|
MINISTRY OF SCIENCE AND TECHNOLOGY OF VIETNAM |
THE SOCIALIST REPUBLIC OF VIETNAM |
|
No. 08/2026/TT-BKHCN |
Hanoi, March 31, 2026 |
ON GUIDELINES FOR AUTHENTICATION OF INFORMATION OF TERRESTRIAL MOBILE SUBSCRIBERS
Pursuant to Law on Telecommunications No. 24/2023/QH15;
Pursuant to Law on Identification No. 26/2023/QH15;
Pursuant to the Law on Personal Data Protection No. 91/2025/QH15;
Pursuant to Decree No. 163/2024/ND-CP dated December 24, 2024 of the Government elaborating some articles and measures for enforcement of Law on Telecommunications;
Pursuant to Decree No. 69/2024/ND-CP dated June 25, 2024 of the Government on electronic identification and authentication amended by Decree No. 169/2025/ND-CP dated June 30, 2025 of the Government on science, technology, innovation activities on data and data products and services;
Pursuant to Decree No. 70/2024/ND-CP dated June 25, 2024 of the Government elaborating some articles and measures for enforcement of Law on Identification;
Pursuant to Decree No. 55/2025/ND-CP dated March 02, 2025 of the Government on functions, responsibilities, jurisdiction and organizational structure of the Ministry of Science and Technology;
At the request of the Director General of the Vietnam Telecommunications Authority;
Minister of Science and Technology promulgates the Circular on guidelines for authentication of information of terrestrial mobile subscribers.
This Circular provides guidelines for authentication of information of terrestrial mobile subscribers (hereinafter referred to as “authentication of subscriber information”) as prescribed in clause 2, Article 18 of Decree No. 163/2024/ND-CP dated December 24, 2024 of the Government elaborating some articles and measures for enforcement of Law on Telecommunications (hereinafter referred to as “Decree No. 163/2024/ND-CP”).
1. Terrestrial mobile telecommunications service users (hereinafter referred to as “mobile subscribers”).
2. Terrestrial mobile telecommunications service providers (hereinafter referred to as “telecommunications service providers”).
3. Authorities, organizations and enterprises engaging in management, use and provision of terrestrial mobile telecommunications services; and authentication of mobile subscribers.
Article 3. Implementation principles
1. Telecommunications service providers shall authenticate subscriber information by assessment and classification of mobile subscribers based on identification documents that entities use for registration of mobile subscribers in accordance with relevant laws.
2. Enterprises and entities engaging in collection and handling of personal data during authentication of subscriber information shall establish and fully implement procedures and mechanisms for supervision in accordance with laws on personal data protection, electronic identification and authentication.
3. After the effective date of this Circular, telecommunications service providers may only provide telecommunications services to new mobile subscribers if they have registered and verified subscriber information in accordance the laws.
4. Telecommunications service providers shall suspend outgoing services (making phone calls, sending SMS messages to other subscribers) for any mobile subscriber that changes device but fails to perform information authentication, or performs authentication that is incomplete or inaccurate as prescribed in Article 8 of this Circular.
Article 4. Methods for authentication of subscriber information
1. The authentication of subscriber information (including authentication of personal identification number, full name, date of birth and facial biometric data) shall be carried out by one of the following methods:
a) Online via the National Electronic Identification application (hereinafter referred to as “VNeID”);
b) Online via applications of telecommunications service providers as prescribed in clause 3, Article 16 of Decree No. 163/2024/ND-CP;
c) In person at locations owned and established by telecommunications service providers as prescribed in clause 1, Article 16 of Decree No. 163/2024/ND-CP.
d) In person at fixed-address locations established by other enterprises that are authorized by telecommunications service providers to perform subscriber information registration as prescribed in clause 2, Article 16 of Decree No. 163/2024/ND-CP.
2. Telecommunications service providers shall fully and accurately archive information and proofs of implementation of methods for authentication of subscriber information as prescribed by laws throughout the active period of mobile subscribers, unless otherwise provided by laws.
Article 5. Authentication of subscriber information of Vietnamese citizens registering H2H mobile numbers
Telecommunications service providers shall authenticate subscriber information using one of the following methods:
1. Use electronic authentication services to authenticate 04 data fields including personal identification number, full name, date of birth, and facial biometric data of individuals who register telecommunications numbers, or individuals within an organization that is assigned to use SIMs to match data in the National Population Database or Identification Database. Mobile subscribers that have been electronically authenticated shall be deemed to have fulfilled regulations in points a, b and c, clause 2, Article 18 of Decree No. 163/2024/ND-CP.
2. Perform authentication of 04 data fields including personal identification number, full name, date of birth, and facial biometric data of individuals who register for telecommunications numbers, or individuals within an organization that is assigned to use SIMs to match verified encrypted data of ID cards that are issued by police authorities. Mobile subscribers that have been authenticated in accordance with encrypted data of ID cards shall be deemed to have fulfilled regulations in points a, b and c, clause 2, Article 18 of Decree No. 163/2024/ND-CP.
3. For non-chip ID cards and the method prescribed in clause 1 of this Article cannot be applied for subscriber registration, telecommunications service providers shall comply with the following requirements:
a) Compare information on personal identification documents, and portrait taken at that moment of individuals who register for telecommunications numbers, or individuals within an organization that is assigned to use SIMs in the National Population Database or Identification Database to ensure a match of 04 data fields including personal identification number, full name, date of birth, and facial biometric data;
b) Make video calls as prescribed in point c, clause 2, Article 18 of Decree No. 163/2024/ND-CP;
c) For registration and activation of the second H2H SIM onwards, a One-Time Password (OTP) shall be sent to the previously registered/activated SIM in accordance with point b, clause 2, Article 18 of Decree No. 163/2024/ND-CP.
Article 6. Authentication of subscriber information of foreigners registering H2H mobile numbers
Telecommunications service providers shall authenticate subscriber information using one of the following methods:
1. Use electronic authentication services to authenticate 04 data fields including personal identification number; full name, date of birth, and facial biometric data of individuals who register for telecommunications numbers, or individuals within an organization that is assigned to use SIMs to match data in the National Immigration Database. Mobile subscribers that have been electronically authenticated shall be deemed to have fulfilled regulations in points a, b and c, clause 2, Article 18 of Decree No. 163/2024/ND-CP.
2. Other authentication methods shall only be carried out in accordance with points c and d, clause 1, Article 4 of this Circular and the following requirements:
a) For foreigners using valid passports in Vietnam under entry visas or maximum stay periods for visa-exempt countries to register subscriber information, telecommunications service providers shall carry out authentication methods as prescribed in points b and c, clause 2, Article 18 of Decree No. 163/2024/ND-CP for each number registered.
b) For foreigners using electronic identification accounts to register subscriber information, telecommunications service providers shall carry out authentication methods as prescribed in points b and c, clause 2, Article 18 of Decree No. 163/2024/ND-CP.
Article 7. Authentication of subscriber information of individuals of Vietnamese origin whose nationality is undetermined registering H2H mobile numbers
1. The authentication of subscriber information of H2H mobile numbers in cases where registrants or individuals within an organization that is assigned to use those number are of Vietnamese origin whose nationality has not been determined as prescribed in laws on identification shall be carried out in accordance with points c and d, clause 1, Article 4 of this Circular.
2. Telecommunications service providers shall carry out authentication methods as prescribed in points b and c, clause 2, Article 18 of Decree No. 163/2024/ND-CP for each number registered.
Article 8. Authentication of information of subscribers who change their terminal devices
Within 02 hours from the time that a subscriber changes a terminal device that is attached with a specific telecommunications number, telecommunications service providers shall review, detect, suspend outgoing telecommunications services (making phone calls, sending SMS messages to other subscribers), and notify the subscriber to re-authenticate their facial biometric data using one of the following methods:
1. Use electronic authentication services to authenticate portrait take at that moment of the subscriber to match data in the National Population Database, Identification Database or National Immigration Database; or authenticate portrait take at that moment of the subscriber to match verified encrypted data of ID cards that are issued by police authorities.
2. Compare portrait take at that moment of the subscriber to match the facial biometric data that is legally archived in the subscriber information database of telecommunications service providers. Telecommunications service providers are responsible for the accuracy and consistency of the facial biometric data that is being verified with verified data of such subscriber in accordance with Articles 5, 6 and 7 of this Circular before the subscriber change the device. The authentication of information to match facial biometric data shall comply with the following requirements:
a) The accuracy shall be determined in accordance with Vietnamese standards or international standards corresponding to the following criteria: False rejection rate must be under 5% and false acceptance rate must be 0,01% in accordance with FIDO Biometric Requirements (applicable to a minimum sample size of 10.000 samples);
b) There is an ability to detect biometric presentation attacks (Presentation Attack Detection – PAD) in accordance with international standards (such as NIST Special Publication 800-63B Digital Identity Guidelines: Authentication and Lifecycle Management; ISO 30107 – Biometric presentation attack detection; or FIDO Biometric Requirements) to prevent and combat fraud and impersonation of customers via images, videos and 3D masks;
c) Proofs of facial biometric data authentication shall show date and time that each authentication of subscriber information is performed.
3. For H2H mobile numbers, within 30 days from the suspension of outgoing telecommunications services, subscribers shall complete the re-authenticate their facial biometric data. If subscribers fail to comply with the prescribed deadline, telecommunications service providers shall suspend two-way telecommunications services and notify subscribers that the contract and the telecommunications service will be terminated if the authentication is not completed. The contract and telecommunications services shall be terminated 05 days after the suspension of two-way telecommunications services if entities fail to comply.
1. This Circular comes into force from April 15, 2026, except for clause 2 of this Article.
2. Article 8 of this Circular comes into force from June 15, 2026.
Article 10. Transitional provisions
1. For mobile numbers which are registered and authenticated by using a level-2 electronic identification account, ID card or chip-embedded citizen identification card, or mobile numbers which are used for registration of level-2 electronic identification account, subscribers are not required to re-authenticate their subscriber information or facial biometric data, except for cases of change of terminal devices prescribed in Article 8 of this Circular.
2. For H2H mobile numbers which are registered by using a level-2 electronic identification account, ID card or chip-embedded citizen identification card, and authenticated via VNeID, subscribers are not required to re-authenticate subscriber information or facial biometric data, except for cases of change of terminal devices prescribed in Article 8 of this Circular.
3. For H2H mobile numbers which are registered by using a 09-digit ID card, and authenticated via VNeID:
a) Telecommunications service providers shall update subscriber information, provide facial biometric data of subscribers within 60 days from the date on which providers receive information via VNeID;
b) Telecommunications service providers shall suspend outgoing telecommunications services (making phone calls, sending SMS messages to other subscribers) for subscribers who have not updated their subscriber information, provide additional facial biometric data, or provide facial biometric data that is incomplete and inaccuracy.
4. For H2H mobile numbers where individuals confirm via VNeID that they are not registered or not using such numbers:
a) Telecommunications service providers shall continuously notify individuals using mobile numbers within 05 days (at least once a day) from the receipt of the information via the VNelD application individuals confirm that they are not registered or not using such numbers to request them to re-enter into the contract and re-authenticate facial biometric data. If individuals using the mobile phone number fail to comply with the request, telecommunications service providers shall suspend outgoing telecommunications services (making phone calls, sending SMS messages to other subscribers).
b) Within 60 days from the suspension of outgoing telecommunications services, telecommunications service providers shall update and standardize subscriber information and provide additional facial biometric data of subscribers;
c) After the deadline prescribed in point b of this clause, for subscribers that have not standardized their subscriber information and provided additional facial biometric data, telecommunications service providers shall suspend two-way telecommunications services, and notify subscribers that the contract and telecommunications services shall be terminated if they fail to comply. The contract and telecommunications services shall be terminated 05 days after the suspension of two-way telecommunications services if entities fail to comply.
5. For H2H mobile numbers of Vietnamese citizens in cases not prescribed in clauses 1, 2, 3 and 4 of this Article:
a) Within 30 days from the effective date of this Circular, telecommunications service providers shall send notifications requesting subscribers to update, standardize information and authenticate their facial biometric data;
b) Within 60 days from the effective date of this Circular, telecommunications service providers shall suspend outgoing telecommunications services (making phone calls, sending SMS messages to other subscribers) and send notices notifications subscribers to update and standardize their information;
c) Within 60 days from the suspension of outgoing telecommunications services, telecommunications service providers shall update, standardize subscriber information, and provide additional facial biometric data of subscribers;
d) After the deadline prescribed in point c of this clause, for subscribers that have not standardized their subscriber information and provided additional facial biometric data, telecommunications service providers shall suspend two-way telecommunications services, and notify subscribers that the contract and telecommunications services shall be terminated if they fail to comply. The contract and telecommunications services shall be terminated 05 days after the suspension of two-way telecommunications services if entities fail to comply.
6. For mobile numbers registered by foreigners using their passports:
a) Within 60 days from the effective date of this Circular, telecommunications service providers shall send notifications and re-authenticate subscriber information as prescribed in Article 6 of this Circular.
b) Telecommunications service providers shall suspend outgoing telecommunications services (making phone calls, sending SMS messages to other subscribers) for subscribers who fail to re-authenticate, or whose re-authentication is incomplete or inaccurate. After the deadline prescribed in point a of this clause, for subscribers that have not re-authenticated, or provided incomplete or inaccuracy re-authentication, telecommunications service providers shall suspend two-way telecommunications services, and notify subscribers that the contract and telecommunications services shall be terminated if they fail to comply. The contract and telecommunications services shall be terminated 05 days after the suspension of two-way telecommunications services if entities fail to comply.
7. Within 30 days from the effective date of this Circular, telecommunications service providers shall submit the list and information of mobile numbers that are registered and used before the effective date of this Circular to authorities in charge of identification of the Ministry of Public Security for updating into the National Population Database and authenticating the information. To be specific:
a) For subscribers registered by using electronic identification accounts, ID cards and citizen identification cards, the following information shall be submitted: phone number and document number.
b) For subscribers registered by using other documents, the following information shall be submitted: document number, phone number, full name, date of birth.
1. Chief of Office; Director General of the Vietnam Telecommunications Authority; heads of authorities and units affiliated to the Ministry of Science and Technology; relevant organizations and individuals are responsible for implementing this Circular.
2. Every 06 months or at the request, the Vietnam Telecommunications Authority shall take charge and cooperate with relevant authorities in conducting inspection and assessing the implementation of this Circular of telecommunications service providers; handling or proposing competent authorities for handling violations in accordance with the laws.
3. Authorities and entities shall report any issues during the implementation to the Ministry of Science and Technology (Vietnam Telecommunications Authority) for guidelines and resolution.
|
MINISTER Nguyen Manh Hung |
