Open banking is often presented in Vietnam as a technology trend about to become mandatory, but its actual legal status is far more modest: sharing banking data via APIs is currently one of three solutions tested inside the banking sandbox, not an API-opening duty imposed on every bank. A fintech wanting bank data connectivity must therefore go through the testing mechanism or bilateral partnerships with individual banks, inside a personal data protection framework that has just been upgraded.
Current legal status: testing, not a mandate
Decree 94/2025/ND-CP on the controlled testing mechanism in the banking sector, as amended by Decree 382/2026/ND-CP, lists data sharing via open application programming interfaces as one of three testable fintech solutions, alongside peer-to-peer lending and credit scoring. An organisation wanting to deploy this solution needs a sandbox participation certificate from the State Bank of Vietnam and must operate within the approved testing scope and period.
Outside the sandbox, current law imposes no general duty on banks to open APIs to third parties. Data connections existing in the market are mainly bilateral commercial partnerships between a bank and a partner, in which the bank keeps the right to decide data scope, technical conditions and to suspend the connection when risk appears. Any marketing claim that fintechs have a legal right to demand bank data under open banking law runs ahead of the present framework.
How customer data can be shared lawfully
Customer account and transaction data is simultaneously customer information protected under credit institution law and personal data under Law on Personal Data Protection 91/2025/QH15 with Decree 356/2025/ND-CP. API sharing therefore needs a lawful basis, first of all the customer’s clear consent for the exact data scope and purpose of use, with a consent withdrawal mechanism and access time limits.
On the legal-technical side, three documents are indispensable: a data sharing agreement between the bank and the fintech allocating responsibility when data is misused or leaked; a customer consent instrument designed to personal data standards; and a personal data processing impact assessment for the sharing activity. Missing any one of the three, an API connection may run technically while standing on no legal ground.
The practical conditions for a fintech to connect
The first route is joining the sandbox with an open API data sharing solution, suitable where the fintech wants to build account data aggregation as a stand-alone service. The second route is becoming a bank’s technology partner in an embedded banking model, where data flows only within that bank’s own services and the fintech does not act as an independent data recipient.
On both routes the bank appraises the fintech as a critical service provider: information security capacity, system audits, incident response plans and commitments not to use data beyond purpose. Fintechs should prepare this capability file like a mini licensing file, because in practice the bank’s connection decision matters more than any administrative procedure in this field today.
Frequently Asked Questions
What are the current regulations on open banking and API data sharing?
Open banking in Vietnam currently has only a testing frame: data sharing via open APIs is one of three fintech solutions in the banking sandbox under Decree 94/2025/ND-CP as amended by Decree 382/2026/ND-CP. There is no standing open banking regulation and no general API-opening duty for banks; connections outside the sandbox are bilateral commercial partnerships between banks and partners.
Are banks required to open APIs?
No, under current rules. Banks have no general legal duty to open APIs to third parties; opening a data connection is a decision inside an approved testing mechanism or in a commercial partnership the bank joins voluntarily. Banks must still protect customer information under credit institution law and may share only on a lawful basis, first of all customer consent.
How can customer data be shared lawfully?
Lawful sharing needs three elements: the customer’s clear consent for the exact data scope and purpose, which can be withdrawn; a data sharing agreement between the bank and the recipient allocating security and incident responsibilities clearly; and compliance with Law on Personal Data Protection 91/2025/QH15 and Decree 356/2025/ND-CP, including a data processing impact assessment for the sharing. Data may only be used for the consented purpose.
What conditions must a fintech meet to connect to bank APIs?
A fintech has two routes: join the banking sandbox with an open API data sharing solution under Decree 94/2025/ND-CP if it wants to provide an independent data service; or become a bank’s technology partner in an embedded services model. Both require information security and data governance capacity strong enough to pass appraisal by the State Bank or by the partner bank itself.
Bottom line for data fintechs
Open banking in Vietnam is at the controlled testing stage, not a statutory right of data access. A fintech doing this properly chooses the sandbox route or the bank partner route, and builds the consent, sharing agreement and data impact assessment file before writing the first line of connection code.