AML Compliance in Vietnam: What Circular 27 and Continued FATF Grey-Listing Mean for Regulated Businesses

The February 2026 FATF Decision: Why 'Limited Progress' Is a Market Signal

Vietnam was added to the FATF grey list in June 2023 for deficiencies across nine action items, including inadequate regulation of virtual assets, weaknesses in customer due diligence, and gaps in the beneficial ownership regime. The question that international businesses and local regulated entities have been tracking is whether Vietnam's legislative programme — which has been substantial — is translating into the implementation progress that FATF measures.

The February 2026 FATF plenary assessment answered that question with a finding of 'limited progress.' Vietnam remains on the grey list. The FATF's public statement notes that all deadlines from the original 2023 action plan have expired and urges Vietnam to 'go further and faster.' The ten remaining action items include increasing risk understanding and domestic coordination, implementing effective risk-based supervision, regulating virtual assets and VASPs, strengthening suspicious transaction reporting, and establishing a beneficial ownership regime that gives competent authorities timely and reliable information.

This assessment has direct, practical consequences for regulated businesses operating in Vietnam. Grey-listed jurisdictions attract enhanced due diligence from international banking counterparts. Correspondent banking relationships require additional documentation and monitoring. Capital costs for businesses with Vietnamese nexus are elevated relative to non-grey-listed markets. International investors conducting compliance diligence on Vietnam-based businesses apply a heightened scrutiny standard that reflects the jurisdiction's FATF status. The grey list is not a technical designation — it is a market signal that affects the cost and complexity of doing business.

For regulated businesses, 'limited progress' on FATF compliance is also a signal about where regulatory enforcement attention will be directed. When a jurisdiction is under sustained international pressure to demonstrate progress, the enforcement of existing requirements tends to sharpen. The State Bank of Vietnam has explicit institutional incentives to demonstrate that the regulatory framework being built on paper is also being enforced in practice — and those incentives translate directly into examination intensity.

Circular 27/2025: The New AML Framework in Full Force

Against this FATF backdrop, Circular 27/2025/TT-NHNN — issued by the State Bank of Vietnam on September 15, 2025 and in full effect from January 1, 2026 — constitutes the most significant single update to Vietnam's AML operating framework in recent years. It replaces Circular 09/2023/TT-NHNN and introduces material changes to how reporting entities must manage, assess, and report on AML risk.

The circular's scope is comprehensive. It covers all entities subject to the Law on Anti-Money Laundering: commercial banks, credit institutions, securities companies, insurance businesses, real estate businesses, and — critically for the current regulatory moment — virtual asset service providers operating under Vietnam's sandbox or exchange licensing framework. No regulated business in Vietnam operates outside the Circular 27 framework. Reporting entities were permitted to continue operating under Circular 09 until December 31, 2025; from January 1, 2026, the new standard applies without exception.

The changes are not cosmetic adjustments to an existing framework. Circular 27 introduces a standardised, data-driven risk assessment methodology using a quantified 1-5 scoring system, new transaction reporting thresholds, enhanced beneficial ownership verification requirements, and significantly expanded documentation obligations. Businesses that were compliant with Circular 09 may find that their existing frameworks have material gaps relative to the current standard — and those gaps are increasingly visible to the banking partners, regulators, and investors conducting compliance assessments.

Transaction Reporting: New Thresholds and Electronic Filing Obligations

The most immediately actionable changes in Circular 27 are the revised transaction reporting thresholds. All domestic money transfers equal to or exceeding VND 500 million — approximately USD 19,000 — must be reported to the SBV's Anti-Money Laundering Department through the SBV's electronic reporting system. Cross-border transfers of USD 1,000 or more (or equivalent in other currencies) are subject to the same mandatory electronic reporting obligation.

Suspicious transactions remain reportable regardless of value. The circular specifies that any transaction suspected of being associated with money laundering, terrorist financing, or proliferation financing must be filed promptly after the suspicion arises — without waiting for confirmation of underlying criminal activity. The suspicion threshold is intentionally broad. The reporting obligation is triggered by grounds for suspicion, not by certainty of wrongdoing.

The practical implication for compliance functions is significant. Transaction monitoring systems need to be calibrated to flag transactions at the new thresholds. Reporting workflows need to connect flag to filing efficiently and within the required timeframe. The electronic reporting requirement is also substantive: while paper-based reporting remains permissible where electronic submission is not possible, the baseline expectation is systematic electronic filing through the SBV's designated system. Businesses that have not yet integrated with that system — or whose compliance infrastructure is not equipped for systematic electronic STR management — are operating with a structural gap relative to the current regulatory standard.

The 1-5 Risk Scoring Methodology: What It Requires in Practice

Circular 27 mandates a standardised, quantified approach to AML risk assessment. Reporting entities must assess risk across three categories: external factors including industry sector, geographic exposure, and product or service risk; operational factors including customer type, distribution channel, and transaction type; and internal factors reflecting the design and operational effectiveness of the entity's own AML controls. Each factor is rated on a 1-5 scale, with 1 representing minimal risk and 5 representing highest risk.

This is a departure from the narrative risk assessments that many Vietnamese businesses have relied on under the prior framework. The 1-5 methodology requires entities to produce a documented, scored risk assessment that can be reviewed by the SBV and tested against the entity's actual transaction monitoring and CDD outcomes. A risk assessment that rates all factors at low without documentation to support those ratings will not survive regulatory review in the current environment.

The risk scoring requirement also creates a governance dimension. Senior management must formally approve the risk assessment, and it must be reviewed and updated when material circumstances change. An AML risk assessment produced once and filed is not the same as an operational AML risk management process — and the circular's requirements are explicitly designed to produce the latter, not merely document the former. For international businesses operating in Vietnam, presenting a risk assessment framework that maps to the Circular 27 scoring methodology when engaging with Vietnamese banking partners materially simplifies the bank's own compliance process and reduces onboarding friction.

Enhanced CDD and Beneficial Ownership Verification

Circular 27 strengthens the customer due diligence requirements with particular emphasis on beneficial ownership verification. Reporting entities must identify and verify the beneficial owner of any legal entity customer — defined as any natural person who owns more than 25% of the entity, who exercises effective control, or who provides the funds for a transaction if the ownership and control thresholds are not met.

These enhanced requirements directly address one of the FATF's outstanding action items for Vietnam. The country's action plan includes establishing a regime that gives competent authorities adequate, accurate, and current information on beneficial ownership — an area where FATF has assessed Vietnam's progress as insufficient. Circular 27's enhanced CDD requirements are the regulatory response to that specific deficiency, and their implementation is being monitored as part of Vietnam's grey-list review process.

For reporting entities, the enhanced CDD requirements create both an onboarding obligation and an ongoing monitoring obligation. Beneficial ownership information must be collected at the outset of the relationship, verified against reliable independent sources — not merely self-declared — and updated when material changes occur. The standard for verification is demanding: company registries, official corporate documentation, and in higher-risk cases independent verification sources. Businesses that rely on customer self-declaration to satisfy beneficial ownership requirements are not meeting the Circular 27 standard.

What Banking Partners Are Now Assessing

Vietnamese commercial banks are subject to the same Circular 27 obligations they apply to their customers. When a bank onboards a corporate client — particularly one in fintech, digital assets, money services, or international trade — the bank's compliance function must document that the customer meets its risk appetite, that beneficial ownership has been verified, and that the customer's own AML controls are adequate for the nature of the relationship. A corporate customer that cannot provide credible AML documentation faces onboarding friction regardless of the commercial merit of the relationship.

The current regulatory environment also means that periodic compliance reviews of existing banking relationships carry real consequences. A bank that reviews a long-standing customer against the Circular 27 standard and finds that the customer's AML program reflects the superseded Circular 09 framework will raise a compliance concern about the relationship. The cost of that concern — in terms of enhanced documentation requirements, relationship disruption, or potential account closure — far exceeds the cost of updating the program proactively.

For businesses raising capital or conducting M&A transactions with Vietnam exposure, the compliance implications extend beyond banking. Institutional investors conducting diligence on Vietnam-based businesses apply the FATF grey-list context explicitly: the enhanced due diligence requirement for grey-listed jurisdictions means that the compliance documentation expected of a Vietnamese business is held to a higher standard than comparable documentation from a non-grey-listed market. AML programs that would pass unremarked in a clean-list jurisdiction are subject to closer examination when the business is based in Vietnam.

Building a Program That Meets the Current Standard

Circular 27 establishes the regulatory floor. The practical standard — against which banking partners, investor diligence teams, and the SBV's examiners will measure compliance — is often higher than that floor, and it is shaped by the specific context of a grey-listed jurisdiction under sustained FATF pressure. Businesses that build to the minimum text of the circular will pass basic regulatory inspection. Businesses that build to the institutional standard applied by correspondent banks and international investors will also maintain banking relationships, attract capital, and navigate examinations without disruption.

The components of an AML program that meets the current standard are defined but demanding: a risk-tiered KYC/KYB framework aligned with Circular 27's 1-5 scoring methodology; a transaction monitoring system calibrated to the VND 500 million and USD 1,000 reporting thresholds; STR procedures with documented workflows for electronic filing through the SBV's system; beneficial ownership verification processes referencing reliable independent sources; governance structures with board-level reporting and documented senior management oversight; and training records demonstrating that staff understand the current regulatory requirements — not a generic AML program written for a different jurisdiction or a previous regulatory period.

What distinguishes programs that pass institutional scrutiny from those that do not is evidence. Policies that exist on paper without operational evidence — transaction monitoring logs, alert handling records, STR filing history, beneficial ownership verification files — do not constitute an AML compliance program in the sense that examiners and banking counterparts mean when they assess compliance. Evidence takes time to accumulate, and the time to begin building it is before the scrutiny event. For regulated businesses operating in Vietnam in 2026, that time is now.

Krysos Trust's founder holds CAMS certification from ACAMS, holds a Paris II law degree with specialisation in compliance, and has designed AML/CFT frameworks for businesses operating under Vietnam's regulatory sandbox. The firm advises on AML program design, gap assessments benchmarked against Circular 27 and FATF standards, transaction monitoring architecture, and compliance positioning for banking and investor diligence purposes. The starting point for most engagements is an honest assessment of where the existing program stands — and that assessment is most valuable before the pressure point, not during it.