Vietnam Sets AI Banking Risk Thresholds, Payment Caps and Customer Safeguards

Payment thresholds bring automated banking under closer supervision

Vietnam will classify AI systems that automatically make payments as high risk when an individual customer's transactions exceed VND 10 million per payment or VND 20 million in a day. For institutional customers, the corresponding thresholds are above VND 50 million per transaction or VND 100 million daily. The rules take effect on November 15, 2026, under Circular No. 53/2026/TT-NHNN, issued by the Governor of the State Bank of Vietnam on September 30.

Those thresholds trigger stricter supervision, rather than a ban on automated payments. Separate provisions limit the total value that AI may automatically transact each day to VND 100 million for an individual customer and VND 500 million for an institutional customer. A provider's own internal limit also applies and may be lower.

The distinction matters: an AI system can enter the high risk category well before it reaches the maximum permitted payment volume. Both daily ceilings are five times the corresponding daily risk thresholds, calculated from VND 100 million against VND 20 million for individuals and VND 500 million against VND 100 million for institutions.

The Vietnam Banks Association's circular listing identifies the measure as covering safety, risk management and deployment conditions for AI in banking. Its central principle is that automation does not remove human authority or responsibility. Banks and other regulated providers remain accountable for decisions made or supported by AI, including systems purchased from external vendors.

Which systems and institutions are covered?

Before deployment, providers must classify AI systems as high, medium or low risk. The level of oversight and scope for human intervention must reflect the system's potential effects on customers and banking operations. High risk systems require impact assessments, which examine the possible consequences of their use before they enter operation.

Automated credit systems also face a monetary threshold: credit of VND 50 million or more brings the relevant system into the high risk category. Unlike the payment thresholds, which apply to values above the stated amounts, the credit threshold includes exactly VND 50 million.

Reports differ in their description of the credit function covered. Some describe AI that automatically decides whether to grant credit, while others describe AI that automatically proposes a credit decision. That distinction matters for banks where software makes a recommendation but a person retains approval authority. Institutions need to check the issued wording when classifying those systems.

The circular reaches beyond commercial banks. It applies to credit institutions, foreign bank branches, intermediary payment providers, mobile money providers and credit information companies. The Vietnam Asset Management Company, National Money Printing Plant and Vietnam Deposit Insurance are also covered. Its scope includes banking, payment intermediary services, credit information and mobile money operations.

Customers must agree before AI can make payments

A bank cannot treat the availability of an AI payment function as permission to use it on a customer's behalf. Automated payment execution requires a prior agreement between the provider and customer, defining what the system is authorised to do.

The agreement must specify the scope of permitted transactions, limits for individual payments and daily totals, its validity period, applicable conditions and the customer's right to terminate. Reports also describe requirements to set out suspension conditions and the provider's responsibility when a termination request arrives.

Customers must have tools to pause or cancel the authority granted to AI. The rules therefore distinguish between an institution's technical ability to automate payments and a customer's continuing consent to that automation. Reports describe a right to terminate at any time and an obligation to act immediately on that request.

Neither customer consent nor an internal payment limit removes the regulatory ceiling. A customer may authorise a defined range of transactions, but execution must still remain within the provider's limit and the VND 100 million or VND 500 million daily cap, as applicable.

Human supervisors need power to stop the system

High risk AI must be monitored continuously. Supervisors need both the authority and the practical ability to override, adjust or pause its decisions. Providers must also maintain an emergency mechanism to stop or isolate an AI system when necessary.

Human intervention must leave a record. Logs must capture what was changed, when the intervention occurred, who carried it out and why. This makes it possible to reconstruct a decision and the response to it, rather than relying on a general assurance that a person was supervising.

During a serious incident, banks and electronic wallet providers must activate emergency shutdown, move to manual operations when needed and take corrective steps to limit damage. The manual fallback is distinct from ordinary review: it allows an institution to continue necessary work without relying on the affected AI.

Providers cannot use a system's autonomy, technical characteristics or origin as a third party product to exclude or reduce their managerial and legal responsibility. The circular treats human control as an operational requirement, not simply a statement that somebody remains accountable.

Customers gain disclosure, explanations and human review

When AI replaces a person in direct communication, customers must be told at the beginning of the session or conversation that they are interacting with an AI system. Providers must also maintain a department and procedures for receiving and handling complaints about AI use.

If a customer challenges an automated decision, a human must review it. The result of that review becomes the final basis for resolving the complaint. This requirement should not be confused with a statement that other legal remedies are unavailable; it addresses the provider's complaint resolution process.

For automated decisions directly affecting legal responsibility, financial obligations or access to products and services, providers must retain the grounds and key factors behind the outcome. Those records must allow an explanation when the customer requests one.

Explanation does not require disclosure of source code, detailed algorithms, model parameters or business and technology secrets. For decisions concerning fraud, scams, money laundering, terrorist financing or cybersecurity, the provider may give reasons consistent with risk controls and protection of customer assets. The requirement is to explain the relevant basis without exposing information that could weaken those protections.

Data quality and security become deployment conditions

The circular addresses risks that can arise before a customer sees an AI output. Data used for training, testing and operation must have a clear, lawful origin. Institutions must control its quality, detect errors and inaccuracies, identify manipulation or poisoning, and monitor changes during operation.

Data poisoning means deliberately contaminating information used by an AI system so that its results become unreliable or serve an attacker's purpose. More ordinary problems, such as inaccurate or outdated records, can also distort decisions. The rules require attention to both deliberate interference and data quality.

AI systems must undergo cybersecurity assessments before entering operation, periodically afterwards and when substantially changed. Providers must also meet requirements for data safety, change management, incident handling and logging. Model, ethical, outsourcing and supply chain risks form part of the management framework.

Before deployment, an institution must prepare the required documentation, assess whether the conditions for operation have been met and obtain approval from the appropriate authority. Introducing a new model or changing an existing one therefore involves more than deciding whether its output appears useful.

Outsourcing does not transfer accountability

External AI vendors may not use an institution's data to train, fine tune or improve models without written consent. This restriction addresses a separate issue from permission to process data for the contracted service: access to information does not itself authorise reuse for model development.

The institution using an outsourced system remains responsible for operational safety, customer rights, cybersecurity, personal data protection and risk management. If that system harms customers or other affected parties, the institution must promptly take corrective action, protect customers, handle complaints and compensate for damage in accordance with applicable rules.

These duties connect vendor management to the customer protections elsewhere in the circular. A bank still needs a way to explain material decisions, review disputed outcomes and intervene in operations even when the underlying technology comes from another company. Hiring a supplier does not remove those obligations.

Earlier proposals show the framework's development

The final circular follows a draft framework described earlier in 2026. Baker McKenzie's April draft analysis, dated April 23, outlined controls covering design, testing, monitoring, updates and safe retirement of AI systems. It also described detection of model drift, when a system's behaviour or accuracy changes as the data it encounters changes.

That analysis described proposed measures against algorithmic bias involving gender, ethnicity, religion, disability, age and socioeconomic disadvantage. It also identified annual capability reviews and independent audits of outsourced AI as elements of the draft. These are draft details and should not automatically be treated as confirmed provisions of the issued circular.

The Australian Chamber of Commerce in Vietnam's draft circular update similarly described proposed prohibitions on discrimination and exploitation of vulnerable groups. It highlighted performance and accuracy benchmarks, staff training, incident response plans and annual governance reviews. The chamber stated that Vietnam's AI Law took effect in March 2026; the banking circular implements provisions of that law.

Both institutional descriptions of the draft specified reporting serious AI incidents to the State Bank within 24 hours of detection and submitting a completion report within five working days after resolution. Those deadlines appear in the draft descriptions, but are not confirmed in the reports detailing the issued circular. Institutions should verify the final reporting provisions rather than carry draft deadlines into compliance plans without checking.

The implementation calendar and remaining questions

The circular takes effect on November 15, 2026, while AI systems already operating before that date have until March 1, 2027, to complete compliance with safety, risk management and deployment requirements. Some provisions concerning the risk management framework, cybersecurity checks and personnel follow a phased schedule, although the detailed milestones are not specified in the reports describing the final measure.

• March 2026: Vietnam's AI Law took effect, according to the Australian Chamber of Commerce in Vietnam.
• April 23, 2026: Baker McKenzie published its analysis of the proposed banking AI circular.
• September 30, 2026: The State Bank Governor issued Circular No. 53/2026/TT-NHNN.
• November 15, 2026: The circular takes effect.
• March 1, 2027: AI systems operating before the effective date must complete the required compliance work.

The rules arrive while banks are expanding AI use in credit scoring, loan assessment, payment fraud detection, automated advice and electronic identity checks. An unnamed executive at a state owned bank said payments at most banks still involve people, and that the executive's own bank retains human review of loan approvals. That account indicates that AI assistance and fully automated execution are not yet the same stage of adoption.

Existing rules also require account holder biometric authentication for online transactions above VND 10 million per transaction. That amount matches the individual payment threshold for high risk AI classification, but the requirements serve different purposes: one verifies the account holder, while the other governs the risk of the automated system. The reports do not explain how autonomous payment arrangements will satisfy biometric requirements in every situation.

What to Know

• Circular No. 53/2026/TT-NHNN takes effect on November 15, 2026.
• Individual automated payments above VND 10 million per transaction or VND 20 million daily trigger high risk classification.
• Institutional thresholds are above VND 50 million per transaction or VND 100 million daily.
• Automated daily payments are capped at VND 100 million for individuals and VND 500 million for institutions, subject to provider limits.
• Relevant automated credit systems enter the high risk category at VND 50 million or more.
• Customers must consent to automated payments and be able to pause or revoke that authority.
• Disputed automated decisions require human review, and providers must retain the basis for material decisions.
• Outsourcing does not remove institutional responsibility, and vendors need written consent to reuse institutional data for model development.
• Existing AI systems must complete compliance by March 1, 2027, with some requirements following a phased schedule.