|
THE STATE BANK OF VIETNAM
--------
|
THE SOCIALIST REPUBLIC OF VIETNAM
Independence - Freedom - Happiness
---------------
|
|
No. 50/2024/TT-NHNN
|
Hanoi, October 31, 2024
|
CIRCULAR
PROVIDING FOR SECURITY AND
CONFIDENTIALITY DURING PROVISION OF ONLINE BANKING SERVICES
Pursuant
to the Law on the State Bank of Vietnam dated June 16, 2010;
Pursuant
to the Law on Cyberinformation Security dated November 19, 2015;
Pursuant
to the Law on Cybersecurity dated June 12, 2018;
Pursuant
to the Law on E-Transactions dated June 22, 2023;
Pursuant
to the Law on Credit Institutions dated January 18, 2024;
Pursuant
to the Government’s Decree No. 102/2022/ND-CP dated December 12, 2022 defining
the functions, tasks, powers and organizational structure of the State Bank of
Vietnam;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
The
Governor of the State Bank of Vietnam hereby promulgates a Circular providing
for security and confidentiality during provision of online banking services.
Chapter I
GENERAL PROVISIONS
Article 1. Scope and regulated entities
1. Scope
This
Circular provides for requirements for ensuring security and confidentiality
during provision of online banking services, including:
a)
Banking activities and other business activities of credit institutions and
foreign bank branches;
b)
Provision of intermediary payment services;
c) Credit
information activities.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
This
Circular applies to credit institutions, foreign bank branches and intermediary
payment service providers and credit information companies (below collectively
referred to as “units”).
Article 2. Definitions and terms
For the
purposes of this Circular, the terms below shall be construed as follows:
1.
“online services in the banking sector” (hereinafter referred to as “online
banking services”) include the services specified in clause 1 Article 1 of
this Circular provided online by units to clients to conduct electronic
transactions (hereinafter referred to as “transactions”), excluding direct
transactions at units accepting payment via point-of-sale terminals or via
Quick Response Code (QR Code) displayed by clients.
2.
“online banking system” means a structured combination of hardware,
software, databases, communication and network system, and security and
confidentiality system used to produce, transmit, collect, process, store and
exchange digital information serving the management and provision of online
banking services, which is established, administered and operated by a unit or
a hired third party.
3.
“online banking application software” means application software providing
online banking services.
4.
“mobile banking application software” means online banking application
software installed on mobile devices.
5.
“online payment transaction” means a transaction conducted by electronic
means via online banking system.
6.
“client” may be an organization or individual using online banking
services.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
8.
“electronic transaction authentication” (hereinafter referred to as
“transaction authentication”) means a form of authentication by electronic
means to express the client’s acceptance of data messages in an electronic
transaction.
9.
“end-to-end encryption” means a mechanism by which information is securely
encrypted at the original point before being sent and is decrypted only after
being received at the destination point in the process of information exchange
between applications or devices in a system in order to limit the risk of
information exposure or leakage on transmission lines.
10.
“database management system” means software designed for management,
storage, retrieval and execution of queries on data within a database.
Article 3. General principles of ensuring security and
confidentiality of the information system during provision of online banking
services
1. Online
banking systems must comply with regulations on ensuring information system
security at level 3 or higher in accordance with regulations of law on
assurance of information system security by levels; for information systems
providing switching services and electronic clearing services, they must comply
with regulations on assurance of information system security at level 4 or
higher; comply with TCVN 11930:2017 (Information technology - Security
techniques - Basic requirements for securing information according to security
levels) and regulations of the State Bank of Vietnam (hereinafter referred to
as “SBV”) on information system security in banking operations.
2.
Confidentiality and integrity of client information must be ensured;
availability of the online banking system must be ensured to provide services
in an uninterrupted manner.
3.
Client's transactions must be classified and assessed in terms of their minimum
risk level by groups of clients, their behaviors, transaction type, transaction
limit (if any) and compliance with relevant laws. On that basis, the unit shall
provide appropriate forms of transaction authentication to the clients for
their choice by way of complying with at least the following regulations:
a)
Applying at least one of the authentication forms specified in clauses 3
through 9 Article 11 of this Circular upon changing the client's identification
information;
b)
Applying at least one or combination of transaction authentication forms
according to this Circular. In case a legislative document providing guidance on
the services specified in clause 1 Article 1 of this Circular stipulates the
form of transaction authentication, such legislative document shall be complied
with;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
4. The
online banking system must have its security and confidentially inspected and
assessed on an annual basis.
5. Risks,
possibility of occurrence and causes of risks must be regularly identified to
promptly adopt measures to prevent, control and manage risks during provision
of online banking services.
6.
Information technology (IT) infrastructure and equipment for provision of
online banking services must be protected by copyright and of clear origin. For
equipment which is about to reach the end of its life cycle and is no
longer supported by manufacturers, the unit shall plan to upgrade or replace it
as notified by the manufacturers, ensuring that equipment is able to be come
with a new software version. Pending the upgradation or replacement, the unit
must take measures to enhance the security and confidentiality of the online
banking system.
7.
Regarding systems providing electronic payment gateway services, payments- and
collections-on-behalf-of services, the regulations set out in clauses 7, 9
and 10 Article 7 and Section 2 Chapter II of this Circular are not required to
be complied with.
8. Every
online banking systems may operate and provide services to clients only when
its security and confidentiality are ensured in accordance with this Circular
and relevant regulations of law.
Chapter II
SPECIFIC PROVISIONS
Section 1. TECHNICAL INFRASTRUCTURE OF THE ONLINE BANKING
SYSTEM
Article 4. Network, communication, security and
confidentiality systems
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
1.
Security and confidentiality solutions should be in place, containing at least:
a)
Application firewall or equivalent protection solutions;
b)
Database firewall or equivalent protection solutions;
c)
Solutions for prevention against denial-of-service attacks (DoS), distributed
denial of service attack (DDoS) for systems directly providing services on the
Internet;
d)
Information security event management and analysis system.
2. Client
information (client identification information, clients’ transaction
information) must not be stored in the Internet connection zone and
demilitarized zone (DMZ).
3.
Policies should be in place to minimize services and gateways connected to the
online banking system.
4. Any
inbound connection to the online banking system for administration is permitted
only when it is impossible to establish connection from the internal network
and ensure safety and the following regulations shall be complied with:
a) The
connection is approved by a competent authority after considering its purpose
and method;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
c)
Connecting devices must come with software that ensures security and
confidentiality;
d) At
least two of the authentication forms specified in clauses 1, 3, 4, 7, 8 and 9
Article 11 of this Circular are applied when logging in the system;
dd)
Securely encrypted communication protocols must be used and passwords must be
not saved in utility software.
5. The
high availability and uninterrupted service provision of network connection
lines for service provision must be ensured.
Article 5. Server system and system software
1.
Requirements for a server:
a) Its
monthly average usage, including a central processing unit (CPU), internal
memory (RAM), data storage devices, devices for retrieving data upon data
storage or transmission, is up to 80% of its design capacity;
b) The
online banking system must have a backup server that ensures high availability;
c) It is
logically or physically separated from other servers serving professional
operations;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
2. Each
unit shall make a list of software permitted to be installed in servers, and
ensure that such list is updated and inspected at least once every 06 months
and strictly complied with.
Article 6. Database management system
1. The
database management system must have security and access management mechanism
in order to protect the data therein.
2. The
online banking system must have a backup database for disaster discovery which
is able to replace the main database and ensure the completeness and integrity
of clients’ transaction data.
3. The
database management system must be checked and hardened, and patches must be
updated regularly.
4. Units
must take measures to supervise and log access to the database and manipulations
upon access to the database.
Article 7. Online banking application software
1.
Security and confidentiality requirements must be determined before developing
software, and satisfied in the process of development (analysis, design,
development, testing), official operation and maintenance of the software.
Documents on software security and confidentiality must be systemized, stored
and synchronously updated upon changes to the system, and strictly controlled
through limited access.
2. Every
unit shall control software source codes in accordance with at least the
following requirements:
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
(i) On a
periodic basis or when there is any change in the application software, the
unit must check source codes to remove malicious codes and security
vulnerabilities. The personnel performing the check must be independent of the
personnel developing the software source codes;
(ii)
Appoint specific individuals responsible for managing source codes of online banking
application software;
(iii)
Source codes must be kept safely in at least two geographically separate
locations, and measures must be in place to protect their integrity.
b) For
outsourced software source codes:
(i) The
unit must request the supplier to sign a commitment that the software source
code is legitimate and genuine; commit to implementing agreements on editing
the source code upon software warranty and maintenance;
(ii) In
case of source code handover, before the handover, the unit shall request the
supplier to check, handle and fix security vulnerabilities in the source code.
After the source code is handed over, the unit shall comply with the provisions
set forth under point a of this clause;
(iii) In
case the unit is not handed the source code, when signing the handover record,
it must request the supplier to scan and remove malicious codes and sign a
commitment that the application software does not contain malicious codes.
3. Online
banking application software must be inspected and tested before official
operation, satisfying at least the following requirements:
a)
Prepare and approve plans and scenarios for testing online banking application
software, explicitly stating safety and confidentiality conditions to be
satisfied;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
c) Assess
and scan to detect technical vulnerabilities and weaknesses. Assess the
capacity for prevention of attacks, including but not limited to Injection
(SQL, Xpath, LDAP), Cross-site Scripting (XSS), Cross-site Request Forgery
(XSRF), Server-Side Request Forgery (SSRS), Brute-Force, and such
confidentiality-related errors as access control errors; identification and
authentication errors; encryption errors; design errors, insecure configurations;
logging and security monitoring errors;
d) Record
errors and process of fixing errors, especially security and
confidentiality-related errors, in the software inspection and testing reports;
dd)
Inspect and test security and confidentiality features on popular browsers (for
online banking application software provided via website platform) and
operating system software of mobile devices (for Mobile Banking application
software); provide mechanisms for checking and immediate notification to clients
when running applications on browsers or mobile device’s operating system
software versions which have undergone safety inspection and testing.
4. Before
deploying new online banking application software, a unit shall assess the
risks of the deployment process to related professional operations and IT
systems, and prepare and implement plans to minimize these risks.
5. Each
unit shall manage changes of online banking application software versions
according to following requirements:
a)
Documents on the analysis of the impacts of the change of application software
on the existing system and other related systems of the unit must be formulated
and approved by the competent authority before implementation;
b)
Software versions, including also source codes developed by the unit itself or
handed over by the supplier, must be managed in a centralized manner, stored
and kept confidential and a mechanism must be in place to grant privilege to
each member and record logs during manipulation of files;
c)
Information on versions (update time, persons updating such versions,
instructions for updating and other relevant information on such versions) must
be stored;
d) The
upgradation of versions must rely on testing results and be approved by
competent authorities.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
a)
Applying end-to-end encryption to all data transmitted online or data exchanged
between online banking application software and related equipment;
b)
Ensuring the integrity of transaction data; promptly detecting, warning, and
preventing all unauthorized modifications, or adopting appropriate measures to
handle such unauthorized modifications to ensure the accuracy of transaction
data in the process of transaction processing and data storage;
c) Controlling
transaction sessions: The system must automatically apply session timeout in a
case where a user has been inactive for a certain period of time prescribed by
the unit or apply other protective measures;
d) Having
the function of hiding passwords or PINs used to log in the system;
dd)
Having the function of disabling automatic login;
e) Where
the e-transaction account prescribed in clause 1 Article 9 of this Circular
uses a PIN or password as a form of authentication, the online banking
application software must have functions to control the PIN and password;
(i)
Requesting the client to change the PIN or password in case the client is
granted a default PIN or password for the first time;
(ii)
Notifying the client when the PIN or password is about to expire;
(iii)
Invalidating the PIN or password when it expires; requesting the client to
change the expired PIN or password when the client uses the PIN or password to
log in;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
(v) The
unit shall only regrant the PIN or password at the client’s request and must
verify and identify the client before the regrant to prevent fraud and forgery.
g) With
regard to a client being an organization, the application software shall be
designed in a manner to ensure that every online payment transaction is
conducted in two steps as follows: creation and approval of the transaction.
For a client being a business household or micro-enterprise applying a simple
accounting regime, the transaction is not required to be conducted by
separating the two aforesaid steps;
h) Having
the function of notifying the first login to the online banking application
software or the login to the online banking application software on a device
different from the one last used to log in the online banking application
software via SMS or other channels registered by the client (phone, email,
etc.), except where an institutional client: logs in on devices that have been
used for registration for use of services; or logs in using at least one of the
authentication forms specified in clauses 3, 4, 5, 7, 8, and 9 Article 11 of
this Circular.
7. Online
banking application software must have the function of online storage of
information about the devices that perform clients’ transactions, transaction
logs, transaction authentication logs for at least 03 months and backup for at
least 01 year, including:
a) Device
identification information:
(i) For
mobile devices: unique identifiers (e.g., IMEI or Serial number or WLAN MAC or
Android ID or other identification information);
(ii) For
computers: unique identifiers (such as the MAC address or a combination of
computer-related information that can uniquely identify a computer).
b)
Transaction logs, including at least transaction code, client name, transaction
initiation time, transaction type, transaction value (if any);
c)
Transaction authentication logs, including at least transaction authentication
form and transaction authentication time. In case of biometric authentication,
the unit shall store the client's biometric information when performing the
transaction for at least the 10 most recent transactions of that client.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
a) The
unit shall only provide online banking services by STP method for institutional
clients. The unit is shall select, appraise, supervise, manage and reach an
agreement with the clients when providing online banking services by STP
method;
b) Online
banking application software must have the function of authenticating the
connection with the institutional client’s software to prevent fraud and
forgery;
c) The
application of the regulations in points c, dd, e, g, and h clause 6 and point
a clause 7 of this Article is optional.
9. Card
issuers providing online payment services using bank cards must have online
banking application software which has at least the following features:
a)
Permitting or not permitting online payment;
b)
Setting limits on daily online payment using bank cards;
c)
Permitting or not permitting overseas payments at point-of-sale terminals and
automated teller machines;
d)
Permitting clients to register to choose between proactively confirming or
agreeing to let the card issuer confirm all or part of online payment
transactions using bank cards (online card payment transactions) in case of
applying the authentication form as prescribed in clause 10 Article 11 of this
Circular.
10.
Online banking application software must have the function of notifying clients
of transactions occurring via SMS or email or mobile banking application
software or other communication channels registered by clients.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
Mobile
banking application software provided by each unit must comply with Article 7
of this Circular and the following requirements:
1. The
software must be registered and managed on the official application store of
the mobile operating system provider and explicit installation instructions
must be available on the unit's website so as for clients to download and
install the mobile banking application software. In case the mobile banking
application software is not registered and managed on the official application
store of the mobile operating system provider for objective reasons, the unit
must adopt a method of providing instructions for, notifying, supporting the
installation of the mobile banking application software to ensure security and
confidentiality for clients and report to SBV (the Information Technology
Department) before providing the service.
2.
Protective measures must be taken to minimize the reverse engineering of the
source code.
3.
Measures shall be in place to prevent interference in the data exchange flow on
the mobile banking application and between the mobile banking application and
the server providing online banking services.
4.
Solutions must be adopted to prevent, combat and detect unauthorized interference
in the mobile banking application installed on clients’ mobile devices.
5. The
password-saving feature is not permitted.
6. For
individual clients, there must be a function of verifying a client when they
first log in or when they log in on a device different from the one last used
to log in the online banking application software. The client verification
includes at least the following:
a) The
match with SMS OTP or Voice OTP via the client's registered phone number or
Soft OTP/Token OTP;
b) The match
with biometric information as prescribed in clause 5 Article 11 of this
Circular in case the specialized legal document related to the service provided
on the mobile banking application software stipulates the collection and
storage of clients' biometric information.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
Article 9. Access to online banking application software
1. Every
registered user of online banking application software must be identified by
the unit and granted an e-transaction account. The e-transaction account
comprises username and at least one of the forms of authentication specified in
clauses 1 to 9 of Article 11 of this Circular.
2. Each
client shall access online banking application software by using their
e-transaction account issued by the unit or using Single Sign-On method through
the e-transaction account of another information system that has been
integrated by the unit registered by the client.
Article 10. Transaction authentication
1. For
online payment transactions:
a) For
payment transactions using checking accounts or e-wallets or money transfers
from debit cards or identified prepaid cards, the unit shall classify
transactions by their type specified in the Appendix 01 to this Circular and apply
the authentication form specified in the Appendix 02 to this Circular, except
for the regulations set out under points b, c, d and dd of this clause;
b) For
payment transactions conducted using STP method, the unit shall confirm the
transactions using at least one of the authentication forms specified in
clauses 7, 8, and 9 Article 11 of this Circular;
c) For
online card payment transactions (excluding money transfer transactions), the
unit shall classify transactions according to the transaction type groups
specified in Appendix 03 to this Circular and apply the authentication forms
specified in the Appendix 04 to this Circular;
d) For
transactions in which the unit automatically debits checking accounts,
automatically debits e-wallets or automatically makes payments from the
clients’ cards as agreed upon with clients, the transaction authentication
specified in points a and c clause 1 of this Article is not required;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
2. For
services registered for automatic payments from checking accounts, e-wallets
and cards of clients, the unit must apply at least one of the authentication
forms specified in clauses 3 to 9 Article 11 of this Circular.
3. For
other transactions, in addition to the transactions specified in clauses 1 and
2 of this Article, the unit shall, by way of risk assessment and compliance with
relevant laws, select an appropriate form of authentication prescribed in
Article 11 of this Circular to provide it to registered users and shall be
responsible for its selection.
4. Where
a client is a person with disability, the unit shall, based on its conditions
and supply capacity, provide appropriate forms of authentication and instruct
them in their selection. It is not required to apply the regulations in clauses
1, 2, and 3 of this Article but is required to ensure that the check is carried
out and the client's consent is confirmed when conducting any transaction in
accordance with the law on e-transactions and this Circular.
Article 11. Authentication forms
1. Password-based
authentication: A client uses a password which is a string of characters used
to confirm their access to an information system, application or service or to
confirm their transactions. The authentication by password must meet the
following requirements:
a) A
password must have at least 08 characters and contain at least the following:
numbers, uppercase letters, lowercase letters;
b) The
maximum validity period of the password is 12 months. For the default password,
the maximum validity period is 30 days.
2. PIN
(Personal Identification Number) authentication: It refers to a form of
authentication based on a password which is created from a string of digits.
PIN authentication (except for PINs attached to physical cards) must meet the
following requirements:
a) A PIN
must be at least 06 characters long;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
3. One
Time Password (OTP) authentication: It is a form of authentication based on
a password which can only be used once and is valid for a certain period of
time, including the following forms:
a) SMS
OTP is a form of authentication based on
an OTP sent via short message services (SMS) or messages via basic
telecommunications services on the Internet. An SMS OTP must meet the following
requirements:
(i) The
OTP sent to a client must be attached with a notification so as for them to
understand its purposes;
(ii) The
OTP must be valid for up to 05 minutes.
b) Voice
OTP is a form of authentication based on an OTP sent via a voice call or
call via basic telecommunications services on the Internet. Voice OTP must meet
the following requirements:
(i) The
OTP sent to a client must be attached with a notification so as for them to
understand its purposes;
(ii) The
OTP must be valid for up to 03 minutes.
c) Email
OTP is a form of authentication based on an OTP sent via email. An email
OTP must meet the following requirements:
(i) The
OTP sent to a client must be attached with a notification so as for them to
understand its purposes;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
d) OTP
matrix card is a form of OTP authentication determined from a 2-dimensional
table (rows, columns) in which every row or column corresponds to an OTP. An
OTP matrix card must meet the following requirements:
(i) The
OTP matrix card must be valid for up to 01 year from the date of registration;
(ii) The
OTP must be valid for up to 02 minutes.
dd) Soft
OTP is a form of authentication based on an OTP generated by software installed
on the client's mobile device. Soft OTP software may be standalone software or
integrated with mobile banking application software.
Soft OTP
is classified into 02 types: (i) Basic Soft OTP: The OTP is randomly
generated over time and synchronized with the online banking system; (ii) Advanced
Soft OTP: The OTP is generated in combination with the code of each
transaction. Upon conducting a transaction, the online banking system generates
a transaction code to notify the client or transmit it to the Soft OTP
software. The client or the Soft OTP software automatically enters the
transaction code in the Soft OTP software in order for the latter to generate
an OTP.
A Soft
OTP must meet the following requirements:
(i) In
case the Soft OTP software is independent from the mobile banking application
software, it must be registered and managed by the unit on the official
application store of the mobile operating system provider and explicit
installation instructions must be available on the unit's website so as for
clients to download and install the Soft OTP software;
(ii) The
Soft OTP software must require activation before use. The Soft OTP activation
code shall be provided by the unit to clients and can only be used for
activation on a single mobile device. The activation code must have an
expiration date;
(iii) The
Soft OTP software must have an access control function. If the Soft OTP
attempt limit (but not more than 10 attempts) is exceeded, access to the Soft
OTP software will be automatically blocked. The unit shall unlock the Soft OTP
software only when the client so requests and identify the client before
unlocking in order to prevent fraud and forgery.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
(v) The
OTP must be valid for up to 02 minutes.
e) OTP
Token is a form of authentication based on an OTP generated by a
specialized device. OTP Token is classified into 02 types: (i) Basic OTP
Token: The OTP is randomly generated over time and synchronized with the
online banking system; (ii) Advanced OTP Token: The OTP is generated in
combination with the code of each transaction. When performing a transaction,
the online banking system generates a transaction code to notify the client,
the client enters the transaction code in the OTP Token so that the device can
generate an OTP. The OTP Token must be valid for up to 02 minutes.
4. Two-channel
authentication: It refers to an authentication form whereby a client conducts a
transaction, the online banking system sends a request for transaction
authentication to the client's mobile device via a voice call or call via basic
telecommunications service on the Internet or via USSD (Unstructured
Supplementary Service Data) message code or via specialized software and the
client shall respond directly through the connected channel to confirm whether
the transaction is conducted. The authentication request required by this form
must be valid for up to 05 minutes.
5. Biometric
authentication: It is the process of making comparison to ensure that the
biometric information of the client conducting a transaction matches their
biometric information collected and stored at the unit as per the regulations
imposed by SBV's Governor. Biometric authentication must meet the following
minimum requirements:
a) In
case of applying the face matching method:
(i) Its
accuracy shall be determined according to international standards (or
equivalent) as follows: The false reject rate and false accept rate shall meet
the requirement of < 5% and < 0.01% respectively according to the FIDO
Biometric Requirements (applicable to a set of at least 10,000 samples);
(ii) It
has the ability to detect biometric spoofing attacks of live objects
(Presentation Attack Detection - PAD) according to international standards
(such as NIST Special Publication 800-63B Digital Identity Guidelines:
Authentication and Lifecycle Management or ISO 30107 - Biometric presentation
attack detection or FIDO Biometric Requirements) to prevent fraud and spoofing
through images, videos and 3D masks.
b) In
case of applying other methods of biometric information matching, it is
required to ensure prevention of spoofing and fraud according to equivalent
standards;
c) The
Presentation Attack Detection - PAD prescribed in point a of this clause which
is deployed by the unit itself or provided by a third party must be certified
by a biometric organization/laboratory accredited by the FIDO Alliance;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
dd) The
time limit for biometric authentication is up to 03 minutes.
6. Device-based
biometric authentication: It refers to the process of making comparison to
ensure that the biometric information of the client conducting a transaction
matches the biometric information of the client stored on their mobile device.
Device-based biometric authentication must meet the following minimum
requirements:
a)
Activation is permitted only after the client’s consent has been obtained and
the client has conducted at least one successful transaction by applying
another form of authentication;
b) The
time limit for biometric authentication is up to 02 minutes.
7. FIDO
(Fast IDentity Online) authentication is a form of authentication according to
the standard for transaction authentication using asymmetric key algorithms
(including private keys used to generate digital signatures, and public keys
used to validate digital signatures) issued by the FIDO Alliance. FIDO
authentication must meet the following requirements:
a) The
private key is securely stored on the client's device. The client uses PIN
authentication or biometric authentication on their device to access and use
the private key when conducting transactions;
b) The
public key is securely stored at the unit and linked to the client's
e-transaction account;
c) The
solution deployed by the unit itself or provided by a third party must be
certified by an organization accredited by the FIDO Alliance.
8. E-signature
authentication: It is specified under regulations of law on e-signatures
(excluding secure e-signatures specified in clause 9 of this Article).
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
10.
Authentication form based on risk assessment for online card payment
transactions according to EMV 3-D Secure (hereinafter referred to as “EMV
3DS authentication”). The EMV 3-D authentication must meet the requirement:
Card issuers, acquirers and merchants must implement the EMV 3-D Secure.
11.
Authentication through operations showing the client's authentication of
a data message when performing a transaction such as clicking accept, approve,
send or similar operations on the online banking application software. Such
authentication form must meet the following requirements:
a)
Authentication operations must be logged so as to retrieve information related
to these authentication operations;
b)
Clients must be organizations that have logged in the online banking
application software using the authentication forms as prescribed in this
Article, except for clauses 1, 2, 6, and 10.
Section 3. OPERATION MANAGEMENT
Article 12. Management of personnel in charge of
administration and operation of online banking systems
1. Each
unit shall assign personnel to supervise and monitor operations of its online
banking system, detect and handle technical incidents and cyberattacks.
2. Each
unit shall assign personnel to receive information and support clients, and
promptly contacting clients upon detection of unusual transactions.
3. The
personnel in charge of administration, supervision and operation of the online
banking system shall participate in annual training courses to update knowledge
about security and confidentiality.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
Article 13. Management of operations of the operating
environment of online banking systems
1. Any
unit is not permitted to install or store application development software and
source codes in the operating environment.
2. The
administration, supervision and operation must meet the following requirements:
a)
Personnel in charge of administration, supervision and operation shall only be
permitted to install allowed software on their computers and must install
anti-malware software; these computers must frequently update malware
identification patterns and not permit the automatic disabling of anti-malware
software;
b) System
administration, supervision and operation connections must be established
through intermediate servers or secure and controlled centralized
administration systems and must not be established directly from the computers
of the personnel in charge of administration, supervision and operation;
c) An
account with administrator privilege shall be granted for a limited period of
time that is just enough to finish the task and revoked immediately at the end
of the working session;
d) It is
required to take measures to monitor the use of accounts with administrator,
supervisor and operator privilege and provide warnings when there is any
unusual impact on the database or applications.
3. Every
unit shall tailor a policy for computers used for administration, supervision
and operation of its online banking system; these computers may only be
connected to the online banking system or other information systems of the unit
in service of the administration, supervision and operation.
Article 14. Management of technical vulnerabilities and
weaknesses
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
1. Taking
measures to prevent, combat and discover illegal changes to the online banking
application software.
2.
Establishing mechanisms to detect, prevent and combat intrusion into or
cyberattacks to the online banking system.
3.
Cooperating with regulatory bodies and IT partners in promptly obtaining
information on incidents and circumstances regarding information security and
confidentiality to take appropriate preventative measures.
4.
Updating information on published vulnerabilities related to system software,
database management system, and application software from the Common
Vulnerability Scoring System - version 4 (CVSS, v4.0 or equivalent).
5.
Scanning vulnerabilities and weaknesses of the online banking system at least
once a year or when receiving information related to new vulnerabilities and
weaknesses. For system components directly connected to the Internet, scanning
vulnerabilities and weaknesses at least once every 03 months. Assessing the
level of impact and risk of each discovered technical vulnerability and
weakness of the system and proposing solutions and plans for handling thereof.
6.
Updating security patches or prompt preventive measures based on the level of
impact and risk:
a) For a
vulnerability rated critical: Within 01 day for system components directly
connected to the Internet; within 01 month for remaining components after the
vulnerability is announced or discovered.
b) For a
vulnerability rated high: Within 01 day for system components directly
connected to the Internet; within 02 months for remaining components after the
vulnerability is announced or discovered.
c) For a
vulnerability rated medium or low: Within the time limit decided by the unit.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
1. Each
unit shall establish a system for supervising and monitoring operations of its
online banking system. The system for supervising and monitoring operations of
the online banking system must fully collect logs of the components of the
online banking system to detect and investigate unusual events or cyberattacks.
2. Each
unit shall develop criteria and software to warn unusual transactions based on
time, geographical location, transaction frequency, transaction money (if any),
number of incorrect login attempts exceeding the prescribed limit, and other
unusual signs.
Article 16. Assurance of uninterrupted operations
Each unit
shall develop a disaster prevention system and processes and scenarios to
ensure uninterrupted operations of its online banking system in accordance with
SBV’s regulations on security and confidentiality of the information technology
system in banking operations. In addition, the unit shall:
1.
Analyze and identify circumstances likely to cause information insecurity and
disruption of operations of the online banking system. Identify and assess each
circumstance with high and medium level of risk and possibility of occurrence
at least once every 06 months. Make a list of circumstances with high, medium,
acceptable and low level of risk and possibility of occurrence.
2.
Prepare plans, including processes and scenarios, for remedying circumstances
with high and medium level of risk and possibility of occurrence as prescribed
in clause 1 of this Article. Determine the maximum downtime to restore the
system and database for a plan to handle each circumstance. Disseminate the
plan to relevant personnel so as for them to clearly understand their tasks in
each circumstance.
3.
Provide human and financial resources and technical equipment to organize
drills of plans for handling circumstances with a high level of risk and
possibility of occurrence at least once every year.
4.
Formulate plans and hold drills to ensure uninterrupted business operations,
store related documents and assess drill results.
Section 4. PROTECTION OF CLIENTS’ INTERESTS
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
1. Each
unit shall publicize information about online banking services, ensure that
clients have access to information before or at the time of registering to use
the services, at least including:
a) Method
of providing the services, method of accessing the online banking services
corresponding to each access equipment;
b)
Transaction limit (if any) and transaction authentication forms;
c)
Equipment required to use the services, conditions applicable to the equipment
used;
d) Risks
related to the use of online banking services.
2. Each
unit shall inform clients about terms of the agreement on provision and use of
online banking services, at least containing:
a) Rights
and obligations of clients when using online banking services;
b) Types
of client data that the unit collects, purposes of using client data and the
unit’s responsibility for ensuring confidentiality of client data in accordance
with law, except where the unit and the client have reached another agreement
on the protection of client data in accordance with law;
c)
Undertaking to maintain uninterrupted operations of the online banking system,
at least including one-time service interruption time, total service
interruption time in one year, except for force majeure events or cases of
system maintenance and upgradation notified by the unit;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
3. The
unit shall not send SMS or emails to clients containing hyperlinks to access
websites unless otherwise requested by the client.
Article 18. Instructing clients in use of online banking
services
1. Units
shall develop processes and manuals for installation and use of software,
applications and equipment for conducting online banking transactions, instruct
clients in applying such processes and using such manuals.
2. Units
shall instruct clients in taking measures to ensure safety and confidentiality
when using online banking services, including at least the following:
a)
Protecting passwords, PINs and OTPs and not sharing equipment storing such
information;
b)
Principles of creating and changing passwords and PINs of e-transaction
accounts;
c) Not using
public computers to access the online banking system or conduct transactions;
not using public Wi-Fi when using online banking services;
d) Not
saving usernames and passwords, PINs on browsers;
dd)
Logging out from online banking application software after use;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
g) Fully
installing security patches for operating systems and mobile banking
application software; considering installing anti-malware software and updating
the latest malware identification pattern on personal devices used to conduct
transactions;
h)
Selecting authentication forms with the level of security and confidentiality
in accordance with regulations and in a manner that suit clients' need for
transaction limits;
i)
Issuing warnings of the risks related to the use of online banking services;
k) Not
using unlocked mobile devices to download and use online banking application
software or OTP generator software;
l) Not
installing strange software, unlicensed software or software of unknown origin;
m)
Promptly notifying the unit when detecting unusual transactions;
n)
Immediately notifying the unit of the loss of or damage to OTP generators,
phone numbers receiving SMS, devices storing keys used to generate e-signature;
cases of fraudulence or suspicious fraudulence; or attacks or suspicious
attacks by hackers.
3. Units
must provide clients with information about their focal points for receiving
information, hotlines and instructions on the process and methods for
cooperation in handling errors and incidents in the course of using online
banking services.
4. Units
must provide clients with explanation for specific cases in which the units
will contact them, methods and means of communication during the clients' use
of online banking services.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
Each unit
shall apply measures to ensure security and confidentiality of client data,
comprising at least the following:
1.
Ensuring security and confidentiality of client data in accordance with law.
2.
Storing information used to authenticate client transactions including
passwords, PINs, and biometric information by using encryption or concealment
measures to ensure confidentiality.
3.
Granting access to client data to personnel in charge of accessing such data
according to their functions and tasks; and taking measures to monitor each
access.
4. Taking
measures to manage access to equipment and devices used to store client data to
prevent the risk of exposure and leakage of data.
5.
Notifying clients of any incident that causes client data exposure or leakage,
and promptly reporting it to SBV (the Information Technology Department).
Chapter III
IMPLEMENTATION CLAUSE
Article 20. Reporting regime
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
1. Report
on provision of online banking services:
a) Time
limit for submitting the report: At least 10 working days before the official
provision of online banking services;
b)
Details of the report:
(i)
Website address or application store;
(ii) The
official date of provision;
(iii)
Solutions for verifying clients accessing online banking services; forms of
transaction authentication applicable to each type of transaction and
transaction limit (if any);
(iv)
Copies of certificates of security and confidentiality assurance, spoofing and
fraud prevention prescribed in clauses 5 and 7 Article 11 of this Circular.
2. Ad hoc
report at SBV's request.
Article 21. Responsibilities of units affiliated to SBV
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
2. The
Banking Supervision Agency shall inspect and supervise the implementation of
this Circular and impose penalties for violations in accordance with law.
3. SBV
branches of provinces and cities shall inspect and supervise the implementation
of this Circular by local intermediary payment service providers (except for
the National Payment Corporation of Vietnam - NAPAS) and impose penalties for
violations in accordance with law.
Article 22. Effect
1. This
Circular comes into force from January 01, 2025, except for the cases specified
in clauses 2, 3 and 4 of this Article.
2. Point
b clause 1 of Article 4, point d clause 9 of Article 7 and clause 4 of Article
8 come into force from July 01, 2025.
3. Point
b clause 1 of Article 10 comes into force from January 01, 2026.
4. Point
c clause 5 of Article 11, point c clause 7 of Article 11 and point b (iv)
clause 1 of Article 20 come into force from July 01, 2026.
5. The
following documents shall cease to have effective from the effect date of this
Circular:
a)
Circular No. 35/2016/TT-NHNN dated December 29, 2016 of SBV’s Governor;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
6.
Article 25 of the Circular No. 09/2020/TT-NHNN dated October 21, 2020 of SBV’s
Governor is repealed.
Article 23. Transitional clauses
1. For
services registered for automatic payments from checking accounts, e-wallets
and cards of clients before the effective date of this Circular shall continue
to be rendered until the expiry of the signed agreements; in case the
agreements do not specify an expiry date, they shall continue to be implemented
until December 31, 2026. The amendment and extension of such agreements must
comply with clause 2 Article 10 of this Circular.
2.
Passwords and PINs that are in use before the effective date of this Circular
shall continue to be used until the client changes them or until the end of
their validity period. From the effective date of this Circular, any change of
passwords and PINs must comply with clauses 1 and 2 Article 11 of this
Circular.
Article 24. Organizing implementation
Chief of
Office, Director General of Information Technology Department and heads of
units affiliated to SBV, Chairpersons of Boards of Directors, Chairpersons of
Board of Members, Directors General (Directors) of credit institutions, foreign
branch banks, intermediary payment service providers and credit information
companies are responsible for the implementation of this Circular./.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
APPENDIX 01
CLASSIFICATION OF ONLINE PAYMENT TRANSACTIONS
(Enclosed with the Circular No. 50/2024/TT-NHNN dated October 31, 2024 of
the Governor of the State Bank of Vietnam)
No.
Description
Category A
Category B
Category C
Category D
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
Individual
client
1
Group
I.1:
- Money
transfer between payment accounts, debit cards, identified prepaid cards
(hereinafter referred to as “cards”) of a client in a payment service
provider.
- Money
transfer between e-wallets of a client in an intermediary payment service
provider.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
2
Group
I.2:
-
Transactions including payments of lawful goods and services processed by
payment service providers and intermediary payment service provider or at
payment acceptors selected, appraised, supervised and managed by payment
service providers and intermediary payment service providers
Any
transaction that satisfies the following condition:
G + T ≤
VND 5 million.
Any
transaction that satisfies the following conditions:
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
(ii) G
+ T ≤ VND 100 million.
Any
transaction that satisfies the following conditions:
(i) G +
T > VND 100 million.
(ii) G
+ T ≤ VND 1.5 billion.
Any
transaction that satisfies the following condition:
G + T
> VND 1.5 billion.
3
Group
I.3:
- Money
transfer between checking accounts, cards, e-wallets of different account
holders, card holders and e-wallet owners.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
-
E-wallet cash-in1.
-
E-wallet cash-out.
Any
cash-in or cash-out between an e-wallet and VND account of an e-wallet owner
at the affiliated bank according to regulations of law that satisfies the
following conditions:
(i) G ≤
VND 10 million.
(ii) G
+ Tksth ≤ VND 20 million.
Any
transaction (except cash-in or cash-out between an e-wallet and VND account
of an e-wallet owner at the affiliated bank according to regulations of law)
that satisfies the following conditions:
(i) G ≤
VND 10 million.
(ii) G
+ Tksth ≤ VND 20 million.
Any
transaction that satisfies one of the following conditions:
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
(i) G ≤
VND 10 million.
(ii) G
+ Tksth > VND 20 million.
(iii) G
+ T ≤ VND 1.5 billion.
2. 2.
Any transaction that satisfies the following conditions:
(i) G
> VND 10 million.
(ii) G
≤ VND 500 million.
(iii) G
+ T ≤ VND 1.5 billion.
Any
transaction that satisfies one of the following conditions:
1. 1.
Any transaction that satisfies the following conditions:
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
(ii) G
+ Tksth > VND 20 million.
(iii) G
+ T > VND 1.5 billion.
2. 2.
Any transaction that satisfies the following conditions:
(i) G
> VND 10 million.
(ii) G
≤ VND 500 million.
(iii) G
+ T > VND 1.5 billion.
3. 3.
Any transaction that satisfies the following condition:
G >
VND 500 million.
4
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
Outbound
interbank transfer2.
Any
transaction that satisfies the following conditions:
(i) G ≤
VND 200 million.
(ii) G
+ T ≤ VND 1 billion.
Any
transaction that satisfies one of the following conditions:
1. 1.
Any transaction that satisfies the following conditions:
(i) G ≤
VND 200 million.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
2. 2.
Any transaction that satisfies the following condition:
G >
VND 200 million.
II
Institutional
client3
1
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
Money
transfer between checking accounts or e-wallets of the same client in a
payment service provider or intermediary payment service provider.
All
transactions.
2
Group
II.2:
- Money
transfer between checking accounts and e-wallets of different account holders
and e-wallet owners.
- Money
transfer between accounts and e-wallets opened at different payment service
providers and intermediary payment service providers.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
-
E-wallet cash-in1.
-
E-wallet cash-out.
Any
transaction that satisfies the following conditions:
(i) G +
T ≤ VND 1 billion.
(ii) G
+ T ≤ VND 10 billion.
Any
transaction that satisfies one of the following conditions:
1. 1.
Any transaction that satisfies the following conditions:
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
(ii) G
+ T > VND 10 billion.
2. 2.
Any transaction that satisfies the following condition:
G >
VND 1 billion.
3
Group
II.3:
Outbound
interbank transfer2.
Any
transaction that satisfies the following conditions:
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
(ii) G
+ T ≤ VND 5 billion.
Any
transaction that satisfies one of the following conditions:
1. 1.
Any transaction that satisfies the following conditions:
(i) G ≤
VND 500 million.
(ii) G
+ T > VND 5 billion.
2. 2.
Any transaction that satisfies the following condition:
G >
VND 500 million.
Notes:
G: Value
of the transaction.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
T: Total
value of each category of transactions performed in a day (on a checking
account (including e-wallet cash-in) or an e-wallet (excluding e-wallet
cash-in) of a client at a payment service provider or intermediary payment
service provider, excluding checking account auto-debit, e-wallet auto-debit
and card auto-debit transactions.
(1) In
case of e-wallet cash-in from the e-wallet owner's VND account at an affiliated
bank, the transaction classification shall rely on the checking account linked
to the e-wallet.
(2)
Converted limit is based on exchange rate at the time of transaction.
(3) In case
the client is a business household or a micro-enterprise applying a simple
accounting regime, transactions of such business household or micro-enterprise
are classified similarly to transactions of an individual client.
APPENDIX 02
ONLINE PAYMENT TRANSACTION AUTHENTICATION
(Enclosed with the Circular No. 50/2024/TT-NHNN dated October 31, 2024 of
the Governor of the State Bank of Vietnam)
No.
Transaction
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
Individual client
Institutional client
1
Category
A transaction
-
Password or PIN (if authenticated at the login step, authentication is not
required at the transaction step).
-
Password or PIN (if authenticated at the login step, authentication is not
required at the transaction step).
2
Category
B transaction
- SMS
OTP or Voice OTP or Email OTP;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
- Or
basic or advanced Soft OTP/ Token OTP;
- Or
two-channel;
- Or
device-based biometric authentication1;
- Or
FIDO;
- Or
e-signatures;
- Or
secure e-signatures.
- SMS
OTP or Voice OTP or Email OTP;
- Or
OTP Matrix Card;
- Or
matching the device-based biometric information of the legal representative
or the individual authorized by the legal representative (if any).
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
Category
C transaction
- OTP
sent via SMS/Voice or basic Soft OTP/Token OTP or e-signatures,
- And
biometric authentication.
- Basic
Soft OTP/ Token OTP;
- Or
two-channel;
- Or
e-signatures.
4
Category
D transaction
-
Advanced Soft OTP/Token OTP or FIDO or secure e-signatures,
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
-
Advanced Soft OTP/ Token OTP;
- Or
FIDO;
- Or
secure e-signatures.
Notes:
- Details
about authentication forms are specified in Article 11 of this Circular.
-
Category D transaction authentication form may be used to authenticate Category
A, B and C transactions.
-
Category C transaction authentication form may be used to authenticate Category
A and B transactions.
-
Category B transaction authentication form may be used to authenticate Category
A transactions.
- In case
the client is a business household or a micro-enterprise applying a simple
accounting regime, the transaction authentication form to be applied is similar
to that applied to an individual client. Regarding the form of biometric authentication
and the form of device-based biometric authentication, the biometric
information used for comparison is that of the legal representative or the
individual authorized by the legal representative (if any).
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
APPENDIX 03
CLASSIFICATION OF ONLINE CARD PAYMENT TRANSACTIONS
(Enclosed with the Circular No. 50/2024/TT-NHNN dated October 31, 2024 of
the Governor of the State Bank of Vietnam)
No.
Description
Category E transaction
Category F transaction
Category G transaction
1
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
Any
transaction that satisfies the following condition:
G + T ≤
VND 5 million.
Any
transaction that satisfies the following conditions:
(i) G +
T > VND 5 million.
(ii) G
+ T ≤ VND 100 million.
Any
transaction that satisfies the following conditions:
G + T
> VND 100 million.
Notes:
G: Value
of the transaction.
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
APPENDIX 04
ONLINE CARD PAYMENT TRANSACTION AUTHENTICATION
(Enclosed with the Circular No. 50/2024/TT-NHNN dated October 31, 2024 of
the Governor of the State Bank of Vietnam)
No.
Transaction
Minimum online card payment transaction authentication
form
1
Category
E transaction
Password
or PIN (if authenticated at the login step, authentication is not required at
the transaction step).
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
Category
F transaction
- SMS
OTP or Voice OTP or Email OTP;
- Or
OTP Matrix Card;
- Or
Basic Soft OTP/ Token OTP;
- Or
device-based biometric authentication1;
- Or
two-channel.
3
Category
G transaction
-
Advanced Soft OTP/ Token OTP;
...
...
...
Hãy đăng nhập hoặc đăng ký Thành viên
Pro tại đây để xem toàn bộ văn bản tiếng Anh.
- Or
e-signatures/ secure e-signatures;
- Or
EMV 3DS.
Notes:
- Details
about authentication forms are specified in Article 11 of this Circular.
-
Category G transaction authentication form may be used to authenticate Category
E and F transactions.
-
Category F transaction authentication form may be used to authenticate Category
E transactions.