2026
4 MIN READ
Vietnam is developing its first formal licensing regime for virtual asset service providers. For crypto businesses considering the market — or already operating informally within it — understanding the pathway to regulatory legitimacy is now a strategic priority, not a compliance afterthought.
The Current State of Vietnam's VASP Framework
Vietnam does not yet have a finalized formal licensing regime for virtual asset service providers. What exists is a developing framework — legislation under development, regulatory bodies whose VASP-related authority is being defined, and a sandbox mechanism that has functioned as the primary route for supervised operation while the formal regime is constructed.
The State Bank of Vietnam holds authority over payment systems and related financial infrastructure. The Ministry of Finance has been assigned primary responsibility for developing the legal framework governing virtual assets. The interaction between these two bodies — which transactions and business models fall under each — is part of what the framework is still resolving. For businesses trying to understand where they fit, this ambiguity is substantive and needs to be navigated carefully.
The trajectory is toward a licensing regime, not continued ambiguity or prohibition. Vietnam has been explicit about developing a regulatory framework rather than banning virtual assets outright. The question for international operators is not whether to engage with this framework but how to position for it — and how early to begin.
The Sandbox Pathway
The regulatory sandbox has been Vietnam's mechanism for permitting supervised VASP operations prior to the formal licensing framework taking effect. It is not an informal pilot — it is a regulated operating environment with reporting obligations, operational conditions, and ongoing regulatory oversight.
Sandbox admission is for businesses that can demonstrate a credible, operational compliance infrastructure. It is not a route for businesses to test whether compliance is necessary. Applicants who approach the sandbox as a way to operate while building their compliance program misunderstand both the requirements and the regulatory relationship that sandbox admission creates.
Admission is competitive in the sense that the number of participants is limited and the regulatory bodies are assessing whether each applicant's model contributes meaningfully to the development of the regulatory framework — not just whether it meets minimum documentation requirements. The practical implication is that the quality of the application and the credibility of the compliance narrative matter, not just the completeness of the checklist.
The AML/CFT Prerequisites
No credible VASP licensing application in Vietnam — whether for sandbox admission or for the formal licensing regime when it takes effect — will succeed without a demonstrated AML/CFT compliance infrastructure. This is not a procedural requirement that can be addressed with a template policy document. It is an assessment of whether the business has built the systems, governance structures, and documented processes that a regulated operator is expected to maintain.
The specific requirements include: a KYC/KYB framework that reflects the actual customer and transaction risk environment of the business; a transaction monitoring program with documented rules, thresholds, and alert handling procedures; STR procedures that are operational and tested; governance structures that evidence board-level compliance oversight; and training records that demonstrate staff have been trained on the relevant requirements.
Applicants who arrive at the application stage without this infrastructure in place face two problems. First, the application will not be credible and will not be approved. Second, building the compliance infrastructure under the time pressure of an active application process is significantly harder and more expensive than building it as a planned program.
Common Positioning Mistakes
The most common mistake is applying before the compliance foundation is in place. Businesses that have been operating informally — or that have a compliance framework in name but not in substance — sometimes believe that initiating an application will create the pressure they need to build the program. The regulatory relationship that results from an unsuccessful or withdrawn application is not neutral. It creates an impression that is difficult to overcome.
The second common mistake is treating the published requirements as a complete picture of what the application requires. Vietnam's regulatory bodies assess applications against their own institutional expectations, which are informed by the sandbox experience, by FATF guidance, and by the practical realities of what a regulated VASP operation needs to look like. Published requirements are the floor, not the ceiling.
International operators sometimes also underestimate the importance of local presence and advisory relationships. An application that arrives from outside Vietnam, without local institutional relationships and without advisers who have direct engagement with the relevant regulatory bodies, is at a structural disadvantage relative to one that arrives through established channels.
How to Position for Admission
The sequencing that leads to a credible application begins well before the application itself. First, assess the compliance infrastructure and close the gaps — not against a minimum standard, but against the standard that the regulatory bodies actually apply. This takes time and should not be compressed.
Second, develop the regulatory relationships that inform a credible application. This means engagement with the relevant bodies and with institutional intermediaries — including industry associations with direct regulatory dialogue — before the application is submitted. An application that arrives cold, without established relationships or prior engagement, starts at a disadvantage.
Third, prepare the application materials with the same rigor that you would apply to a licensing submission in a more established jurisdiction. The narrative needs to demonstrate not just compliance capability but a genuine understanding of Vietnam's regulatory environment and a credible operational plan for how the business will function as a regulated entity. Applications that are thorough, specific, and grounded in local market understanding are meaningfully better positioned than those that apply a generic template to a Vietnam-specific context.
