2026
11 MIN READ
On January 20, 2026, Vietnam's State Securities Commission began accepting crypto exchange license applications under MOF Decision No. 96/QĐ-BTC, operationalizing the five-year pilot established by Resolution No. 05/2025/NQ-CP. The framework imposes a VND 10 trillion (~$380M) minimum charter capital, a 49% foreign ownership cap, and mandatory 65% institutional shareholder participation — conditions that effectively restrict the market to a handful of well-capitalised domestic institutions. Firms with Vietnamese exposure must act immediately to assess structural eligibility, partner arrangements, and AML/CFT readiness before the post-licensing grace period eliminates the option of informal market participation.
A Decade of Ambiguity Ends in One Administrative Decision
The significance of January 20, 2026 should not be understated. On that date, Vietnam's Ministry of Finance issued Decision No. 96/QĐ-BTC, formally activating the administrative licensing procedures for crypto asset trading market operators and instructing the State Securities Commission (SSC) to begin accepting applications with immediate effect. The decision operationalises Resolution No. 05/2025/NQ-CP, signed by Deputy Prime Minister Ho Duc Phoc on September 9, 2025, which had established a five-year pilot programme for the issuance, trading, and supervision of crypto assets in Vietnam — marking the first time a comprehensive legal framework of this nature has existed in the country.
The regulatory architecture did not emerge in isolation. Its immediate legal foundation is the Law on Digital Technology Industry (Law No. 71/2025/QH15), passed by the National Assembly on June 14, 2025, and effective January 1, 2026. That statute formally recognised digital assets as a legitimate category of property under the Civil Code, allowing them to be owned, transferred, inherited, and legally protected for the first time. Resolution 05/2025/NQ-CP is the government's direct fulfilment of the legislative mandate created by that law, and MOF Decision No. 96/QĐ-BTC is, in turn, the procedural instrument that transforms the Resolution from policy into enforceable practice.
Vietnam's path to this moment was deliberately measured. For years, the State Bank of Vietnam issued warnings rather than licences, and no formal regime existed for crypto exchanges, even as adoption exploded. Inter-ministerial working groups studied regulatory models from the EU, Singapore, Japan, and South Korea before settling on an approach. The result is a framework that treats crypto-asset trading platforms not as fintech payment providers, but as regulated market infrastructure — a classification that shapes every requirement that follows and places the SSC, rather than the central bank, at the centre of supervisory authority.
The Architecture of Restriction: Capital, Ownership, and the Institutional Mandate
The barrier to entry established by Resolution No. 05/2025/NQ-CP is among the most demanding for crypto exchange licensing anywhere in the world. Under Article 8.2 of the Resolution, any applicant seeking a licence to organise a crypto asset trading market must maintain a minimum contributed charter capital of VND 10,000 billion — approximately USD 380–400 million, fully paid in Vietnamese Dong. This threshold immediately excludes every startup, every mid-tier fintech, and every foreign exchange without a deep-pocketed local partner. By comparison, Thailand's Digital Asset Business Emergency Decree of 2018 requires only THB 50 million (approximately USD 1.59 million) for exchanges not holding client assets, while Vietnam's threshold exceeds it by a factor of roughly 240.
The composition of that capital is equally prescriptive. Under Article 8.3(a) of Resolution 05/2025/NQ-CP, at least 65% of charter capital must be contributed by institutional shareholders, of which more than 35% must be collectively held by at least two qualifying entities drawn from a defined list: commercial banks, securities companies, fund management companies, insurance firms, or technology companies. Foreign ownership across the entire structure is capped at 49%, and no single investor — individual or institutional — may hold an interest in more than one licensed crypto asset service provider simultaneously. The combined effect of these provisions is a regulatory design that mandates a specific kind of market participant: a domestically anchored, bank- or securities-firm-led consortium.
The cybersecurity and governance obligations reinforce this institutional orientation. Applicants must satisfy Level-4 IT security certification requirements — Vietnam's highest civilian cybersecurity standard — alongside governance checks on senior personnel, documented internal control procedures, and risk management systems covering trading, custody, and settlement. The initial dossier filed with the SSC must include the company's business charter, enterprise registration documents, a full personnel list, and detailed operational procedures. Within 12 months of the MOF's written confirmation of a complete initial filing, applicants must then submit a supplemental dossier covering the remaining technical and governance documentation before a 30-working-day substantive review clock begins. There are no state fees applicable to any of these procedures during the pilot phase, but the administrative and structural preparation required is substantial.
The FATF Grey List Shadow and the AML Imperative
Vietnam's regulatory pivot on crypto is inseparable from its standing on the Financial Action Task Force's monitoring lists. The country's unregulated crypto market was a material factor in its placement on the FATF grey list, and Resolution 05/2025/NQ-CP was explicitly engineered as a response to the FATF's concerns, with strong emphasis on AML and countering the financing of terrorism (CFT) as a core design principle throughout the pilot framework. The Ministry of Finance coordinates with the State Bank of Vietnam and the Ministry of Public Security specifically on anti-money laundering, cybersecurity, and risk-control requirements when reviewing license applications, reflecting the cross-agency seriousness with which financial integrity is being treated.
The AML architecture embedded in the framework is operationally significant for any firm in the value chain. All issuance, trading, and settlement of crypto assets must be conducted in Vietnamese Dong under Article 4.7 of Resolution 05/2025/NQ-CP. Foreign investors must open dedicated VND payment accounts at licensed local banks or foreign bank branches for all transactions, establishing a documented fiat on-ramp that generates the transaction records regulators need to fulfil FATF Travel Rule obligations. Crypto asset issuers must publish a prospectus at least 15 days prior to issuance, and licensed exchanges bear responsibility for KYC, transaction monitoring, and AML reporting across their platforms.
The grace period mechanism adds a hard enforcement horizon. From the date the first licensed exchange receives its approval — expected sometime in 2026 — all domestic crypto trading activity must be channelled through licensed platforms within six months. After that window closes, Vietnamese investors who continue to trade through unlicensed exchanges, OTC desks, or foreign platforms may face administrative sanctions, and in cases involving significant transaction volume or apparent intent, criminal exposure. This timeline compression is not incidental: it is the mechanism by which the government intends to shift Vietnam's estimated USD 220–230 billion in annual crypto transaction volume — approximately USD 600 million traded daily according to Chainalysis data for mid-2024 to mid-2025 — from offshore platforms into a supervised, AML-compliant domestic environment.
Who Bears the Burden: Exchanges, Fintechs, and the International Dimension
For international crypto exchanges currently serving Vietnamese users — including large offshore platforms — the framework's 'local-first' architecture presents an existential choice. There is no passporting mechanism, no offshore licensing recognition, and no fast-track arrangement for foreign exchanges. Any entity wishing to operate legally must be Vietnamese-incorporated, in the form of a limited liability company or joint stock company under the Law on Enterprises, and must satisfy every capital, ownership, governance, and cybersecurity condition applicable to domestic applicants. In practice, this means that foreign exchanges can only participate as minority shareholders — capped at 49% — within a Vietnamese corporate structure that is majority-controlled by qualifying institutional investors. Platforms that do not pursue this structure face the prospect of being effectively restricted or blocked once the post-licensing grace period expires, mirroring the approach South Korea has taken with foreign platforms that lack domestic banking access.
The institutional shareholder requirement creates a specific structuring challenge that deserves careful attention. The requirement that at least 35% of charter capital be contributed by at least two qualifying institutions — banks, securities firms, fund managers, insurers, or technology companies — effectively means that no consortium can be assembled without the active buy-in of Vietnam's established financial sector. Early movers already reflect this dynamic: Techcombank has established a digital asset exchange subsidiary (TCEX), VPBank has signalled operational readiness, Military Bank (MB) has entered a technical cooperation agreement with Dunamu (operator of South Korea's Upbit), SSI Securities established SSI Digital (SSID) as early as 2022 and has since inked strategic cooperation agreements with Tether, U2U Network, and Amazon Web Services, and VIX Securities has built out VIXEX in cooperation with FPT. Approximately ten securities firms and banks in total have publicly declared intent to apply. Given the anticipated cap of approximately five licensees, the race for institutional partnerships is already underway and positions are filling fast.
For fintech startups and smaller compliance consultancies operating in the digital asset space, the framework draws a sharp line. The VND 10 trillion capital threshold makes direct exchange licensing structurally impossible for any firm that does not command institutional-scale balance sheets. However, the creation of a licensed exchange ecosystem generates substantial secondary demand: KYC/AML technology providers, custody solution vendors, blockchain analytics firms, legal and compliance advisors, and IT security certifiers will all be needed by the incoming cohort of licensed operators. The regulatory ambiguity surrounding decentralised exchanges, P2P platforms, and on-chain activity conducted by Vietnamese IP addresses also remains unresolved, with legal expert Dao Tien Phong of the Vietnam Blockchain Association noting that guidance from the Ministry of Finance on these edge cases is still pending — a gap that creates both risk and advisory opportunity.
A Regional Comparison: Where Vietnam Sits on the Spectrum of Strictness
Placed within its regional context, Vietnam's framework occupies the restrictive end of the regulatory spectrum, distinct in its philosophy from the approaches taken by Hong Kong, Singapore, and the European Union. Hong Kong's Virtual Asset Trading Platform (VATP) regime under the Securities and Futures Commission imposes mandatory licensing but relies on intensive ongoing supervision rather than a capital barrier as the primary filter. Singapore's Payment Services Act (PSA), administered by the Monetary Authority of Singapore, similarly employs conduct-based regulation with comparatively modest capital requirements, reflecting a policy preference for attracting a broad base of well-governed operators. The EU's Markets in Crypto-Assets Regulation (MiCA), effective from December 2024, establishes a passporting framework allowing CASPs authorised in one member state to serve users across the bloc — a feature entirely absent from Vietnam's design.
Vietnam's architects appear to have consciously rejected the 'broad base of licencees' model in favour of a 'few, well-capitalised, domestically anchored operators' model that more closely resembles South Korea's approach under its VASP regime, where only a handful of exchanges hold licences and foreign platforms without local banking relationships face practical exclusion. The philosophical divergence is significant for market participants assessing whether a MiCA-passported or MAS-licensed entity can serve as a regulatory springboard for Vietnamese market access — it cannot. Each jurisdiction's regulatory standing is treated as irrelevant by Resolution 05/2025/NQ-CP, which demands full onshore compliance regardless of an applicant's credentials elsewhere. Vietnam's framework, in this respect, functions as a self-contained regulatory universe.
The comparison with Thailand is particularly instructive given the two countries' shared status as civil law jurisdictions with growing digital economies. Thailand's Digital Asset Business Emergency Decree has produced a relatively open market, permits trading in SEC-approved cryptocurrencies including Bitcoin, Ethereum, USDC, and USDT in Thai Baht, and imposes capital requirements approximately 240 times lower than Vietnam's VND 10 trillion threshold. This gap in capital requirements and asset class permissions suggests that international firms choosing between Southeast Asian entry points will face a fundamentally different risk-return calculus for Vietnam than for Thailand — a market where the regulatory cost of entry is high but the potential reward of exclusive access to a USD 100 billion domestic crypto market may ultimately justify the investment.
Strategic Imperatives: What Firms Must Do Before the Window Closes
The five-step licensing process under Decision No. 96/QĐ-BTC is sequential and time-bound in ways that punish delay. An applicant that submits a complete initial dossier triggers a 20-working-day review clock, after which it has 12 months to submit the full supplemental documentation — including governance certifications, IT security evidence, and fully-constituted capital — before the substantive 30-working-day review commences. Licensed operators must then commence operations within 30 days of receiving their licence or face revocation. The combined timeline from first submission to operational launch, assuming no deficiencies, is measured in months rather than weeks. Given the anticipated cap of approximately five total licencees and the fact that roughly ten institutions have already signalled intent, the probability that an applicant joining the queue today will secure one of the remaining slots is materially lower than it was six months ago.
For exchange-seeking clients, the immediate priorities are threefold. First, institutional shareholder structuring must be resolved before an initial dossier is filed: identifying two or more qualifying anchor institutions, negotiating their participation in the requisite ownership proportions, and confirming that no prospective shareholder already holds an interest in a competing applicant. Second, the Level-4 IT security certification process must begin in parallel, as this certification — Vietnam's highest civilian cybersecurity standard — involves independent audit and remediation cycles that cannot be compressed. Third, the AML/CFT compliance framework must be fully documented, including KYC policy, transaction monitoring logic, Travel Rule implementation, and suspicious transaction reporting procedures, all of which will be scrutinised by the Ministry of Finance in coordination with the State Bank of Vietnam and the Ministry of Public Security during the review stage.
For international firms with Vietnamese user exposure that have no intention of pursuing a local licence, the grace period is not a reprieve — it is a countdown. The six-month enforcement window that begins from the date the first exchange is licensed means that the moment of reckoning is not within the firm's control. Firms in this position must either initiate a licensing strategy now, identify a licensed Vietnamese partner through which to channel their users' activity, or develop a compliant exit plan before administrative or criminal sanctions become applicable. Krysos Trust maintains specialist expertise across all three response pathways — from institutional shareholder structuring and AML/CFT framework development to IT security readiness assessments and regulatory liaison — and advises clients operating anywhere in the Vietnamese digital asset value chain to commence their compliance assessment without further delay.
