What is Information Security Level 4? Why is it mandatory for Vietnamese crypto exchanges?
nformation security level 4 is a mandatory requirement for crypto exchanges seeking licensing in Vietnam. Recently, CAEX announced that it has completed the level 4 assessment process from the Ministry of Public Security.
But what exactly does Level 4 verification check? How well are wallet systems, assets, and customer data protected?
1. What is Information Security Level 4?
According to Article 8 of the Cybersecurity Law No. 116/2025/QH15, information systems in Vietnam are classified into 5 levels , with level 5 being the highest. The higher the level, the stricter the protection requirements, due to the greater the potential consequences of system failures.
For Vietnamese crypto exchanges, Article 8 of Resolution 05 on crypto assets stipulates that information technology systems must meet information security standard level 4 before being put into operation.
Level 4 applies to systems where, if an incident or cybersecurity breach occurs, the consequences could cause exceptionally serious harm to the public interest, social order and safety, or seriously jeopardize national security.
To illustrate just how stringent this requirement is, Vietnamese stock exchanges currently apply level 3, while crypto exchanges must meet level 4. This is also the level applied to some critical systems in the banking industry, such as systems that process data for 10 million or more customers.
Five levels of cybersecurity for crypto
From 5PC’s perspective, this requirement is essential due to the unique nature of crypto exchanges. Besides processing buy and sell orders, exchanges can also directly store crypto assets and manage customers’ deposit and withdrawal wallets. A security incident could therefore affect assets, trading activity, and users’ personal data.
On October 22, 2026, Vietnam Prosperity Cryptocurrency Exchange Joint Stock Company ( CAEX ), part of the VPBank ecosystem, announced that it had received approval from the Cybersecurity Department (Ministry of Public Security) for its proposal to assess its information security system at level 4.
So, to meet this standard, what technological and security measures must a crypto exchange prepare? 5PC will delve into the most important requirements below.
2. Who assesses and approves Level 4 information systems?
According to Decree 331/2026/ND-CP, the Ministry of Public Security is the agency responsible for appraising level 4 system proposals, excluding systems within the military and cryptographic spheres.
Authorities will review whether the system’s security classification is appropriate and evaluate the cybersecurity plan proposed by the operating entity. After the assessment, the information system’s managing authority, i.e., the agency or organization responsible for managing that system, will approve the application according to regulations.
3. What does Level 4 verification check within a crypto exchange system?
To meet Level 4 requirements, a crypto exchange must satisfy a series of requirements regarding technological infrastructure, data security, and operational processes. According to Article 30 of Decree 331/2026/ND-CP , these requirements include both management and technical measures, with specific criteria depending on the system’s level.
CAEX completes Level 4 information system security assessment.
3.1 Preventing attacks and limiting incident spread
A crypto exchange has many systems operating simultaneously, from order matching and account management to deposit and withdrawal processing and customer asset custody. If hackers gain access to one system, the biggest risk is that they could continue attacking other systems, especially those where assets are stored.
To mitigate this risk, Level 4 requires systems to be isolated, access controlled, and measures in place to prevent the spread of incidents.
In practice, exchanges can separate the order matching system from the asset custody system, and limit which departments or personnel are allowed to access it. This makes it more difficult for hackers to access the remaining systems if one is compromised, reducing the risk of an incident affecting the entire exchange.
Level 4 also places demands on server and software protection. For crypto exchanges, this directly relates to order placement, account management, and transaction processing applications, as a vulnerability in the software could become a pathway for hackers to infiltrate the system.
3.2 Maintaining operations and protecting customer data
It’s not only when the exchange is hacked that customers suffer losses. Sometimes, simply a system outage that prevents users from logging in, placing orders, or withdrawing assets in a timely manner can also cause damage.
Therefore, Level 4 requires the system to be designed to maintain operation, minimize disruptions, and have backup and recovery plans in place in case of failure. Data backup is also crucial so that the exchange can recover necessary information if the main system encounters problems.
In addition, the platform must protect customer data, especially KYC information such as national ID cards, phone numbers, and other identity verification data. If leaked, this information could be exploited by malicious actors to impersonate individuals or carry out fraudulent activities.
3.3 Control of people and operational processes
Even with robust security technology, incidents can still occur if employees make mistakes, have their accounts stolen, or are granted excessive access privileges.
Therefore, level 4 also places demands on personnel management, access control, and operational procedures. Each department needs to be controlled in terms of authority and responsibility, especially for operations that may affect the system’s operation.
In addition, the platform must have a plan for monitoring, inspecting, and assessing security risks during operation. When vulnerabilities or signs of attacks are detected, the business needs to take timely corrective measures to limit damage and prevent recurrence.
4. What benefits does reaching level 4 bring to users?
CAEX’s completion of Level 4 due diligence is very positive news for users. When depositing assets on the exchange, customers are most concerned about how their money and personal information are protected. The stringent cybersecurity requirements of Level 4 will help the exchange reduce the risk of attacks, data leaks, and operational disruptions.
To sustain these benefits in the long term, exchanges need to continue investing in security throughout their operations. Especially as the number of users and assets deposited increases, regular system checks, updates, and security vulnerability remediation become even more essential.
Besides the protection measures provided by the platform, users should also proactively secure their accounts. Fraudulent schemes such as fake websites or password/authentication code theft can still result in users losing assets even if the platform’s system is not compromised.
Therefore, while using the exchange, users need to pay attention to personal security measures such as enabling two-factor authentication (2FA), carefully checking login links, etc. You can also refer to 4 crypto account security tools to enhance asset protection.
When exchanges invest seriously in security infrastructure and users are conscious of protecting their accounts, the Vietnamese cryptocurrency market will have a stronger foundation for safer and more sustainable development.