Electronic customer identification lets accounts open and loans flow online in minutes, but every eKYC-opened account is a legal commitment about identity. Whether a fintech uses a partner’s eKYC or builds its own, it must answer the same question when fraud occurs: who is responsible for a customer who was identified wrongly.
Legal basis
- AML Law 14/2022/QH15 and Decree 19/2023/ND-CP: the customer-identification duty is the legal root of every eKYC process in finance.
- Decision 2345/QD-NHNN on online payment safety (applied from 1 July 2024): transactions above thresholds require biometric authentication matched against ID data.
- Personal Data Protection Law 91/2025/QH15 (effective 1 January 2026) and Decree 356/2025/ND-CP (replacing Decree 13/2023/ND-CP): biometric data is sensitive personal data with a higher protection regime.
Detailed analysis
eKYC in Vietnam is built on the customer-identification frame of anti-money-laundering law — AML Law 14/2022/QH15 and Decree 19/2023/ND-CP — plus State Bank rules on opening and using payment accounts by electronic means that allow verification through recognition technology and data matching. The transaction-authentication layer is tightened by Decision 2345/QD-NHNN on safety measures in online payment, requiring biometric authentication for transactions above regulated value thresholds. Biometric and identification data fall within sensitive personal data under the Personal Data Protection Law 91/2025/QH15 effective 1 January 2026 and Decree 356/2025/ND-CP replacing Decree 13/2023/ND-CP, so an eKYC programme needs a data-processing impact assessment, a clear consent basis for the biometric part, and retention and deletion policies for identity data. On responsibility, a financial organisation cannot transfer its customer-identification duty to a technology vendor: an outsourced eKYC contract must allocate liability for document and face-matching accuracy, authentication logs must be stored so each identification can be replayed, and the organisation remains the party answering the regulator when an account is used for fraud.
Risks to note
The fastest-growing technical risk is biometric spoofing with deepfake images and video, so eKYC relying on a static face photo is no longer a sufficient defence; practice standards are active liveness detection, chip-based citizen ID matching where possible, and freezing anomalous transactions after identification. The second compliance risk is reusing identification data for marketing beyond the original consent scope, breaching the purpose-limitation principle of personal data law. In bank-fintech partnerships such as agency or lending-platform models, the agreement must state which party keeps the original identification file and for how long, because on inspection the party that cannot produce the file is assessed as having failed its customer-identification duty.
Immediate actions
- Prepare a personal data processing impact assessment for the entire eKYC flow before official launch.
- Write into the eKYC outsourcing contract the liability allocation for mis-identification and the duty to hand over authentication logs on termination.
- Apply active liveness detection and chip-based ID data matching to high-limit account-opening flows.
Frequently asked questions
What is eKYC in fintech and who bears ultimate responsibility for identification?
The key point is this: eKYC is the electronic performance of the customer-identification duty, and the financial organisation keeps ultimate responsibility even when it hires a technology partner. If the actual file on eKYC compliance fintech Vietnam differs from the assumptions above, the conclusion must be adjusted accordingly.
How does data law classify biometric data collected through eKYC?
In practice, Biometric data in eKYC is sensitive personal data under Law 91/2025/QH15, requiring a clear consent basis and a processing impact assessment. This is also what the authority usually asks first when inspecting eKYC compliance fintech Vietnam.
Does onboarding eKYC replace biometric authentication for transactions?
Here, Transactions above value thresholds need additional biometric authentication under Decision 2345/QD-NHNN, so onboarding eKYC does not replace transaction authentication. Deviation on this point in eKYC compliance fintech Vietnam is an error often detected on post-check.
May customers’ identification data be used for marketing?
As a matter of principle, It should not: using identification data for marketing beyond the consent scope breaches the purpose-limitation principle of data protection law. Any oral agreement about eKYC compliance fintech Vietnam should be replaced by a written one.
What must an eKYC outsourcing contract with a technology vendor record?
The outsourcing contract must clearly allocate liability for document and face-matching accuracy, spoofing and liveness detection standards, the duty to retain and hand over authentication logs on termination, and biometric data security commitments, because the financial organisation remains the party answering the regulator when a wrongly identified account is used for fraud.
This article has been quality-reviewed by the FLAW AI Legal Council