Vietnam's establishment of a pilot framework for the digital asset market sets new requirements for transparency and accountability. Resolution No. 05/2025/NQ-CP and Circular No. 165/2026/TT-BTC not only define the information to be reported and disclosed but also require businesses to be able to verify transaction data, asset status, and operational risks. The core issue is therefore not only to disclose on time, but also to organize a control system that is reliable enough to take responsibility for the published information.
It is worth noting that the pilot framework designs reporting and information disclosure obligations according to the characteristics of each subject and activity.
1. From New Markets to Controlled Transparency Requirements
On September 9, 2025, the Government issued Resolution No. 05/2025/NQ-CP on the pilot implementation of the digital asset market in Vietnam (Resolution 05). The Resolution establishes a legal framework for the offering, issuance, organization of the trading market and provision of digital asset services within the scope of the pilot.
Subsequently, the Ministry of Finance issued Circular No. 165/2026/TT-BTC dated October 31, 2026 (Circular 165), guiding a number of contents on the regime of reporting and disclosing information on the digital asset market.
The two documents represent a remarkable management orientation: the crypto asset market is regulated not only through market entry conditions, licensing, and transaction supervision, but also through the obligation to be transparent throughout its operations.
The peculiarities of digital assets make the need for transparency urgent: investors may be exposed to risks from price fluctuations, technological failures, security incidents, or loss of control over assets. These risks are not always fully reflected in financial statements. Therefore, in addition to information about the business and business results, transaction data, customer asset management, and operational safety have direct implications for the assessment of investment risk.
It is worth noting that the pilot framework designs reporting and information disclosure obligations according to the characteristics of each subject and activity. It is impossible to automatically apply the entire information disclosure mechanism on the traditional stock market to digital assets without corresponding legal grounds.
2. Which subjects are directly affected?
According to Article 2 of Circular 165, the obligation to report and disclose information applies to four groups of subjects, including organizations providing digital asset services; organizations that issue digital assets; organizations and individuals participating in investment and operation in the digital asset market; and other relevant agencies, organizations and individuals. However, the scope of obligations of each group is not the same.
Firstly, the organization that provides digital asset services.
Organizations providing digital asset services are a group with a wide scope of information disclosure obligations, especially for enterprises that organize market trading, depository or provide licensed digital asset services.
The obligations of this group include information on license status, business operations, financial statements, and transaction data. Businesses need to categorize each obligation to properly determine the arising event, deadline and channel of implementation.
Notably, the disclosure not only arises when the enterprise has a change in legal status or governance activities, but is also associated with transaction data and market operations.
For example, the service provider must disclose information on transaction prices, trading volumes, and other indicators for crypto assets traded on its system.
Therefore, compliance requires a system of data collection, collation and disclosure in accordance with the frequency of each obligation; it cannot be based solely on the process of preparing periodic financial statements.
Second, the issuer of the digital asset.
For issuers, the obligation to be transparent starts from the stage of preparing for the offering and continues in the process of fulfilling commitments to investors.
According to Article 11 of Circular 165, the issuer must disclose information related to the offering, issuance, offering results and changes to the digital asset or issuance conditions.
Resolution 05 sets out requirements for the underlying assets of digital assets offered for sale and issued within the pilot scope. When information about the underlying asset changes, the issuer needs to assess the impact on the published content and investors' interests. In particular, the disclosure of information about the underlying asset does not in itself prove that the investor has established a legal ownership or right to claim that asset.
Third, investors and related entities.
Investors are not subject to the same regular information disclosure obligation as service providers. However, they are directly affected by the new transparency mechanism through conditions for access to information, transactions, asset management and information requirements for market management.
For foreign investors, it is also important to assess the conditions for participation, the trading mechanism and the ability to access information in the appropriate language.
It should be distinguished that being governed by the Circular does not mean that all investors must fulfill all prescribed reporting and information disclosure obligations to service providers or issuers.
3. Notable information disclosure obligations
3.1 Information disclosure must be complete, accurate and timely
Article 4 of Circular 165 stipulates general principles on reporting and information disclosure; when applying, it is necessary to distinguish information sent to management agencies from information publicly disclosed to the market.
In particular, information must be disclosed fully, accurately, promptly and reflect the true nature of the announced events and activities. In case there is a change or need to be corrected, the subject is obliged to comply with regulations.
The requirements for the language of disclosure should be determined according to the subjects and cases stipulated by Circular 165, avoiding inferences that all types of information of all subjects must be published bilingually.
For enterprises with foreign investors or operating cross-border technology systems, this is not just a translation requirement. Businesses need to ensure consistency in content, legal terminology and time of publication between language versions.
3.2 Disclosure obligations associated with various timelines
Circular 165 distinguishes the obligations by event, periodic and by transaction activities. Each group has its own content, method and time of implementation; the reporting obligation is not always the same as the obligation to make a public disclosure.
For example, Article 7 stipulates the disclosure of information related to the issuance and revocation of licenses by service providers, with a deadline of 24 hours for specified cases. When implementing, enterprises must accurately compare the event of starting to calculate the time limit on a case-by-item basis. Article 8 stipulates periodic information disclosure, including financial information. Enterprises need to make a separate schedule for each type of report, clearly defining the reporting period, deadlines and requirements for attached documents. Article 10 covers transaction information on the crypto asset market, including indicators such as price and trading volume. The frequency of updates must be compared according to each type of information, rather than being interpreted as continuous disclosure.
Thus, businesses cannot build a single information disclosure schedule for all obligations. Each type of information needs to be individually defined in terms of trigger events, deadlines, content and method of disclosure.
3.3 Transparency of assets and trading activities
One of the notable features of the crypto asset market is the possibility of a gap between the data recorded on the technological system and the actual control over the asset.
Circular 165 uses specific concepts such as crypto-asset wallets, hot wallets, cold wallets, and proof of reserves. However, it is necessary to distinguish the fact that a term is defined with the incurrence of the corresponding public disclosure obligation.
From a risk management perspective, evidence of asset balances should be considered in conjunction with liabilities, controls, and restrictions on assets. Proof of reserves, if stood alone, does not necessarily fully reflect the ability to meet obligations to customers. This is an analytical recommendation, which should not be construed as an additional disclosure obligation outside of the provisions of the Circular.
Source: Vietnam Investment Review
4. Compliance challenges in practice
The three notable challenges are delineating internal responsibilities, validating data, and processing information when something goes wrong. They are particularly complex when operational data changes rapidly and is stored across multiple systems.
First of all, there is the distribution of responsibilities between departments. Information that must be disclosed may come from the finance, legal, technology, risk management or transaction operation departments. Without a unified coordination mechanism, businesses may not be able to detect events to be disclosed in time or disclose information that has not been fully verified.
The next challenge is that the transaction data that is automatically recorded is not automatically legally verified. For example, when the balance of customer assets on the transaction system differs from the custodial wallet data, the business must reconcile the cause, assess the impact, and determine whether there is an obligation to report, disclose or handle the incident according to regulations. Not every discrepancy automatically leads to the obligation to disclose the issue.
The third challenge is incident handling. When a cyber security incident, transaction interruption or suspected insecurity of customer assets occurs, businesses may have to simultaneously fulfill their obligations to handle incidents, report to regulators and disclose information.
If it is announced too early without verification, businesses are at risk of providing false information. Conversely, waiting until the internal investigation is completed may lead to a violation of the disclosure deadline.
5. What do businesses need to do to comply effectively?
Enterprises can organize the compliance system according to three layers of controls: determination of legal obligations; verification and approval of information; monitoring, traceability and accountability. This is the proposed governance model, not a mandatory structure according to Circular 165.
First, make a list of legal obligations.
This list should clearly state the obligator, triggering event, content, deadline, data provider, approver, receiving agency and disclosure channel. At the same time, the reporting obligation must be distinguished from the public disclosure obligation.
The list should be updated when there is a change in licenses, products, trading systems, or legal regulations; this is an operational tool, not just a list of documents to track.
Second, establish a mechanism to control information before publication.
Enterprises should adopt a minimum three-step process: the specialized department that validates the data, the legal or compliance department checks the legal requirements, and the person who has the authority to approve the disclosure. For transaction information that is automatically updated, it is necessary to add a mechanism for data reconciliation, anomaly detection, and change traces.
Third, integrate compliance into the technology system.
Instead of relying entirely on manual operations, businesses should build a deadline warning system, automatically aggregate data and store publication history.
In particular, data on transactions, depository and customer assets need to be traceable to serve checking and comparison when disputes arise or requests from management agencies.
Fourth, develop a process for disclosing information when an incident occurs.
This process should clearly define who has the authority to activate the emergency handling mechanism, who is responsible for assessing the materiality of the event, what content is immediately disclosed, and which content needs to be further verified.
Businesses also need to coordinate this process with technology risk management mechanisms, personal data protection, and cybersecurity incident response.
Fifth, periodically check and determine the responsibilities of leaders.
The responsibility for information disclosure cannot be assigned only to the legal or communication departments. The executive board needs to ensure personnel, technological resources, decentralization mechanisms and control processes so that information is verified, approved and disclosed on time.
Periodic inspections should focus on real-world situations, such as changes in license conditions, disruptions in trading systems, discrepancies in customer asset data, or changes in issuance conditions. This is also the basis for businesses to detect and fix weaknesses before they become legal violations.
Circular 165 contributes to the concretization of the transparency mechanism of the digital asset market in the pilot phase. However, compliance efficiency is not only measured by the number of reports or the speed of posting, but also by the ability to verify information and account when data, assets or transaction activities arise abnormally.
The biggest challenge for businesses is not how much more information to disclose, but in the ability to build a control system that is reliable enough to take responsibility for the information published. Transparency is therefore not only a legal obligation, but also a foundation for forming trust and sustainable development in the digital asset market.
