Vietnam crypto regulation in 2026 remains fragmented: holding and trading crypto are not the same as using crypto for payment, and there is no clearly codified standalone nationwide crypto license equivalent to a mature VASP regime. Businesses must assess payment law exposure, AML obligations, token structure, marketing risk, and cross-border conduct before serving Vietnamese users.
Vietnam crypto regulation in 2026 remains fragmented: holding and trading crypto are not the same as using crypto for payment, and there is no clearly codified standalone nationwide crypto license equivalent to a mature VASP regime. Businesses must assess payment law exposure, AML obligations, token structure, marketing risk, and cross-border conduct before serving Vietnamese users.
This page is an informational compliance overview, not legal or tax advice. Vietnam crypto rules can change through laws, decrees, circulars, official guidance, and enforcement practice.
Key regulatory facts, timeline markers, and practical next steps for a fast initial read.
Vietnam began formal policy work on virtual assets and virtual currencies through government-level planning rather than a single crypto statute.
Vietnam adopted a new anti-money laundering law, increasing the importance of risk-based compliance, beneficial ownership review, and suspicious transaction controls.
The market remains shaped by fragmented rules, payment-law sensitivity, and evolving state review of virtual assets, digital finance, and enforcement priorities.
Vietnam crypto regulation in 2026 is best understood as a split regime. First, cryptoassets are not recognized as lawful payment instruments in the ordinary sense, so businesses should not assume they can accept Bitcoin, stablecoins, or other tokens as payment for goods and services in Vietnam. Second, ownership, trading, custody, and token-related activity exist in a more legally complex space: not expressly covered by a single dedicated crypto licensing law, but still exposed to payment rules, AML law, anti-fraud enforcement, securities-style analysis, tax review, and consumer-risk scrutiny. Third, there is no reliable shortcut called a “Vietnam crypto license” for all business models. The practical answer depends on whether the business touches fiat rails, custody, public fundraising, local solicitation, or client asset intermediation.
The main change by 2026 is not the arrival of a clean standalone crypto code; it is the growing expectation that serious operators map crypto activity into existing Vietnamese legal domains and international compliance standards. That means less reliance on informal market practice and more emphasis on AML governance, transaction traceability, token characterization, and defensible customer-risk controls.
| Topic | Legacy Approach | Current Approach |
|---|---|---|
| Market reading | Treat crypto as an unregulated gray area and rely on absence of explicit licensing text. | Treat crypto as a fragmented but enforceable area where payment law, AML rules, anti-fraud norms, and cross-border conduct all matter. |
| Business launch logic | Focus on product build and user growth first. | Run a pre-launch legal classification covering payment use, custody, fiat ramps, token rights, and local marketing triggers. |
| Compliance baseline | Minimal onboarding and generic terms of service. | FATF-style KYC, sanctions screening, suspicious activity escalation, wallet screening, and audit-grade recordkeeping. |
| Foreign platform risk | Assume offshore structure alone reduces Vietnam exposure. | Assume Vietnamese-language acquisition, local support, local payment rails, or direct solicitation can create regulatory attention. |
Vietnam does not operate under one consolidated crypto law. The legal framework is assembled from payment regulation, anti-money laundering law, civil-law treatment of property and transactions, securities and fundraising risk analysis, tax administration, cybersecurity, and anti-fraud enforcement. That fragmentation is the central fact every founder, exchange, and compliance officer must understand.
| Law / Regime | Scope | Applies To | Why It Matters |
|---|---|---|---|
| Non-cash payment framework | Regulates lawful payment instruments and payment services. | Any model using crypto as payment, settlement, merchant acceptance, or payment facilitation. | This is the main reason "holding crypto" and "paying with crypto" must be analyzed separately in Vietnam. |
| Anti-Money Laundering Law 2022 | Risk-based AML controls, customer due diligence, beneficial ownership, reporting, and recordkeeping. | Crypto businesses with financial-crime exposure, especially exchanges, brokers, custodians, OTC desks, and fiat-linked platforms. | Even where crypto licensing is incomplete, AML expectations remain the minimum serious-operating standard. |
| Securities and public offering rules | Investment products, fundraising, public solicitation, and security-like rights. | Token issuance, ICOs, revenue-sharing tokens, investment schemes, and exchange-listed offerings. | A token can trigger securities-style scrutiny based on rights and offering mechanics, not just label. |
| Tax administration and accounting rules | Transaction records, valuation support, income recognition, and audit readiness. | Crypto companies, founders, investors, and any business with crypto-linked flows. | Tax uncertainty does not remove recordkeeping duties; it increases the need for defensible documentation. |
| Cybersecurity and anti-fraud enforcement | Data security, platform misuse, scams, fraud, and unlawful fundraising. | Custodians, exchanges, wallet providers, token issuers, and consumer-facing apps. | In practice, enforcement often arrives through fraud, consumer harm, or cyber incidents before bespoke licensing rules do. |
No single regulator owns the entire crypto perimeter in Vietnam. The practical map is functional: the State Bank of Vietnam is central for payment-related issues, the Ministry of Finance and State Securities Commission matter for investment and token-offering questions, AML enforcement intersects with multiple state bodies, and tax authorities matter wherever value is created, transferred, or realized.
Core authority for payment systems, non-cash payment rules, and the legal treatment of payment instruments.
A business accepts crypto for goods or services, facilitates crypto-denominated payment flows, or links crypto activity to payment rails.
Relevant for financial policy, tax coordination, and oversight questions where digital assets intersect with investment products or financial markets.
A platform structures token sales, investment products, or crypto-linked commercial models with financial return features.
Relevant where tokenized rights resemble securities, collective investment interests, or public fundraising instruments.
A token grants profit rights, repayment expectations, governance rights tied to enterprise value, or is marketed as an investment.
Key enforcement body for fraud, cybercrime, illicit finance, and criminal misuse of digital assets.
Scams, unlawful fundraising, wallet theft, laundering indicators, or organized misuse involving crypto channels.
Tax administration, supporting documentation, audit trails, and treatment of income or gains.
A business books revenue, trading gains, service fees, treasury positions, or crypto-denominated transactions.
Sets strategic direction for digital assets, fintech, and the development of legal frameworks.
New strategies, pilot frameworks, inter-ministerial reviews, or legislative development affecting virtual assets.
The short answer is that Vietnam does not offer a clearly codified standalone nationwide crypto license in 2026 that covers the full range of exchange, brokerage, custody, issuance, and transfer services under one mature regime. The real question is not “Do I have a crypto license form?” but “Which parts of my model trigger payment, AML, securities, tax, cyber, or solicitation risk?”
Pure software wallet with no custody and no fiat rails
Needs case-by-case analysis
Custodial wallet holding client assets
Usually requires authorisation
Centralized exchange with fiat on/off-ramp
Usually requires authorisation
OTC brokerage matching buyers and sellers
Usually requires authorisation
Merchant crypto payment acceptance
Usually requires authorisation
Token issuance or public fundraising
Usually requires authorisation
Mining infrastructure
Needs case-by-case analysis
Foreign platform actively marketing to Vietnamese users
Usually requires authorisation
| Business Model | MiCA Relevance | Adjacent Regimes | Practical Answer |
|---|---|---|---|
| Holding crypto for treasury or investment | No direct Vietnam equivalent to MiCA-style licensing just for passive holding. | Tax, accounting, source-of-funds, corporate governance. | Usually lower licensing risk than customer-facing services, but documentation risk remains. |
| Exchange or brokerage | No clear standalone VASP/CASP license path. | AML, payment exposure, banking access, consumer risk, cross-border marketing. | High-risk activity; requires case-by-case legal analysis before launch. |
| Custody or safekeeping | No simple custody license route under a dedicated crypto regime. | AML, cybersecurity, consumer protection, asset segregation, incident response. | One of the most sensitive models because it involves client asset control. |
| Token issuance / ICO / IEO | No general token issuance passport. | Securities-style analysis, anti-fraud, marketing, disclosure, tax. | Very high structuring risk; legality depends on rights, audience, and offering design. |
| Crypto payment acceptance | Not a licensing gap but a payment-law problem. | SBV payment rules, enforcement risk, merchant conduct. | Avoid unless specific legal advice confirms a compliant structure. |
| DeFi interface or non-custodial protocol access | No dedicated local DeFi regime. | Front-end control, fees, custody, token promotion, sanctions screening. | Risk depends on operational control and customer-facing intermediation. |
Vietnam crypto regulation is activity-driven, not label-driven. Calling a product a utility token, wallet, or platform does not determine its legal treatment. The decisive questions are whether the business controls client assets, touches fiat rails, facilitates payment, offers investment-like rights, or actively solicits Vietnamese users.
| Category | Core Feature | Typical Trigger |
|---|---|---|
| Exchange and brokerage | Matches, executes, or intermediates crypto trades; may include fiat conversion. | Higher risk where the platform serves Vietnamese users directly, holds client assets, or integrates local banking/payment channels. |
| Custody and wallets | Stores private keys or controls access to client cryptoassets. | Custody sharply increases AML, cybersecurity, consumer-protection, and operational-risk expectations. |
| Token issuance and fundraising | Creates and sells tokens to raise capital or finance a project. | Rights to profit, repayment, governance, or pooled enterprise value can trigger securities-style scrutiny. |
| Payment use | Uses crypto as consideration for goods, services, or settlement. | This is the clearest high-risk area because payment law is stricter than simple holding or trading. |
| Mining and infrastructure | Provides validation, mining, node operation, or technical infrastructure. | Usually lower direct licensing sensitivity unless bundled with customer-facing financial services. |
| Staking, DeFi, NFT platforms | Offers protocol access, yield features, tokenized assets, or marketplace functions. | Risk rises when the operator controls front-end access, fees, custody, token promotion, or treasury management. |
| Foreign platform marketing | Targets Vietnamese residents from offshore. | Vietnamese-language ads, local support, local payment methods, and direct solicitation increase exposure. |
Yes: Treat as highest-priority legal risk and review under SBV-facing payment rules before launch.
No: Move to the next classification question.
Yes: Treat as custody-sensitive and apply enhanced AML, cybersecurity, segregation, and incident-response controls.
No: Move to the next classification question.
Yes: Assume materially higher regulatory exposure and banking friction.
No: Exposure may be lower, but AML and solicitation analysis still apply.
Yes: Run securities and fundraising analysis with MOF/SSC risk in mind.
No: Continue to functional review of marketing, consumer risk, and AML.
Yes: Treat as Vietnam-facing regulated exposure even if the entity is offshore.
No: Risk may be reduced, but not eliminated where Vietnamese users are knowingly onboarded.
Vietnam’s crypto policy path has evolved through staged government review rather than a single licensing switch. The key pattern is gradual formalization: first policy recognition, then stronger AML architecture, then more detailed scrutiny of virtual assets, market conduct, and digital-finance risk.
Marked the beginning of structured state treatment of the topic rather than ad hoc commentary.
Reinforced the core distinction between speculative/investment use and payment use.
Raised the importance of risk-based controls, beneficial ownership review, and suspicious transaction processes for crypto-exposed businesses.
Businesses can no longer rely on regulatory silence as a launch strategy.
Vietnam does not currently operate a legacy national crypto register comparable to a mature VASP authorization list. Businesses should avoid presenting offshore registration elsewhere as a substitute for Vietnam-specific legal analysis.
The practical process in Vietnam is a legal-classification and risk-mitigation exercise, not a simple form submission. The right sequence is to classify the activity, test payment exposure, map regulators, build AML controls, and only then decide whether the model can be launched, localized, or needs restructuring.
Separate exchange, brokerage, custody, issuance, merchant payments, DeFi access, NFT marketplace, mining, and software-only tooling.
Check whether any part of the model uses crypto as payment, settlement, or merchant consideration.
Identify SBV, MOF, SSC, tax, AML, cybersecurity, and consumer-risk interfaces.
Review language, marketing, local support, local staff, and local payment methods.
Implement KYC/KYB, wallet screening, transaction monitoring, escalation, and record retention.
Define valuation logic, transaction logging, and supporting documentation for audits.
Document why the model is structured as launched, restricted, or delayed.
The file should read like one operating model, not like disconnected policy appendices.
| Document | Purpose | Owner |
|---|---|---|
| Business model memo | Explains what the platform actually does and which activities it performs. | Legal / Product |
| Regulatory classification matrix | Maps each feature to payment, AML, securities, tax, and cyber risk. | Legal / Compliance |
| AML/KYC policy | Sets onboarding, risk scoring, monitoring, and escalation standards. | Compliance / MLRO function |
| Custody and security controls paper | Documents key management, segregation, access controls, and incident response. | Security / Operations |
| Tax and accounting memo | Supports valuation, revenue recognition, and recordkeeping logic. | Finance / Tax |
| Marketing and solicitation review | Tests whether Vietnam-facing conduct increases local regulatory exposure. | Legal / Growth |
The main cost in Vietnam is legal ambiguity management, not just filing fees. Where there is no mature standalone crypto license, businesses spend more on classification, controls, banking strategy, transaction monitoring, and restructuring than on a single regulator application.
| Cost Bucket | Low Estimate | High Estimate | What Drives Cost |
|---|---|---|---|
| Legal classification and local memo | Case-specific | Case-specific | Cost depends on whether the model includes custody, fiat rails, token issuance, or Vietnam-facing marketing. |
| AML/KYC stack | Variable vendor cost | Variable vendor cost | Includes identity verification, PEP/sanctions screening, wallet screening, transaction monitoring, and case management. |
| Security and custody controls | Variable implementation cost | Variable implementation cost | Segregation, key management, access control, logging, and incident response are major cost centers for custodial models. |
| Tax and accounting support | Case-specific | Case-specific | Higher where the business has treasury holdings, market making, token issuance, or multi-wallet operations. |
| Banking and payments strategy | Operationally significant | Operationally significant | Fiat ramps and settlement relationships often become the practical bottleneck in Vietnam-facing crypto operations. |
The common misconception is that no standalone crypto license means low compliance cost. In practice, fragmented regulation often increases cost because the business must defend its structure across multiple legal domains at once.
A serious crypto business serving Vietnam should operate to a FATF-grade AML standard even where local crypto-specific licensing is incomplete. That means customer due diligence, beneficial ownership review, sanctions and PEP screening, wallet risk analysis, suspicious activity escalation, and retention of records sufficient to reconstruct who sent what, to whom, when, why, and through which wallet path.
| Workflow Step | Control | Owner |
|---|---|---|
| Onboarding | Collect identity data, verify documents, screen sanctions/PEPs, and classify customer risk. | Compliance / Operations |
| Wallet attribution | Screen deposit and withdrawal addresses using blockchain analytics and adverse-risk indicators. | Compliance / Risk |
| Transaction monitoring | Apply rule-based and risk-based monitoring for suspicious patterns, rapid movement, and high-risk counterparties. | Compliance / Monitoring team |
| Enhanced due diligence | Request source-of-funds and source-of-wealth evidence for high-risk customers or unusual flows. | Compliance / Investigations |
| Travel Rule exchange | Transmit and receive originator/beneficiary information where cross-border VASP standards require it. | Compliance / Engineering |
| Case escalation | Document internal reviews, decision rationale, account restrictions, and reporting actions where required. | MLRO function / Legal |
A foreign company can face Vietnam regulatory exposure without incorporating locally. The decisive issue is not only where the entity is registered, but whether it knowingly serves Vietnamese users through localized marketing, local support, local payment methods, custody, or direct solicitation. Offshore status is a structuring fact, not a compliance shield.
Reverse solicitation should be treated cautiously. If the platform designs onboarding, language, support, pricing, or campaigns for Vietnamese users, it is difficult to argue that access is purely user-initiated.
The highest-risk conduct in Vietnam is conduct that looks like payment facilitation, unlawful fundraising, weak AML controls, or consumer-facing intermediation without a defensible legal structure. Enforcement risk is therefore operational, not theoretical.
Legal risk: Payment-law exposure involving non-approved payment instrument concerns.
Mitigation: Do not structure retail commerce around direct crypto payment acceptance without specific legal advice.
Legal risk: Cross-border solicitation, AML, banking, and consumer-risk exposure.
Mitigation: Review market-entry structure, restrict localized acquisition, and assess whether the model should be ring-fenced or paused.
Legal risk: Potential securities-style characterization, anti-fraud exposure, and public offering risk.
Mitigation: Restructure token rights, investor targeting, and disclosure; obtain local legal review before launch.
Legal risk: AML, cybersecurity, consumer-harm, and operational-control failure.
Mitigation: Implement segregation, HSM or equivalent key controls, wallet screening, and formal incident response.
Legal risk: Lower direct licensing exposure, but sanctions and misuse risk remain.
Mitigation: Maintain terms, geofencing review, misuse controls, and sanctions-related safeguards.
Tax treatment and accounting treatment can be less settled than in fully codified crypto jurisdictions, but that does not reduce compliance duties. In practice, uncertainty increases the importance of records, valuation methodology, and transaction-level support. Any Vietnam-facing crypto business should be able to show what asset moved, who controlled it, how it was valued, and how related revenue, fees, gains, or expenses were booked.
| Topic | Why It Matters | Responsible Team |
|---|---|---|
| Wallet and transaction logs | Needed to reconstruct flows, substantiate ownership, and support tax or audit review. | Finance / Operations |
| Valuation snapshots | Support accounting treatment and tax analysis where crypto is received, sold, transferred, or held on balance sheet. | Finance / Treasury |
| Fiat settlement records | Connect blockchain activity to bank statements, invoices, and revenue recognition. | Finance |
| KYC and source-of-funds files | Support AML defensibility and help explain transaction provenance during audits or investigations. | Compliance |
| Token issuance documentation | Critical for analyzing whether proceeds are revenue, financing, deferred obligations, or another category. | Legal / Finance |
| Intercompany and treasury records | Important where group entities move crypto between wallets, exchanges, or jurisdictions. | Finance / Tax |
12-step launch checklist
Sequence these after the core perimeter, governance, and launch-control decisions are stable.
Open the key issues founders, compliance teams and legal leads usually need to confirm before launch.
The accurate answer is it depends on the activity. In 2026, crypto should not be described as simply legal or illegal in Vietnam. Holding or trading cryptoassets is different from using them as a means of payment. Payment use is the more sensitive and higher-risk category.
Businesses should treat direct crypto payment acceptance in Vietnam as a high-risk model. The State Bank of Vietnam has historically taken a restrictive approach to non-approved payment instruments, so accepting Bitcoin or similar cryptoassets for goods or services requires extreme caution and specific legal review.
There is no clearly codified standalone comprehensive Vietnam crypto license in 2026 equivalent to a mature VASP or CASP regime. The practical analysis depends on the business model, especially custody, fiat ramps, payment functionality, token issuance, and local solicitation.
Crypto in Vietnam is regulated functionally rather than by one single crypto regulator. The State Bank of Vietnam is central for payment-related issues, the Ministry of Finance and State Securities Commission matter for investment and token-offering questions, and AML, tax, cybersecurity, and anti-fraud enforcement involve additional authorities.
A foreign exchange can still face Vietnam regulatory exposure even without a local entity. Risk rises materially when the platform uses Vietnamese-language marketing, local support, local payment methods, fiat ramps, custody, or direct solicitation. Offshore incorporation does not eliminate local compliance risk.
ICOs and token fundraising should be treated as high-risk in Vietnam. The legal analysis depends on token rights, investor expectations, public marketing, and whether the offering resembles a security, collective investment, or misleading fundraising scheme. No issuer should assume that calling a token a utility token resolves the issue.
Yes, as a practical compliance baseline. Even where crypto-specific licensing is incomplete, Vietnam-facing crypto businesses should implement FATF-grade AML controls, including KYC, beneficial ownership checks, sanctions screening, suspicious activity escalation, and recordkeeping. This is especially important for exchanges, brokers, custodians, and fiat-linked models.
Yes, especially for cross-border VASP interactions. Even if local crypto rules do not yet provide a fully mature Travel Rule framework, serious operators serving Vietnam should be technically ready to exchange originator and beneficiary data using standards such as IVMS101 where counterparties or group policy require it.
Tax outcomes depend on the taxpayer profile, transaction type, and how the activity is characterized, so businesses should not rely on generic internet summaries. What is clear is that crypto-related activity requires strong records, valuation support, wallet logs, and transaction documentation for tax and audit purposes.
The biggest mistake is treating all crypto activity as one category. In Vietnam, the decisive distinction is between holding/trading, custody, token fundraising, and payment use. A second common mistake is assuming that offshore incorporation removes Vietnam exposure when the platform actively targets Vietnamese users.
The practical position in 2026 is clear on three points. First, do not confuse crypto ownership or trading with lawful payment use in Vietnam. Second, do not assume a simple nationwide crypto license exists for every business model. Third, if you are launching an exchange, custody product, token sale, or Vietnam-facing platform, build the project around payment-law screening, FATF-grade AML, tax records, and a written local legal analysis before scaling user acquisition.
