AI Regulation Tracker  /  Regulation in force

Vietnam confines AI credit scoring, open APIs and P2P lending to a State Bank sandbox

Under Decree No. 94/2025/ND-CP, in force in 2025 though its exact effective date is reported but unconfirmed, fintechs and banks can run AI credit scoring, open-API services or peer-to-peer lending only inside a licensed testing program at the State Bank of Vietnam. A completion certificate is the gate to full-market rollout.

By Anthony Guerriero  ·  Reviewed by The Leveraged Years Editorial Desk  ·  Published July 7, 2026  ·  Last updated July 7, 2026

Vietnam has put a gate in front of some of the most commercially active corners of fintech. Under Decree No. 94/2025/ND-CP, a controlled-testing regime that functions as a regulatory sandbox, three activities can be run only inside a program licensed by the State Bank of Vietnam: AI credit scoring, open-application-programming-interface (open API) services, and peer-to-peer lending. For firms in these lines, entering the Vietnamese market is now a supervised, time-boxed process rather than a straight product launch.

What the decree does

The decree names a controlled-testing mechanism for banking and identifies the activities that must pass through it. Credit scoring is called out explicitly as a sandbox-gated activity, which matters because AI-driven scoring sits at the center of modern lending, buy-now-pay-later, and thin-file underwriting products. Open APIs, the connective tissue of open banking, and peer-to-peer lending, which matches individual lenders and borrowers, complete the covered set.

According to secondary banking guidance from IFLR and VILAF, a sandbox license runs for up to two years and can be extended twice, by one year each time. That gives a maximum supervised runway of roughly four years. The endpoint is a certificate of testing completion. As reported, that certificate is what allows a tested activity to move from the sandbox into full-market operation. The mechanics of the license term and the extension count are attributed here to those secondary sources; the authoritative terms sit in the decree text on the government gazette.

Who has to pay attention

The reach is practical rather than theoretical. A startup building an AI scoring model for Vietnamese borrowers, a bank exposing account data through APIs to third parties, and a platform running a P2P marketplace all fall within the covered activities. Foreign firms are not exempt by virtue of being foreign; the question is whether the activity is offered into Vietnam, not where the company sits. That makes the decree a market-access rule as much as a supervision rule.

What it does not do

The decree does not ban these activities, and it is not a general AI statute. It is a sector-specific mechanism inside banking supervision, run by the central bank. It does not, on the facts confirmed here, set out penalties, model-accuracy standards, or fair-lending tests in the way a dedicated AI-in-finance rule might. Firms outside the three named activities are not automatically pulled in. Reading it as a blanket AI regulation would overstate it; reading it as a live licensing checkpoint for scoring, open APIs and P2P lending is accurate.

The cross-border read for a US audience

The design will look familiar to anyone who has followed the UK Financial Conduct Authority sandbox or the Monetary Authority of Singapore's testing regime. Vietnam is borrowing a well-worn supervisory tool and positioning itself as an ASEAN fintech test-bed. For a US firm, the immediate consequence is procedural: a product that could ship in a lighter-touch market cannot go live in Vietnam on the same timeline, because the covered activities must clear a State Bank testing cycle first. It does not bind US operations at home, but it does shape any Vietnam launch plan, and it signals the direction of travel for AI lending oversight across the region.

The bottom line for compliance teams

Treat covered products as licensable, not launchable. The operative sequence is application, supervised testing under a term-limited license, and only then full rollout once the completion certificate is in hand. Build that timeline into product and capital plans early, and verify the current application procedure and any comment or intake windows directly with the State Bank of Vietnam, since the authoritative details live in the decree and its implementing guidance rather than in secondary summaries.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.