Without a digital signature, a business cannot log in to, sign, or transmit declarations on the VNACCS/VCIS e-customs system. From 10 April 2025, the legal framework for digital signatures changed fundamentally: Decree 130/2018/ND-CP expired and was replaced by Decree 23/2025/ND-CP — under which public digital-signature certificates are valid for a maximum of 3 years (no longer 5). This article summarizes the current rules and the steps to register a digital signature with the customs authority.
The current legal framework for digital signatures
Decree 23/2025/ND-CP, detailing the Law on Electronic Transactions 2023 on electronic signatures and trust services, effective 10 April 2025, is the current instrument governing digital signatures, digital-signature certificates and trust service providers. Older articles and guides still citing Decree 130/2018/ND-CP are outdated — businesses should not rely on them.
Parent law: the Law on Electronic Transactions 2023 (20/2023/QH15, passed 22 June 2023, effective 1 July 2024, replacing Law 51/2005/QH11):
- Article 22 — electronic and digital signatures: conditions include identifying the signatory; signature-creation data uniquely linked to the data message; under the signatory’s control at signing time; any post-signing change detectable; secured by a digital-signature certificate;
- Article 23 — a digital signature has legal value equivalent to that individual’s handwritten signature on paper;
- Article 28 — trust services (including public digital-signature certification services).
Public certificate validity: maximum 3 years
This is the most important change to remember: under Article 7 of Decree 23/2025/ND-CP, a public digital-signature certificate is valid for a maximum of 3 years — no longer 5 years as under Decree 130/2018/ND-CP. Businesses must proactively renew or re-obtain certificates before expiry to avoid interrupting declarations.
Transitional provisions (two layers):
- Article 53 of the Law on Electronic Transactions 2023: certificates issued before 1 July 2024 remain usable until their expiry;
- Article 47 of Decree 23/2025/ND-CP: issuance of certificates under licenses granted before the Law on Electronic Transactions 2023 took effect and still valid at that date is carried out once; the validity of an issued certificate is at most 5 years and must not exceed the remaining term of the license.
The role of digital signatures in customs declarations
A digital signature is the means for customs declarants to log in, sign and transmit electronic declarations on VNACCS/VCIS. The certificate serial number in the USB Token must match the serial registered on the customs authority’s portal and on VNACCS — a serial mismatch is a common reason declarations cannot be signed or transmitted.
Signing forms: USB token, SIM-based signing, or remote signing (SmartCA). From 1 February 2026, Circular 121/2025/TT-BTC adds registration of customs-system connection via VNeID digital-identity accounts.
Note the distinction: “public digital signatures” (used by businesses — issued by trust service providers) differ from “official-duty digital signatures” (for state agencies).
Steps to register a digital signature with customs
Practical steps on the customs portal (customs.gov.vn), described at principle level (interface may change):
- Step 1: purchase a certificate from a licensed trust service provider (CA) and install the USB Token driver;
- Step 2: go to Public Services → “Register enterprise use of digital signature”: enter the tax code and the ID/passport number of the legal representative, review and confirm certificate information, enter the registration validity dates, and sign with the PIN to submit;
- Step 3: register an admin account and new users (business code OE1001) to obtain a User ID, Terminal ID and Terminal Access Key;
- Step 4: configure the declaration software and sign declarations with the Token before transmitting.
A digital signature already registered with the tax authority can be used to register with the customs authority (same tax code).
Dossier for a public digital-signature certificate
Contact a licensed public digital-signature certification provider — the list is published by the Ministry of Science and Technology (formerly the Ministry of Information and Communications) — and provide the enterprise’s legal papers as required by the provider. Legal materials should not list specific providers with endorsements, since the licensed list may change; state only the principle of choosing a licensed provider.
Operational notes
When renewing, re-obtaining, changing certificate information or switching CA providers, businesses must update the certificate information on the customs portal and VNACCS — otherwise declarations may fail to sign/transmit even though the new certificate is valid.
Frequently asked questions
How long is a public digital-signature certificate valid?
Maximum 3 years under Article 7 of Decree 23/2025/ND-CP (effective 10 April 2025) — no longer 5 years as before.
Is Decree 130/2018/ND-CP still in force?
No. It expired on 10 April 2025 and was replaced by Decree 23/2025/ND-CP (Decree 48/2024/ND-CP amending it expired at the same time).
Can a tax-registered digital signature be used for customs?
Yes — under the same tax code, a business may use that signature to register with the customs authority.
Must I re-register with customs when switching CA providers?
Yes. On renewal, re-issuance, information changes or CA switches, update the information on the customs portal and VNACCS.
Legal references
- Law on Electronic Transactions 2023 (20/2023/QH15), Articles 22, 23, 28, 53;
- Decree 23/2025/ND-CP (effective 10 April 2025), Articles 7 and 47;
- Circular 121/2025/TT-BTC (effective 1 February 2026).
This information is for reference only and does not constitute legal advice. Portal steps are practical administrative procedures; businesses should check current regulations.
If your business needs legal support on digital signatures, trust services or e-customs declarations, contact FLAT Law Firm for advice.
For reference only, not legal advice. Content quality-checked by the AI Legal Council; not yet reviewed by a human lawyer.
