Update on new regulations in May 2025

Our Newsletter #34 would lead you on the following:

LEGAL UPDATE

I. Sandbox mechanism for peer-to-peer lending solutions

On 29 April 2025, the Government issued Decree No. 94/2025/ND-CP (“Decree 94”) prescribing the regulations on controlled sandbox mechanisms in the banking sector (“Sandbox”), which takes effect on 01 July 2025, with some notable contents regarding the application of Sandbox for peer-to-peer lending solutions (“P2P Lending”) of financial technology company (“Fintech Company”) as follows:

1. Conditions and criteria for P2P Lending under the Sandbox

According to Decree 94, P2P Lending may be considered for the issuance of a certificate of participation in the Sandbox if the solution meets the following criteria:

1. It is a solution involving technical and operational aspects that are not yet clearly regulated under the current legal framework;
2. It is an innovative solution that brings benefits and added value to service users in Vietnam, especially solutions to support and promote the goal of financial universalization;
3. It is a solution that has designed and built a risk management framework, limiting negative impacts on the banking system and banking – monetary – foreign exchange activities; has developed a plan on handling and overcoming risks occurring during the testing process; and has developed a plan to protect consumer rights;
4. It is a solution that has been organized to participate in the Sandbox to carry out measures to review and fully evaluate the aspects of operation and function, utility, and usefulness;
5. It is a feasible solution to be able to supply to the market after completing the testing process;
6. Having measures to determine and manage the maximum outstanding debt for a borrower under the P2P Lending provided by the organization, to report and exploit instant information about the borrower from the Vietnam National Credit Information Centre to ensure compliance with the regulations on the maximum outstanding debt for a borrower under the P2P Lending provided by the organization and the remaining maximum debt for a borrower across all P2P Lending participating in the Sanbox;
7. The disbursement and payment of debt, interest, and fees for customer transactions under the P2P Lending must be carried out through the customer’s payment account at a credit institution, foreign bank branch, or through the customer’s e-wallet at an intermediary payment service provider; and
8. Having measures to ensure that the contract term between the borrower and the lender using the P2P Lending participating in the Sandbox does not exceed 02 years.

2. Conditions and criteria for Fintech Company under the Sandbox

According to Decree 94, a Fintech Company registering for the trial implementation of P2P Lending may be considered for the issuance of a certificate of participation in the Sandbox if the solution meets the criteria specified in item I.1 and satisfies the following specific conditions:

1. It is an enterprise lawfully established and operating within the territory of Vietnam, which is neither a foreign-invested enterprise nor is undergoing division, separation, consolidation, merger, transformation, dissolution, or bankruptcy as prescribed by law;
2. The legal representative(s) and General Director(s) (Director) of the Company must be Vietnamese citizens; have no criminal record; have not been administratively sanctioned in the fields of finance, banking, an cybersecurity; are not concurrently the owner or manager of an enterprise providing financial, banking, pawn services, or multi-level marketing services; are not the owner of the rotating savings and credit association chains, associations, and guilds, or member of the Board of directors, Member’s council, Supervisory board, General director (Director), Deputy general director (Deputy director), or equivalent positions in credit institutions, foreign bank branch, or organizations providing intermediary payment services;
3. The legal representative and General Director (Director) of the Company must have at least a university degree in one of the following fields like economics, business administration, law, or information technology, and must have at least 02 years of experience in management or executive roles within the financial and banking sectors, and must not fall under any categories prohibited by law; and
4. It satisfies standards on human resources, physical facilities, and technical infrastructure for the digital platform implementing the P2P Lending, ensuring at least the following minimum requirements:
   1. The information technology system, information storage system must be located within the territory of Vietnam, must operate safely and continuously, and must have a backup technical system independent from the main system to ensure uninterrupted operation in case of incidents, especially technical or technological failures;
   2. Data, information of all customers and relevant parties must be updated, stored, and shared on a digital platform with high security, ensuring transparency and openness among participating parties, while at the same time protecting participant information from unrelated parties in accordance with the law;
   3. The information technology system must be tested and evaluated before being put into operation; and
   4. The technical staff must possess professional qualifications in their assigned fields to ensure safe and continuous operation of the system.

Note: Fintech Company participating in the Sandbox shall be responsible for ensuring the continued fulfillment of the conditions and criteria during their participation in the Sandbox.

II. Tax management for enterprises with related-party transactions

On 10 February 2025, the Government issued Decree No. 20/2025/ND-CP (“Decree 20”), amending Decree No. 132/2020/ND-CP on tax management for enterprises with related-party transactions (“Decree 132”), which takes effect on 27 March 2025, with some notable contents regarding tax management for enterprises with related-party transactions as follows:

1. Definition of related parties

Decree 20 has amended and supplemented provisions regarding parties in related-party relationships as follows:

1. An enterprise that directly or indirectly holds at least 25% of the contributed capital of the owner of the other enterprise;
2. Both enterprises have at least 25% of their contributed capital held directly or indirectly by the same third party;
3. An enterprise is the largest shareholder in terms of contributed capital of the owner and directly or indirectly holds at least 10% of the total shares of the other enterprise;
4. An enterprise guarantees or provides loans to another enterprise in any form (including loans from third parties guaranteed by the financial resources of the related party and other financial transactions of similar nature), provided that the total outstanding loans balance between the borrowing enterprise and the lending or guaranteeing enterprise is at least 25% of the contributed capital of the owner of the borrowing enterprise and accounts for over 50% of the total medium-term and long-term debt of the borrowing enterprise.
   • This provision does not apply to the following cases:
     1. The guarantor or lender is an economic organization operating under the Law on Credit Institutions and does not directly or indirectly participate in the management, control, capital contribution, or investment in the borrowing enterprise or the guaranteed enterprise as specified in points (i), (iii), (v), (vi), (vii), (viii), (x), (xi), and (xii) of section II.1.
     2. The guarantor or lender is an economic organization operating under the Law on Credit Institutions, and the borrowing or guaranteed enterprise is not directly or indirectly subject to the management, control, capital contribution, or investment of another party as specified in points (ii), (vi), and (ix) of section II.1.
5. An enterprise appoints members of the executive board or controls another enterprise, provided that the number of members appointed by the first enterprise accounts for more than 50% of the total members of the executive board or control board of the second enterprise; or a member appointed by the first enterprise has the authority to decide on the financial policies or business activities of the second enterprise;
6. Two enterprises both have more than 50% of the members of the executive board or have one member of the executive board who has the authority to decide on financial policies or business activities, appointed by the third party;
7. Two enterprises are managed or controlled in terms of personnel, finance, and business operations by individuals who have one of the following family relationships: spouses; biological parents, adoptive parents, stepparents, parents-in-law; biological children, adopted children, stepchildren of the spouse, sons-in-law, daughters-in-law; siblings sharing both parents, half-siblings, brothers-in-law, sisters-in-law of persons sharing both parents or half-siblings; paternal grandparents, maternal grandparents; paternal grandchildren, maternal grandchildren; and paternal or maternal aunts, uncles, nieces, nephews;
8. Two business establishments have a relationship of head office and permanent establishment, or both are permanent establishments of the same foreign organization or individual;
9. Enterprises are under the control of an individual through that individual’s capital contribution to the enterprises or through direct participation in the management of the enterprises;
10. Other cases in which an enterprise (including an independently accounted branch that declares and pays corporate income tax) is managed, controlled, or subject to actual decision-making by another enterprise in relation to its business operations;
11. An enterprise engages in transactions involving the transfer or receipt of a transfer of at least 25% of the contributed capital of the enterprise during the tax period; borrow or lend at least 10% of the contributed capital at the time the transaction arises during the tax period with an individual who manages or controls the enterprise, or with an individual having one of the family relationships specified in point g of this clause; and
12. A credit institution and its subsidiary, controlling company, or associate company, as defined under the Law on Credit Institutions and its amending, supplementing, or replacing legal documents (if any).

2. Role of the State Bank of Vietnam regarding related-party transactions

Decree 20 has revised the role of the State Bank of Vietnam in tax administration for related-party transactions. Specifically, within the scope of its duties and authority, the State Bank of Vietnam is responsible for the following:

1. Coordinate in providing information and data on foreign loans and repayments of specific enterprises engaged in related-party transactions, based on a list requested by the tax authority. This includes data on loan value, interest rates, interest and principal repayment schedules, actual disbursements, repayments (both principal and interest), and other related information (if any); and
2. Coordinate in providing information reported in accordance with legal regulations on related persons of members of the Board of Directors, Members’ Council, Supervisory Board, General Director (Director), Deputy General Director (Deputy Director), and equivalent positions as prescribed in the charter of the credit institution; related persons of shareholders holding 01% or more of the charter capital of the credit institution; and affiliated companies of the credit institution, based on the information and data management system of the State Bank of Vietnam, upon request from the tax authority.

3. Transitional provisions for implementation of Decree 20

In cases in which during the corporate income tax periods from 2020 to 2023, a borrowing enterprise has related-party relationships only with economic organizations operating under the Law on Credit Institutions as specified in points a and b of section II.1.(iv), and has related-party transactions subject to the regulation of Decree 132 with non-deductible interest expenses under Decree 132, then from the tax period on 2024, the following shall apply:

1. In cases in which the enterprise has no related-party relationships and no related-party transactions arise under Decree 123 and Decree 20, the portion of non-deductible interest expenses that has not been carried forward to subsequent tax periods by the end of the 2023 tax period shall be evenly allocated and carried forward to the remaining tax periods according to the regulations on the period for carrying forward interest expenses; or
2. In cases in which the enterprise has related-party relationships and related-party transactions under Decree 132 and Decree 20, the non-deductible interest expenses that have not been carried forward to subsequent tax periods shall follow the provisions of Decree 132. Specifically, these expenses will be carried forward and deducted within the following 5 years, provided that the interest expenses do not exceed the limit for each subsequent tax period.

III. Digital signature certificates

On 21 February 2025, the Government issued Decree No. 23/2025/ND-CP on electronic signatures and trust services (“Decree 23”), which takes effect on 10 April 2025, with some critical contents regarding digital signature certificates as follows:

1. Classification of digital signature certificates

According to Decree 23, the classification of digital signature certificates is as follows:

1. Original digital signature certificates of the national electronic authentication service provider are digital signature certificates that the national electronic authentication service provider granted for themselves corresponding with each trust service;
2. Digital signature certificates of trusted service providers are certificates granted by the national electronic authentication service provider to trust service providers corresponding with each trust service. These include: digital signature certificates for timestamping services, digital signature certificates for data message authentication services, and a digital signature certificate for public digital signature authentication services;
3. Public digital signature certificates are digital signature certificates granted for subscribers by public digital signature authentication service providers; and
4. Special-use digital signature certificates are electronic signature certificates granted by an agency or organization generating special-use digital signatures.

2. Contents of digital signature certificates

According to Decree 23, a digital signature certificate shall contain the following information:

1. Information about the agency or organization that grants the digital signature certificate;
2. Information about the agency, organization, or individual to whom the digital signature certificate is issued, including the name of the agency, organization, or individual; the identification code/number or digital identity of the agency, organization, or individual receiving the digital signature certificate; and other necessary information (if any);
3. The serial number of the digital signature certificate;
4. The validity period of the digital signature certificate;
5. Data for verifying the digital signature of the agency, organization, or individual to whom the electronic signature certificate is issued;
6. The electronic signature of the agency or organization issuing the digital signature certificate;
7. The purpose and scope of use of the digital signature certificate; and
8. The legal responsibilities of the agency or organization issuing the digital signature certificate.

3. Validity period of the digital signature certificate

According to Decree 23, the validity period of digital signature and digital signature certificates is as follows:

1. The validity period of the original digital signature certificate issued by the national electronic authentication service provider is 25 years;
2. The validity period of the digital signature certificate issued by the trust service providers:
   1. The digital signature certificate for timestamping services has a maximum validity period of 5 years;
   2. The digital signature certificate for data message authentication services has a maximum validity period of 5 years;
   3. The digital signature certificate for public digital signature authentication services has a maximum validity period of 10 years.
3. The validity period of a public digital signature certificate is a maximum of 3 years; and
4. The validity period of a special-use digital signature certificate, in cases in which the special-use digital signature is secured by a special-use digital signature certificate, is 10 years.

The above is not official advice from BLawyers Vietnam. If you have any questions or suggestions about the above, please contact us at info@blawyersvn.com. We would love to hear from you.

Date: 29 May 2025

Writer: BLawyers Vietnam

Legal News and Update Team

PUBLISHED ARTICLES

• 06 issues that businesses in Vietnam need to pay attention to when the Law on Data 2024 takes effect
• What conditions does the plaintiff need to understand prior to initiating a lawsuit concerning an individual labor dispute?
• Resolving disputes between two people living together as husband and wife without registering marriage
• 03 notes for resolving disputes about international sales contracts under CISG and Vietnamese law

DIGITAL AUDIO PROGRAM

• PODCAST: #23 Carbon Credit: Some prevailing legal regulations on the Carbon Credit market in Vietnam

PUBLISHED LEGAL NEWSLETTERS

• Update on new regulations in April 2025

CONTACT US

✍ Legal News and Update Team
📩 legalnews@blawyersvn.com

For Downloading:

Newsletter #34 (EN version)

Maybe you are interested in reading other Newsletters of BLawyers Vietnam: Legal Newsletter in January 2025/ Legal Newsletter in February 2025/ Legal Newsletter in March 2025