The Circular was issued to operationalize the provisions of the Law on Artificial Intelligence and relevant implementing regulations, while establishing a consistent framework for the safety, risk management and deployment of AI systems in the banking sector.
In recent years, entities across the banking sector have accelerated the adoption of AI in a wide range of operations, including credit scoring, loan assessment, payment fraud detection, automated advisory services and electronic Know Your Customer (eKYC). Alongside these benefits, AI adoption has also introduced new risks relating to cybersecurity, data security, model risk, and third-party and supply-chain risks. These risks may affect the lawful rights and interests of organizations and individuals, as well as the safety and soundness of banking operations.
The Circular adopts a risk-based regulatory approach, ensuring that regulatory requirements are proportionate to the level of risk and potential impact of each AI system, while maintaining effective human oversight and intervention. Its key provisions include:
- Risk classification of AI systems and ensuring human oversight and intervention: AI systems must be classified according to their level of risk, with appropriate mechanisms established for human oversight and intervention. AI systems must not replace human responsibility or decision-making authority in banking operations.
- Specific requirements for high-risk AI systems in the banking sector: The Circular specifies high-risk AI systems in accordance with Decision No. 33/2026/QD-TTg of the Prime Minister, promulgating the List of High-Risk Artificial Intelligence Systems. For AI systems that automatically execute payment transactions, a system is classified as high-risk when it automatically executes a transaction exceeding VND 10 million per transaction or transactions totaling more than VND 20 million per day for individual customers; or exceeding VND 50 million per transaction or totaling more than VND 100 million per day for institutional customers. For AI systems that automatically make credit-granting decisions, a system is classified as high-risk when it processes a credit facility of VND 50 million or more.
- Strengthening cybersecurity and data security: AI systems must undergo cybersecurity testing and assessment before being put into production, as well as periodically thereafter or whenever significant changes are made. They must also comply with requirements relating to data security, change management, incident response, logging, and the management of AI-specific risks.
- Establishing an AI application risk management framework: The Circular sets out responsibilities for risk management and impact assessments for high-risk AI systems, together with a three-lines-of-defense risk management framework. It also addresses risks relating to models, ethics, outsourcing, and supply chains.
- Conditions for deploying AI systems: Before an AI system is put into production, regulated entities must prepare the required documentation, assess whether the deployment conditions have been satisfied, and submit the system to the competent authority for consideration and approval before it is officially deployed.
SBV/translated by VNBA News
