Two months after the Government rebuilt the licensing regime for cybersecurity vendors, the Ministry of Finance has put a price list on it. Thông tư 152/2026/TT-BTC sets the fees (phí) and charges (lệ phí) for four procedures under the new cybersecurity law: the vendor business licence, conformity certification, the import permit for security products, and the sender name used in online advertising messages. Anyone who expected a price rise or a cut will find neither. Almost every figure is the same as in 2016. The changes are in which law the fees rest on, who collects them and when they are due.
What the document is
Thông tư 152/2026/TT-BTC “quy định mức thu, chế độ thu, nộp phí và lệ phí thuộc lĩnh vực an ninh mạng” was signed on 9 October 2026 by Deputy Minister of Finance Cao Anh Tuấn, on the proposal of the Director of the Department of Tax, Fee and Charge Policy. Under Điều 6 it takes effect on the day it was signed, 9 October 2026. The Government’s legal-documents portal published the signed copy on 13 October, and VTV and CafeF reported it the same day.
It is short: six articles plus a one-page schedule. Its legal bases include the Luật Phí và lệ phí 97/2015/QH13, the Luật Quản lý thuế 108/2025/QH15 and the Luật An ninh mạng 116/2025/QH15. It also cites Nghị định 91/2020/NĐ-CP on spam messages, emails and calls, and Nghị định 332/2026/NĐ-CP on cybersecurity products and services. Khoản 2 Điều 6 ends Thông tư 269/2016/TT-BTC, the 2016 circular that set the same fees for the “information security” (an toàn thông tin) field under the old 2015 law.
The fee schedule
| Item | Thông tư 152/2026 | Thông tư 269/2016 |
|---|---|---|
| Vendor licence, first issue or re-issue, one product/service type | 8,000,000 đ | 8,000,000 đ |
| — each additional type | 2,000,000 đ | 2,000,000 đ |
| Licence exchange: change of name or legal representative | 3,000,000 đ | 3,000,000 đ |
| Licence exchange: change of one product/service type | 3,000,000 đ | 3,000,000 đ |
| Licence exchange: add one type | 1,000,000 đ | 1,000,000 đ |
| Licence extension | 500,000 đ | 500,000 đ |
| Conformity certification (hợp quy), first time | 5,000,000 đ | 5,000,000 đ |
| Standards certification (hợp chuẩn), first time | 5,000,000 đ | 5,000,000 đ |
| Appraisal of a conformity/standards declaration | 100,000 đ | 100,000 đ |
| Import permit for a security product, first issue / re-issue | 200,000 / 100,000 đ | 200,000 / 100,000 đ |
| Advertising sender-name certificate, first issue / re-issue or extension | 200,000 / 100,000 đ | 200,000 / 100,000 đ |
A few lines were reworded to match the new procedures. The 2016 schedule priced a re-issue “when the licence expires” and a certification renewal “when it expires”. The 2026 schedule prices a plain “re-issue” and only first-time certification, with no renewal line. Licence changes now sit under “cấp đổi giấy phép” (licence exchange), the term Nghị định 332 uses. On the advertising side, the certificate is now for a “tên định danh người gửi” (sender identity name), not a “người dùng” (user) name. The separate 100,000 đ charge for amending a certificate’s content is gone, and “extension” has been added at the same price.
What actually changes
The legal basis. The 2016 fees were tied to the Luật An toàn thông tin mạng 2015 and to Bộ Thông tin và Truyền thông, whose Cục An toàn thông tin was named as the collector. That law stopped applying on 1 July 2026, when Luật An ninh mạng 116/2025 took over. Bộ Công an had already been handling the vendor and import licences since the 2025 ministry reorganisation. Since then the fee circular has pointed at a superseded law and at a body that no longer did the work. Thông tư 152 closes that gap. Điều 3 no longer names a department. The collector is simply “the competent state body” that appraises and grants each document.
When you pay. This is the change that matters most to applicants. Under Thông tư 269, the payer was the organisation or individual granted the licence or certificate. Under Điều 2 khoản 1 of Thông tư 152, the vendor-licence, certification and import-permit fees are owed when the application file is submitted. Only the advertising sender-name charge is still paid on grant (khoản 2). Khoản 3 Điều 6 applies the new rules to files lodged before 9 October whose fee had not yet been paid.
Where the money goes. Thông tư 269 let a collector on a cost-autonomy regime keep 90% of fee income. Điều 5 of the new circular sends 100% to the state budget, including any interest earned on the collection account. The collector’s costs are funded through its normal budget estimate. Payment and declaration follow Điều 3 of Nghị định 362/2025/NĐ-CP, the decree implementing the Luật Phí và lệ phí.
Who is affected
- Cybersecurity vendors that produce, sell or provide the products and services Nghị định 332 now licenses. That includes testing and assessment firms, SOC and monitoring providers, incident-response teams, and the newly listed IP-masking services and vulnerability-reporting platforms. A single-type licence costs 8 million đồng. A vendor applying for four types pays 8 + 3 × 2 = 14 million đồng.
- Importers of the security products listed by HS code in Phụ lục II of Nghị định 332. Under that decree the import permit is issued per shipment, so the 200,000 đ charge recurs with each shipment.
- Manufacturers and labs seeking cybersecurity conformity or standards certification.
- Advertisers and SMS or email marketing agents who register a sender name (“brandname”) to send advertising messages under Nghị định 91/2020.
Practical implications
Budget for the fee at submission, not at approval. A file that is rejected or withdrawn will probably have cost its fee already. The circular says nothing about refunds, and an appraisal fee pays for the appraisal whatever the outcome. If you have a file pending from before 9 October with the fee unpaid, expect to be asked for payment under Thông tư 152 at the same amount.
Re-check the fee references in internal procedures and client quotes. Many consultancies still cite Thông tư 269/2016 and “an toàn thông tin mạng”. Online procedure listings may still show the old “an toàn thông tin mạng” wording. The amounts are unchanged, but a fee receipt or tender document citing a repealed circular invites avoidable queries.
Open questions
- Export permits. Nghị định 332 introduced an export licence for certain cybersecurity products, but the schedule has no line for it. Either it is free or a fee will follow in another instrument. The circular does not say which.
- Certification renewal. The schedule prices only first-time certification. It is unclear whether renewing a certificate is free, charged as a first-time appraisal, or handled under a different procedure.
- Sender-name authority. Like the rest of the circular, the sender-name line refers to “the competent state body” without naming one. Businesses will need the guidance implementing Nghị định 91/2020 under the new law to know where to file and pay.
- Same-day effect. Like Nghị định 332, the circular took effect on its signing date, with no notice period, and the signed copy was published four days later. Fees charged in that window are governed only by the transition clause in khoản 3 Điều 6.
Sources
- Thông tư 152/2026/TT-BTC, signed text (PDF) — Cổng Thông tin điện tử Chính phủ
- Bộ Tài chính quy định mức thu phí, lệ phí trong lĩnh vực an ninh mạng — VTV
- Bộ Tài chính quy định mức thu phí, lệ phí trong lĩnh vực an ninh mạng — CafeF
- Đề xuất phí thẩm định an ninh mạng cao nhất 8 triệu đồng/lần (draft, 22/9/2026) — VnEconomy
- Thông tư 269/2016/TT-BTC, full text and fee schedule — LuatVietnam
This post is general information, not legal advice.