Scenario: A Singapore investor wants to establish a company in Vietnam to provide network-based telecommunications services — building base stations and offering mobile services to domestic subscribers. Legal counsel warns this is a “sensitive” sector: the project may face a security appraisal, and foreign ownership is capped. The investor asks: what does the security appraisal for a telecom project cover, what are the capital limits, and what should be prepared from the start to avoid getting stuck at the appraisal gate?
Service classification: not all telecom services are restricted alike
The Telecommunications Law No. 24/2023/QH15 took effect on 1 July 2024 (with provisions on data center services, cloud computing services and basic Internet-based telecommunications services effective from 1 January 2025) and drew an important line. Under Articles 28 and 29 of this law, enterprises providing basic Internet-based telecommunications services, data center services and cloud computing services may invest and do business without any limit on the foreign investor’s share or capital contribution ratio. In other words, for the “over-the-Internet” and digital infrastructure segment, Vietnam has fully opened foreign ownership ratios.
By contrast, network-based telecommunications services — building, owning and operating physical networks as in the scenario — remain tightly controlled. Foreign investors must satisfy market-access conditions under the List of sectors with restricted market access for foreign investors (Law on Investment No. 143/2025/QH15, Article 8) and Vietnam’s international commitments. This article states no specific percentage figure, because the cap depends on each service type and the international commitments in force at the time of investment — investors must consult the updated list rather than mechanically applying figures from an earlier period.
The investment gate: in-principle approval by the Prime Minister
The Law on Investment No. 143/2025/QH15 was passed on 11 December 2025, effective 1 March 2026, replacing the Law on Investment No. 61/2020/QH14 (expired 1 March 2026). Under Clause 7, Article 24 of this law, investment projects of foreign investors in network-based telecommunications services fall within the cases requiring in-principle investment approval; and under Point a, Clause 2, Article 25, the approving authority is the Prime Minister. This is the highest approval tier, reflecting the sector’s sensitivity.
During appraisal of the approval dossier, ministries and ministerial-level agencies participate in appraisal within their functions and are responsible for appraisal contents under their management. On the defense–security coordination mechanism, one may refer to the Regulation issued by the Hanoi People’s Committee in Decision No. 144/2026/QD-UBND dated 13 October 2026: it governs the solicitation and provision of opinions on national defense and security conditions for socio-economic development projects, firmly refusing licensing where a project harms national defense and security. Investors should understand this is a substantive appraisal, not a formality.
What does the security appraisal cover?
At the level of legal principle — without venturing into state agencies’ internal procedures — the security appraisal of a foreign-invested telecom project revolves around three pillars. First, the Law on Cybersecurity No. 24/2018/QH14 (effective 1 January 2019; note the correct code is QH14 — the XIVth National Assembly — not QH15): it requires protection of information systems critical to national security, of which telecommunications infrastructure is a core component. Second, Decree No. 53/2022/ND-CP dated 15 August 2022 (effective 1 October 2022) details several articles of the Law on Cybersecurity: coordinated appraisal, assessment, inspection, supervision, incident response and remediation for information systems critical to national security; it also implements the requirements to store data in Vietnam and establish a commercial presence under Articles 26 and 27 of the Law on Cybersecurity. Third, the duty to ensure the safety of telecommunications infrastructure under the 2023 Telecommunications Law, including compliance with technical and network-safety requirements set by regulators.
In practice, the investor will be asked to provide information on ownership structure, capital origin, technologies and equipment used, information-security assurance plans, and commitments to comply with Vietnamese cybersecurity law. The depth of appraisal depends on the infrastructure scale, coverage scope and each project’s national-security implications.
Sanctions and four things to prepare from the start
The heaviest sanction sits in Clause 3, Article 35 of the Law on Investment 143/2025/QH15: the Prime Minister decides to suspend or partially suspend an investment project where its implementation causes or risks causing harm to national defense, national security or the environment. To avoid this, investors should do four things at the preparation stage: first, precisely identify the service type (network-based vs. Internet-only) to know whether they face ownership caps or full opening; second, consult the current restricted market-access list and relevant international commitments; third, prepare a complete in-principle approval dossier, including a network safety and security assurance plan; fourth, proactively cooperate in providing information to appraising agencies instead of waiting for repeated supplementation requests.
Frequently asked questions
Providing only OTT or cloud services, without building network infrastructure — is in-principle approval still required?
No, this does not fall under Clause 7, Article 24 of the Law on Investment 143/2025/QH15, which applies only to “network-based telecommunications services.” The enterprise must still fully meet telecom business conditions and cybersecurity duties under Decree 53/2022/ND-CP.
Can a foreign investor hold 100% of a telecom company?
For basic Internet-based telecom services, data centers and cloud computing: yes, the law imposes no foreign ownership ratio limit (Articles 28 and 29 of the 2023 Telecommunications Law). For network-based telecom services: ownership is capped under international treaties and the restricted market-access list — check the current instruments; do not apply figures from an earlier period.
Must Vietnamese users’ data be stored in Vietnam?
Under Decree 53/2022/ND-CP guiding Article 26 of the Law on Cybersecurity, enterprises falling within its scope must store data in Vietnam and establish a commercial presence. Each enterprise should check the decree’s criteria to determine whether it falls within scope, rather than assuming either way.
What happens if a project is assessed as a security risk?
At the approval stage, the project may be denied in-principle investment approval. For an operating project, the Prime Minister may suspend or partially suspend operations under Clause 3, Article 35 of the Law on Investment 143/2025/QH15 where implementation causes or risks harming national defense or national security.
