailed implementation plan in accordance with this
Circular, and report to the State Bank of Vietnam (through the Department of
Information Technology) by July 01, 2025.
2. Comply with regulations in this Circular by
March 01, 2027.
Article 16. Implementation
Heads of units affiliated to the State Bank of
Vietnam, commercial banks, cooperative banks, foreign bank branches shall
implement this Circular./.
PP. THE
GOVERNOR
DEPUTY GOVERNOR
Pham Tien Dung
...
...
...
Please sign up or sign in to your Pro Membership to see English documents.