VILAF Legal Bulletin: September 2026

1. Classification of State owned enterprises

On 5 August 2026, the Prime Minister issued Decision No. 40/2026/QD-TTg (“Decision 40”) stipulating criteria for classification of enterprises to restructure State capital in State-owned enterprises and enterprises with State capital. Decision 40 became effective on 5 August 2026.

Decision 40 sets out classification criteria that form the basis for developing State capital arrangement and restructuring plans in enterprises, including whether to maintain the existing State ownership ratio or restructure State capital. Based on these industry- and sector-specific criteria, Decision 40 groups covered enterprises into three broad categories according to the level of State ownership to be retained post-restructuring, as follows:

• Enterprises with 100% state capital include: enterprises supplying essential public utility products and services (i.e. railway infrastructure and traffic management, public postal services, air navigation and related aviation services, maritime safety, publishing, agricultural and forestry activities, environmental protection, and irrigation); enterprises operating in natural monopoly sectors (i.e. national electricity transmission and system dispatch, production and trading of industrial explosives, currency printing and minting, lottery business, securities market operation and central securities registration, custody, clearing and settlement, and State capital investment and debt restructuring); science and technology enterprises; enterprises constructing nationally significant infrastructure works in transport, irrigation, energy, and digital infrastructure; enterprises applying high technologies or enterprises with investment capital of at least VND12,000 billion; cigarette production enterprises; Agribank; enterprises operating in key or essential fields of the economy (consisting of energy, food, strategic mineral mining and processing, basic chemicals, formulation and operation of national, specialised database facilities and other fields as decided by the Prime Minister from time to time); and certain enterprises operating in areas critical for security and national defence.
• The State will hold 65% or more of the charter capital of enterprises involved in: management and operation of air terminals and airports, flight zone operation services, air information, surveillance, aeronautical meteorological services, air transport; management and operation of harbors in special seaports; large-scale mineral mining; production of children’s cartoon films sponsored by the State; finance and banking (excluding insurance, securities, fund management companies, finance companies, financial leasing companies, and Agribank); mechanical engineering; fertiliser production and trading; water supply and drainage; and enterprises assuring essential requirements for development of production and raising living conditions of ethnic minorities in mountainous, remote and isolated areas.
• The State will hold above 50% to below 65% of the charter capital of enterprises operating in the following sectors: primary petroleum import enterprises which have a market share of 30% or more; telecom services with network infrastructure with special important for the national telecom network pursuant to the Prime Minister’s decision; mineral exploration and assessment of mineral reserves (excluding oil and gas).

Decision 40 also specifies criteria for re-structure of State capital in certain enterprises operating outside the sectors classified above. These criteria cover: (a) cement production enterprises which have a market share of 30% or more including raw material mining in geographical areas critical for security and national defence; (b) public-utility enterprises with the ratio of turnover from public utility activities accounting for at least 50% of the total turnover of the enterprise for 3 consecutive years preceding the date of re-structure; (c) enterprises having cultural value, historical value, architectural value or value of national brands; having an important role in national defense and security or performing political tasks or duties of socio-economic development; and (d) enterprises engaged in collection, transportation and treatment of wastes, operation of public lighting systems, planting and nursing trees. For those enterprises, the State will continue to hold more than 50% of the charter capital where it currently holds more than 50%; otherwise, where State ownership is 50% or less, the State will transfer the right to represent the owner of State capital in the enterprises to other SOEs.

For enterprises that conduct a business not involved in the sectors mentioned in the said criteria, the State will generally not continue to hold capital in such enterprises, unless otherwise stated in specialised laws.

Certain exceptions to these rules require the Prime Minister’s consideration and approval, including proposals to (i) adopt a State capital ownership ratio different from that prescribed under the classification criteria; (ii) reduce the State’s ownership to 50% or less in an enterprise that would otherwise be subject to a higher ownership threshold; or (iii) maintain State capital in an enterprise that falls outside the classification criteria.

2. Implementing the Apostille Convention

Vietnam acceded to the Hague Apostille Convention Abolishing the Requirement of Legalisation for Foreign Public Documents (the “Apostille Convention”) on 31 December 2025, and the Convention will enter into force in Vietnam on 11 September 2026.

In order for implementation of the Apostille Convention, on 23 July 2026, the Government issued Decree No. 293/2026/ND-CP (“Decree 293”) which will be effective on 11 September 2026. Below are some highlighted provisions of Decree 293.

Before the reform, foreign public documents generally required consular legalisation before being accepted for use in Vietnam, subject to limited exemptions. Likewise, Vietnamese public documents for use overseas could be subject to similar consular certification requirements in the destination country. The Apostille Convention streamlines these procedures by replacing multi-step legalisation with a single apostille issued by the competent authority in the country of origin, certifying the document’s authenticity for use in another Contracting State.

Since the effective date of Decree 293, Vietnamese public documents for use abroad and foreign public documents for use in Vietnam may be authenticated in the following forms:

• Apostille certification, for public documents circulated between Vietnam and a Contracting State having an effective relationship with Vietnam under the Apostille Convention;
• Consular legalisation, for public documents circulated between Vietnam and a non-Contracting State; or
• Other simplified or exempt forms of authentication as provided under other international treaties to which Vietnam is a party.

Apostille certificates for Vietnam public documents

The Ministry of Foreign Affairs are responsible for preparing guidelines, issuing standard form for Apostille certificate and application forms, publishing and updating the list of Contracting States to the Apostille Convention that have applicable relations with Vietnam. The Minister of Foreign Affairs shall assign agencies in charge of issuing Apostille certificates.

An Apostille certificate can be issued for the following Vietnam public documents: (i) documents formulated, issued or certified by agencies or persons competent in proceedings and enforcement agencies in accordance with laws (e.g. verdicts or decisions of courts, decisions of enforcement agencies); (ii) administrative documents formulated, issued or certified by competent agencies or persons in accordance with laws (e.g. papers on civil status, judicial record cards, diplomas, heath certificates); (iii) notarised documents and certified documents; and (iv) other documents formulated, issued or certified by competent agencies or persons while exercising their duties and powers.

Decree 293 specifies the types of document that are excluded from apostille certification which include, among others, administrative documents directly related to trading or customs activities (except for those being consularly certified under the law on consular certification and legalisation before 11 September 2026), and documents issued by diplomatic staff, consular staff while exercising their diplomatic/consular functions. It also specifies documents that fail to meet conditions for apostille certification.

Foreign public documents issued in Contracting States to the Apostille Convention

Except the cases of refusal to receive documents set forth in Article 26 of Decree 293, public documents issued by Contracting States that have applicable relations with Vietnam and bearing a valid apostille certificate may be used in Vietnam without further consular legalisation procedures. However, any foreign language public documents certified with an apostille must be translated into Vietnamese, and the Vietnamese translation must be notarised or certified pursuant to the laws of Vietnam, unless otherwise exempted by specialised laws.

For public documents issued in a Contracting State that objected to Vietnam’s accession to the Apostille Convention, these documents must be legalised.

Transitional arrangements

From the effective date of Decree 293 (i.e. 11 September 2026), Apostilles issued before such date by competent authorities of Contracting States that have applicable relations with Vietnam may be accepted and used in Vietnam, unless subject to statutory refusal. In addition, public documents from such Contracting States that were consularly legalised by competent Vietnamese authorities before the effective date of Decree 293 will remain valid for use in Vietnam and will not be required to undergo apostille procedures.

3. Cybersecurity regulations

After promulgation and the entry into effect of the Cybersecurity Law 2025, on 19 August 2026, the Government issued the three following new decrees that materially expand the obligations applicable to businesses operating in Vietnam:

• Decree No. 331/2026/ND-CP (“Decree 331”) on cybersecurity protection for information systems;
• Decree No. 332/2026/ND-CP (“Decree 332”) on conditions for conducting business in cybersecurity products and services; and
• Decree No. 333/2026/ND-CP (“Decree 333”) guiding a number of Articles of the Cybersecurity Law 2025.

All the three new decrees became effective on 19 August 2026, with some key issues summarized .

Cybersecurity classification framework for information systems

Decree 331 introduces a five-level classification framework for information systems in Vietnam, ranging from Level 1 systems processing lower-risk public information to Level 5 systems involving strategic defence and national security, national-level data infrastructure, international connectivity infrastructure and particularly sensitive industrial control systems. The framework applies directly to organisations that build, manage, operate or upgrade information systems serving State agencies and online public services. Other organisations may apply the framework voluntarily, and equivalent requirements may also become relevant to private-sector service providers where required by government customers.

A key new feature is the risk-based approach under which cybersecurity obligations become more stringent as the classification level increases. Depending on the applicable level, organisations are required to maintain appropriate cybersecurity policies, qualified personnel, secure system design, operational security controls, risk management, monitoring, backup and incident-response arrangements.

Decree 331 also introduces more specific incident-reporting requirements, including a general 24-hour deadline for reporting serious cybersecurity incidents, followed by a full report within 72 hours, and immediate notification for incidents affecting national security.

Requirements for providingcybersecurity product and engaging in cybersecurity service business

Decree 332 introduces a comprehensive licensing framework for the provision of cybersecurity products and the provision of cybersecurity services in Vietnam. The regulated products include, among others, civilian cryptographic products and anti-attack and intrusion prevention products, while the regulated services include, among others, cybersecurity testing and assessment, information security services not involving civilian cryptography, and cybersecurity consulting services.

Notably, Decree 332 sets out specific conditions for obtaining a licence to provide cybersecurity products or conduct cybersecurity services in Vietnam. The applicant must be established under Vietnamese law and comply with applicable laws on cybersecurity products and services. For foreign-invested enterprises, a key additional requirement is that the remaining investment term in Vietnam must exceed five years from the date of issuance of the licence.

Decree 332 also introduces requirements relating to the applicant’s legal representative, managers and technical personnel, as well as its technical systems, facilities and technology. These requirements are intended to ensure that the applicant has sufficient legal compliance, technical capabilities and infrastructure appropriate to the specific cybersecurity products or services it intends to provide.

The Ministry of Public Security is the competent authority for the issuance of the cybersecurity business licence, which is valid for ten years and may be renewed once for a renewal period of no more than three years.

Data localisation and local office

Decree 333 clarifies the data localisation and local presence requirements under the Cybersecurity Law 2025, with different requirements applying depending on whether the relevant enterprise is established in Vietnam or operates from offshore.

Under Decree 333, the following types of data must be stored in Vietnam: (i) data on personal information of service users in Vietnam; and (ii) data created by service users in Vietnam, including account name, service using time, credit card information, email addresses, IP addresses for the latest login and logout and registered telephone number pertaining to the account or data. Local enterprises involved in businesses mentioned in Article 25.3 of the Cybersecurity Law 2025 must store such data in Vietnam.

Foreign enterprises operate in Vietnam in any of the following sectors: (1) telecom services; (2) data storage and sharing in cyberspace; (3) registration and maintenance of domain names to service users in Vietnam; (4) e-commerce; (5) online payment; (6) intermediary payment; (7) transport connection via cyberspace; (8) social network and social media; (9) online games; (10) online applications; and (11) services of providing, managing or operating other information in cyberspace in the form of messages, voice calls, video calls, emails or online chats must store the above-identified data and establish a branch or representative office in Vietnam upon the occurrence of the following incidents:

• the services they provide have been used to commit a violation of cybersecurity laws; and
• the specialized force for cybersecurity protection (the “SFCP”) under the Ministry of Public Security has requested for coordination and provided the enterprises with written notice on three occasions within a maximum period of six months but the enterprises have failed to implement necessary measures to remedy the violation; failed to comply with SFCP’s request; or obstructed the implementation of, or invalidated, the SFCP’s security measures.

The Minister of Public Security shall issue a decision requesting the foreign enterprise to store data and establish a branch or representative office in Vietnam. The data storage period must be at least 24 months. The foreign enterprise must maintain its branch or representative office in Vietnam until it terminates its operation in Vietnam or no longer provides the specified services in Vietnam.

4. Amending the regulations on the Ministry of Justice legal opinions

On 17 August 2026, the Government issued Decree No. 324/2026/ND-CP (“Decree 324”) amending Decree No. 51/2015/ND-CP dated 26 May 2015 on issuance of legal opinions (“Decree 51”). Decree 324 shall take effect from 1 October 2026.

Decree 324 adopts certain amendments to Decree 51 regarding the principles and procedures for obtaining legal opinions issued by the Ministry of Justice (the “MOJ”) as follows:

Assumptions for issuance of MOJ legal opinions

While Decree 51 was silent on the assumptions underlying an MOJ legal opinions, Decree 324 now expressly provides that an MOJ legal opinion shall be issued on the basis that: (i) the foreign contracting party has negotiated, signed, ratified, approved or issued the relevant document in accordance with its applicable laws and regulations; (ii) all related documents have been duly signed or issued, and copies provided to the MOJ conform in form and substance to the originals; (iii) all information and documents provided to the MOJ are complete, accurate and truthful; and (iv) any other specific assumptions set out in the legal opinion are satisfied.

Documents eligible for the MOJ legal opinion

Decree 51 identifies, among others, “PPP projects (comprising the project contract, Government guarantee document (if any), land lease contract and other documents relating to the project to which the State, the Government or a State agency is a party)” as one of the transaction documents eligible for the MOJ legal opinions. Decree 324, however, exclusively excludes PPP projects and narrows documents eligible for the MOJ legal opinions to the following transaction documents: (1) an international treaty on ODA loan and preferential loan; (2) an ODA loan and preferential loan agreement entered into in the name of the Government; (3) a Government guarantee for loans or international bond documents; (4) an agreement on issuance of international bonds of the Government; and (5) other special cases as assigned by the Government or the Prime Minister.

Application file requesting issuance of legal opinion

After the documents considered for issuance of the MOJ legal opinion have been duly signed and approved or ratified, the entity requesting issuance of legal opinion shall submit one set of the application file to the MOJ. Under Decree 51, the application file was required to be submitted in paper form. Decree 324 now permits the application file to be submitted either electronically or in paper form. However, paper submission is required where (i) the application file contains State secrets; (ii) the information system is not capable of sending or receiving electronic documents; or (iii) the information system is experiencing a technical failure.

When requesting issuance of legal opinions for transaction documents mentioned in items (1), (2) and (3) above, besides the documents required by Decree 51, the applicant must present an assessment by the relevant agency regarding the legality of the transaction documents considered for issuance of the MOJ legal opinion, except where the applicant is the supervising agency of an ODA-funded or foreign concessional loan-funded programme, project or non-project, in which case this assessment is not required.

5. Commodity exchanges

On 01 August 2026, the Government issued Decree No. 302/2026/ND-CP (“Decree 302”) implementing the Commercial Law on sale and purchase of goods on commodity exchanges. Decree 302 will take effect on 15 September 2026 and replaces Decree No. 158/2006/ND-CP dated 28 December 2006, as amended (“Decree 158”).

Expanding conditions to establish a commodity exchange

At laws, enterprises that intend to establish a commodity exchange must obtain an establishment licence from the Ministry of Industry and Trade and satisfy the certain conditions, including: (i) the applicant must be a domestic enterprise or a foreign invested enterprise in which the capital contribution of the foreign investor must not exceed 49%; (ii) the enterprise must have charter capital of at least VND1,500 billion; (iii) the information technology system must meet the requirements for safe and stable operation, connecting, monitoring and security as specified in Decree 302; and (iv) the enterprise must have the operational structure of the commodity exchange, the roadmap for listing goods produced domestically, and the draft operational charter of the commodity exchange.

Expanding the scope of goods permitted to be traded on commodity exchanges

Under the previous regime, goods traded on commodity exchanges were subject to different requirements depending on their classification. However, pursuant to Decree 302, except for goods falling within prohibited business sectors, all other types of goods can be traded on the commodity exchanges in Vietnam. In case of performing contracts through the delivery and receipt of physical goods on the list of conditional business lines, individuals and traders have to satisfy all conditions required by the applicable specialized regulations.

Members of commodity exchange

Under Decree 158, members of a commodity exchange comprised only trading members and broker members.Decree 302 now introduces depository and delivery members as an additional category of members. The commodity exchange shall (i) accept the member status for trading members and broker members if they satisfy the conditions set out in Decree 302, and (ii) designate depository and delivery member(s) to carry out the depository, preservation and delivery of goods.