Decree 94/2025/ND-CP on the controlled testing mechanism in the banking sector, effective from 1 July 2025, is the first official door for a fintech solution without a full licensing framework to be tested with real clients in Vietnam. For a foreign fintech that door does not open directly: the enterprise participates through cooperation with a credit institution in Vietnam. This article explains how that cooperation model works, how pilot limits on client numbers and transaction values are decided inside each file approval decision rather than by one common hard cap, how liability is split between the fintech and the partner bank when an incident occurs, and which side controls the client data generated during testing.
The cooperation model: the bank is the gateway and the accountable party before the regulator
Decree 94/2025/ND-CP defines sandbox participants as credit institutions, foreign bank branches and fintech companies. For a foreign fintech with no licensed presence in Vietnam, the practical route is partnering with a domestic commercial bank or credit institution: the two sides jointly build the solution testing file, with the partner bank as the liaison to the State Bank of Vietnam and the named party in the testing approval decision.
The cooperation contract must therefore be drafted as a regulatory risk allocation contract, not merely a technology purchase: it allocates who designs the algorithm and answers for model correctness, who makes the final decision on each client, who stores the data and who responds to the regulator on explanation demand. The foreign fintech must also prepare for data and operations presence in Vietnam within the testing scope, and undertake not to reach Vietnamese clients outside the partner bank channel during testing.
Pilot limits: no common hard cap, every limit sits in the per-file approval decision
The most-asked sandbox question is how many clients and how much transaction value are allowed, and the correct answer under Decree 94/2025/ND-CP is that the decree sets no common hard cap for all files. The testing scope covering participating client numbers, transaction value and frequency, territory and duration is decided by the State Bank of Vietnam in the testing approval decision of each file, based on the solution risk level and the participant governance capability.
Duration carries the decree level single hard limit: a maximum of two years for one solution, and this is the milestone the enterprise must use to design its commercialisation or wind-down path. During testing the participant must report periodically and on incidents to the State Bank, follow the approved risk management and client protection plan, and not expand scope beyond the approval decision without consent.
Liability on incidents and control of testing client data
When an incident occurs during testing, for example the fintech scoring model misclassifies and a client is wrongly declined or a platform fault exposes data, liability toward clients and the regulator splits into two layers. On the outer layer, toward clients and the State Bank, the bank named in the testing approval decision bears primary responsibility for safe testing organisation and client remediation, because clients joined the test on trust in the bank. On the inner layer, between the partners, the cooperation contract reallocates by incident source: algorithm and platform faults sit with the fintech together with indemnity and remediation support duties, while channel operation and client communication faults sit with the bank.
Client data generated during testing is governed simultaneously by the current personal data protection framework and the approval decision conditions. On allocation principle, the partner bank is the data controller in the client relationship because clients contract and consent on the bank channel, while the foreign fintech processes data as an authorised processor within the approved testing purpose. The practical consequences include: the fintech may not use testing data to train models for another market or any purpose outside the testing file, may not transfer data abroad beyond the approval decision and contract permission, and must delete or return data when testing ends under the committed plan.
Frequently Asked Questions
How does a foreign fintech join the Vietnamese banking sandbox through cooperation with a commercial bank?
A foreign fintech joins through cooperation with a credit institution or commercial bank in Vietnam under Decree 94/2025/ND-CP: the two sides jointly build the solution file, and the partner bank liaises with the State Bank of Vietnam and is named in the testing approval decision. Common models are the bank distributing the fintech solution to its clients, embedding fintech technology into a client-facing process, or co-development where the fintech supplies the platform and the bank supplies payment infrastructure and the compliance channel. The fintech undertakes not to reach Vietnamese clients outside the partner bank channel during testing.
What are the pilot limits on client numbers and transaction values in the sandbox?
Decree 94/2025/ND-CP sets no common hard cap on client numbers or transaction values for all files. The testing scope covering client numbers, transaction value and frequency and territory is decided by the State Bank in the approval decision of each file according to the solution risk, so two solutions receive two different limit sets. The single decree-level hard limit is a maximum testing duration of two years. An enterprise should not trust any advertised general sandbox quota figure, and must design its testing plan on the actual limit set inside its own approval decision.
How is liability split between the foreign fintech and the partner bank when an incident occurs?
Liability splits into two layers: toward clients and the State Bank, the partner bank named in the approval decision bears primary responsibility for safe testing organisation and remediation; between the partners, the cooperation contract allocates by incident source, with algorithm and platform faults on the fintech side plus indemnity, and channel operation and communication faults on the bank side. The contract should carry a fast-trigger client compensation mechanism that does not wait for final fault determination. This split must be written into the cooperation contract from the start, not negotiated after an incident occurs.
Which party controls client data during testing?
Client data in testing is controlled by the partner bank in the client relationship, because clients contract on the bank channel; the foreign fintech is a data processor acting on authorisation within the approved testing purpose. Consequently the fintech may not use testing data for purposes outside the file, including training models for another market, may not transfer data abroad beyond the approval decision and contract permission, and must delete or return data when testing ends under the committed plan. The whole allocation sits under the current personal data protection framework and must be settled in the cooperation contract before filing.
FLAT Law Firm structures the sandbox cooperation file between the foreign fintech and the partner bank
A successful sandbox file is decided by the quality of the cooperation contract behind it: the State Bank approves a risk governance mechanism, not merely a technology. FLAT Law Firm drafts the cooperation contract splitting incident liability and data rights between the foreign fintech and the Vietnamese bank, tests the intended testing scope against Decree 94/2025/ND-CP, and prepares the client-protecting testing exit plan for all three post-two-year scenarios. Foreign fintechs seeking a partner bank, or banks vetting a fintech, may contact the firm to structure the file before the first working round with the State Bank.
