Fifteen months ago Việt Nam opened its first regulatory sandbox for banking technology. The base text is Nghị định 94/2025/NĐ-CP, which took effect on 1 July 2025. It lets banks and fintech companies test three kinds of product under State Bank supervision: credit scoring, data sharing through open application programming interfaces (Open API), and peer-to-peer (P2P) lending. On 6 October 2026 the Government amended that decree. Nghị định 382/2026/NĐ-CP does not add new products to the sandbox. It changes who can get in, which papers they have to file and how long the State Bank may take to answer. For a fintech start-up thinking about applying, those are the rules that matter most.
The document
- Number: Nghị định 382/2026/NĐ-CP, amending Nghị định 94/2025/NĐ-CP of 29 April 2025 on the controlled testing mechanism (Cơ chế thử nghiệm có kiểm soát) in banking.
- Signed: 6 October 2026, by Deputy Prime Minister Nguyễn Văn Thắng on behalf of the Government, on the proposal of the Governor of the State Bank of Vietnam.
- Effective: 6 October 2026, the day it was signed (Điều 13).
- Size: 14 articles. It also replaces Phụ lục I (the application and decision forms) of the 2025 decree.
- Legal bases now include the banking-law amendment Luật 23/2026/QH16, which this blog covered in September.
Điều 13 also says that six provisions on this sandbox in Nghị quyết 24/2026/NQ-CP (29 April 2026) lapse from the same day. That resolution was the Government’s broad package of cuts to administrative procedures and business conditions. Its sandbox items are now written into the decree itself, so the 2025 decree as amended is once again the single rulebook.
What changes
1. The fintech chief: a degree or experience. The 2025 text said the legal representative and general director of a fintech company had to hold a university degree in economics, business administration, law or IT and have at least two years as a manager in finance or banking. The new Điều 8 (for credit scoring and Open API) and Điều 11 (for P2P lending) change “and” to “or”. The list of degrees also grows to include finance, banking, accounting and auditing. Management experience now counts if it was gained in finance, banking, payment intermediation or IT. A founder with an IT degree and no time at a bank now qualifies, and so does a veteran payments manager without a relevant degree. The ban on persons legally barred from management stays in place.
2. Thinner application files.
- The board or shareholder resolution approving the proposal (Điều 9 k3 and Điều 12 k3) is abolished.
- The personnel file for credit-scoring and Open API applicants used to cover the deputy general directors and “key staff” running the test. It now covers only the legal representative and general director.
- For P2P lenders, the criminal-record certificate (Phiếu lý lịch tư pháp) no longer has to be submitted, and the company charter (Điều lệ) is no longer listed.
- In return, the proposal must now include a technical description of the information system, showing that it meets the information-system security requirements for its classification level.
3. The State Bank looks things up itself. A new Điều 7 k6 requires the State Bank to pull documents that already sit in national or sector databases. That covers criminal records, degrees and certificates, enterprise registration and investment registration. The applicant has to supply a document only when the database query fails or returns incomplete or inaccurate data. Applicants can file by public postal service, through a courier or authorised agent, in person at the State Bank’s one-stop desk, or online on the National Public Service Portal. The separate State Bank e-service portal is no longer named.
4. Different deadlines. The 2025 text counted its deadlines in working days. Most of the new ones are written simply as “ngày” (days):
| Step | Nghị định 94/2025 (original) | Nghị định 382/2026 |
|---|---|---|
| Review of a credit scoring / Open API application | 90 working days | 80 days |
| Review of a P2P lending application | 90 working days | 90 days |
| Ministries’ comments on an application | 15 working days | 20 days |
| Applicant’s time to answer a request for clarification | 30 working days | 45 days |
| Notice before an on-site inspection | 3 working days | 5 days |
| Decision to adjust a solution under test | 30 working days | 25 working days |
| Decision on an extension of the test period | 45 working days | 25 working days |
| Decision on voluntary exit / completion certificate | 30 working days | 25 working days |
| Ministries’ comments on adjustment, exit, extension, completion | 10–15 working days | 7 working days |
For the later stages (adjusting, extending, exiting or completing a test) the cuts are clear: the State Bank must answer in 25 working days, and other ministries get 7 working days to comment. At the application stage, applicants also get 45 days instead of 30 working days to answer the State Bank’s questions.
5. Wording and signatures. References to “an toàn thông tin mạng” (network information security) become “an ninh mạng” (cybersecurity), in line with the new Luật An ninh mạng. Reports and plans in Phụ lục IV, V and VI may now be signed digitally or electronically under the law on electronic transactions, instead of signed and stamped on paper. In Phụ lục II, the anti-money-laundering requirement is reworded as an obligation to adopt internal AML/CFT rules.
Who it affects
- Fintech start-ups planning to test credit scoring, Open API data sharing or P2P lending. The leadership condition was a real barrier for founders who came from tech rather than banking.
- Banks and foreign bank branches that partner with fintechs or run their own tests. They benefit from the shorter adjustment, extension and exit procedures.
- P2P lending companies, the most tightly controlled group in the sandbox. Their file gets lighter, but their review period stays at 90 days.
Transition
Điều 14 sets out three cases:
- If the State Bank had already confirmed an application as complete before 6 October 2026, the old deadlines and procedure still apply.
- For those same applications, however, the leadership condition is assessed under the new, looser rule.
- If an application was received but not yet confirmed as complete, its completeness is judged against the slimmed-down document list.
Open questions
- Days or working days? Most of the new application-stage deadlines are written simply as “ngày”. If they are read as calendar days, “80 days” is shorter than the old 90 working days (about 18 weeks). The “90 days” for P2P, on the other hand, would be a real cut, not a freeze. The decree does not define the term.
- No new products. The sandbox still covers only three solution types. Any fintech model outside credit scoring, Open API and P2P lending still has no sandbox route, and this amendment does not open one.
- Database coverage. Whether the State Bank can really pull degrees and criminal records depends on how complete those national databases are. Where the query fails, applicants will still be asked for paper.
Sources
- Văn bản Chính phủ: Nghị định 382/2026/NĐ-CP (metadata and signed PDF)
- Thời báo Ngân hàng: Sửa đổi một số quy định về Cơ chế thử nghiệm có kiểm soát trong lĩnh vực ngân hàng
- Báo Chính phủ: Sửa đổi một số quy định về Cơ chế thử nghiệm có kiểm soát trong lĩnh vực ngân hàng
- Báo Đấu thầu: Nới điều kiện, đơn giản hồ sơ tham gia cơ chế thử nghiệm Fintech
- LuatVietnam: Nghị định 94/2025/NĐ-CP (base text)
This post is general information, not legal advice.