AI Regulation Tracker  /  Draft rule

Vietnam's central bank drafts first AI-in-banking rules: human review of any AI decision a customer challenges

The State Bank of Vietnam is drafting its first circular on AI in banking. In its current form it would force lenders to give customers an explanation of automated decisions and a human re-review on request, plus a 24-hour incident-reporting clock.

By Anthony Guerriero  ·  Reviewed by The Leveraged Years Editorial Desk  ·  Published July 7, 2026  ·  Last updated July 7, 2026

The State Bank of Vietnam is drafting the country's first set of rules aimed squarely at how banks use artificial intelligence. According to an April 2026 analysis by Baker McKenzie, the draft circular would reach across the financial system, covering banks, foreign bank branches, payment-intermediary providers, credit-information companies, the Vietnam Asset Management Company and Deposit Insurance of Vietnam. Nothing here is binding yet. There is no circular number, no effective date, and the text is still moving through consultation. What follows is best read as a preview of where Vietnamese bank supervision is heading, not a rule anyone must follow today.

What the draft would require

The proposed duties track a familiar structure for anyone who has read a modern AI rule. Covered entities would classify each AI system by risk level, apply human oversight, and run impact assessments for systems judged high-risk. On the customer-facing side, firms would owe transparency and an explanation of the key factors behind an automated decision, and would have to monitor their models for algorithmic bias and discriminatory outcomes. The reporting duty is tight: serious incidents flagged to the regulator within 24 hours, with remediation results due in five working days.

The breadth of the covered list is itself notable. By naming payment-intermediary providers, credit-information companies, VAMC and Deposit Insurance alongside the banks, the draft reaches beyond traditional lenders to the data brokers and payment rails that increasingly sit behind an AI decision. A credit bureau feeding a scoring model, or a wallet provider screening transactions, would fall inside the same duty set as the bank at the counter. That design closes an obvious gap, because much of the AI risk in retail finance now lives in the vendors and utilities that banks rely on rather than in the bank's own code.

The clause that matters most

The single provision most likely to change daily practice is the right to human review. Under the draft, when a customer challenges an AI-driven decision, the firm would have to guarantee that a person re-examines it. Paired with the explanation duty, that lands directly on AI credit scoring and loan-denial workflows, the exact places where an applicant is most likely to push back. A lender cannot satisfy this by pointing to a model score. It would need a record of the factors that drove the outcome and a staffed path to a human who can look again.

Faster than the general AI Law

Two design choices signal how seriously the SBV is treating this. First, the 24-hour incident clock is stricter than the 72-hour reporting window reported under Vietnam's broader AI Law. Second, the circular would front-run that law's finance-sector grace period, which is reported to run to September 2027. In other words, the central bank appears ready to hold banks to AI-specific obligations before the general timeline would otherwise require it. For a sector regulator to move ahead of the headline statute is unusual and worth watching.

What it does not do

It is worth being precise about the limits. This is a consultation draft, so its scope, thresholds and definitions can all shift before issuance, and some may be dropped. It does not yet assign penalties that a firm can plan around, and it does not carry an effective date. Reading it as settled law would be a mistake. The value now is directional: it tells lenders which controls the SBV cares about, so teams can build toward them rather than scramble later.

The cross-border read for US firms

A US bank or fintech operating in Vietnam should recognize the shape of this. The explanation-and-review pairing echoes the adverse-action-notice logic that US lenders already run under fair-lending and credit-reporting rules, and the high-risk framing tracks the EU AI Act's treatment of credit scoring as a high-risk use. A firm that already documents the reasons behind automated credit decisions in the United States has a head start on what Vietnam appears to want. The gap to close is mostly the 24-hour incident clock and the formal human-review guarantee, both of which are more prescriptive than current US practice.

For now, the practical move is inventory and mapping. Identify every model that touches a customer decision, confirm it can produce a readable explanation, and make sure a challenged decision has somewhere human to go. That work holds its value whether or not the final circular keeps every clause in the draft.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.