Decree 165/2018/ND-CP on electronic transactions in financial activities

Decree 165/2018/ND-CP The applicable entities are agencies, organizations, and individuals that manage information systems serving electronic transactions in financial activities.

"Electronic transactions in financial activities" refers to electronic transactions between agencies, organizations, and individuals in various types of professional activities: state budget, state treasury, taxes, fees, charges, other state budget revenues, state reserves, public assets, state financial funds, financial investment, corporate finance, cooperative finance, customs, accounting, state management of prices, securities, financial services, accounting services, auditing services, insurance business, and other financial services under the state management scope of the Ministry of Finance. The implementation of these professional activities is governed by specialized laws.

Electronic documents are digitally signed by the agency, organization, or individual creating the electronic document and the agency, organization, or individual with relevant responsibilities as prescribed by specialized laws.

Agencies, organizations, and individuals may request the information system administrator to confirm the execution of electronic transactions in paper form for presentation to competent authorities for verification of document information or to provide to other agencies, organizations, and individuals who need to search for or verify information within the scope of the law. When this request and confirmation is made at a state agency, it must comply with the regulations, procedures, and processes for providing information as stipulated by the law on access to information.

The document is canceled based on the agreement and confirmation of the parties involved in the transaction. This confirmation is expressed in one of the following ways: A written document signed by the parties involved in the transaction or their authorized representatives (if it is an electronic document, the provisions on legal validity under Article 5 of this Decree apply); a request to cancel the document by one party involved in the transaction and acceptance of the request to cancel the document by the other party(ies) in the form of an email or data message created on the same information system that created or stored the electronic document, authenticated by one of the accepted methods applicable to electronic documents as stipulated in Article 5 of this Decree.

Develop and implement a roadmap for applying electronic transactions between agencies, organizations, and individuals with financial agencies under the Ministry of Finance; establish connections and exchange information on electronic transactions in financial activities between financial agencies under the Ministry of Finance and other ministries, agencies, and organizations in accordance with the Government's objectives and programs on e-Government, consistent with actual conditions and legal regulations.

Businesses that provided intermediary services in electronic financial transactions before the effective date of this Decree may continue to provide intermediary services in electronic financial transactions in accordance with the provisions of this Decree.

Download the full Decree 165/2018/ND-CP

DECREE

ON ELECTRONIC TRANSACTIONS IN FINANCIAL ACTIVITIES

Pursuant to the Law on Organization of the Government dated April 30, 2013, 19 year of 6;

Based on the Law on Electronic Transactions dated November 29, 2005;

At the proposal of the Minister of Finance;

The government has issued a Decree on electronic transactions in financial activities.

Chapter I

GENERAL RULES

Article 1. Scope

This decree regulates electronic transactions in financial activities.

Article 2. Subject of application

1. Agencies, organizations, and individuals are the owners of information systems serving electronic transactions in financial activities.
2. Agencies, organizations, and individuals participating in electronic transactions in financial activities.
3. Organizations, institutions, and individuals may need to search for and verify information about electronic transactions in the financial activities of other organizations, institutions, and individuals within the scope permitted by law.

Article 3. Explain words

In this Decree, the following terms are understood as follows:

1. "Electronic transactions in financial activities" refers to electronic transactions between agencies, organizations, and individuals in various types of professional activities: state budget, state treasury, taxes, fees, charges, other state budget revenues, state reserves, public assets, state financial funds, financial investment, corporate finance, cooperative finance, customs, accounting, state management of prices, securities, financial services, accounting services, auditing services, insurance business, and other financial services under the state management scope of the Ministry of Finance. The implementation of these professional activities is governed by specialized laws.
2. "Specialized laws" include laws on the state budget; taxes; fees and charges; management and use of state capital invested in production and business in enterprises; public debt management; customs; state reserves; public assets; accounting; pricing; securities; independent auditing; insurance business and other financial laws.
3. "Electronic documents in financial activities" (hereinafter referred to as "electronic documents") are information created, sent, received, and stored electronically when conducting electronic transactions in financial activities; including documents, reports, contracts, agreements, transaction information, information on administrative procedures, and other types of information and data as prescribed by specialized laws.
4. "The agency, organization, or individual initiating an electronic document" refers to the agency, organization, or individual that creates or sends an electronic document before it is stored, but does not include any intermediary transferring the electronic document. The determination of the agency, organization, or individual initiating the electronic document is governed by Clause 2, Article 16 of the Law on Electronic Transactions.
5. "The information system administrator serving electronic transactions in financial activities" (hereinafter referred to as "information system administrator") is the agency, organization, or individual with the authority to directly manage the information system serving electronic transactions in financial activities.
6. "Financial authority" is one of the following agencies:
7. a) The Ministry of Finance and its affiliated and subordinate agencies and units have the function of state management in the sectors and fields under the Ministry of Finance's purview;
8. b) Specialized agencies advising on state management in the field of finance under the People's Committees at all levels (local finance agencies).
9. "Electronic transaction intermediary services in financial activities" refers to services that represent (in whole or in part) other agencies, organizations, or individuals in sending, receiving, storing, assisting in the creation and processing of electronic documents, and confirming the execution of electronic transactions by the parties involved in the electronic transaction.
10. "Invalidating an electronic document" is a measure that renders an electronic document unusable on the information system.
11. "Destroying electronic documents" is a measure that makes electronic documents no longer exist on the information system, making it impossible to access or refer to the information contained in the electronic document.
12. "Electronic document sealing" is a measure to ensure the integrity of the information contained in electronic documents, preventing unauthorized modification, copying, transfer, invalidation, or destruction from the beginning to the end of the sealing process.
13. "Information systems serving electronic transactions in financial activities" (hereinafter referred to as "information systems") are information systems as defined in Clause 8, Article 4 of the Law on Electronic Transactions that are provided and used to carry out electronic transactions in financial activities.
14. "Authentication" is the process of verifying on an information system to ensure that the person conducting an electronic transaction is the person authorized to perform that transaction, or to verify the digital signature on an electronic document in accordance with the law on digital signature authentication.
15. "Authentication code" is a string of characters (numbers, letters, symbols, special characters) generated or recorded by an information system to be associated with the person performing an electronic transaction each time a transaction is made, for authentication purposes.
16. "Biometric authentication" is authentication performed using human biological characteristics with a very low probability of overlap (according to scientific and technological standards at the time this method is applied).
17. "Electronic document identifier" is a barcode or string of numbers and letters associated with an electronic document to uniquely identify the electronic document on the information system, serving the purpose of retrieving information about the electronic document.

Article 4. Principles of electronic transactions in financial activities

1. Agencies, organizations, and individuals participating in electronic transactions in financial activities must comply with the principles stipulated in Article 5 of the Law on Electronic Transactions; the provisions of specialized laws and other relevant legal regulations.
2. Electronic transactions in financial activities that fall under administrative procedures must comply with the legal regulations on administrative procedures and online public services.
3. The use of digital certificates and digital signatures in electronic transactions within financial activities must comply with the legal regulations on digital signatures and digital signature authentication services.

Download backup copy of Decree 165/2018/ND-CP: 

Chapter II

SPECIFIED

Article 5. Legal validity of electronic documents

1. Electronic documents must fully meet the requirements of state management and comply with the provisions of specialized laws. The form of presentation, creation, sending, receiving of electronic documents, and the legal validity of electronic documents shall be governed by the Law on Electronic Transactions.
2. Electronic documents are considered originals when one of the following measures is taken:

a) Electronic documents are digitally signed by the agency, organization, or individual creating the electronic document and the agency, organization, or individual with relevant responsibilities as prescribed by specialized laws.

b) The information system has measures to ensure the integrity of electronic documents during transmission, receipt, and storage on the system; it records the agency, organization, or individual that initiated the electronic document and the agency, organization, or individual responsible for processing the electronic document; and applies one of the following measures to verify the agency, organization, or individual that initiated the electronic document and the agency, organization, or individual responsible for processing the electronic document: digital certificate authentication, biometric authentication, or two-factor authentication including a one-time authentication code or a random authentication code.

c) Other measures agreed upon by the parties to the transaction, ensuring data integrity, authenticity, and non-repudiation, in accordance with the provisions of the Law on Electronic Transactions.

Article 6. Conversion from paper documents to electronic documents

1. Methods for converting paper documents to electronic documents:

a) Paper documents are converted into electronic form by scanning and transferring them as files on the information system, or

b) The content of the paper document is converted into data to be stored in the information system.

2. Electronic documents converted from paper documents must meet the following conditions:

a) Fully reflect the content of the paper document;

b) Individuals or agencies/organizations performing (or being responsible for) the conversion of paper documents into electronic documents shall digitally sign the electronic documents after they have been converted from paper documents or authenticated by one of the authentication methods specified in point b, clause 2, Article 5 of this Decree.

3. Electronic documents converted from paper documents have the same value as paper documents, unless otherwise stipulated by specialized laws.

Article 7. Conversion from electronic documents to paper documents

1. Agencies, organizations, and individuals may print electronic documents that they themselves create, and the information system administrator may print electronic documents of the agencies, organizations, and individuals under their management from the information system for storage, information verification, or presentation to competent authorities for verification of document information, or provide them to agencies and organizations that need to search for or verify information within the scope of the law.
2. Agencies, organizations, and individuals may request the information system administrator to confirm the execution of electronic transactions in paper form for presentation to competent authorities for verification of document information or to provide to other agencies, organizations, and individuals who need to search for or verify information within the scope of the law. When this request and confirmation is made at a state agency, it must comply with the regulations, procedures, and processes for providing information as stipulated by the law on access to information.
3. Paper documents converted from electronic documents must meet the following conditions:

a) To fully and accurately reflect the content of the electronic document;

b) There is information showing that the document has been processed on the information system and the name of the information system or the name of the information system's administrator;

c) The electronic document must have an identification code for the purpose of searching and verifying information, or it must have the full name and signature of the person performing the conversion;

d) The conversion must bear the seal of the agency or organization carrying out the conversion in cases where it is required by law or by agreement between the transacting parties.

d) Searches can be made at any time during the normal operation of the information system.

4. Paper documents converted from electronic documents have the same value as electronic documents, unless otherwise stipulated by specialized laws.

Article 8. Amendment of electronic documents

1. Modification of electronic documents before official approval or transmission for electronic transactions must follow the management procedures of the agency, organization, or individual that created the document or the information system administrator.
2. Any modifications to electronic documents after they have been officially approved or transmitted for electronic transactions must be redone from the initial creation stage and must ensure compliance with relevant laws and regulations.
3. The information system must record the person performing the modification, the time of the modification, and other relevant information related to the electronic document modification.

Article 9. Storage of electronic documents

1. Electronic documents are stored in accordance with specialized laws, suitable for the electronic storage environment and conditions, and relevant legal regulations on archiving.
2. Agencies and units responsible for storing electronic documents must ensure compliance with the conditions stipulated in Clause 1, Article 15 of the Law on Electronic Transactions.

Article 10. Invalidation of electronic documents

1. Electronic documents are invalidated under one of the following conditions:

a) Documents are canceled according to the procedures and regulations of the unit that created and processed the electronic documents, in compliance with the provisions of specialized laws.

b) The document is canceled based on the agreement and confirmation of the parties involved in the transaction. This confirmation is expressed in one of the following ways: A written document signed by the parties involved in the transaction or their authorized representatives (if it is an electronic document, the provisions on legal validity under Article 5 of this Decree apply); a request to cancel the document by one party involved in the transaction and acceptance of the request to cancel the document by the other party(ies) in the form of an email or data message created on the same information system that created or stored the electronic document, authenticated by one of the accepted methods applicable to electronic documents as stipulated in Article 5 of this Decree.

2. Invalidated electronic documents must be marked, recording the time and person who performed the invalidation on the information system, and notified to the relevant parties.

3. Invalidated electronic documents must be stored for retrieval by competent state agencies for the retention period prescribed by specialized laws.

4. When an electronic document is invalidated, any paper documents converted from this electronic document (if any) also become invalid and unusable.

Article 11. Destruction of electronic documents

1. Electronic documents and paper documents converted from electronic documents that have exceeded the prescribed retention period may be destroyed unless otherwise decided by a competent state agency.
2. The destruction of electronic documents must not affect the integrity of electronic documents that have not been destroyed and must ensure the normal operation of the information system.
3. The information system must record the destruction of electronic documents in the form of a list including information about the time and person who carried out the destruction of the electronic documents, store this list on the system, and make it available for retrieval when needed.

Article 12. Sealing of electronic documents

1. The authority to seal electronic documents is exercised in accordance with the law on sealing documents and evidence serving the process of inspection, auditing, investigation.
2. The sealing of electronic documents must ensure:

a) It must not affect the normal operation of information systems and the production and business activities of organizations and individuals;

b) It is possible to fully restore sealed electronic documents within the information system of the organization or individual after the sealing period has expired;

c) Identifying access to or modification of the contents of sealed electronic documents.

d) The information system must mark sealed electronic documents and record the time and person who sealed the electronic documents.

3. After the competent state agency decides and implements sealing measures, organizations and individuals are not allowed to access, exploit, copy, modify, or use these electronic documents in their information systems for transactions or other purposes.

Article 13. Regulations for information systems

1. Information systems must ensure time accuracy and synchronization with Vietnam's time zone (ISO 8601 standard). It is recommended to use timestamping services provided by organizations authorized to do so in accordance with the law on digital signatures and digital signature certification services for documents where the creation or processing time is constrained by specialized legal regulations or may cause disputes over interests and legal matters between the parties involved in the transaction.
2. Information systems used for creating and processing electronic documents must have the capability to convert electronic documents into paper documents for the purposes specified in Clauses 1 and 2 of Article 7 of this Decree.
3. Information systems must be capable of storing electronic documents or providing access to electronic documents stored in a separate storage system. In the event of an information system upgrade or technological change, the information system administrator is responsible for providing access to electronic documents created or stored on the information system prior to the upgrade or technological change.
4. The information systems of financial agencies and related state agencies must be capable of connecting and exchanging electronic documents in accordance with the Government's regulations on the implementation of e-Government. The information systems of other agencies and organizations must be capable of connecting and exchanging electronic documents with the information system of the financial agency in accordance with the regulations of specialized management laws.
5. The legal representative of the agency or organization using the information system to automatically digitally sign electronic documents is legally responsible for the electronic documents that have been automatically digitally signed.

Article 14. Ensuring security in electronic transactions in financial activities.

1. Information system administrators who collect personal information from participants in transactions must comply with the Law on Information Security, the Law on Cybersecurity, and other relevant legal regulations on the protection of personal information.
2. The information system administrator must ensure the safety and security of the information system and the transactions of participants in accordance with the law on cybersecurity, applying at least the following measures:

a) Determine the security level and implement corresponding information system security measures in accordance with the Law on Network Information Security and Government Decree No. 85/2016/ND-CP dated July 1, 2016, on ensuring information system security according to security levels. In cases where the information system owner is a non-state organization, only the security level of the system must be determined, and minimum protection measures must be implemented to meet the requirements for the corresponding level as stipulated by the Ministry of Information and Communications; assessment and approval procedures for the security level dossier are not mandatory.

b) Connections from agencies, organizations, and individuals to the information system must be encrypted. Websites or portals serving electronic transactions in financial activities must use digital certificates to secure information during transmission and prevent forgery.

Article 15. Use of intermediary services in electronic transactions

1. Businesses providing information technology services on mobile telecommunication networks and the Internet; and businesses providing digital signature authentication services are permitted to offer intermediary services in electronic transactions within financial activities.
2. Agencies, organizations, and individuals may choose intermediary service providers that suit their needs in conducting electronic transactions in financial activities.
3. Agencies, organizations, and individuals using intermediary services, as well as businesses providing intermediary services, must sign an agreement or contract specifying the responsibilities and rights of each party (within the framework permitted by law).

Article 16. Verification of information on electronic transactions in financial activities

1. When conducting inspections, audits, or investigations under specialized laws, the competent authority, or the agency responsible for handling related administrative procedures, may verify information regarding electronic transactions of agencies, organizations, or individuals using one of the following methods:

a) Use the electronic confirmation of the results of electronic transactions sent by the information system administrator to agencies, organizations, and individuals in the form of a file or email.

b) On-site observation of the information system results of information queries carried out by agencies, organizations, and individuals.

c) Utilize the electronic document information retrieval feature provided by the information system administrator.

d) Connecting, transmitting data, and exchanging information with financial agencies to obtain information on electronic transactions of subjects performing administrative procedures. The provisions in this point apply to agencies responsible for handling related administrative procedures.

2. Inspection, investigation, and administrative procedure-handling agencies may only request agencies, organizations, and individuals to present paper documents converted from electronic documents in cases where information verification cannot be carried out using one of the methods specified in Clause 1 of this Article.

Chapter III

TERMS ENFORCEMENT

Article 17. Responsibilities of the information system administrator serving electronic transactions in financial activities.

1. Comply with the provisions of this Decree.
2. The organization supports the execution of transactions on the information system through one or a combination of the following methods: in person, by telephone, by email, by website or portal, and other technologies.
3. Providing information on electronic transactions in financial activities within the scope of the information system's managing entity to competent management agencies for inspection, auditing, and investigation of financial activities, as well as to agencies, organizations, and individuals requiring information lookup and verification, within the scope of the law as prescribed in Article 16 of this Decree and other relevant laws.
4. Directly or through authorized member units or branches, certify paper documents converted from electronic documents upon request from agencies, organizations, or individuals participating in transactions on information systems under the management of the information system owner, in accordance with the law.
5. Maintaining the confidentiality of personal information, business information, and information of agencies and organizations on information systems under the management of the information system owner in accordance with the law.
6. Ensure the security of information systems, participate in incident response activities, and handle and resolve incidents in accordance with the law on network information security, cybersecurity, and the provisions of this Decree.
7. Agencies, organizations, and individuals that lease information technology infrastructure services from other businesses to provide electronic transactions in financial activities must ensure coordination with the infrastructure leasing enterprise to fully fulfill the responsibilities stipulated in Clauses 1 to 6 of this Article.

Article 18. Responsibilities of agencies, organizations, and individuals participating in or using the results of electronic transactions in financial activities.

1. Agencies, organizations, and individuals participating in electronic transactions in financial activities are responsible for managing and maintaining the confidentiality of the means and information used for digital signing or authentication; and must immediately notify the information system administrator if such means or information are lost or disclosed.
2. Organizations, institutions, and individuals participating in electronic transactions with financial institutions are responsible for notifying the financial institution of their electronic contact address and maintaining its stability for information exchange during these transactions. In case of a change of address, the organization or individual must notify the financial institution of the change.
3. Agencies, organizations, and individuals using the results of electronic transactions in financial activities are responsible for recognizing and using electronic documents according to their legal validity.
4. Comply with other relevant provisions of this Decree.

Article 19. Responsibilities of the Ministry of Finance

1. Develop and implement a roadmap for applying electronic transactions between agencies, organizations, and individuals with financial agencies under the Ministry of Finance; establish connections and exchange information on electronic transactions in financial activities between financial agencies under the Ministry of Finance and other ministries, agencies, and organizations in accordance with the Government's objectives and programs on e-Government, consistent with actual conditions and legal regulations.
2. Directing and organizing the dissemination and education of legal regulations on electronic transactions in financial activities.
3. Providing guidance, conducting inspections, and supervising the implementation of legal regulations on electronic transactions in financial activities.
4. Resolving complaints, denunciations, and petitions from agencies, organizations, and individuals regarding electronic transactions in financial activities.

Article 20. Responsibilities of local financial authorities

1. Develop and implement a roadmap for applying electronic transactions between agencies, organizations, and individuals with local financial authorities (online public services related to finance at the local level).
2. Implement and coordinate with the Ministry of Finance to carry out the work of disseminating, publicizing, and educating the public on legal regulations regarding electronic transactions in financial activities within the local financial authority's jurisdiction.

Article 21. Transitional provisions

1. Businesses that provided intermediary services in electronic financial transactions before the effective date of this Decree may continue to provide intermediary services in electronic financial transactions in accordance with the provisions of this Decree.
2. Until a government-issued digital signature certification service provider issues a digital certificate, state budget-using entities may use public digital certificates to conduct electronic transactions with financial agencies for transactions requiring digital signatures. After being issued a digital certificate by a government-issued digital signature certification service provider, the state budget-using entity is responsible for using this digital certificate instead of the public digital certificate and notifying the relevant financial agency about the change of digital certificate.

Article 22. Terms enforcement

1. This Decree takes effect from May 1, 2019.
2. Decree No. 27/2007/ND-CP dated February 23, 2007, on electronic transactions in financial activities and Decree No. 156/2016/ND-CP dated November 21, 2016, amending and supplementing a number of articles of Decree No. 27/2007/ND-CP dated February 23, 2007, on electronic transactions in financial activities, shall cease to be effective from the date this Decree comes into force.
3. Ministers, heads of ministerial-level agencies, heads of government agencies, and chairpersons of provincial and centrally-administered city People's Committees are responsible for implementing this Decree.