Decree 320/2026: VNeID account verification for platforms in Vietnam
What Decree 320/2026/ND-CP asks of social networks and e-commerce platforms in Vietnam: which accounts must link to an e-identification account, the deadline before 31 December 2026, data rules and a migration plan.
By Alberto RosasCo-founder & CEO, DiditUpdated 
In short
Decree 320/2026/ND-CP amends Vietnam's e-identification decree so that electronic transaction accounts on digital platforms in the fields it lists, social networks and e-commerce sellers among them, must be linked and authenticated with an e-identification account, the account people use in the VNeID app.[1][2] It took effect on 28 September 2026.[2]
- Accounts created before 28 September 2026 outside banking must be linked before 31 December 2026; banking accounts before 30 June 2027.[2]
- In e-commerce the decree names sellers, livestream sellers and affiliate marketers; it does not name buyers.[2]
- Private platforms reach the e-identification system through a licensed e-authentication service provider, under a plan the system operator approves.[2]
Decree 320/2026 turns VNeID, Vietnam's national identification app, from a convenience into a requirement for many online accounts, which makes VNeID account verification part of sign-up. It was signed on 13 August 2026 and applies from 28 September 2026.[1][2] If you run a social network, a marketplace, a livestream shopping service or an affiliate programme in Vietnam, every account in scope that existed before 28 September 2026 must be linked before 31 December 2026.[2]
This guide reads the Vietnamese text article by article. One naming note: Decree 320/2026/ND-CP is not Decree 320/2025/ND-CP, which according to EY Vietnam guides the Corporate Income Tax Law.[12]
Planning a Vietnam rollout
Didit verifies Vietnamese ID cards and passports with chip reading, liveness and face match today. Talk to us about your Vietnam rollout, or start free and test the document route in the console.
Decree 320/2026 at a glance
| Question | Answer from the text | Where |
|---|---|---|
| What is it | An amendment to Decree 69/2024/ND-CP on electronic identification and authentication[1][2] | Title, preamble |
| The platform rule | Electronic transaction accounts on platforms in the fields listed in Vietnam are linked and authenticated with an e-identification account[2] | New Art. 40(9) of Decree 69/2024 |
| E-commerce scope | Sellers, livestream sellers and affiliate marketers as defined by the E-commerce Law[2] | Art. 40(9) |
| Sanctions in the decree | None: the text sets no penalty and no rule on locking unlinked platform accounts[2] | Whole text |
What Decree 320/2026 changes for platforms
Its full title is "Decree No. 320/2026/ND-CP amending and supplementing a number of articles of the Government's Decree No. 69/2024/ND-CP of 25 June 2024 on electronic identification and authentication".[1][2] It rests on the Identity Law No. 26/2023/QH15, as amended by Law No. 118/2025/QH15, and the Data Law No. 60/2024/QH15, among others. It does not amend the internet services or e-commerce decrees.[2]
The platform rule sits in a new clause 9 added to Article 40 of Decree 69/2024, the article on entry into force, by Article 19 of Decree 320/2026.[2] In our translation from the Vietnamese:
Article 40(9)Decree 69/2024/ND-CP, added by Decree 320/2026/ND-CP
"Electronic transaction accounts under the Law on Electronic Transactions on digital platforms serving activities in the fields of education, digital literacy, securities, telecommunications, banking, e-commerce (sellers, livestream sellers and affiliate marketers as defined by the E-commerce Law), e-invoices, transport business, tourism business, pharmaceutical business, medical examination and treatment, and social networks in Vietnam must be linked and authenticated with an e-identification account."
Source: Decree 320/2026/ND-CP, Article 19 (Vietnamese text)[2]
Three things in that sentence matter. The duty attaches to "electronic transaction accounts" on the platform.[2] The decree says "e-identification account", the account issued by the Ministry of Public Security (MPS) system and used in the National Identification Application, known as VNeID.[2][3] And no account level is specified.[2]
Who is covered, field by field
Article 40(9) lists twelve fields; Vietnamese press counts them the same way, according to CafeF.[2][11]
| Field in Article 40(9) | Accounts named | Existing accounts linked |
|---|---|---|
| Social networks | Electronic transaction accounts on digital platforms serving social networks; no sub-category[2] | Before 31 December 2026[2] |
| E-commerce | Sellers, livestream sellers and affiliate marketers as defined by the E-commerce Law[2] | Before 31 December 2026[2] |
| The nine other fields: telecoms, securities, e-invoices, education, digital literacy, transport, tourism, pharmaceutical business, healthcare | Electronic transaction accounts on platforms in these fields[2] | Before 31 December 2026[2] |
| Banking | Electronic transaction accounts on banking platforms[2] | Before 30 June 2027[2] |
| Defence, security, cross-border services | Linked before use only when the platform meets the conditions and is connected to the e-identification platform[2] | No date in the decree[2] |
Two readings are still open. First, "electronic transaction account" is a defined term: according to Thư viện Pháp luật, a Vietnamese legal database, the social-network rule covers accounts that are electronic transaction accounts under the Law on Electronic Transactions, not every social media account automatically.[9] Second, the clause says "in Vietnam" and makes linking conditional for "cross-border services" without defining either phrase.[2] A foreign platform should not assume the conditional bucket.
Deadlines: the regulatory clock
- 1 July 2024Base rulesThe Identity Law and Decree 69/2024 take effect.[3][4]
- 25 December 2024Decree 147Social networks authenticate accounts by phone number.[5]
- 1 January 2026PDP LawThe data protection law and Decree 356/2025 apply.[6][7]
- 1 July 2026E-commerce LawLaw No. 122/2025/QH15 takes effect.[13]
- 13 August 2026SignedDecree 320/2026/ND-CP is signed for the Government.[1]
- 28 September 2026In forceNew accounts in the listed fields link from creation.[2]
- 31 December 2026Existing accountsLinked before this date, outside banking.[2]
- 1 January 2027Seller checksE-commerce seller identity checks start.[14]
- 30 June 2027BankingExisting banking accounts linked before this date.[2]
Dates as written in the decrees and laws.
The decree says "chậm nhất trước ngày 31 tháng 12 năm 2026", literally "at the latest before 31 December 2026", so on a literal reading the last day is 30 December; banking uses the same wording, "chậm nhất trước ngày 30 tháng 6 năm 2027", before 30 June 2027.[2] A separate deadline, also before 31 December 2026, applies to national digital platforms on the list the Ministry of Science and Technology publishes.[2] New accounts get no grace period: an account in scope created on or after 28 September 2026 falls under Article 40(9) from creation.[2]
What linking and authenticating means
The MPS builds and operates the e-identification and authentication system; its management agency is the Department of Administrative Police for Social Order (C06).[3] People use their account in the National Identification Application, on the sites dinhdanhdientu.gov.vn and vneid.gov.vn, and in the apps of organisations connected to the system.[3]
| Account | Who can get it | How it is issued |
|---|---|---|
| Level 1 | Vietnamese citizens with a valid card (under 6: level 1 only)[2] | Self-enrolment in the app: personal ID number, own phone number, face capture[3] |
| Level 2 | Vietnamese citizens aged 6 or older with a valid card[2] | In person at the police with the card; face and fingerprints checked against the Identity Database[3] |
| Foreigner account | Foreigners who lawfully enter or reside in Vietnam, without distinction of level[2] | In person at a provincial immigration office with a passport, face and fingerprints[2] |
Article 40(9) does not say which level a platform account must be linked to.[2] Record whatever assurance information the link returns, and confirm with your provider what a stricter rule would require.
How a private platform connects
State bodies and organisations that provide public services may connect their own systems directly if they meet at least cybersecurity level 3.[2] Every other organisation, private social networks and marketplaces included, connects through an e-authentication service provider, under a plan and process approved by the authority that operates the system.[2] E-authentication is a conditional business line; providers need an MPS certificate of eligibility.[3]
Consents in VNeID or by SMS
Simplified from Articles 18 and 19 of Decree 69/2024 as amended. The technical flow is set by the plan the system operator approves.
Three rules travel with that connection. Each request from a private party needs the person's consent, in the app, by text message (SMS) or another prescribed form.[3] A connected organisation stores the history of what it accessed (documents, purpose, number of times, time, who) and provides it to the operator, which shows it to the person.[2] And results and documents from the system may not be passed to others unless the person asks or a law provides otherwise.[2] Decree 320/2026 also bars anyone using documents integrated in the app from asking for originals or copies of the same documents, a general rule rather than a platform-specific one.[2]
Foreign users and Decree 320/2026
Under the amended Article 7, foreigners who lawfully enter or reside in Vietnam may get an e-identification account, without distinction of level.[2] They apply in person at a provincial police immigration office with a passport, fill in form TK01 with a phone number in their own name, and have face and fingerprints checked against the National Database on Immigration; processing takes up to 2 working days, or 5 if their biometrics are not on file.[2]
What changed for foreigners
According to KPMG Vietnam, Decree 69/2024 had tied foreigners' accounts mainly to residence card holders; the amendment extends eligibility to business travellers, secondees and short-term visitors.[10]
The decree does not say how a platform should treat a foreign user without an account: Article 40(9) speaks of accounts "in Vietnam" with no carve-out.[2] That is a question for your counsel. For sellers the E-commerce Law is explicit: foreign sellers, livestream sellers and affiliates are authenticated through lawful documents.[13] Either way, plan a lawful document route for sellers and other cases where a law allows one; being unable to link is not an exemption from linking.
Identity data rules that apply at the same time
Linking accounts means handling identity data, and Vietnam rebuilt its data protection rules in 2026. The Personal Data Protection Law (PDP Law, Law No. 91/2025/QH15) and its implementing Decree 356/2025/ND-CP both took effect on 1 January 2026.[6][7] The PDP Law sets the maximum fines; Decree 330/2026/ND-CP, in force since 19 August 2026, sets the bands.[8]
| Rule | What it asks of a platform | Where |
|---|---|---|
| Sensitive data | Biometric data and images of the identity card or citizen identity card are sensitive personal data, with access limits and security measures[7] | Decree 356/2025/ND-CP Art. 4(1) |
| Data leaving Vietnam | Storing data on servers abroad or a foreign cloud, or processing it on a foreign platform, is a cross-border transfer; file an impact assessment within 60 days of the first transfer, unless an exemption applies[6][7] | PDP Law Art. 20; Decree 356/2025/ND-CP Art. 17 |
| Social networks | Do not require images or videos of an identity document as an account authentication factor[6] | PDP Law Art. 29(2) |
| Fines | Up to 5% of prior-year revenue for cross-border transfer breaches; up to VND 3 billion for other breaches[6] | PDP Law Art. 8; Decree 330/2026/ND-CP Art. 56 |
Decree 330/2026 sets the bands. Where transfers abroad without an impact assessment lead to a leak affecting 10,000 or more Vietnamese citizens, fines run from 1% to 5% of the prior fiscal year's revenue in the Vietnamese market, rising with the number affected; fixed bands up to VND 3 billion apply where that revenue is absent or the result is lower.[8] Forcing users to provide ID document images or videos to authenticate an ordinary account, where no specialised law requires identification, costs VND 70 to 150 million.[8] Using another person's ID, edited ID images or deepfakes to authenticate an account is fined too.[8]
Watch out
On a social network, an ID document photo is not a free choice of login factor, and it is not a way to satisfy Decree 320/2026 linking. Use a document check only where a specific law asks for identification, such as commercial livestreaming under Decree 147/2024/ND-CP, or sellers under the E-commerce Law, and get advice on the form.[5][6][8][13]
Two sector rules sit next to Decree 320/2026. Decree 147/2024/ND-CP, in force since 25 December 2024, makes social networks authenticate accounts by Vietnamese mobile number, by personal identification number when the user has no Vietnamese number, and by personal identification number for commercial livestreaming, including foreign providers that rent data storage in Vietnam or average 100,000 or more monthly visits from Vietnam over six consecutive months.[5] The E-commerce Law (Law No. 122/2025/QH15), in force since 1 July 2026, requires platforms to authenticate sellers, livestream sellers and affiliates electronically before they start, and foreign ones through lawful documents.[13] Decree 248/2026/ND-CP starts the seller check on 1 January 2027 and, in summary, uses full name, date of birth and personal identification number for a Vietnamese individual, a passport valid for at least 6 months for a foreign one.[14]
A migration plan for existing accounts
The deadline is less than twelve weeks away.
1Map accounts to the listed fields
Tag sellers, livestream sellers, affiliates and social accounts in scope; leave buyers out.[2]
2Secure the connection route
Choose an e-authentication service provider and get your connection plan approved by the system operator.[2]
The account holder can link an e-identification account
Link and record
Store the link, the level returned, the consent and the access log.[2][3]
Follow your written policy
Restrict features, verify by document where lawful, log the reason.
3Prompt, remind, then gate
Ask at sign-in, remind in waves, gate selling features before 31 December 2026.[2]
4Report and keep evidence
Track linked rates per field and keep evidence for an MPS inspection.[2]
The decree sets scope and deadline; prompts and gating are your choices.
The hardest decision is what happens to an account still unlinked at the deadline. The decree sets no rule on locking, suspending or deleting platform accounts and has no penalty article.[2] Its only locking rules concern the e-identification account itself, which the system locks when, for example, the registered phone number is no longer in the holder's name.[2] So write your own policy now and be ready to change it when the MPS issues guidance. Link and gate sellers and livestream sellers first.
Architecture: VNeID first, chip-checked document as the fallback
A document check does not by itself satisfy a VNeID-linking obligation where Article 40(9) applies: the decree asks for linking and authentication with an e-identification account and lists no alternative method.[2] The document route still belongs in the same flow, where a law allows it.
Default route for accounts in scope
E-identification account (VNeID)
- The method Article 40(9) names
- Through an MPS-licensed provider under an approved plan
- Consent in the app or by SMS; access logged
- Results may not be shared onward
Decree 69/2024 Art. 18, 19, 40(9)
Fallback and step-up route
Chip-checked ID card or passport
- Foreign sellers and other cases where a law allows it
- Chip signature checked, then liveness and face match
- Step-up for sellers and high-risk actions
- Does not replace linking where the decree requires it
Your risk policy
Vietnam's identity card has a chip. Under the Identity Law, the card carries printed information and "an encrypted information storage component" holding the face image, fingerprints, iris and identity data.[4] The law renamed the citizen identity card (CCCD) as the identity card (thẻ căn cước); CCCD cards issued before 1 July 2024 stay valid until their printed expiry, so expect both.[4] See our guide on verifying the CCCD chip by near-field communication (NFC).
1Classify the account
Field, role and country.
Article 40(9) applies to this account
Link the e-identification account
Through your approved provider.[2]
Step up where lawful
Liveness where lawful; no originals or copies of documents already integrated in VNeID.[2]
Verify by document if needed
Where a specific law asks for it, or your policy outside social networks: chip read, liveness, face match.
One workflow, two routes. Which account takes which route is a legal decision.
For the business check on sellers, see our guide to verifying sellers, livestream sellers and affiliates in Vietnam.
Talk to us about Vietnam
Talk to us about the document route and seller checks next to your e-identification connection.
Checklist for product and compliance teams
- Confirm which of your account types fall into the fields of Article 40(9).[2]
- Get a local legal opinion on "electronic transaction account", "in Vietnam" and "cross-border services" for your service.[2][9]
- Choose an MPS-licensed e-authentication service provider.[2][3]
- Submit your connection plan for the operator's approval.[2]
- Capture consent, store the access history and block onward sharing.[2][3]
- Stop asking linked users for copies of documents already in the app.[2]
- Link accounts in scope at creation, and those created before 28 September 2026 before 31 December 2026 (banking: 30 June 2027).[2]
- Write the policy for unlinked accounts and the document route for foreigners.
- File a cross-border transfer impact assessment within 60 days of the first transfer abroad, unless a Decree 356/2025/ND-CP Art. 17(3) exemption applies.[6][7]
- Keep ID document images out of social-network account authentication unless a specific law requires identification.[6][8]
- Prepare an evidence pack for an MPS inspection.[2]
How Didit helps with Decree 320/2026 programmes
Didit runs the identity checks around the e-identification link, in one no-code workflow: see eID verification.
Didit's national eID framework runs MitID, BankID Sweden, Finnish Trust Network, Smart-ID and Mobile-ID today. VNeID is not one of them. Access to VNeID authentication goes through the MPS system, a licensed e-authentication service provider and an approved connection plan.[2][3] Platforms that need VNeID can talk to Didit about connecting it through the same workflow. Meanwhile the chip-checked document route is available today, for foreign sellers and other cases where a law allows a document check. Didit verification does not discharge your Decree 320/2026 obligations: account linking, the connection plan and the decisions stay with you.
Didit provides
- Vietnamese ID card, passport and driver's license capture
- NFC chip reading for e-passports and e-IDs in the mobile SDKs, at $0.15; Vietnamese ID cards and passports are on the NFC list
- Passive and active liveness, face match and video injection detection; full know your customer (KYC) check from $0.33 (pricing)
- Face search for duplicate accounts; device and internet protocol (IP) address analysis
- Phone codes by SMS, WhatsApp and, in Vietnam, Zalo (availability varies by country)
- Anti-money laundering (AML) screening against 1,300+ sanctions, politically exposed person (PEP) and watchlists at $0.20, ongoing monitoring at $0.07 per person per year
- Business verification with Vietnam registry data, and linked checks for each legal representative and owner
- The flow in Vietnamese, by application programming interface (API), software development kits (SDKs) or hosted link; data stored in the European Union (EU) by default
Stays with you
- Linking accounts in scope to e-identification accounts
- The e-authentication provider and the approved connection plan
- Deciding which accounts are in scope
- The policy for unlinked accounts and foreign users
- Consent, access logs and data protection duties
- The answer to an MPS inspection
Talk to us about your Vietnam rollout
Tell us how your accounts split, and test the document route today.
Key takeaways
- Decree 320/2026/ND-CP amends Decree 69/2024 and took effect on 28 September 2026.
- Covered electronic transaction accounts, on social networks and of e-commerce sellers, livestream sellers and affiliates in Vietnam, must link to an e-identification account.
- Existing accounts outside banking must be linked before 31 December 2026; banking accounts before 30 June 2027.
- A document check does not replace the link where the decree requires it; it serves foreign sellers and other cases where a law allows it.
Frequently asked questions
What is Decree 320/2026 in Vietnam?
Decree 320/2026/ND-CP is a Government decree, signed on 13 August 2026 and in force since 28 September 2026, that amends Decree 69/2024/ND-CP on electronic identification and authentication. It requires electronic transaction accounts on platforms in the fields it lists, including social networks and e-commerce sellers, to be linked and authenticated with an e-identification account, the account used in the VNeID app.[1][2]
What is the deadline for existing accounts under Decree 320?
Accounts in the listed fields created before 28 September 2026 must be linked before 31 December 2026; banking accounts before 30 June 2027. The decree says at the latest before those dates, so the last days are 30 December 2026 and 29 June 2027.[2]
Which platforms does Decree 320/2026 cover?
Article 40(9) covers platforms in the listed fields, from education, telecoms, securities and banking to e-commerce, healthcare and social networks in Vietnam. Defence, security and cross-border services link before use only once the platform meets the conditions and is connected.[2]
Do e-commerce buyers have to link their accounts to VNeID?
Decree 320/2026 does not name them. In e-commerce it names sellers, livestream sellers and affiliate marketers as defined by the E-commerce Law.[2]
Do foreign users need VNeID?
Foreigners who lawfully enter or reside in Vietnam can get an e-identification account in person at a provincial immigration office.[2] The decree sets no separate rule for foreign users without one, so get legal advice; being unable to link is not an exemption.[2]
Does Decree 320 require a level 2 VNeID account?
No level is specified. Article 40(9) asks for linking with an e-identification account without saying level 1 or level 2. Record whatever assurance information the link returns.[2]
What happens to accounts that are not linked before 31 December 2026?
Decree 320/2026 does not say: it has no rule on locking or suspending unlinked platform accounts and no penalty article. Its locking rules concern the e-identification account itself. Write your own policy and watch for MPS guidance.[2]
Can a private platform connect to VNeID directly?
No. State bodies and public-service providers may connect directly; other organisations connect through an e-authentication service provider, under a plan approved by the system operator, with the person's consent for each request.[2][3]
Does an ID document or NFC chip check satisfy Decree 320/2026?
Not by itself where Article 40(9) applies: the decree asks for linking with an e-identification account and lists no alternative, and being unable to link is not an exemption.[2] Foreign sellers may be authenticated through lawful documents under the E-commerce Law; other document checks need a lawful basis, and on social networks ID document images may not be required as an authentication factor where no law requires identification.[13][6][8]
Can Didit connect a platform to VNeID?
Not today. Didit's national eID framework runs MitID, BankID Sweden, Finnish Trust Network, Smart-ID and Mobile-ID; VNeID access goes through the MPS system and a licensed e-authentication service provider. Platforms that need VNeID can talk to Didit about connecting it through the same workflow; the chip-checked document route is available now.[2]
Sources
- Decree No. 320/2026/ND-CP amending Decree No. 69/2024/ND-CP on electronic identification and authentication, Government of Vietnam legal documents portal, 13 August 2026.
- Decree No. 320/2026/ND-CP, full Vietnamese text, Thư viện Pháp luật, opened 10 October 2026.
- Decree No. 69/2024/ND-CP on electronic identification and authentication, National Legal Database (vbpl.vn), 25 June 2024.
- Identity Law No. 26/2023/QH15, National Legal Database (vbpl.vn), 27 November 2023.
- Decree No. 147/2024/ND-CP on internet services and online information, National Legal Database (vbpl.vn), 9 November 2024.
- Personal Data Protection Law No. 91/2025/QH15, National Legal Database (vbpl.vn), 26 June 2025.
- Decree No. 356/2025/ND-CP detailing the Personal Data Protection Law, Thư viện Pháp luật, 31 December 2025.
- Decree No. 330/2026/ND-CP on administrative sanctions in cybersecurity and personal data protection, Thư viện Pháp luật, 19 August 2026.
- Legal Q&A on linking social network accounts with VNeID under Decree 320, Thư viện Pháp luật, opened 10 October 2026.
- Decree 320 on electronic identification and authentication, KPMG Vietnam, September 2026.
- Accounts in twelve fields must link to VNeID by the end of 2026, CafeF, 10 October 2026.
- Decree providing guidance for the Law on Corporate Income Tax 2025, EY Vietnam, December 2025.
- E-commerce Law No. 122/2025/QH15, Thư viện Pháp luật, 10 December 2025.
- Decree No. 248/2026/ND-CP guiding the E-commerce Law, Thư viện Pháp luật, 30 June 2026.
Read how Didit combines national eIDs and chip-checked documents on the eID verification page, or see our country page for identity verification in Vietnam.
Get your Vietnam identity flow ready
Start with the chip-checked document route and add the checks your sellers need, in one workflow.
Related articles
- Vietnam e-commerce law: KYB for sellers, livestreamers and affiliates
- Vietnam ID card verification: reading the CCCD chip with NFC
- MiCA regulation in 2026: the EU crypto compliance guide to 2028
- Companies House identity verification: Insolvency Service convictions
- Privacy coin regulation after FinCEN drops its mixing rule
- OSC Argosy decisions: KYC risk tolerance and a suspended UDP