Notes from Việt Nam on law, technology, languages, history, culture and travel.

Your Credit File Needs Your Say-So: New CIC Consent Rules Start on 1 November

Every loan, credit card and overdue payment held by a Vietnamese bank ends up in one place: the database of the Trung tâm Thông tin tín dụng Quốc gia Việt Nam (National Credit Information Centre, CIC), run by the State Bank of Vietnam (SBV). Banks pull reports from it before lending. So, increasingly, do non-bank lenders, debt buyers and pawn businesses that join CIC as “voluntary organisations”. Thông tư 46/2026/TT-NHNN, which takes effect next Sunday, 1 November 2026, tightens the consent rules for this flow of data. It brings them closer to the Luật Bảo vệ dữ liệu cá nhân (Personal Data Protection Law, 91/2025/QH15), in force since 1 January 2026. It also adds rules for the new international financial centre and drops some outdated reporting timetables.

The document

  • Number and title: Thông tư 46/2026/TT-NHNN, “Sửa đổi, bổ sung một số điều của Thông tư số 15/2023/TT-NHNN quy định về hoạt động thông tin tín dụng của Ngân hàng Nhà nước Việt Nam” (amending Circular 15/2023 on the SBV’s credit information activities).
  • Issuer and signer: State Bank of Vietnam. Signed for the Governor by Deputy Governor Đoàn Thái Sơn, on the proposal of the head of the Department of Credit Institution System Safety (Cục An toàn hệ thống các tổ chức tín dụng).
  • Signed: 9 September 2026.
  • Effective: 1 November 2026.
  • Size: 12 articles, 4 pages, no transition period.
  • What it amends: Thông tư 15/2023/TT-NHNN (dated 5 December 2023, in force since 1 January 2025). On 22 September 2026 the SBV published a consolidated text, 104/2026/VBHN-TT-NHNN, which is the easiest way to read the rules as they will stand.

What changes

1. Explicit consent before CIC shares your data outward (Article 12). The old Article 12(6) said only that organisations outside the listed categories needed the borrower’s consent to use CIC services. The new Article 12(7) is wider. CIC may provide a borrower’s credit information to three groups only with that borrower’s consent:

  • voluntary organisations (development and credit guarantee funds, microfinance programmes, debt-trading and asset-management companies, consumer lenders, leasing, instalment-sale and pawn businesses);
  • foreign credit information organisations; and
  • “other organisations (if any)”.

The consent standard also goes up. Before, consent only had to exist “in a format that can be printed or copied”, including electronic or verifiable formats. Now it must be expressed “by a clear, specific method” that can be printed or copied, including electronic or verifiable formats. That wording follows the PDPL’s idea of consent: specific, unambiguous and provable. Licensed banks drawing reports under their contracts with CIC (Article 12(3)) are not on this list.

2. Consent at the inbound end too (Article 17). Voluntary organisations already had to “ensure the borrower’s consent” before reporting a debt to CIC. The amended Article 17(1) ties that duty to both this Circular and the personal data protection law, and applies the same “clear, specific, printable or verifiable” standard. For a fintech lender or a pawn chain, that means the consent clause in its onboarding flow must be capable of standing up as evidence.

3. One reporting schedule (Article 10). Previously the Bank for Social Policies reported twice a month, and people’s credit funds and microfinance institutions reported monthly. Those carve-outs are gone. All credit institutions now report at the frequency set in the SBV Governor’s decision on the credit information indicator system. Voluntary organisations report at the frequency agreed in their contracts with CIC.

4. Data, not files (Article 9(3)). The old text required reporting “in the form of electronic data files”. The new text says “in the form of electronic data”. Paper is still allowed only as a fallback agreed with CIC. The wording no longer ties reporting to file batches.

5. Foreign borrowers’ accounts (Article 9(1)(i)). For a borrower that is a foreign organisation, banks may report annual financial statements prepared under International Financial Reporting Standards or the accounting standards of its home country. Vietnamese companies still use statements filed with the tax authority or audited statements.

6. The international financial centre. A new Article 3(3a) defines “member banks” as banks and foreign bank branches set up under Nghị quyết 222/2025/QH15 and Nghị định 329/2025/NĐ-CP, the legal framework for the International Financial Centre in Việt Nam. Related persons of their borrowers are determined under Decree 329, not the Law on Credit Institutions. CIC becomes the contact point for sharing data with the centre’s supervisors (new Article 14(7a)). Credit-information inspections at member banks follow the centre’s own inspection rules (Article 15(3a)).

7. Housekeeping. References follow the 2025 restructuring. “Provincial SBV branches” become “SBV regional branches”, the banking inspectorate becomes “the SBV Inspectorate”, and foreign bank branches must be “established and operating in Việt Nam”. The purpose clause also separates two goals: supporting the safety of credit institutions and supporting the business of voluntary organisations.

Who is affected

  • Borrowers. Your CIC record cannot lawfully go to a debt buyer, a consumer-finance partner outside the banking system or a foreign bureau without consent you can later see on paper or on screen. Your free annual self-check of your own CIC report (Article 18) is unchanged.
  • Non-bank lenders and fintechs that are CIC voluntary members. Expect contract amendments from CIC, and review consent screens. A pre-ticked box or a general clause in the terms and conditions is hard to defend as “clear, specific” consent.
  • Banks. The main work is operational: adopting the single reporting frequency and the IFRS option for foreign borrowers. Member banks in the financial centre come under a separate inspection track.
  • People’s credit funds, microfinance institutions and the Bank for Social Policies lose their fixed schedules and move to whatever the indicator-system decision sets.

Open questions

  • “Other organisations (if any)”. The circular does not say who they could be. The phrase leaves room for future data sharing, perhaps with insurers or e-commerce platforms, but gives no list.
  • Withdrawal. The PDPL lets a data subject withdraw consent. The circular does not say what happens to data already shared with a voluntary organisation when a borrower does.
  • No grace period. Article 11 brings everything into force on 1 November with no transition clause for existing contracts or consents gathered under the looser standard. How CIC treats old consents will show up only in practice.
  • The reporting frequency now depends entirely on the Governor’s indicator-system decision, which is not part of this circular.

Sources

This post is general information, not legal advice.