Vietnam Decree 382/2026/ND-CP on Fintech Sandbox: 7 Decisions for Investors

Vietnam is gradually opening up to new fintech products through a pilot program in the banking sector. Approved businesses can test certain products under the supervision of the State Bank of Vietnam (SBV). The authorities can then learn from the results before developing further rules.

This is a learning process for both businesses and the authorities. Investors need patience, but they also need a plan for the money they will spend, the information they will share and the commitments they will make while approval remains uncertain.

Decree 382/2026/ND-CP, effective October 6, 2026, amends the banking sandbox established under Decree 94/2025/ND-CP. It makes parts of the application process easier, including the use of official records and more flexible qualification requirements for management. These changes do not remove the need to check whether the proposed business is eligible.

Why Vietnam is Using a Fintech Sandbox

A sandbox is a limited trial under regulatory supervision. It gives the authorities a way to study new services, their benefits and their risks. The aim is to encourage useful innovation and improve access to financial services while protecting customers and the banking system.

For a business, the trial is an opportunity to test a product within an agreed scope. It is not a promise of funding or a permanent license. A Vietnam market entry strategy should therefore explain what the company wants to learn from the trial and what it will need before expanding.

Quick Reference

The sandbox covers selected activities, not every new financial product. Investors should check the product, ownership and role of the Vietnamese company. Restrictions on foreign-invested peer-to-peer (P2P) lending businesses can determine whether the proposed investment is possible.

The application should show a useful product, a capable team and a credible way to protect customers. Funding needs to cover preparation, regulatory review and the trial, with room for changes or delays. A review deadline should not be treated as a guaranteed commercial launch date.

Intellectual property (IP) ownership, confidentiality, data use and partners’ responsibilities should be settled before the company shares sensitive material or makes firm commitments. The trial also needs a plan for what happens if approval is refused, testing stops or wider operation is not yet permitted. Successful testing does not automatically produce a permanent license.

Vietnam Decree 382/2026/ND-CP on Fintech Sandbox: 7 Decisions for Investors

The Product Should Fit the Program Before the Business Expands

The framework covers credit scoring, data sharing through Open Application Programming Interfaces, usually called Open APIs, and peer-to-peer lending, or P2P. It is not a general route for every payment app or online financial service.

A credit-scoring tool might help a bank assess a small business using information it may lawfully access. An Open API service might connect permitted bank information with a company’s accounting software. A P2P platform connects lenders and borrowers rather than lending its own money. These examples explain possible models; they are not examples of SBV-approved products.

The team needs to explain what is new and which part of the service is not clearly covered by existing rules. It should also consider its actual role. Supplying software to a bank is different from providing a financial service directly to customers. That distinction should be examined before choosing the sandbox route or committing to a full local operation.

Ownership and the Local Company Should Be Planned Together

A fintech-company applicant must be legally established and operating in Vietnam. An overseas company cannot rely only on its foreign registration, and a foreign founder cannot apply personally. Incorporation and permission to test the product are separate steps when starting a business in Vietnam.

The proposed product also affects foreign ownership and market access in Vietnam. P2P applicants must not be foreign-invested enterprises, and their legal representative and chief executive must be Vietnamese nationals. An offshore holding company does not remove those restrictions. Credit-scoring and Open API proposals need their own market-access assessment.

An information technology (IT) business registration allows the company to carry out its lawful technology activities. It does not, by itself, authorize a regulated financial service or a sandbox trial. The business lines should reflect the company’s actual work, rather than be treated as a way around financial regulation.

Founders should also agree who controls the product, who approves spending and who deals with the regulator. A local partner needs a defined role. The joint venture governance arrangements should address changes to the trial and a possible closure, not only profit sharing. A partnership cannot be used to avoid ownership restrictions.

The Application Should Explain Why the Product Can Be Tested Safely

The selection criteria concern the gap in existing rules, the benefit to users, the control of risks, prior assessment of the product and the plan after testing. A persuasive application connects these subjects rather than treating them as separate documents.

For credit-scoring and Open API applications, the product description must include a simulation model or demonstration, identify the intended customers and explain how the system meets the security requirements that apply to it. The business should also explain how it will handle errors, complaints and system failures. For example, a credit-scoring tool should explain what happens when its result is wrong.

The same applies to personal data protection and cybersecurity compliance in Vietnam. Management should know where customer information comes from, why the company may use it, who can access it and how a leak would be handled. These questions belong in the product design, not only in a privacy notice prepared before launch.

The team should be ready to explain these choices clearly to the SBV. A strong presentation cannot replace evidence, and meeting the published criteria does not make admission automatic.

Funding Should Support the Trial Without Assuming Early Revenue

The funding plan should show how the company will pay for the trial and meet its obligations. People, systems and available funds need to match the work proposed. Any separate financial requirements for the company’s activities must also be checked.

A startup may be suitable when it has a product that can be demonstrated and a team able to manage the work. An idea alone is not enough. Sandbox admission does not automatically bring government funding, and revenue should not be assumed before the service may lawfully operate.

The capital strategy for entering Vietnam should cover preparation, review, testing and the cost of stopping if necessary. Investors may choose to release further funding when agreed conditions are met, while respecting the company’s legal capital obligations. Those conditions could include approval to begin testing, confirmation of a bank partnership or evidence that a technical problem has been resolved.

The board should know how long the available funds can support the project without customer income. Further hiring, supplier contracts and expansion should be reviewed against that position. This is a funding decision for management, not an additional admission test imposed by the sandbox rules.

Regulatory Timing Should Shape Spending and Contracts

The SBV’s acceptance of a complete application is different from approval to start testing. Review periods also need to be read with their starting points and any excluded time. The company should confirm the current procedure rather than use a statutory period as its promised launch date.

Submission records, written acknowledgments and requests for more information should be kept together. They help the company understand where the application stands and follow up on a delay. The team should be ready to explain the product, but should not assume that the process guarantees repeated workshops or informal approval in advance.

The Vietnam market entry risk assessment should address a delayed decision, a request to change the proposal and a refusal. Management should decide who follows up with the authority and when the board will reconsider further spending. Bank agreements, hiring plans and customer commitments should allow for these possibilities where commercially possible.

A missed deadline does not itself permit the company to launch. Patience is easier to justify when directors can see the outstanding questions, the money already committed and the choices still available.

IP Protection Should Be Settled Before Detailed Disclosure

Copyright can protect software code and written material, but it does not give ownership of the underlying business idea. A review of intellectual property in Vietnam should identify what the company owns, what it licenses and what must remain confidential.

Founders should settle rights in work created by employees and contractors before presenting the product. Possible patent protection should be assessed before public disclosure. Access controls, records of what has been shared and suitable confidentiality agreements with staff and partners also help protect valuable information.

The regulatory application should identify sensitive material and request appropriate handling. The applicant must still provide information the SBV lawfully requires. It should not assume that the authority will sign a commercial confidentiality agreement or that a confidentiality label alone provides sufficient protection.

An overseas company in the group may license its IP to a Vietnamese company. The license itself does not create patent or trademark protection in Vietnam. For an international application under the Patent Cooperation Treaty (PCT), PCT national phase entry in Vietnam is a separate part of seeking local protection. The group should also agree who owns improvements developed during the trial and who may use them after it ends.

The Trial Needs a Plan for Both Continuation and Closure

Testing must stay within the approved scope and limits. Agreements with customers, banks and technology providers should reflect the trial’s temporary nature. They should identify who handles complaints, protects information and responds to incidents.

An overseas parent company or cloud provider may also need access to data. That access requires a separate legal assessment; sandbox admission does not remove privacy or data obligations. Responsibility should be clear even when several businesses contribute to the service.

The contracts should explain what happens if the trial changes or stops. Customer commitments, unpaid amounts, access to systems and the handling of data should not be left unresolved. The company should avoid promising long-term service that its current permission cannot support.

Successful testing does not automatically lead to a permanent operating license. Further operation depends on the applicable rules and regulatory decisions. Investors should assess the business on the rights it actually has, while treating wider permission as an uncertain future outcome rather than an assured part of its value.

Frequently Asked Questions About Vietnam Decree 382/2026/ND-CP on Fintech Sandbox

Q1: Is the sandbox only for large fintech companies?

The framework does not set a general company-valuation threshold. A smaller business still needs to meet the entry conditions and have the team, product and funding to run the trial. Size alone does not show whether it is ready.

Q2: Can a company start operating while its application is being considered?

An application is not permission to begin the proposed trial. Lawful technology-development work should be distinguished from testing or providing a regulated financial service. The company should establish that boundary before dealing with customers.

Q3: Does simpler paperwork remove the need for internal approval?

No. Decree 382 removes the requirement to include the company’s internal resolution approving the proposal in the application. This does not remove any approvals required under company law, the company’s charter or shareholder agreements. The company should confirm who has authority to approve the trial, its budget and the arrangements for stopping it.

Conclusion

Vietnam is making room for fintech testing while the authorities learn from the results. Decree 382 makes parts of the process easier, but it does not remove the need for careful investment decisions.

Before committing more money, investors should understand who may apply, what the company may test, what information it must share and what happens if the project cannot continue. Clear ownership, suitable contracts and a realistic funding plan allow the business to participate without treating approval or future expansion as certain.