Quyết định 2345/QĐ-NHNN năm 2023 triển khai giải pháp an toàn, bảo mật trong thanh toán trực tuyến và thanh toán thẻ ngân hàng do Thống đốc Ngân hàng Nhà nước Việt Nam ban hành

STATE BANK OF VIETNAM
-------

SOCIALIST REPUBLIC OF VIETNAM
Independence - Freedom – Happiness
---------------

No. 2345/QD-NHNN

Hanoi, December 18, 2023

No.

Transaction 1

Minimum authentication methods 2

Individual customers

Organization customers

1

Category A transactions

- Username, password or PIN (if a customer has been authenticated during log-in, authentication is not required during transaction)

- Username, password or PIN (if a customer has been authenticated during log-in, authentication is not required during transaction)

2

Category B transactions

- OTP sent by SMS or Voice or Email; or

- OTP Matrix Card; or

- Basic OTP generated by soft/hard token; or

- Two-factor authentication method; or

- The customer's handheld device 3, or

- Advanced OTP generated by soft/hard token; or

- FIDO Authentication; or

- Safe electronic signature.

- OTP sent by SMS or Voice or Email; or

- OTP Matrix Card; or

- Basic OTP token without authentication of token user; or

- Handheld device biometrics of the customer's legal representative or accountant 3.

3

Category C transactions

- The customer's biometric identifier that: (i) matches the biometric data in the customer's ID card issued by the police authority 4; or (ii) is authenticated by the customer's electronic identification account created by the electronic identification and authentication system 5; or

- The customer's biometric identifier that matches the customer's biometric data in the biometric database 6. It is recommended to combine with SMS/Voice OTP or OTP generated by soft/hard token.

- Basic OTP soft/hard token with authentication of software/token user; or

- Two-factor authentication method.

4

Category D transactions

The customer's biometric identifier that: (i) matches the biometric data in the customer's ID card issued by the police authority 4; or (ii) is authenticated by the customer's electronic identification account created by the electronic identification and authentication system; or (iii) matches the biometric data stored in the verified biometric database 6, combined with one of the following authentication methods:

- Advanced OTP generated by soft/hard token; or

- FIDO authentication; or

- Safe electronic signature.

 - Advanced OTP generated by soft/hard token; or

- FIDO authentication; or

- Safe electronic signature.

PP THE GOVERNOR
DEPUTY GOVERNOR




Pham Tien Dung

No.

Description

Category A

Category B

Category C

Category D

I

Individual customers

1

Group I.1:

- Information lookup

- Intrabank transfer to the same account holder

All transactions

2

Group I.2:

- Transactions including payments of lawful goods and services processed by payment service providers at payment acceptors selected, appraised, supervised and managed by payment service providers

Any transaction that satisfies the following condition:

G + T ≤ 5 million VND.

Any transaction that satisfies the following conditions:

(i) G + T > 5 million VND

(ii) G + T ≤ 100 million VND

Any transaction that satisfies the following conditions:

(i) G + T > 100 million VND

(ii) G + T ≤ 1,5 billion VND

Any transaction that satisfies the following condition:

G + T > 1,5 billion VND

3

Group I.3:

-  Intrabank transfer to other account holders

- Domestic interbank transfer

- Money transfer between e-wallets

- E-wallet cash-in 7

- E-wallet cash-out

Any transaction that satisfies the following conditions:

(i) G ≤ 10 million VND

(ii) G + T_ksth ≤ 20 million VND.

Any transaction that satisfies one of the following conditions:

1. Any transaction that satisfies the following conditions:

(i) G ≤ 10 million VND

(ii) G + T_ksth > 20 million VND

(iii) G + T ≤ 1,5 billion VND.

2. 2. Any transaction that satisfies the following conditions:

(i) G > 10 million VND.

(ii) G ≤ 500 million VND.

(iii) G + T ≤ 1,5 billion VND.

Any transaction that satisfies one of the following conditions:

1. Any transaction that satisfies the following conditions:

(i) G ≤ 10 million VND

(ii) G + T_ksth > 20 million VND

(iii) G + T ≤ 1,5 billion VND

2. Any transaction that satisfies the following conditions:

(i) G > 10 million VND

(ii) G ≤ 500 million VND

(iii) G + T ≤ 1,5 billion VND

3. Any transaction that satisfies the following condition:

G > 500 million VND

4

Group I.4:

Outbound interbank transfer *

Any transaction that satisfies the following conditions:

(i) G ≤ 200 million VND

(ii) G + T ≤ 1 billion VND

Any transaction that satisfies one of the following conditions:

1. Any transaction that satisfies the following conditions:

(i) G ≤ 200 million VND

(ii) G + T > 1 billion VND

2. Any transaction that satisfies the following condition:

G > 200 million VND

II

Organization customers

1

Group II.1:

Information lookup

All transactions

2

Group II.2:

Intrabank transfer to the same account holder

All transactions

3

Group II.3:

- Intrabank transfer to other account holders

- Domestic interbank transfer

- Transactions including payments of lawful goods and services processed by payment service providers at payment acceptors selected, appraised, supervised and managed by payment service providers

- Money transfer between e-wallets

- E-wallet cash-in

- E-wallet cash-out

Any transaction that satisfies the following conditions:

(i) G ≤ 1 billion VND

(ii) G + T ≤ 10 billion VND

Any transaction that satisfies one of the following conditions:

1. Any transaction that satisfies the following conditions:

(i) G ≤ 1 billion VND

(ii) G + T > 10 billion VND

2. Any transaction that satisfies the following condition:

G > 1 billion VND

4

Group II.4:

Outbound interbank transfer *

Any transaction that satisfies the following conditions:

(i) G ≤ 500 million VND

(ii) G + T ≤ 5 billion VND

Any transaction that satisfies one of the following conditions:

1. Any transaction that satisfies the following conditions:

(i) G ≤ 500 million VND

(ii) G + T > 5 billion VND

2. Any transaction that satisfies the following condition:

G > 500 million VND

No.

Method

Description

1

SME/Voice/Email OTP

When an online payment is made, the Internet Banking/Mobile Banking will send an OTP via SMS (SMS OTP) or call (Voice OTP) or email (Email OTP) Article registered by the customer.

The customer will then enter the OTP on the online payment interface to complete the payment process.

2

OTP Matrix Card

The matrix card has 2-dimension table with rows and columns, which provide an arrangement of OTPs.

When an online payment is made, the Internet Banking/Mobile Banking will send a notification of the numbers of row and column on the matrix card. The customer will then enter the corresponding OTP to complete the payment process.

3

Basic OTP generated by soft token

The OTP-generating software (soft token) is usually installed on a handheld device that has been registered with the payment service provider. Basic OTPs will be periodically generated and synchronized with the online payment system of the payment service provider.

When an online payment is made, the Internet Banking/Mobile Banking will require the customer to enter the OTP generated by the soft token.

The customer or the software will enter the OTP on the online payment interface, then the customer will give a confirmation to complete the payment process.

4

Advanced OTP generated by soft token

The soft token is usually installed on a handheld device that has been registered with the payment service provider. Advanced OTPs will be generated in combination with the transaction code (transaction signing).

When an online payment is made, the Internet Banking/Mobile Banking will generate a transaction code and notify the customer.

Then customer or the software will enter the transaction code into the soft token, which will generate an OTP.

The customer or the software will then enter the OTP on the online payment interface. Next, the customer will give a confirmation to complete the payment process.

5

Basic OTP generated by hard token

An OTP token is a device that generates OTPs. Basic OTPs will be periodically generated and synchronized with the online payment system of the payment service provider.

When an online payment is made, the Internet Banking/Mobile Banking will require the customer to enter the OTP generated by the hard token to complete the payment process.

6

Advanced OTP generated by hard token

Advanced OTPs will be generated by the hard token in combination with the transaction code (transaction signing).

When an online payment is made, the Internet Banking/Mobile Banking will generate a transaction code and notify the customer.

Then customer will enter the transaction code into the hard token, which will generate an OTP.

The customer will then enter the OTP on the online payment interface to complete the payment process.

7

Two-factor authentication

When an online payment is made, the Internet Banking/Mobile Banking will send an authentication request to the customer's mobile device by a call, USSD or a dedicated software.

The customer will respond directly through this channel to confirm or deny the transaction.

8

Biometrics

When an online payment is made, the Internet Banking/Mobile Banking will require the customer to present his/her forgery-proof biometric identifier, such as face, finger veins, hand veins, fingerprint, iris, voice.

9

FIDO

Authentication standards established by FIDO Alliance (more at  Fidoalliance.org)

When an online payment is made, the Internet Banking/Mobile Banking will require the customer to authenticate using an U2F/UAF device (connected via a USB port, Bluetooth or NFC) or an authentication software on the smart phone, or a FIDO2-compatible browser. After authentication using an access code or biometric identifier, the U2F/UAF or software will automatically communicate with the browser and the server to authenticate the address of the internet banking website and the transaction.

10

Safe digital signature

When an online payment is made, the Internet Banking/Mobile Banking will require the customer to use the safe digital signature registered with the payment service provider.

Safe digital signatures include secured digital signature or recognized foreign digital signature as prescribed by law.