On 11th September 2018, Decree No. 117/2018/ND-CP on the protection of confidentiality and provision of customer information of credit institutions and foreign banks’ branches (“CIs”) (“Decree 117”) was issued. Decree 117 has replaced Decree No. 70/2000/ND-CP (“Decree 70”)[1].

Effective from 01st November 2018, Decree 117 aims to update regulations on the protection of customer information at CIs in accordance with the Vietnamese current business situation and prevailing laws.

The following are the principles of protection of confidentiality and provision of customer information[2]:

  • Customer information provision:

Customer’s information of CIs shall be kept confidential and shall only be provided in accordance with the relevant laws.

  • Restriction on providing customer information:

CIs must not provide customer’s authentication information to any organization or individual unless allowed by such customer.

  • Cases of requesting customer information

State agencies, organizations and individuals may only request the provision of customer information

i. in accordance with law, or

ii. with the consent of the customer and shall be responsible for the information request.

  • Using customer’s information from CIs

State agencies, organizations and individuals must keep customer information confidential and use the information for legal purposes when requested and should not be provided to any third party without the customers’ consent.

This table makes a comparison between Decree 117 and Decree 70:

Criteria

Decree 117

Decree 70

Scope –     Protection of confidentiality and provision of customer information, except for information:

  • on the list of State secrets,
  • confidentiality and provision of customer information to the State Bank of Vietnam pursuant to other specific regulations.
  • against money laundering and terrorism.
–     Keeping secret, archiving and providing information related to money and property deposited by customers except for information on the list of the State’s secrets in the banking sector.
Regulatory authority having the power to request customer information –     The list of regulatory authorities is broader than that stipulated in Decree 70, including customs, tax, State audit, etc. –     State bodies in the course of inspection, investigation, prosecution, court trial or judgment execution.
Others –     Decree 117 provides further details on the application, procedures for providing customer information. –    Decree 70 does not detail the application, procedures for providing customer information.

[1] Decree 70 on keeping confidential, archiving and providing information related to customers’ deposit money and property issued on 21st November 2000.

[2] Article 4, Decree 117


DISCLAIMER

This LBN newsletter are NOT legal advice. Readers are advised to retain a qualified lawyer, should they wish to seek legal advice. VCI Legal are certainly among those and happy to be retained, yet VCI Legal is not to be hold responsible should any reader choose to interpret/apply the regulations after reading this LBN without engaging a qualified lawyer.