A virtual card — a card that exists only inside an app, with no plastic — is fully recognised by Vietnamese banking law, but the right to issue one is not open to every business. Only credit institutions, foreign bank branches, and payment intermediaries licensed for prepaid cards may issue cards; an FDI company outside those categories that wants a virtual card in its product must go through one of them.
Who may issue virtual cards and the license condition
Circular 18/2024/TT-NHNN (replacing Circular 19/2016/TT-NHNN, effective 1 July 2024, as amended by Circular 45/2025/TT-NHNN) governs all bank card activity in Vietnam and permits cards to be issued in non-physical form. Card issuers under this circular are credit institutions, foreign bank branches, and payment intermediary service providers for the prepaid card business. An FDI digital bank issuing virtual debit or credit cards to retail customers is therefore doing ordinary card business within its banking license; a non-bank FDI fintech may issue prepaid cards only where its payment intermediary license under Decree 52/2024/ND-CP covers that service, or it must co-issue with a partner bank.
On the customer side, virtual card issuance carries identification requirements matching the card type: debit, credit and identified prepaid cards require full identification files (in person or by eKYC as regulated), while anonymous prepaid cards are tightly limited in balance and reloadability. An FDI company wanting virtual cards for internal spending or customer rewards still has to pass through a licensed issuer — there is no mechanism for printing its own bank-style numbered ‘cards’.
Transaction limits on non-physical cards
A non-physical card sits under the same limit framework as its physical counterpart: daily cash withdrawal, transfer and payment limits are set by the issuer within the State Bank’s framework and the cardholder’s risk profile, and recorded in the card issuance and use contract. Anonymous prepaid cards — typically used as gift cards — are locked at a low level: the maximum balance may not exceed VND 5 million under Circular 18/2024/TT-NHNN, with no reloading after issuance and no cash withdrawal, to control the money-laundering risk of an unidentified payment instrument.
Beyond money limits, non-physical cards carry channel and authentication-tier limits: high-value online or contactless transactions require strong authentication (one-time passwords, biometrics or 3D Secure) under the electronic transaction safety rules for banking. Cardholders can proactively lower or lock channel limits in the app; the issuer must provide those tools and notify balance movements after every transaction — this control layer is the first barrier when virtual card data is compromised.
When money is lost from a virtual card: allocating liability
Where a transaction arises that the cardholder says they did not make, Circular 18/2024/TT-NHNN places the complaint and trace process on the issuer: the issuer must receive the complaint, trace the transaction with the payment organisation and the acquirer, and refund the cardholder for transactions determined not to have been made or authorized by the cardholder, within the regulated complaint-handling period — except where the transaction is proven to arise from the cardholder’s own fault, such as disclosing authentication data or the PIN, or handing the card to another person.
For virtual cards, ‘disclosed card data’ is the most common dispute scenario because the full card data is displayed in the app and can be screenshotted or harvested by malware. The issuer therefore bears a duty to design a matching protection layer: masked card numbers by default, authentication before full card data is displayed, instant card locking in the app, and abnormal-transaction alerts. An FDI issuer giving virtual cards to staff or customers should state in its terms: the loss-reporting procedure, how quickly the card is locked after notification, and who bears losses in the gap between a fraudulent transaction and the lock report — because that gap is where liability is argued most when an incident happens.
Frequently asked questions
Is a license required to issue virtual cards to customers?
Yes. Card issuance — including non-physical cards — is reserved to card issuers under Circular 18/2024/TT-NHNN: credit institutions, foreign bank branches, and payment intermediaries for prepaid cards (whose Decree 52/2024/ND-CP license must cover prepaid card issuance). An FDI company outside these categories must co-issue with a licensed bank or intermediary.
Do non-physical cards have transaction limits?
Yes, the same limits as the corresponding physical card: daily transaction limits set by the issuer within the State Bank framework and recorded in the card contract. Anonymous prepaid cards are tightly capped — maximum balance of VND 5 million under Circular 18/2024/TT-NHNN, no reloading, no cash withdrawal. High-value online or contactless transactions also require strong authentication (OTP, biometrics, 3D Secure).
Who is liable when money is lost from a virtual card?
The issuer must handle the complaint, trace the transaction and refund the cardholder for transactions determined not made or authorized by the cardholder, under Circular 18/2024/TT-NHNN — except where the transaction is proven to result from the cardholder’s fault (disclosing authentication data or the PIN, or lending the card). On seeing an unknown transaction, the cardholder should report and lock the card immediately to fix the timeline and protect the refund right.
This article has been quality-reviewed by the FLAW AI Legal Council
