The State Bank of Vietnam (SBV) is set to tighten biometric authentication standards to prevent artificial intelligence (AI) and deepfake impersonations, while introducing a mandatory minimum 24-hour transaction delay mechanism to counter fraud.
Scheduled to take effect in 2027, the incoming regulations aim to reinforce transaction security and protect payment service users.
Speaking at a recent press conference for Vietnam Digital Payments Day 2026, Mr. Pham Anh Tuan, Director of the Payment Department at the SBV, noted that cross-referencing user biometrics against the National Population Database has significantly curbed fraudulent mule accounts as well as the illicit renting, buying, borrowing, and selling of bank accounts.
However, Mr. Tuan underscored that biometric matching is not an all-encompassing shield against fraud. Driven by rapid technological shifts, criminals increasingly deploy generative AI and deepfakes to circumvent checks and data-validation layers instituted by payment service providers.
"To be frank, bad actors have successfully bypassed certain biometric verification stages at several payment service providers," Mr. Tuan said.
According to the official, outlining long-term remedies, the central bank has incorporated rigorous technical specifications for biometric cross-referencing into formal legal and regulatory frameworks.
Under these rules, authentication systems must satisfy stringent technical benchmarks, obtain verified certifications, and align with international standards on anti-deepfake capabilities to block the exploitation of AI and unauthorized biometric data for fraudulent schemes.
Payment service providers and payment intermediaries that fail to meet these technical requirements will be barred from offering the corresponding services.
"Because institutions require time to upgrade infrastructure and meet the new technical specifications, the regulations include transitional provisions and are slated to enter into force in 2027," said Mr. Tuan.
He anticipated that adopting these elevated standards will make authentication systems across payment service providers substantially more robust and secure.
Nonetheless, the SBV representative reiterated that technical defenses merely mitigate fraud risks rather than eradicate criminal activity outright.
Notably, starting March 1, 2027, payment service providers will be required to offer tools enabling customers to set custom transaction caps and activate an optional 24-hour delay on transfers directed toward accounts with which they have had no transaction history over the preceding 12 months.
Google translate