Vietnam's amended Anti-Money Laundering Law brings virtual asset service providers into the reporting regime from 1 December 2026. Enacted as Law 23/2026/QH16, it makes crypto-asset services reporting entities under the State Bank of Vietnam, with customer due diligence, transaction monitoring and suspicious transaction reporting obligations, and adds suspicious-transaction indicators written for virtual-asset activity.
The amendment also touches the State Bank and Credit Institutions laws, and the detailed implementing rules follow the statute. The specifics below are drawn from the law as reported; confirm the article-level requirements and the covered-activity definitions against the primary text and the implementing decrees before relying on them.
This guide is written for compliance leads at SBV-regulated institutions and crypto-asset businesses, and for regional teams with Vietnam exposure who need to know what changes on 1 December 2026.
What does Vietnam's amended AML law change?
It extends the AML regime to virtual asset service providers and strengthens beneficial ownership and due diligence requirements across reporting entities.
As KPMG's legal alert summarises, Law 23/2026/QH16 takes effect on 1 December 2026. It amends the laws on the State Bank of Vietnam, anti-money laundering and credit institutions. Its headline AML change is to subject virtual asset service providers to AML obligations and to introduce dedicated suspicious-transaction indicators for virtual-asset activity, as Vietnamese press coverage also reports. Beyond crypto, the revised framework is reported to strengthen beneficial ownership checks and enhance customer due diligence. It also requires pre-launch AML risk assessments for new products and technologies, applied to reporting entities more broadly.
What must a virtual asset service provider now do?
Apply customer due diligence, monitor transactions, and report suspicious transactions to the State Bank, as any other reporting entity does.
For a crypto-asset business that previously sat outside the formal AML perimeter, the change is a step up in obligation. It has to identify and verify customers, monitor activity against expected behaviour, and file suspicious transaction reports with the authorities. Coverage of the law notes that crypto services must report suspicious cases to the central bank. The dedicated virtual-asset indicators give these businesses a starting point for what to watch, but the thresholds and the detection logic have to be built for crypto flows, which behave differently from fiat. Our transaction monitoring guide covers the aggregation and calibration that any monitoring programme needs.
How does this compare with the rest of Southeast Asia?
It moves Vietnam toward the regional direction, where regulators are extending AML rules to crypto and tightening beneficial ownership, though each does so on its own instrument and timeline.
Vietnam is not acting in isolation. Across the region, regulators are bringing virtual assets into scope and sharpening ownership transparency, each under its own framework, a landscape our Southeast Asia due diligence benchmark compares. The reporting mechanics differ by jurisdiction, so an institution operating across markets runs one operating model with local reporting adapters, not one rulebook. The Philippine clocks are a useful contrast: a suspicious transaction report is due the next working day from the determination of suspicion, as our STR versus CTR guide sets out. Vietnam's reporting timelines should be read from its own text.
Why does Vietnam's FATF status raise the stakes?
Because Vietnam remains under FATF increased monitoring, so supervisory expectations and the cost of weak controls are higher than in a jurisdiction off the list.
Vietnam is on the FATF list of jurisdictions under increased monitoring, which raises the pressure on reporting institutions to show their controls work. Extending the regime to virtual assets is part of the direction FATF expects, and institutions that implement it well contribute to the country's standing, while gaps draw scrutiny. For the contrast, the Philippines left the grey list on 21 February 2025 and is preparing for its 2027 evaluation, a trajectory our grey-list exit explainer and 2027 evaluation guide cover. The lesson across both is that effectiveness, not paperwork, is what an assessor measures.
What should an affected institution do before 1 December 2026?
Confirm whether it is in scope, map the new obligations to its current controls, and build the virtual-asset monitoring and reporting it now owes.
The runway is short, so the work is practical. First, confirm scope against the primary text, because the definition of a covered virtual asset service decides whether the law applies. Second, map each obligation, customer due diligence, monitoring, suspicious transaction reporting and the beneficial ownership checks, to what the institution already does, and find the gaps. Third, build the virtual-asset monitoring scenarios and the reporting path to the State Bank, and run a pre-launch risk assessment where the law requires one. Confirm every requirement with Vietnamese counsel, because this guide works from reported summaries, not the enacted articles.
How does Fyscal ARCX support compliance with the new regime?
Fyscal ARCX gives a reporting entity the monitoring, case and reporting controls the amended law requires, configured to its own rules. A compliance team defines its own variables and scenarios, including ones built for virtual-asset behaviour, tests them against historical data before activation, and holds one case per customer with a timestamped trail. Named parties are screened against sanctions and watchlists, and Regulatory Reporting prepares and tracks the filings the regime requires. The reporting format is configured to the jurisdiction, so a Vietnam obligation and a Philippine one run from one operating model.