State Bank of Vietnam Sets Risk Tiers and Human Review Rules for Banking AI
Vietnam’s central bank has set out how lenders and payment firms may use artificial intelligence. The State Bank of Vietnam (SBV) has issued Circular No. 53/2026/TT-NHNN on safety, risk management and the conditions for applying AI systems in banking, VietnamPlus reported on October 8. The rules take effect on November 15, 2026, and cover credit institutions, foreign bank branches, payment intermediaries, credit information companies and mobile money providers.
The core principle is that AI does not replace human authority or responsibility. Providers remain legally responsible to customers for decisions made or supported by AI, and cannot point to technical features, system autonomy or third-party products to avoid or reduce liability. Before deployment, every system must be classified as high, medium or low risk.
The circular puts numbers on that. AI that automatically executes payments counts as high risk if it handles individual transactions above 10 million dong each or more than 20 million dong a day for one customer; for institutional clients the thresholds are 50 million and 100 million dong. AI that recommends credit approvals is high risk for loans of 50 million dong or more. Automated payments need a prior agreement that sets limits and a right to terminate, and daily AI-executed totals cannot exceed 100 million dong for individuals or 500 million dong for institutions.
What it means in practice
Customers gain several new protections. Banks must say at the start of a session when a customer is dealing with an AI system instead of a person, provide tools to pause or revoke an AI’s authority to make payments, and have a human review any automated decision a customer challenges, with that review as the final basis for resolving it. For decisions that affect a customer’s obligations or access to services, banks must keep the key factors so they can explain them on request, though not source code or trade secrets. Monitoring teams must be able to override or pause AI and trigger emergency shutdowns, with every intervention logged.
Outsourcing does not shift responsibility, and vendors may not use a bank’s data to train or improve models without written consent. The rules arrive as lenders roll out new tools, such as the three AI platforms Viettel unveiled for banks and FPT’s AI-first finance roadmap through 2030.
What to watch: how banks classify their existing chatbots and credit models before November 15, how quickly complaint units are set up, and whether the SBV issues further guidance on explaining automated decisions.