Decree 323's Supremacy Clause Gives the VIFC Power to Override Vietnamese Law — if the Rules Get Written

Decree No. 323/2025/ND-CP, issued December 18, 2025, is the VIFC's foundational governance instrument — seven chapters, 23 articles, implementing Articles 8 and 9 of Resolution 222/2025/QH15. Most of the coverage since its release has focused on what the VIFC will do: which sectors it targets, what tax rates apply, how the two-node structure divides Ho Chi Minh City and Da Nang. Less attention has gone to how it will be governed — and what the legal mechanics mean for any institution evaluating membership. One clause in particular deserves more scrutiny than it has received.

The Supremacy Clause#

The most operationally significant provision in Decree 323 is not a tax rate or a sector list. It is the legal hierarchy mechanism: Operational Regulations approved by the Executive Council take precedence over conflicting Vietnamese domestic legislation, with two exceptions — the Constitution and ratified international treaties.

VCI Legal, in its January 2026 analysis of the decree, calls this "a significant legislative innovation, creating a flexible legal space." That framing is accurate as far as it goes. The more precise way to state it for practitioners: the VIFC can operate under a bespoke legal order, distinct from the national framework that governs every other financial institution in Vietnam.

Licensing requirements, conduct rules, capital adequacy standards, and operational restrictions that apply to banks, securities firms, and asset managers across Vietnam could, in principle, be displaced inside the VIFC by what the Executive Council writes into its Operational Regulations. The ceiling is set by the Constitution and treaty law. Everything below that is, at least in theory, adjustable.

The catch — and it is a real one — is that the Operational Regulations do not yet fully exist. The Executive Council was directed to finalise them by June 10, 2026, following the June 2026 governance meeting chaired by Prime Minister Le Minh Hung. As of this writing, their content remains unknown. The supremacy mechanism is real, but it activates only what the Council actually codifies. An empty or narrow set of Operational Regulations produces a narrow bespoke zone. The legal innovation is only as powerful as the text it produces.

Three Pillars, Two Cities, One Entity#

Decree 323 establishes three governance bodies.

The Executive Body consists of the Executive Council — the apex authority responsible for issuing the Operational Regulations — plus city-level operating agencies in HCMC and Da Nang, each sitting under its respective People's Committee.

The Supervisory Body is headquartered in HCMC under the HCMC People's Committee, with authority to establish branch offices in Da Nang. Both the Operating Authority and the Supervisory Authority hold independent legal person status under Article 10.

The Dispute Resolution Body comprises two institutions: a Specialized Court and the International Arbitration Centre (IAC).

The structure is coherent in outline. In practice, it creates some accountability complexity. Two independent legal persons — the Operating Authority and the Supervisory Authority — operate within what the decree simultaneously describes as a single unified legal entity. Vietnamese law contains no statutory definition of "legal unit" (thực thể pháp lý), the term the decree uses to characterise the VIFC's unified status. That definitional gap is not merely academic: it leaves open how disputes between the Operating and Supervisory authorities would be resolved, and whose instructions member firms follow when the two bodies issue conflicting guidance.

The two-city structure adds a further dimension. City-level executive agencies answer to their respective People's Committees in HCMC and Da Nang — two cities with different economic profiles, different development priorities, and potentially different interpretations of how aggressively to deploy the VIFC framework. The "unified" mandate sits atop an architecture that structurally accommodates divergence at the implementation level. For an institution with operations in both zones, that means navigating two People's Committees while theoretically operating under one legal entity. This dual-edged quality — regulatory flexibility against interpretive uncertainty — runs through the framework at every level. For more on how the node differentiation plays out geographically, see our piece on Da Nang vs. HCMC under Decree 323.

Licensing Authority Has Moved#

One structural novelty that practitioners should register immediately: city-level Operating Authorities — not the SBV, SSC, or ISA — hold authority under Article 10, Point a, Clause 5 to issue, amend, and revoke Member Registration Certificates and operating licences inside the VIFC. This covers banking, securities, and insurance licences within their domain.

This is not a minor procedural shift. It means the licensing relationship for VIFC members runs through the HCMC or Da Nang Operating Authority, not through the standard national regulator channel. A bank wanting to operate inside the VIFC does not simply obtain an SBV licence and transpose it into the zone — it applies to the city-level authority operating under the VIFC framework.

The SBV, SSC, and ISA presumably retain influence through the Supervisory Body and through any provisions the Operational Regulations carry over from national law. But the formal licensing authority, as Decree 323 currently reads, sits at the city level. For compliance and licensing teams accustomed to dealing with the SBV's HCMC branch or the SSC's registration desks, this requires a rethink of who owns the relationship. The SBV's own organisational restructure under Decree 198/2026 has already restructured the unit that traditionally processed foreign bank applications — a related pressure on the transition.

The Five-Year Pilot Clause#

Article 4(3) mandates a comprehensive review of the VIFC model after five years, with explicit authority to "adjust, restructure, or further refine" the architecture. This provision has received minimal coverage relative to its importance.

The five-year review clause does two things simultaneously. It signals that the government retains the option to redesign the framework if it underperforms — which is prudent adaptive governance. It also signals that the legal architecture is provisional. The VIFC is, in the decree's own terms, a pilot. Institutions building VIFC subsidiaries, staffing compliance functions, and constructing legal entities within the zone are doing so under a framework that the government has reserved the right to materially alter within a five-year horizon.

For short-cycle fintech operations, this is manageable — five years is a long runway. For long-horizon investors — infrastructure finance, long-duration bond programmes, leasing platforms with ten-year asset lives — it is a genuine legal risk factor that due diligence cannot ignore. The question of whether the five-year review will be conducted by a standing body or an ad hoc committee, and what procedural protections member firms will have during that process, is not answered by the decree.

The same clause that lets the government fix structural problems is the clause that lets it change the rules on institutions that have already committed capital. Regulatory stability risk and adaptive governance capacity are two readings of identical text.

The Authority Chain Above the Decree#

Decree 323 does not sit at the top of the VIFC's legal hierarchy. Understanding where it fits matters for anticipating how the framework will evolve.

The chain runs: Politburo Resolution 09-NQ/TW (May 2026) sets the political mandate at the Party level. The National Assembly's Resolution 222/2025/QH15 translates that mandate into statutory form. Decree 323/2025/ND-CP implements Articles 8 and 9 of Resolution 222 at the government level. And the Executive Council's Operational Regulations — once issued — become the operative instrument for day-to-day member compliance.

In practice, this means that the Operational Regulations are simultaneously the most powerful instrument for member firms (because they prevail over conflicting domestic law) and the most politically constrained (because they must stay within boundaries set by three layers of higher authority). The Executive Council does not have unconstrained rulemaking power — it has bounded discretion within a framework shaped by the National Assembly and, above that, the Politburo. For the political foundations of that mandate, see Resolution 09-NQ/TW explained.

Six Sectors, Seven Member Categories#

Article 6's Appendix designates six priority sector groups: IFC infrastructure, green and ESG finance, commodity and derivatives and trade finance, fintech and innovation, investment funds and asset management, and professional support services.

Member categories span seven types: commercial banks and foreign bank branches, securities companies, insurance and reinsurance, investment funds and asset managers, market infrastructure institutions, fintech and digital asset organizations, consulting and support services, and non-financial organizations.

The breadth is deliberate. The VIFC's revenue model — voluntary contributions, service revenues, fee and charge retention, and state budget allocations — is structurally dependent on attracting a critical mass of fee-paying members across multiple sectors. Guaranteed state funding is not the model. If member registration stalls, the VIFC's financial sustainability stalls with it. As of June 2026, 38 members have registered — a starting point, not a critical mass. See the VIFC membership scoreboard for the current breakdown.

What Comes Next#

Three things will determine how useful the Decree 323 governance architecture actually proves to be in practice.

First, the content of the Operational Regulations. The supremacy mechanism is only as valuable as the legal space it carves out. Narrow, conservative Operational Regulations that largely replicate national law produce a VIFC that looks different on paper and operates identically in practice. Ambitious Regulations that genuinely displace domestic law — on capital requirements, licensing conditions, product authorizations — would make the zone materially distinct. The directive to finalise those Regulations by June 10, 2026 signals urgency. Whether urgency produces ambition or caution remains to be seen.

Second, the Supervisory Body's operational independence. The HCMC-headquartered body with Da Nang branches will be the institution that enforces compliance with whatever the Operational Regulations require. Its effectiveness — and its willingness to act against member firms or against city-level Operating Authorities — will determine whether the governance framework has real teeth. The HCMC directive giving the Supervisory Body until May 15 to constitute itself suggests constitution is underway. Whether it is constituted with genuine enforcement capacity is a separate question.

Third, the five-year review process. Institutions planning long-horizon commitments to the VIFC should begin now to engage on what the review mechanism will look like in practice — what protections apply to existing members, what triggers a review conclusion, and whether the outcome requires National Assembly approval or can be implemented at the decree level. The answers are not in Decree 323. They should be sought before capital is committed at scale.

This article was last updated on 12 June 2026. We will update it as the Operational Regulations are issued and the five-year review framework is clarified.