On 15 November, Circular 53/2026/TT-NHNN takes effect, and with it the State Bank of Vietnam's answer to a question every AI vendor selling into banking eventually faces. Which of your features count as high risk?
The answer in Vietnam is a set of numbers, and the numbers are small enough to matter to almost any product.
A payment executed automatically by an AI system is high risk once it exceeds 10 million dong in a single transaction, or 20 million dong in a day for one individual customer. For organizations the line sits at 50 million and 100 million dong. An AI system that approves credit automatically is high risk from 50 million dong per loan. That is roughly 380 to 3,800 US dollars per transaction depending on which line you read. Most business products cross that on day one.
I work with foreign companies entering Vietnam, and the mistake I watch for is reading a rule like this as a compliance question someone else will answer. The circular puts classification on the institution. It must classify every AI system as high, medium or low risk before deployment, have the result approved by its competent authority, keep a list of systems with risk levels, providers and versions, and review that list at least once a year. A foreign bank branch follows its parent's approval rules. The vendor inherits the classification of its provider in some cases, and must reclassify with the bank when a change of function creates new risk.
Read that again from the vendor's side. The bank decides, annually, whether your feature is high risk. Your product can sit below the line this quarter and above it the next, because the trigger is transaction size, and transaction size is a commercial decision your client makes. The same feature serving a bank whose customers move 8 million dong per automated payment is low risk. Serve a bank whose customers move 12 million and the classification, the monitoring obligations and the contract requirements change underneath you.
What does the circular demand once you are high risk? For automated payment execution, the list is concrete.
The customer and the bank need an agreement that authorizes the AI to execute payments, with clear scope, per-transaction and daily limits, validity period, suspension conditions and the customer's right to terminate at any time. The agreement itself must be verified, biometric matching combined with another confirmation method, under the bank's existing online security rules. Daily automated volume is capped at 100 million dong for individuals and 500 million for organizations regardless of what the internal limits say. The bank must give the customer a tool to suspend or revoke the authorization on their own. And the bank must be able to identify whether a given transaction was executed by the AI system or by a human.
That last requirement is the one I would build against first. It sounds like an audit log until you try to satisfy it across a payment stack where an AI system proposes, a rules engine approves, and a human taps confirm. If your product cannot answer that question per transaction, the bank's classification of your feature as safe to automate is at risk, and so is the feature.
The effective dates give this week a specific urgency. The core of the circular lands on 15 November 2026. Article 14 waits until 1 January 2027, and two further provisions wait until 1 September 2027, except for anyone running a high-risk system, which follows the earlier dates. Guidance for AI systems below the high-risk list is still open, which means banks are currently classifying into a framework whose lower half is unfinished.
If you sell AI into Vietnamese banking, payments or mobile money, the checklist I would run before the 15th is short. Ask each bank client where it has classified your system and on what transaction assumptions. Get the reclassification trigger written down, what happens when limits rise or your integration changes. Check whether your contract carries the agreement terms the circular requires, scope, limits, suspension and the customer kill switch. And test whether your logs can separate AI-executed transactions from human ones, because that question is now a regulatory requirement with a date on it, and the date is close.
Share this post