Chương II: Quy định cụ thể về triển khai open API

CIRCULAR

ON IMPLEMENTATION OF OPEN APPLICATION PROGRAMMING INTERFACE IN BANKING SECTOR

Pursuant to the Law on State Bank of Vietnam dated June 16, 2010;

Pursuant to the Law on Credit Institutions dated January 18, 2024;

Pursuant to the Law on Electronic Transactions dated June 22, 2023;

Pursuant to the Law on Cybersecurity dated November 19, 2015;

Pursuant to Decree No. 52/2024/ND-CP dated May 15, 2024 of the Government on cashless payments;

Pursuant to Decree No. 13/2023/ND-CP dated April 17, 2023 of the Government on protection of personal data;

Pursuant to Decree No. 102/2022/ND-CP dated December 12, 2022 of the Government on functions, responsibilities, jurisdiction and organizational structure of the State Bank of Vietnam;

At the request of the Director General of the Department of Information Technology;

The Governor of the State Bank of Vietnam promulgates the Circular on implementation of Open Application Programming Interface in banking sector.

Chapter I

GENERAL REGULATIONS

Article 1. Scope

1. This Circular promulgates regulations on implementation of Open Application Programming Interface in banking sector.

2. This Circular does not regulate the connection and processing of state secret data. The processing of state secret data shall be in accordance with the law.

3. This Circular does not regulate the direct connection and resolution of data between:

a) The information system of banks and the information system of organizations via Application Programming Interface to serve internal affairs of those organizations;

b) The information system of banking sector and the Body governing electronic clearing systems. Body governing electronic clearing systems is determined in accordance with regulations of the State Bank of Vietnam on provision of payment intermediary services.

Article 2. Regulated entities

1. Commercial banks, cooperative banks, foreign bank branches (hereinafter referred to as “banks”).

2. Relevant organizations and individuals in implementation of services via Application Programming Interface in banking sector

Article 3. Definitions

For the purposes of this Circular, the terms below shall be construed as follows:

1. Application Programming Interface (hereinafter referred to as “API”) is an interface that allows communication between software applications within an organization or between organizations.

2. Open API in banking sector (Open API) is a collection of APIs provided by banks to third parties for direct connection and data processing to provide services to customers. Open API includes basic Open API and other Open APIs

3. Open API testing system is the information system of banks provided to third parties to test Open APIs before official implementation.

4. Customers are

Individuals using services of banks.

5. Third party is an organization or another bank that has a contractual agreement with the bank to connect, process data through Open APIs to provide services to customers.

6. Customer consent is the clear, voluntary expression affirming a customer’s permission for the processing of the his/her personal data.

Article 4. General principles

Banks, customers, third parties (hereinafter referred to as parties) shall comply with following principles during implementation of Open API:

1. Comply with the law on protection, provision of customer data and protection of personal data. The processing of personal data of a customer serves only the respective customer, unless otherwise prescribed by law.

2. Data during processing shall be managed, stored, exploited, and used for the intended purpose as prescribed in the contract between parties and in accordance with the law.

3. Data during processing shall be continuously updated and accurate. In case of discrepancies, timely corrections and adjustments shall be implemented according to the agreement between parties.

Chapter II

SPECIFIC REGULATIONS ON IMPLEMENTATION OF OPEN API

Section 1. REGULATIONS ON IMPLEMENTATION OF OPEN API

Article  5. Principles of implementation of Open API

1. When implementing basic Open APIs prescribed in Article 6 of this Circular, banks shall comply with regulations in Appendices 01 and 02 attached to this Circular.

2. When implementing Open APIs other than those prescribed in Article 6 of this Circular according to practical needs and in accordance with the law, banks shall comply with regulations in Appendix 02 attached to this Circular.

3. Banks shall only implement Open API prescribed in point c clause 1 Article 6 for third parties which are banks and payment intermediary service providers.

Article 6. List of Open APIs

1. The list of basic Open APIs includes following groups:

a) Open APIs for querying exchange rates and interest rates of banks including API for retrieval of data on interest rates, API for retrieval of exchange rates;

b) Open APIs for querying data of customers including: API for authorization and consent, API for retrieval of access code, API for refresh of access code, API for revocation of access code, API for retrieval of account list, API for retrieval of account data, API for retrieval of transaction history;

c) Open APIs for payment initiation, e-wallet cash-in, and e-wallet cash-out including:

 (i) Open APIs for payment initiation including: API for payment initiation, API for confirmation via Redirect Flow, API for retrieval of access code via Redirect Flow, API for update of confirmation status via Decoupled Flow, API for payment confirmation, API for retrieval of transaction status, API for retrieval of payment confirmation status of customers via Decoupled Flow;

 (ii) Open APIs for e-wallet cash-in including: API for e-wallet deposit, API for OTP confirmation, API for update of confirmation status of e-wallet deposit via Decoupled Flow, API for retrieval of confirmation status of e-wallet deposit via Decoupled Flow, API for e-wallet deposit confirmation, API for retrieval of transaction status;

(iii) Open API for e-wallet cash-out.

2. The detailed list of Open APIs in clause 1 of this Article is promulgated  in Appendix 01 attached to this Circular.

Article 7. List of technical standards

1. The technical standards for implementing Open API include architecture standards, data standards, and security standards.

2. The technical standards for implementing Open API in banking sector is promulgated in Appendix 02 attached to this Circular.

Article 8. Contracts between banks and third parties

The bank and the third party shall enter into a contract on implementing Open API including following content:

1. Commitment to data security including an agreement to ensure safety and security of data during data processing via Open API provided by the bank.

2. Commitment to using data provided by the bank within the correct scope and purpose.

3. The third party’s responsibility to notify the bank when they detect any personnel violating cybersecurity network during implementation of Open API.

4. Information on Open API  services provided to customers.

5. Information on Open API service fees for customers (if any).

6. Terms regarding the evaluation and classification of the information system of third parties, which connects and transmits data via Open API, in accordance with regulations on assurance of information system security at different levels of the Government.

7. Access rights of third parties during implementation of Open API.

8. Termination clause.

Article 9. Disclosure of information on Open API

Before connecting and processing data with the third parties, banks shall disclose information on Open AI on their official websites including the following content:

1. Information on Open API testing system.

2. List of Open APIs implemented by banks.

Section 2. RIGHTS AND RESPONSIBILITIES OF BANKS AND THIRD PARTIES

Article 10. Rights of banks

1. Request third parties to provide information related to connection and processing data via Open API.

2. Other rights as prescribed in the contract with the third parties.

Article 11. Responsibilities of banks

1. Complete information technology infrastructure for connection and processing data via Open API.

2. Formulate and complete guidelines on connection and processing data.

3. Ensure the quality of data during the implementation of Open API. Timely notify the third parties in case of data discrepancies, and collaborate with the third parties to correct and adjust them promptly.

4. Ensure cybersecurity of the information system implementing Open API in accordance with level 3 of the Government on levels of information system security and of the State Bank of Vietnam on the information system in banking sector.

5. Provide tools and fuctions for customers to:

Search the data that customers have allowed the third party to process.

b) Withdraw their consent in accordance with the law.

6. Set a time limit of up to 180 days for accessing customer data after obtaining customer consent, except in cases where there is another agreement between customers and banks.

7. Provide information on the progress of implementation of Open API to the State Bank of Vietnam (through the Department of Information Technology) upon request.

8. Collaborate with the third parties based on agreements and with competent authorities in resolving issues or disputes during the implementation of Open API.

9. Implement a technological solution to limit the number of automated queries for customer information from third parties.

10. Take responsibility in selecting, appraising, supervising and managing the third parties.

11. Update or revoke the right to access to the data of the third parties in accordance with contract changes.

12. Supervise access activities:

a) Implement a supervising system to detect and prevent unauthorized or suspicious access activities from the third parties;

b) Record a comprehensive log  of all Open AI usage of the third-parties at least 03 months and store the data for at least 01 year for inspection (if necessary).

Article 12. Rights and responsibilities of third parties

1. The third parties have the following rights according to contracts or agreements with banks and customers.

2. Responsibilities of third parties:

a) Provide tools and fuctions for customers to:

(i) Search the data that customers have allowed the third party to process.

(ii) Withdraw their consent in accordance with the law.

b) Notify the customers on clauses, requirements for using the services and provide guidelines for customers to use the services.

c) Issue procedures for risk management, customer care, complaint resolution, dispute resolution, assurance of continuous operation, and use of services when providing services to customer.

d) Exploit and use of data within the agreement between parties and in accordance with the law.

dd) Promptly notify the banks if there are incidents related to information technology or information security when implementing Open API. The method and time of notification shall be in accordance with the agreement between banks and third parties.

e) Timely notify the banks in case of data discrepancies, and collaborate with the banks to correct and adjust them promptly. The method and time of notification shall be in accordance with the agreement between banks and third parties

Chapter III

IMPLEMENTATION CLAUSE

Article 13. Responsibilities of the Department of Information Technology

1. Take charge, collaborate with relevant units affiliated to the State Bank of Vietnam to resolve issues during the implementation of this Circular.

2. Supervise, consolidate, report the Governor of the State Bank of Vietnam the implementation status of banks in accordance with this Circular.

3. Inspect banks implementing this Circular.

Article 14. Effect

This Circular comes into force from March 01, 2025.

Article 15. Transitional provision

Banks that have already connected and directly processed data with third parties via API or Open API to provide services to individual customers before the effective date of this Circular must:

1. Formulate a list of APIs, Open APIs that they are implementing and a detailed implementation plan in accordance with this Circular, and report to the State Bank of Vietnam (through the Department of Information Technology) by July 01, 2025.

2. Comply with regulations in this Circular by March 01, 2027.

Article 16. Implementation

Heads of units affiliated to the State Bank of Vietnam, commercial banks, cooperative banks, foreign bank branches shall implement this Circular./.

Bài viết liên quan