LAWYER IN VIETNAM DR. OLIVER MASSMANN – E-COMMERCE - THE WORLD BANK IS ASKING DUANE MORRIS VIETNAM ON THE LOGISTICS FOR E-COMMERCE – HERE ARE OUR ANSWERS:

1. LAWYER IN VIETNAM DR. OLIVER MASSMANN – E-COMMERCE -
THE WORLD BANK IS ASKING DUANE MORRIS VIETNAM ON THE
LOGISTICS FOR E-COMMERCE – HERE ARE OUR ANSWERS:
ONLINE PAYMENTS
1. Which types of online payment solutions are available in your country?
Digital wallets[1], Internet Payment service providers[2] (IPSPs, also called as aggregated account or the
third‐party biller), and Payment service providers[3] (PSPs).
2. What services do most Payment service providers (PSPs) offer in your country?
Opening merchant accounts[4], or providing access to aggregated accounts, at the acquiring bank, Transact
multiple payment methods, and Security services, such as risk management.
3. What categories of PSPs are available to provide digital payment services in your country?
Retail PSP[5], Micropayment PSP[6], Government PSP[7] and Non‐issuing PSP[8].
4. What are the main laws and regulations that establish how PSPs are regulated and supervised
in your country?
Law on State Bank of Vietnam 2010, Law on Credit Institutions 2010, Decree No. 101/2012/ND‐CP on
non‐cash payment as amended, Circular No. 39/2014/TT‐NHNN guiding intermediary payment services as
amended, Circular No. 46/2014/TT‐NHNN guiding non‐cash payment services.
5. How many business days does it take for PSPs to obtain a license to provide digital payment
services?
60 days by law.
6. What is the main authority in charge of issuing licenses and supervising PSPs in your
country?
The State Bank of Vietnam
7. According to the law, how long (in years) is the PSP license valid in your country?
10 years (Article 16.3 of Decree No. 101/2012/ND‐CP)
8. Which of the following documents are required for the PSP license application?
Registration documents (including certificate of incorporation and the Articles of Association); The
business model, specifically outlining the type of digital payment services and payment instruments
envisaged; Evidence that the PSP applicant holds the minimum initial capital required; A certified copy of

2. the bank guarantee on the initial capital; A description of the measures implemented to ensure adequate
levels of operational reliability, including disaster recovery and business continuity mechanisms; A
description of how the PSP Applicant will settle payment transactions accompanied by a certified copy of
the agreement with a settlement bank or a designated payment system; A copy of the system rulebook,
detailing the operational rules of the envisaged payment scheme; A risk management system; A report of a
feasibility and risk assessment study; An internal control system; and An outsourcing agreement if any.
9. According to the law, do PSPs have to meet the requirement of minimum initial capital at the
time of authorization?
Yes. USD2.2 million (Article 15.2(c) of Decree No. 101/2012/ND‐CP).
10. According to the law, do PSPs have to establish at least one separate account with commercial
banks to safeguard User Funds[9]? What are required for PSPs when managing the separate
account(s)?
They must ensure all received funds are placed in a ring‐fenced account at commercial bank exclusively
dedicated for this purpose as approved by the Central Bank; Ensure that the account balance is not at any
time be less than the outstanding balance owed to Users; Not use the Funds to engage in any lending activity,
including (but not limited to) the provision of credit and overdraft facilities; Not invest User Funds in any
type of financial asset; and Not transfer User Funds to another account used for other business activities.
11. According to the law, do PSPs have to hold and account User Funds separately from any
other funds they hold for other business purposes?
Yes. (Article 8.2 of Circular No. 39/2014/TT‐NHNN).
12. According to the law, do PSPs have to ensure that User Funds are covered by an insurance
policy or a guarantee from a credit institution?
No.
13. According to the law, do PSPs have to seek for approval from the related authority before
they intend to outsource any operational functions?
They cannot outsource the licensed activities (Article 6.2 of Circular No. 39/2014/TT‐NHNN).
14. According to the law, do PSPs, their agents and users have to comply with Anti‐Money
Laundering and Combating of Financing of Terrorism (AML/FT) law, standards and
measures?
Yes. (Article 7 of Circular No. 39/2014/TT‐NHNN).
15. According to the law, which of the following documents that PSPs/agents require when
performing customer due diligence processes?
For any natural person users: An original copy of a valid ID card/passport

3. For any legal person users: Investment/ Enterprise registration certificate; and Copy of passports of
authorized signatories.
16. According to the law, are PSPs allowed to charge users for registration?
Yes. (Articles 10‐13 of Circular No.39/2014/TT‐NHNN).
17. According to the law, do PSPs have a monthly load limit for Electronics Inc.[10] through an
issued payment instrument in your country?
No.
18. According to the law, do PSPs have a single payment transaction limit for Electronics Inc.
through an issued payment instrument in your country?
No.
19. What information is required for PSPs to disclose to Electronics Inc. upon the execution of a
payment transaction?
A unique reference number enabling the payer/payee to identify the payment transaction; The payment
transaction amount; The identity of the payer/payee; and The date on which the payment order was placed.
20. What are the main laws and regulations that govern the payment and settlement system in
the country?
Decree No. 101/2012/ND‐CP, Circular No. 39/2014/TT‐NHNN, Circular No. 46/2014/TT‐NHNN.
21. Does the PSP require additional information from Electronics Inc. for cross border payment
transactions?
Yes. The information include Additional identity confirmation and Detailed transaction purpose.
22. Does Electronics Inc. have to pay additional service fees to the PSP for cross border e‐
commerce transactions?
Yes. The fees include Currency conversion fee and International transaction fee.
23. Based on the pricing model above, how much transaction fee does Electronics Inc. have to
pay on a $20 transaction to the PSP in your country?
Domestic e‐commerce: Below $0.05 USD dollar
Cross border e‐commerce: $0.05 ‐ $0.10 USD dollar
24. What are the main laws and regulations about online payment authentication standards in
your country?

4. Law on Internet information security 2015, Law on Information Technology 2006, Law on E-transactions
2005, Circular No. 35/2015/TT‐NHNN, Circular No. 47/2014/TT‐NHNN.
25. According to the law, do PSPs have to provide two‐factor authentication using standards like
3D Secure?
Yes.
26. According to the law, do PSPs and users (like Electronics Inc.) have to comply with the
Payment Card Industry Data Security Standard (PCI DSS)?
Yes. (Section 2, Point 3.1.3, Decision No. 488/QD‐NHNN).
27. According to the law, do PSPs and users (like Electronics Inc.) have to install Transport Layer
Security (TLS) or Secure Sockets Layer (SSL) on webpage or internet browser?
Yes. (Article 15 of Circular No. 47/2014/TT‐NHNN).
28. According to the law, how long (in years) does PSPs have to store and retain all user and
transaction data from that of the original transaction?
20 years (Article 9.1(a) of Regulation attached to Decision No. 376/2003/QD‐NHNN).
29. According to the law, how long (in years) does a PSP have to store all details data of users’
personal information after the user relationship is terminated?
20 years from the original transaction, not depending on the relationship termination
30. According to the law, PSPs should keep user identification data and transaction records
confidential and can only be made available to?
The corresponding User, the State Bank of Vietnam, or By a court order in the country.
31. What are the main laws that regulate chargebacks regarding online payments in your
country?
The Civil Code of Vietnam, Circular No. 39/2014/TT‐NHNN.
32. The legal framework on chargebacks apply to:
Fraudulent transactions, Credit and service not processed; and An error in the amount.
33. According to the law, do banks hold initial amount to cover prospected chargebacks?
No.
34. Is there a legal time limit for Electronics Inc. to notify the PSP of any
unauthorized/incorrectly executed payment transaction?

5. No.
35. After a successful dispute, how many business days it usually takes for customers to get a full
chargeback of the original form of payment or an Electronics Inc. gift card?
3-10 days.
36. Do PSPs set a maximum predetermined threshold of monthly chargeback rate for Electronics
Inc.?
No.
DIGITAL MARKETS
1. Are merchants selling goods through Electronics Inc. legally mandated to comply with a legal
framework on online consumer protection? (i.e. is there an online consumer protection law
in your country?)
Yes. Law No. 59/2010/QH12 on Consumer Protection.
2. Are merchants selling goods through Electronics Inc. (i.e. engaged in distance or off‐premises
selling) legally mandated to comply with online information disclosure rules?
Yes.
3. What information are merchants on Electronics Inc. legally mandated to disclose to
consumers prior their online purchase?
Full business address of the merchant (i.e. geographical address); Identity of the merchant (i.e. trading
name, phone number, fax number, email address, etc.); Product information (availability, price, description,
etc.); Delivery information (time, price, etc.); Information about payment processes; Information about the
existence of a right of withdrawal (or cancellation); Information about complaint handling; Information
about the party bearing the cost of returning the goods in case of cancellation; Information on out‐of‐court
complaint and redress mechanism; Information on product guarantee, rights and obligations of the
merchants and customers in each transaction.
4. Are online information disclosure rules specified above applicable to mobile devices?
Yes.
5. Considering a domestic merchant selling a computer charger on Electronics Inc.’s platform,
he is legally mandated to comply with the following general rules related to the right of
withdrawal (or cancellation) for online purchases:
Information duty: Electronics Inc. must inform the customer of his right of withdrawal
Absence of reason: Electronics Inc.’s customer can withdraw from contract with no reason
Withdrawal period: Electronics Inc.’s customer can withdraw from contract after receiving the product

6. 6. What is the period (in number of days) during which the customer of Electronics Inc. can
withdraw (cancel) its purchase without any penalties and without giving any reason (also
called cooling‐off period), if applicable?
It depends on policy of each merchant.
7. In case of a dispute between a domestic customer and a domestic merchant on Electronics
Inc. for a low value sale (less than 30USD), what types of procedures are legally available for
the domestic consumer acting individually?
Use of the general judicial system for addressing online disputes; Use of alternative dispute resolution
(ADR) mechanism such as consultations, conciliation, or mediation; and Other provision for a dispute
resolution mechanism (e.g. administrative procedures before a specific authority).
8. Are merchants on Electronics Inc. legally mandated to comply with redress rules for online
purchase of goods?
Yes.
9. What types of remedy are legally enforced for online purchase of goods?
Monetary remedy: monetary payment
Non‐monetary remedy: repair, replacement
10. Is Electronics Inc, an e‐commerce platform, considered as an internet intermediary in your
jurisdiction?
No.
11. Bearing in mind that it processes data such as name, surname, data of birth, email address,
mail address, credit card information, preferences of its customers, does Electronics Inc., an
e‐commerce platform, have to comply with a legal or regulatory framework on data privacy?
Yes. Decree No. 52/2013/ND‐CP.
12. Bearing in mind that Electronics Inc. is managing the data it collects, does it have to process
differently non‐sensitive and sensitive personal data?
Yes.
13. What categories of personal data are considered sensitive in Electronics Inc.’s jurisdiction?
Political opinions, Sex life, Sexual orientation.
14. Under which conditions can Electronics Inc. lawfully process computerized personal data of
its adult customers (also called data subject)?
The customer has given consent to the processing of his personal data for one or more specific purposes;

7. Processing is necessary for the performance of a contract to which the customer is party;
Processing is necessary for compliance with a legal obligation to which Electronics Inc. is subject.
15. Regarding consent, what are the legal grounds on which Electronics Inc. can lawfully get its
customer’s consent (the customer is an adult) when collecting (non‐sensitive, if applicable)
personal data:
Consent must be freely given
Consent must be specific
Consent must be informed
Consent must be non‐ambiguous
Consent must be distinguishable from (or tied to) other matters
Consent must be obtained by a specific method.
16. Regarding data access, if a customer (an adult) requests Electronics Inc. information on the
processing of his personal data and is ready to bear the cost of it, to what degree is Electronics
Inc. obliged to provide it?
The customer can access all his personal data with no condition
17. Regarding data deletion (or erasure), if a customer (an adult) requests the deletion of his
personal data to Electronics Inc., to what degree is the latter obliged to comply?
All personal data must be deleted (or erased) under certain conditions; and Electronics Inc. can apply
suitable measures to protect the data or inform the customer that the request cannot be processed due to a
technical reason or any other reasons.
18. Is Electronics Inc. required to establish a procedure for the deletion of personal data if
requested by a customer (an adult)?
Yes.
19. To what degree is Electronics Inc. allowed to transfer personal data of local customers (also
local citizens) to non‐domestic third parties?
Totally free with certain countries but subject to certain conditions.
20. What are the general conditions under which Electronics Inc. can engage in cross‐border
data trade with a nondomestic third party? (general conditions exclude specific conditions
such as model contract clauses, binding corporate rules or other contractual arrangements.)

8. Adequacy approach: The country in which a non‐domestic third party is based has an “adequate level of
protection”, “an equivalent protection”, “a sufficient level of protection”, or any provision entailing an
adequacy approach.
21. What circumstances constitute an “adequate level of protection” when trading personal data
with a third‐party country?
the nature of the personal data, the country of final destination of that information, the law in force in the
country in question, the international obligations of that country, any relevant codes of conduct or other
rules which are enforceable in that country; any security measures taken in respect of the data in that
country.
22. Bearing in mind that Electronics Inc. is considered as a data controller, does Electronics Inc.
have to comply with any of the following security requirements for automated (computerized)
personal data?
Adoption of an internal policy for establishing procedures for preventing and detecting violations;
Performance of internal controls; Assessment of the harm that might be caused by a data breach; Awareness
program among employees.
23. Bearing in mind that Electronics Inc. processes personal data for marketing purposes, is it
monitored by a supervisory authority?
No.
24. Does Electronics Inc. have to comply with the following administrative procedures with the
supervisory authority to lawfully process personal data for marketing purposes?
There is no administrative procedures to process personal data for marketing purposes.
25. Given that Language Inc.[11] and free‐lance instructors[12], based abroad, sign a local
contract (Language Inc. is based in your country), what are the types of e‐signature granting
the same legal status as handwritten contracts?
E‐signature (click wrap, digitized signature, etc.)
Digital signature (need for a public key)
26. Does Language Inc. need to comply with any requirements on the use of a specific technology
(e.g. PKI) for a digital signature to have legal validity?
Yes. PKI.
27. On the contrary, is any form of digital signature including the following requirements equally
acceptable?
The digital signature helps verify the identity of the signatory (origin).

9. 28. Does the use of a specific technology (e.g. PKI) grant additional legal benefits in terms of the
legal recognition of the digital signature (e.g. validity in terms of burden of proof)?
No.
29. Does Language Inc.’s signature need to be certified by a Certification Authority (CA) in order
to be recognized as having full legal validity?
Yes.
30. Do certification authorities (CAs) need a license to operate?
Yes. The conditions include: (1) Being enterprises established under the laws of Vietnam; (2) Having
sufficient financial capacity to establish a system of technical equipment, organization, and maintenance of
activities in accordance with the scale of service provision; (3) Depositing at a commercial bank operating
in Vietnam or having a guarantee of a commercial bank operating in Vietnam of not less than 5 (five) billion
VND, or insurance buying commitments to solve risks and the compensation that may occur during the
course of service provision and make payment for expenses receiving and maintaining database of
enterprises in the event of withdrawal of licenses; (4) Having team of technical staffs, managers,
administration staffs, security managers and customer service personnel meeting professional requirements
and scale of services deployment of having no criminal records; (5) The legal representative having
knowledge of law on digital signatures and certification service of digital signatures; (6) Suitable
formulation of technical equipment system; (7) Having feasible technical plans and business plans,
consistent with the technical regulations and mandatory standards to apply; (8) Having plans to control the
entrance and exit of head offices, the right to access the system, right to enter, exit the place where the
equipment is located for providing for certification service of digital signatures; (9) Having contingency
plans to maintain the continuous, safe operation, and overcome when the problem occurs; (10) The entire
system of equipment used to service providers is located in Vietnam; (11) Construction of offices, places
where the machinery and equipment is located in accordance with the requirements of the law on prevention
and combat of fire and explosion; having ability of fighting against floods, earthquakes, electromagnetic
interference, illegal intrusion of man; and (12) Having public certification regulations in the form issued by
the Ministry of Post and Telecommunications, and contents in accordance with relevant laws.
31. How many CAs are available in your jurisdiction?
6-10 CAs.
32. Please list the most popular Certification Authorities available in your city:
1: VNPT‐CA 2: CA2‐CA 3: Viettel ‐CA
33. What is the average time and cost for Language Inc. to obtain a digital signature from a
certification authority (if applicable)?
5‐10 days; USD50‐210 per 15-month package
34. Does your country have a national VAT/GST scheme applying to imported services bought
on the internet?

10. Yes.
35. If applicable, is there a registration process for VAT/GST purposes for foreign‐based
companies (like tutors) selling through Language Inc.?
Yes. There is no threshold under which foreign‐based companies do not need to register.
BROADBAND REGULATORY FRAMEWORK
1. Does your country have a national broadband plan or policy to develop a high-speed access
network?
Vietnam has a national broadband plan in 2016 under Decision No. 149/QD-TTg of the Prime Minister
dated 21 January 2016 approving the program on the development of broadband telecommunications
infrastructure through 2020
2. What is the main body responsible for planning implementing the national broadband plan
Ministry of Information and Communications is the main body to plan and implement the national
broadband.
3. Does the plan include blended finance or PPP investment schemes for broadband expansion?
We are not aware of the plan includes blend finance or PPP investment schemes or applicable financial
instruments.
4. Does the plan include government investment in infrastructure to make broadband more
broadly available?
The Government focus to investment in the following area:
First Mile: international gateways or the segment of a telecommunications network where the internet enters
a country such as through cable landing stations or satellite links
Middle Mile: national backbone networks, or the segment of a telecommunications network linking a
network operator's core network to the local network plant
5. Does the plan include investments in cross border links and networks?
The plan under WTO’s Commitment include investments in cross border links. There are agreements in
effect or in preparation with other countries to foster cooperation or joint investment for cross border.
6. Does the plan or policy include new internet exchange points (IXPs)?
We do not see any updates related to internet exchange points in the policy
7. Does the plan have a universal service fund (USF)

11. Yes. Vietnam has a universal service fund at http://www.vnpt.vn and there is implicit funding arrangement
for USF
8. Are there fiscal incentives to accelerate internet deployment?
Now there are not fiscal investment to accelerate internet deployment.
9. Does Vietnam have a unified licensing regime?
Yes. WTO's Commitment, Law on Investment 2014
10. Does Vietnam have a policy for releasing more licensed spectrum?
Yes. Circular 46/2016/TT-BTTTT on list of license-exempt radio serves and accompanying technical and
operational conditions.
11. Does Vietnam assign spectrum on the basis of competitive auctions?
Yes. The spectrum auction winner are primarily evaluated on speed of build out, technology and quality of
spectrum.
12. Does Vietnam have policies and regulations that allow the following practices for spectrum
allocation?
Yes. Vietnam has spectrum shortage evaluations and spectrum caps.
13. What is the duration of the spectrum license?
15 years
14. Is there equal access to shared and/or government owner infrastructure such as road,
railways, water and power lines?
No.
15. According to the law, does Vietnam require its cable operators to provide open access for
internet services?
No.
16. Does your country have unbundling and line sharing rules?
No.
17. What restriction, if any, are placed on the level of foreign ownership of foreign telecom
operators?
We see the minimum level of local ownership mandated.

12. 18. Are there regulations regarding portability or preventing customer lock-in
No.
19. Does your country’s national broadband plan or policy set performance targets?
Vietnam has the national broadband plan with minimum download speed 22.77 mbps and minimum upload
speed 22.28 mbps.
20. Does Vietnam’s national broadband plan or policy allow different access technologies?
Yes
21. Are there backward compatibility requirements with legacy infrastructure?
Yes
22. Does Vietnam’s national broadband plan or policy set date localizations requirements
Yes
23. Are there spectrum harmonization efforts in the national broadband strategies?
No.
24. Does Vietnam’s national broadband plan set coverage targets?
Yes. The plan includes population with broadband with 40% of the population, schools with broadband
with 99% of schools and e-government with 100% national information portal, government portal.
25. Are peak usage charges allowed
No.
26. Are there fiscal incentives to increase access to broadband?
Yes. Incentives in rural broadband subsidies
27. Does Vietnam’s broadband plan or program include the rollout of free, public access points?
Enterprise Registration Certificate
ID Card or Passport of the legal representative
Contract Service with the broadband provide

13. 28. What documents are needed in order to secure a business broadband connection?
Enterprise Registration Certificate
ID Card or Passport of the legal representative
Contract Service with the broadband provide
29. Please list what Broadband Access Providers are available to connection in Vietnam?
VNPT, Viettel, FPT
***
Please do not hesitate to contact Dr. Oliver Massmann under omassmann@duanemorris.com if you have
any questions or want to know more details on the above. Oliver Massmann is the General Director of
Duane Morris Vietnam LLC.
THANK YOU!