SBV Biometric Rule Extends to Card Issuance, Closing Gap Left by Circular 77

Vietnam's banking regulator has closed the remaining gap in its biometric authentication framework. Circular No. 45/2025/TT-NHNN, signed by the State Bank of Vietnam (SBV) Governor on November 19, 2025, and in force since January 5, 2026, makes biometric verification at card issuance a legal requirement — completing a two-layer authentication stack that Circular 77/2025 began for online banking.

What Circular 45 Actually Changes#

Circular 45/2025 amends Circular 18/2024/TT-NHNN — Vietnam's base regulation for bank card operations — across 16 articles. The changes fall into four operational categories.

Biometric verification at issuance#

Before issuing any new card to an individual customer, the bank must conduct an in-person meeting and match the customer's biometric data — face and fingerprint — against the chip embedded in their Citizen ID Card (CCCD). No biometric match, no card issued.

The activation gate is equally firm: a card may only be enabled for electronic transactions after successful biometric verification. A card physically handed over without completed biometric verification cannot be used online, at an ATM, or at a point-of-sale terminal for electronic payments.

For customers registering through an online banking application, the issuer must also verify that the mobile phone number provided is registered to the actual cardholder — not a proxy. This step directly addresses SIM-swap fraud, where an attacker ports a victim's number to intercept one-time passwords.

The foreign national change#

The previous framework barred foreign individual cardholders from obtaining a bank card unless they had resided legally in Vietnam for at least 12 months. Circular 45 removes that bar entirely. Card validity for foreign nationals is now tied to the duration of their remaining legal residency — a visa holder on a one-year permit gets a card valid for that permit's remaining term.

For VIFC-zone banks onboarding international professionals, banks can begin issuing cards to international clients immediately, for the duration of their current visa period. The 12-month wait blocked finance professionals on initial work visas; it has been removed.

One uncertainty remains: the biometric verification mechanism for foreign nationals. The CCCD chip standard applies to Vietnamese citizens. The circular's secondary sources do not specify whether biometric verification for foreigners draws on passport chip data, the VneID system, or another mechanism. Banks onboarding foreign clients should seek direct SBV guidance on this point before building their issuance workflow.

Credit card cash withdrawal cap#

Circular 45 introduces a new monthly ceiling: VND 100 million (approximately USD 4,000 at approximately VND 25,000 per dollar) in credit card cash withdrawals per cardholder per month, calculated across all cards issued under the same Bank Identification Number (BIN). This is a new constraint — Circular 18/2024 did not impose a specific monthly cash-advance limit at this level.

The across-BIN calculation matters for corporate card programs. A treasury team distributing multiple credit cards to employees under the same BIN must aggregate cash withdrawals across all holders when calculating compliance. High-limit corporate card products with embedded cash-access features will require a compliance review against this ceiling.

Institutional supplementary cardholders#

For institutional customers, the circular requires written authorization naming a specific individual as the supplementary cardholder before that card can be issued. Circular 18/2024 left ambiguity around multi-user corporate card arrangements; Circular 45 closes it by requiring a named person and a paper trail for each card added to an institutional account.

POS device placement#

POS devices may now be installed at payment agent locations, not only at bank branches. This expands cash-access infrastructure beyond the branch network — relevant for banks operating through agent banking models outside HCMC's main commercial districts.

How This Completes the Biometric Stack#

Circular 45 and Circular 77/2025 address different layers of the same authentication architecture:

Both layers share a common dependency: the Ministry of Public Security's national electronic identification infrastructure. Biometric data must match the chip on the physical CCCD card, which means any gap in CCCD chip coverage or data quality — whether from recently issued cards, damaged chips, or citizens not yet migrated to the chip-based format — becomes a banking access bottleneck. The SBV's card policy is structurally linked to how thoroughly MPS has rolled out functional CCCD chips across the population.

Compliance Implications for VIFC-Zone Institutions#

Card-issuance operations. Front-line staff handling card applications must be trained on the biometric verification workflow. Banks that previously issued cards through mail, courier, or branch pickup without an in-person biometric step must redesign those processes. Biometric-reading hardware must be present at every card-issuance point.

Foreign national onboarding. The residency-bar removal is actionable now. Banks can begin issuing cards to international clients for their remaining visa period without waiting for the 12-month threshold. The open question — which biometric document applies for non-CCCD holders — should be resolved with the SBV before rollout.

Corporate treasury teams. Any institutional card program must: (1) maintain written authorizations for each named supplementary cardholder, and (2) track credit card cash withdrawals across all cards under the same BIN against the VND 100 million monthly ceiling.

Embedded card products. For fintech operators and VIFC digital finance firms building card-linked products — whether under the Decree 94 peer-to-peer lending sandbox, e-wallet platforms, or embedded finance structures — the biometric-at-issuance requirement raises the bar for issuing physical cards to new customer segments. Any product that relies on remote or asynchronous card issuance needs a compliance review.

Exemptions. Secondary sources confirm that the circular specifies cases where biometric verification is not required for card transactions. The exact conditions have not been enumerated in available secondary analyses. Institutions should obtain the full primary text of Circular 45 and identify which transaction categories qualify for exemption before assuming any workflow is covered.

What to Watch#

The circular is in force but no secondary reporting has documented bank compliance rates or SBV enforcement action in the five months since January 5, 2026. The practical test will come as card-issuance volumes grow and VIFC-zone banks scale their retail and professional banking offerings.

Two open items warrant monitoring: first, SBV guidance on the biometric verification mechanism for foreign nationals — essential for any institution targeting the international professional segment. Second, SBV has not yet fully clarified fraud-reporting obligations linked to the circular.

This article was last updated on 8 June 2026. We will update it as SBV guidance on foreign-national biometric verification and exemption conditions is issued.