On 30 April 2025, the Government officially promulgated Decree 94/2025/ND-CP, stipulating the sandbox mechanism in the banking sector (Decree 94).

This marks a significant milestone for financial innovation in Vietnam, allowing licensed banks and financial technology (Fintech) entities to pilot emerging technologies under the supervision of the State Bank of Vietnam (SBV). Decree 94 outlines the scope, procedures, and regulatory framework for testing new financial services within a controlled environment before broader market deployment. Decree 94 comprises 26 Articles divided into 5 Chapters, with 12 accompanying procedural document templates, and is set to take effect on 01 July 2025.

In this legal update, we will outline key contents of Decree 94, which sets out the principles, requirements, and procedures of the sandbox mechanism (Sandbox) in the banking sector that Fintech companies should stay alert on.

1. Scope of the Sandbox and Eligible Participants

The Sandbox applies to specific types of Fintech innovations, including:

• • Credit Scoring: a solution that applies information technology systems operated by Vietnamese credit institutions, foreign bank branches, or Fintech companies to assess the creditworthiness of individuals or organisations;
  • Open application programming interface sharing (Open API Sharing): a set of standardised APIs that can be used by computer systems of various Vietnamese credit institutions, foreign bank branches, Fintech companies, and other third parties to send service requests to the systems of the Vietnamese credit institutions or foreign bank branches that share such Open APIs; and
  • Peer-to-peer lending (P2P Lending): an IT-based solution provided by a P2P lending company that connects borrowers and lenders, facilitating the conclusion of contracts on a digital platform. The currency used in the P2P lending solution is the Vietnamese dong.

Eligible participants for the Sandbox include (i) Vietnamese credit institutions and foreign bank branches operating in Vietnam (excluding P2P lending); and (ii) Fintech companies. Fintech companies must have a legal establishment in Vietnam and provide Fintech solutions independently or in partnership with Vietnamese credit institutions or foreign bank branches. To qualify for the Sandbox, participants must not be undergoing liquidation or bankruptcy proceedings and must be in good legal standing with adequate operational capacity to implement the proposed pilot project.

2. Principles of the Sandbox

The core principles of the Sandbox include:

• • Risk control: Participants are required to identify, assess, and mitigate any potential risks that may arise during the Sandbox period, particularly those relating to financial system stability, operational resilience, and technological integrity. The SBV assumes supervisory responsibility throughout the duration of the pilot to ensure that the Sandbox activities do not pose systemic risk or cause disruption to existing financial markets.
  • Consumer protection: Entities participating in the Sandbox must adopt adequate measures to safeguard the legitimate rights and interests of users, including but not limited to privacy, informed consent, data security, and recourse mechanisms. Participants must provide full disclosure to customers regarding the experimental nature of the products or services, including any risks associated with their use. Additionally, customers must have the right to discontinue participation in the Sandbox at any time, and participants must implement procedures to handle complaints, losses, or disputes arising during the pilot phase.
  • Transparency: Participants are obligated to submit regular reports to the SBV, including disclosures of Sandbox results, encountered difficulties, customer feedback, and any incidents or breaches. These reports enable the SBV to monitor the effectiveness of the Sandbox and to assess whether the continued participation of a given entity remains appropriate. In serious cases, the SBV reserves the right to terminate the Sandbox if material violations occur or if the Sandbox is deemed no longer compliant with the Sandbox objectives.

3. Requirements to participate in the Sandbox

For the testing of Credit Scoring and Open API Sharing solutions under the Sandbox, Decree 94 sets out specific eligibility criteria for participants:

• • The eligible participants for these solutions include: (i) Vietnamese credit institutions that are not currently subject to exceptional control; and (ii) foreign bank branches, provided these entities meet the following conditions:

(a) Legally established and operating in Vietnam; not undergoing division, separation, merger, consolidation, conversion, dissolution, or bankruptcy under Vietnamese law; and

(b) The legal representative or General Director (or Director) must: (i) hold a university degree or higher in economics, business administration, law, or information technology; (ii) have at least 2 years of experience as a manager or executive in the finance or banking sector; and (iii) not be subject to any legal prohibitions from holding such positions.

• • Innovations of the participants must meet the following criteria:

(a) Involves technical or operational aspects not yet clearly regulated under existing law;

(b) Demonstrates innovation and provides added value to service users in Vietnam, particularly by supporting and promoting financial inclusion;

(c) Include a comprehensive risk management framework to minimise potential negative impacts on the banking system and the broader monetary and foreign exchange environment. This must cover detailed plans for addressing and resolving risks during the testing process, as well as measures to protect user rights;

(d) Have undergone a thorough internal assessment covering the solution’s operations, functionality, usefulness, and practicality; and

(e) Be feasible for market deployment upon successful completion of the testing phase.

For P2P Lending, participants wishing to take part in the testing of P2P Lending solutions must meet the following criteria:

• The eligible participants in this case are Fintech companies that meet the following requirements:

(a) Legally established and operating in Vietnam; not undergoing division, separation, merger, consolidation, conversion, dissolution, or bankruptcy under Vietnamese law; and

(b) The legal representative and General Director (or Director) must: (i) be Vietnamese citizens; (ii) have no criminal record or administrative penalties in finance, banking, cybersecurity; (iii) must not concurrently serve as owners or managers of financial service providers, pawn businesses, or multi-level marketing enterprises, nor be involved in informal lending groups; (iv) must not hold key positions in Vietnamese credit institutions, foreign bank branches, or payment intermediaries; (v) hold a university degree or higher in economics, business administration, law, or information technology; (vi) have at least 2 years of experience as a manager or executive in the finance or banking sector; and (vii) not be subject to any legal prohibitions from holding such positions.

(c) Meet specific technical and operational requirements for the digital platform used to provide P2P lending services, including:

• • • • • IT systems and data storage must be located in Vietnam and must operate reliably with uninterrupted service;
        • Independent backup systems must be installed to mitigate any service disruptions, particularly those caused by technical failures;
        • Customer and related party data must be securely stored and shared in a transparent and high-security manner, ensuring both visibility and data protection in compliance with legal regulations;
        • The IT system must be tested and assessed prior to deployment; and
        • The company must have a qualified technical team to ensure stable and secure system operations
• P2P Lending must meet the following criteria:

(a) Involves technical or operational aspects not yet clearly regulated under existing law;

(b) Demonstrates innovation and provides added value to service users in Vietnam, particularly by supporting and promoting financial inclusion;

(c) Include a comprehensive risk management framework to minimise potential negative impacts on the banking system and the broader monetary and foreign exchange environment. This must cover detailed plans for addressing and resolving risks during the testing process, as well as measures to protect user rights;

(d) Have undergone a thorough internal assessment covering the solution’s operations, functionality, usefulness, and practicality;

(e) Be feasible for market deployment upon successful completion of the testing phase;

(f) Include controls to monitor and manage the maximum loan per borrower, with real-time reporting via the Vietnam National Credit Information Centre (CIC) to ensure compliance across all Sandbox P2P Lending participants;

(g) Ensure disbursement and repayment (principal, interest, fees) occur via customer accounts at Vietnamese credit institutions, foreign bank branches, or e-wallets from licensed payment intermediaries;

(h) Include measures to ensure that the loan term under contracts between lenders and borrowers using the P2P lending solution participating in the Sandbox does not exceed 02 years.

4. Duration and Limitations of the Sandbox

Each approved pilot project may operate within the Sandbox for a maximum period of two years, with the possibility of an extension if additional time is deemed necessary by the SBV. However, under no circumstances may the total duration of the Sandbox participation exceed three years. All testing activities must be conducted strictly within the geographical territory of Vietnam, and no cross-border operations are permitted under the Sandbox framework.

Decree 94 also imposes additional restrictions tailored to specific categories of innovation. In the case of P2P Lending, participants may not serve as borrowers or lenders themselves, nor may they pledge collateral on behalf of users or collaborate with unlicensed entities such as pawnshops. All communications and advertisements related to Sandbox services must clearly disclose that the product or service is being tested under a controlled regime, and customers must be appropriately informed of the associated risks. The scope of operations must adhere strictly to what is authorised by the SBV, and any deviation may result in sanctions or early termination of participation.

5. Exit and Evaluation of the Sandbox

Upon conclusion of the Sandbox period, participants are required to submit a final evaluation report to the SBV. This report must provide a comprehensive assessment of the trial, including performance results, operational challenges, customer feedback, and an evaluation of the legal and regulatory implications of the tested solution.

Based on this final assessment, the SBV may determine one of the following outcomes:

• • Termination or suspension of Sandbox participation: The SBV may terminate participation and revoke the Certificate of Participation in the following cases: (i) expiry of the testing period without renewal; (ii) voluntary withdrawal; (iii) dissolution or bankruptcy; (iv) failure to commence testing within ninety (90) days (excluding force majeure); (v) serious technical incidents or legal violations; (vi) continued non-compliance despite notice; or (vii) breach of the certificate conditions.

The SBV shall notify the participant in writing and allow for a response. If the explanation is inadequate or absent, the SBV proceeds with revocation. Once notified of termination, participants must immediately implement their exit plan, inform customers, cease onboarding new users, resolve customer interests, and report to the SBV upon conclusion.

• • Approval of an extension to the trial period: Participants may request a testing extension at least ninety (90) days before expiry. The SBV evaluates the request, considering the testing report, monitoring outcomes, and input from other relevant ministries. Each extension may not exceed one year and is limited to two renewals.
  • Issuance of a Certificate of Completion: A Certificate of Completion may be granted if legal regulations for the tested Fintech innovation are finalised and effective, or if the solution is deemed lawful and not subject to conditional business requirements. This certificate only affirms the solution’s completion under the testing framework and does not confirm investment or business eligibility under other laws.

6. Conclusion

Decree 94 marks a pivotal development in Vietnam’s legal and regulatory approach to financial innovation. By establishing a formal framework for Sandbox participation, the SBV has created a legal pathway for banks and fintech companies to explore and validate novel solutions in a supervised environment. The Sandbox strikes a careful balance between innovation and regulatory prudence, offering participants the opportunity to test high-potential services while ensuring that consumers and the financial system remain protected.

For institutions considering participation, thorough preparation is essential. Participants must ensure that they meet all eligibility and procedural requirements and are capable of maintaining high standards of governance, compliance, and customer care throughout the trial period.

Key contacts

If you have any questions or would like to know how this might affect your business, please contact the key contacts.

	Nguyen Viet Ha Partner Head of Technology, Media and Telecoms Hanoi, Vietnam +84 24 3971 0888 [email protected]
	Hoang Le Quan Senior Associate Hanoi, Vietnam +84 24 3971 0888 [email protected]
	Tran Quang Long Junior Associate Hanoi, Vietnam +84 24 3971 0888 [email protected]

Legal notice

The contents of this publication, current at the date of publication set out above, are for reference purposes only. They do not constitute legal advice and should not be relied upon by any party for any purpose.

© Lexcomm Vietnam LLC 2025