Tiếng Việt
中文 (中国)
日本語
In the context of rapid growth of the financial technology sector in Vietnam, coupled with increasing legal and systemic risks, the issuance of Decree No. 94/2025/ND-CP marks a significant shift in the regulatory approach to Fintech.
For the first time, digital financial models are placed within a relatively comprehensive legal framework, covering licensing mechanisms, regulatory sandbox arrangements, and compliance obligations relating to data protection and cybersecurity. This article analyzes the notable new features of the Fintech framework under Decree No. 94/2025/ND-CP and clarifies its implications for Fintech enterprises and foreign investors operating or planning to enter the Vietnamese market.
For the first time, a unified legal framework for Fintech in Vietnam
Decree No. 94/2025/ND-CP represents the first attempt by Vietnam to establish a relatively comprehensive and unified legal framework dedicated specifically to financial technology activities. Prior to its issuance, Fintech operations were primarily governed indirectly by various separate laws, including banking law, oversea investment law, enterprise law, information technology regulations, and cybersecurity legislation.
This fragmented regulatory approach created uncertainty for businesses in identifying their exact legal obligations and increased compliance risks during operations and business expansion.
The promulgation of Decree No. 94/2025 addresses a long-standing regulatory gap in relation to digital financial services. By setting out management principles, operational conditions, and supervisory mechanisms, the decree provides a clearer legal foundation for state oversight while enabling enterprises to formulate long-term development strategies with greater legal certainty. This is particularly significant as Fintech becomes increasingly integrated with the banking system and the broader financial market.
From a policy perspective, Decree No. 94/2025 reflects a cautious but progressive regulatory stance. Rather than prohibiting innovation or allowing unchecked market development, the State has opted for a controlled regulatory framework that simultaneously promotes innovation and mitigates financial, technological, and systemic risks. This approach lays the groundwork for orderly and sustainable Fintech development in Vietnam.
Clarification and expansion of regulated Fintech models
A key innovation of Decree No. 94/2025 lies in its clearer identification of core Fintech activities subject to regulation. Models such as peer-to-peer (P2P) lending, credit scoring services, and data-sharing through open APIs are explicitly brought within the regulatory scope, reflecting their potential impact on financial stability and consumer protection.
Notably, the decree does not regulate Fintech solely based on technological labels or service delivery channels. Instead, regulators adopt a substance-over-form approach, focusing on the underlying financial activity regardless of whether services are provided via mobile applications, online platforms, or in cooperation with domestic credit institutions. This method reduces the risk of regulatory arbitrage through technical structuring and enhances consistency in legal application.
For emerging models such as robo-advisory or embedded finance, Decree No. 94/2025 does not categorically exclude them but allows for flexible classification under appropriate regulatory or licensing categories.
However, this flexibility also places responsibility on enterprises to proactively assess their operational models and determine corresponding legal obligations. In practice, unclear classification may lead to implementation delays or require adjustments to business structures, necessitating close monitoring of guidance from competent authorities.
Foreign-invested enterprises in Vietnam should consider consulting reputable law firms in Hanoi and Ho Chi Minh City to obtain tailored advice suited to their specific circumstances.
Introduction of a tiered licensing and regulatory sandbox mechanism
Another significant reform under Decree No. 94/2025/ND-CP is the establishment of a more structured licensing regime aligned with the risk level and operational scope of different Fintech models. Rather than imposing a single uniform licensing mechanism, the decree differentiates between enterprises requiring full licenses and those eligible to participate in a controlled regulatory sandbox. This tiered approach lowers market entry barriers for innovative models while preserving the regulator’s capacity to manage systemic risks.
Under the formal licensing regime, Decree No. 94/2025 sets out relatively stringent requirements concerning charter capital, technological capacity, cybersecurity systems, anti-money laundering measures, and periodic reporting obligations.
Enterprises doing business in Vietnam should consider contacting a Law Firm Located in Ho Chi Minh City capable of providing Vietnam Company Secretarial Services and Corporate services in Vietnam tailor-based to the enterprises’ specific needs.
These requirements reflect the regulatory view that Fintech constitutes a component with direct implications for financial system safety, rather than merely a technology business. Consequently, Fintech enterprises must invest seriously in corporate governance, compliance infrastructure, and technological resilience from the outset.
Parallel to the licensing regime, the regulatory sandbox serves as a key policy instrument for testing new Fintech models in a controlled environment. Within the sandbox framework, enterprises may deploy products and services within a defined scope and duration under the supervision of the State Bank of Vietnam.
This mechanism enables regulators to evaluate the practical viability and risk profile of innovative models, while enterprises gain an opportunity to refine products and prepare for formal licensing.
Stricter compliance obligations, particularly regarding data protection and cybersecurity
While creating space for experimentation and innovation, Decree No. 94/2025 simultaneously tightens compliance obligations for Fintech enterprises, especially in the areas of data protection and cybersecurity. Given that Fintech entities process large volumes of financial and personal data, the sector is recognized as high-risk in the event of technological incidents or data breaches.
Pursuant to the decree and related legislation, Fintech enterprises must comply with data localization requirements, implement multi-layer security measures such as encryption, access control, and system monitoring, and establish mechanisms for timely detection, response, and notification of cybersecurity incidents or data breaches. These obligations extend beyond technical safeguards and are closely linked to corporate governance and legal accountability.
Enhanced compliance requirements are accompanied by stricter enforcement measures. Operating without a license, exceeding sandbox limits, or violating data protection and cybersecurity rules may result in administrative penalties, suspension of operations, or revocation of licenses. This underscores that Decree No. 94/2025 functions not only as a development-oriented instrument but also as a critical tool for consumer protection and financial market stability.
Implications for domestic Fintech enterprises and foreign investors
Decree No. 94/2025/ND-CP significantly reshapes how Fintech enterprises approach entry and operation in the Vietnamese market. For domestic enterprises, the decree provides greater legal clarity, reducing regulatory ambiguity during product rollout and scaling. However, this clarity comes with heightened compliance expectations, requiring substantial oversea investment in governance systems, technological infrastructure, and legal resources.
For foreign investors and foreign Fintech enterprises, the decree reflects Vietnam’s prudent approach to opening its digital financial market. Requirements to establish a local legal entity or cooperate with licensed institutions, coupled with foreign ownership limitations in certain sensitive sectors, necessitate more structured and long-term market entry strategies. Data localization and cybersecurity obligations may also increase cross-border compliance costs.
Conversely, the decree creates competitive advantages for enterprises that proactively adapt to the new framework. Foreign-invested companies in Vietnam that prioritize legal compliance, maintain transparent business models, and engage constructively with regulators are better positioned to leverage the sandbox mechanism and secure formal licenses. In the long term, Decree No. 94/2025 contributes to shaping a more orderly Fintech ecosystem, in which well-governed and compliant enterprises can build a sustainable foundation for growth in Vietnam’s evolving digital financial market.
ASL Law is a leading full-service and independent Vietnamese law firm made up of experienced and talented lawyers. ASL Law is ranked as the top tier Law Firm in Vietnam by Legal500, Asia Law, WTR, and Asia Business Law Journal. Based in both Hanoi and Ho Chi Minh City in Vietnam, the firm’s main purpose is to provide the most practical, efficient and lawful advice to its domestic and international clients. If we can be of assistance, please email to [email protected].
ASL LAW is the top-tier Vietnam law firm for Banking & Financial Services. If you need any advice, please contact us for further information or collaboration.
