State Bank of Vietnam sets three-step AML supervision process from 1 December

The Governor of the State Bank of Vietnam (SBV) issued Circular 57/2026/TT-NHNN on 9 November 2026, setting procedures for supervising anti-money laundering (AML) activity in the monetary and banking sector. It applies to reporting entities covered by the Law on Anti-Money Laundering 14/2022/QH15, as amended by Law 23/2026/QH16, within the SBV’s state-management remit. The circular takes effect on 1 December 2026.

The practical compliance impact is a structured, risk-based information process. SBV supervisory units will periodically request and guide entities to provide documents, information and data, then assess, score and classify their money-laundering risk. Those classifications will inform the allocation of supervisory resources and proposed supervisory measures, as well as the target, frequency, content and scope of periodic or ad hoc inspections.

Three stages, two supervisory tracks

Circular 57 sets out three stages:

1. collecting, compiling and processing documents, information and data;
2. conducting compliance and risk-based supervision; and
3. preparing a supervisory report and proposing supervisory measures.

Compliance supervision will examine whether an entity has met information and reporting requirements under Articles 15, 25, 26, 34, 36 and 37 of the AML Law and related rules. It will also assess the entity’s internal AML regulations under Article 24 and compliance with any AML directions or requirements issued by competent state authorities.

Risk-based supervision covers three categories:

- Structural risk, based on the entity’s operating scale and organisational model, including its licence, total assets, management structure, domestic and overseas network, parent bank and group structure.
- Inherent risk, based on customers, products and services, distribution channels and geography. Requested data may include customer numbers, account numbers and transaction values broken down by customer risk rating, individual or organisation, resident or non-resident status and business sector.
- Control and prevention mechanisms, covering governance, internal policies, AML personnel, annual risk assessments, risk-control policies, transaction monitoring, suspicious transaction reporting, training, internal controls, internal audit and remediation of audit findings.

The inherent-risk data also covers high-risk products and services, direct and remote electronic channels, and transactions linked to high-risk countries, territories or domestic geographical areas.

Remote supervision linked to inspections

The SBV will combine compliance and risk-based supervision with remote supervision and on-site inspection or examination. Supervisory units must report the risk classifications to the SBV Governor and use the results to propose measures under Chapter VI of the circular.

They must also combine information already available to them with other relevant sources when developing inspection plans. That information will be used to determine the targets, frequency, content and scope of supervision and inspection. The circular also calls for stronger coordination and information-sharing between supervisory units and the SBV units responsible for inspection and examination, including when annual AML inspection plans are prepared.

For reporting entities, the immediate preparation point is the consistency and retrievability of data across customer-risk classifications, transaction monitoring, reporting, governance and audit-remediation records. In Atlas’s view, the circular makes those data sets part of the supervisory evidence trail, rather than merely internal AML documentation.

Circular 57/2026/TT-NHNN enters into force on 1 December 2026.