Context: A payment intermediary holds millions of users’ money in escrow accounts at banks; the independent audit is the mechanism by which the State Bank and partners trust that the money is actually still there.
Reading the Framework from the Source Texts
A payment intermediary’s audit duties have two layers. The first is the annual audit of financial statements by an approved independent audit firm, under the general accounting and audit regime founded on the Law on Independent Audit 67/2011/QH12. The second is payment-specific: licence-maintenance conditions under Decree 52/2024/ND-CP and State Bank rules require the organisation to demonstrate continuously its system safety, risk governance and payment-escrow account balances — matters usually examined through audits or thematic assessments when the State Bank inspects, not left until the annual audit cycle.
The scope of a ‘proper’ audit for a payment intermediary is therefore wider than an ordinary financial audit: beyond the financial statements, auditors and assessors must reconcile user funds in escrow accounts against internal ledgers, review top-up, withdrawal and refund processes, and check system access rights and configuration-change logs. The weakness most often found is not in the financial statements but in balance reconciliation: small discrepancies repeated over many days signal transaction-recording errors, and must be explained in the auditor’s management letter.
Practical Points Commonly Overlooked
The minimum frequency is one financial audit a year, but a prudent organisation reconciles escrow balances daily and reviews system safety quarterly. When the State Bank requests an ad-hoc report, an organisation with reconciliation data ready answers within hours; one that only ‘does the year-end audit’ takes weeks and creates unnecessary suspicion.
Concrete Steps for Those Involved
The steps below turn the analysis above into concrete work:
- First, test your own situation against this ground: A payment intermediary’s audit duties have two layers.
- Record the application point specific to this case instead of copying conclusions from another case: The second is payment-specific: licence-maintenance conditions under Decree 52/2024/ND-CP and State Bank rules require the organisation to demonstrate continuously its system safety, risk governance and payment-escrow account balances — matters usually examined through audits or thematic assessments when the State Bank inspects, not left until the annual audit cycle.
- Prepare the evidence and file relating to the following point before dealing with authorities or partners: The minimum frequency is one financial audit a year, but a prudent organisation reconciles escrow balances daily and reviews system safety quarterly. When the State Bank requests an ad-hoc report, an organisation with reconciliation data ready answers within hours; one that only ‘does the year-end audit’ takes weeks and creates unnecessary suspicion.
- Answer the question clients ask most directly with this conclusion, and keep it on file: Yes. A payment intermediary must have its annual financial statements independently audited, and is also subject to thematic checks of system safety and escrow balances when the State Bank inspects licence conditions under Decree 52/2024/ND-CP.
Frequently Asked Questions
Must a payment intermediary company undergo independent audits?
Yes. A payment intermediary must have its annual financial statements independently audited, and is also subject to thematic checks of system safety and escrow balances when the State Bank inspects licence conditions under Decree 52/2024/ND-CP.
What does the audit scope include?
Beyond financial statements, the substantive scope covers reconciling user funds in escrow accounts against ledgers, reviewing top-up/withdrawal/refund processes, system access rights and configuration-change logs. Auditing only the financial statements while skipping balance reconciliation misses the payment industry’s substantive requirement.
What is the penalty for not auditing?
Failing to audit or to maintain licence conditions can lead to administrative fines in the monetary and banking field, corrective measures by the State Bank, and at the severe end revocation of the payment-intermediary licence. The exact fine depends on the conduct and is fixed when the violation record is drawn up.
This article has been quality-reviewed by the FLAW AI Legal Council