New 2026 Anti-Money Laundering Rules for Vietnam’s Financial Sector

2026 marks a turning point for anti-money laundering (AML) in Vietnam: beyond paper regulations, financial institutions — banks, securities firms, insurers, payment intermediaries — must complete a comprehensive upgrade of internal rules, risk management, and e-reporting systems. At the center of this tightening is Circular 27/2025/TT-NHNN (issued 15 September 2025, effective 1 November 2025) guiding the Law on Anti-Money Laundering 14/2022/QH15. This article builds a “2026 compliance roadmap” from the financial-institution perspective: what the new framework contains, what must be done before 1 January 2026, and the FATF context behind it.

1. The new framework: Circular 27/2025/TT-NHNN

Circular 27/2025/TT-NHNN is the newest and most detailed guidance implementing the AML Law 14/2022 for banks and financial institutions. Core contents:

Money-laundering risk assessment: institutions must build risk-assessment methodologies based on customer types, products/services, distribution channels, and geography;
Risk-based customer classification: proportionate know-your-customer (KYC) measures — tightened for high-risk customers (PEPs, customers without accounts, infrequent transactors);
Transaction reporting: three mandatory report types — large-value transactions, suspicious transactions, and wire transfers;
E-reporting: migration to electronic reporting systems with the State Bank of Vietnam, progressively replacing manual methods.

Three milestones not to miss

Milestone	Content
1 Nov 2025	Circular 27/2025 takes effect — new obligations begin to apply
Through 31 Dec 2025	Transition period: complete adjustments to internal rules, risk-management processes, IT systems, and e-reporting
From 1 Jan 2026	All financial institutions must operate fully under the new framework

2. New wire-transfer reporting thresholds (Article 9)

Among the most-watched changes are the wire-transfer reporting thresholds in Article 9 of Circular 27/2025:

Domestic wire transfers: VND 500 million or more must be reported;
International wire transfers: USD 1,000 (or equivalent in other foreign currencies) or more must be reported.

Financial institutions must collect and retain full originator/beneficiary information under the “travel rule,” ensuring data accompanies the transfer across the entire chain. Commercial banks and payment intermediaries should review their core banking systems now.

3. Compliance roadmap for financial institutions

Step 1 — Review and adjust internal rules: update KYC procedures, risk classification, and reporting workflows for large-value/suspicious/wire-transfer transactions per Circular 27/2025. Obtain competent-level approval before 31 December 2025.

Step 2 — Strengthen risk governance: establish/designate a dedicated AML unit; build a customer–product–channel–geography risk matrix; alert-handling and escalation procedures.

Step 3 — Upgrade IT systems: deploy or upgrade screening software against blacklists, watchlists, and PEP lists; scenario-based transaction monitoring; e-reporting connectivity with the State Bank.

Step 4 — Expand KYC: not only account holders — the new Circular requires identifying customers without accounts and infrequent transactors when reportable transactions arise. Retrain all front-line staff.

Step 5 — Test and parallel-run: run old/new systems in parallel in Q4 2025; independent internal audit before 1 January 2026.

4. Context: FATF and the National Action Plan

The 2026 tightening is no coincidence. Vietnam is implementing its National Action Plan to exit the FATF grey list — and Circular 27/2025 is Action No. 5 of that plan, focused on financial institutions’ obligations. Full compliance not only avoids domestic sanctions but helps improve Vietnam’s international compliance rating, directly affecting cross-border transaction costs for the whole economy.

5. AML for the piloted crypto-asset market

A new frontier not to miss: Resolution 05/2025/NQ-CP (9 September 2025) on piloting the crypto-asset market in Vietnam. Pilot participants — exchanges, custodians, service providers — will bear AML obligations similar to traditional financial institutions: customer identification, suspicious-transaction reporting, chain monitoring. FDI enterprises using financial services in Vietnam should note: KYC demands from banking partners will be significantly stricter from 2026 — prepare complete corporate legal files and transparent cash flows to avoid transactions being “held” at the control stage.

6. What changes for FDI enterprises using banking services

For FDI companies, the 2026 framework is felt mainly from the receiving end of bank compliance. Expect three practical changes. First, heavier onboarding and periodic KYC: banks will request complete corporate files — investment certificates, charters, ultimate-beneficial-owner declarations (now stricter under Decree 296/2026), and source-of-funds evidence — not only at account opening but on periodic review cycles. Second, slower large transfers: transfers at or above the new thresholds (VND 500 million domestic, USD 1,000 cross-border) pass through enhanced screening; incomplete beneficiary information is the top reason transfers get held. Provide full remittance details (purpose codes, contracts, invoices) proactively. Third, crypto-adjacent caution: banks are tightening controls around transactions linked to digital-asset activities during the pilot period — businesses with any crypto exposure should discuss their banking arrangements with their bank’s compliance team in advance rather than discovering a frozen transaction mid-deal.

7. Sanctions for non-compliance

Failure to meet the new obligations exposes institutions to administrative sanctions under the sanctioning regime for monetary and banking violations — fines scale with the violation and responsible individuals face disqualification measures. Beyond fines, the State Bank may impose operational restrictions, and serious or repeated violations can affect licensing. Just as costly is the correspondent-banking risk: international partner banks increasingly condition correspondent relationships on demonstrable AML compliance — a weak AML posture can literally cut a bank off from the global payment system. For boards, the message is that AML investment in 2025–2026 is not a cost center but license insurance.

Board-level actions for Q4 2025: three decisions cannot be delegated to middle management. First, approve the budget for system upgrades — screening software, monitoring scenarios, and e-reporting integration are capital expenditures that procurement must start now to meet the 31 December 2025 transition end. Second, appoint the accountable AML officer with direct reporting to the board or CEO; regulators look for personal accountability, not a committee on paper. Third, commission an independent pre-implementation review — an external check in November 2025 is far cheaper than a sanction in 2026. Institutions that treat these as board priorities, not IT projects, will enter 2026 compliant; the rest will enter 2026 exposed.

Conclusion

The message for the financial sector: 31 December 2025 is the deadline for completing internal and system upgrades; from 1 January 2026 the Circular 27/2025 framework operates in full, with new wire-transfer reporting thresholds (VND 500 million domestic / USD 1,000 international). Against the FATF backdrop and the piloted crypto-asset market, 2026 AML compliance is no longer “defense” — it is a condition of doing business.

This article provides general legal information as of 14 October 2026 based on AML Law 14/2022/QH15, Circular 27/2025/TT-NHNN, and Resolution 05/2025/NQ-CP. It does not cite draft amendments to the AML Law or the State Bank Law as current authority.

The cost of waiting: every month of delay in 2025 compresses the testing window before the 1 January 2026 go-live. Institutions that start system upgrades in Q4 2025 leave themselves no parallel-run period — the single most effective defect-catching phase. The transition period ending 31 December 2025 is not an extension of the old regime; it is a countdown. Boards should ask management for a dated milestone plan at the next meeting, with the independent pre-implementation review locked in for November 2025.

Training as the multiplier: systems and rules only work if people use them. Schedule role-based AML training before year-end: front-office staff on customer-identification and red-flag recognition, operations teams on reporting workflows and deadlines, and senior management on personal accountability under the new framework. Document every session — training records are among the first items inspectors request, and a well-documented program demonstrates the “risk-based approach” the Circular demands far better than any policy binder alone.

This article has been reviewed by the QA Council — FLAW AI Legal Council.