Short answer: Digital banking in Vietnam currently grows as incumbent banks running fully digital channels, not as a standalone pure digital-bank licence separate from a credit-institution licence. Open banking — sharing customer data with third parties via API with the customer’s consent — is being advanced by the State Bank on a cautious roadmap that puts data safety ahead of opening speed.
Licensing: no separate digital-bank licence yet
The Law on Credit Institutions 32/2024/QH15 (effective 01/7/2024) is the current licensing frame: taking deposits and extending credit as a bank requires establishing a credit institution in a statutory form, subject to charter-capital, governance and foreign-ownership limits as regulated. Market offerings branded as digital banks are either digital channels of licensed banks or fintechs partnering with banks — the fintech itself does not take public deposits. Realistic foreign entry routes are: capital contribution or share purchase within ownership limits at an existing bank, or building a fintech as the bank’s technology and distribution partner. Expecting a 100% foreign-owned digital-bank licence in the near term does not match the current frame.
Open banking and financial data
Open data sharing turns on three axes: customer consent for each sharing purpose; API and information-security standards banks and third parties must meet; and liability when data leaks along the sharing chain. Financial data is sensitive personal data in many cases, so sharing also sits under the Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/ND-CP: impact assessments, data processing agreements between bank and partner, and consent-withdrawal mechanics are indispensable components. The controlled-testing (sandbox) mechanism in banking is the practical entry path for novel data-sharing and financial-service models without a complete frame, allowing limited-scope, time-bound trials under State Bank supervision.
Fintech–bank partnership opportunities
- The fintech supplies experience and technology layers; the bank holds the licence and deposits.
- Design purpose-by-purpose data-sharing consent flows inside the product itself.
- Sign data processing and incident-liability agreements before API integration.
- Treat the sandbox as a serious option for models with no licensing precedent.
Frequently asked questions
Is there a licence for a 100% foreign-owned digital bank?
Under the current Law on Credit Institutions 32/2024 frame, there is no standalone pure digital-bank licence; banking activity still requires establishing a credit institution subject to capital, governance and foreign-ownership limits. Practical foreign routes are capped investment in an existing bank or a fintech–bank partnership.
What does the bank data-sharing (open API) frame include?
Three components: customer consent per purpose; API connectivity and information-security standards for banks and third parties; and liability allocation for data incidents along the sharing chain. Because financial data is often sensitive personal data, the frame runs together with Law 91/2025 impact assessments and processing agreements.
How is customer financial data protected?
Through credit institutions’ customer-information confidentiality regime plus the personal data protection frame: sharing only on a valid basis such as customer consent, encryption and access control during sharing, binding agreements on recipients, and incident notification and response duties.
Where are fintech–bank partnership opportunities?
In layers banks do not best self-provide: customer experience, eKYC, alternative-data credit scoring, payments and personal finance management. The durable model is the fintech supplying technology and distribution on the bank’s licence and compliance infrastructure, with revenue and data-liability splits agreed clearly upfront.
This article has been quality-reviewed by the FLAW AI Legal Council