Vietnam Lists First 15 Crypto AML Red Flags as VASPs Enter Compliance Perimeter

On July 14, 2026, State Bank of Vietnam Governor Phạm Đức Ấn tabled a draft omnibus amendment bill before the National Assembly Standing Committee that, for the first time, brings crypto asset service providers (VASPs) explicitly inside the country's AML compliance perimeter — and attaches to that inclusion a statutory list of 15 suspicious transaction indicators that every exchange, custodian, and crypto-adjacent bank must build its monitoring systems around. The bill is scheduled for the National Assembly's extraordinary session in early August. Vietnam's crypto licensing pilot is already live.

The amendment covers the AML Law, the SBV Law, and the Law on Credit Institutions simultaneously. The bundling is deliberate: regulators need amendments to all three to create a coherent legal chain from VASP definition through to supervisory enforcement. The definitional groundwork was laid earlier: the Digital Technology Industry Law (Luật Công nghiệp công nghệ số) introduced the statutory definitions of "digital assets" and "crypto assets" and directed the government to regulate them. This AML amendment is the compliance follow-through — it takes those definitions and attaches obligations to them.

VASPs Enter the Perimeter#

Until now, "crypto asset services" (dịch vụ tài sản mã hóa) sat outside the AML Law's list of reporting entities. Banks filed suspicious transaction reports. Securities firms, insurers, casinos, and real estate agents filed suspicious transaction reports. Crypto platforms did not.

The draft amendment ends that gap. VASPs are explicitly added to the list of entities required to:

• Conduct customer due diligence (KYC)
• Retain transaction records
• File suspicious transaction reports (STRs) with the relevant supervisory authority

This is not a pilot or a sandbox carve-out. It is a statutory obligation that attaches to the category of business, not to the licence type. Once the bill passes, operating as a VASP without AML compliance infrastructure will be operating illegally — regardless of which ministry issued your licence.

Six of the 15 Indicators Are Public#

The draft enumerates 15 specific suspicious transaction indicators for crypto assets. The government's public summary of the bill names approximately six; the full list has not been publicly released at the time of publication. Based on the summary submission, the indicators include:

Structuring. Breaking transactions into sub-threshold amounts to avoid reporting triggers — the crypto analogue of cash smurfing.

Rapid high-value transactions with no clear business purpose. Large volumes moving through an account at speed, without commercial context that explains the activity.

Deposit-transact-withdraw sequences immediately after account opening. A newly opened account that receives funds, immediately transacts, and withdraws — a pattern associated with layering.

Dormant accounts suddenly transacting at scale. Accounts with little prior activity that abruptly begin processing large volumes.

Immediate transfers to VASPs in high ML/TF-risk jurisdictions. Outbound transfers to counterparties in jurisdictions on FATF's high-risk or under-monitoring lists.

Chain-hopping. Continuously converting between crypto assets while accepting abnormal fees or economic losses without rationale — a technique used to obscure fund origins across multiple blockchains.

The remaining nine indicators are not yet in the public domain. The National Assembly's Finance and Budget Committee has called for more operational specificity on indicator criteria and data-source guidance — suggesting the final list may be refined before the August vote.

The six publicly named indicators map directly to patterns in FATF's VASP guidance under Recommendation 15. That alignment is the point: Vietnam is writing domestic law that mirrors the international standard it needs to demonstrate compliance with.

MoF Gets the Supervision Mandate#

Supervisory assignment matters as much as the rules themselves. Under the draft, the Ministry of Finance takes AML inspection authority over VASPs — alongside its existing supervision of securities firms, life insurers, accounting firms, casinos, and lotteries. The SBV retains AML supervision over banks. Entities whose ministries lack specialist inspectorates fall under the Government Inspectorate.

The five crypto exchange applicants cleared in Vietnam's pilot hold, or are working toward, exchange licences from the SSC — an SSC-regulated entity under MoF's portfolio. Their AML obligations now also sit with MoF, via a different supervisory channel. On paper, this is coherent. In practice, an exchange could receive compliance guidance from its SSC licensing supervisor that diverges from MoF's AML inspection team's expectations.

The NA Finance and Budget Committee has flagged this explicitly: the coordination mechanism between SBV, MoF, and the Ministry of Public Security for VASP AML supervision remains unresolved in the current draft. Until that mechanism is specified — in an implementing decree or circular — VASPs operating across the licensing and AML tracks face genuine ambiguity about which instruction governs when the two conflict.

The FATF Dimension#

Governor Phạm Đức Ấn's submission frames the amendment explicitly as internalising FATF Recommendation 15 into domestic law. FATF Rec. 15 requires countries to apply AML/CFT obligations to VASPs, register or license them, and subject them to effective supervision — the same standard applied to banks and other financial institutions.

Vietnam is currently on the FATF enhanced monitoring list. Exiting that list requires demonstrating that the legal and supervisory frameworks exist and are functioning — not just that they have been announced. Passing this amendment in August, and demonstrating that MoF and the relevant authorities have the supervisory capacity to enforce the 15 indicators, is one of the required steps in Vietnam's next FATF mutual evaluation submission.

The connection between the crypto licensing pilot and the FATF exit timeline runs in both directions. The pilot creates a licensed population of VASPs that can be supervised. The AML amendment creates the legal obligations those VASPs must meet. Together, they are Vietnam's proof-of-work to FATF.

What This Means for VIFC Operators#

For licensed and prospective VASPs. The 15 indicators will be a licence condition, not merely a regulatory aspiration. Any crypto exchange, custodian, or asset service provider seeking to operate in Vietnam — including inside the VIFC — must build transaction monitoring systems capable of detecting and reporting all 15 patterns. The full list is not yet public, which means compliance build-out cannot be finalised until the bill passes and implementing guidance follows. But the six named indicators are sufficient to begin architecture decisions.

For banks with digital asset exposure. LPBank, the first VIFC bank subsidiary to explicitly name digital assets in its operational mandate, and any other bank seeking to custody or settle crypto assets, will need to integrate VASP-grade AML monitoring into their compliance infrastructure. A bank that takes crypto deposits or settles crypto transactions sits in a grey zone between bank AML rules (SBV supervision) and VASP AML rules (MoF supervision) until the coordination mechanism is clarified.

For international firms with existing FATF-compliant systems. Crypto operators whose parent entities already run FATF-compliant AML infrastructure — OKX, HashKey, and VPBank's CAEX vehicle among the known pilot participants — carry a compliance advantage. Adapting an existing Rec. 15-compliant system to Vietnam's 15 indicators is an implementation exercise. Building one from scratch is a cost question that smaller domestic platforms may not be able to answer.

For informal and under-capitalised operators. Fifteen-indicator monitoring, STR filing infrastructure, and KYC documentation are not free. Peer-to-peer platforms and under-capitalised domestic exchanges without the technical and legal capacity to meet these standards will face structural pressure to exit or consolidate.

What Remains Unsettled#

Several specifics that VASPs need before they can finalise compliance programs remain unresolved:

• The full text of all 15 indicators (nine have not been publicly released at the time of publication)
• Whether "crypto asset services" covers custodians, brokers, and DeFi interfaces, or only centralised exchanges — the NA committee explicitly called this scope definition insufficiently sharp
• The STR filing timeline and minimum transaction value triggering mandatory reporting
• The SBV–MoF–Ministry of Public Security coordination mechanism, which the NA committee flagged as unresolved

The bill may pass in August as submitted, or the NA may return it for redrafting on scope and coordination grounds. The committee's three specific concerns — scope definition, indicator specificity, and inter-agency coordination — are substantive enough to cause a revision cycle, though the extraordinary session timeline creates pressure for a clean pass.

What Comes Next#

Watch the August extraordinary session closely for two outcomes: whether the bill passes as submitted or returns for amendment, and whether the "crypto asset services" definition is tightened to resolve the scope ambiguity. A passed bill with a narrow definition benefits large centralised exchanges but leaves DeFi-adjacent operators in a grey zone. A passed bill with a broad definition creates compliance obligations for a wider set of actors — and a harder supervisory task for MoF.

The implementing guidance that follows the vote — the decrees and circulars that specify STR thresholds, data-source requirements for each indicator, and the inter-agency coordination protocol — will determine whether the framework is operationally workable. Legislation establishes the obligation; guidance determines whether compliance is achievable.

For VIFC-licensed VASPs, the message is clear: the compliance baseline has been drawn. The specifics will be refined, but the direction is fixed. Vietnam is building the regulatory infrastructure to exit the FATF grey list, and every crypto operator in the country is now inside that project.