Context: Reports to the State Bank, anti-money-laundering filings, system-safety reviews and data-protection duties recur every quarter and every year; missing a single item is enough to draw a warning or a fine.
Legal Basis and How It Applies
A fintech company’s compliance frame in Vietnam does not sit in a single instrument. A payment intermediary operates under a State Bank licence and Decree 52/2024/ND-CP on non-cash payments (effective 1 July 2024); anti-money-laundering duties follow Law 14/2022/QH15 on Anti-Money Laundering; customer data must meet the Personal Data Protection Law 91/2025/QH15 (effective 1 January 2026) and Decree 356/2025/ND-CP, which replaced Decree 13/2023/ND-CP. A periodic checklist therefore splits into four tracks: activity reports to the State Bank, suspicious and large-value transaction reports to the AML authority, information-system safety assessments, and reviews of customer consent records for data processing.
The point operating teams most often get wrong is frequency: intermediary activity reports are usually monthly and quarterly, financial statements and independent audits are annual, while system-safety assessment and disaster-recovery drills follow an internal cycle the State Bank expects to be maintained continuously. A good checklist states three columns for every item — the legal basis, the deadline, and the named person who signs — and without one of those columns it is a reminder list, not a compliance tool.
Application in Practice and Common Pitfalls
On staffing, even a small fintech startup needs a compliance owner appointed in writing, even if the role is part-time. When the State Bank inspects, the first question is rarely ‘did you do it’ but ‘who is responsible and where is the evidence’ — a signed checklist with quarterly review minutes is the cheapest evidence a company can prepare in advance.
Action Checklist
The steps below turn the analysis above into concrete work:
- First, test your own situation against this ground: A fintech company’s compliance frame in Vietnam does not sit in a single instrument.
- Record the application point specific to this case instead of copying conclusions from another case: A periodic checklist therefore splits into four tracks: activity reports to the State Bank, suspicious and large-value transaction reports to the AML authority, information-system safety assessments, and reviews of customer consent records for data processing.
- Prepare the evidence and file relating to the following point before dealing with authorities or partners: On staffing, even a small fintech startup needs a compliance owner appointed in writing, even if the role is part-time. When the State Bank inspects, the first question is rarely ‘did you do it’ but ‘who is responsible and where is the evidence’ — a signed checklist with quarterly review minutes is the cheapest evidence a company can prepare in advance.
- Answer the question clients ask most directly with this conclusion, and keep it on file: The recurring set includes monthly and quarterly payment-intermediary activity reports to the State Bank, audited annual financial statements, suspicious and large-value transaction reports under AML Law 14/2022/QH15, plus system-safety and personal-data files under Law 91/2025/QH15.
Frequently Asked Questions
What reports must a fintech company file each year?
The recurring set includes monthly and quarterly payment-intermediary activity reports to the State Bank, audited annual financial statements, suspicious and large-value transaction reports under AML Law 14/2022/QH15, plus system-safety and personal-data files under Law 91/2025/QH15.
How often must a payment intermediary undergo an independent audit?
A payment intermediary must have its annual financial statements independently audited; the State Bank may also order thematic audits of system safety and licence conditions during inspections — so do not schedule one audit a year and relax, keep the file inspection-ready all year.
Should a fintech startup hire a dedicated compliance officer?
Not every startup must employ a full-time compliance officer, but a named person must own compliance in writing. For models that touch customer money, such as e-wallets or payment gateways, a dedicated compliance lead is close to a condition for passing partner-bank due diligence.
This article has been quality-reviewed by the FLAW AI Legal Council