Special Alert | From Idea to Market – Legally: Vietnam’s Fintech Sandbox Takes Shape

On 29 April 2025, the Vietnamese Government issued Decree No. 94/2025/ND-CP, introducing a long-awaited controlled testing mechanism (sandbox) for fintech solutions in the banking sector (“Decree”). Effective from 1 July 2025, this Decree establishes Vietnam’s first official framework for piloting innovative banking-related technologies under the direct supervision of the State Bank of Vietnam (the “SBV”).

Eligible Players & Permitted Fintech Activities

With this Decree, Vietnam has not just launched a sandbox – it has drawn, for the first time, clear legal boundaries within which financial innovation can be tested, validated, and potentially scaled. The Decree defines who may participate, and what they are permitted to do.

Participation is limited to legal entities established and operating in Vietnam, and must fall into one of the following categories:

1. Licensed credit institutions, such as commercial banks, non-bank credit institutions, microfinance institutions, and people’s credit funds, as defined under the Law on Credit Institutions;
2. Fintech companies in formal partnership with credit institutions; and
3. Independent fintech firms, operating without a banking partner but offering services directly to users.

For now, the sandbox is narrow, covering three selected fintech activities:

1. Credit scoring – technology-driven solutions that assess the creditworthiness of individuals or organizations. These tools are particularly valuable for improving access to credit among Vietnam’s underbanked population;
2. Open API – standardized application programming interfaces that allow secure, permission-based access to financial services data, facilitating interoperability between banks, fintechs, and third-party providers; and
3. Peer-to-peer (P2P) lending – a technology-based platform that facilitates information exchange and supports the execution of loan agreements in digital form between borrowers and lenders. Notably, all transactions must be conducted in Vietnamese Dong (VND), in accordance with local currency control regulations.

Fintech verticals such as digital asset trading, robo-advisory, and insurtech remain excluded from the sandbox. This reflects a cautious policy approach: the sandbox is not designed as an innovation free-for-all, but rather as a controlled regulatory environment – one that seeks to foster technological advancement while maintaining financial stability and customer protection.

Sandbox Participation

Once an eligible entity has met all applicable regulatory conditions, it may be granted a Certificate of Registration for Sandbox Participation (the “Participation Certificate”) by the SBV. This certificate serves as formal authorization to operate within the sandbox framework. In assessing applications, the SBV may consult with other competent authorities, such as the Ministry of Science and Technology, the Ministry of Public Security, or other relevant ministries, depending on the nature and scope of the proposed fintech solution.

Each approved solution will be subject to a testing period of up to two years, commencing from the date the Participation Certificate is issued. The SBV may grant an extension on a case-by-case basis, taking into account the complexity of the solution, its performance during testing, and associated risk factors.

Importantly, the scope of the sandbox participation will be determined by the SBV based on the applicant’s proposal, the specific features of the solution, and input from other regulators, where applicable. These conditions will be clearly defined in the Participation Certificate.

All sandbox activities must be conducted exclusively within Vietnam’s territory. Cross-border testing or deployment is expressly prohibited during the sandbox period.

Regulatory Requirements for P2P Lending

Among the three fintech activities permitted under this Decree, P2P lending receives the most regulatory scrutiny, and for good reason. In Vietnam, P2P lending holds significant promise for expanding credit access to individuals and small businesses often overlooked by traditional banks. But this opportunity comes with heightened risks, particularly around borrower protection, over-lending, and data security. Recognizing this, the Government has imposed a strict set of conditions for both the P2P platforms and the companies that operate them.

Eligibility Criteria

Fintech companies seeking to test P2P solutions must meet strict eligibility criteria:

Corporate & Legal Status	Management Integrity	Technology & Operational Infrastructure
Be a Vietnamese enterprise, duly established and lawfully operating within Vietnam; Must not be subject to foreign ownership; and Must not be undergoing any form of corporate restructuring, such as division, merger, or dissolution.	The legal representative and CEO must: Be Vietnamese nationals; Hold a university degree or higher in economics, business, law, or IT; Have at least two years of management experience in finance or banking; Have no criminal record and no administrative penalties in finance, banking, or cybersecurity; Not serve as owner or manager of any pawnshop, MLM firm, informal lending group (e.g., hụi/họ/biêu/phường), or licensed financial services provider; and Not hold executive or board roles at any credit institution, foreign bank branch, or intermediary payment provider.	All IT systems and data storage must be physically located in Vietnam; A robust backup system must ensure business continuity; Customer data must be securely stored, anonymized, and shared only with authorized parties, in compliance with personal data protection laws; Systems must be tested and validated prior to launch; and The platform must be supported by a qualified IT team capable of maintaining secure, uninterrupted operations.

Operational Safeguards

To participate in the sandbox, P2P lending platforms must also implement several core safeguards:

1. Borrower debt tracking: Platforms must have systems in place to monitor the total outstanding debt of each borrower – not only within their own platform, but across all sandboxed P2P platforms. This includes real-time integration with the Vietnam National Credit Information Center (CIC) to ensure compliance with borrower debt caps;
2. Secure transaction processing: All disbursements, repayments, interest, and fees must be processed exclusively through customers’ bank accounts or licensed e-wallets; and
3. Loan term limits: Any loan agreement executed on a sandbox-approved platform must have a term not exceeding two years.

Ongoing Obligations

During the testing phase, P2P lending companies must also:

1. Prevent conflicts of interest: Board members, executives, and employees are prohibited from participating as borrowers, lenders, or guarantors. They must not engage in any fraudulent, deceptive, or dishonest behavior;
2. Ensure customer transparency: Platforms must provide borrowers and lenders with complete and accurate information prior to loan execution – including contract terms, interest rates, fees, and legal rights. Customers must confirm receipt and understanding of such disclosures;
3. Manage borrower exposure: Each new loan must be cross-checked with CIC data at the time of contract signing to ensure borrowers are not breaching the sandbox-wide debt cap; and
4. Operate within scope: P2P firms may only offer services specifically authorized under their SBV-issued Participation Certificate. They may not offer additional services, provide guarantees for loans, act as users themselves, or facilitate services for pawnshops or unlicensed lending networks.

Sandbox Ongoing Compliance Matters

During the sandbox period, participating entities must comply with a range of ongoing obligations aimed at ensuring regulatory transparency, customer protection, data security, and operational integrity.

To start, participants are required to submit regular reports and, upon request, provide ad hoc updates to the SBV. These submissions must cover key information such as testing progress, emerging risks, and core performance indicators. At a minimum, participants must file a quarterly report through the SBV’s reporting system, no later than the 15th day of the first month of the following quarter.

Participants are also responsible for developing and maintaining reporting and monitoring tools that align with the SBV’s technical requirements. Where necessary, the SBV may instruct participants to develop additional software or tools to facilitate real-time supervision or enhanced data reporting throughout the trial period.

In parallel, participants must adopt clear and proactive measures to protect users throughout the testing phase. These include the following minimum obligations:

1. Issuing risk disclosures to customers regarding the experimental nature of the fintech solution;
2. Notifying customers that the solution is undergoing sandbox testing, and clearly providing accurate and complete information about the product or service, applicable fees, and user rights and obligations;
3. Ensuring data privacy and security, both during and after the use of the sandboxed solution, except when disclosure is required by law;
4. Adopting technical safeguards for data storage and transmission, including encryption, anonymization, and user consent protocols for data collection and sharing. Customer information may only be shared with third parties with explicit customer consent or when mandated by competent authorities;
5. Implementing internal risk controls to prevent unauthorized access to personal data, fraud, or identity theft;
6. Conducting regular risk assessments, and promptly notifying users if the risk profile of the solution changes; and
7. Establishing a customer complaint handling mechanism, including designated contact points and processes for resolving issues.

Finally, should a participant wish to modify the scope or functionality of the tested fintech solution, they must first submit a formal request to the SBV and obtain written approval. No changes may be implemented without prior regulatory consent.

Revocation of Participation Certificate

This Decree sets out scenarios under which the SBV may prematurely terminate a participant’s status and revoke its Participation Certificate, including, among others:

1. Failure to commence testing within 90 days of receiving the Participation Certificate (except in cases of force majeure);
2. The emergence of serious technical failures, legal violations, or risks deemed to cause substantial harm to customers or financial market stability, as assessed by competent authorities;
3. Non-remediation of any sandbox breach within 15 days of the SBV’s official notification;
4. Breach of the terms or scope specified in the Participation Certificate; or
5. In the case of P2P lending, failure to implement required borrower credit exposure controls as mandated by sandbox rules.

Revocation of the Participation Certificate results in the discontinuation of all sandbox activities by the relevant participant. However, such revocation does not, in itself, indicate that the entity fails to meet general business or investment conditions under Vietnamese law. The participant remains fully responsible for reviewing its legal position and ensuring ongoing compliance with all applicable regulations.

Sandbox Completion & Exit Outcomes

At the end of the sandbox period, the SBV will evaluate each participating entity based on its testing performance, regulatory compliance, and, where applicable, feedback from other relevant ministries. Based on this review, the SBV may determine one of the following outcomes:

1. Terminate the trial and revoke the Participation Certificate;
2. Extend the testing period, subject to a maximum of 12 months per extension, with no more than two extensions granted in total; or
3. Issue a Certificate of Completion, confirming the successful conclusion of the sandbox trial.

The Certificate of Completion may be granted under either of the following conditions: (a) a formal legal framework regulating the fintech solution is already in place, allowing the participant to transition from sandbox to full-scale operation under existing law; or (b) the solution is deemed lawful under current regulations and not subject to conditional business licensing, enabling it to be deployed commercially, subject to compliance with general laws.

It is important to note that the Certificate of Completion is valid only within the sandbox context. It does not serve as a business license, nor does it confirm full compliance with all legal conditions required for broader market operation. Likewise, termination of sandbox participation, whether through early revocation or upon completion of the trial, does not, by itself, imply a legal violation. Affected entities remain fully responsible for independently assessing their compliance obligations under applicable laws in Vietnam.

Final Thoughts

While the sandbox is deliberately narrow and tightly governed, it reflects Vietnam’s growing openness to financial innovation – paired with clear expectations around accountability, transparency, and consumer protection. For fintech companies, especially those developing solutions in credit scoring, open APIs, or P2P lending, this represents a rare opportunity to test market-ready models with legal certainty and structured regulatory feedback.

The sandbox is not a shortcut to market entry, nor a substitute for long-term licensing. But for serious innovators, it offers a meaningful early-mover advantage – a platform to engage with regulators, demonstrate operational integrity, and build credibility in a still-developing legal environment. For those able to exit with a Certificate of Completion, the benefits may extend well beyond the trial period – in investor confidence, partner validation, and future licensing pathways.

At Indochine Counsel, we are ready to assist businesses in managing this regulatory milestone, from eligibility assessment and application strategy to compliance design, sandbox reporting, and post-trial transition planning.