Understanding Vietnam’s New Fintech Law and Decree 94/2025
Vietnam’s financial technology (fintech) industry has expanded quickly, offering more digital services than ever before, from e-wallets and online lending to blockchain-based tools. Until now, these activities operated with little formal regulation, creating legal uncertainty for businesses and investors.
Decree 94/2025 changes that. This new law sets clear rules for how fintech companies must operate in Vietnam. It introduces licensing procedures, outlines a sandbox program for testing new models, and defines what companies need to do to comply with data and cybersecurity laws.
If you’re running or investing in a fintech business in Vietnam, understanding this legal shift is essential to staying compliant and protecting your operations.
What Is Vietnam’s Decree 94/2025? Fintech Law Overview
Decree 94/2025, issued by the State Bank of Vietnam (SBV), is the first comprehensive regulation aimed specifically at financial technology (fintech) companies. It serves two primary goals:
- Establish a structured regulatory framework for the fintech sector
- Support innovation while mitigating financial, technological, and systemic risks
The decree addresses long-standing legal gaps in digital financial services, providing a baseline for supervision, licensing, and risk control. It reflects Vietnam’s broader push toward digital transformation in the banking and finance industry.
Which Fintech Businesses Must Comply with Decree 94/2025?
Decree 94/2025 targets a wide range of fintech activities. Businesses required to comply include:
- Peer-to-peer (P2P) lending platforms
- Payment intermediaries, including e-wallets, payment gateways, and mobile money providers
- Blockchain-based financial services, particularly where they involve payments, settlements, or investment services
- Credit scoring platforms using alternative data
- Cross-border digital finance platforms offering services to Vietnam-based users
Additionally, emerging models such as robo-advisory and embedded finance solutions may be captured under broader licensing categories, depending on how their operations intersect with regulated services.
The law applies regardless of whether these services are delivered through apps, websites, or partnerships with local banks.
Vietnam Fintech Licensing Requirements Under Decree 94/2025
Under Decree 94/2025, fintech firms must either register, apply for a license, or enter the regulatory sandbox depending on the nature of their business.
Key licensing requirements include:
- Minimum capital thresholds based on business model
- Detailed technology and cybersecurity documentation
- Policies for anti-money laundering (AML) and combating financing of terrorism (CFT)
- Periodic compliance reporting to the SBV
Additional requirements may include internal audit functions, customer data protection systems, and business continuity planning.
Operating without a license or registration may lead to penalties, even if the business is conducted digitally or offshore. Therefore, fintech startups must conduct a legal gap analysis early in their development.
How Vietnam’s Fintech Sandbox Works Under Decree 94/2025
The regulatory sandbox is a controlled testing environment that allows fintech startups and financial institutions to test innovative products under SBV oversight. This mechanism enables companies to experiment with emerging technologies while remaining within a legally recognized structure.
Key features include:
- Eligibility: Models involving credit scoring, digital lending, eKYC, or distributed ledger technology are prioritized. Other proposals may be considered if they show strong innovation and financial inclusion potential.
- Approval process: Applicants must submit a comprehensive application including technical plans, risk mitigation strategies, data protection policies, and expected market impact.
- Time limits: Sandbox participation is typically limited to 1–2 years with defined evaluation milestones and exit criteria. Extensions may be granted on a case-by-case basis.
Applicants must also submit progress reports and comply with strict operational boundaries imposed by the SBV. This helps the regulator assess the real-world viability of new models without fully exposing consumers to untested risks.
Successful participants may receive fast-tracked licensing upon completion. Sandbox participants are also subject to interim regulatory controls, and in cases of consumer harm or policy violation, participation may be suspended or terminated early.
The sandbox initiative reflects Vietnam’s balanced approach—encouraging financial innovation while ensuring market integrity and user protection.
Can Foreign Fintech Companies Operate in Vietnam?
Yes, but with important restrictions. Foreign entities must:
- Comply with limitations on foreign ownership, particularly in credit-related services
- Set up local legal entities or partner with licensed Vietnamese firms
- Address data localization and cybersecurity compliance under Vietnam’s Cybersecurity Law
Additionally, marketing fintech services directly to Vietnamese users without legal presence may still trigger regulatory obligations.
Foreign fintech investors should carefully assess how to structure their market entry, especially if operating in lending, payments, or digital assets.
Vietnam’s approach emphasizes national sovereignty and consumer protection, and foreign companies must navigate licensing, compliance, and local partnership requirements to operate legally and sustainably.
What Happens If You Violate Vietnam’s Fintech Law?
The SBV and Ministry of Public Security have enforcement powers under Decree 94/2025. Violations can result in:
- Fines for unlicensed operation or exceeding sandbox limits
- Temporary suspension or forced shutdown of operations
- Public disclosure of non-compliant platforms
In more serious cases, authorities may pursue criminal investigations, especially for fraud, data breaches, or consumer harm.
SBV may also blacklist offending companies or notify other regulatory agencies, affecting broader business operations such as banking relationships, investor access, or digital advertising capabilities. Ongoing non-compliance can also result in permanent license revocation.
Challenges Fintech Companies Face Under Vietnam’s New Law
Although Decree 94/2025 provides legal clarity, it also introduces new operational challenges:
- Ambiguity in emerging technologies: Areas like crypto trading and decentralized finance (DeFi) remain outside the scope but may still fall under other laws
- Cost of compliance: Building systems to meet reporting, IT security, and risk management standards can strain early-stage startups
- Evolving expectations: The SBV retains discretion to issue further guidance, which may shift over time
For example, a fintech startup offering cross-border digital lending may struggle to determine whether its model qualifies for the sandbox or requires full licensing. Missteps could result in delays or even enforcement actions. Navigating unclear definitions or dual regulatory regimes (e.g., fintech and cybersecurity) can lead to added legal costs and operational inefficiencies. Companies must continuously monitor legal developments and invest in adaptive compliance infrastructure.
Data Protection and Cybersecurity Obligations for Fintechs
Fintech firms must comply with Vietnam’s Cybersecurity Law, Data Protection Decree, and technical requirements under Decree 94/2025.
Requirements include:
- Storing user data on servers located in Vietnam
- Implementing multi-layer cybersecurity protocols, including encryption and access controls
- Internal monitoring systems to detect suspicious activity
- Incident reporting obligations in the event of data breaches
Failure to comply may result in administrative penalties or civil liability. Fintech companies should proactively implement IT risk assessments, conduct employee training, and develop breach response plans in line with SBV guidance.
How to Launch a Fintech Business Under Decree 94/2025
Entrepreneurs and foreign investors planning to enter Vietnam’s fintech market should:
- Determine licensing path: Based on business model — registration, sandbox, or full license
- Establish local presence: Form a Vietnamese entity or partner with a licensed operator
- Conduct legal and regulatory due diligence: Understand sector-specific restrictions
- Build compliance infrastructure: AML/CFT policies, cybersecurity framework, internal controls
- Engage with SBV: Submit application and support documents for approval
It’s also essential to prepare operational documents such as user terms, data privacy notices, and contractual agreements with partners. Engaging legal counsel familiar with both fintech and local business law significantly reduces delays and legal risks.
Decree 94/2025 Marks a Major Step for Fintech Compliance
Vietnam’s Decree 94/2025 brings long-awaited structure to a fast-moving sector. While the regulation introduces new hurdles, it also opens the door for innovation to thrive under a clear legal framework.
Businesses that take early steps to understand and implement compliance measures will be better positioned for sustainable growth in the Vietnamese fintech ecosystem.
Le & Tran has experience advising fintech companies on compliance, licensing, and regulatory matters under Vietnamese law. If you need legal support with Decree 94/2025 or launching your fintech business in Vietnam, feel free to contact us at info@letranlaw.com.
