New regulations on e-banking transactions have a profound impact on business operations

Vietnamese businesses are facing an unprecedented large-scale technical "screening" when the State Bank of Vietnam (SBV) officially issued Circular 77/2025/TT-NHNN. No longer general recommendations, this new legal document sets tough "technical barriers", forcing hundreds of thousands of businesses to change the way they manage cash flows and operate accounting systems as early as Q1 2026.

Safety and security for the provision of online services in the banking industry regulations is no longer an option but an urgent requirement to ensure the smoothness of cash flow.

On December 31, 2025, the Governor of the State Bank of Vietnam signed and issued Circular No. 77/2025/TT-NHNN, amending and supplementing a number of articles of Circular No. 50/2024/TT-NHNN regulating safety and security for the provision of online services in the banking industry, which will take effect from March 1, 2026. This document was born in the context that financial crimes no longer target small individuals but have shifted their attacks to corporate accounts – where there is a large cash flow and a dense frequency of transactions. For business owners, CFOs and Chief Accountants, understanding and adapting to these regulations is no longer an option but an urgent requirement to ensure the smoothness of cash flow.

Challenges for start-ups

One of the landmark changes of Circular 77 is the designation of the target group "New Institutional Customers". According to Clause 11, Article 2, these are organizations that have been operating for less than 12 months from the date of establishment or have just established a relationship with the bank within 12 months.

Why is there this distinction? In fact, most cases of money laundering and fraudulent appropriation of assets online use "ghost" companies (shell companies) established in a short time to serve as dirty money transfer stations. To prevent this, the SBV has set up an extremely strict "filter" for this group.

Transaction threshold of 50 million VND and personnel problems

If in the past, businesses could authorize all transactions to the accounting department through a basic OTP code, now, with "New Institutional Customers", all money transfer transactions with a value of over VND 50 million (Type C1 transactions) are required to be authenticated by biometrics of the legal representative.

This regulation creates a huge operational pressure for businesses in some specific cases. This regulation also sets out that for larger transactions (over VND 1 billion - Type D1), businesses must use secure electronic signatures or combine biometrics with advanced OTP. This forces new businesses to immediately invest in enterprise digital signature infrastructure and establish a multi-layered approval process from the first day of operation dynamic.   

However, the Circular also opens up a "way out" through the exception list. Fortune Global 500 enterprises, listed organizations or state-owned enterprises will not be subject to this special supervision regulation. This invisibly creates a competitive advantage in terms of transaction processing speed for the "big players" compared to new SMEs entering the market.

Requirements for ensuring the safety of the device

Another challenge for the work habits of many businesses is the regulation of equipment safety. The SBV requires Mobile Banking applications to integrate the "Kill Switch" mechanism – automatically stop operation if the device is detected to be unsafe.

From 01/03/2026, any device that is found to be Rooted/Jailbroken will be immediately denied service by the banking application. Businesses applying the BYOD (Bring Your Own Device) policy will face a big risk: An accountant using a rooted personal phone to approve payroll transfers can cause the entire transaction to be blocked at the last minute.   

Not only rooting, enabling "Developer Options" mode or using emulators on computers is also absolutely prohibited. This is a major blow to tech businesses, where programmers often have to turn on these modes to work. They will be forced to buy "clean" equipment only for banking purposes, increasing the cost of equipment investment (CAPEX).

The inclusion of Mobile Money services in the scope of regulation and application of banking security standards shows the regulator's desire to close all loopholes in the national payment system.

New authentication matrix

Circular 77 completely restructures the classification of transactions and authentication methods, creating a matrix that businesses need time to get used to.

The concept of "Secure Electronic Signatures" is emphasized as an alternative to biometrics in high-value transactions (Type D). This is an important point that businesses need to pay attention to. Instead of relying on the face of the Director or legal representative, businesses should switch to using a Business Digital Signature (CA Token or HSM).

Order creation and mandatory approval rules

Clause 2, Article 4 stipulates that banking software for institutional customers must be designed in at least two steps: Maker and Checker. This double control rule is intended to prevent risks from the personnel in charge of the banking account of the enterprise.

Besides, the SBV also makes exceptions. If microenterprises adopt a "simple accounting mode," they are not required to separate these two steps. This is the necessary flexibility, helping more than 90% of businesses in Vietnam operate more neatly and efficiently.

To enjoy this mechanism, enterprises must prove their micro-scale (less than 10 employees, revenue of less than 3 billion or 10 billion depending on the field). This requires close coordination between the accounting department and the bank to update the identification records for the right group of subjects.

Challenges for FDI and Biometric barriers

A major "bottleneck" that Circular 77 creates is in the group of foreign-invested enterprises (FDI). As a rule, biometrics are mandatory for category C and D transactions for new institutional clients.

The problem lies in the fact that, currently, the National Population Database (VNeID) currently mainly serves Vietnamese citizens with chip-attached citizen IDs. Foreigners use a Passport without a compatible chip to perform NFC authentication on the phone.

This means that foreign General Directors will have difficulty approving transactions remotely. The current solution is that they have to go to the counter to collect biometrics" at the counter and this data is only valid internally in that bank, there is no interconnection.

What do businesses prepare before the regulations officially take effect?

The time 01/03/2026 is approaching. To avoid the scenario of cash flow being frozen due to not meeting security standards, businesses need to reconsider the following issues:

Check the device: Review  all phones and tablets that are being used by the Chief Accountant and Director to install the banking app. Require a factory reset if it is detected that the device has been subjected to software interference. Consider equipping specialized equipment only for banking transactions.

Upgrade the authentication method: Businesses immediately register a business digital signature (if they do not already have one) and integrate it into the e-banking system. This is an essential device to help businesses overcome most transaction limitations without relying too much on personal biometrics.   

Standardize legal documents: For businesses that are about to be established or under 12 months old, it is necessary to be psychologically prepared for tight control. Please make sure your Legal Representative is available to perform biometric authentication.

Take advantage of microbusiness status: If you qualify as a micro-enterprise, you should work with your bank to formally confirm this status in order to streamline operational processes.

Circular 77 is more than just a mere technical update. It represents the management agency's "Zero Trust" management mindset[1] . In particular, the inclusion of Mobile Money services in the scope of regulation and application of banking security standards shows the regulator's desire to close all loopholes in the national payment system. While there will be embarrassments and costs incurred in the short term, in the long term, this is the foundation for building a transparent business environment where genuine businesses are protected from increasingly sophisticated scams and money laundering. The initiative to adapt from today will be the competitive advantage of businesses when the new "rules of the game" officially start in the near future.