Crypto was once marketed with the word anonymous, but a provider seeking a licence inside the Vietnam pilot framework must build operations on the opposite principle: know who the client is, understand their transactions and report suspicious transactions to the anti-money laundering authority. Resolution 05/2025/NQ-CP places crypto-asset service providers inside the duty system of Anti-Money Laundering Law 14/2022/QH15, on three pillars of client identification, transaction monitoring and reporting. This article presents each pillar at implementation level, handles the two most-asked grey zones of self-custody wallets and cross-border transactions, and sets out the sanction frame for non-compliance under Decree 284/2026/ND-CP from 1 September 2026.
Pillars one and two: client identification and continuous transaction monitoring
Client identification in the crypto-asset field does not stop at photographing an identity document at account opening. Under Anti-Money Laundering Law 14/2022/QH15 applied to crypto-asset service providers, the provider must collect and verify identification information of individual and organisational clients, determine the true beneficial owner behind an organisational account, understand the account purpose and the source of deposited funds, and screen clients against warning lists and prohibition lists under anti-money laundering and counter-terrorist financing rules.
Transaction monitoring is a continuous post-onboarding duty run by combined on-chain and off-chain surveillance: detecting transactions inconsistent with the declared client profile, structured transactions designed to dodge reporting thresholds, asset flows through wallet addresses linked to unlicensed exchanges, mixing services or internationally sanctioned addresses. The crypto-asset specificity is that every on-chain transaction is public while the identity behind a wallet address is not, so the provider must use blockchain analytics tooling to risk-score each counterparty address and keep a trace of allow or block decisions.
Pillar three: suspicious reporting, threshold reporting and the two grey zones
A suspicious transaction report goes to the anti-money laundering authority under the State Bank of Vietnam through the national anti-money laundering system channels and forms, whenever the provider holds a grounded suspicion that assets in a transaction relate to money laundering or a predicate offence, regardless of transaction value. The duty carries two hard principles: reporting confidentiality, meaning the provider must not tip off the client that their transaction was reported, and timeliness over completeness, because the receiving authority is where information from many providers is cross-matched.
The first grey zone is the self-custody wallet: a provider controls only the two ends of a transaction when a client deposits from a self-custody wallet to the exchange or withdraws from the exchange to one, while activity between self-custody wallets sits outside the direct control of any licensed provider. Sound risk practice scores the external wallet address with blockchain analytics, requires source-of-assets explanation for large deposits from high-risk addresses, and refuses transactions tied to prohibition lists or mixing services.
Sanctions for non-compliance and the minimum compliance programme
From 1 September 2026, failure to meet anti-money laundering duties in the crypto-asset field is sanctioned under Decree 284/2026/ND-CP as the specialised frame, at frame level including fines by act and strict supplementary measures such as licence suspension or revocation for serious or repeated conduct; this article fixes no per-act amount because provisions must be checked on a real file. Before that effective date, a provider anti-money laundering breach is reviewed under the sanction frame of the Anti-Money Laundering Law and related decrees.
The minimum compliance programme a provider needs before opening to clients comprises: a dedicated anti-money laundering officer or unit with authority to halt transactions; risk-tiered client identification procedures with a beneficial-owner checklist; an on-chain transaction monitoring system with periodically calibrated alert thresholds and an escalation process turning alerts into suspicious reports; mandatory training for client-facing and wallet-operations staff; and periodic independent compliance testing reporting straight to the board. The provider also needs a procedure for answering information requests from the anti-money laundering authority and investigative agencies within statutory deadlines, with a client-data access log ensuring the provider itself does not leak report information.
Frequently Asked Questions
What KYC must a crypto-asset service provider perform for clients?
The provider must perform client identification under Anti-Money Laundering Law 14/2022/QH15 applied to the pilot framework: collect and verify identification of individual and organisational clients, determine the true beneficial owner, understand account purpose and source of deposits, screen against warning and prohibition lists, and apply enhanced identification to high-risk clients such as politically exposed persons or complex ownership structures. Information must be refreshed periodically and the relationship refused or terminated when a client supplies insufficient identification; anonymous accounts are not accepted in the pilot framework.
To which agency must suspicious crypto-asset transactions be reported, at what threshold and deadline?
Suspicious transactions are reported to the anti-money laundering authority under the State Bank of Vietnam through national system channels and forms, whenever the provider holds a grounded suspicion of a link to money laundering or a predicate offence, regardless of value threshold. Reporting is confidential and the client must not be tipped off.
How are anti-money laundering duties handled for self-custody wallets and cross-border transactions?
A self-custody wallet sits outside a licensed provider direct control in the segment between wallets; the provider controls only the deposit and withdrawal ends at the exchange. Sound risk practice scores the external address with blockchain analytics, requires source-of-assets explanation for large deposits from high-risk addresses and refuses transactions tied to prohibition lists or mixing services. For cross-border flows, assets arriving from unlicensed foreign exchanges are an enhanced-risk signal and a foreign exchange identification does not replace the Vietnamese provider own duty.
How is failure to comply with AML in the crypto-asset field sanctioned?
From 1 September 2026, AML non-compliance in the crypto-asset field is sanctioned under Decree 284/2026/ND-CP at frame level including fines by act and strict supplementary measures such as suspension or licence revocation for serious or repeated conduct; concrete amounts must be checked against provisions on a real file. Before that date, breaches are reviewed under the sanction frame of Anti-Money Laundering Law 14/2022/QH15 and related decrees.
FLAT Law Firm builds the complete AML compliance programme for a provider preparing its licence application
In a licence file, the anti-money laundering programme is the section the regulator reads most closely because it shows whether the provider can control the very market it asks to operate. FLAT Law Firm designs the full compliance frame for a crypto-asset service provider: risk-tiered client identification policy, on-chain transaction monitoring and suspicious-report escalation procedure, a reporting-duty mapping table per transaction type, and the training and independent testing programme. Providers preparing a licence file under Resolution 05/2025/NQ-CP may contact the firm for a compliance readiness review before formal submission.
