Real-world scenario: An OSAT shop in Bac Ninh has just invested in a packaging line for automotive power-control chips. They ask: “To win orders from a German fabless firm, what certifications do we need — is it like getting CE for consumer electronics?”
The answer surprises many: the OSAT industry has almost no “mandatory state certification” of the BIS or TISI kind. No authority issues a “chip packaging licence” to hang on the wall. Instead, “certification” here means supplier qualification run by each customer — the fabless company sends an audit team to assess your quality system, and only on passing do you enter the approved vendor list (AVL). Comparing Vietnam vs Malaysia for OSAT is therefore not about comparing certification laws, but about comparing the environment for passing those audits: cleanroom infrastructure, qualified material supply chains, and the cluster’s accumulated credibility.
Legal position updated to 18 October 2026. Malaysia content is framework-level.
Three real “certification” layers in OSAT
Layer 1 — Quality management systems (the foundation). ISO 9001 is the minimum ticket — nearly every fabless RFQ requires it. For automotive chains: IATF 16949 is a practical must; for medical/aerospace: ISO 13485/AS9100 respectively. Plus ISO 14001 (environment) and ISO 45001 (occupational safety) — large customers assess all three pillars. These certificates come from independent certification bodies, are valid globally, and do not distinguish a plant in Vietnam from one in Malaysia — but the cost and time to earn them differ.
Layer 2 — Customer audits (the decider). This is the real “certification”. A fabless audit team typically assesses: cleanroom contamination control (ISO 14644 classification), electrostatic discharge control (ESD S20.20), physical and information security (chips are IP assets — some firms require segregated production areas, cameras, multi-layer access control), lot traceability, process change management (PCN — process change notification: you may not change materials or processes without telling the customer), and the business continuity plan (BCP). Pass the audit → enter the AVL → receive trial orders → meet the committed yield → full orders. This cycle typically takes 6–12 months.
Layer 3 — Local legal compliance (the precondition). The part that is “same in nature, different in detail” between the two countries: environmental licences (OSAT uses chemicals with special wastewater), fire approval for cleanrooms, work permits for foreign specialists, and import/export controls where products are controlled. Fail this layer and you cannot operate — but passing it wins no orders either.
Vietnam vs Malaysia: the difference is the audit “playing field”
Because ISO certificates are global and audits are customer-run, the Vietnam–Malaysia difference lies in the cost and speed of clearing the three layers:
Layer 1 (system certificates): international certification bodies operate in both countries. The practical difference: in Malaysia, the ISO/IATF consulting and training ecosystem for semiconductors has matured over decades, and it is easy to find consultants who have worked in OSAT; in Vietnam, deep semiconductor consulting capacity is thinner — companies often invite foreign experts or build internal capability, costing more time the first time around.
Layer 2 (customer audits): this is where Malaysia (Penang) holds its clearest historical advantage — major fabless firms have audited dozens of shops there, the audit process runs smoothly, and more importantly, customer A’s audit result is a trusted reference for customer B. A Vietnam shop must prove itself from scratch with each customer; but once inside the AVL of two or three majors, that credibility record carries global value regardless of location.
Layer 3 (local compliance): Vietnam — environmental licence, fire approval, IRC under Investment Law 143/2025/QH15, specialist work permits under Decree 219/2025/ND-CP; Malaysia — the equivalent under local law (local counsel needed). Plan for it: the time to obtain these permits stacks onto the 6–12-month qualification cycle — do not finish building the plant before starting the environmental licence application.
A 12-month roadmap: from greenfield plant to first order
Months 1–3: complete the quality-system documentation (quality manual, procedures, forms) to ISO 9001; apply for local operating permits in parallel; contract the certification body.
Months 4–6: ISO 9001 certification assessment (and IATF 16949 if targeting automotive — note IATF requires 12 months of operating data, so schedule early); complete ESD controls and cleanroom classification; build the lot traceability system.
Months 7–9: invite 1–2 target customers for pilot audits; close non-conformities; run pilot lots and report yield.
Months 10–12: enter the AVL; receive the first commercial orders at ramping volumes. The rule: never promise a yield you have not measured on your own line — miss one yield commitment to a fabless customer and it takes two years to rebuild trust.
Customer-audit readiness checklist
- ISO 9001 certificate (minimum) in force; IATF 16949 in progress if serving automotive.
- Cleanroom at the required classification, with periodic measurement records (particle count, temperature, humidity).
- ESD S20.20 control programme with personnel training records.
- Security: segregated production zones, access control, cameras, personal-device rules.
- Traceability: from incoming wafer to outbound carton — traceable within 4 hours on customer request.
- PCN procedure: every material/process/supplier change notified and customer-approved in advance.
- Business continuity plan (BCP): power loss, cleanroom fire, key-material disruption — scenarios with drill records.
- An audit-facing team: one technical lead who speaks the customer’s “audit language”, bilingual documents ready.
OSAT shops in Vietnam needing to build a quality system that passes fabless customer audits, or reviewing local compliance duties for a semiconductor plant, can speak with our legal team.
Choosing a certification body and consultant
Not all certification bodies are equal for OSAT. When selecting one, verify three things: accreditation scope (the body must be accredited for ISO 9001 and, if needed, IATF 16949 — IATF has a separate oversight scheme and only recognised bodies may issue it), semiconductor experience of the assigned auditors (ask for CVs; an auditor who has only audited food packaging will miss cleanroom-specific risks), and language capability (audit reports your customers will read should be available in English). For consultants, prefer those who have guided at least one OSAT shop through a full customer qualification, not just ISO documentation — the gap between “having a quality manual” and “passing a fabless audit” is where consultants earn or waste your money. Agree on deliverables tied to milestones: documentation complete, certification achieved, pilot audit passed — not open-ended day rates.
Frequently asked questions
1. Is there any state-issued “OSAT licence”?
No. There is no state licence to practise chip packaging/testing akin to a telecom licence or BIS certification. “Certification” in this industry means system certificates (ISO/IATF) plus supplier approval from each customer.
2. Is ISO 9001 enough to win OSAT orders?
Enough to get invited for an audit, not enough for large orders. Customers decide on the actual audit plus pilot-lot results plus yield. For automotive chains, IATF 16949 is nearly a precondition.
3. After failing an audit, how soon can we be re-audited?
Typically 3–6 months after closing major non-conformities, depending on each firm’s policy. So prepare the first audit as if there were no second chance.
4. What is PCN and why does every fabless ask about it?
Process Change Notification. Fabless firms require you not to change materials, suppliers or process parameters without prior notice and approval, because every change can affect chip yield and reliability. PCN violations are a common reason for AVL removal.
5. Does a Vietnam plant face any audit disadvantage versus Malaysia?
The main disadvantage is the lack of an accumulated credibility record — proving from scratch with each customer — plus thinner local deep-semiconductor consulting. Once inside a few majors’ AVLs, though, that reputation carries global value.
6. What should an OSAT BCP cover?
At minimum: power loss/dip scenarios (UPS + generators + safe line shutdown/startup sequences), cleanroom fire, key-material disruption (backup suppliers pre-approved by customers), and cybersecurity (customer yield data and chip designs). Periodic drills with minutes — every audit asks for drill records.
This article has been quality-reviewed by the FLAW AI Legal Council