Circular No. 36/2012/TT-NHNN dated December 28, 2012 of the State Bank of Vietnam on the installation, management, operation, and security of automated teller machines

CIRCULAR

ON THE INSTALLATION, MANAGEMENT, OPERATION, AND SECURITY OF AUTOMATED TELLER MACHINES

Pursuant to the Law on the State bank of Vietnam No. 46/2010/QH12 dated June 16^th2010;

Pursuant to the Law on credit institutions No. 47/2010/QH12  dated June 16^th2010;

Pursuant to the Law on Electronic transaction No. 51/2005/QH11 dated November 29^th2005;

Pursuant to the Government s Decree No. 35/2007/NĐ-CP dated March 08^th2007 on the electronic transaction in banking;

Pursuant to the Government s Decree No. 96/2008/NĐ-CP dated August 26^th2008, defining the functions, tasks, powers and organizational structure of the State bank of Vietnam;

At the proposal of the Director of the Department of Payment;

The Governor of the State bank of Vietnam issues a Circular on theinstallation, management, operation, and security of automated teller machines (ATM),

Article 1. Scope of regulation

This Circular deals with the requirements, procedures, and responsibility for the installation, management, operation, and security of ATMs.

Article 2. Subjects of application

This Circular is applicable to the providers of payment services that have ATMs (hereinafter referred to as providers of payment services) ant the organizations relevant to the installation, management, operation, and security of ATMs.

Article 3. The requirements of providers of payment services that install the ATM system for the first time

1. Formulate the scheme for the installation, operation, maintenance, and supervision of ATMs, ensuring:

a) Sufficient infrastructure, reserve system, management software that ensure the smooth, stable, and safe operation of ATMs.

b) The internal regulations on the information security, operation process, risk management, maintenance, control, and supervision of the operation of the ATMs.

c) Adequate human resources that are competent, sufficient, and moral in order to safely and efficiently manage and operate the ATMs.

2. Plan and arrange the ATM network reasonably in order to satisfy the demand for cash withdrawal of customers.

3. Formulate and issue the regulations and instruction to use the services provided by the ATMs.

4. The providers of payment services that install the ATM system for the first time must send the schemes prescribed in Clause 1, Clause 2, and Clause 3 this Article to the State bank of Vietnam (via the Department of Payment) at least 15 days before the commencement date.

Article 4. The regulations on the installation, the change of locations, and the termination of ATMs

1. The ATM locations must be convenient, have enough light, be safe for the customers that make transaction at the ATM.  The electricity at the ATM booths and the ATMs must satisfy the national standards of electrical safety. The ATM must have a backup power supply in order to avoid customers’ cards being held when the primary power supply is cut.

2. During the installation, the providers of payment services must send reports on the change of the location (within the same locality) or the ATM suspension using the form No. 01 in the Annex enclosed with this Circular to the branches of the State bank in of the central-affiliated cities and provinces where the ATM are installed (hereinafter referred to as branches of foreign banks) 15 working days before the commencement.

3. The local branches of foreign banks must issue a written confirmation about the installation, change of locations, or suspension of the ATM (using the form No. 2 in the Annex enclosed with this Circular) within 05 working days from the date on which the written report form the provider of payment services is received.

4. If the ATMs are moved to another province or city, the providers of payment services shall register the suspension of the ATMs in the old locality in order to register the installation in the new locality.

5. The providers of payment services must update the information about the installation, change of locations, or suspension of the ATMs on their official websites.

Article 5. The regulations on the management and operation of the ATMs

The providers of payment services must:

1. Ensure that the ATM system serves their customers 24 hours every day and 7 days every week.

2. Appoint employees to repair the inoperative ATMs as soon as possible. The customers and the local branches of foreign banks must be notified of the ATMs that have stopped working for more than 24 hours.

3. Maintain the customer care department 24 hours per day and 7 days per week in order to serve their customers anytime.

4. Cooperate with other switching organizations to ensure that the inter-bank ATM transaction are continuous and safe.

5. Monitor the cash fund of the ATM, ensure that the ATMs always have cash to satisfy the demand for cash withdrawal of customers.

If the ATMs are located in the urban areas that have the cash-supplying units of the providers of payment services, the providers of payment services must supply cash for the ATM so that the no-cash period of the ATMs does not exceed 04 working hours, or not exceed 01 days if the cash is depleted after-hours. In other cases, the providers of payment services must supply cash in order to ensure that the ATMs are not depleted more than 08 working hours, or not 01 day if the cash is depleted after hours.

6. Monitor, discover, resolve the failed transactions, and handle the transactions accurately. Promptly provide compensations for customers if the providers of payment services’ failures, mistakes, or accidents causes damage for customers.

7. Receive, resolve, or settle the complaints or requests for checking from customers. For about the internal ATM transactions, the time limit for checking, settling complaints, and giving answers to customers is 05 working days as from the date on which the complaints are received. For the inter-bank ATM transactions (except for international transactions), the time limit for checking, settling complaints, and giving answers to customers is 07 working days as from the date on which the complaints are received.

Article 6. The specific requirements of the ATMs

1. The ATMs must have instructions or symbols to identify the acceptable cards, names of numbers of the ATMs, the phone numbers of the support department and the ATM managers.

2. There must be instructions about the use of ATM; the introduction on the ATM services; the relevant fees; the risks and risk prevention measures when using ATMs; the phone numbers and address to contact when the transactions are failed; the procedure and time limit for checking upon the request.

3. The ATMs must have symbols showing how to put the card in.

4. The ATM interface must be displayed at least in Vietnamese and English.

5. The ATM bills must be clear and legible, printed in Vietnamese or English depending on the choices of the customers. The bill must at least show: the name of the payment service provider that installs the ATM, the name or number of the ATM, the type, number, date, and time of the transaction, the transacted amount, transaction fee, and the balance (applicable to the internal transactions).

6. The customers must be reminded to take their cards or cash after the ATM transaction. If the ATM is set up to give money after the card is returned, the payment service provider must instruct the customers to wait for a certain period of time to receive the money after the ATM returns their card, in case the cash is delayed because of the slow connection.

7. The providers of payment services must not impose the cash withdrawal limits lower than 2 million VND.

8. The ATMs must record all transactions and relevant information for checking, testing, and resolving disputes.

The ATM logs must be legible. The information in the ATM log must include: the name of number of the ATM; the card number, the transaction code, the date and time of transaction, the transacted amount; the amount of each denomination. When the transaction is successful, the log must show that cash has been given by the machine.

The transaction data and log must be kept as prescribed by law.

Article 7. The regulations on the safety and security of ATM transactions

The providers of payment services must:

1. Comply with the current regulations on the safety and security of the information technology system in banking activities. Keep the data and information of customers confidential during the processing, transmission, and storage of data.

2. Install monitoring cameras and devices to keep the ATM information from being copied or steal within 06 months from the date on which this Circular takes effect.

Keep the pictures captured by the cameras for at least 100 days. When it is necessary to carry out inspection to serve the investigation of the police, such pictures must be provided and keep according to the period of keeping the complaint dossiers of customers.

3. Assign people to supervise and guard the ATMs.

4. Take measures for securing the PIN numbers, or preventing the PIN numbers from being copied or stolen when customers are entering the PIN numbers at the ATM.

5. Regularly monitor and supervise the ATM transactions, and notify the customers of the transactions that are suspected of fraudulence.

6. Provide and encourage the use of services of controlling the transactions and account balance (such as SMS banking and internet banking services) in order to help customers supervise their own accounts.

7. Provide information and cooperate with the police and relevant organizations in the prevention of ATM crimes. Investigate and handle the high-tech crimes, ATM theft, robbery, and vandalism.

8. The providers of payment services shall make agreements and cooperate in sharing information about the ATM crimes in order to promptly and efficiently take preventative measures.

Article 8. The regulations on the inspection and maintenance of the ATMs

The providers of payment services must:

1. Formulate and implement the plans for periodically inspecting and maintaining the ATMs.

2. Ensure the safety for the ATM and the cash therein during the maintenance.

3. Pay attention to the electrical safety, the prevention of fire and explosion during the inspection and maintenance of the ATMs. Find and remove the devices that are illegally installed in order to steal the card information.

4. The inspection and maintenance of ATM must be recorded in writing.

Article 9. The regulation on mobile ATMs

1. Mobile ATMs are the ATMs that are able to be regularly or periodically moved to one or some locations to serve customers within a certain period of time.

2. The dossier of application for deploying mobile ATMs.

In order to deploy a new mobile ATM, the provider of payment services shall send a dossier of application for deploying a mobile ATM to the State bank of Vietnam (via the Department of Payment), including:

a) A written request for the State bank’s approval for deploying the mobile ATM.

b) The scheme for the installation, operation, maintenance, and supervision of mobile ATM.

c) The internal regulations on the information security, operation process, risk management, maintenance, control, and supervision of the operation of the mobile ATM.

3. Within 30 days from the date on which the complete dossier is received as prescribed in Clause 2 this Article, according to the policy on the orientation of the development of mobile ATMs in each period, the State bank of Vietnam shall issue a written approval or disapproval of the deployment of the mobile ATM; the disapproval must be explained in writing.

4. The provider of payment services only deploys the mobile ATM within the licensed scope.

5. The provider of payment services must ensure the safety of the equipment and the wireless connection.

6. The providers of payment services shall take measures to prevent the fake mobile ATMs, and guide their customers to identify the real one.

Article 10. Information and reports

1. The providers of payment services and branches of foreign banks must make reports in accordance with the regime for reporting and statistics of the State bank of Vietnam, and at the requests from competent agencies as prescribed by law.

2. The providers of payment services shall report the upgrade of the ATM system, the unusual issues that may entail risks and vulnerability of their ATM systems and that of other providers of payment services to the State bank of Vietnam (via the Department of Payment).

Article 11. The responsibility of the units affiliated to the State bank of Vietnam

1. The Department of Payment shall consider and cooperate with relevant units in inspecting the compliance with the requirements during the first installations of ATM systems as prescribed in Article 3 of this Circular, and give opinions when a provider of payment services fails to satisfy such requirements, receive the reports on the operation of the ATM system, cooperate with the police and relevant organizations in ATM crime prevention; send quarterly reports on the general status to the management board of the State bank, and send irregular reports upon the occurrence of unusual events.

2. The banking inspection and supervision agencies shall inspect the compliance with this Circular of the providers of payment services, handle the violations, and send reports to the Department of Payment.

3. Local branches of foreign banks where the ATMs are located shall:

a) Certify the registration for the installation, the change of locations, and the suspension of the local ATMs of the providers of payment services.

b) Inspect, supervise, and handle the violations related to ATM activities locally: inspect all or some local ATMs periodically or when necessary, make ATM inspection records (using the form No. 3 in the Annex enclosed with this Circular). Request the providers of payment services to suspend the operation of the ATMs that fail to satisfy the conditions prescribed in this Circular, and take measures for resolving and handling the violation.

c) Report the difficulties and issues to the State bank Vietnam (via the Department of Payment) for resolving in cooperation.

Article 12. Effect

This Circular takes effect on March 01^st2013.

Article 13. Implementation organization

The Chief officers, the Director of the Department of Payment, Directors of relevant units affiliated to the State bank of Vietnam, the Directors of branches of foreign banks in central-affiliated cities and provinces, General Directors (Directors) of the providers of payment services, relevant organizations and individuals are responsible for the implementation of this Circular.