Decree 94's P2P Sandbox: The Foreign Ownership Bar and What It Means for VIFC Firms

Decree No. 94/2025/ND-CP, issued on 29 April 2025 and effective 1 July 2025, creates Vietnam's first formal regulatory sandbox for banking-sector fintech. For most international firms evaluating Vietnam's fintech market, the headline matters less than a single clause buried in the P2P lending conditions: foreign-owned enterprises cannot participate. Understanding exactly what that exclusion covers — and what it leaves open — is the practical starting point for any cross-border fintech structuring analysis.

What the Sandbox Actually Covers#

The decree's scope is narrow by design. Three activities — credit scoring, Open API platforms, and P2P lending — qualify for sandbox participation. Digital asset trading, robo-advisory, and insurtech fall outside the framework entirely. Firms building products that straddle these categories should assume the excluded activities will be treated as outside scope unless the SBV issues clarifying guidance.

This matters for VIFC-oriented fintechs because the VIFC's own priority sectors include digital assets and embedded finance. Those plays require separate legal pathways — Decree 94's sandbox is not the route. For the intersection of the VIFC and fintech lending specifically, the relevant framework is Decree 94, but the structural constraints below will determine whether international firms can actually use it.

For broader context on how Decree 94 fits within Vietnam's fintech regulatory architecture, see Decree 94 Explained: Vietnam's Fintech Sandbox and What Foreign Firms Can Actually Do.

The Foreign Ownership Bar: What It Covers and What It Doesn't#

The critical asymmetry in Decree 94 is structural: foreign-invested enterprises are treated differently depending on which sandbox vertical they pursue.

Credit scoring and Open API are open to any fintech company lawfully established in Vietnam, including foreign-invested enterprises. The qualification bar for these verticals focuses on the legal representative and CEO — a relevant university degree (economics, law, information technology, or business administration) and at least two years of finance or banking management experience. Nationality is not a condition.

P2P lending is categorically different. The decree restricts participation to enterprises with no foreign ownership. It also requires the legal representative and CEO to be Vietnamese nationals — not merely Vietnam residents. This rules out most international management teams.

The practical problem is definitional: Decree 94 does not define "foreign-owned enterprise." Vietnam's Investment Law defines "foreign-invested economic organizations" broadly enough to potentially capture any entity with any foreign shareholder or any indirect foreign control. Until the SBV or a court ruling provides authoritative interpretation, firms with minority foreign shareholders or indirect offshore holding structures cannot assume they qualify for the P2P sandbox.

For VIFC-resident entities — which by design often carry foreign capital — this exclusion will be determinative for any P2P lending ambition. Firms exploring the VIFC as an entry point for fintech lending should take legal advice on their specific ownership structure before assuming they qualify.

The EVFTA and CPTPP Tension#

Some legal commentary argues that the nationality-based exclusion for P2P lending may conflict with Vietnam's obligations under the EVFTA and CPTPP. Both agreements require Vietnam to allow foreign financial service suppliers to offer new financial services that domestic suppliers are permitted to offer. Vietnam entered a reservation permitting limits on sandbox participant numbers and scope restrictions — but the argument runs that this reservation does not expressly authorise nationality-based exclusions.

This is an unresolved legal question, not a settled interpretation. Firms should not assume the exclusion will be challenged or overridden — the reservation may ultimately be read broadly enough to cover it. What it does create is regulatory uncertainty that will persist until either treaty dispute resolution proceedings test the point or Vietnam amends the decree. International firms with treaty rights under EVFTA or CPTPP should factor this into their strategic planning, but should not treat the tension as a near-term operational lever.

Cross-Border Testing: A Hard Stop#

Article 6(2) of Decree 94 is unambiguous: sandbox testing is limited to Vietnam's territory, and cross-border testing is not permitted.

For VIFC-oriented firms that contemplate serving regional or international clients, this is a structural constraint, not a technicality. During the sandbox period, all activity — user acquisition, loan origination, API calls, credit scoring queries — must stay within Vietnam's borders. A P2P platform that connects Vietnamese borrowers with foreign lenders, or an Open API product that calls external systems in Singapore or Hong Kong, cannot operate under the sandbox in that configuration.

This constraint should inform how firms design their sandbox testing scope from day one. Products built for a Vietnamese-only testing environment may require significant re-architecture before they scale regionally.

What the Certificate of Completion Actually Confers#

Article 21(3) draws a clear line: the Certificate of Completion is valid only within the sandbox framework. It is not a business license. It does not confirm that all conditions for full-scale commercial operation are met.

This is a significant practical point that the broad-brush coverage of Decree 94 sometimes obscures. Firms that complete the sandbox successfully — and that means up to four years of testing, reporting, and SBV oversight — emerge with evidence that their solution worked in a controlled environment. They do not emerge with a regulatory green light to scale commercially. That licensing process runs separately, under whichever regulatory regime governs their activity class at the time.

The implication: sandbox participation is a necessary step toward market legitimacy in Vietnam's fintech sector, but it is not sufficient for commercial launch. Firms should map their post-sandbox licensing pathway before they apply, not after they complete.

Timelines and Operating Requirements#

The application process has a single significant friction point: once the SBV confirms receipt of a complete application file, it has 90 working days to complete its review — approximately 18 calendar weeks at standard working-day counts. Firms that receive a Participation Certificate must commence sandbox operations within 90 calendar days or face revocation.

The sandbox period itself runs up to two years from the Participation Certificate date. Firms may apply for extensions — up to two extensions of 12 months each — giving a theoretical maximum of four years in the sandbox environment.

For P2P participants, the ongoing compliance obligations are substantial:

• Real-time integration with the Credit Information Centre (CIC) for borrower debt monitoring
• All loan disbursements via bank accounts or licensed e-wallets — no cash
• Maximum loan term of two years per contract
• IT systems and data storage physically located in Vietnam
• Quarterly reports to the SBV by the 15th of the first month of the following quarter
• Incident reporting within 24 hours to the SBV's designated contact channel

On borrowing caps: the decree delegates to the SBV Governor the authority to set maximum outstanding debt per borrower, both per-platform and across all sandboxed P2P platforms (Article 24(1)(e)). Figures circulating in industry discussions have cited expected caps of VND 100–400 million (approximately USD 4,000–16,000), but none of this has been officially gazetted as of the date of this article and firms should not rely on these figures for business planning until the SBV issues a formal decision.

Practical Implications for International Firms#

If you are a foreign-invested enterprise considering P2P lending in Vietnam: The sandbox is likely unavailable to you under current structuring. The definitional ambiguity around "foreign-owned" creates residual uncertainty, but the direction of policy is clear. Explore whether a domestically controlled joint venture structure achieves your commercial objective, taking local legal advice on what degree of control you can retain without triggering foreign-ownership classification.

If you are evaluating credit scoring or Open API plays: The sandbox is available to foreign-invested enterprises lawfully established in Vietnam. Focus on executive qualification requirements (the two-year finance or banking management experience bar) and the Vietnam-only testing constraint. If your product requires cross-border data flows or offshore system integration during the testing phase, re-architect before applying.

If you are routing a fintech play through the VIFC: The VIFC's foreign exchange and entity frameworks do not override Decree 94's domestic-only ownership requirement for P2P. VIFC membership may assist with talent, FX access, and dispute resolution — see the VIFC's labor rules for foreign professionals and immigration framework — but it does not neutralise the P2P ownership bar. The two frameworks operate on parallel tracks.

If you are planning around the Certificate of Completion: Budget for a separate licensing process post-sandbox. Start mapping the regulatory pathway for full commercial operation now, not in year three of a four-year sandbox.

What Comes Next#

Two things will determine how this framework operates in practice. First, the SBV Governor's decision on P2P borrower debt caps — when gazetted, this will set the commercial ceiling for the entire sandboxed P2P sector. Second, any interpretive guidance or amendment addressing the "foreign-owned enterprise" definition. If Vietnam moves to clarify or narrow that definition in response to treaty pressure or market feedback, the P2P vertical opens materially to international capital.

Firms should also monitor whether Vietnam's government amends Decree 94 to accommodate the EVFTA and CPTPP concerns that legal commentary has flagged. Treaty compliance reviews happen on their own schedule, but the gap between the decree's nationality-based exclusion and Vietnam's new financial services obligations is narrow enough that legal developments are possible within the sandbox's four-year maximum life.

This article was last updated on 3 May 2026. We will update it as the SBV Governor issues the borrower debt cap decision and as any interpretive guidance on the foreign-ownership definition is released.