Information Security Level Certification of TCEX Exchange
Regarding the information security level certification and safety compliance system of TCEX Exchange (a crypto trading platform under Techcombank in Vietnam), below are its core standards and specifications during the pilot preparation and compliance review phase:
1. Regulatory Compliance & Information Security Leveling (Vietnamese Regulatory Framework) As a compliant project backed by Techcombank (a major private bank in Vietnam), TCEX’s system security is directly governed by the technical standards of the State Bank of Vietnam (SBV) and the Ministry of Information and Communications (MIC):
-
Financial-Grade Information System Leveling (Level 4 / Level 5): According to Vietnam’s Decree No. 85/2016/NĐ-CP on the classification of information system security levels, the core trading and clearing systems of financial and crypto asset trading platforms must meet the security protection requirements of Level 4 (Important Information Systems) or Level 5 (National Critical Infrastructure Level).
-
Compliance under Resolution 05/2025/NQ-CP Pilot Framework: Under Resolution 05/2025/NQ-CP issued in 2025, all pre-approved exchanges must establish a cybersecurity defense system audited by qualified third parties. This includes establishing a 24/7 Security Operations Center (SOC) linked with the National Cyber Security Centre (NCSC) for real-time data and security event reporting.
2. International Standards & Industry Security Certifications As a compliant bank-backed exchange, TCEX adheres to the following internationally accepted standards for system architecture and security certification:
-
ISO/IEC 27001 (Information Security Management System): Core databases, matching engines, and operational systems must fully obtain ISO 27001 certification to ensure data access control, risk assessment, and business continuity management comply with international standards.
-
ISO/IEC 27017 / 27018 (Cloud Security & Privacy Protection): Applies data protection standards for cloud services and Personally Identifiable Information (PII) to systems hosted in cloud or hybrid cloud environments.
-
PCI-DSS Level 1 (Payment Card Industry Data Security Standard): Strictly complies with the highest level of PCI-DSS certification when integrating with Techcombank’s fiat deposit/withdrawal channels and fiat/crypto gateways to secure user bank cards and transaction credentials during transmission.
-
SOC 2 Type II Audit: Conducts multi-year continuous compliance audits on platform security, availability, and data confidentiality according to the standards of the American Institute of CPAs (AICPA).
3. Asset Custody & Underlying Technical Protection Architecture To meet regulatory requirements for customer asset security, TCEX implements strict hardware and cryptographic protections:
-
Cold/Hot Wallet Isolation & HSM Protection:
-
95%+ Cold Storage: The vast majority of customer crypto assets are stored in offline cold wallets.
-
FIPS 140-2 Level 3 Hardware Security Modules (HSM): Private key generation, signing, and management are performed within HSMs or MPC (Multi-Party Computation) threshold signature systems that comply with top-tier security standards, eliminating single points of failure.
-
-
DDoS & Application Layer Defense (RASP/WAF): Deploys front-end anti-DDoS WAF (Web Application Firewall) and traffic scrubbing networks capable of mitigating Tbps-level DDoS attacks and OWASP Top 10 vulnerability exploits.
-
Penetration Testing & Bug Bounty: Must undergo penetration testing and smart contract/code audits by internationally renowned blockchain security firms (such as Hacken, CertiK, etc.) prior to launch.
Summary & Key Takeaways
Vietnam crypto exchange TCEX’s information security level is built upon a dual standard of “Traditional Bank Financial-Grade Security” + “Crypto Asset Multi-Sig Custody.” The platform is currently in the pre-pilot system testing and regulatory filing stage. The final list of officially approved security certifications will be announced publicly when registration opens to the public.