Electronic identification is the gateway to every fintech service in Vietnam: without valid eKYC there is no payment account, no activated wallet and no digital loan disbursement. But eKYC in Vietnam is not a freely chosen technology; it is a legal process standardised by the State Bank for banks, and non-bank fintechs may take part only in the roles the legal framework allows.
The base framework: payment accounts and customer identification
The banking eKYC process is anchored in Circular 17/2024/TT-NHNN on opening and using payment accounts at payment service providers, as amended by Circular 25/2025/TT-NHNN, which allows electronic account opening provided the institution identifies and verifies the customer through identity documents and biometric factors matched against the population database. In parallel, Law on Anti-Money Laundering 14/2022/QH15 requires reporting entities to identify customers, update information and monitor transactions, and eKYC is how those duties are executed on digital channels.
The most important limit is the actor: the right to open payment accounts and perform bank-grade eKYC belongs to licensed payment service providers, meaning banks and eligible payment intermediaries. A pure technology fintech does not itself become a banking identification principal; it supplies technology solutions to a licensed principal, or must itself obtain a payment intermediary licence if it wants to run an e-wallet service directly.
Does eKYC replace face-to-face checks, and transaction limits
For accounts opened electronically, the law allows an equivalent electronic verification process to replace the face-to-face meeting, but in exchange such accounts are usually subject to transaction limits set by regulation and by the opening institution’s risk policy. Where a customer needs transactions above the limit or falls into a higher risk group, the institution may require supplementary verification, an identification upgrade or an in-person meeting.
A point companies often get wrong is that eKYC is not a once-for-all-services procedure. Each service relationship carries its own identification requirement: payment accounts, credit granting and investment sit at different appraisal tiers, and a customer’s completed eKYC at one bank does not automatically exempt them from eKYC at another platform, unless a lawful data-sharing mechanism exists between the institutions.
Storing eKYC data and penalties for violations
eKYC data includes images of identity documents, biometric data and records of the verification process. Biometric data is sensitive personal data under Law on Personal Data Protection 91/2025/QH15 and Decree 356/2025/ND-CP, so collection needs a lawful basis and consent as required, protection by proportionate technical measures and retention only for the period needed for customer identification and anti-money laundering purposes.
eKYC violations are sanctioned at several levels: a payment service provider can face administrative fines in the monetary and banking sector under the current penalty decree, be required to close or restrict accounts opened through a faulty process, and bear civil liability where faulty identification harms a customer. At the data level, leaking biometric data also triggers personal data protection sanctions and incident notification duties to the regulator and data subjects.
Frequently Asked Questions
What are the current legal rules for eKYC in fintech?
The current frame has three layers: Circular 17/2024/TT-NHNN as amended by Circular 25/2025/TT-NHNN on electronic opening of payment accounts; Law on Anti-Money Laundering 14/2022/QH15 on customer identification duties of reporting entities; and Law on Personal Data Protection 91/2025/QH15 with Decree 356/2025/ND-CP for the biometric data arising in eKYC. The actor performing banking eKYC must be a licensed payment service provider.
Can eKYC replace face-to-face identification?
Yes, within the scope of electronically opened accounts: an electronic verification process using identity documents and biometric matching is accepted in place of a face-to-face meeting when opening the account. In exchange, eKYC accounts usually carry transaction limits, and the opening institution may require supplementary verification or an in-person meeting for higher-risk customers or limit upgrades.
How must eKYC data be stored?
eKYC data must be stored securely under both the banking frame and the personal data protection frame: biometric data is sensitive data, may only be processed for customer identification and anti-money laundering purposes, needs proportionate security measures and a retention period tied to the service relationship and customer file archiving duties. Sharing eKYC data with third parties outside the defined purpose is prohibited.
What are the penalties for eKYC violations?
Fines depend on the violation layer: breaches of account opening and usage process draw administrative fines in the monetary and banking sector under the current penalty decree, plus remedies such as closing wrongly opened accounts; personal data breaches, especially biometric leaks, are handled under the data protection frame. For repeat or systemic offenders, the largest risk is restriction of payment service operations rather than the fine alone.
Bottom line for fintech product teams
eKYC in Vietnam is a licensed actor’s legal process, not a technology feature to buy off the shelf. A fintech wanting eKYC must either become a licensed payment intermediary or integrate through a bank partner, and in both cases must design biometric data storage to sensitive-data standards from day one.
Related articles
- Total Cost of Setting Up a Manufacturing FDI Company: Sample Budget
- First-Year Office/Headquarters Rent for an FDI Company
- First-Year Costs: Digital Signature, E-Invoices and Accounting Software
- ICA Account Opening and First-Year Bank Fees
- Translation, Notarization and Legalization Costs for FDI Dossiers
This legal analysis has been verified against current Vietnamese regulations and cross-border FDI transaction practices by the attorneys at FLAT LAW FIRM.
