Vietnam business compliance checklist

Self-check: Do the accounting records and supporting documents for capital contribution match the registered amount? If not fully contributed, has the capital adjustment procedure been completed?

Why it matters

Many people register high capital for a better file appearance but do not contribute enough. When the deadline is exceeded without adjustment, the company falls into a violation status and members must bear liability corresponding to the amount they committed.

Consequence if ignored

Administrative penalty for business registration (refer to the penalty level in the currently effective penalty decree) and mandatory capital adjustment. Members are liable according to the capital they have committed, not the amount they have contributed.

Frequency / timing

Once after establishment; re-check when capital is increased

Where to look

Law on Enterprises, provisions on capital contribution for each business type

Suggested owner

Accounting, legal affairs

Self-check: Does the signboard have the correct company name as per the registration certificate, address, and telephone number? Is it in a visible location?

Why it matters

A signboard is often considered a minor matter, but lacking the correct registered name, address, and telephone number is subject to sanctions. When the tax authority verifies the address, they also look at the signboard to determine whether the company is operating.

Consequence if ignored

Administrative penalty in the advertising field (refer to the penalty level in the currently effective penalty decree). Greater indirect risk: being deemed not to operate at the registered address.

Frequency / timing

Maintain at all times

Where to look

Law on Advertising, section on signboards; currently effective penalty decree for culture and advertising

Suggested owner

Administration

Self-check: Is the address on the registration certificate the actual place of operation? Is there someone to receive mail and receive inspection visits?

Why it matters

If the tax authority verifies and does not find the company at the registered address, the tax code may be suspended and the legal representative may be subject to travel restrictions when owing taxes — the conditions for application are set out in the currently effective documents. This is a common situation with companies renting virtual addresses or that have relocated their office without re-registering.

Consequence if ignored

Tax code suspension, inability to issue e-invoices, inability to file tax returns. The legal representative may be subject to temporary travel ban when owing taxes, according to conditions in the currently effective regulations. Reopening takes many weeks.

Frequency / timing

Check each time the office is relocated

Where to look

Law on Tax Administration; decree on temporary travel ban due to tax debt

Suggested owner

Administration, legal affairs

Self-check: Has the most recent change been registered? Does the current registration certificate match the actual situation?

Why it matters

Changing the legal representative, address, capital, or business line without updating the business registration authority within the prescribed time limit is subject to penalty. This is often discovered when conducting other procedures.

Consequence if ignored

Administrative penalty depending on the delay period (refer to the penalty level in the currently effective penalty decree). Documents signed during the period of incorrect information may be questioned.

Frequency / timing

Within the prescribed time limit after each change

Where to look

Law on Enterprises; decree on business registration

Suggested owner

Legal affairs

Self-check: Does the current business line fall within the list of conditional investment and business lines? Is the license still valid?

Why it matters

Certain business lines require a separate license or must meet conditions before commencing operation. Operating before obtaining a license may result in penalty and forced cessation.

Consequence if ignored

Forced cessation of operation, administrative penalty under specialized law, possible revocation of registration certificate. Revenue from unlicensed operation may be subject to enforcement action.

Frequency / timing

According to the validity period of each license

Where to look

Law on Investment, annex on conditional business lines; specialized laws

Suggested owner

Legal affairs

Self-check: Is there a currently effective charter? Has the member register been updated after the most recent transfer?

Why it matters

Charter, register of members or shareholders, meeting minutes, and resolutions are documents that banks, investors, and inspection authorities often request. Without them, it is difficult to prove that the company's decisions are valid.

Consequence if ignored

Minor administrative penalty. The real risk is disputes between members and shareholders with no basis for resolution, and banks and investors stopping transactions when documents are missing.

Frequency / timing

Update after each change

Where to look

Law on Enterprises, provisions on documents to be retained

Suggested owner

Legal affairs

Self-check: How long is the digital signature still valid? Who holds the password to the e-tax account and e-social insurance account?

Why it matters

Digital signature expiring on the exact tax return filing date is a frequent occurrence. A company with a locked tax code faces a circular problem: a digital signature is needed to file the tax return, but a new digital signature cannot be issued because the tax code is locked.

Consequence if ignored

Late filing of tax return due to expiry or lost password, resulting in late filing penalty calculated by number of days. When the tax code is locked, a new digital signature cannot be issued.

Frequency / timing

Check every quarter

Where to look

Digital signature provider; e-tax portal

Suggested owner

Accountant

Self-check: Is there a ready-made power of attorney template? Was a power of attorney issued during the most recent extended business trip?

Why it matters

When the legal representative is absent for an extended period without a written power of attorney, documents signed during that time may be questioned regarding their validity.

Consequence if ignored

Documents and contracts signed during absence may be disputed regarding validity. Minor administrative penalty if inspected.

Frequency / timing

Each time of extended absence

Where to look

Law on Enterprises, provisions on legal representative

Suggested owner

Legal affairs

Self-check: Where are documents from prior years stored, in paper or electronic form? Can they be retrieved within 1 day?

Why it matters

Accounting documents used directly for record-keeping and financial reporting must be retained for at least 10 years (Law on Accounting). When inspected for prior years, failure to produce documents results in expenses being disallowed.

Consequence if ignored

Failure to produce documents during inspection results in expenses being disallowed, input VAT being rejected, back assessment plus penalties for false declaration and late payment interest calculated by day. Violation of accounting document retention is also subject to separate penalties.

Frequency / timing

Continuously

Where to look

Law on Accounting, provisions on preservation and retention of accounting documents

Suggested owner

Accountant

Self-check: Is the company still a micro-enterprise under current criteria? If not, who is the current chief accountant, is there an appointment decision and certificate? If only a person in charge of accounting, has the temporary period expired?

Why it matters

An accounting unit must have a chief accountant. If not yet appointed, arrange a person in charge of accounting or outsource the service, but only temporarily within the maximum period prescribed by law; thereafter a qualified chief accountant must be appointed (holding a chief accountant training certificate, appropriate qualifications and years of experience). Micro-enterprises are exempt and only need a person in charge of accounting. Many small companies have accountants maintaining complete records, taxes and accounts, but no one holds the position of chief accountant and are still penalised for missing the position rather than for incomplete work.

Consequence if ignored

Administrative penalty in the accounting field (check the amount in the current penalty decree), penalty for missing position even if records are complete.

Frequency / timing

Check when exceeding micro-enterprise threshold; temporary arrangement period for person in charge of accounting per law

Where to look

Law on Accounting, provisions on chief accountant and chief accountant standards; decree guiding the Law on Accounting; decree on micro-enterprise criteria; circular on accounting regime for micro-enterprises (check current version in force); decree on penalties in the accounting field

Suggested owner

Accountant, director

Self-check: How many digital signatures does the company currently have (tokens, remote digital signatures, personal digital signatures of the legal representative)? Who holds each one, what types of documents can be signed, when do they expire? Are digital signatures separated for tax and insurance, for e-invoices, for contracts? Is there a signing log or digital signature usage policy? Are departing employees' rights revoked immediately?

Why it matters

A company's digital signature has the value of a company seal and the legal representative's signature combined: it can sign tax returns, insurance documents, e-invoices, electronic contracts, business registration documents, certain banking transactions. A single token in the accountant's pocket or at an accounting service firm means that person can sign everything on behalf of the company without anyone's review. Common risks: employee leaves or retains the password, signs unapproved contracts or e-invoices, digital signature for e-invoices automatically stored on a server with no oversight, digital signature expires on the exact tax return filing date.

Consequence if ignored

The person holding the digital signature can sign contracts, e-invoices, legal documents on behalf of the company without anyone's review. The consequences are not limited to fines but include contractual obligations and legal liability that the company must bear.

Frequency / timing

Inventory every quarter; review authority when personnel changes

Where to look

Law on Electronic Transactions 2023; decree on electronic signatures and trust services 2025; internal regulations on digital signature and seal usage

Suggested owner

Director, accountant, IT

Self-check: Is there a written document catalogue? Can a new employee find 2022 documents within 1 hour? Are documents stored on the company system or on individual staff members' computers and emails?

Why it matters

When an inspection team arrives, the first question is about the document catalogue, not individual documents. A company may have all the papers but scattered across emails, personal computers, and filing cabinets of departed staff—which is as good as having nothing. There should be a written document catalogue by year and by category (tax, accounting, labour, insurance, legal, personal data), with each category clearly noting where documents are stored, who holds them, and the retention period. Accounting records have minimum retention periods by type: documents used directly for bookkeeping and financial reporting must be kept for at least 10 years; other types should be checked against the guidance decrees on the Law on Accounting currently in force.

Consequence if ignored

No direct penalty, but if documents cannot be found within the required timeframe during inspection, they are deemed non-existent, leading to consequences under the document retention provisions.

Frequency / timing

Prepared once, updated annually when closing the books

Where to look

Law on Accounting and guidance decrees, provisions on document types and retention periods; current regulations on electronic document storage

Suggested owner

Accounting, administration

Self-check: Is there a handover record template? Are portal accounts and digital signatures linked to company email and phone numbers or to individuals?

Why it matters

When the person keeping the books leaves, the company is most vulnerable to losing track of documents. Handover must be documented with a record and catalogue: ledgers, documents by year, usernames and passwords for all portals (tax, insurance, e-invoice, banking), digital signatures, company seals, active contracts, pending work and upcoming deadlines. If the digital signature, tax portal account, or e-invoice portal account is registered under or linked to the departing person's name or personal phone number, it must be transferred immediately.

Consequence if ignored

Loss of access to tax portals, insurance portals, and banks; missed deadlines across multiple consecutive periods; inability to locate old documents. Many back-assessment cases begin with a single accounting staff change without proper handover.

Frequency / timing

Each time staff changes

Where to look

Law on Accounting, provisions on responsibility when accounting staff changes; internal regulations

Suggested owner

Director, accounting, human resources

Self-check: When was the most recent backup, where is it stored, and who checks it? Has recovery from backup ever been tested, and how long does it take? If accounting software is changed, what opens the old data?

Why it matters

Data from accounting software, original-format e-invoices, and digital documents are accounting records; if lost, they cannot be recreated. Software installed on a computer must have regular backups stored elsewhere and actual recovery must be tested. Cloud-based software requires checking the service provider's contract for backup commitments, data export procedures when service ends, and the company should still export data periodically itself. Original e-invoices are data files with digital signatures, not printouts; they must be downloaded and stored separately because the provider only retains them under contract.

Consequence if ignored

Loss of accounting data means ledgers for multiple years cannot be reconstructed; the company is deemed to have no accounting records, expenses are disallowed in bulk, plus penalties for storage violations.

Frequency / timing

Backup on schedule; test recovery at least 1 time per year

Where to look

Law on Accounting and guidance decrees, provisions on electronic accounting records and preservation; decree on invoices and documents, provisions on e-invoice storage; software provider contracts

Suggested owner

Accounting, IT

Self-check: Have you checked the e-tax portal's tax obligation lookup to see if there is any unpaid business license fee from any prior year?

Why it matters

The business license fee was abolished from the start of 2026, but unpaid amounts from prior years remain a tax debt. Many companies discover this debt with accrued late payment interest only when dissolving.

Consequence if ignored

The annual amount may not be large, but combined with late payment interest it adds up; however, as a tax debt it blocks dissolution and may trigger travel restrictions if the company is deemed to have abandoned its address.

Frequency / timing

Once

Where to look

Resolution 198/2025/QH15 of the National Assembly (abolishing business license fee from 1 January 2026); e-tax portal tax obligation lookup section

Suggested owner

Accounting

Self-check: Is the company filing monthly or quarterly? When was the most recent return filed? Are there any periods with no filing?

Why it matters

This return must be filed in every period even if there is no revenue. Most penalties for companies that neglect this come from failing to file this return for multiple consecutive periods, with penalties calculated per return.

Consequence if ignored

Penalty for late filing of tax returns based on the number of days late, calculated separately for each return (check the penalty amount in the currently effective penalty decree); if the delay is excessive and tax is owed, it may be treated as tax evasion. This is the largest source of penalties for companies that neglect it.

Frequency / timing

Monthly filing: deadline is the 20th of the following month; quarterly filing: deadline is the last day of the first month of the following quarter (according to the Law on Tax Administration; check for any updated regulations)

Where to look

Law on Tax Administration; currently effective decree guiding the deadline for filing tax returns

Suggested owner

Accountant

Self-check: In which periods were salaries paid and withholding made? What interpretation is the accountant applying for periods with no withholding?

Why it matters

If there is no withholding in a period, the return may not need to be filed, but the regulation on this has changed. It is advisable to confirm the current interpretation rather than assume.

Consequence if ignored

Penalty for late filing of the return based on the number of days, plus late payment interest on the tax withheld that is paid late (at 0.03% per day under the long-standing regulation — check the current rate).

Frequency / timing

Same period as value-added tax (VAT)

Where to look

Decree guiding the Law on Tax Administration, section on cases where tax return filing is not required

Suggested owner

Accountant

Self-check: Has advance payment been made each quarter? Does the total advance payment made meet the minimum ratio compared to the estimated full-year amount under the regulations?

Why it matters

There is no quarterly return form so it is often forgotten. If the total advance payments made during the year fall below the minimum ratio compared to the annual finalization amount, the shortfall is subject to late payment interest even if the full amount is paid by year-end.

Consequence if ignored

Late payment interest (at 0.03% per day under the long-standing regulation — check the current rate) on the shortfall compared to the minimum ratio, calculated from the deadline of the last quarter to the date of full payment. For large tax amounts this is a significant sum.

Frequency / timing

Quarterly

Where to look

Decree guiding the Law on Tax Administration, section on advance payments

Suggested owner

Accountant

Self-check: Have the finalization documents and financial statements for the previous year been filed, with a receipt? Do the figures match across all reports?

Why it matters

Even if there is a loss, the finalization documents and financial statements must still be filed. This is the set of documents that banks, major partners, and investors will ask for, so late filing or mismatched figures leave a record.

Consequence if ignored

Penalty for late filing of finalization documents and financial statements, each type of penalty calculated separately; banks and major partners refuse loan applications and bidding documents when financial statements have not been filed.

Frequency / timing

Annually; finalization dossier of the organization deadline is the last day of the 3rd month following the financial year (according to the Law on Tax Administration)

Where to look

Law on Tax Administration; Law on Accounting

Suggested owner

Accountant

Self-check: Were salaries paid to anyone in the previous year? Has finalization been filed? Have employees authorized to finalize signed the documents?

Why it matters

If salaries are paid at any time during the year, finalization must be done, even if no one reaches the threshold for paying tax. Often overlooked in small companies paying low wages.

Consequence if ignored

Penalty for late filing of finalization documents based on the number of days; employees cannot finalize their tax, leading to complaints.

Frequency / timing

Annually

Where to look

Decree guiding the Law on Tax Administration; circular on personal income tax (PIT)

Suggested owner

Accountant

Self-check: What corporate income tax (CIT) rate is the company applying? Based on revenue from which year? Does the company have a parent company or affiliated company?

Why it matters

From the 2025 tax period, Law on Corporate Income Tax 67/2025/QH15 has three rates: 20% standard rate, 15% for enterprises with annual total revenue not exceeding VND 3 billion, and 17% for enterprises with revenue above VND 3 billion to VND 50 billion. How to determine the revenue used as the basis and cases where the lower rate does not apply are set out in the guiding decree — check the currently effective version. Applying the wrong rate means under-paying or over-paying.

Consequence if ignored

Applying a rate lower than the correct one means under-reporting tax, resulting in back-tax assessment plus penalty for incorrect reporting and late payment interest calculated daily. Applying a rate higher than correct results in overpayment, and requesting a refund takes time.

Frequency / timing

Determined at the beginning of each year

Where to look

Law on Corporate Income Tax 67/2025/QH15 and guiding decree, section on tax rates

Suggested owner

Accountant

Self-check: Do accounting and purchasing staff understand the VND 5 million threshold? Does the purchasing process block cash payments above the threshold? How are multiple small invoices from the same supplier on the same day handled?

Why it matters

Under Law on Value-Added Tax 48/2024/QH15, purchase invoices of VND 5 million or more must have non-cash payment evidence to qualify for input credit — significantly lower than the previous threshold. The condition for deductibility as an expense when calculating corporate income tax (CIT) follows the implementing decree currently in force. Depositing cash into the seller's account is typically not considered non-cash payment.

Consequence if ignored

Loss of value-added tax (VAT) input credit and possible disallowance of expenses for invoices from the threshold upwards paid in cash. Tax reassessment plus penalties for incorrect declaration and late payment interest calculated daily.

Frequency / timing

Per transaction

Where to look

Law on Value-Added Tax 48/2024/QH15 and its implementing decree, provisions on input credit conditions

Suggested owner

Accountant

Self-check: Has a complete list of all foreign suppliers currently being paid to been compiled? Which suppliers have registered for tax in Vietnam and which have not? Has the company declared and paid contractor tax on any of these amounts?

Why it matters

Companies using foreign services such as cloud servers, advertising, software subscriptions, and artificial intelligence typically pay by card and make no declaration. During inspection, the tax authority cross-checks outbound cash flows and reassesses. Tax administration documents issued mid-2026 should be reviewed for provisions on foreign suppliers.

Consequence if ignored

Reassessment of contractor tax on all amounts paid abroad within the statute of limitations, plus penalties and late payment interest calculated daily; corresponding expenses may be disallowed. Usually the largest reassessment for technology companies.

Frequency / timing

Full review once, then per each payment thereafter

Where to look

Circular on contractor tax; guidance documents on the Law on Tax Administration currently in force, provisions on foreign suppliers (if any); list of foreign suppliers registered on the tax portal

Suggested owner

Accountant, tax advisor

Self-check: List of foreign subscribers of the company – which suppliers have registered for tax in Vietnam (search on the tax authority's foreign supplier portal)? For those amounts, is the accountant deducting value-added tax (VAT) (according to common understanding, it is not allowed)? Is the accountant self-excluding from expenses (possibly overpaying)? Has each amount retained all 5 types of documents: commercial invoice, contract or service terms, payment evidence, documents proving business use (employee-linked account, purpose), contractor tax file if any?

Why it matters

The most common case today: subscriptions to artificial intelligence tools, online office application suites, social media advertising, and search tools from foreign companies. When the supplier has registered for tax in Vietnam and self-declares, the company typically does not need to withhold contractor tax. However, the company receives only a foreign commercial invoice, not a Vietnamese VAT invoice and no contractor tax payment evidence, so under the prevailing interpretation it does not meet the conditions for VAT input credit; the expense may still be deductible for CIT purposes if documentation is complete. These two conclusions are independent, but accounting often conflates them. This is an area of significant interpretation variance — for large amounts, the company should consult the managing tax office in writing.

Consequence if ignored

Two opposite errors: claiming VAT input credit on these amounts, under the prevailing interpretation, is incorrect and triggers reassessment plus penalties and late payment interest calculated daily on the entire multi-year subscription; self-disallowing from expenses because 'no invoice' results in unnecessary overpayment of corporate income tax (CIT). Technology companies with dozens of such subscriptions accumulate large amounts.

Frequency / timing

Full review once; check when adding new subscriptions

Where to look

Decree implementing Law on Value-Added Tax 48/2024/QH15, provisions on input credit conditions; Decree implementing Law on Corporate Income Tax 67/2025/QH15, provisions on deductible expenses; guidance documents currently in force on declaration and payment of tax by foreign suppliers; list of foreign suppliers registered on the tax portal

Suggested owner

Accountant

Self-check: Are there any payments to individuals without an employment contract? Has withholding been made and withholding certificates issued?

Why it matters

When paying income of VND 2 million or more per transaction to an individual without an employment contract or with a contract of less than 3 months (contributors, freelancers, seasonal workers), 10% must be withheld before payment; individuals with low income may make a commitment statement according to the template in the current circular. Often overlooked because payment is made via personal bank transfer.

Consequence if ignored

The company is subject to back-assessed tax and must withhold in place of penalties and late payment interest, even though the money has been fully paid to the individual and cannot be recovered.

Frequency / timing

Each payment occasion

Where to look

Circular guiding the Law on Personal Income Tax, provisions on PIT withholding

Suggested owner

Accountant

Self-check: Did the company distribute profit during the year? Has withholding been made and declared?

Why it matters

Distribution of profit to members or individual shareholders triggers personal income tax from capital investment, and the company must withhold. Personal income tax has new guidance issued mid-2026 (Decree 253/2026/ND-CP, Circular 87/2026/TT-BTC) — review the rates and calculation methods according to the currently effective version.

Consequence if ignored

Back-assessed personal income tax from capital investment plus penalties and late payment interest. Easily detected through comparison with profit distribution resolutions and cash flows to personal accounts.

Frequency / timing

When distributing profit

Where to look

Law on Personal Income Tax currently in effect and guidance documents (Decree 253/2026/ND-CP, Circular 87/2026/TT-BTC)

Suggested owner

Accountant

Self-check: Does the company have transactions with any company under the same owner or manager? Has the related-party transaction annex been declared?

Why it matters

If an owner operates two or more companies and there are sales, service purchases, loans, shared personnel or office space between them, these are likely related-party transactions under the decree criteria. An annex must be declared with the annual finalization, a transfer pricing file may be required, and interest expenses are capped. Few small companies know they fall into this category.

Consequence if ignored

Failure to declare the annex is a separate penalty; the tax authority may determine transaction prices, adjust taxable income upward, and disallow interest expenses exceeding the ceiling. Back-assessed tax is typically large and spans multiple years.

Frequency / timing

Same period as annual finalization

Where to look

Decree 255/2026/ND-CP on tax management for enterprises with related-party transactions (check the currently effective version)

Suggested owner

Accountant, tax advisor

Self-check: Has a VAT rate table been prepared for each product and service code being sold? Are bundled sales (equipment with software) being split or combined for VAT purposes? Are any items being applied at 0% for foreign customers, and are all conditions met?

Why it matters

A company may sell many items subject to different VAT rates: software is exempt, equipment is standard-rated, services to foreign customers may be 0% but conditions have tightened under the new law, and some groups have temporary rate reductions by annual resolution. Applying the wrong rate to one group means errors across the entire invoice chain, declarations and input VAT credits.

Consequence if ignored

Applying the wrong rate to one product code means errors across many invoices over multiple periods: back-assessed output VAT plus penalties and late payment interest, and invoices must be adjusted with each customer.

Frequency / timing

Prepared once, reviewed when adding products or when new VAT reduction policies are introduced

Where to look

Law on Value-Added Tax 48/2024/QH15 and implementing decrees, provisions on non-taxable objects and tax rates; current VAT reduction resolutions if any

Suggested owner

Accountant

Self-check: Does the company qualify for any incentive? Has the year incentive begins been determined? Are there documents proving all conditions are met (e.g., software product certification)? Have prior-year losses been registered for carryforward?

Why it matters

Many incentive categories are missed or misapplied by small companies: incentives for software product manufacturing, 3-year CIT exemption for newly established small and medium enterprises under Resolution 198/2025/QH15, incentives for innovative startups, and loss carryforward to subsequent years. Each category has its own conditions regarding industry, documentation, timing, and some cannot be combined.

Consequence if ignored

Missing an incentive means overpaying tax for many years with no full recovery. Claiming an incentive without meeting conditions means back-assessed tax on the entire exempted amount plus penalties and late payment interest.

Frequency / timing

Determined once, reviewed each annual finalization period

Where to look

Law on Corporate Income Tax 2025 and implementing decrees, provisions on tax rate incentives, exemptions, reductions and loss carryforward; Resolution 198/2025/QH15 of the National Assembly

Suggested owner

Accountant, tax advisor

Self-check: Who is maintaining the file organized by the 7 stages for each software product? Are requirement, design, test plan, and handover documents filed by product? Has information been submitted to the sector management authority?

Why it matters

To claim software tax incentives, the company must prove it genuinely manufactures software following the prescribed process (2020 Circular describes 7 stages — check replacement text): requirement definition; analysis and design; programming and coding; testing and verification; finalization and packaging; installation, handover, warranty and maintenance; release and distribution. The minimum condition is performing at least one of the first two stages and maintaining documentation for each completed stage. The enterprise self-determines, takes responsibility, and submits information to the sector management authority for consolidation. Technical teams usually have sufficient documentation but scattered across locations, with no one organizing it according to this framework until an inspection occurs.

Consequence if ignored

Failure to provide proof results in loss of all software tax incentives for the entire period, with back-assessment of exempted tax plus penalties and late payment interest calculated from multiple prior years.

Frequency / timing

Prepared for each product, updated when major versions are released

Where to look

Circular of the Ministry of Information and Communications in 2020 on determining software product manufacturing activities meeting the prescribed process (check replacement text after ministry merger); Law on Corporate Income Tax 2025, incentives section

Suggested owner

Technical, accounting

Self-check: Does the accounting ledger separate revenue and expenses by activity? How are common expenses (management salaries, office) being allocated?

Why it matters

A software company receiving incentives but also selling equipment, consulting services, leasing, etc. cannot claim incentives on that other income. Revenue, expenses, and income must be separated by activity. If separation is not possible, the tax authority allocates by revenue ratio, which is usually disadvantageous.

Consequence if ignored

The tax authority reallocates by revenue ratio, typically shifting profit from incentivized activities to ordinary taxable activities, resulting in back-assessment of the difference plus penalties.

Frequency / timing

Set up once in the accounting system

Where to look

Law on Corporate Income Tax 2025 and implementing decree, provisions on incentive eligibility conditions; circular guidance on separate accounting of incentivized income

Suggested owner

Accounting

Self-check: Is there a written list of disallowed expenses from recent years with reasons? What are the non-deductible expense amounts on annual tax returns for each year? Does accounting review quarterly or only at year-end finalization?

Why it matters

Actual expenses that have been paid are not synonymous with expenses deductible when calculating corporate income tax (CIT). Three conditions must be met: serving business operations, supported by valid invoices and documents, and payment made without cash above the threshold. Accountants often only record entries without classification, and only during annual tax finalization do they overstate or understate deductions. A warning sign to watch for: the line item for non-deductible expenses on the annual tax finalization return equals 0 for many consecutive years. Law on CIT 67/2025/QH15 effective from the 2025 tax calculation period has changes to the list of deductible and non-deductible expenses — cross-check against the currently effective version, do not use the old list.

Consequence if ignored

Expenses disallowed on inspection constitute under-reported tax: back-assessment of tax plus penalties for false declaration and late payment interest calculated daily on the entire disallowed amount, covering multiple years within the statute of limitations.

Frequency / timing

Review each quarter; prepare list at annual finalization

Where to look

Law on Corporate Income Tax 67/2025/QH15, provisions on deductible and non-deductible expenses; 2025 implementing decree

Suggested owner

Accounting, tax advisor

Self-check: Going through each of the 12 items, does the company have any? Is that item being recorded as deductible or already self-excluded? For items still salvageable (adding contracts, policies, reimbursement documents, substitute tax filing), has this been done?

Why it matters

These are items nearly every small company has and nearly every inspection questions: (1) foreign services paid by card with no invoice, contractor withholding tax not filed; (2) expenses paid by director or employee personal card without delegation authority policy and reimbursement documents; (3) house or vehicle rental from individuals with no contract, no payment documents, no substitute tax filing when exceeding threshold; (4) expenses from the mandatory transfer threshold paid in cash (for VAT input credit from VND 5 million under Law 48/2024/QH15; for CIT expenses check implementing decree); (5) direct employee benefits (travel, birthday, condolences) exceeding average salary limits; (6) clothing expenses exceeding limits; (7) personal loan interest exceeding ceiling, or interest on unpaid charter capital; (8) asset depreciation with no invoice, not in company name, vehicles under 9 seats with price exceeding threshold; (9) administrative penalties, tax late payment interest; (10) salaries and bonuses not paid by finalization deadline, bonuses outside policy; (11) purchases from individuals with no invoice but no itemized list per template; (12) expenses with no invoice, only internal payment vouchers. Each item has a correct solution if done from the start; if done later, most cannot be salvaged.

Consequence if ignored

Each disallowed item constitutes under-reported corporate income tax: back-assessment of tax corresponding to the disallowed expense (at the applicable rate), plus penalties for false declaration and late payment interest calculated daily. These items recur monthly, so accumulated back-assessments over multiple years typically exceed estimates.

Frequency / timing

Review each quarter

Where to look

Decree implementing Law on Corporate Income Tax 2025, provisions on non-deductible expenses; circular guidance on deductible expenses still in effect

Suggested owner

Accounting

Self-check: Does the company have non-taxable value-added tax activities? If so, by what ratio is shared input currently apportioned, and has it been recalculated at year-end? Is there a list of input invoices not eligible for credit with reasons? Has the non-creditable portion been correctly reclassified to expenses?

Why it matters

Not all input invoices are eligible for credit. Credit is denied when: input serves non-taxable activities (for example, a company selling software in a non-taxable category cannot credit input VAT used solely for that software; shared input must be apportioned by revenue ratio), payment documentation is missing for non-cash transactions, invoices are from enterprises that have absconded or pose risk, invoices have incorrect buyer name or tax code, motor vehicles under 9 seats with price exceeding the threshold, foreign services where the contractor has not paid tax on behalf. Non-creditable portions may be treated as expenses if conditions are met, but must be properly separated.

Consequence if ignored

Excess credit results in recovery of the amount incorrectly credited plus penalties and late payment interest calculated daily. For companies with non-taxable activities that credit all input VAT, the recovery amount is typically large.

Frequency / timing

Audit by filing period; recalculate apportionment ratio at year-end

Where to look

Law on Value-Added Tax 48/2024/QH15 and implementing decrees; provisions on input VAT credit and apportionment

Suggested owner

Accountant

Self-check: Which statute of limitations period do known old errors fall within? Are there any errors that should be voluntarily amended now? Under current rules, voluntary amendment before the tax authority issues an inspection or audit decision typically requires payment only of unpaid tax and late payment interest — verify against current regulations.

Why it matters

Once the statute of limitations expires, no penalty applies, but unpaid tax and late payment interest must still be paid within a much longer recovery period. The statute varies by type of violation — invoices, tax procedures (late return filing, late registration), incorrect reporting resulting in underpayment, tax evasion — and by field (social insurance, labour, accounting); cases with no tax registration have separate recovery rules. Check the correct provision in the currently effective legal text, not based on hearsay figures. Understanding the statute is for prioritizing old file processing, not for waiting out the deadline.

Consequence if ignored

This is not a separate penalty item, but a tool for prioritization. Misunderstanding it as 'once the penalty statute expires, the matter is closed' leads to overlooking unpaid tax that is still subject to recovery with late payment interest; correct understanding means proactively filing amended returns to reduce penalty risk.

Frequency / timing

Audit when old errors are discovered; full audit before each annual finalization

Where to look

Law on Tax Administration, provisions on statute of limitations for penalties and recovery period; Decree 125/2020/ND-CP on administrative penalties for tax, invoice violations and amending documents (check currently effective version); Law on Administrative Violations

Suggested owner

Accountant, tax advisor

Self-check: Is the salary and bonus regulation documented in writing? Are all bonuses currently paid included in the regulation?

Why it matters

Salary, bonus, and allowances are deductible only when recorded in a contract, regulation or agreement and supported by payment documentation. Ad-hoc bonuses outside the regulations are typically disallowed.

Consequence if ignored

Salary, bonus not included in the regulations or lacking documentation is excluded from expenses, resulting in recovery of corresponding corporate income tax plus penalties.

Frequency / timing

Update when changed

Where to look

Circular providing guidance on expenses deductible in calculating corporate income tax

Suggested owner

Accountant, human resources

Self-check: When does the accountant issue invoices: when payment is received, when service is completed, or at month-end? Does that align with current regulations?

Why it matters

Issuing invoices late relative to service completion or payment receipt is the most common error and carries a separate penalty. Mid-2026 brings new guidance on invoices and electronic documents (Decree 254/2026/ND-CP, Circular 91/2026/TT-BTC) — cross-check the timing rules against the currently effective version.

Consequence if ignored

Administrative penalty for incorrect invoice timing (check the amount in the currently effective penalty decree); if it results in late tax payment, additional penalties for underpayment and late payment apply.

Frequency / timing

Per transaction

Where to look

Decree 123/2020/ND-CP, Decree 70/2025/ND-CP amending it; Decree 254/2026/ND-CP and Circular 91/2026/TT-BTC on invoices and electronic documents — check currently effective version

Suggested owner

Accountant

Self-check: Is there a procedure to verify buyer information before issuing an e-invoice? What is the proportion of e-invoices that must be adjusted or replaced during the year?

Why it matters

If the buyer's tax code is incorrect, the tax rate is wrong, or mandatory content is missing, the buyer cannot claim input VAT credit and the seller must perform an adjustment procedure. This wastes time for both parties.

Consequence if ignored

Minor administrative penalty for the seller; the buyer cannot claim input VAT credit, must process an adjustment, and customer relationships are affected more than the penalty amount.

Frequency / timing

Per transaction

Where to look

Decree on e-invoices and supporting documents, provisions on e-invoice content

Suggested owner

Accountant

Self-check: Does the accountant have a written procedure for each type of defect? How many e-invoices required adjustment or replacement during the year, and what are the main causes?

Why it matters

Once an e-invoice is submitted to the tax authority, it cannot be directly amended. Depending on the type of error (not yet sent to the buyer, information error with no financial impact, amount or tax rate error), it must be handled by cancellation, adjustment, or replacement, and a defect notification must be sent to the tax authority in the prescribed form. Incorrect handling or failure to notify is penalised even if the final e-invoice is correct.

Consequence if ignored

Administrative penalty for each violation of procedure or failure to notify of defects; incorrectly cancelled e-invoices are treated as failure to issue an e-invoice, with a higher penalty range.

Frequency / timing

When the defect arises

Where to look

Decree on e-invoices and supporting documents and amending decrees, provisions on handling defective e-invoices

Suggested owner

Accountant

Self-check: Does the company sell directly to consumers? Does it fall within a mandatory industry group?

Why it matters

Sale of goods or provision of services directly to consumers in certain industry groups must use e-invoices from cash registers connected to the tax authority.

Consequence if ignored

If the entity is required to use them but does not, it is treated as failure to issue e-invoices in compliance with regulations, and is penalised for each violation (refer to penalty levels in the current penalty decree).

Frequency / timing

One-time inspection

Where to look

Decree 123/2020/ND-CP as amended by Decree 70/2025/ND-CP; new e-invoice guidance for 2026 — refer to the current version in force

Suggested owner

Accountant

Self-check: Does the accountant verify the status of suppliers before recording large e-invoices?

Why it matters

Receiving e-invoices from tax-evading enterprises or high-risk enterprises results in disallowance of expenses and may be treated as e-invoice trading. The tax authority has public lookup tools.

Consequence if ignored

E-invoices from tax-evading enterprises are disallowed as expenses and input VAT credit is rejected, with back-tax and penalties; large quantities may trigger investigation for e-invoice trading and criminal liability.

Frequency / timing

Monthly

Where to look

E-invoice portal of the tax authority; list of high-risk enterprises

Suggested owner

Accountant

Self-check: Are there any workers without a written contract? Have any fixed-term contracts been signed more times than permitted?

Why it matters

A person who receives wages and is subject to management is in an employment relationship, regardless of what it is called. A fixed-term contract may be signed only a limited number of times before conversion to an indefinite-term contract, and cannot be extended by addendum.

Consequence if ignored

No written contract: penalty based on number of workers (refer to penalty levels in the current penalty decree). Signing the wrong type: in case of dispute, the court treats it as an indefinite-term contract, with significantly higher termination costs.

Frequency / timing

Per worker, according to expiry schedule

Where to look

Labour Code, provisions on contract formation, contract types, addenda

Suggested owner

Human Resources

Self-check: What is the probation period currently applied for each position? What percentage of the regular wage is the probation wage?

Why it matters

Probation duration is limited according to the nature of the work, and probation wages have a minimum level. Excessive probation or multiple probation periods for the same position is a violation.

Consequence if ignored

Administrative penalty (refer to penalty levels in the current penalty decree), and obligation to pay full wages for probation periods exceeding the limit or payment below the minimum wage.

Frequency / timing

Per worker

Where to look

Labour Code, provisions on probation

Suggested owner

Human Resources

Self-check: Does the current employment contract contain clauses on ownership of work products and confidentiality?

Why it matters

For technology companies, the products created by employees are the largest asset. The law has provisions on works created under assignment, but stating it clearly in the contract avoids future disputes. Information confidentiality and trade secrets should also have separate clauses.

Consequence if ignored

No administrative penalty, but when an employee leaves and takes source code, data, customers, the company has no clear basis to claim or prevent it. For technology companies this is a survival risk.

Frequency / timing

All contracts

Where to look

Labor Code, provisions on contract content; Law on Intellectual Property

Suggested owner

Human Resources, Legal Affairs

Self-check: Is there a labor management register, in paper or electronic form? Was notification made when operations commenced?

Why it matters

Enterprises must establish a labor management register and notify the use of labor when commencing operations. Few small companies know of these two obligations until inspected.

Consequence if ignored

Separate administrative penalty for missing labor management register and for failure to notify (check penalty amounts in the current penalty decree).

Frequency / timing

Established once, updated continuously

Where to look

Labor Code; decree guiding labor management

Suggested owner

Human Resources

Self-check: Has the most recent reporting period been submitted? To which authority, through which channel?

Why it matters

This report is submitted multiple times per year, not once. The receiving authority changed after the 2025 machinery reorganization; submission is now through the public service portal.

Consequence if ignored

Administrative penalty for each reporting period not submitted (check penalty amounts in the current penalty decree).

Frequency / timing

Periodically during the year as prescribed

Where to look

Decree guiding the Labor Code on labor use reporting, current version

Suggested owner

Human Resources

Self-check: Does the company have written work rules? Have they been registered? Has the current number of employees reached the mandatory threshold?

Why it matters

From a certain number of employees, work rules must be in writing and registered with the labor management authority. Without registered work rules, disciplinary action against anyone is nearly impossible to enforce lawfully.

Consequence if ignored

Administrative penalty (check penalty amounts in the current penalty decree). Greater risk: discipline and dismissal not based on registered work rules is unlawful and requires reinstatement and compensation.

Frequency / timing

Once, re-registered when amended

Where to look

Labor Code, provisions on work rules

Suggested owner

Human Resources

Self-check: Is there a written wage scale and table? Has it been posted? Is the minimum wage in the scale higher than the current regional minimum wage?

Why it matters

No longer required to be submitted to state authorities, but must still be developed, consult with worker representative organizations if any, and posted at the workplace. This also provides a basis for the wage level used for social insurance contributions.

Consequence if ignored

Administrative penalty (check penalty amounts in the current penalty decree). Without a wage scale and table, the wage level for social insurance contributions lacks a basis when inspected.

Frequency / timing

Updated when changed

Where to look

Labor Code, provisions on wage scale development; decree on current regional minimum wage

Suggested owner

Human Resources

Self-check: Are there democracy regulations? When was the most recent periodic dialogue held, and are there minutes?

Why it matters

From a certain number of employees, the company must have grassroots democracy regulations and organize periodic dialogue with minutes. Few companies do this, but it is a common labor inspection and inquiry item.

Consequence if ignored

Administrative penalty (check penalty amounts in the current penalty decree). Rarely inspected separately, usually asked about when labor complaints arise.

Frequency / timing

Periodically annually

Where to look

Labor Code; decree guiding dialogue at the workplace

Suggested owner

Human Resources

Self-check: Is there a leave tracking record for each employee? Is the calculation of leave days based on seniority correct?

Why it matters

Annual leave increases with seniority. Upon contract termination, unused leave must be paid. Failure to track leave easily causes disputes at separation.

Consequence if ignored

Must pay for unused leave upon contract termination; disputes arise at separation; administrative penalty if leave is not granted or not paid.

Frequency / timing

Annually

Where to look

Labour Code, provisions on annual leave

Suggested owner

Human Resources

Self-check: Is there a written procedure for contract termination? Was the most recent separation payment made in full and on time?

Why it matters

This is the most common source of litigation. Notice period, amounts to be paid, payment deadline, severance allowance for periods without unemployment insurance coverage, all have specific regulations.

Consequence if ignored

Unlawful termination: must rehire the worker, pay wages and social insurance for the entire period of non-work, plus compensation under the Labour Code; if not rehired, additional compensation is due. Litigation may be prolonged.

Frequency / timing

Case by case

Where to look

Labour Code, provisions on contract termination and responsibilities upon termination

Suggested owner

Human Resources

Self-check: Does the company hire foreign workers, including remote work? Are permits still valid?

Why it matters

Hiring foreign workers requires a work permit or exemption certificate, and a separate report. Remote work for a Vietnamese company also needs to be considered.

Consequence if ignored

Administrative penalties based on number of workers (check rates in the current penalty decree); workers may be deported; contracts may be voided.

Frequency / timing

According to permit validity

Where to look

Decree on foreign workers working in Vietnam

Suggested owner

Human Resources

Self-check: Have workers requested to establish a union? Does the company understand this is their right?

Why it matters

Establishment of a grassroots union is a right of workers, not an obligation of the company. However, the company must not obstruct it and must provide conditions when workers wish to establish one. Union funding must be paid by the company regardless of whether a grassroots union exists; see insurance section.

Consequence if ignored

Obstruction of union formation is subject to penalties and may result in litigation. Misunderstanding it as a company obligation does not incur penalties, only wasted effort.

Frequency / timing

When it arises

Where to look

Law on Trade Unions 2024

Suggested owner

Human Resources

Self-check: When was the most recent collective health examination? Are records kept?

Why it matters

Mandatory for all workers, minimum frequency set by law. Office companies often overlook this thinking it applies only to factories.

Consequence if ignored

Penalties based on number of workers not examined (check rates in the current penalty decree). In case of accident or occupational disease, lack of examination records is a significant disadvantage.

Frequency / timing

Periodic annually

Where to look

Law on Occupational Safety and Health, provisions on health examination

Suggested owner

Human Resources

Self-check: Are new employees trained? Are there records and signed attendance lists?

Why it matters

Workers must be trained by category. Office staff and IT personnel fall under the company self-organized category, but records proving training must still be maintained.

Consequence if ignored

Penalties based on number of workers not trained (check rates in the current penalty decree). In case of workplace accident, lack of training records increases the company's liability.

Frequency / timing

Initial and periodic as required

Where to look

Decree guiding the Law on Occupational Safety and Health on training

Suggested owner

Human Resources

Self-check: Who is assigned responsibility? Has the most recent report been submitted?

Why it matters

Must assign a person responsible for occupational safety and health work and submit periodic reports, including workplace accident reports even when no accidents occur.

Consequence if ignored

Administrative penalties for failure to assign or report (check rates in the current penalty decree).

Frequency / timing

Periodic during the year

Where to look

Law on Occupational Safety and Health; decree providing guidance on reporting

Suggested owner

Human Resources

Self-check: Does the office lease contract clearly specify each party's fire prevention responsibilities? Does the company have its own fire prevention documentation?

Why it matters

Rented offices in a building must still have internal regulations, plans, equipment and clearly defined responsibilities with the building owner. The new law takes effect in 2025.

Consequence if ignored

Administrative penalties; may be subject to temporary business suspension; in case of fire, absence of documentation and plans is grounds for holding the head of the organization liable.

Frequency / timing

Annual inspection

Where to look

Law on Fire Prevention, Fire Suppression and Rescue Operations 2024

Suggested owner

Administration

Self-check: Is anyone working without social insurance contributions? What is the reason, and is it compliant with the law?

Why it matters

The 2024 Law on Social Insurance has expanded the scope of compulsory contributions to include short-term contracts — check the minimum contract duration applicable under the current law; do not rely on old thresholds. Arrangements under a different name but involving wage payment and management control are also treated as labour contracts.

Consequence if ignored

Recovery of all unpaid amounts plus late payment interest calculated daily; administrative penalties based on the ratio of unpaid amounts (refer to rates in the current enforcement penalty decree); evasion of large amounts may result in criminal prosecution.

Frequency / timing

Continuous

Where to look

Law on Social Insurance 2024, provisions on persons participating

Suggested owner

Human Resources

Self-check: Do the company managers receive salary? If not, have they registered for social insurance contributions under this category?

Why it matters

From mid-2025, directors, company owners and members of the board of management not receiving salary still fall within the scope of compulsory social insurance contributions and must contribute on a self-selected basis within the prescribed range. This is a new provision that many founders are unaware of; previously, not receiving salary meant no contribution obligation.

Consequence if ignored

Recovery of contributions from the date the 2024 Law on Social Insurance takes effect, plus late payment interest; penalties as for contribution evasion. The amount may not be large but is easily detected through cross-reference with enterprise registration.

Frequency / timing

Monthly or according to the selected period

Where to look

Law on Social Insurance 2024 and implementing decree, provisions on managers not receiving salary

Suggested owner

Human Resources, Accounting

Self-check: Has the most recent new employee been reported within the deadline? Has the most recent departing employee been reported as a decrease?

Why it matters

Registration for new participants is calculated from the date the labour contract is signed. Late reporting of increases and decreases results in recovery and interest charges.

Consequence if ignored

Recovery of contributions plus late payment interest for the period of delayed reporting; administrative penalties. Late reporting of decreases means the company bears the contribution cost for the person who has left.

Frequency / timing

Within the month of occurrence

Where to look

Law on Social Insurance 2024; collection procedures of the social insurance authority

Suggested owner

Human Resources

Self-check: How does the salary used for social insurance contributions compare to actual wages paid and to the current regional minimum wage?

Why it matters

The salary used for social insurance contributions must not be lower than the regional minimum wage and is subject to a ceiling as prescribed. Contributing on a salary lower than actual wages paid is a risk of recovery upon inspection, as the social insurance authority can cross-reference with tax data.

Consequence if ignored

Contributing below the correct level constitutes contribution evasion: recovery of the shortfall plus interest and penalties based on the ratio of underpaid amounts (refer to rates in the current enforcement penalty decree); the social insurance authority can cross-reference with tax data so batch detection is likely.

Frequency / timing

At the beginning of each year and when salary changes

Where to look

Law on Social Insurance 2024; decree on current regional minimum wage

Suggested owner

Human Resources, Accounting

Self-check: Do labour contracts clearly separate the base wage, each type of allowance, supplementary amounts and benefits into distinct line items? Are bonuses and performance incentives governed by a written scheme? Are there any items called 'allowances' but paid as fixed monthly amounts to everyone? Can the difference between the salary contributed for social insurance and the taxable income of each person be explained?

Why it matters

Salary forming the contribution base comprises 3 components: the wage rate according to the job or position, salary allowances tied to working conditions, and other supplementary amounts if simultaneously determined with a specific amount, recorded in the contract and paid evenly each period. Not counted for contribution: bonuses, commissions, amounts varying by productivity or business results, and separate benefits (meal allowance, fuel, telephone, housing, child support, gifts, birthday allowance). This means the fixed salary must be contributed in full, the variable commission portion is not subject to contribution, but must be clearly stated and separately itemized in the contract and payroll. Greatest risk: the insurance authority cross-checks the contributed salary against income reported on the personal income tax annual finalization; a large discrepancy that cannot be explained by regulations results in recovery of the entire package.

Consequence if ignored

Items called 'allowances' but paid as fixed amounts are treated as salary and result in recovery for all employees for the entire period, plus interest and penalties. This is the most common type of social insurance recovery.

Frequency / timing

Review when drawing up contracts, when salary changes, and annually against the personal income tax annual settlement

Where to look

Law on Social Insurance 2024, provisions on contribution basis; current implementing decree, provisions on salary as contribution basis; guidance documents from the labour and social insurance management authorities

Suggested owner

Human Resources, Accounting

Self-check: Is the company currently paying the trade union fund? To which organization? Does it qualify for any exemption or reduction?

Why it matters

The company must pay the trade union fund calculated on the payroll subject to social insurance, whether or not a grassroots trade union has been established. If not established, payment is made to the higher-level trade union. Cases of exemption, reduction, or temporary suspension of payment are specified in the currently effective decree on trade union finance.

Consequence if ignored

Recovery of unpaid trade union fund plus interest; penalty calculated as a percentage of the late payment amount (refer to the penalty rate in the currently effective decree).

Frequency / timing

Monthly or according to the announced filing period

Where to look

Law on Trade Unions 2024; currently effective decree on trade union finance

Suggested owner

Accountant

Self-check: What personal data is the company collecting and storing, from whom, and for what purpose? Has anyone read the new law yet?

Why it matters

The new law takes effect at the beginning of 2026, replacing the old decree, with new implementing regulations. Any company that stores customer names, phone numbers, or email addresses falls within its scope. Penalties are significantly higher than before.

Consequence if ignored

Highest penalty framework in this checklist: certain violations are penalized as a percentage of revenue; other violations also carry significantly higher penalties than before (refer to the currently effective law and decree); the company may be ordered to suspend data processing, meaning suspension of services.

Frequency / timing

Once; review again when changes occur

Where to look

Law on Protection of Personal Data 2025 and currently effective implementing regulations

Suggested owner

Legal affairs, technology

Self-check: Does the website or application have a privacy policy? How do users give consent, and is evidence of consent retained?

Why it matters

The company must disclose the purpose, type of data, retention period, and third parties receiving the data. Consent must be separate and verifiable, not bundled into general terms and conditions.

Consequence if ignored

Processing personal data without valid consent is a core violation, penalized under the law's framework; all marketing activities based on such data may be ordered to cease.

Frequency / timing

Update when changes occur

Where to look

Law on Protection of Personal Data 2025, provisions on consent and notification

Suggested owner

Legal affairs, technology

Self-check: If a customer requests deletion of all their data, can the company do so, and within what timeframe?

Why it matters

Customers have the right to request access, correction, deletion, or withdrawal of consent. The company must process such requests within the deadline. Many systems lack the functionality to delete user data.

Consequence if ignored

Failure to respond to requests for deletion or access within the deadline is a violation that may be reported directly to the managing authority; penalty under the law's framework.

Frequency / timing

Continuous operation

Where to look

Law on Protection of Personal Data 2025, provisions on rights of data subjects

Suggested owner

Technology

Self-check: Does the company qualify for exemption? Does it process financial, health, or location data? How many individuals' data does it hold?

Why it matters

The file must be prepared and submitted to the competent authority within the deadline from the start of processing. Small enterprises and startups may choose not to prepare it for a certain initial period; household businesses and micro-enterprises are exempt. However, exemption does not apply if the company processes sensitive data, provides data processing services, or processes data of a large number of individuals.

Consequence if ignored

If the company falls within the mandatory scope but has no assessment file, it is penalized under the law's framework and ordered to suspend processing until the file is completed. For companies processing financial or health data, this is the first item inspectors ask about.

Frequency / timing

Once; update when changes occur

Where to look

Law on Protection of Personal Data 2025 and implementing regulations, provisions on exemptions and impact assessment files

Suggested owner

Legal affairs

Self-check: Has the company listed all foreign service providers currently receiving customer or employee personal data? Does the submitted file match the actual list, especially artificial intelligence tools and services added after submission? Are there data processing contracts or agreements with each recipient? Does the company qualify for exemption (micro-enterprise, household business, except if its business is data processing, sensitive data, or large-scale data)?

Why it matters

Three scenarios are all considered transfers abroad: moving data stored in Vietnam to servers outside Vietnam, including cloud computing; transferring to organizations or individuals abroad; using a platform located abroad to process data collected in Vietnam. This means using foreign cloud services, office software suites, artificial intelligence tools, sending marketing emails, conducting analytics, or holding online meetings with customer or employee data all fall within scope. A separate file must be prepared and submitted to the competent authority, not included in the standard impact assessment file. The file comprises a cross-border data transfer impact assessment report in the prescribed form, a contract or agreement for data transfer with the recipient, documentation proving data protection policies and procedures, and a notice of file submission. Submission is within the deadline from the first transfer; it is done once but must be updated when the recipient changes or the data type changes. The competent authority may request supplementation or order suspension of transfers.

Consequence if ignored

Transferring personal data abroad without a file is an act with a penalty framework calculated as a percentage of revenue (refer to the currently effective law); the company may be ordered to stop transfers, meaning suspension of foreign cloud services.

Frequency / timing

Before transfer; update procedure when adding a recipient or new data type

Where to look

Law on Protection of Personal Data 2025, provisions on cross-border data transfer; currently effective implementing regulations, provisions on scope of transfer, files, procedures, and exemptions; assessment report form and notification form attached to the decree

Suggested owner

Legal affairs, technology

Self-check: Do contracts with suppliers that access data contain clauses on personal data?

Why it matters

Server providers, technical partners, and agents accessing customer data on behalf of the company are data processors. Contracts with them must include personal data protection clauses.

Consequence if ignored

When the supplier exposes data, the company remains liable to customers and regulatory authorities without grounds to claim against the other party.

Frequency / timing

Review all supplier contracts

Where to look

Law on Personal Data Protection 2025, section on data processor

Suggested owner

Legal affairs

Self-check: If data is exposed tonight, who does what, who is notified, and within how long?

Why it matters

When an incident occurs, the company must notify the competent authority within the prescribed deadline. Without a ready procedure, notification will be delayed.

Consequence if ignored

Failure to notify within the deadline is a separate violation in addition to the underlying violation; reputational damage and civil compensation to customers.

Frequency / timing

Once, with periodic drills

Where to look

Decree guiding the Law on Personal Data Protection, section on breach notification

Suggested owner

Technical, legal affairs

Self-check: Has the company's system been assigned a security level? Does the sector in which the company operates have specific information security requirements?

Why it matters

Information systems must be classified by security level and have an approved security level proposal document, especially for systems serving multiple users or sectors with specific requirements.

Consequence if ignored

Administrative penalties for information security; for sectors with specific requirements (finance, payments), missing security level documentation affects licensing and cooperation with banks.

Frequency / timing

Once, review again when systems change

Where to look

Law on Cybersecurity; decree on ensuring information system security by level

Suggested owner

Technical

Self-check: Does the company fall within the service group required to store data domestically? Where is data currently stored?

Why it matters

Certain types of data and certain types of services must be stored in Vietnam.

Consequence if ignored

If the company falls within the scope and stores data abroad, it will be required to transfer it within a deadline, face administrative penalties, and may be restricted from providing services.

Frequency / timing

Check once

Where to look

Law on Cybersecurity and decree guiding data storage

Suggested owner

Technical, legal affairs

Self-check: Does the company's product use artificial intelligence that interacts with users? Has anyone read these two laws yet?

Why it matters

The Law on Data and the Law on Digital Technology Industry take effect in 2025 and 2026, imposing new obligations on critical data and artificial intelligence systems. Companies with products using artificial intelligence should review.

Consequence if ignored

No specific sanctions yet, but this is a tightening trend for coming years; companies with artificial intelligence products should monitor to avoid surprises.

Frequency / timing

Once

Where to look

Law on Data 2024; Law on Digital Technology Industry 2025

Suggested owner

Legal affairs, technical

Self-check: Has the company name and main product name been filed for trademark registration? Who holds the certificate?

Why it matters

Vietnam follows the principle that the first to file has priority, not the first to use. Many cases exist where companies built a major brand only to discover someone else had already registered that name.

Consequence if ignored

If another party registers first, they have the right to force the company to change its name, rebrand, remove products, and claim compensation. The cost of rebranding after several years of operation is many times higher than the registration fee.

Frequency / timing

Renew according to certificate term

Where to look

Law on Intellectual Property, trademark section; search portal of the Intellectual Property Office

Suggested owner

Legal affairs

Self-check: Have you inventoried all software in use? For each software in use, which version are you using, and do the terms permit organizational use?

Why it matters

Software has versions for individuals, families, and students with low or no cost, but the terms prohibit use in organizations or for commercial purposes. Using that version in a company is a copyright infringement even if you have paid for it.

Consequence if ignored

Copyright inspectors may arrive unexpectedly; administrative penalties plus compensation based on copyright value for all infringing machines; commercial-scale violations may result in criminal prosecution. Reputational damage when dealing with foreign partners.

Frequency / timing

Periodic inventory

Where to look

Terms of use from each vendor; Law on Intellectual Property

Suggested owner

Administration, IT

Self-check: What open-source licenses do the libraries used in your company's products fall under? Are there any licenses that require source code disclosure?

Why it matters

Open source does not mean you can use it any way you want. Some licenses require disclosure of product source code if integrated; some restrict commercial use. Companies with software products need to audit the libraries in use.

Consequence if ignored

License violation may result in mandatory disclosure of product source code or removal of libraries; civil litigation from the copyright holder; impact on due diligence when raising capital or selling the company.

Frequency / timing

Each time a major library is added

Where to look

Terms of each open-source license

Suggested owner

IT

Self-check: Who drafted the standard contracts and service terms, and when were they last reviewed? Do they align with your privacy policy?

Why it matters

Standard contracts, service terms, refund policies, and quality commitments must align with the new consumer protection law and personal data protection policy. Standard terms unfavorable to consumers may be void.

Consequence if ignored

Unfavorable standard terms for consumers are void; penalties under consumer protection law; disputes over refunds and service lack a basis for resolution.

Frequency / timing

Annual review

Where to look

Law on Protection of Consumer Rights 2023; Law on Commerce; Civil Code

Suggested owner

Legal

Self-check: Does your company's website have order placement, shopping cart, or payment functions? Have you notified or registered it?

Why it matters

A website with order placement, payment, or a marketplace for third-party sellers must be notified or registered with the Ministry of Industry and Trade. Many e-commerce websites skip this step.

Consequence if ignored

Administrative penalties for failure to notify or register a platform (check the amount in the current penalty decree); may be required to remove sales functions.

Frequency / timing

Once; update when changes occur

Where to look

Decree on e-commerce and related amending decrees

Suggested owner

Legal

Self-check: Do you have a standard confidentiality agreement template? Does your process for sharing information with external parties require signing beforehand?

Why it matters

Partners, suppliers, and candidates who see internal information should sign a confidentiality agreement first. Without it, there is no legal basis to address a leak.

Consequence if ignored

No penalty, but if an external party discloses information, plans, prices, or customers, the company has no legal basis to claim damages.

Frequency / timing

Before sharing information

Where to look

Civil Code; Law on Intellectual Property, section on trade secrets

Suggested owner

Legal

Self-check: Who currently holds the seal, and is there a handover record clearly stating responsibility? Is there a regulation stating that the seal may only be affixed after authorization by a competent person? Is there a log tracking seal use on documents sent outside? Are unauthorized sealing and suspended seals prohibited?

Why it matters

The law allows companies to decide on their seals and management methods; there is no longer a seal template registration procedure. This means all responsibility lies with internal regulations. The director typically does not affix the seal personally but delegates to accounting or administration; however, without a regulation and handover record, if the seal is affixed to unapproved documents, affixed without authorization on blank paper, or affixed to unfavorable contracts, the company remains liable to external parties and it is very difficult to hold individuals internally accountable.

Consequence if ignored

Seal affixed to unapproved documents, affixed without authorization, or affixed to unfavorable contracts: the company must still perform with external parties; it is difficult to hold individuals accountable internally without a regulation and handover record.

Frequency / timing

Establish regulation once; handover record each time the custodian changes

Where to look

Law on Enterprises 2020, provisions on company seals; charter and internal regulations

Suggested owner

Director, Administration

Self-check: On electronic banking, who has the right to initiate instructions and who has the right to approve them? Is there anyone who can both initiate and approve? Where is the approver's authentication device located? Are there limits by transaction and by day? Is it mandatory that a payment request be approved before the instruction is initiated?

Why it matters

Basic principle: the person who initiates an instruction must not be the person who approves it. All corporate electronic banking systems have mechanisms for initiating accounts and approving accounts, with limits by person, by transaction, by day, and fixed beneficiary lists. If the accountant can both initiate and approve, or if the director hands the authentication device to the accountant to avoid inconvenience, the company has no control layer before money leaves—detection only occurs after reviewing the subsidiary ledger. This is the most common embezzlement scenario in small companies, often lasting many years before discovery.

Consequence if ignored

Risk of embezzlement by company insiders with no preventive layer; typically discovered after many years with large sums. Recovery is difficult and litigation is prolonged.

Frequency / timing

Set up once; review authorization quarterly and when personnel change

Where to look

Internal financial regulations; authorization guidelines from each bank; circulars from the State Bank on safety and security of online banking services

Suggested owner

Director, accountant

Self-check: Have all possible methods to create payment instructions from the company account been listed? Who holds each method? Is the company's digital signature registered as an authentication method on electronic banking? Whose phone number receives the authentication code?

Why it matters

Beyond the login account, money can leave through many means: the bank's token generator, authentication codes sent to a particular phone number, digital signature if the bank accepts digital signature as an authentication method for the company account, e-tax account that directly debits from the bank, company card, wallet or linked payment gateway. Each is a channel. If no one lists them all, the company does not know which channels are open and who holds the keys.

Consequence if ignored

An unmonitored payment channel is a pathway for embezzlement or fraud; if the company does not know how many channels it has, it cannot close any of them.

Frequency / timing

Inventory quarterly

Where to look

Contracts and service configuration with each bank; internal regulations

Suggested owner

Director, accountant, technical staff

Self-check: Who holds cash and who records the cash ledger—is it the same person? What is the current cash balance, when was the last inventory, and is there a record? Are there any overdue advances that have not been repaid?

Why it matters

The person holding cash must not simultaneously be the person recording the books. Small companies often have the accountant also serve as cashier, with the cash book and accounting ledger written by one person, so they always match even though the actual cash may have diverged. It is necessary to set a standard cash balance, conduct periodic and surprise cash counts with minutes, limit advances with repayment deadlines, and restrict cash payments to small amounts below the mandatory bank transfer threshold. For service and technology companies, the best control method is to bring cash close to 0 and use a company card with a spending limit.

Consequence if ignored

Prolonged cash loss goes undetected when one person both holds cash and keeps records; overdue advances become bad debts when that person leaves.

Frequency / timing

Monthly inventory and surprise checks

Where to look

Law on Accounting, provisions on asset inventory; internal financial regulations

Suggested owner

Director, accountant

Self-check: Who reconciles the monthly bank subsidiary ledger with the accounting ledger, and is that person the one initiating instructions? Does the director receive notifications of balance changes? When did the director last independently review the subsidiary ledger?

Why it matters

Four functions should be performed by different people: requesting payment, approving payment, executing payment, and recording and reconciling. Small companies may not have enough staff to fully segregate, so at minimum the approver and the person reconciling the bank subsidiary ledger must not be the person executing. The director should receive notifications of balance changes and review the subsidiary ledger periodically on their own, not waiting for the accountant's report. Automatic reconciliation between the bank subsidiary ledger and the accounting ledger is the cheapest tool to detect discrepancies early.

Consequence if ignored

Without independent reconciliation, all other controls can be concealed by the person implementing them. This is the final layer to detect discrepancies; without it, the ability to detect is lost.

Frequency / timing

Monthly reconciliation; director reviews weekly

Where to look

Internal financial regulations; internal control principles under accounting and auditing standards

Suggested owner

Director, accountant