On May 15, 2025, the Government of Vietnam promulgated Decree No. 94/2025/ND-CP (“Decree 94”), introducing a regulatory sandbox mechanism for certain fintech activities in the banking and financial services sector. This legal milestone marks a pivotal step in Vietnam’s digital finance landscape. It establishes a controlled environment for the testing of innovative financial technology solutions under State Bank of Vietnam’s (SBV) supervision, while simultaneously fostering innovation and mitigating associated risks.

This newsletter offers a detailed legal analysis of Decree 94, examining its scope, eligibility criteria for participating fintech solutions, and strategic legal implications for stakeholders.

A. Legislative Background

Vietnam’s fintech sector has witnessed rapid growth, spurred by digitalization, technology innovation, and a rising demand for accessible financial services. In 2023, the market was valued at USD 33.9 billion and is projected to climb to USD 72.74 billion by 2029. By 2030, the government aims for 70% of banking transactions to be conducted digitally, reflecting both strategic policy and growing investor interest.

Despite this momentum, regulatory frameworks have struggled to keep pace with technological evolution. Legal uncertainty persists in areas such as peer-to-peer (P2P) lending, credit scoring, and Open Application Programming Interfaces (Open API)-based data sharing. The absence of licensing frameworks or risk-based supervisory mechanisms has constrained market access, while leaving consumers exposed to unregulated services.

In response, the government tasked the SBV with developing a sandbox regulatory framework. Following public consultation on a draft decree in early 2024, Decree 94 was officially issued, authorizing pilot programs for fintech solutions under regulatory supervision.

B. Objectives and Nature of the Sandbox

Under Decree 94, the sandbox mechanism aims to:

  • Facilitate innovation and modernization in the banking sector;
  • Create a pilot environment to evaluate risks, costs, and benefits of fintech solutions while reducing customer exposure to risks arising from services offered by sandbox participants; and
  • Develop and complete legal framework and regulatory instruments, drawing on insights gained from the pilot implementation of fintech solutions.

It is important to emphasize that the sandbox mechanism is not designed to replace existing legal or regulatory frameworks. Participation in the sandbox does not imply that the authorities have recognized compliance with the relevant legal or regulatory conditions required for conducting business or attracting investment. Accordingly, participants remain obligated to comply with all other applicable legal requirements beyond the scope of their approved pilot activities—including, but not limited to, obligations relating to anti-money laundering, cybersecurity, and data privacy.

C. Scope of Application

Decree 94 applies to organizations voluntarily seeking participation in the sandbox. Within this framework, participants may deploy and test fintech solutions within a defined scope, scale, and duration, all under the supervision of the SBV. All activities must take place within Vietnam, as cross-border testing is strictly prohibited.

Eligible participants include:

  • Credit institutions under the Law on Credit Institutions (excluding those engaging in P2P lending); and
  • Fintech companies (i.e., non-credit institutions), operating independently or in partnership with credit institutions within the Vietnamese market.

The permitted pilot period is up to two years, with the possibility of two extensions of one year each, subject to SBV approval.

D. Eligible Fintech Solutions

Under Article 1 of Decree 94, the sandbox mechanism will initially apply to three categories of fintech solutions: credit scoring, data sharing via Open APIs, and P2P lending. Eligible solutions must demonstrate innovation, provide added value to the customers, and contain technical and business content that have not yet been clearly regulated or guided by current Vietnamese law.

Initially, Decree 94 applies to the following fintech categories:

1. Credit Scoring

Credit institutions and fintech companies may develop and test new credit assessment tools using a wide range of data sources to evaluate the creditworthiness of individuals or businesses. These tools can enhance traditional credit assessments and expand credit access—particularly for individuals and SMEs lacking formal credit histories. The sandbox provides a valuable opportunity to test innovative credit-scoring solutions that incorporate non-traditional, alternative data sources, such as mobile usage, utility payment records, e-commerce transaction history, and digital footprints. These approaches can offer deeper insights into a borrower’s current financial profile and help detect risk factors missed by conventional methods, ultimately improving credit risk management.

Currently, banks can assess credit risk by exchanging customer data with the National Credit Information Centre of Vietnam (CIC), under direct SBV supervision. However, there are no specific regulations for non-bank credit-scoring entities. The entry of private, non-bank players is expected to strengthen the ecosystem by offering more diverse and reliable customer data sources, thereby enhancing the transparency and security of credit decisions.

2. Data Sharing via Open APIs

Decree 94 permits credit institutions and fintech companies to develop and utilize Open APIs to enable more efficient and inclusive data sharing. This approach aligns with global trends toward Open Banking, where financial data is shared with authorized third parties to promote innovation in areas such as payments, personal finance, and other banking services.

Currently, the SBV has issued Circular No. 64/2024/TT-NHNN, which regulates the implementation of Open API in the banking sector. This Circular, however, remains limited in scope, applying only to commercial banks and their affiliated entities. Meanwhile, fintech startups continue to expand rapidly, accelerating the transformation of Vietnam’s banking sector and fueling greater demand for Open Banking adoption. This model necessitates active involvement not only of traditional banks but also of fintech service providers to ensure broader access to diverse, low-cost financial services.

Against this backdrop, Decree 94 represents a critical step forward by allowing fintech companies to pilot new data exchange models using Open APIs. This initiative is expected to provide the SBV and other relevant authorities with practical insights into how Open APIs function in a real-world environment. The ultimate goal is to support the creation of a robust legal framework for Open API operations, which could serve as a key driver of Vietnam’s ongoing digital transformation—an effort strongly prioritized by the national government.

3. Peer-to-Peer (P2P) Lending

P2P lending remains unregulated in Vietnam, leaving many platforms operating in a legally ambiguous space, and the sandbox provides the first official channel to test P2P models within a regulated environment. Participants must comply with specific requirements, including:

  • Maximum borrowing limits and data sharing with the CIC;
  • Use of domestic accounts or e-wallets for fund transfers;
  • Loan terms not exceeding two years;
  • Appointment of senior management who are Vietnamese nationals with relevant experience and clean compliance records; and
  • Prohibition against offering guarantees, engaging in overlapping roles, or providing services to pawning companies.

Notably, Decree 94 excludes foreign-invested enterprises from P2P sandbox participation, regardless of foreign ownership percentage. This restriction effectively bars many well-funded, publicly listed, or foreign-backed firms from entering the sandbox in this category.

E. Application Process

Applicants must submit a dossier to the SBV, including:

  • Standard application form;
  • Organizational and management structure;
  • Business proposal and internal approval;
  • Detailed pilot plan (scope, budget, reporting, exit strategy);
  • Dossiers of key personnel;
  • Incorporation and charter documents.

The SBV evaluates applications based on:

  • Innovation and public interest;
  • Technical and financial capacity;
  • Risk management and consumer protection;
  • Market readiness post-pilot.

The SBV may consult relevant authorities and, upon approval, issue a Certificate of Participation.

F. Supervision Controls

Participation in the sandbox does not grant full market access or unrestricted business. Fintech services must remain strictly within the limits outlined in the Certificate. This rule is even more stringent for P2P lending participants, as they are required not to implement any business activities other than the ones specified in the Certificate.

The SBV retains authority to revoke Certificates under circumstances such as:

  • Failure to commence the pilot within 90 days;
  • Breach of Certificate terms; or
  • Emergence of significant risks affecting financial stability or consumer protection.

To ensure oversight, the SBV will implement:

  • Periodic and ad hoc reporting;
  • Collection of operational data from participants and relevant third parties;
  • Risk incident alerts; and
  • On-site inspections, as needed.

Conclusion

Coming into effect July 1, 2025, Decree 94 marks a pivotal advancement in Vietnam’s approach to fintech regulation. It introduces a structured, risk-based mechanism to promote innovation while maintaining systemic integrity and consumer protection. Although the sandbox does not replace formal licensing, it provides a transitional pathway for compliance and regulatory alignment. Legal practitioners and market participants are strongly encouraged to monitor further implementation guidance and legislative developments as the SBV moves forward with operationalizing the sandbox framework.