Proposal for cryptocurrency exchanges to report incidents within 24 hours.
Vietnam’s cryptocurrency asset exchanges may be required to report to the State Securities Commission (SSC) within 24 hours from the time they detect an information technology incident affecting customer transactions.
This is one of the provisions adjusted following the consultation process on the draft Circular guiding the reporting and information disclosure regime on the cryptocurrency asset market. The summary document incorporating and explaining feedback was released by the SSC on October 15, 2026, with input from Techcombank, CAEX, SCEX, and TCEX.
We propose reporting technology incidents within 24 hours.
On October 15, 2026, the Ministry of Finance and the State Securities Commission of Vietnam (SSC) published a summary of comments, feedback, and explanations regarding the draft Circular guiding certain aspects of reporting and information disclosure in the cryptocurrency market.
The document compiles 43 groups of comments, focusing on issues related to the operation of the trading system, asset custody, periodic reporting, market data disclosure, and the responsibilities of participating organizations.
One of the notable changes relates to how IT incidents are handled.
According to the revised draft, when a crypto asset service provider detects an IT incident affecting the execution of transactions for customers, they must submit a report to the State Securities Commission within 24 hours.
The report should clearly state the nature of the incident and the company’s proposed solutions.
This timeframe is calculated from the moment the problem is detected, rather than waiting until the system is fully restored.
For a continuously operating trading platform, incidents can prevent clients from placing orders, accessing accounts, or performing asset-related operations. Therefore, requiring early reporting helps regulators understand the situation and monitor the operator’s response.
During the explanation process, the drafting agency did not add a separate definition for the term “system incident” as proposed by the businesses, but continued to use the concept of “information technology incident” according to Resolution 05/2025/NQ-CP.
Note: This is the content of a draft that is still being finalized and does not constitute a basis for confirming that the official Circular has come into effect or that all current exchanges are subject to the 24-hour reporting obligation as stipulated in this document.
What content did CAEX, SCEX, and TCEX provide feedback on?
A notable aspect of this announcement is the participation of businesses that are preparing to offer cryptocurrency services in Vietnam.
According to information compiled from the consultation process, the participating entities include Vietnam Technological and Commercial Bank (Techcombank), Vietnam Prosperity Cryptocurrency Exchange Joint Stock Company (CAEX), Sacom Cryptocurrency Exchange Joint Stock Company (SCEX), and TCEX.
Proposals for data standardization and automated report integration.
A joint feedback group from various units focused on the methods for sending and receiving reports.
Instead of maintaining numerous manual operations, the parties proposed standardizing data structures, using digital signatures, and gradually implementing automated connections through application programming interfaces (APIs).
This approach aims to reduce processing time, minimize data entry errors, and facilitate the government’s access to data from multiple organizations according to a unified standard.
The State Securities Commission of Vietnam (UBCKNN) announced that it is developing a dedicated information disclosure system for the cryptocurrency market, which will be able to receive data online.
During the system’s development phase, reports can still be submitted either in person or electronically, subject to the authority’s approval.
The API proposals demonstrate the need to build a reporting infrastructure suited to the continuous trading nature of the cryptocurrency market. However, participation in providing feedback does not automatically mean that businesses have been granted operating licenses.
Techcombank and TCEX provide feedback on the disclosure of transaction data.
Another aspect that was incorporated relates to displaying market data on the website or trading application.
According to the proposed regulations, service providers need to ensure customers have access to basic information such as the most recent price and trading volume, the highest and lowest prices of the day, and the price volatility of each type of cryptocurrency.
The draft also includes aggregated data from the previous day and the total transaction value of foreign investors.
This is intended to help market participants track the trading activity rather than just seeing the final price on the screen.
It is necessary to distinguish between the continuous disclosure of data on the trading platform and the obligation to submit reports to the State Securities Commission. The two activities have different purposes and deadlines.
Several other reporting deadlines have also been adjusted.
In addition to technological issues, the summary of feedback also addresses reporting obligations related to client assets, personnel, and custody operations.
For separate reports on client assets on a six-monthly basis, the submission deadline has been adjusted to 60 days from the end of the reporting period.
The drafting agency did not add a mandatory requirement for a separate audit of this report. Businesses can choose to conduct the audit themselves, while the obligations for auditing and reviewing financial statements as stipulated in the relevant regulations still apply.
In cases where a service provider uses the crypto asset custody service of another organization, the draft requires reporting to the State Securities Commission at least 7 days before accepting the service.
For operational changes affecting the segregation of customer assets or the mechanism for allocating assets between hot and cold wallets, businesses must also fulfill their reporting obligations in advance according to the draft, except in cases of incident handling according to published procedures.
When there are key personnel changes within the scope of regulations, such as the CEO, CTO, or personnel in the technology department, the reporting deadline is 5 days.
These requirements demonstrate that the drafting body is not only interested in transaction data but also in how businesses manage assets and maintain operational conditions.
The proposal requiring shareholders owning 1% or more of the capital to report transactions has been dropped.
Another adjustment concerns the reporting obligations of shareholders in cryptocurrency service providers.
In the previous draft, organizations or individuals owning 1% or more of the charter capital may have to report before carrying out transactions that change their ownership ratio.
During the consultation process, a proposal emerged to raise this threshold to 5% to better align with securities law regulations.
After reviewing the Enterprise Law and the Securities Law, the drafting agency stated that it had removed the corresponding provision from the draft.
Removing this content does not mean that shareholders of a cryptocurrency service provider are exempt from all disclosure obligations.
When a business is subject to regulations concerning public companies or related legal provisions, the reporting and disclosure obligations must still be fulfilled within the scope of their respective application.
Providing information 24/7 does not mean having to report daily.
The cryptocurrency market is characterized by continuous trading, not limited to business hours or trading sessions like the traditional stock market.
Therefore, the draft was adjusted to be more in line with the publication of market data on a 24/7 operating platform.
However, the obligation to disclose information to customers and the obligation to report to regulatory authorities are two different mechanisms.
Price and transaction data can be continuously updated on the system, while management reports are sent periodically or when specific events occur.
For example, the previous month’s proprietary trading activity report is required by the 10th of each month; client asset reports are required every six months; and technological incidents affecting transactions must be reported within 24 hours of detection, according to the new draft regulations.
This division helps avoid the misunderstanding that all of the exchange’s operational data must be manually submitted to the State Securities Commission every day.
What aspects have yet to be understood?
Besides the adjustments, the drafting agency also retained some requirements after the consultation process.
Notably, the regulation requires simultaneous publication of information in both Vietnamese and English. The proposal to prioritize the Vietnamese version when discrepancies arise between the two languages was not accepted.
The requirement to disclose transaction data of foreign investors also remains in place.
For insiders of the service provider organization, the draft maintains reporting requirements related to cryptocurrency transactions within the scope of the regulations.
Wallet address information is stored in forms for monitoring purposes. According to the explanation, this data is submitted to the regulatory authority and is not publicly available to all users.
These provisions reflect a focus on enhancing the ability to verify and cross-check transaction data and deposited assets, while also setting security requirements for the information collected.
What preparations do businesses need to make before the market becomes operational?
For businesses preparing to enter the Vietnamese cryptocurrency market, perfecting their trading systems is only part of the job.
Organizations also need to establish procedures for recording incidents, classifying impact levels, maintaining system logs, and preparing data for reporting.
The client asset management system must also support reconciliation of balances, wallet addresses, and changes related to custody operations.
If electronic reporting mechanisms and API connectivity are implemented, the ability to standardize data right from the platform development stage can help businesses reduce the amount of adjustments needed later on.
For customers, incident reporting and disclosure requirements can provide a stronger basis for tracking the operational accountability of the service provider.
However, the actual effectiveness depends on the content of the official Circular, the implementation process, and the monitoring mechanism after the business is licensed.
The draft is still being finalized.
The announcement by the State Securities Commission of Vietnam (UBCKNN) of the summary, feedback, and explanations on October 15, 2026, marks a new step in the process of perfecting regulations on reporting and information disclosure in the cryptocurrency market.
Notably, the feedback came not only from regulatory bodies but also from businesses that are preparing to deploy trading infrastructure.
Proposals for reporting technology incidents within 24 hours, adjustments to customer asset reporting deadlines, and research into automated data connectivity are changes worth watching.
However, the content incorporated during the drafting process still needs to be compared with the official Circular upon issuance.
This is also not an announcement confirming that CAEX, SCEX, TCEX, or any other organization has been granted a license to operate a cryptocurrency exchange.
In the coming period, the officially issued document and implementation guidelines from the Ministry of Finance and the State Securities Commission will serve as the basis for determining the specific scope, deadlines, and reporting responsibilities of each organization.
Readers can find more information about companies preparing to enter the CAEX , SCEX , and TCEX markets on Sancoin.com.（Vietnam Crypto Exchange）