Circular 53/2026/TT-NHNN on safety requirements, risk management for AI systems in banking sector

CIRCULAR

Prescribing safety requirements, risk management and deployment conditions for the application of artificial intelligence systems in the banking sector

Pursuant to Law No. 46/2010/QH12 on the State Bank of Vietnam;

Pursuant to Law No. 32/2024/QH15 on Credit Institutions, as amended and supplemented by Law No. 96/2025/QH15;

Pursuant to Law No. 134/2025/QH15 on Artificial Intelligence;

Pursuant to the Government’s Decree No. 142/2026/ND-CP detailing a number of articles and measures for organising and guiding the implementation of the Law on Artificial Intelligence;

Pursuant to the Government’s Decree No. 26/2025/ND-CP defining the functions, tasks, powers and organisational structure of the State Bank of Vietnam, as amended and supplemented by the Decree No. 198/2026/ND-CP;

Pursuant to the Prime Minister’s Decision No. 33/2026/QD-TTg promulgating the List of High-Risk Artificial Intelligence Systems;

At the proposal of the Director of the Information Technology Department;

The Governor of the State Bank of Vietnam promulgates the Circular prescribing safety requirements, risk management and deployment conditions for the application of artificial intelligence systems in the banking sector.

Chapter I

GENERAL PROVISIONS

Article 1. Scope of regulation and subjects of application

1. Scope of regulation

a) This Circular prescribes safety requirements, risk management and deployment conditions for the application of artificial intelligence systems to make decisions or support decision-making in the banking-sector operations involving the provision of services to customers (below referred to as operations), including:

(i) Banking activities and other business activities of credit institutions and foreign bank branches;

(ii) Provision of intermediary payment services by intermediary payment service providers;

(iii) Credit information activities of credit information companies;

(iv) Provision of mobile money services by mobile money service providers.

b) The application of the provisions of this Circular is encouraged for artificial intelligence systems serving internal governance and administration activities and artificial intelligence systems being deployed within the framework of regulatory sandboxes in accordance with the law on artificial intelligence and other relevant laws;

c) Services provided by third-party artificial intelligence systems that are used as personal support tools without being integrated into the business processes or information systems of the subjects specified in Clause 2 of this Article are not governed by this Circular.

2. Subjects of application

This Circular applies to credit institutions, foreign bank branches, intermediary payment service providers, mobile money service providers, credit information companies, the Vietnam Asset Management Company, the National Banknote Printing Plant, and the Deposit Insurance of Vietnam (below collectively referred to as units).

Article 2. Interpretation of terms

In this Circular, the terms below are construed as follows:

1. Artificial intelligence system lifecycle means a sequence of successive and iterative stages throughout the existence of an artificial intelligence system, including design, development, testing, deployment, operation and discontinuation of use of the system.

2. Model extraction means an act of exploiting the interface, outputs or interaction mechanisms of an artificial intelligence system to infer or unlawfully copy the structure, parameters or operational logic of an artificial intelligence system model (below referred to as model) for the purpose of creating a new model resembling the original model.

3. Evasion attack means an act of intentionally perturbing input data during the operation stage to deceive an artificial intelligence system into incorrectly classifying the nature of the data, thereby producing erroneous, inaccurate results or results inconsistent with the original design purpose.

4. Prompt injection means an act of inserting or manipulating input content in an artificial intelligence system using a large language model to bypass safety control constraints and cause deviations in the system's behavior or outputs.

5. Privacy leakage means an act of exploiting vulnerabilities in an artificial intelligence system to unlawfully extract or collect data of organisations or individuals, or cause such data to be leaked or disclosed.

6. Model drift means a phenomenon in which the performance of an artificial intelligence system model deteriorates over time due to changes in the relationships between input data variables and predicted outputs compared to the initial training stage, or due to data drift.

7. Data drift means a phenomenon in which the statistical distribution or characteristics of input data or actual operational data change compared to the data used for training or testing the model, thereby posing a risk of deviations in processing results.

8. Explainability means the ability to provide information, reasoning or evidence that enables humans to understand the causes or influencing factors leading to a specific output or decision of an artificial intelligence system.

9. Significant change to an artificial intelligence system means a change falling into any of the cases requiring conformity reassessment as specified in Clause 1, Article 13 of the Government's Decree No. 142/2026/ND-CP dated April 30, 2026, detailing a number of articles and measures for organising and guiding the implementation of the Law on Artificial Intelligence.

10. Competent authority of a unit means its Board of Directors, Members' Council or an organisation or individual with equivalent authority (below collectively referred to as the senior governing body); its legal representative or authorised representative (below collectively referred to as the lawful representative); or a person to whom the senior governing body or lawful representative has delegated powers or granted authorisation in writing to perform one or more functions or tasks of the unit.

11. Representative means the at-law representative or guardian of an individual who opens a payment account, card, e-wallet or mobile money account in accordance with relevant laws.

12. Third party means an individual or organisation (excluding foreign credit institutions and members of foreign credit institutions in cases where the organisation is a dependent unit or commercial presence in Vietnam of a foreign credit institution) that has entered into a written agreement with a unit to provide digital technology services.

13. Outsourcing means an arrangement under which a unit enters into a written agreement to engage a third party to perform part or all of the activities involving the application of artificial intelligence systems.

Article 3. Principles for the application of artificial intelligence systems in the banking sector

1. The application of artificial intelligence systems shall comply with the law on artificial intelligence, the law on cybersecurity, the law on data, the law on personal data protection, and the State Bank of Vietnam's regulations on risk management.

2. The application of artificial intelligence systems shall be managed in a manner commensurate with their risk levels and based on the results of assessments of their impacts on operations, customers' rights and interests, and the safe operation of information systems.

3. Artificial intelligence shall not replace human authority and responsibility. Units shall be responsible before the law and to customers for all decisions made or decision-making support provided by artificial intelligence systems on which they rely to provide services to customers. Units may not invoke reasons relating to the technical characteristics or autonomy of artificial intelligence systems, or results provided by third parties, to deny, disclaim or mitigate their legal liability, management responsibility or liability for compensation for damage, except where exemptions are provided by law.

4. Artificial intelligence systems shall be designed, deployed and operated in a safe and reliable manner, ensuring information system security, data safety and continuity of banking operations.

5. Artificial intelligence systems shall be designed to ensure the possibility of human supervision and intervention during their use, commensurate with their risk levels, and to ensure that the systems operate accurately in accordance with the units' objectives.

Article 4. Classification of artificial intelligence systems by risk level

1. Before deploying an artificial intelligence system, a unit shall classify the system as high-risk, medium-risk or low-risk in accordance with the law on artificial intelligence and Clause 2 of this Article.

2. Units shall identify high-risk artificial intelligence systems based on the List of High-Risk Artificial Intelligence Systems promulgated by the Prime Minister, under which high-risk artificial intelligence systems in the banking sector shall be identified as follows:

a) An artificial intelligence system that automatically conducts electronic transactions in banking activities shall be classified as a high-risk artificial intelligence system if it conducts at least one of the following types of transactions:

(i) Payment transactions of individual customers with a value exceeding VND 10 million, or where the total value of transactions automatically conducted by the artificial intelligence system for an individual customer in a day exceeds VND 20 million;

(ii) Payment transactions of organisational customers with a value exceeding VND 50 million, or where the total value of transactions automatically conducted by the artificial intelligence system for an organisational customer in a day exceeds VND 100 million;

b) An artificial intelligence system that automatically makes credit extension decisions shall be classified as a high-risk artificial intelligence system if it processes a credit extension of VND 50 million or more.

3. The results of the classification of artificial intelligence systems shall be approved by the competent authority of the unit. For foreign bank branches, the approval competence shall be determined in accordance with the regulations of their parent banks.

4. Units may adopt the classification results of providers in accordance with the law on artificial intelligence. In cases where modifications, integration or changes to the functions of an artificial intelligence system give rise to new or higher risks, units shall coordinate with providers in reclassifying the system.

5. Units shall establish a list of artificial intelligence systems and review and update it at least annually. The list shall contain at least the following information: name of the artificial intelligence system, risk level, purpose of use, provider, version, and written document approving the risk level.

Article 5. Conditions for automation and human control of artificial intelligence systems

1. The automated execution of decisions proposed by artificial intelligence systems shall only be permitted when the following conditions are met:

a) The operations in which artificial intelligence systems are applied are not subject to legal requirements for human review, decision-making or approval;

b) The models have undergone testing and assessment and met the quality thresholds prescribed by the units' internal regulations;

c) Units have clearly defined risk thresholds, warning criteria and procedures for supervising the operation of artificial intelligence systems. For high-risk artificial intelligence systems, units shall establish tools for continuously monitoring their operation;

d) The possibility of human intervention is ensured in accordance with Clause 2 of this Article;

dd) The operational results of the systems shall be reviewed and reported in accordance with Clause 6, Article 12 of this Circular;

e) The possibility of identifying whether transactions are automatically conducted by artificial intelligence systems or performed by humans is ensured;

g) In cases where units deploy artificial intelligence systems to automatically conduct payment transactions, such units shall meet the following requirements:

(i) Customers and units shall enter into agreements permitting artificial intelligence systems to automatically conduct payment transactions. When entering into such agreements, units shall check, compare and verify customer identification information, ensuring that the agreements are entered into by the payment account, card, e-wallet or mobile money account holders themselves, or by the representatives of individual customers, or by the legal representatives or authorised representatives of organisational customers. In cases where agreements are entered into by electronic means, verification shall be conducted at least by matching biometric information combined with another form of authentication prescribed in Circular No. 50/2024/TT-NHNN of the Governor of the State Bank of Vietnam prescribing safety and security for the provision of online services in the banking sector, as amended and supplemented by Circular No. 77/2025/TT-NHNN (below referred to as Circular No. 50/2024/TT-NHNN). The agreements shall clearly specify: the scope of transactions permitted to be conducted automatically; transaction limits for each transaction and per day; validity periods; conditions for suspension; customers' right to terminate the agreements at any time; and units' responsibility to immediately comply with requests for termination;

(ii) The total value of transactions automatically conducted by artificial intelligence systems for a customer in a day shall not exceed the limits prescribed by the units' internal regulations, and shall not exceed VND 100 million for individual customers or VND 500 million for organisational customers;

(iii) Tools shall be provided to enable customers to proactively suspend or revoke the authorisation for artificial intelligence systems to automatically conduct payment transactions;

(iv) Within the scope of the confirmed agreements, transactions automatically conducted by artificial intelligence systems shall not be subject to transaction confirmation requirements specified at Points a and c, Clause 1, Article 10 of Circular No. 50/2024/TT-NHNN, and the values of such transactions shall not be included in T and T_ksth as prescribed in Appendices 01 and 03 promulgated together with Circular No. 50/2024/TT-NHNN;

h) In cases where units deploy artificial intelligence systems to automatically make credit extension decisions, they shall comply with the provisions of law on lending by electronic means.

2. Units shall establish supervision mechanisms and ensure the possibility of human intervention commensurate with the risk levels of artificial intelligence systems, in which:

a) The department responsible for supervising artificial intelligence systems shall have sufficient authority and competence to:

(i) Override, modify or suspend decisions made by artificial intelligence systems, or activate an emergency shutdown mechanism to stop or isolate the systems where necessary;

(ii) Intervene in necessary situations to ensure the safety of operations, customers' rights and interests, and the operation of information systems;

b) All interventions, modifications or overrides of decisions made by artificial intelligence systems shall be fully recorded, including at least: actions taken, time of execution, person performing the actions, and reasons for intervention.

3. Personnel involved in supervising, controlling and intervening in artificial intelligence systems shall be trained and possess appropriate competencies to supervise, detect deviations, implement or activate intervention measures, and promptly handle cases where artificial intelligence systems operate incorrectly.

Chapter II

SAFETY ASSURANCE REQUIREMENTS FOR THE APPLICATION

OF ARTIFICIAL INTELLIGENCE SYSTEMS

Article 6. Ensuring the safety of artificial intelligence systems

1. Artificial intelligence systems shall undergo cybersecurity examination and assessment before being put into official operation, periodically or immediately upon any significant change to the systems, covering at least the following:

a) Examination and assessment of measures for preventing and countering attack scenarios and risks specific to artificial intelligence systems, including at least:

(i) Privacy leakage;

(ii) Data poisoning attacks, model poisoning attacks, evasion attacks and model extraction (mandatory for high-risk artificial intelligence systems and encouraged for other artificial intelligence systems);

(iii) Prompt injection, risks of generating inaccurate or factually unsubstantiated content, and risks of bias in outputs (for generative artificial intelligence systems);

b) For high-risk artificial intelligence systems or medium-risk artificial intelligence systems that make decisions in operations, measures shall be applied to prevent and counter risks, vulnerabilities and cyberattacks in accordance with international standards and practices such as OWASP (OWASP Machine Learning Security Top Ten for machine learning systems, OWASP Top 10 for Large Language Model Applications for systems using large language models; the applicable OWASP version shall be the latest version or the version closest to a version released within six months) or equivalent standards and practices;

c) The intervals between periodic cybersecurity examinations and assessments shall be appropriate to the cybersecurity level of the artificial intelligence systems in accordance with the law on cybersecurity;

d) The results of cybersecurity examination and assessment and remedial measures shall be documented and retained to serve management, examination and inspection activities in accordance with regulations.

2. Units shall establish mechanisms for monitoring the performance and behaviour of artificial intelligence systems, including at least the detection of abnormal signs such as deviations in outputs, deterioration in quality, bias, model drift, data drift or other abnormal behaviours indicating that the systems are not operating in accordance with their intended design purposes or approved scopes of use.

Article 7. Data safety management

1. Units shall fully comply with the provisions of law on data, personal data protection and intellectual property, and relevant regulations of the State Bank of Vietnam when processing data for artificial intelligence systems.

2. Data used by units for training, testing and operating artificial intelligence systems shall meet the following requirements:

a) The data shall have clear and lawful origins, and information on its origins shall be retained. In cases where data from third parties is used, units shall require such third parties to provide undertakings concerning the lawful origins of the data, the scope of data sharing and the right to share the data; and to provide appropriate information or evidence demonstrating the right to share the data or describing the origins of the data to an appropriate extent, without being required to disclose trade secrets, except where lawfully disclosed open data is used;

b) In cases where synthetic data simulating the characteristics of real-world data is used, units shall conduct assessments and take measures to prevent risks of deterioration in model quality and deviations in results over time;

c) Logs of input data processing shall be retained before the data is fed into artificial intelligence systems to ensure data traceability when necessary.

3. Units shall establish procedures and policies for controlling the quality of data used for training, testing and operating artificial intelligence systems, covering at least the following:

a) Training and testing data shall:

(i) Be representative and appropriate to the purposes of use, subjects and scope of application of artificial intelligence systems;

(ii) Be updated in a manner appropriate to the characteristics of operations and the data change cycles in actual operating environments;

b) Establishment of criteria for measuring and assessing the quality of datasets used for training, testing and operating artificial intelligence systems;

c) Detection and handling of erroneous, distorted, manipulated or poisoned data;

d) Monitoring of data drift and implementation of measures to update data, adjust or retrain models where necessary.

4. Units shall establish mechanisms to protect data against risks of leakage from artificial intelligence systems, covering at least the following:

a) Restricting and controlling the access privileges of artificial intelligence systems to units' data in accordance with the principle of granting only the minimum necessary privileges, when necessary, appropriate to the relevant subjects, purposes of use and approved scope of data processing;

b) Controlling access to data used for training, testing and operating artificial intelligence systems and information on model structures to prevent risks of data leakage or disclosure.

Article 8. Change management for artificial intelligence systems

1. Units shall fully comply with the State Bank of Vietnam's regulations on change management for information systems.

2. Units shall manage model versions, including at least: model version information; time of application, modification or discontinuation of use; scope of impact; relevant configurations; change logs; and results of model testing and assessment.

3. Management of changes to model versions:

a) In cases where models are directly managed by units, such units shall have recovery plans in the event of unsuccessful changes or unforeseeable incidents;

b) For high-risk artificial intelligence systems or medium-risk artificial intelligence systems that make decisions in operations and use models provided by third parties through platform services or application programming interfaces (APIs), units shall conduct impact assessments and have contingency plans when providers update or modify the models.

4. All significant changes to artificial intelligence systems shall be managed through change management procedures, including reassessment of the impacts of deployment on existing systems and updating of guidance documents, response scenarios and contingency plans before implementation.

Article 9. Management and handling of incidents involving artificial intelligence systems

1. Units shall develop and promulgate incident handling procedures for artificial intelligence systems, covering types of incidents specific to artificial intelligence systems and plans for handling operations when incidents occur in such systems.

2. When a serious incident occurs in an artificial intelligence system, units shall:

a) Immediately activate the emergency shutdown mechanism and switch to manual operation where necessary;

b) Immediately implement remedial measures and limit damage;

c) Report the incident to competent state management agencies and the State Bank of Vietnam (Information Technology Department) in accordance with the law on artificial intelligence;

d) Notify affected customers in accordance with the law on personal data protection (if any);

dd) Prepare a report on the completion of incident remediation, including at least the causes, damage and remedial measures.

3. Units shall fully retain records and documents relating to incidents to serve examination and investigation where necessary.

4. After handling a serious incident, units shall organise a reassessment of the risk level of the artificial intelligence system; where necessary, reclassify its risk level, adjust control measures or temporarily suspend putting the system into use to prevent recurrence of the incident.

Article 10. Logging of artificial intelligence system operations

1. Artificial intelligence systems shall be configured to log events during operation, including at least:

a) The time, system and user performing transactions or tasks;

b) Information on input data and system outputs, together with information on model versions, configurations or prompts (if any), sufficient to enable tracing, examination and reproduction of the data processing where necessary;

c) Instances where outputs fall outside the intended scope of operation or have low confidence levels;

d) Events relating to system errors or cybersecurity incident alerts.

2. The retention periods for operation logs of artificial intelligence systems and data processing logs specified at Point c, Clause 2, Article 7 of this Circular shall be appropriate to the risk levels and purposes of use of the systems and shall meet at least the requirements for information system log retention corresponding to their cybersecurity levels.

Article 11. Provision of information and support to internal users

1. Units shall provide complete and clear information to managers, executive officers and employees using artificial intelligence systems (below collectively referred to as internal users), including:

a) Purposes of use, scope of application, roles of the systems in supporting or making decisions, and capabilities and limitations of artificial intelligence systems;

b) Instructions for using the systems and recommendations on interpreting and using system outputs, including warnings about risks of deviations or use beyond the intended design purposes;

c) Procedures and methods for requesting human intervention upon detecting abnormalities, risks or incidents during operation.

2. Units shall establish channels for receiving and handling feedback from internal users and relevant departments on incidents, abnormal behaviours, adverse impacts or erroneous results arising during the operation of artificial intelligence systems, as a basis for adjusting models, procedures or risk control measures.

Chapter III

RISK MANAGEMENT FOR THE APPLICATION

 OF ARTIFICIAL INTELLIGENCE SYSTEMS

Article 12. Responsibilities for risk management in the application of artificial intelligence systems

1. Units shall clearly define the roles and responsibilities of individuals and functional departments in managing risks associated with the application of artificial intelligence systems and establish coordination mechanisms among relevant departments.

2. The senior governing body shall bear ultimate responsibility for the application of artificial intelligence systems within the unit, including:

a) Approving orientations for the development and application of artificial intelligence systems in accordance with the unit's business strategy and risk management policies;

b) Approving the risk management framework for the application of artificial intelligence systems and relevant important policies;

c) Allocating sufficient resources for the deployment, operation and risk management of the application of artificial intelligence systems;

d) Organising and supervising the implementation of risk management for the application of artificial intelligence systems.

3. For high-risk artificial intelligence systems, the senior governing body shall approve the deployment policy and decide on putting the systems into official operation.

4. Detailed approvals concerning the technical aspects, deployment and operation of artificial intelligence systems shall be carried out in accordance with the unit's internal delegation of powers and authorisation arrangements.

5. The competence to approve the matters specified in Clauses 1, 2, 3 and 4 of this Article concerning the application of artificial intelligence systems by foreign bank branches shall be exercised in accordance with the regulations of their parent banks.

6. Units shall report to the senior governing body and parent banks on the operational status, risks, serious incidents, complaints and trends in system deviations at least once every six months for high-risk and medium-risk artificial intelligence systems, or whenever there is a significant change to a high-risk artificial intelligence system.

Article 13. Impact assessment for high-risk artificial intelligence systems

1. For high-risk artificial intelligence systems, units shall conduct impact assessments before deployment, covering at least the following:

a) Description of the purposes, scope and operating principles of the systems; description of mechanisms for ensuring the possibility of human supervision and intervention;

b) Analysis of potential risks to operations; cybersecurity risks to information systems; and risks to the rights and interests of customers and related parties (including specific assessments of impacts in terms of fairness, transparency, explainability and risks of discrimination against customers);

c) Assessment of the impacts of personal data processing in accordance with the provisions of law (if any);

d) Identification of risk control and mitigation measures;

dd) Development of monitoring plans and incident response plans during operation.

2. The results of impact assessments shall be documented and approved by the competent authority of the unit; reviewed and updated when there are changes to the functions, scope of data processing or operating conditions of artificial intelligence systems; and the relevant records shall be retained throughout the operational life of the systems.

Article 14. Risk management framework for the application of artificial intelligence systems

1. Units shall develop, promulgate and implement a risk management framework for the application of artificial intelligence systems, ensuring that such framework is appropriate and consistent with their overall risk management policies and forms an integral part of their general internal control systems.

2. Units shall organise risk management for the application of artificial intelligence systems according to three independent lines of defence, whereby:

a) The first line of defence consists of departments or individuals responsible for developing, deploying, operating and using artificial intelligence systems; identifying risks and implementing measures to control, monitor and mitigate risks;

b) The second line of defence consists of departments or individuals responsible for examining and assessing artificial intelligence systems; developing risk management policies and internal regulations on risk management; monitoring and controlling risks and complying with the provisions of law;

c) The third line of defence consists of departments or individuals performing internal audit functions;

d) Units may outsource the performance of certain functions of the lines of defence, but shall ensure independence among these lines.

3. The types of risks associated with the application of artificial intelligence systems to be managed shall include at least:

a) Model risk;

b) Data governance risk;

c) Cybersecurity risk;

d) Legal compliance risk;

dd) Ethical risk;

e) Third-party risk;

g) Supply chain risk;

h) Reputational risk (for commercial banks and foreign bank branches).

4. Units shall define the nature, identification criteria, measurement methods, risk acceptance thresholds and control measures for each type of risk specified in Clause 3 of this Article.

Article 15. Artificial intelligence system lifecycle management

1. Units shall establish, implement and maintain risk management for artificial intelligence systems throughout their lifecycles, within the scope of their responsibilities and control capabilities, covering the stages from design, development, testing, deployment and operation to discontinuation of use, as specified in Clauses 2, 3, 4 and 5 of this Article.

2. During the design and development stages of artificial intelligence systems, units shall:

a) Identify and analyse known and reasonably foreseeable risks that may affect operations, customers' rights and interests, and cybersecurity;

b) Perform training data governance in accordance with Point a, Clause 3, Article 7 of this Circular;

c) Integrate cybersecurity requirements, supervision and control mechanisms, and the possibility of human intervention from the system design stage.

3. During the testing stage, units shall:

a) Conduct cybersecurity examination and assessment of artificial intelligence systems before putting them into use, ensuring compliance with the requirements specified in Clause 1, Article 6 of this Circular;

b) Conduct model testing and assessment before putting the models into use, ensuring compliance with the requirements specified in Article 16 of this Circular.

4. During the deployment and operation stages, units shall:

a) Monitor the performance and behaviour of artificial intelligence systems in accordance with Clause 2, Article 6 of this Circular;

b) Develop procedures for reporting and handling serious incidents;

c) Consider repeating risk assessment procedures and conducting cybersecurity examination and assessment in the same manner as for new deployments to ensure that updates do not cause adverse impacts when there is a significant change to an artificial intelligence system.

5. Discontinuation of use stage:

a) Units shall retain necessary records and documents to serve auditing activities in accordance with the provisions of law, including at least: design documents; records relating to the pre-operation requirements for artificial intelligence systems specified in Article 22 of this Circular (and documents updated during operation, if any); and technical dossiers of high-risk artificial intelligence systems in accordance with the law on artificial intelligence;

b) When artificial intelligence systems are no longer in use, units shall implement safe decommissioning procedures, including the deletion (after data retention requirements under the provisions of law have been fulfilled), secure disabling or isolation of data, models, configurations and related components within the scope of their management and control, in order to prevent data leakage or unauthorised restoration;

c) For training data and model parameters managed by third parties, units shall establish coordination mechanisms, make appropriate requests and retain records and documents relating to their handling in accordance with contractual agreements.

Article 16. Model risk management

1. Units shall manage model risks in accordance with this Article, covering at least models of high-risk artificial intelligence systems and models of medium-risk artificial intelligence systems that make decisions in operations. For other artificial intelligence systems, units shall comply with their internal regulations.

2. Units shall conduct model testing and assessment in the following cases:

a) Before the models are put into operation for the first time;

b) Periodically, at least once a year during operation;

c) When a serious incident occurs; when there is a significant change to an artificial intelligence system; when serious abnormalities or deviations are detected during operation; or when the risk level of the system changes.

3. Model testing and assessment shall cover at least the following:

a) For models directly managed by units:

(i) Appropriateness of training and testing data;

(ii) Reasonableness of algorithms and model architectures;

(iii) Model performance and accuracy;

(iv) Explainability of decision-making mechanisms and the extent to which key input factors influence model outputs;

(v) Fairness and control of risks of bias;

(vi) Model stability and robustness under operating conditions;

b) For models provided by third parties as services through platforms or application programming interfaces (APIs):

(i) Purposes of use, scope of deployment and risk levels of the systems;

(ii) Results of actual black-box testing using the units' datasets;

(iii) Model outputs under actual operating conditions, except for the case specified at Point a, Clause 2 of this Article;

(iv) Documents, information, reports or commitments disclosed by providers;

(v) Measures for human control, supervision and intervention during use.

4. Model testing and assessment shall be conducted by departments independent of those responsible for developing, deploying and operating artificial intelligence systems and of model providers.

5. Units shall establish mechanisms for monitoring model performance, including:

a) Prompt detection of signs of deterioration in model quality;

b) Periodic comparison of model predictions with actual outcomes;

c) Establishment of warning thresholds and intervention measures upon detection of abnormalities.

6. The results of testing, assessment and monitoring shall be reported to the competent authority of the unit.

Article 17. Ethical risk management

1. Units shall apply appropriate control measures to detect and mitigate data bias, model bias and operational bias; and ensure full consideration of impacts on vulnerable groups, including children, older persons, persons with disabilities and disadvantaged groups.

2. Units shall specifically assess impacts in terms of fairness, transparency, explainability and risks of discrimination against customers in accordance with Point b, Clause 1, Article 13 of this Circular for high-risk artificial intelligence systems.

3. The application of the National Artificial Intelligence Ethics Framework promulgated by the Ministry of Science and Technology is encouraged.

Article 18. Risk management for outsourcing

1. Scope and general principles of outsourcing

a) Units may outsource the development, deployment and operation of artificial intelligence systems or use artificial intelligence solutions provided by third parties in accordance with the provisions of law and this Circular;

b) Outsourcing shall not alter the responsibilities of units for ensuring the safety of operations, protecting customers' rights and interests, complying with the law on cybersecurity and personal data protection, and managing risks.

2. Requirements for outsourcing artificial intelligence systems:

a) When using artificial intelligence solutions provided by third parties, units shall conduct risk assessments of the use of third-party services in accordance with the provisions of law and determine criteria for selecting third parties, including at least:

(i) Technical capabilities, experience and reputation of third parties;

(ii) Ability to comply with Vietnamese laws on cybersecurity and personal data protection;

(iii) Contingency plans and incident support capabilities;

(iv) Certifications in cybersecurity and personal data protection in cases where high-risk artificial intelligence systems are deployed;

b) Units shall develop and promulgate guidelines for risk management in outsourcing artificial intelligence systems, clearly specifying:

(i) Scope of outsourced work;

(ii) Requirements for safety, security, quality and risk control;

(iii) Coordination, supervision and reporting mechanisms.

3. Requirements for outsourcing contracts for artificial intelligence systems shall include at least the following:

a) Compliance with the requirements for contracts on the use of information technology services provided by third parties as prescribed by the Governor of the State Bank of Vietnam;

b) Third parties shall provide annual information technology compliance audit reports prepared by independent audit organisations during the contract term or valid certifications of equivalent international security and risk management standards (such as SOC 2, ISO/IEC 27001 and ISO/IEC 42001). Where third parties are unable to provide such documents, units shall conduct assessments or engage independent organisations to assess the information technology compliance of such third parties;

c) Third parties shall provide information or reports on the results of model quality testing and assessment annually or for each released version;

d) Third parties shall provide tools, application programming interfaces (APIs), log data or other necessary technical means to enable units to monitor model performance;

dd) Third parties shall be responsible for providing information on technical characteristics, model limitations, update mechanisms and relevant security measures to enable units to conduct risk assessments and operational governance;

e) Third parties shall undertake to ensure continuity in service provision and have appropriate contingency plans and transition periods when discontinuing support or making significant changes to models;

g) Third parties shall coordinate with and provide information to competent state agencies in the examination, assessment, post-inspection and remediation of incidents involving artificial intelligence systems in accordance with the law on artificial intelligence;

h) Third parties shall undertake not to use units' data to train, fine-tune or improve their models without the units' written consent.

4. Supervision of outsourcing

a) Units shall establish and maintain mechanisms for regularly supervising the activities of outsourced service providers throughout the cooperation period, ensuring that the development, deployment and operation of artificial intelligence systems comply with the policies, procedures and concluded contracts;

b) For high-risk artificial intelligence systems, units shall:

(i) Review and approve plans for system development, deployment and operation;

(ii) Require third parties to provide sufficient information and documents to serve examination, assessment, supervision and auditing activities;

(iii) Establish procedures and measures for handling detected errors, violations or incidents;

c) Units shall conduct comprehensive examinations and assessments of the outsourcing of artificial intelligence systems periodically or when there are signs of increased risks;

d) Units and third parties shall coordinate in establishing preventive measures to mitigate risks arising from the operation of artificial intelligence systems;

dd) Units shall assess and manage risks arising from dependence on a single artificial intelligence platform when the provider encounters incidents;

e) In cases where outsourced artificial intelligence systems cause damage to customers or related parties, units shall:

(i) Promptly implement remedial measures to protect customers' rights and interests;

(ii) Organise the receipt and handling of complaints and provide compensation for damage in accordance with the provisions of law and contractual agreements.

Article 19. Supply chain risk management for artificial intelligence systems

1. Units shall establish procedures for cybersecurity examination and assessment, at a minimum, of software libraries, datasets and pre-trained models originating from third parties or open sources before integration and throughout the system lifecycle, ensuring that these components do not contain malware or security vulnerabilities.

2. Units shall develop and maintain detailed inventories of software components of artificial intelligence systems, including at least: names of components (libraries, models, training datasets and dependencies); names of component providers or developers; versions in use; licences; codes for integrity verification and origin authentication; and dates of inventory creation, to facilitate traceability and timely response to cybersecurity risks and incidents.

3. For models transferred from third parties or downloaded from open-source repositories, units shall apply technical measures to verify their integrity and origin, ensuring that the models have not been tampered with or modified without authorisation during transfer.

4. Units shall regularly update information on security vulnerabilities, security alerts and recommendations from providers relating to artificial intelligence platforms and libraries in use; conduct risk assessments and promptly implement remedial measures appropriate to the risk levels.

5. Units shall conduct periodic assessments of supply chain risk management for artificial intelligence systems commensurate with the risk levels of the systems, at least annually for high-risk artificial intelligence systems.

Chapter IV

DEPLOYMENT CONDITIONS FOR THE APPLICATION OF ARTIFICIAL INTELLIGENCE SYSTEMS

Article 20. Deployment conditions for artificial intelligence systems that make decisions in operations

1. Artificial intelligence systems that make decisions in operations shall meet the pre-operation requirements specified in Article 22 of this Circular and the requirements specified in this Article.

2. Units shall be responsible for providing information and instructions for use and clearly stating the limitations of artificial intelligence systems to customers before they enter into agreements to use the units' services.

3. For artificial intelligence systems that replace humans in direct communication with customers, units shall take measures to inform customers that they are interacting with artificial intelligence systems from the beginning of each session or conversation.

4. Units shall establish departments and procedures for receiving and handling complaints relating to the use of artificial intelligence systems, ensuring human review and reassessment of contested automated decisions and using the results of human review as the final basis for resolving complaints.

5. For artificial intelligence systems that automatically make decisions directly affecting customers' legal liabilities, financial obligations or access to and use of products and services, units shall take measures to retain information on the grounds and key factors leading to such decisions to facilitate the provision of information and explanations upon customers' requests. The provision of explanatory information shall not disclose source codes, detailed algorithms, sets of parameters or information constituting trade secrets or technological secrets. In cases where decisions made by artificial intelligence systems are intended to prevent and combat fraud, scams, money laundering or terrorist financing, or to ensure cybersecurity, units shall only be required to notify customers of reasons consistent with risk review and the protection of customers' assets.

Article 21. Human resource requirements for the deployment and management of artificial intelligence systems

1. In cases where artificial intelligence systems are directly developed, deployed and operated by units, such units shall arrange personnel with appropriate professional qualifications and experience to perform the following tasks:

a) Developing, deploying, operating, supervising and maintaining artificial intelligence systems;

b) Managing risks and conducting model testing and assessment;

c) Auditing artificial intelligence systems.

2. In cases where units outsource the development, deployment or operation of artificial intelligence systems, such units shall be responsible for managing, supervising and assessing the capabilities of service providers to ensure the performance of the tasks specified in Clause 1 of this Article.

3. Units shall develop and implement training and capacity-building programmes for relevant personnel and employees on:

a) Fundamental knowledge of artificial intelligence and its applications in banking activities;

b) Risk management for the application of artificial intelligence systems and methods for risk assessment and control;

c) Artificial intelligence ethics, personal data protection and privacy;

d) Cybersecurity and relevant provisions of law.

4. At least once a year, units shall assess and update the competencies of the personnel specified in Clause 1 of this Article.

Article 22. Pre-operation requirements for artificial intelligence systems

1. Units shall prepare dossiers relating to artificial intelligence systems as specified in Clause 2 of this Article and report to the competent authority of the unit for a decision on putting such systems into official operation.

2. The dossiers shall comprise:

a) Risk classification dossiers in accordance with the law on artificial intelligence;

b) Results of cybersecurity examination and assessment;

c) Results of model testing and assessment;

d) Results of impact assessments of high-risk artificial intelligence systems as specified in Article 13 of this Circular;

dd) Results of conformity assessments of high-risk artificial intelligence systems in accordance with the law on artificial intelligence;

e) Safe operation plans, including supervision, ensuring operational continuity and incident response;

g) Results of assessments of compliance with the deployment conditions for artificial intelligence systems that make decisions in operations as specified in Article 20 of this Circular;

h) Reports on human resources for the deployment and management of artificial intelligence systems as specified in Article 21 of this Circular;

i) Conditions for system shutdown and recovery.

3. Units shall establish specific criteria to be met before putting artificial intelligence systems into operation, including at least:

a) Indicators of model accuracy and reliability;

b) Indicators of system performance;

c) Results of cybersecurity examination and assessment.

4. Units shall develop detailed deployment plans, including implementation roadmaps, data migration plans, incident recovery plans and assessments of the impacts of deployment on existing systems.

Chapter V

IMPLEMENTATION PROVISIONS

Article 23. Effect

1. This Circular takes effect on November 15, 2026, except as provided in Clauses 2, 3 and 4 of this Article.

2. The provisions of Article 14 of this Circular take effect on January 1, 2027.

3. The provisions of Point b, Clause 1, Article 6 of this Circular take effect on September 1, 2027.

4. The provisions of Article 21 of this Circular take effect on September 1, 2027, except for units having high-risk artificial intelligence systems.

Article 24. Transitional provisions

Artificial intelligence systems deployed and put into official operation before the effective date of this Circular shall comply with the provisions on safety assurance, risk management and deployment conditions specified in Chapters II, III and IV of this Circular from March 1, 2027.

Article 25. Responsibilities for implementation

1. The Information Technology Department shall be responsible for monitoring, examining and coordinating with relevant units to resolve difficulties arising during the implementation of this Circular.

2. Heads of units under the State Bank of Vietnam, Directors of the State Bank of Vietnam's regional branches, credit institutions, foreign bank branches, intermediary payment service providers, credit information companies, mobile money service providers, the National Payment Corporation of Vietnam, the Vietnam Asset Management Company, the National Banknote Printing Plant and Deposit Insurance of Vietnam shall be responsible for organising the implementation of this Circular./.

For the Governor

The Deputy Governor

PHAM TIEN DUNG