Vietnam's AML reforms: What do financial institutions need to know before 1 December?

‍

‍

Vietnam has passed its most significant update to anti-money laundering (AML) regulation in years. Law No. 23/2026/QH16, which amends the Law on Anti-Money Laundering alongside the Law on the State Bank of Vietnam and the Law on Credit Institutions, takes effect on 1 December 2026.

A second law, Law No. 13/2026/QH16, creates the country's first dedicated framework for preventing the financing of the proliferation of weapons of mass destruction (WMD). It comes into force on 1 July 2027.

Together, the two laws bring Vietnam closer to international standards for AML and countering the financing of terrorism (CFT). They also target the areas where financial crime is moving fastest: virtual assets, opaque ownership structures and new technology. KPMG Vietnam's regulatory alert sets out the detail. Here, we look at what the changes mean in practice for the compliance teams who will implement them.

The amendments touch nine areas, but four carry the greatest operational impact.

Virtual assets come into scope. Virtual asset service providers now carry AML obligations, including customer due diligence, transaction monitoring, and suspicious transaction reporting. The law also introduces dedicated suspicious transaction indicators for virtual asset activity. For providers new to AML rules, this is a step change. For banks and payment firms that work with those providers, it raises the bar for how they monitor relationships.

Beneficial ownership must be traced further. Institutions must identify individuals who ultimately own or control a customer, including through indirect ownership and legal arrangements. New recordkeeping requirements apply to the controlling parties and beneficiaries of those arrangements.

Customer due diligence becomes broader. Reporting entities must collect and verify more customer information and may draw on official databases to support identification and verification.

New products need a risk assessment first. Before launching a new product, service, business practice or technology, organisations must assess the money laundering and terrorist financing risk it introduces.

The law also strengthens the suspicious transaction reporting framework and protects those who report in good faith. Regulators, in turn, must step up risk-based supervision across financial institutions and designated non-financial businesses and professions.  

‍

Law 13/2026/QH16 applies to Vietnamese and foreign organisations and individuals operating or residing in Vietnam. It sets out prohibited acts, control measures, sanctions implementation, early warning mechanisms and the responsibilities of financial institutions. The Ministry of National Defence is designated as the national focal authority.

For compliance teams, the practical consequence is that proliferation financing is likely to need its own place in the risk assessment, screening programme and governance framework, rather than sitting implicitly within general sanctions compliance.  

‍

The direction of travel is clear. Regulators expect controls that are risk-based, evidenced and able to adapt as threats evolve, and several of the new requirements will test whether existing systems can keep pace.

Monitoring has to reflect new typologies. Dedicated indicators for virtual asset activity, and a framework built to add risk indicators over time; mean transaction monitoring cannot be a static ruleset configured once. Teams need to add and update scenarios quickly. They also need to test those changes before go-live, so that a new rule improves detection rather than flooding analysts with alerts.

Ownership and screening data must be connected. Tracing indirect ownership and legal arrangements, then screening the controlling parties against sanctions and proliferation-related lists, depends on joining customer, ownership and screening data. Name matching also has to cope with transliteration, variant spellings and partial matches, which are a constant feature of cross-border screening.

Risk assessments need evidence behind them. The requirement to assess risk before launching a new product or technology is easier to meet when controls can be tested against realistic scenarios in advance. It is easier still when the results can be shown to a supervisor.

Explainability becomes a supervisory expectation. Expanded risk-based supervision means institutions should be ready to explain why a customer was rated as they were, why an alert was closed, and why a report was or was not filed. Every alert, disposition, and escalation should be auditable.

‍

Vietnam's reforms reflect a wider pattern across Asia Pacific. Regulators are raising expectations on virtual assets, ownership transparency and proliferation financing, and they want institutions to show that their controls work, not simply that they exist.

Institutions that treat 1 December as the start of continuous improvement, rather than a one-off compliance deadline, will be better placed as indicators evolve and supervision intensifies.

Napier AI works with financial institutions across Asia Pacific to modernise screening and monitoring with explainable, compliance-first AI. To discuss how your controls measure up against Vietnam's new requirements, speak to our team.

For a deeper look at building controls that can keep pace with regulatory change, download the whitepaper: How to build AI-ready FinCrime infrastructure.