From idea to market: fintech sandbox takes shape

Now, clear boundaries will be set for financial innovation to be tested and potentially scaled. Participation is limited to legal entities established in Vietnam, including licensed credit institutions, fintech companies in formal partnership with such institutions, and independent fintech firms operating without a banking partner but offering services directly to users.

Currently, the sandbox permits three activities: credit scoring tools that improve access to credit for the underbanked; open APIs enabling secure and standardised data sharing between financial institutions and third-party providers; and peer-to-peer (P2P) lending platforms that support digital loan agreements in VND.

Other fintech areas such as digital assets, robo-advisory, and insurtech are excluded, reflecting a cautious regulatory stance aimed at balancing innovation with financial safety and consumer protection.

Qualified entities may be granted a certificate of registration for sandbox participation by the SBV. The certificate formalises regulatory permission to operate within the sandbox. The SBV may consult other authorities depending on the solution’s scope. Approved solutions are subject to a testing period of up to two years, with possible extensions of up to 12 months per case, for a maximum of two extensions.

The SBV defines the scope of the trial based on the applicant’s proposal and regulatory input. These parameters will be explicitly stated in the certificate. All sandbox activities must be conducted within Vietnam; cross-border testing is not permitted.

Among the sandbox-approved activities, P2P lending is subject to the highest level of scrutiny due to potential risks around borrower protection, over-lending, and data privacy. P2P companies must be Vietnamese-owned, not under corporate restructuring, and led by executives who are Vietnamese nationals with relevant degrees and at least two years of experience in the banking or finance sector. They must not hold executive roles in credit institutions or manage pawnshops or informal lending entities.

IT systems must be located in Vietnam. Data must be stored securely, anonymised, and shared only with consent or as required by law. The platform must have robust backup and security systems in place, managed by a qualified IT team. Fintech companies seeking to test P2P solutions must meet strict eligibility criteria.

To participate, P2P platforms must implement borrower debt tracking systems integrated with the Credit Information Centre (CIC), ensure all financial transactions are conducted through bank accounts or licensed e-wallets, and cap loan terms at a maximum of two years.

During the testing phase, P2P platforms must avoid conflicts of interest by prohibiting staff, board members, and executives from acting as borrowers or lenders.

They must ensure full transparency of loan terms, interest rates, fees, and user rights, and verify each borrower’s total outstanding debt using CIC data before loan disbursement.

Participants are only allowed to operate within the services approved by the SBV. They may not provide guarantees, act as users, or facilitate services for pawnshops or unlicensed lenders. They must also file quarterly reports and provide ad hoc updates to the SBV, including information on testing progress, risk assessments, and performance indicators. The SBV may require additional software tools for real-time monitoring or enhanced data reporting.

User protection measures must be in place: risk disclosures must be issued, customers must be informed that the solution is under testing, and complete information about products and applicable fees must be clearly provided. Data privacy must be protected using encryption, anonymisation, and consent-based data sharing protocols. Systems must also be established for handling complaints, and any change to the solution’s functionality or scope requires prior SBV approval.

The SBV may revoke a participation certificate under various scenarios: failure to commence testing within 90 days (except due to force majeure), serious legal violations or technical failures that may harm customers or financial stability, non-remediation of sandbox breaches within 15 days, or violation of the scope of participation. P2P platforms may also face revocation if they fail to implement required borrower exposure controls.

Revocation leads to the termination of sandbox activities but does not imply non-compliance with Vietnam’s broader business laws. Participants remain responsible for assessing their legal standing and compliance obligations independently.

At the end of the testing period, the SBV will evaluate each participant based on testing performance, compliance, and feedback from relevant ministries. The central bank may then decide to revoke the certificate, extend the testing phase, or issue a certificate of completion. This certificate may be granted if the solution is already regulated under current law or does not require conditional licensing.

The completion certificate is not a business licence and does not guarantee full market access. It only confirms successful participation in the sandbox. Nonetheless, for fintech firms, it can serve as a strong regulatory endorsement that enhances investor confidence, supports strategic partnerships, and lays the groundwork for long-term market entry.

The sandbox is not a shortcut to market entry, nor a substitute for long-term licensing. But for serious innovators, it offers a meaningful early-mover advantage. For those able to exit with a certificate of completion, the benefits may extend well beyond the trial period - in investor confidence, partner validation, and future licensing pathways.