Thông tư 18/2024/TT-NHNN quy định về hoạt động thẻ ngân hàng do Thống đốc Ngân hàng Nhà nước Việt Nam ban hành

CIRCULAR

ON BANK CARD OPERATIONS

Pursuant to the Law on State Bank of Vietnam dated June 16, 2010;

Pursuant to the Law on Credit Institutions dated January 18, 2024;

Pursuant to Decree No. 102/2022/ND-CP dated February 12, 2022 of the Government on function, tasks, powers and organizational structures of the SBV;

Pursuant to Decree No. 52/2024/ND-CP dated May 15, 2024 of the Government on non-cash payments;

At the request of the Director of the Payment Department;

The Governor of the State Bank of Vietnam hereby promulgates a Circular on bank card operations.

...

...

...

GENERAL PROVISIONS

Article 1. Scope

This Circular provides for operations relating to bank cards (hereinafter referred to as "cards"), including: issuance, use, payment, switching, electronic clearing and settlement of card transactions.

Article 2. Regulated entities

1. Card issuers.

2. Acquirers

3. Intermediary payment service providers.

4. Merchants.

5. Cardholders.

...

...

...

Article 3. Interpretation of terms

For the purposes of this Circular, these terms below shall be construed as follows:

1. “Bank card” means a payment instrument issued by a card-issuer for conducting card transactions under the conditions and terms agreed upon by the involved parties.

2. “Debit card” means a card that authorizes its holder to conduct card transactions within the amount of money available and overdraft limit (if any) on the payment deposit account of the cardholder opened at a card issuer.

3. “Credit card” means a card that authorizes its holder to conduct card transactions within the credit limit granted under the agreement with the card issuer.

4. “Prepaid card” means a card that authorize its holder to conduct card transactions within the value limit deposited to the card corresponding to the amount of money already prepaid by its holder to the card issuer.

Prepaid cards include:  Identified prepaid card (identifying the cardholder) and anonymous prepaid card (not identifying the cardholder).

5. “Co-branded card” means a card that bears both brand names of a switching company in Vietnam and an international card association or a switching company of another nation.

6. “Physical card” means a card with physical existence, usually made of plastic, fitted with an electronic chip to store card data, with information thereon complying with Article 11 hereof.

...

...

...

8. “Card transaction” means the use of a card to make a payment, to withdraw cash and to get other services provided by the card issuer and card acquirer according to the law.

9. “fictitious transaction at a merchant” means the use of a card to pay for goods or services without actual occurrence of any sale of goods or provision of services.

10. “Domestic card-present transaction” means a card transaction where the card is issued by a card issuer in Vietnam and is used to perform card transactions at an automated teller machine (“ATM”) or via a point-of-sale terminal (“POS terminal”) in Vietnam.

11. “Fake card” means a card which is not issued by a card issuer but contains information of genuine card and its holder.

12. “Fraudulent card transaction” means a transaction where a fake card is used or where a valid card is unlawfully used.

13. “Cardholder” means an individual or organization that is authorized to use a card issued by a card issuer, including principal cardholder and supplementary cardholder.

14. “Principal cardholder” means an individual or organization whose name appears on the card issuance and use contract concluded with a card issuer.

15. “Supplementary cardholder” means an individual who uses a card with authorization from the principal cardholder that has committed in writing to fulfill all obligations arising from the card issuance and use contract.

16. “Card issuer” means a credit institution or a foreign bank branch (FBB) that is licensed to issue cards as prescribed in clause 1 Article 8 of this Circular.

...

...

...

18. “intermediary payment service provider” includes: Switching companies; clearing companies and intermediary payment service providers that cooperate with acquirers.

19. “Switching company” means an intermediary payment service provider that carries out switching of card transactions for card issuers, acquirers, intermediary payment service providers cooperating with acquirers, international card associations and merchants under written agreements between involved parties.

20. “Clearing company” means an intermediary payment service provider that makes clearing of financial liabilities arising from card transactions for card issuers, acquirers, intermediary payment service providers cooperating with acquirers, international card associations and merchants under written agreements between involved parties.

21. “Merchant” means a unit that accepts card payment (acceptor) as a form of payment for goods and services.

22. “International card association” means an organization which is established and operating in a foreign country under such country's regulations and law, and has agreements concluded with card issuers, acquirers, switching companies and/or other involved parties on cooperation in terms of bank card operations (for cards bearing BINs granted by the international card association or cards bearing BINs of other countries) in accordance with Vietnamese law and international commitments.

23. “Personal Identification Number” (PIN for short) means a numeric password which is granted by a card issuer to a cardholder or made by a cardholder according to the process regulated by the card issuer for use in card transactions.

24. “Point-of-sale terminals including Point of Sale (POS for short), Mobile Point of Sale (mPOS for short) and other POSs, are card readers and terminals that are installed and used at merchants and allow cardholders to use cards to make payments of goods and services. A POS may be installed at a branch or transaction office of an acquirer to provide cash for cardholders as agreed upon between the acquirer and the card issuer in accordance with the uses of the card as prescribed in this Circular.

25. “Automated Teller Machine (ATM)” means a device which can be used by cardholders to: make deposit or withdrawal of cash, money transfer, bill payment, account inquiry, PIN change, card information inquiry or use other services as prescribed by law.

26. “Bank Identification Number - BIN” means a numeric code, including types of BIN as follows: BINs identifying card issuers in accordance with the regulations of the State Bank of Vietnam (hereinafter referred to as the SBV) stated in the Regulations on issuance, use and management of BINs; BINs issued by International card associations; and BINs issued by other countries. In case a card has a BIN issued by an international card association or a card has a BIN issued by another country, the issuance, use and management of the BIN shall be carried out in accordance with the regulations of the international card association or the country where the BIN is issued.

...

...

...

28. “Card payment contract” means a written agreement on acceptance of payment for goods and services by cards concluded by an acquirer and a merchant or an international card association, intermediary payment service provider (if any).

29. “Basic standards for domestic chip cards” are the set of basic standards TCCS 01:2018/NHNNVN on Technical requirements for domestic payment cards with contact-based chip technology in Vietnam and TCCS 02:2018/NHNNVN on Technical requirements for domestic payment cards with contactless chip technology in Vietnam announced by the Governor of the SBV according to Decision No. 1927/QD-NHNN dated October 5, 2018 and its amendments or replacements (if any).

Article 4. Card currency

1. On Vietnamese territory:

a) Cash withdrawal by cards must be made in Vietnamese dong;

b) For other card transactions:

(i) Transaction currency is Vietnamese dong. In case where foreign exchange is permitted for a transaction as prescribed by law on foreign exchange management, the transaction currency will be Vietnamese dong or Vietnamese dong and foreign currency;

(ii) Currency of payment is Vietnamese dong. Merchants are required to accept payments only in Vietnamese dong made by acquirers;

c) In case of conversion into Vietnamese dong from a foreign currency, the exchange rate between Vietnamese dong and such foreign currency shall be agreed upon the involved parties in accordance with regulations of the SBV.

...

...

...

When a card transaction is conducted outside Vietnamese territory, the cardholder must make a payment in Vietnamese dong to the card issuer according to the exchange rate agreed upon by the parties in accordance with regulations of the SBV.

Article 5. Card fees

1. Only card issuer is permitted to collect fees from cardholders according to the announced schedule of card fees of the card issuer, provided that:

a) The schedule of card fees must specify fee types and fee rates applicable to each card type and card service.

b) The schedule of card fees of the card issuer must comply with regulations of law, be posted publicly and provided for cardholders before its application and upon any change to this schedule;

c) Forms and time limits of notification and supply of information on fees for cardholders must be specified in card issuance and use contracts. A period of at least 7 days is required for the application of any change of the service fees from the date on which it is informed.

d) The card issuer is not allowed to collect any fees other than those specified in the announced Schedule.

2. The acquirer and the merchant and intermediary payment service provider cooperating with the acquirer may enter into an agreement on fee collection. The sharing of fees between the card issuer, acquirer, intermediary payment service provider and international card association shall be agreed upon by the parties in accordance with regulations of law.

Article 6. Actions against risks and losses in trading cards

...

...

...

2. With regard to other types of risks in card trading, card issuers and acquirers shall settle losses arising from card trading as prescribed in regulations of law on financial regime applicable to credit institutions and FBBs.

Article 7. Revocation of cards

A card shall be revoked in any of the following cases:

1. It is fake;

2. It is used illegally.

3. It is used for the purpose of investigation and actions against crime as prescribed by law.

4. Other cases of card revocation as agreed upon in the card issuance and use contract.

Chapter II

ISSUANCE OF CARDS

...

...

...

1. Card issuers include:

a) Commercial banks, cooperative banks, and FBBs are permitted to issue cards provided that their licenses issued by the SBV indicate the card services.

b) Policy banks issue cards according to the Government's regulations and the provisions of this Circular;

c) General finance companies and consumer credit firms are permitted to issue credit cards provided that the credit card issuance is recorded in their Licenses issued by the SBV.

2. Card issuers must comply with the Basic Standards for domestic chip cards when issuing cards with BINs issued by the SBV.

3. Card issuers must issue internal regulations on card issuance and card use in a manner that ensures compliance with the provisions of this Circular and relevant laws.

4. Card issuers must use BINs issued by the SBV, except for regulations in Clause 5 of this Article.

5. Any card issuer that is permitted to conduct foreign exchange transactions may enter into an agreement with an international card association on issuance of cards with BINs issued by such international card association.

6. Card issuers may not agree with other organizations to restrict the issuance of Co-branded cards.

...

...

...

1. Any arrangement on card issuance and use must be made in the form of a card issuance and use contract in accordance with this Circular and relevant laws. The contents of the agreement shall comply with Article 12 of this Circular.

2. Before signing a card issuance and use contract at the request of a customer, the card issuer shall request the cardholder to provide sufficient information, document and data for identification of the customer as prescribed by anti-money laundering laws and relevant laws:

a) In case the customer (individual) is a Vietnamese, the card issuer shall require the customer to provide identification documents to identify the customer: Citizen ID card or ID card or Electronic ID card (through access to level 02 electronic identification account) or Identity card;

b) In case the customer (individual) is a person of Vietnamese origin whose nationality has not been determined, the card issuer shall require the customer to provide identification documents to identify the customer: Identity certificate;

c) In case the customer (individual) is a foreigner, the card issuer shall require the customer to provide identification documents to identify the customer: Passport and entry visa or valid documents in lieu of visas or documents proving entry visa exemption; or electronic identity (through access to level 02 electronic identity account) (if any). The card issuer shall require the customer to provide necessary documents to verify the period of residence in Vietnam such as work permit or documents issued by a competent regulatory agency proving the period of residence in Vietnam;

d) If the customer is an organization, the card issuer shall request the customer to provide information, documents and data to identify the customer in accordance with anti-money laundering laws and the provisions of this Article, including documents, information and data of its legal representative or authorized representative (hereinafter referred to as “lawful representative”).

3. The collection and storage of documents, information and data of a customer must meet the following requirements:

a) Physical documents must be originals or copies certified as true or copies issued from master books or copies enclosed with originals for comparison in accordance with the provisions of law. In case an original is required for comparison, the card issuer must confirm its copy and be responsible for the accuracy of the copy compared to the original;

b) For electronic documents, information and data, the card issuer must carry out a check, comparison and confirmation to ensure complete and accurate content and archive them in accordance with the law on electronic transactions;

...

...

...

(i) The card issuer must check, control and confirm the content of the foreign documents, information and data​​ to ensure that they meet the requirements provided in this Circular;

(ii) The foreign documents, information and data ​​must be translated at the request of a competent authority;

d) The documents, information, and data as prescribed in Clause 2 of this Article must remain valid throughout the card issuance and use process.

4. When a principal cardholder requests a card issuer to issue a debit card, the principal cardholder is required to have a payment account opened at such card issuer.

5. Each card issuer must have regulations on the validity period of a card, in which the validity period of an identified prepaid card must not exceed 03 years. Before a card of a customer is renewed, the card issuer must take measures to authenticate and re-verify the customer information in accordance with anti-money laundering laws and this Circular.

6. At least 15 days before launching a new type of card or a new design for an existing type of card, the card issuer shall send a notification of the new card design to the SBV by using the form in Appendix No. 01 enclosed with this Circular. Within 15 days from the day on which the issuance of an existing type of card is terminated, the card issuer must send a notification in writing to the SBV for management.

7. Card issuers shall, based on their conditions and supply capacity, provide instructions on card issuance procedures for customers with disabilities, provided that all necessary documents, information and data for identification of such customers are collected in accordance with anti-money laundering laws and this Circular.

8. In case the card issuer detects a customer using fake or illegal documents, information or data or a customer included in the Black List in accordance with anti-money laundering laws, the issuer shall report to a competent authority and handle such violation according to the law.

9. Card issuers may issue debit cards, credit cards and identified prepaid cards to principal cardholders who are individuals and organizations by electronic means. Procedures for card issuance by electronic means shall be carried out in accordance with the provisions of this Article and Article 10 of this Circular.

...

...

...

1. A card issuer must develop and promulgate internal regulations on the procedures for card issuance by electronic means which must comply with the provisions of this Circular, and laws on anti-money laundering, electronic transactions, and personal data protection, ensure customers’ information safety and confidentiality, and safety in its operation, and include at least the following steps:

a) Collect documents, information and data serving the identification of customers according to the provisions of Clause 2, Article 9 of this Circular and biometric information of cardholders (if customers are individuals), biometric information of lawful representatives (if customers are organizations);

b) Check, compare and verify customer identification information. The card issuer must make a comparison, ensuring the correct matching between the biometric information of a cardholder (individual) or a lawful representative (organization) and:

(i) Biometric data stored in the encrypted data storage unit of his/her citizen ID card or ID card which has been certified to be issued by the police or to be accurate via verification of his/her electronic identification account created by the Electronic Identification and Authentication System; or

(ii) Biometric data that has been collected and checked (ensuring the correct matching between the biometric data of the cardholder and the biometric data stored in the encrypted data storage unit of his/her citizen ID card or ID card which has been certified to be issued by the police or to be accurate via verification of his/her electronic identification account created by the Electronic Identification and Authentication System; or

2. The card issuer is allowed to decide measures, forms, and technologies to identify and verify customers for card issuance by electronic means; take responsibility for arising risks (if any) and must at least meet the following requirements:

a) The measures, forms and technologies selected by the card issuer must ensure standards of security, safety and confidentiality according to the regulations of the SBV;

b) There are technical measures for electronic verification of approval by cardholders (if customers are individuals) or legal representatives (if customers are organizations) for the contents of card issuance and use contracts;

c) All customer identification information and data must be stored and preserved over time during the card issuance and use, such as: Customer identification information; biometrics; sounds, images, video recordings, audio recording; phone numbers used for making transactions; transaction logs. Information and data must be stored safely, securely and backed up in a manner that ensures the completeness and integrity of data to serve the checking, comparison, resolution of inspections, complaints and disputes and information provision upon request from competent regulatory authorities. The storage period shall comply with anti-money laundering laws;

...

...

...

3. The card issuance by electronic means specified in this Article shall not apply to the subjects in Point b, Clause 1 and Clause 3, Article 15 of this Circular.

Article 11. Information on cards

1. Information on a physical card must contain:

a) Name of the card issuer (abbreviated name or trade logo). In cases where the abbreviated names or trade logos of many organizations are printed on the card (including the card issuer, organization cooperating with the card issuer, switching company, international card association and related units), the abbreviated name or the trade logo of the cooperative organization must be no larger than that of the card issuer, and the text “this card is issued by the card issuer” must be written clearly in Vietnamese on the card;

b) The name of the switching company of which the card issuer is a member (abbreviated name or trade logo of the switching company) unless the card does not support payment switch by the switching company;

c) Name or brand name of the card (if any);

d) Full name of the cardholder being individual; or name of the cardholder being organization and full name of the person who is authorized to use the card on behalf of the organization. This provision does not apply to anonymous prepaid cards.

2. Apart from the information prescribed in Clause 1 of this Article, the card issuer may regulate other information on cards provided that it complies with Vietnamese law.

3. When issuing a co-branded card, the card issuer must ensure no discrimination occurred in the arrangement of trade logos of domestic switching company and international card association or international switching company (these logos must be in the same size, and placed on the same side of the card).

...

...

...

1. A card issuance and use contract must contain at least the following contents:

a) Number of contract;

b) Date of contract;

c) Name of the card issuer, name of the cardholder; full name of the person who is authorized to use the organization's card;

d) Rights and obligations of contracting parties;

dd) Regulations on fees (fee types and changes of fees);

e) Information and forms of notification provided by the card issuer to the cardholder about the card issuance, account balance, card transaction history and other necessary information;

g) Agreement on credit extension for the cardholder, including limits (payment limit, cash withdrawal limit and other limits) and changes to card use limit, overdraft limit (for debit cards) and credit limit; interest rate, interest calculation method in credit extension according to regulations of the Governor of the SBV, order of collection of principal and interest (for credit cards and overdrawn debit cards); Credit extension term, credit purpose, debt repayment term, minimum debt repayment, debt repayment method, late fees (if any). The agreement on credit extension for the cardholder may be mentioned in the card issuance and use contract or in another document; 

h) Uses, use limit, validity period of the card;

...

...

...

k) Cases of card revocation or invalidation of the card during its use (including cases where the card issuer detects that the customer is using fake documents or impersonating to issue the card or using the card for fraudulent purposes or other illegal activities and other cases in accordance with the law);

l) Cases of refund of the remaining sum of the card;

m) Safety and security measures required during the card use and card losses or card disclosure;

n) Method of receiving requests for inspection and complaints; Time limit for processing requests for inspections and complaints and handling of results of inspections and complaints according to the provisions of Article 19 of this Circular;

o) Cases of force majeure;

p) Processing of personal data of the customer and related persons according to the provisions of this Circular or personal data provided by the customer (organization); information provided to third parties in order to serve the provision of card services to the cardholder or handling of cases of suspected fraud, forgery, or violation of legal regulations.

2. With respect to anonymous prepaid cards, card issuers must provide terms and conditions for issuance and use of anonymous prepaid cards and announce them to customers. A written agreement on the issuance of anonymous prepaid card between a card issuer and an applicant is required. The agreement includes at least: information about the applicant; number of cards to be issued, card limit, deposit made into the card, uses of the card, validity period of the card.

Article 13. Card limit

1. Card issuers shall make agreements with cardholders about payment limits, transfer limits, cash withdrawal limits and other card-related limits in accordance with the provisions of this Circular, applicable foreign exchange management laws and relevant laws.

...

...

...

3. Total monthly cash withdrawal limit by BIN of a credit card is 100 (one hundred) million VND.

4. For prepaid cards, card issuers shall provide specific regulations on balance limits, cash-in limit and transaction limits; ensuring that the balance at any time of an anonymous prepaid card does not exceed 05 (five) million VND; total amount of transactions conducted using an identified prepaid card in a month (including cash withdrawals, transfers, payments for goods and services) shall not exceed 100 (one hundred) million VND.

Article 14. Credit extension by card

1. Credit extension by credit card must satisfy the following requirements:

a) Be bound by the card issuance and use contract and other agreements on credit extension between the card issuer and the cardholder (if any);

b) The card issuer must have internal regulations on credit extension by credit card (including regulations on credit extension by credit card using electronic means (if any)) which must comply with the law on ensuring safety in credit extension, and include specific provisions on eligible subjects, limits (including credit extension limit, cash withdrawal limit and other limits), credit extension term and conditions, debt repayment term, debt restructuring, minimum debt repayment, applicable interest rate, interest calculation method in credit extension according to regulations of the Governor of the SBV, order of collection of principal and interest, late fees, order of applying measures to collect overdue debt, time limit for applying each measure to handle overdue debt, credit purpose, process for appraising and deciding credit extension by card according to the principle of clear division of responsibilities between credit extension appraisal and decision stages, and measures to apply debt recovery to ensure the responsibilities of departments at the card issuer during the debt recovery;

c) For credit extensions by card falling under the case specified in Clause 2 of this Article, the card issuer must have at least information about the legal purpose of capital use and financial capacity of the customer before deciding credit extension;

d) For credit extensions by card not falling under the case specified in Clause 2 of this Article, the card issuer must request the customer to provide information, documents and data proving the customer’s financial capacity, feasible capital use plan, legal purpose of capital use, and information about relevant people before deciding credit extension;

dd) Information on the customer’s relevant people specified in point d of this clause, including:

...

...

...

(ii) Information about a related organization, including: name, business code, head office address of the organization, number of Business Registration Certificate or equivalent legal documents; legal representative, relationship with the customer;

e) The card issuer shall consider and decide the credit extension by credit card for a cardholder if the following requirements are satisfied:

 (i) The cardholder is an individual falling into the subjects specified in clause 1 Article 15 hereof;

(ii) The cardholder is an organization that falls into the subjects specified in Clause 2 Article 15 of this Circular and falls into the cases of ineligibility for credit extension specified in Article 134 of the Law on Credit Institutions;

(iii) The cardholder has a feasible capital use plan (not mandatory to the cases specified in clause 2 of this Article), legal purpose of capital use and financial capacity to pay principal, interest and fees in full and on time;

g) The card issuer enters into an agreement with the customer on the application or refusal of application of measures to ensure the performance of debt obligations according to the law;

h) Credit card limits for the individuals specified in Clause 1, Article 134 and Point dd, Clause 1, Article 135 of the Law on Credit Institutions are as follows:

(i) In case of credit card issuance with collateral: The credit limit granted to the cardholder is determined by the card issuer according to the card issuer's internal regulations on credit extension by credit card and is 01 (one) billion VND;

(ii) In case of credit card issuance without collateral: The credit limit granted to the cardholder is 500 (five hundred) million VND.

...

...

...

3. Lending under the overdraft limit for debit cards of card issuers must comply with the regulations of the Governor of the SBV on the lending by credit institutions and bank branches to customers.

4. The credit extension by credit card and lending under the overdraft limit for debit cards of card issuers shall comply with regulations on credit extension restrictions and credit extension limits specified in Article 135 and Article 136 of the Law on Credit Institutions and guidelines of the SBV.

5. Card issuers shall retain credit records according to the provisions of the Law on Credit Institutions; Credit record retention period shall comply with archives laws.

6. Card issuers have the right and obligation to inspect and supervise the use of credit extensions by card and debt repayment by customers as prescribed in Clause 1, Article 102 of the Law on Credit Institutions; take measures to check and monitor card use and debt repayment by customers, ensuring the ability to collect principal, interest and fees in full and on time as agreed, and card use for intended purposes for credit extensions by card as prescribed in Clause 2, Article 102 of the Law on Credit Institutions and Clause 2 of this Article; the right to request customers to report the use of credit extensions by card and provide documents and data proving that credit extensions by card are used for intended purposes.

Chapter III

USE OF CARDS

Article 15. Eligible entities

1. For principal cardholders being individuals:

a) Any person who is 18 years of age or older and has full legal capacity as prescribed by law is permitted to use debit cards, credit cards and/or prepaid cards;

...

...

...

2. For principal cardholders being organizations: Organizations that are eligible for open of payment accounts are permitted to use debit cards. Organizations being juridical persons duly established and operating under laws of Vietnam are permitted to use credit cards and identified prepaid cards. Cardholders being organizations may authorize in writing individuals to use cards of such organizations or use supplementary cards in accordance with the provisions of this Circular and authorization laws.

3. With respect to supplementary cardholders:

Supplementary cardholders may use cards as specific authorization of principal cardholders in accordance with the following requirements:

a) Any person who is 18 years of age or older and has fully legal capacity as prescribed by law is permitted to use debit cards, credit cards and/or prepaid cards;

b) Any person who is 15 to less than 18 years of age and does not have lack of legal capacity or limited legal capacity is permitted to use debit cards, credit cards and prepaid cards;

c) Any person who is 6 to less than 15 years of age and does not have lack of legal capacity or limited legal capacity and obtains an authorization in writing from his/her legal representative (principal cardholder) to use cards is permitted to use debit cards and prepaid cards.

4. In case the eligible card user specified in Clauses 1 and 3 of this Article is a foreigner, he or she must have a residence period in Vietnam of 12 months (360 days) or more from the time of request for card issuance; The card validity period does not exceed the remaining period of residence in Vietnam.

5. Cardholders must provide sufficient and accurate information, documents and data as required by card issuers in order to verify and identify customers before entering into card issuance and use contracts and take responsibility for the accuracy of the information, documents and data provided.

6. When using a credit card or an overdrawn debit card, the cardholder must use money properly and make full and due repayment of principals, interests and fees arising from the card use under the agreement concluded with the card issuer.

...

...

...

Article 16. Uses of cards

1. Debit cards and identified prepaid cards can be used to conduct card transactions as agreed upon by the cardholders and the card issuers;

2. Credit cards can be used to pay for legal goods and services; withdraw cash according to the agreements between the cardholders and the card issuers; credit cards cannot be used to transfer (or credit) to payment accounts, debit cards and prepaid cards.

3. Anonymous prepaid cards are only used to pay for legal goods and services at point-of-sale terminal (“POS terminal”) in Vietnam; these cards cannot be used to make card transactions using electronic means and to withdraw cash.

4. Supplementary cards issued to supplementary cardholders aged under 15 years cannot be used to withdraw cash but can be used to pay for goods and services that are legal and consistent with the uses as agreed upon in writing between the card issuers and the cardholders.

5. Cards can be used to pay for legal goods and services according to Vietnamese law, including cases of purchasing goods and services abroad.

6. A card can only be used to perform card transactions using electronic means when the comparison has been completed to ensure the correct matching between the cardholder's identification documents and biometric information and:

a) Biometric data that is stored in the encrypted data storage unit of his/her citizen ID card or ID card which has been certified to be issued by the police or to be accurate via verification of his/her electronic identification account created by the Electronic Identification and Authentication System; or

b) Biometric data that has been collected and checked (ensuring the correct matching between the biometric data of the cardholder and the biometric data stored in the encrypted data storage unit of his/her citizen ID card or ID card which has been certified to be issued by the police or to be accurate via verification of his/her electronic identification account created by the Electronic Identification and Authentication System; or

...

...

...

d) The cardholder’s biometric data that is stored in the National Population Database in the case where the cardholder’s citizen ID card does not have an encrypted data storage unit.

Article 17. Security, safety and confidentiality measures in card use

1. Card issuers:

a) Take responsibilities in risk management upon their issuance of card types;

b) Provide customers with guidelines for card services, process of card use, risks that may be encountered during the card use and actions against problems, prohibited acts during the card use and the cardholders' responsibilities in case of violation;

c) Initiate prudential measures and risk avoidance for card transactions in conformity with the electronic banking risk management principles; keep confidential information relating to card operations; to ensure the uninterrupted and safe operation of the system of infrastructure and software used in the administration of card issuance and payment activities;

d) Set up and operate a round-the-clock hotline to receive and take prompt actions against information sent by cardholders;

dd) Cooperate with acquirers, switching companies and clearing companies in initiation of prudential measures for card transactions; and in management of risks from other entities according to rules of risk management in internet banking operations;

e) Have measures to check, compare and verify customer identification information during the card issuance and use, including: Measures to check the legality, validity and make comparison to ensure the correctness and accuracy of documents, information and data of customers that have been collected during the card issuance and use; Measures to prevent acts of impersonation, intervention, editing and falsification of verification of customer identification information during the card issuance and use; technical measures and technological solutions to compare customer biometric information according to the provisions of Point b, Clause 1, Article 10 and Clause 6, Article 16 of this Circular; measures to ensure that cards are used by the cardholders themselves; other measures provided by card issuers to prevent and combat risks of fraud, impersonation, violation of law or misuse of cards for illegal purposes;

...

...

...

h) Develop a set of criteria for identifying cards suspected of fraud, deceit, or violation of law (hereinafter referred to as “the set of criteria”) based on the reasons for suspicion in Appendix No. 02 enclosed herewith. Card issuers must regularly review, edit, supplement and update the set of criteria based on information, documents and data during the card issuance and use;

i) Identify types of risks that may arise during the card issuance and use and corresponding risk treatment measures. Risk treatment measures include:

(i) Regulations on transaction scope and limits according to risk levels by customer, including specific regulations on risk management measures for customers under 18 years old;

(ii) Cases where customer identification information must be updated and re-verified, including cases specified in Point n of this Clause;

(iii) Cases of refusal or suspension of card transactions by electronic means;

k) Issue regulations on checking and comparing cardholder identification information with the information in the information system for supporting management, supervision and prevention of fraud risks in payment activities of the SBV and lists of relevant customers suspected of fraud, deceit and violation of law provided by the Ministry of Public Security and other relevant authorities (if any) to apply appropriate risk management measures;

l) Provide information about cards on which signs of fraud and forgery are detected to authorities in charge of investigation of card-related crime; check, review and cooperate with relevant authorities in updating acquirers and merchants on lists of cards which must be declined to use for payment or show signs of fraud; cooperate with relevant authorities and entities in card-related crime prevention and fighting and actions against such as prescribed by law;

m) Card issuers must regularly warn and guide customers about criminal methods during the card issuance and use; provide instructions on data security and safe card use;

n) Card issuers must verify customer identification information and promptly apply measures according to anti-money laundering laws in the following cases:

...

...

...

(ii) Card issuers have grounds for the suspicion about the legality and validity of documents, information and data of customers that have been collected when concluding card issuance and use contracts and during the card use;

(iii) A cardholder’s information is found to be included in the list of persons/customers suspected of fraud and deceit available on the information system for supporting management, supervision and prevention of fraud risks in payment activities of the SBV or lists of relevant customers suspected of fraud, deceit and violation of law provided by the Ministry of Public Security and other relevant authorities (if any);

(iv) Information about cards and cardholders is incorrect or does not match the information and data of relevant authorities;

o) Issue regulations on documents related to overseas card transactions and carry out inspection and storage of documents according to foreign exchange management and electronic transaction laws;

p) Closely monitor and take responsibility for ensuring that overseas card transactions are carried out for intended purposes, within card use limits specified in this Circular and in accordance with foreign exchange management laws;

q) Card issuers must monitor the validity period of the customer identification documents and documents proving the residence duration in Vietnam as prescribed in Clause 2, Article 9 of this Circular; notify customers at least 30 days before the expiration date of identification documents and documents proving the residence duration in Vietnam to promptly request customers to update and supplement; temporarily suspend card transactions in cases where customer identification documents or documents proving the residence duration in Vietnam have expired.

2. Each cardholder and the person authorized to use an organization’ card must preserve the card, ensure security of the PIN, other cardholder identification numbers, card information, transaction information without any disclosure; notify and cooperate with the card issuer in actions against cases of card losses or make related trace requests or complaints.

3. Acquirers:

a) cooperate with card issuers, switching companies, clearing companies, intermediary payment service providers cooperating with the acquirers, merchants, relevant authorities and entities in card-related crime prevention and fighting;

...

...

...

c) Have measures to strictly inspect and manage merchants, especially merchants that have wireless POS terminals installed. In case it is discovered that or there are grounds for believing that a merchant carries out prohibited acts against regulations in the Decree on non-cash payments and acts such as making fictitious transactions at the merchant, transferring POS terminals to other parties to use, accepting card payments without a card payment contract or illegally using POS terminals of an acquirer in Vietnam or of an acquirer in a foreign country, the acquirer shall notify relevant agencies or organizations in charge of receiving denunciations and information about crimes and recommendations for prosecution or other competent authorities for cooperating in monitoring and handling such acts, and consider applying appropriate preventive measures, including terminating or requesting the intermediary payment service provider that cooperates with the acquirer to terminate the card payment contract signed with the violating merchant.

4. Each merchant must implement all professional measures and processes and ensure the security of cardholders’ information, quickly discover card-related fraud acts as guided by the acquirer and take responsibility for any damage caused by its non-observance of regulations of the acquirer.

5. When a card issuer, an acquirer, an intermediary payment service provider that cooperates with the acquirer, a switching company or an Clearing company enters into an agreement on bank card operations, such agreement must contain responsibilities of the relevant entities for observance of regulations of law on foreign exchange management, personal data protection, personal privacy, security of documents, card information, card transactions and accounts of the cardholder.

6. When cooperating with intermediary payment service providers in rendering intermediary payment services using cards, acquirers shall comply with the provisions of this Circular and Circulars on the provision of intermediary payment services.

Article 18. Actions against cases of card losses or card disclosure

1. When a card is lost or a card’s information is disclosed, the cardholder must promptly notify the card issuer.

2. Upon the receipt of the notification, the card issuer shall lock the card and cooperate with relevant entities in carrying out necessary operations to prevent possible damage and send another notification to the cardholder. After locking the card, the period for carrying out the actions against notification received from the cardholder must not exceed 5 working days (for the card whose BIN is issued by the SBV) or 10 working days (for the card whose BIN is issued by an international card association) from the date on which the cardholder’s notification is received.

3. In case such card is misused, thereby causing damage, the card issuer and the cardholder shall jointly determine their responsibility and negotiate the measures for repairing the damage. In the event that both parties fail to reach a consensus on the measures for repairing the damage, regulations of law shall apply.

Article 19. Tracing and actions against complaints during the card use

...

...

...

2. The card issuer shall process the trace request or complaint of the cardholder in a manner that ensures at least the following requirements:

a) Apply at least two methods of receipt of trace requests or complaints, including via telephone exchange (with recording and round-the-clock operation) and through legal transaction points of the card issuer; ensuring the authentication of basic information that the cardholder has provided to the card issuer;

b) Issue the trace request/complaint forms (physical and electronic forms) for the cardholder to use. In case of receiving information via a telephone exchange or online channel, the card issuer requires the cardholder to provide necessary information for customer verification, and has measures to store the customer information as a basis for processing the trace request or complaint. In case of authorizing another person to send a request or complaint, the cardholder shall comply with authorization laws;

c) The card issuer must immediately take measures to block the card when the cardholder requests due to suspicion of fraud or loss and be responsible for all financial losses of the customer arising after the time of receiving the request to block the card;

d) The card issuer shall process the trace request or complaint and give results to the cardholder within the following period:

(i) For a card with a BIN thereon issued by the SBV, the period for processing trace requests/complaints must be specifically agreed with the customer in the card issuance and use contract and must not exceed 30 working days from the date of receiving the cardholder's first trace request/complaint via one of the methods specified in point a of this clause;

(ii) For a card with a BIN thereon issued by an international card association, the period for processing trace requests/complaints must be specifically agreed upon with the customer in the card issuance and use contract.

3. Processing the trace request or complaint:

a) Within 05 working days from the date on which a notification of results of the trace request/complaint processing is sent, the card issuer shall reimburse the cardholder, as agreed upon or in accordance with applicable laws, for damage incurring not due to any fault of the cardholder and/or force majeure events agreed upon in the agreement. In case the loss arises due to the fault of the relevant parties (Acquirer, intermediary payment service provider, international card association, or merchant), the at-fault party shall reimburse the card issuer according to the agreement between the parties in accordance with the provisions of law;

...

...

...

c) In case the card issuer, cardholder and related parties cannot reach an agreement or disagree with the results of processing the trace request or complaint, the dispute resolution shall be carried out in accordance with the provisions of law.

4. If the case shows signs of crime, the card issuer shall notify a competent regulatory agency in accordance with criminal proceedings laws and send a report to the SBV (via the Payment Department, the SBV’s provincial branch); and send a written notification of the status of processing the trace request/complaint to the cardholder. In case the competent regulatory agency notifies that the trace response shows no sign of criminal activities, within 15 working days from the date on which the competent state agency comes to the conclusion, the card issuer shall negotiate with the cardholder for a plan to process the trace request/complaint.

5. The card issuer must have a solution so that the cardholder can look up information, progress and results of the trace request/complaint processing online.

Chapter IV

PAYMENT AND STATEMENT OF CARD TRANSACTION

Article 20. Acquirers

1. Acquirers include:

a) Commercial banks, cooperative banks, and FBBs are permitted to make card payments provided that their licenses issued by the SBV indicate the card services.

b) Policy banks are permitted to make card payments according to the Government's regulations and the provisions of this Circular;

...

...

...

3. Acquirers must cooperate with relevant parties in formulation of processes and procedures for card payments, which clarify steps for handling card transactions and responsibilities of relevant parties in accordance with this Circular and applicable regulations on internet banking operations; manage, operate, ensure safety and continuity of equipment used for card payments.

4. Acquirers must comply with the Basic Standards for domestic chip cards applicable to ATMs and POS terminals of the acquirers.

5. Acquirers shall handle card transactions as agreed upon by the acquirers and switching companies, card issuers, international card associations, intermediary payment service providers that cooperate with acquirers and other relevant parties in terms of processes and procedures for card payments.

6. When cooperating with intermediary payment service providers and merchants, acquirers shall comply with the provisions of the Circular on the provision of non-cash payment services and the provisions of the Circular on the provision of intermediary payment services.

7. Acquirers must emboss names (abbreviated names or trade logos) of switching companies of which the acquires are members on ATMs of the acquirers and on the POS terminals of the acquirers at the merchants' premises.

8. Acquirers must not practise any discrimination in payment cards with BINs thereon issued by the SBV and payment cards with BIN thereon issued by international card associations and payment cards with BIN thereon issued by other countries; the acquirers must not enter into any agreement on restriction or prevention of the acceptance of transactions conducted through co-branded cards with other entities.

9. Acquirers shall cooperate with intermediary payment service providers that cooperate with the acquirers in appraising, selecting merchants and supervising the compliance with the provisions of this Circular and the Circular on the provision of intermediary payment services by merchants.

Article 21. Merchants

1. Merchants shall comply with regulations concerning acceptors in the Circular on the provision of non-cash payment services.

...

...

...

Article 22. Switching companies and clearing companies

1. The switching and electronic clearing for card transactions between card issuers and acquirers relating to transactions using cards with BINs thereon issued by the SBV shall be conducted by switching companies or clearing companies licensed by the SBV.

2. The switching for domestic card-present transactions using cards with BINs thereon issued by international card associations and cards with BINs thereon issued by other countries between card issuers and acquirers with the international card associations shall be conducted through a payment gateway of a switching company licensed to be operated by the SBV.

3. The electronic clearing of transactions using cards with BINs thereon issued by international card associations shall be conducted as agreed upon between card issuers, acquirers and relevant parties.

4. Switching companies and clearing companies shall enter into agreements with members on standards, rules, professional procedures and other regulations on switching and electronic clearing of card transactions in accordance with regulations of law.

5. Switching companies and clearing companies shall facilitate the system directly linked with card issuers, acquirers and international card associations as agreed by contracting parties in a manner that ensures the safety and continuity of switching services and other services provided for members and international card associations involved in the direct link and compliance with relevant laws.

Article 23. International card associations

1. International card association shall conclude agreements with switching companies licensed by the SBV to implement the provisions in Clause 2 Article 22 of this Circular.

2. International card associations may not give restrictions to card issuers and acquirers for the purposes of:

...

...

...

b) Restriction on rights of merchants to select switching companies based on regulations on fees and other obligations.

Article 24. Settlement of results of clearing for card transactions

The statement of financial liabilities incurring from clearing and settlement for card transactions between card issuers and acquirer must be conducted by an organization licensed by the SBV.

Article 25. Rejection of card payments

1. Card issuers, acquirers, intermediary payment service providers that cooperate with the acquirers and merchants must reject card payments in any of the following cases:

a) Cards are used to make fictitious transactions at merchants and prohibited card transactions according to the provisions of the Decree on non-cash payments;

b) Cards have been lost as notified by the cardholders;

c) Cards are expired;

d) Cards are locked.

...

...

...

3. Card issuers, acquirers, intermediary payment service providers that cooperate with the acquirers and merchants may decline card payments as agreed upon in the following cases:

a) The payment account balance, card balance, available credit or remaining overdraft limit (if any) is not enough to cover the payment;

b) Cardholders breach any of the regulations of the card issuers on the cases of rejection of card payments as agreed upon by the cardholders and the card issuers.

4. Card issuers shall send written notifications or data messages of cases of card payment rejection specified in Clause 1, Clause 2 and Clause 3 of this Article to acquirers; If such written notifications or data messages are sent from card issuers in Vietnam or card issuers in foreign countries or international card associations, acquirers shall notify intermediary payment service providers that cooperate with the acquirers and merchants.

5. Notifications of card payment rejection (including notifications from card issuers in foreign countries and international card associations) take effect at the time that involved parties in the card transactions receive written notifications or data messages of the rejection. In case where involved parties still process the payment of such cards after their receipt of the notifications resulting in the card misuse, they shall reach an agreement on their responsibilities.

Chapter V

REPORTING AND INFORMATION PROVISION

Article 26. Reporting

1. Card issuers, acquirers, switching companies and Clearing companies shall send regular reports in accordance with statistical reporting regimes and regulations of the SBV.

...

...

...

3. Card issuers, acquirers and intermediary payment service providers shall send reports to the SBV in the following cases:

a) Upon specific requests of the SBV for state management purposes;

b) Upon irregular card-related occurrences affecting operation of card issuers or acquirers.

Article 27. Information provision

1. Card issuers, acquirers, merchants, intermediary payment service providers that cooperate with the acquirers, switching companies, Clearing companies and international card associations must ensure the confidentiality of information on cards, cardholders, card transactions and only provide information at the request of cardholders, competent regulatory agencies or as prescribed by law.

2. Card issuers, acquirers and intermediary payment service providers shall enter into agreements on sharing information in line with card operations as prescribed by law.

3. International card associations shall provide information concerning transactions using cards with BINs thereon issued by international card associations at the request of the SBV for state management.

4. Card issuers shall provide information on cards at the request of the SBV for state management.

5. No later than the 10^th of every month, card issuers shall provide information about cards and cardholders showing signs of fraud, deceit and violation of law according to Appendix No. 02 enclosed herewith at the request of the State Bank.  The information must be provided by electronic means according to the SBV's technical connection instructions.

...

...

...

ORGANIZATION OF IMPLEMENTATION

Article 28. Entry into force

1. This Circular comes into force from July 01, 2024, excluding the regulations in Clause 2 and Clause 3 of this Article.

2. Article 9, Article 10, Article 12 (excluding point g clause 1) and Clause 1, Article 17 (excluding Point q) of this Circular take effect from October 1, 2024.

3. Clause 3, Article 13, Clause 6, Article 16, Point q, Clause 1, Article 17 and Clause 5, Article 19 of this Circular take effect from January 1, 2025. For card issuers that are credit institutions put under special control, Clause 6, Article 16, Point q, Clause 1, Article 17 and Clause 5, Article 19 of this Circular take effect from July 1, 2025.

4. Circular No. 19/2016/TT-NHNN dated June 30, 2016 of the Governor of the SBV on bank card operations is amended by: Circular No. 30/2016/TT-NHNN dated October 14, 2016; Circular No. 26/2017/TT-NHNN dated December 29, 2017; Circular No. 41/2018/TT-NHNN dated December 28, 2018; Circular No. 28/2019/TT-NHNN dated December 25, 2019; Circular No. 22/2020/TT-NHNN dated December 31, 2020; Circular No. 17/2021/TT-NHNN dated November 16, 2021 will be no longer effective from the effective date of this Circular, except Article 10, Article 10a, Article 13 (excluding point g Clause 1 of Article 13) and Clause 1 Article 18 that will be effective until September 30, 2024; Point g, Clause 1 of Article 13 that will no longer be effective from July 1, 2024.

Article 29. Transitional provisions

1. Blank physical cards printed by card issuers before July 1, 2024 may continue to be used until December 31, 2024.

2. For cards issued to customers before October 1, 2024, card issuers shall cooperate with cardholders in updating and obtaining additional documents, information and data from cardholders as prescribed in Clause 2 of Article 9, and Article 12 of this Circular. This task must be completed before January 1, 2026.

...

...

...

1. The Payment Department is responsible for monitoring, inspecting and cooperating with relevant units in handling problems that arise during the implementation of this Circular.

2. The Banking Inspection and Supervision Agency, SBV’s branches of provinces and cities shall inspect and supervise the implementation of this Circular and handle violations under their jurisdictions.

3. The Chief of the Office, the Director of the Payment Department, Heads of units affiliated to the SBV, credit institutions, FBBs, intermediary payment service providers and other relevant organizations and individuals are responsible for the implementation of this Circular./.

PP. GOVERNOR
DEPUTY GOVERNOR




Pham Tien Dung

Appendix 01

(enclosed with Circular No. 18 dated June 28, 2024 of the Governor of the SBV on bank card operations)

...

...

...

SOCIALIST REPUBLIC OF VIETNAM
Independence - Freedom – Happiness
---------------

No. ................

....... ………[date] ....................

Notification of card designs

To: SBV (via the Payment Department)

The unit’s name:

- In Vietnamese: ……………………………………..

- In foreign language: ……………………………………..

...

...

...

Address of headquarters:…………………………………………………………………………..

Tel: ……………. Fax: ……………..

Tel (division or official in charge): …………

Pursuant to Clause 6, Article 9 of Circular No......................... dated .... , 2024 of the Governor of the SBV on bank card operations, we hereby notify the following card design(s):

1. Relevant information on card designs

Card name

Card classification

Uses of card

Card with BIN thereon issued by SBV/card with BIN thereon issued by International switching company (specifying the BIN to clearly identify the card issuer)

...

...

...

Physical card/Non-physical card

Card A (principal card design)

...

...

...

2. Eligible customers, conditions of card issuance

3. Roles and responsibilities of the card issues and related parties (organization cooperating or join in issuing card (if any)) in issuing card designs

4. Colour scan of front and back of card design

5. Information about supplementary card designs (if any): (In case no supplementary card is issued, the card issuer shall clearly state that “không phát hành mẫu thẻ phụ” (“no supplementary card is issued”)

Information

Card A (supplementary card design)

If it is the same as the principal card design of Card A, please add the “X” mark

...

...

...

Subjects and conditions of issuance of supplementary card design

Functions of supplementary card design

Image of supplementary card design

...

...

...

LEGAL REPRESENTATIVE

Appendix 02

(enclosed with Circular No. 18 dated June 28, 2024 of the Governor of the SBV on bank card operations)

Reporter’s name

List of cards, cardholders suspected of FRAUD, FORGERY, VIOLATION OF LAW
(in …[month] ….. , [Year]….)

No

...

...

...

Identification documents

Full name

Date of birth

Sex

Nationality

Card number

Card type

Date of issuance

Validity period

...

...

...

Reasons for suspicion

Status of card

Number of identification document

Type of identification document

Domestic card

International card

...

...

...

(1)

(2)

(3)

(4)

(5)

(6)

...

...

...

(8)

(9)

(10)

(11)

(12)

(13)

(14)

(15)

1

...

...

...

...

...

...

2

...

...

...

...

...

...

....

...

...

...

Notes:

- Report submission date: Before the 10^th of every month.

- Report submission method: Electronic means under the SBV’s instructions.

...

...

...

- In Column (3): Clearly state the type of identification document in numbers (1, 2, 3, 4, 5, 6, or 7) as follows: 1. Citizen ID card; 2. ID card (new format); 3. ID card (old format); 4. Passport; 5. Identity certificate; 6. Electronic identification and authentication account; 7. Other documents.

- In Column (6): Clearly write “M” for Male gender, "F" for Female gender.

- In Columns (9) and (10): Clearly write “GN” for debit cards, “TD” for credit cards, “TT” for identified prepaid cards in Column 9 and column 10 respectively.

- In Column (14): Clearly state one or more reasons in numbers (1, 2, 3, 4, 5, 6, 7, 8, or 9) as follows:

1. Debit cards associated with payment accounts and e-wallets are on the list of payment accounts and e-wallets suspected of fraud, forgery, or violation of law;

2. Information, documents and data provided by the cardholder when entering into the card issuance and use contract and during the card use do not match the information of that individual in the National Population Database;

3. The card is on the list of cards advertised, bought, sold, and exchanged on websites and groups in cyberspace;

4. Card transactions occur at unusual locations, times, and frequencies;

5. Transaction value and quantity are large and unusual, which is not consistent with the cardholder's occupation, age, residential address, transaction history and behaviour, etc.;

...

...

...

7. The customer is on the warning list of the SBV, the Police or other competent authorities;

8. Fictitious transactions are carried out at merchants; card transactions are carried out at merchants in foreign countries that trade in illegal goods and services under regulations of law or at merchants included in the list of acceptors suspected of fraud, forgery, or violation of law;

9. Other signs: Adding footnote(s) to this information.

- In Column (15): Clearly state the card status in numbers (1, 2, 3, 4, or 5) corresponding to the content below: 1. Active; 2. Suspended; 3. Locked; 4. Revoked; 5. Expired.

prepared by
(signature and full name)

The Bank Representative
(signature and seal)

Phone number:………..

Division: