|
STATE BANK OF VIETNAM |
SOCIALIST REPUBLIC OF VIETNAM |
|
No. 59/2025/TT-NHNN |
Hanoi, December 29, 2025 |
ON THE PROVISION AND USE OF SPECIALIZED DIGITAL SIGNATURES AND SPECIALIZED DIGITAL CERTIFICATES OF THE STATE BANK OF VIETNAM
Pursuant to the Law on the State Bank of Vietnam No. 46/2010/QH12;
Pursuant to the Law on Information Technology No. 67/2006/QH11;
Pursuant to the Law on Electronic Transactions No. 20/2023/QH15;
Pursuant to the Law on Credit Institutions No. 32/2024/QH15, amended by Law No. 96/2025/QH15;
Pursuant to Decree No. 23/2025/ND-CP of the Government on digital signatures and trust services;
Pursuant to Decree No. 26/2025/ND-CP of the Government on functions, duties, powers and organizational structure of the State Bank of Vietnam;
At the proposal of the Director of the Department of Information Technology;
The Governor of the State Bank of Vietnam hereby issues a Circular on the provision and use of specialized digital signatures and specialized digital certificates of the State Bank of Vietnam.
This Circular provides for the provision and use of specialized digital signatures and specialized digital certificates of the State Bank of Vietnam (hereinafter referred to as the State Bank).
1. Units under the State Bank; credit institutions; foreign bank branches; payment intermediary service providers; credit information companies; Vietnam State Treasury; Deposit Insurance of Vietnam.
2. Other organizations using specialized digital signatures and specialized digital certificates of the State Bank (hereinafter referred to as digital signatures and digital certificates) in electronic transactions organized by the State Bank.
For the purpose of this Circular, these terms below shall be construed as follows:
1. Root certificate means the digital certificate issued by the State Bank to itself in the process of initializing the State Bank’s digital signature certification system.
2. The State Bank’s digital signature certification system means the information system providing infrastructure and services for the issuance, management and verification of digital certificates and ensuring the creation and verification of digital signatures.
3. Digital certificate means the certificate issued by the State Bank to a subscriber to confirm that the subscriber is authenticated as the signatory of the digital signature.
4. Subscriber means an organization or individual to whom the State Bank has issued a digital certificate.
5. Subscriber management organization means units under the State Bank, credit institutions, foreign bank branches, payment intermediary service providers, credit information companies, Vietnam State Treasury, Deposit Insurance of Vietnam, or other organizations managing subscribers using the State Bank’s digital signatures.
6. Private key means one of the keys in a key pair belonging to an asymmetric cryptographic system, used to create a digital signature.
7. Public key means one of the keys in a key pair belonging to an asymmetric cryptographic system, used to verify a digital signature created by the corresponding private key in the key pair.
8. Signatory means a subscriber who uses their own private key to digitally sign a data message under their name.
9. Relying party means an organization or individual who receives a data message digitally signed by the signatory, and uses the signatory’s digital certificate to verify the digital signature in the received data message.
10. Activation code means information issued to a subscriber comprising a reference number and an authentication code used for authentication during the activation of the digital certificate.
11. Activating the digital certificate means the process by which a subscriber uses the activation code to authenticate, generate a key pair comprising a private key and a public key, and store them in a dedicated storage device (hereinafter referred to as a cryptographic token).
12. Authorized person means the head of units under the State Bank, or the legal representative or authorized representative of the agencies and organizations prescribed in Article 2 of this Circular.
13. Certificate-authenticated service means services on information systems in which a subscriber may use a digital certificate to sign or authenticate. A digital certificate may be used to sign or authenticate on one or more information systems. Information systems using the State Bank’s digital certificates include:
a) The National Interbank Electronic Payment System;
b) The State Bank Reporting System;
c) The Open Market Operations and Auction System, comprising the following service modules:
– Open market operations and auctions;
– Issuance, payment, extension and cancellation of special bonds;
– Issuance of State Bank treasury bills;
– Refinancing.
d) The Payment Fraud Risk Management and Monitoring Information System;
dd) The Anti-Money Laundering Reporting System;
e) The information system serving the monitoring of operations of people’s credit funds and microfinance institutions;
g) Other systems as decided by the Governor of the State Bank.
Article 4. Organization responsible for creating digital signatures and digital certificates
The Department of Information Technology is the focal unit responsible for managing, operating the technical infrastructure and creating digital signatures and digital certificates of the State Bank.
Article 5. Content of digital certificates
Digital certificates issued by the State Bank shall contain the following information:
1. Name of the State Bank.
2. Name of the subscriber.
3. Unique identifier of the subscriber.
4. Serial number of the digital certificate.
5. Validity period of the digital certificate.
6. Data for verifying the digital signature of the agency, organization or individual to whom the digital certificate has been issued.
7. Digital signature of the State Bank.
8. Purpose and scope of use of the digital certificate.
9. Legal liability of the State Bank.
Article 6. Submission and receipt of digital certificate issuance applications
1. Methods of submission and receipt of applications
The subscriber management organization shall submit applications to the State Bank (Department of Information Technology) through one of the following methods:
a) Electronic applications submitted online through the National Public Service Portal;
b) Paper applications submitted in person at the single window division of the State Bank or sent by postal service;
c) Applications submitted through the State Bank’s Document Management and Workflow System (applicable to units under the State Bank).
The Department of Information Technology shall only receive and process paper applications or applications submitted through the State Bank’s Document Management and Workflow System where the National Public Service Portal encounters an incident that prevents it from operating.
Where a unit has already submitted an electronic application through the National Public Service Portal or submitted an application through the State Bank’s Document Management and Workflow System, it shall not submit a paper application to the Department of Information Technology.
2. Requirements for applications
a) Where electronic applications are submitted
The subscriber management organization shall enter information into the electronic forms on the National Public Service Portal corresponding to Appendix I through Appendix VII issued together with this Circular. For other documents in the application such as appointment decisions, authorization documents or task assignment documents, the subscriber management organization shall attach digitized electronic copies from the originals (PDF format files).
b) Where paper applications are submitted
The subscriber management organization may choose to submit either the original or a copy (and present the original for comparison upon request by the Department of Information Technology).
3. Processing results
The Department of Information Technology shall send an electronic document containing the processing results or the reasons for refusal where the application is not approved, to the subscriber management organization in accordance with regulations on the processing of administrative procedures under the single-window mechanism. Where the administrative procedure processing information system encounters an incident, the results shall be sent to the subscriber management organization by postal service.
Article 7. Subscriber’s cryptographic token
1. The Department of Information Technology shall be responsible for publishing on the State Bank’s online portal guidelines on the types and technical specifications of subscribers’ cryptographic tokens.
2. The Department of Information Technology shall provide cryptographic tokens to administrative units under the State Bank. Public sector entities under the State Bank and other subscriber management organizations shall procure cryptographic tokens in accordance with the guidelines of the Department of Information Technology.
3. The sending and receiving of cryptographic tokens between the Department of Information Technology and administrative units under the State Bank shall be carried out in person or through postal service.
MANAGEMENT AND ISSUANCE OF DIGITAL CERTIFICATES
Article 8. Digital certificate management and issuance activities
1. Issuance of digital certificates and enabling of certificate-authenticated services.
2. Update of digital certificate information.
3. Change of the activation code of digital certificates.
4. Renewal of digital certificates.
5. Suspension of digital certificates.
6. Reinstatement of digital certificates.
7. Revocation of digital certificates and disabling of certificate-authenticated services.
8. Online maintenance of the digital certificate database.
Article 9. Issuance of digital certificates and enabling of certificate-authenticated services
1. Issuance of digital certificates and enabling of certificate-authenticated services for individuals
The application for issuance of a digital certificate or enabling of additional certificate-authenticated services for an individual shall include:
a) Application form for issuance of or enabling of additional certificate-authenticated services on the digital certificate for an individual in accordance with Appendix I issued together with this Circular;
b) A document expressing the subscriber’s consent for the Department of Information Technology to collect and process personal data for the purpose of issuing a digital certificate to the subscriber in accordance with Appendix VIII issued together with this Circular;
c) Where the individual to be issued a digital certificate is an authorized person of a state agency, the subscriber management organization shall attach an appointment decision of the authorized person to the application;
d) Where the individual to be issued a digital certificate is a person authorized by or assigned duties by the authorized person, the subscriber management organization shall attach an authorization document or duty assignment document to the application. The content of the authorization or duty assignment shall clearly state that the authorized or duty-assigned person is permitted to represent the organization in signing and approving files, documents, records, reports and transactions on information systems corresponding to the certificate-authenticated services requested for the digital certificate. The authorized person shall not re-delegate the authorization to another person.
2. Issuance of digital certificates and enabling of certificate-authenticated services for organizations
The application for issuance of a digital certificate or enabling of additional certificate-authenticated services for an organization shall comprise: an application form for issuance of or enabling of additional certificate-authenticated services on the digital certificate for an organization in accordance with Appendix II issued together with this Circular.
3. Where a digital certificate has been issued and has expired or has been revoked, and the subscriber wishes to continue using it, the subscriber shall submit an application as prescribed in clause 1 of this Article for an individual digital certificate or clause 2 of this Article for an organizational digital certificate, in order to be issued a new digital certificate as a replacement.
4. Where a digital certificate has been issued and is still valid, but the cryptographic token is damaged or the digital certificate has been deleted from the cryptographic token or has become unusable due to other causes, and the subscriber wishes to continue using it, the subscriber shall submit an application for re-issuance of a replacement digital certificate as follows:
a) For digital certificates issued to individuals: an application form for issuance of or enabling of additional certificate-authenticated services on the digital certificate for an individual in accordance with Appendix I issued together with this Circular.
b) For digital certificates issued to organizations: an application form for issuance of or enabling of additional certificate-authenticated services on the digital certificate for an organization in accordance with Appendix II issued together with this Circular.
The re-issued digital certificate shall have a validity period equal to the remaining validity period of the most recently issued digital certificate.
5. Processing time and results
Within 3 working days from the date of receipt of a valid application for issuance of a digital certificate or enabling of additional certificate-authenticated services, the Department of Information Technology shall issue the digital certificate or enable additional certificate-authenticated services for the subscriber. Where a digital certificate is issued, the Department of Information Technology shall send the activation code together with the digital certificate issuance notification to the subscriber. Where additional certificate-authenticated services are enabled, the subscriber shall not be required to re-activate the digital certificate.
Within 2 working days from the date of receipt of the application, where the application is invalid, the Department of Information Technology shall refuse to process the application and clearly state the reasons. Feedback and processing results shall be provided in accordance with clause 3 Article 6 of this Circular.
6. The activation code of a digital certificate shall be valid for a maximum of 30 days from the date of issuance of the digital certificate. The subscriber shall activate the digital certificate in accordance with the guidelines for activating and renewing digital certificates published on the State Bank’s online portal.
7. The validity period of a subscriber’s digital certificate shall be a maximum of 5 years. Where the requested validity period exceeds the remaining validity period of the State Bank’s root certificate, the validity period of the digital certificate issued to the subscriber shall be the remaining validity period of the State Bank’s root certificate.
Article 10. Renewal and update of digital certificate information
1. Conditions for renewal and update of digital certificate information
a) The digital certificate must be within its validity period;
b) The subscriber management organization shall submit an application for renewal or update of digital certificate information at least 10 days before the expiry date of the digital certificate.
2. Validity period of the digital certificate
a) The validity period of the digital certificate shall be calculated from the time the subscriber successfully completes the renewal. Where the requested renewal period exceeds the remaining validity period of the State Bank’s root certificate, the validity period of the digital certificate after renewal shall be the remaining validity period of the State Bank’s root certificate;
b) The update of digital certificate information shall not change the validity period of the digital certificate.
3. Cases of update of digital certificate information
a) The subscriber changes their professional title or position;
b) The subscriber changes their address, email address, phone number or passport information;
c) The subscriber changes their working department (division/section) but does not change their unit/branch. Where the subscriber changes to a different working unit/branch, the subscriber management organization shall carry out procedures for revocation of the digital certificate at the previous working unit/branch and issuance of a new digital certificate at the new working unit/branch for the subscriber (if the subscriber wishes to continue using it);
d) In cases where the rearrangement of state organizational structures or rearrangement of administrative divisions at various levels requires changes to the subscriber’s digital certificate information, the Department of Information Technology shall send a notification to the subscriber management organization and update the subscriber’s digital certificate information.
4. The subscriber management organization shall submit 1 set of application for renewal or update of digital certificate information for the cases prescribed in points a, b and c of clause 3 of this Article, comprising an application form for renewal or update of digital certificate information in accordance with Appendix III issued together with this Circular.
5. Processing time and results
Within 2 working days from the date of receipt of a valid application for renewal or update of digital certificate information, the Department of Information Technology shall renew or update the digital certificate information for the subscriber.
Within 1 working day from the date of receipt of the application, where the application is invalid, the Department of Information Technology shall refuse to process the application and clearly state the reasons. Feedback and processing results shall be provided in accordance with clause 3 Article 6 of this Circular.
Upon receipt of the notification of approval for digital certificate renewal, the subscriber shall renew the digital certificate in accordance with the guidelines for activating and renewing digital certificates published on the State Bank’s online portal.
Article 11. Suspension of digital certificates
1. Cases of suspension of a subscriber’s digital certificate
a) The subscriber management organization submits an application for suspension of the subscriber’s digital certificate;
b) Upon written request from a prosecuting authority, public security authority or the Ministry of Science and Technology in accordance with the law;
c) The Department of Information Technology detects errors or incidents that may affect the subscriber’s rights or the security of the State Bank’s Digital Signature Certification System.
2. The suspension period of a digital certificate under point a clause 1 of this Article shall be as requested by the subscriber management organization. The suspension period of a digital certificate under point b clause 1 of this Article shall be as required by the prosecuting authority, public security authority or the Ministry of Science and Technology. The suspension period of a digital certificate under point c clause 1 of this Article shall continue until the errors or incidents have been remedied.
3. The subscriber management organization shall submit 1 set of application for suspension of the digital certificate, comprising an application form for suspension of the digital certificate in accordance with Appendix IV issued together with this Circular.
4. Processing time and results
a) Within 1 working day from the date of receipt of a valid application for suspension of the digital certificate as prescribed in point a clause 1 of this Article, the Department of Information Technology shall suspend the subscriber’s digital certificate and notify the subscriber management organization of the processing result.
Within 1 working day from the date of receipt of the application, where the application is invalid, the Department of Information Technology shall refuse to process the application and clearly state the reasons. Feedback and processing results shall be provided in accordance with clause 3 Article 6 of this Circular;
b) Within 1 working day from the date of receipt of the written request as prescribed in point b clause 1 of this Article, the Department of Information Technology shall suspend the digital certificate and notify the subscriber management organization in writing of the time and reasons for suspension of the digital certificate;
c) For the case prescribed in point c clause 1 of this Article, the Department of Information Technology shall suspend the digital certificate upon detection of the errors or incidents and notify the subscriber management organization of the reasons for suspension of the digital certificate.
Article 12. Reinstatement of digital certificates
1. The digital certificate requested for reinstatement must be within its suspension period.
2. Cases of reinstatement of a subscriber’s digital certificate
a) The subscriber management organization submits an application for reinstatement of a digital certificate that was requested to be suspended as prescribed in point a clause 1 Article 11 of this Circular;
b) A prosecuting authority, public security authority or the Ministry of Science and Technology submits a written request for reinstatement of a digital certificate that was requested to be suspended as prescribed in point b clause 1 Article 11 of this Circular;
c) The digital certificate was suspended as prescribed in point c clause 1 Article 11 of this Circular and the errors or incidents have been remedied;
d) The suspension period of the digital certificate as requested has expired.
3. The subscriber management organization shall submit 1 set of application for reinstatement of the digital certificate as prescribed in point a clause 2 of this Article, comprising an application form for reinstatement of the digital certificate in accordance with Appendix V issued together with this Circular.
4. Processing time and results
a) Within 1 working day from the date of receipt of a valid application for reinstatement of the digital certificate as prescribed in point a clause 2 of this Article, or a written request as prescribed in point b clause 2 of this Article, the Department of Information Technology shall reinstate the digital certificate for the subscriber.
Within 1 working day from the date of receipt of the application, where the application is invalid, the Department of Information Technology shall refuse to process the application and clearly state the reasons. Feedback and processing results shall be provided in accordance with clause 3 Article 6 of this Circular;
b) For the cases prescribed in points c and d clause 2 of this Article, the Department of Information Technology shall automatically reinstate the digital certificate and notify the subscriber management organization.
Article 13. Revocation of digital certificates and disabling of certificate-authenticated services
1. The subscriber management organization may request revocation of or disabling of one or several certificate-authenticated services on the subscriber’s digital certificate. Where the digital certificate is revoked, all certificate-authenticated services of the subscriber shall be disabled.
2. Cases of revocation of a subscriber’s digital certificate
a) Upon written request from a prosecuting authority, public security authority or the Ministry of Science and Technology in accordance with the law;
b) The subscriber management organization submits an application for revocation of the subscriber’s digital certificate;
c) The subscriber management organization has a decision on revocation of its operating license, or undergoes division, separation, merger, dissolution or bankruptcy in accordance with the law;
d) There is sufficient evidence to determine that the subscriber has violated regulations on the management and use of digital certificates and cryptographic token storage devices;
dd) The digital certificate expires.
3. The subscriber management organization shall submit 1 set of application for revocation of or disabling of certificate-authenticated services on the digital certificate, comprising an application form for revocation of or disabling of certificate-authenticated services on the digital certificate in accordance with Appendix VI issued together with this Circular.
4. Processing time and results
a) Within 1 working day from the date of receipt of the written request as prescribed in point a clause 2 of this Article, or a valid application for revocation of or disabling of certificate-authenticated services submitted by the subscriber management organization as prescribed in point b clause 2 of this Article, the Department of Information Technology shall revoke the digital certificate or disable the certificate-authenticated services for the subscriber.
Within 1 working day from the date of receipt of the application, where the application is invalid, the Department of Information Technology shall refuse to process the application and clearly state the reasons. Feedback and processing results shall be provided in accordance with clause 3 Article 6 of this Circular;
b) For the cases prescribed in points c, d and dd clause 2 of this Article, the Department of Information Technology shall automatically revoke the subscriber’s digital certificate and send a notification to the subscriber management organization.
Article 14. Change of activation code of digital certificate
1. Cases requiring a change of the activation code of a digital certificate
a) The activation code has been compromised or is suspected of having been compromised;
b) The activation code has expired, the subscriber has not yet been able to activate the digital certificate and wishes to continue using it.
2. The subscriber management organization shall submit 1 set of application for a change of activation code, comprising an application form for change of activation code of the digital certificate in accordance with Appendix VII issued together with this Circular.
3. Processing time and results
Within 2 working days from the date of receipt of a valid application for change of activation code, the Department of Information Technology shall change the activation code of the digital certificate for the subscriber and send a notification of the new activation code to the subscriber.
Within 1 working day from the date of receipt of the application, where the application is invalid, the Department of Information Technology shall refuse to process the application and clearly state the reasons.
Feedback and processing results shall be provided in accordance with clause 3 Article 6 of this Circular.
4. The activation code of a digital certificate shall be valid for a maximum of 30 days from the date of the change. The subscriber shall activate the digital certificate in accordance with the guidelines for activating and renewing digital certificates published on the State Bank’s online portal.
Article 15. Update and publication of information
The Department of Information Technology shall publish, update and maintain the following information 24 hours a day and 7 days a week on the State Bank’s online portal:
1. The State Bank’s root certificate.
2. The State Bank’s certification practice statement.
3. The list of valid, suspended and revoked digital certificates of subscribers.
4. Guidelines, software and tools related to the management and use of the State Bank’s digital signatures and digital certificates.
5. Other necessary information as prescribed by law.
RESPONSIBILITIES OF PARTIES INVOLVED IN THE PROVISION AND USE OF DIGITAL SIGNATURES AND DIGITAL CERTIFICATES
Article 16. Responsibilities of the Department of Information Technology
1. Issue, renew, suspend, revoke, reinstate, enable additional certificate-authenticated services, disable certificate-authenticated services, change activation codes and update digital certificate information of subscribers upon request.
2. Manage and operate the technical infrastructure and develop plans to ensure the continuous, secure and confidential operation of the State Bank’s Digital Signature Certification System.
3. Research and advise the Governor of the State Bank on technical solutions and technology infrastructure to meet the development and expansion needs of the State Bank’s Digital Signature Certification System.
4. Ensure the security of digital certificate activation information throughout the issuance and transfer process to subscribers. Update and store complete, accurate and secure subscriber information for digital certificate management purposes. Comply with the law on personal data protection in the collection, processing and storage of subscriber and subscriber management organization information.
5. Distribute digital certificates and cryptographic tokens to subscribers in accordance with regulations.
6. Provide subscribers with information on the scope and authorized use of digital certificates, security requirements and other information likely to affect subscribers’ rights.
7. Store information relating to the suspension and revocation of digital certificates for at least 5 years from the time of suspension or revocation of the digital certificate.
8. Publish the list of active, suspended and revoked digital certificates.
9. Provide and update software and documents related to activating and renewing digital certificates, managing cryptographic tokens, and signing and verifying the State Bank’s digital signatures.
Article 17. Responsibilities of subscriber management organizations
1. Designate an individual or a subordinate focal unit responsible for registering and managing the organization’s subscriber list, and managing files, documents and reports related to the management and use of the State Bank’s digital signatures and digital certificates.
2. Register and bear full responsibility for the accuracy of information in documents, files and reports related to subscribers’ digital certificates submitted to the Department of Information Technology.
3. Manage, compile statistics and update the subscriber list within the organization. At least once every 3 months, review and reconcile the list of digital certificates issued by the State Bank against actual usage needs and information at the subscriber management organization. For digital certificates with mismatched information, the subscriber management organization shall carry out procedures for updating information, suspending, revoking or disabling certificate-authenticated services.
4. Notify subscribers within the organization of the provision of personal data and consent to allow the Department of Information Technology to collect and process personal data for the purpose of issuing digital certificates to subscribers. Submit to the Department of Information Technology a document expressing the subscriber’s consent to allow the Department of Information Technology to collect and process personal data for the purpose of issuing digital certificates to the subscriber in accordance with Article 9 of this Circular.
5. Guide, inspect and enable subscribers within the organization to register and use digital certificates in accordance with the provisions of this Circular.
6. Promptly notify the Department of Information Technology to suspend or revoke a subscriber’s digital certificate in the following cases:
a) The subscriber’s private key has been, is suspected of having been, or has been stolen or used without authorization;
b) The subscriber’s cryptographic token has been lost;
c) The subscriber has changed their working position and no longer needs to use the digital certificate for work purposes;
d) The subscriber takes temporary leave, resigns, retires or passes away;
dd) The subscriber belongs to a branch/unit of the subscriber management organization whose bank code has been cancelled;
e) Where the authorization document of the legal representative for the person issued a digital certificate has expired or has been replaced by another authorization document;
g) Other cases arising from the needs of the subscriber management organization.
7. Cryptographic tokens and digital certificates issued to organizations shall be assigned to an individual for management and use. The handover shall be made in writing clearly specifying the roles and responsibilities of the individual assigned management duties. The individual assigned management duties shall fulfill the roles and responsibilities of a subscriber as prescribed in this Circular.
8. Inspect and monitor the management and use of cryptographic tokens and digital certificates by subscribers to ensure security and proper purpose. Recover cryptographic tokens from subscribers upon resignation, job transfer or change of working position where the job requirements no longer require the use of digital certificates. Recovered cryptographic tokens must have all stored data deleted by the subscriber prior to return.
9. Subscriber management organizations that are administrative units under the State Bank shall promptly recover cryptographic tokens from subscribers within the managed unit who no longer use them, for re-use by other subscribers of the unit.
Article 18. Responsibilities of subscribers
1. Provide complete and accurate information and personal data (for individual subscribers) for the purpose of issuing the State Bank’s digital certificate.
2. Use the digital certificate within the scope and for the purposes for which it was issued. Comply with regulations on the responsibilities of the signatory when using the issued digital certificate as prescribed in clause 1 Article 19 of this Circular.
3. Manage and use the cryptographic token
a) Use the correct type of cryptographic token in accordance with the guidelines of the Department of Information Technology;
b) Ensure the security of the access key and data stored in the issued cryptographic token;
c) Do not share the access key or lend the cryptographic token. Upon resignation, job transfer or change of working position where the job requirements no longer require the use of the digital certificate, delete all stored data in the cryptographic token and hand over the token to the subscriber management organization;
d) Do not use tools, programs, software or any other means to interfere with, edit or alter the digital certificate information or data in the cryptographic token, or intentionally damage the token;
dd) Promptly notify the subscriber management organization upon detection or suspicion that the digital certificate is no longer secure; or that the cryptographic token has been lost, is malfunctioning or is no longer usable.
4. Comply with other regulations on the issuance, management and use of digital certificates.
Article 19. Responsibilities of the signatory and the relying party
1. Responsibilities of the signatory
The signatory shall not digitally sign data messages on information systems where the system reports that their digital certificate is no longer valid.
2. Responsibilities of the relying party
The relying party shall only accept the signatory’s digital signature on data messages on information systems where the system reports the signatory’s signature to be valid, after verifying the following information:
a) Verify the validity, scope of use and liability limits of the signatory’s digital certificate;
b) The digital signature must be created by the private key corresponding to the public key secured by the issued digital certificate.
3. The signatory and the relying party shall be liable for any damages that may arise from non-compliance with the provisions of clauses 1 and 2 of this Article.
1. This Circular comes into force from March 1, 2026.
2. Circular No. 28/2015/TT-NHNN of the Governor of the State Bank on the management and use of digital signatures, digital certificates and digital signature authentication services of the State Bank, and Circular No. 16/2023/TT-NHNN of the Governor of the State Bank on amendments to certain articles of Circular No. 28/2015/TT-NHNN shall cease to be in force from the date this Circular comes into force, except as prescribed in Article 21 of this Circular.
Article 21. Transitional provisions
1. Digital certificates issued to subscribers before the effective date of this Circular that remain valid on the effective date of this Circular may continue to be used until the end of their validity period or until they are re-issued in accordance with this Circular.
2. Applications for the provision of the State Bank’s digital signature authentication services submitted by subscriber management organizations to the Department of Information Technology that have not yet been fully processed by the effective date of this Circular shall continue to be processed in accordance with the provisions of Circular No. 28/2015/TT-NHNN and Circular No. 16/2023/TT-NHNN.
Article 22. Responsibilities for implementation
Heads of units under the State Bank, Vietnam State Treasury, Deposit Insurance of Vietnam, credit institutions, foreign bank branches, payment intermediary service providers and credit information companies shall implement this Circular./.
|
|
PP. PP. GOVERNOR Pham Tien Dung |
