[2025] Conditions for Trust Service Business in Vietnam

I. Conditions for Trust Service Business in Vietnam:

According to Article 29 of the Law on Electronic Transactions 2023 ("LGDDT") and Article 18 of Decree 23/2025/ND-CP regulating electronic signatures and trust services ("ND 23"), the conditions for trust service business in Vietnam must meet the following requirements:

1. Financial Conditions to Address Risks and Potential Compensation During Service Provision and Payment of Fees for Receiving and Maintaining Service-Related Information Databases: Enterprises may choose to implement one of the following forms:

a) Escrow at a commercial bank in Vietnam, applicable to one or more trust services. The escrow amount is 10 billion VND for every 300,000 subscribers and no less than 10 billion VND, provided that the enterprise does not collect more than 01 year of prepaid fees from subscribers.

b) Purchase of liability and damage insurance for trust service provision activities to ensure the rights of subscribers throughout the service provision period.

2. Management and Technical Personnel Conditions:

a) System operation personnel, including: administrators, operators, information security, access control, monitoring and inspection, digital signature certificate lifecycle management, key lifecycle management.

b) Service provision personnel, including: technical auditors, security, issuance, suspension, revocation, installation, and warranty; subscriber identity verification (for public digital signature authentication services and data message authentication services).

c) Personnel responsible for information security must have a university degree or higher in information security and at least 02 years of experience corresponding to the trained field.

d) Personnel responsible for administration, operation, technical audit, issuance, suspension, revocation, installation, warranty, monitoring, inspection, and key lifecycle management must have a university degree or higher in information technology or a closely related field and at least 02 years of experience corresponding to the trained field.

3. Technical Plan for Service Provision Activities, Applicable to All Types of Trust Services, Must Specify the Following Contents:

a) Compliance with standards, technical regulations, and technical requirements for digital signatures, digital signature certificates; trust services; network information security; network security.

b) Full, accurate, and up-to-date storage of subscriber information; updating the list of valid, suspended, and revoked digital signature certificates; subscribers can access and use the Internet 24 hours a day and 7 days a week.

c) Ensuring that each key pair is randomly generated and only once; having features to ensure that the private key is not detected when the corresponding public key is available.

d) Warning, preventing, and detecting illegal access in the electronic environment.

e) The digital signature certificate lifecycle management component is designed to minimize direct contact with the electronic environment and be independent of systems not serving trust services.

f) The information system must ensure network information security at least at level 3 and protect personal data in accordance with the law on network information security and network security.

g) Controlling access, system access rights, and access rights to equipment locations.

h) Contingency to ensure safe and continuous operation and recovery in the event of incidents, data backup procedures, online data backup, data recovery, with the ability to recover data within 08 working hours from the time the system encounters an incident; the backup center is at least 20 kilometers away from the main data center and ready to operate when the main system encounters an incident.

i) The service information system is located in Vietnam.

k) Certification regulations as specified in Article 29 of ND 23.

II. Dossier for Applying for, Re-issuing, Changing Content, and Extending Trust Service Business Licenses:

1. Dossier for Applying for a Trust Service Business License:

a) Application for a trust service business license.

b) A certified true copy, including a copy issued from the original book or a notarized copy or a copy compared with the original of one of the following documents: business registration certificate, investment registration certificate for foreign investors, establishment decision or other valid equivalent certificates or licenses as prescribed by investment and enterprise laws.

c) Document proving compliance with financial conditions.

d) Management and technical personnel dossier, including: criminal record, notarized copies of university degrees or higher of management and technical personnel, job descriptions and relevant experience, labor contracts, and assignment decisions.

e) Technical plan for service provision activities suitable for each type of trust service.

f) Certification regulations.

2. Dossier for Re-issuing a Trust Service Business License:

a) Application for re-issuance of a license due to the expiration of the old license.

b) Document proving compliance with financial conditions.

c) Information on changes in the enterprise related to business conditions as specified in Article 29 of the Law on Electronic Transactions (if any).

d) Report on license implementation status from the date of issuance to the date of application for re-issuance.

3. Dossier for Changing the Content of a Trust Service Business License:

a) Application for changing the content of the license.

b) Report describing the requested change details and related documents.

4. Dossier for Extending a Trust Service Business License:

a) Application for extending the trust service business license of the enterprise due to the expiration of the old license.

b) Document proving compliance with financial conditions.

c) Report on license implementation status from the date of issuance to the date of application for extension.

III. License Suspension:

1. Trust Service Providers Will Have Their Licenses Suspended for No More Than 06 Months in the Following Cases:

a) Providing services that deviate from the content stated in the license.

b) Failing to meet one of the business conditions specified in Article 18 of this Decree from the time of service commencement.

c) Failure to fully and accurately declare and pay service fees for maintaining the digital signature certificate status checking system as prescribed by law on fees and charges for more than 06 months.

2. Procedures for License Suspension, Digital Signature Certificate Suspension:

a) The Ministry of Information and Communications organizes a meeting and prepares a meeting record with the trust service provider in one of the cases specified in Clause 1 of this Article. Within 07 working days from the date of issuing the record, the Ministry of Information and Communications considers and issues a suspension decision.

b) Within 05 working days, the national electronic authentication service provider suspends the digital signature certificate of the trust service provider and publishes it on the website (https://rootca.gov.vn/) in case the trust service business license is suspended or the trust service information system does not meet the technical audit regulations.

During the license suspension period, if the trust service provider remedies the reason for suspension, the Ministry of Information and Communications will allow the trust service provider to continue providing services; restore the digital signature certificate within 07 working days from the date of remedying the reason for suspension.

IV. License Revocation:

Trust service providers will have their licenses revoked in the following cases:

a) Not wishing to continue providing services.

b) Dissolution or termination of operation.

c) Being declared bankrupt by a court decision.

d) Merger or consolidation.

e) Within 01 year from the date of licensing, the trust service provider fails to implement the conditions specified in Article 18 of this Decree in practice, except for force majeure events or objective obstacles as prescribed by law, which the trust service provider has reported in writing to the Ministry of Information and Communications.

f) Falsifying documents in the application for issuance, extension, or re-issuance of a license or erasing or amending the content of the issued license.

g) Failure to remedy the reason for suspension specified in Clause 1 of Article 22 of this Decree after the designated suspension period of the competent authority.

h) Committing prohibited acts as specified in Article 6 of the Law on Electronic Transactions.

 

The information contained in this article is general and intended only to provide information on legal regulations. DB Legal will not be responsible for any use or application of this information for any business purpose. For in-depth advice on specific cases, please contact us.

For more information: Our Vietnamese social page or  English social page

Call Us: