Duong Tri Law reviews product models, cryptographic functions and the proposed business activity to identify the appropriate civil cryptography licensing route. Under Decree 341/2026, a business licence, an export/import licence, conformity work or a change to an existing licence can involve separate requirements.
We clarify the proposed scope, missing conditions and documents before preparing the agreed application. Manufacturers, overseas suppliers and Vietnam-based distributors should establish who will hold each licence and perform each procedural step before committing to a shipment or customer delivery.
Start with the exact product and intended activity. A trade name, broad HS heading or the presence of encryption alone does not establish the licensing conclusion for a model.
| Your need | What we review | Further guidance |
|---|---|---|
| Uncertain whether a model is regulated | Record the exact model, firmware, feature licence and functions. Identify missing evidence before drawing a conclusion. | Prepare the model/datasheet record (Vietnamese) |
| A new business licence | Review personnel, equipment/facilities, the technical plan and the products or services on the applicable list. | New-licence requirements (Vietnamese) |
| Planned export or import | Match the HS code, goods description and cryptographic characteristics together. Review the business licence and, for imports, the required conformity certification and declaration. | Export/import route (Vietnamese) |
| An existing licence with proposed changes | A change of company name or legal representative follows amendment; changing or adding licensed products/services follows the separate scope-supplementation route. | Amendment or scope addition (Vietnamese) |
| Dual-use civil cryptography/cybersecurity products | The Ministry of Public Security issues the cybersecurity business and export/import licences for the dual-use route. It obtains the Government Cipher Committee’s written opinion on civil cryptography functions before licensing. | Review dual-use classification (Vietnamese) |
Legal basis:Decree 341/2026/ND-CP.
Choose the relevant service
The route depends on the products, exact models, the applicant’s supply-chain role and existing licences. We review the catalogue, datasheet and proposed activities before defining which applications, outputs and client inputs the engagement covers.
Review the personnel requirements, equipment and facilities, technical plan and proposed product/service scope. The current conditions include at least two appropriately qualified technical staff and a qualifying management/operations officer; their actual qualifications must be checked.
Review each model’s HS code, goods description and cryptographic characteristics together, with the business licence, conformity position and intended use. The applicant should identify who will import/export and who will distribute or integrate the product.
Compare the existing licence with the proposed company-information or product/service change, identify the correct procedure and prepare the agreed supporting materials. An unchanged expiry date should not be assumed to authorise a new product scope.
Business and export/import licences issued before 1 July 2026 continue until the expiry stated on them. Review the licence date, scope, remaining term and new plans before choosing a procedure; later project changes still need assessment.
Initial review and post-licensing guidance
Before confirming the service, we review products, models, cryptographic functions, the client’s role and existing approvals. The agreed handover can include the authority result, retained application records and guidance on licensed scope, continuing conditions, reporting and later amendments. Testing, certification and customs work are separate unless expressly included.
Separate the two permissions
The business licence concerns activities involving the products/services on Annex I. The export/import route concerns products on Annex II, assessed through the HS code, goods description and cryptographic characteristics together. An importer distributing regulated products may need both routes, with conformity and the dual-use rules assessed separately.
Business activities in Vietnam
Relevant where the enterprise manufactures, trades, distributes or supplies products or services falling within the business-licensing list. Review the applicant’s actual activities and scope rather than relying on a manufacturer’s or group company’s approval.
The review focuses on: personnel, equipment and facilities, the technical plan and the products/services proposed for the licence.
Cross-border movement of products
Required for products within the licensed Annex II list. All relevant classification elements must match; customs HS classification is governed by customs law. Do not conclude that every device with encryption needs the same import route.
The review focuses on: the business licence, HS code, description, cryptographic characteristics, conformity position, end users and intended use.
A route to assess for imports intended for distribution
Client inputs
This initial information is broader than the formal authority dossier. Clear product and business data lets us identify the route, missing evidence, proposed deliverables and responsibilities before detailed drafting begins.
Input 01
Provide the manufacturer, full model designation, version, suffixes and feature licences intended for the Vietnam supply. Models with different enabled functions may need separate analysis.
Input 02
Provide the catalogue and technical description of the main functions, algorithms, key management, protected data and environment of use. State what is not yet available rather than substituting marketing language.
Input 03
Explain whether the applicant manufactures, imports, distributes, integrates, provides a service or only uses the product internally. Identify the Vietnam entity and relevant overseas parties.
Input 04
Describe the intended customers and whether products are sold, leased, integrated into projects or supplied through a service. The actual activity affects classification and the proposed scope.
Input 05
Provide relevant licences, personnel qualifications, conformity results and information on completed procedures, where available. Review corporate and market-access questions separately where foreign investment is involved.
Input 06
Identify intended contract, sales, shipment, import and operational dates so the required work can be sequenced. A customer deadline does not replace an authority approval or a conformity requirement.
Handling sensitive technical records
Datasheets, architecture and algorithm/key-management descriptions can contain sensitive information. Begin with a short overview and agree the intake channel, authorised contacts and permitted use before sharing detailed records.
Legal and supply-chain risks
An incorrect classification can affect licence scope, conformity work, shipment documentation and delivery planning. The consequences depend on the actual activity and can include corrective work, contractual disruption or regulatory action.
A company offers a model, product group or service without confirming that its business-licence scope covers the proposed activity.
Missing conformity or export/import permission can disrupt clearance and delivery, require corrections or leave the company needing to address the shipment’s regulatory position.
Product names, models, feature licences, HS codes and specifications do not match across catalogues, licences, conformity records, invoices and shipment documents.
Non-compliant business or export/import activity can result in administrative sanctions and corrective measures depending on the conduct and applicable rules. No single penalty applies to every issue.
From technical evidence to an agreed application
Each stage identifies the products under review, missing materials, responsible contacts and the output expected. The legal engagement and any testing, conformity, customs or engineering work must be scoped separately.
Step 01
Discuss the models, the client’s role, existing approvals and intended commercial milestones.Output: an initial information and document request.
Step 02
Review the catalogue, cryptographic functions, feature licences and proposed supply model. Identify evidence still needed before a conclusion can be reached.Output: findings on the scope requiring review, including any dual-use branch.
Step 03
Sequence a new business licence, conformity work, export/import permission or licence changes according to the actual model and activity.Output: a tailored checklist, responsibilities and proposed filing stages.
Step 04
Prepare the agreed forms and supporting records for client confirmation. A new business application uses Form 01, qualification records and the Form 03 technical plan; export/import uses its separate Form 05 route.Output: the agreed draft application package for signing and submission.
Step 05
Provide the agreed filing support, monitor authority correspondence and coordinate responses. Requests can have short statutory response deadlines; the client must supply accurate and timely information.Output: progress updates and a record of clarification or additional work required.
Step 06
Review the authority’s result and explain the licensed scope, continuing conditions, reporting and changes to monitor. Approval remains the authority’s decision.Output: the authority result, retained filing records and agreed post-licensing guidance.
Keep the operation within the licensed scope and maintain the relevant personnel, facilities, technical and product-quality arrangements. Retain and protect customer, product and technical records. The current rules require an annual report to the Government Cipher Committee before 31 December using Form 07. Review company-information, product/service and shipment changes before implementation; further filings or technical work are separate unless agreed.
Decree 341/2026/ND-CP
These authority periods run from receipt of a complete, valid dossier by the Government Cipher Committee. They exclude client preparation, qualifications, technical materials, conformity work and time needed to address incomplete records. The dual-use cybersecurity route must be assessed separately.
New business licence
The statutory period for a new civil cryptography business-licence application is 12 days from receipt of a complete, valid dossier. This is not a promise that the whole engagement finishes in 12 days.
New-licence term: ten years under the current regime.
Business-licence amendment
Used for a change of company name or legal representative. After the amended licence is issued, the original previous paper licence must be returned within the prescribed period; the current rule specifies two working days.
Add or change products/services
Applies where an existing licence-holder seeks a change or addition to its licensed product/service scope. Review the technical plan and the products concerned before treating the new scope as authorised.
Export/import licence
Applies to the civil cryptography export/import route for Annex II products where the relevant conditions, including the import conformity position, are met.
New-licence term: three years.
Project preparation comes first
Official fees and charges
Circular 64/2025 reduces specified civil-cryptography licensing/conformity appraisal fees to 50% of the relevant base rates from 1 July 2025 through 31 December 2026. This is not a blanket reduction of every licence charge, test cost or service fee. Identify the procedure and current fee instrument before confirming an amount.
Duong Tri Law’s professional fees
The quotation depends on the procedure, number of models, technical-document readiness, applicant conditions, translation/formality needs and agreed representation. Testing, certification, conformity-provider work, customs services and other third-party costs are separate unless expressly included.
Start with the product record
Provide the product/model, datasheet, applicant’s role, existing licences and intended business or delivery date. We will clarify the proposed work, outputs, dependencies and fees before the engagement proceeds.
Coordinating legal and technical evidence
The application needs consistency between company information, technical evidence and commercial plans. Our work focuses on the legal route and agreed filing support, with clear responsibilities for the applicant and any separate technical providers.
Assess the model, version and enabled functions against the actual activity; avoid a blanket conclusion based on a product family or marketing name.
Explain how business licensing, conformity, export/import permission and later scope changes fit together for the proposed supply model.
Align names, models, functions, proposed licence scope and transaction documents before filing. Identify contradictions and information the manufacturer or technical team must clarify.
Help the client understand the result, permitted scope, continuing conditions and reporting or amendment needs within the agreed post-licensing guidance.
Always listening. Always finding a solution.
We review the product and the business objective before proposing a procedure, so the client can understand the work required and decide how to allocate resources. This is an agreed legal service rather than a guarantee of approval or shipment clearance.
Specialist resources
The resources below address separate product and procedural questions. The linked specialist guides currently remain in Vietnamese; this EN page provides the service overview and the information needed to begin a scoped review.
Civil cryptography
Related technology regulation
Legal framework
Decree 341/2026, effective 1 September 2026, governs civil cryptography lists, business conditions, export/import licensing, authority responsibilities and procedures. Read it with the Cybersecurity Law and the rules applying to the actual product, activity and application date.
Primary legislation
Effective 1 July 2026, providing the current statutory framework relevant to civil cryptography. Civil cryptography concerns protection of information outside the scope of state secrets; do not conflate the two regimes.
Cybersecurity Law — official source
Direct implementing rules
Effective 1 September 2026. Annex I concerns business-licensed products/services; Annex II concerns export/import products assessed through all relevant classification elements. Applicant conditions, dossiers and licence changes follow the appropriate procedure.
Decree 341/2026 — official source
Official fees
Specified appraisal fees are 50% of the relevant base rates from 1 July 2025 through 31 December 2026. Confirm the precise fee category and applicable schedule; the reduction does not cover every associated charge.
Circular 64/2025 — official source
Administrative sanctions
Effective 1 July 2026, including relevant civil cryptography business and export/import violations. The applicable consequences depend on the conduct and responsible party; no universal penalty amount is stated here.
Decree 174/2026 — official source
Frequently asked questions
These answers help identify the product evidence, procedural route and legal scope to discuss. Final classification depends on the actual model, functions and proposed activity.
Start with the manufacturer, exact model/version and feature licence, catalogue or datasheet, cryptographic functions, your supply-chain role, existing approvals and target dates. Identify the Vietnam applicant and any overseas manufacturer or rights-holder. Agree a suitable channel before sharing detailed technical information.
Begin with product and activity classification. We assess whether the issue concerns the business list, the export/import list, conformity, changes to an existing licence or the dual-use cybersecurity route. The presence of encryption or a broad HS code alone does not settle all those questions.
Yes, their sequence can be planned together, while their conditions, dossiers and authority results remain separate. Imports within the licensed list require review of the business-licence and conformity conditions as well as the export/import application. The engagement must specify which work is included.
No. A catalogue, datasheet and short activity description can support an initial discussion. More detail may be needed on algorithms, key management, enabled features and the intended configuration before classification is concluded. Do not send passwords, live keys or unnecessary confidential records through an initial messaging enquiry.
Under the transition rule, those business and export/import licences continue until their stated expiry. Review the original scope, any later changes and the current plans. A company-name or legal-representative change and a product/service scope addition have different procedures under Decree 341/2026.
The procedure, model count, quality of technical records, applicant readiness, language/formality requirements and representation scope affect fees. The quotation distinguishes legal outputs from official charges, testing/conformity and other third-party work. Authority review periods are separate from preparation and a guaranteed completion date.
