Vietnam’s P2P lending market presents an interesting opportunity in 2026, driven by strong digital adoption and rising demand for alternative credit. With a population exceeding 102 million and internet penetration at around 77%, the country has a large, tech-savvy base increasingly open to online financial services. At the same time, many individuals and SMEs remain underserved by traditional banks, creating a clear financing gap.
Around 40 domestic and international P2P platforms are already operating in Vietnam, leveraging technology and streamlined digital processes to deliver faster and more accessible loans. However, while the demand and digital readiness are firmly in place, the next phase of growth is being shaped by how regulation and technology evolve together.
In this insight article, Acclime and EmbedIT, combining legal expertise with forward-thinking technology, explore the regulatory landscape and unlock key technology opportunities in fintech, with a special focus on the rapidly evolving P2P sector.
The regulatory shift from grey zone to sandbox
Recently, Vietnam has moved P2P lending out of a long-standing “grey zone” by introducing a formal regulatory sandbox under Decree 94/2025/NĐ-CP, effective 1 July 2025. The sandbox covers three fintech categories: credit scoring, Open API, and P2P lending. For investors, this is a meaningful regulatory step, however it is not equivalent to a mature, permanent licensing regime. Sandbox participation is conditional, time-limited, and subject to revocation/renewal rules. Under Decree 94, a maximum initial term is 2 years, extendable twice, each for up to 1 year.
Public signals suggest the sandbox is active but still in an early stage. As of a Thanh Nien report dated 5 February 2026, the number of P2P sandbox applications under review had increased from 7 to 10, while the number of admitted participants still showed none. That does not mean the regime is closed, but it does indicate that regulatory timing and throughput remain real execution variables.
The key investment issue is market access and structuring. The P2P-specific sandbox conditions include a restriction that the participating P2P company must not be a foreign-owned enterprise, plus nationality and eligibility conditions for management roles. That makes foreign capital participation structurally sensitive and pushes investors toward carefully designed minority or indirect structures etc.
At the same time, platform design is now affected by two regulatory tracks:
- Banking sandbox controls (scope, timing, debt caps, CIC connectivity, conduct restrictions)
- Vietnam’s AI Law (effective 1 March 2026), which introduces risk-based AI compliance obligations relevant to underwriting, fraud detection, customer interaction, and model governance
- A broader compliance stack that directly affects long-term investability, including personal data/privacy, AML/KYC and fraud controls, consumer-facing conduct, and cybersecurity
The practical conclusion for investors is straightforward: Vietnam is now a “regulated build” opportunity, not a pure speed-to-market play. Entry strategy must be framed as a structuring, regulatory execution, governance question from day one.
Regulatory status of P2P lending in Vietnam
Decree 94 established the banking-sector sandbox for fintech solutions and expressly includes P2P lending. This matters because, prior to Decree 94, P2P lending in Vietnam had a fragmented and uncertain compliance posture. The sandbox creates a formal path for pilot participation under SBV oversight, even if the long-term licensing framework is still evolving.
The sandbox is designed as a controlled experiment, not a market liberalization. Decree 94 is explicit that sandbox participation does not automatically mean the business will satisfy future investment or business-licensing conditions when a final legal regime is issued. In other words, sandbox admission helps, but it is not a substitute for future licensing. Investor should read the sandbox as a risk-screening mechanism for the regulator rather than a permanent authorization framework.
For P2P lending specifically, the decree provides that a P2P Lending company applying for sandbox participation must be:
- Legally established and operating in Vietnam
- Not a foreign-invested enterprise
The relevant wording is direct and leaves little room for casual interpretation.
If the investment thesis is “we will incorporate a Vietnam subsidiary and launch a P2P platform”, the non-FIE condition immediately creates a feasibility problem. A model of establishing a new FDI enterprise in the traditional way may conflict with sandbox eligibility for P2P lending. That does not automatically mean foreign capital can never participate in the sector. It means the investor cannot assume a standard foreign-invested setup will fit the current sandbox gateway.
A common investor question is whether a multi-layer structure can solve the Decree 94 requirement that a P2P sandbox applicant must “not be a foreign-invested enterprise.”
In practice, this should be treated with caution. The decree imposes the condition at the applicant-entity level. This may encourage structuring arguments based on direct versus indirect foreign ownership. However, the sandbox is a supervisory regime, and the SBV’s review is not purely formalistic. The application dossier for P2P lending requires disclosure of organizational and management structure, and the SBV has broad powers to request information and supervise the testing process.
As a result, a multi-layer structure may create a technical entity-level argument, but it does not eliminate regulatory risk. The SBV may still assess the substance of ownership, control, governance, and operational arrangements when determining eligibility and ongoing suitability. In a board context, this should be treated as a structuring option with interpretation risk, not a reliable workaround.
A more defensible strategy is usually to focus on a regulator-ready operating model (governance, controls, CIC connectivity, disclosures, and AI governance), while preserving investment optionality for a future licensing framework.
Sandbox mechanics that directly affect the business model
Testing period and geography are limited by law
Under Decree 94:
- The sandbox testing period is up to 2 years (with extension rules)
- Testing is limited to Vietnam territory
- Cross-border testing is not allowed
This affects both scale assumptions decisions and deployment decisions. If a regional group planned to deploy a shared platform stack or cross-border product flows during the pilot, those assumptions must be tested against the Vietnam-only sandbox perimeter.
Go-live timing is not flexible after admission
Once a participant receives the sandbox certificate, the entity must begin deployment within 90 days. The decree states this requirement both in the general procedure and in the P2P-specific section. This is a hard operational point. Sandbox approval is not a “placeholder license.” The P2P platform should be launch-ready (technology, policy pack, customer journey, internal controls, reporting routines) before filing.
Application review timeline is longer than many sponsors expect
The decree provides a procedural framework that includes:
- 5 working days for SBV to confirm whether the dossier is complete/valid
- 90 working days for appraisal after complete dossier confirmation (with inter-agency consultation and potential on-site checks)
For the investor planning, this means they should not model on a 3-month calendar assumption but should build in time for dossier remediation and regulator questions.
Scope restrictions materially shape product design
The decree also restricts what a P2P sandbox participant can do. It states that a P2P company in the sandbox may not:
- Conduct business outside the scope in its sandbox certificate
- Provide its own security/guarantee for customer loans
- Provide P2P solutions to pawnshop companies
Supervisory infrastructure is already being built
Operationally, the sandbox framework is accompanied by a set of implementation controls, including borrower debt limits and CIC-related connectivity and reporting requirements.
Under Decision 2866/QĐ-NHNN dated 22 July 2025, the State Bank of Vietnam (SBV) specifies the maximum loan exposure a borrower may have within the P2P Lending sandbox:
- At a single P2P platform: VND 100 million
- Across all sandboxes P2P platforms combined: VND 400 million
According to SBV, these caps are designed to ensure consistent risk-management principles throughout the trial period, align with the experimental nature of the sandbox, and limit potential financial losses for both lenders and borrowers, thereby contributing to the stability of the financial system.
In addition, Decision 2970/QĐ-NHNN dated 11 August 2025 sets out detailed rules on data connectivity, reporting, and credit-information verification between P2P lending companies and the National Credit Information Center (CIC). This decision outlines technical requirements for establishing CIC connections, specifies reporting indicators, timelines, and frequency, and defines the rights and obligations of sandbox participants when interacting with the CIC.
According to EmbedIT, in more mature markets, P2P platforms have already undergone a similar transition where compliance is not treated as an afterthought but embedded directly into system design from the outset.
For example, in Central Europe, the P2P lending platform which EmbedIT continuously supports has grown successfully, demonstrating how operational efficiency and regulatory alignment can evolve in parallel. Based on the insights and experience gained from this case, EmbedIT has been subsequently developing its own core P2P architecture, enabling a fast go‑to‑market setup and ensuring full integration with bank accounts, scoring engines, and credit bureau data.
As the P2P market matured, the platform upgraded from a classic P2P model (many investors funding one loan) to P2P 2.0, where people could invest into a ready-made portfolio. This upgrade made investing easier, reduced operational costs, and sped up loan approvals. All key features Vietnam is now encouraging through Decree 94.
The current P2P model structure already matches many of Vietnam’s sandbox requirements:
- Money flows through a bank, not the P2P platform
- The platform only connects people, it doesn’t act as a lender
- Credit checks and risk tools are built in
- Clear reporting and audit trails are part of the system
The well-balanced model created strong value for all stakeholders by offering investors stable annual returns of 5–7 percent, passive investment opportunities, and full transparency; providing borrowers with fast, fully digital onboarding, clear pricing, and loan approvals within 24 hours. It also enabled the partner bank to gain complete visibility over cash flows, assured regulatory compliance, and opportunities to crosssell additional financial products—an approach that closely mirrors the transparent and well-structured P2P lending environment Vietnam aims to foster under its regulatory framework.
This alignment reduces adaptation time for Vietnamese clients and shortens the path to sandbox approval.
Vietnam’s AI Law: A new compliance layer for P2P platforms
Vietnam’s Law on Artificial Intelligence No. 134/2025/QH15 came into effect on 1 March 2026 which now creates a standalone legal framework for these systems. The law applies to both Vietnamese and foreign organizations involved in AI-related activities in Vietnam. It also provides transitional compliance timelines for AI systems already in operation, including 18 months for health, education and finance-sector systems and 12 months for other sectors.
For investors, this is helpful but not a reason to defer governance. The transition window reduces disruption risk, but a newly launched platform should be built to comply from the start.
P2P platforms routinely rely on automated and algorithmic systems for borrower onboarding, credit risk scoring, fraud detection, behavioural monitoring, customer service interactions, collections prioritisation, and content generation. Each of these functions may fall within the scope of the AI Law’s compliance obligations.
Compliance requirements beyond Decree 94 and AI Law
For investors, sandbox eligibility and AI governance are only part of the regulatory picture. A P2P platform in Vietnam must also operate within a broader compliance stack that directly affects licensing credibility, operational resilience, and long-term investability.
From a practical implementation perspective, the key layers of that framework are as follows:
- Cybersecurity (network security obligations under the Cybersecurity Law No. 24/2018/QH14, data localization requirements, incident reporting, security audit obligations for finance-sector information systems, and technical security standards for CIC-connected infrastructure under Decision 2970/QĐ-NHNN)
- Personal data and privacy compliance (customer notices, consent architecture, processing governance, retention, vendor/data processor controls, and data transfer controls where relevant)
- AML/KYC and financial crime controls (customer onboarding, identity verification, fraud detection, monitoring and escalation workflows, and recordkeeping)
- Consumer protection and platform conduct controls (clear disclosures, fair communications, complaint handling, and collections conduct standards)
For a new market entry platform, these should not be treated as “Phase 2 compliance.” They are part of the core operating model. In regulatory terms, Decree 94 may determine whether a platform can enter the sandbox, but the broader compliance stack often determines whether it can operate credibly, scale safely, and remain investable.
Strategic insights for P2P investors
Vietnam’s P2P lending market remains an attractive opportunity, supported by strong fundamentals and growing demand for digital financial services. For foreign investors, the decisive question is whether the proposed entry model is legally defensible and operationally bankable under the current sandbox framework. In practice, Vietnam P2P should be treated as a structured market entry project: the non-FIE eligibility issue must be resolved at the outset, the platform must be designed within the sandbox’s legal and operational perimeter, and the operating model must be built for regulatory scrutiny from day one.
In conclusion, bring a platform to market therefore requires two things to work closely together: a clear and workable regulatory structure, and a technology setup that fits how the sandbox operates in practice.
Acclime’s expertise reflects advising on licensing, corporate structuring, and compliance under Decree 94, Law on AI. This includes helping investors think through how to structure their presence in Vietnam and preparing the documentation typically expected during SBV review.
EmbedIT supports P2P operators and investors in Vietnam by designing a business model aligned with Decree 94, delivering an end-to-end digital platform covering onboarding, credit scoring, payments, and reporting, integrating with CIC and local banking systems, establishing AI and cybersecurity controls in line with Vietnam’s new regulatory requirements, and assisting with testing and documentation for submission to the State Bank of Vietnam, positioning EmbedIT as a strong partner for building a secure, compliant, and modern P2P platform for the Vietnamese market.
Contact our expert team for any stage of the market entry process, from initial feasibility through to sandbox application and platform launch.
Acclime Vietnam
Huy Nguyen, Supervisor — Licensing & Corporate Secretarial: huy.nguyen@acclime.com
Thao Nguyen, Senior Manager — Licensing & Corporate Secretarial: thao.nguyen@acclime.com
Rizwan Khan, Managing Partner: r.khan@acclime.com
EmbedIT
Mihaela Todica, VP SEA Sales: Mihaela.Todica@embedit.com
Nguyen Dung Duy, Local Sales Manager in Vietnam: Duy.NguyenDung@embedit.com
Download Vietnam’s P2P Lending market in 2026: Regulatory maturity and technology integration