High-risk AI systems include those automatically executing payments exceeding VND 10mn per transaction or total daily value exceeding VND 20mn for individual customers, and VND 50mn or VND 100mn, respectively, for organizations.
AI systems automatically making credit decisions involving VND 50mn or more are also classified as high-risk.
Institutions must conduct cybersecurity assessments, implement data security controls, manage AI-related risks through three lines of defense, and assess the impact of high-risk AI systems.
The circular takes effect on Nov. 15, 2026.
On Feb. 13, VIE CB proposed a circular on AI risk management in banks.
VIE CB drafted a circular stipulating safety, risk management and conditions for deploying artificial intelligence (AI) applications in the banking sector.
Follows VIE GVT Oct. 2025 proposed Law on artificial intelligence, see #272175.
Outline of Draft Circular
Establishes a framework of safety requirements, risk management, and deployment conditions for the application of AI in banking activities.
Also, serves as a unified basis for credit institutions in deployment and for supervisory authorities in monitoring and promoting the application of AI in banking activities.
Controls and mitigates risks arising from AI applications (credit scoring, loan appraisal, electronic know your customer (eKYC), fraud detection, advisory/decision support).
Plus, it stipulates conditions to be met before an AI system is put into operation, including internal approval documentation and personnel requirements for deployment.
Protects the lawful rights and interests of relevant organizations and individuals.
It meets legal requirements for issuing implementing guidance documents for the Law on artificial intelligence, ensuring timely and coordinated implementation.
In addition, the circular states that responsibility for risk management in the application of AI lies with the board of directors.
Consultation Period
Consultation is open, but the deadline for submitting comments was not specified.
High-risk AI systems include those automatically executing payments exceeding VND 10mn per transaction or total daily value exceeding VND 20mn for individual customers, and VND 50mn or VND 100mn, respectively, for organizations.
AI systems automatically making credit decisions involving VND 50mn or more are also classified as high-risk.
Institutions must conduct cybersecurity assessments, implement data security controls, manage AI-related risks through three lines of defense, and assess the impact of high-risk AI systems.
