Văn bản hợp nhất 37/VBHN-BTC

CIRCULAR[1]

PROVIDING GUIDELINES FOR E-TRANSACTIONS ON SECURITIES MARKET

The Circular No. 134/2017/TT-BTC dated December 19, 2017 of the Minister of Finance providing guidelines for e-transactions on securities market, which comes into force from March 01, 2018, is amended by:

The Circular No. 73/2020/TT-BTC dated December 19, 2017 of the Minister of Finance on amendments to the Circular No. 134/2017/TT-BTC dated December 19, 2017 of the Minister of Finance providing guidelines for e-transactions on securities market, which comes into force from October 01, 2020.

Pursuant to the Law on Securities dated June 29, 2006;

Pursuant to the Law on amendments to the Law on Securities dated November 24, 2010;

Pursuant to the Law on Electronic Transactions dated November 29, 2005;

Pursuant to the Law on Information Technology dated June 29, 2006;

Pursuant to the Law on Cyberinformation Security dated November 19, 2015;

Pursuant to the Government’s Decree No. 58/2012/ND-CP dated July 20, 2012 elaborating and providing guidelines for the Law on Securities and the Law on amendments to the Law on Securities;

Pursuant to the Government’s Decree No. 60/2015/ND-CP dated June 26, 2015 on amendments to some articles of the Government’s Decree No. 58/2012/ND-CP dated July 20, 2012 elaborating and providing guidelines for the Law on Securities and the Law on amendments to the Law on Securities;

Pursuant to the Government’s Decree No. 42/2015/ND-CP dated May 05, 2015 on derivatives and derivatives market;

Pursuant to the Government’s Decree No. 27/2007/ND-CP dated February 23, 2007 on e-transactions in financial operations;

Pursuant to the Government’s Decree No. 156/2016/ND-CP dated November 21, 2016 on amendments to some articles of the Government’s Decree No.27/2007/ND-CP dated February 23, 2007 on e-transactions in financial operations;

Pursuant to the Government’s Decree No. 87/2017/ND-CP dated July 26, 2017 on functions, tasks, entitlements and organizational structure of the Ministry of Finance;

At the request of the President of the State Securities Commission;

The Minister of Finance hereby promulgates a Circular to provide guidelines for e-transactions on securities market2.

Chapter I

GENERAL

Article 1. Scope

This Circular provides for online securities transaction, exchange of electronic information on securities market and other activities related to e-transactions on securities market.

Article 2. Regulated entities

This Circular applies to:

1. The State Securities Commission (SSC), Stock Exchange (SE), Vietnam Securities Depository (VSD).

2. Organizations and individuals participating in making securities transactions and activities on the securities market by electronic means, including:

a) Issuers, listed or registered organizations, public companies;

b) Securities companies, fund management companies, securities investment companies;

c) Vietnam-based representative offices and branches of foreign securities traders; Vietnam-based representative offices and branches of foreign fund management companies;

d) Commercial banks, foreign bank branches that are participants in the bond market or derivatives market, supervisory banks, depository members, offsetting members, fund certificate distributors;

dd) Investors;

e) Other organizations and individuals engaging in securities transaction and market by electronic means.

Article 3. Definitions

For the purposes of this Circular, the terms below shall be construed as follows:

1. “online securities transaction” means a securities transaction carried out through information technology system and Internet, telecommunications network or other open networks, including: securities transactions between investors and providers of online securities transaction services; securities transactions between transaction members and SE; securities-related transactions between depository members, offsetting members and VSD.

2. “online securities trading system” means a system intended to manage and carry out online securities transactions, including: hardware, software, database, telecommunications network, Internet, computer network.

3. “electronic securities document” means a data message about e-transactions on securities market, which is generated, sent, received and stored by electronic means.

4. “electronic order” means a data message recording data about a transaction order which an investor has placed through online securities trading system at a specific time when only that investor is able to access such system through access and order placement authentication.

5. “two-factor authentication” means an authentication method that requires two factors to authenticate an identity. Two-factor authentication is based on information that the user knows, such as PIN and secret key, information that the user has, such as smart card, security tokens, mobile phone or user’s biometrics used to authenticate his/her identity.

6. “cyberinformation security” means the protection of information and information systems in cyberspace from being illegally accessed, utilized, disclosed, interrupted, altered or sabotaged in order to ensure the integrity, confidentiality and usability of information.

7[2]. “identity of an order placement device” means the information associated to each device to identify that device when it is used for conducting online securities transactions.

8. “order placement telephone number” means the telephone number registered by the investor with an online securities transaction service provider to place securities transaction orders.

9. “online securities transaction services” mean services provided by an online securities transaction service provider to investors in order for them to open accounts, place orders, provide their requirements regarding securities transaction or receive transaction results via internet or by telephone.

10. “online securities transaction service provider” means a securities company, fund management company and distributor of fund certificates, which provides online securities transaction services.

11. “depository member” means a securities company or commercial bank operating in Vietnam granted the Certificate of securities depository registration by SSC and approved to be a depository member by VSD.

12. “offsetting member” means a securities company, commercial bank or branch of a foreign bank that may offset or settle derivative transaction service.

13. “serious breakdown” means a technical breakdown occurring to the online securities trading system, which results in termination or suspension of operation of the system.

14[3]. “time of transaction” means the time that the investor logs in to the online securities trading system and executes online securities transaction orders.

Article 4. Rules for carrying out e-transactions on securities market

E-transactions on securities market shall be carried out in an accurate, equal, public, transparent, safe and effective manner, and in accordance with the Law on E-Transactions, Law on Cyberinformation Security, guiding documents and other relevant regulations of law.

Chapter II

ONLINE SECURITIES TRANSACTIONS

Section 1. REQUIREMENTS FOR SERVICES, TECHNICAL INFRASTRUCTURE, SECURITY AND CONFIDENTIALITY, AND DATA STORAGE

Article 5. Service requirements

1. SEs and VSD shall:

a) make and promulgate regulations on connection of online securities trading system, procedures for breakdown handling, system backup and management of risks during online securities transactions in accordance with the Law on E-Transactions, Law on Cyberinformation Security, guiding documents and regulations of this Circular;

b) ensure that online securities transaction activities are provided in a public, equal, transparent, safe and effective manner to members using the same type of service.

2. Every securities company providing online securities transaction services shall:

a) directly provide online securities transaction services to investors;

b) design a website with the domain name registered on the Internet to provide online securities transaction services. Programs and applications used for online securities transactions shall be published or integrated on such website;

c) issue procedures for providing online securities transaction services, including: procedures for daily operation, supervision and management; procedures for registration and cancellation of online securities transactions; procedures for handling breakdowns; procedures for data and system backup; procedures for control of risks during provision of online securities transaction services for investors and other procedures in accordance with the Law on E-Transactions, Law on Cyberinformation Security, guiding documents and regulations of this Circular. Responsibilities of entities participating in such procedures shall be specified.

d) provide personnel that have degrees or certificates of software administration, system management and information security in order to manage and supervise activities of the online securities trading system to ensure continuity;

dd) put the provision and use of online securities transaction services with investors in a contract or clause of the contract for opening a securities transaction account, specifying methods of carrying out online securities transactions, risks incurred during online securities transactions, which are specified in Clause 1 Article 15 of this Circular, responsibilities of each party for compensation for risks and other responsibilities related to online securities transactions;

e) record information on investor’s transaction request in online securities trading system. Such information shall be archived in a way that it is retrieved by time, session, transaction results and investor’s account balance arising before and after the transaction with respect to accounts of investors;

g) report results of execution of transaction orders to investors after the orders are matched on the online securities trading system.

3. Fund management companies and fund certificate distribution agents that provide online securities transaction services shall comply with the requirements specified in Points a, b, c, dd, e and g Clause 2 of this Article.

Article 6. Requirements for technical infrastructure of online securities trading system

1. Regarding a securities company providing online securities transaction services:

a) The online securities trading system shall be physically separated from other business systems of the company to ensure cyberinformation security, reduce risks and avoid conflicts between the systems;

b) The online securities trading system shall be equipped with a dedicated server. A personal computer shall not be used as a server and a server shall not be shared with other units or companies. There must be standby information technology equipment exclusively used for the online securities trading system;

c) The area where the online securities trading system is located shall comply with security, environment and safety requirements: it must be a separate area, there must be a system of smart keys or equivalent devices to control access, a video recording system, a specialized fire alarm and fighting system, an air conditioning system, a temperature and humidity monitoring and control system, an uninterruptible power supply and specialized backup generator system, and a lightning protection system;

d) The company may rent space for placing the online securities trading system at a data center. The data center shall comply with regulations on operation of data centers. The online securities trading system located in a data center shall have solutions for preventing unauthorized access and exploitation of data;

dd)5 The online securities trading system must be integrated with solutions whereby investors can use digital certificates or digital signatures of public certification authorities when executing online securities transaction orders. It may be also integrated with other solutions prescribed in Point a and Point c Clause 1 Article 8 of this Circular. Application of digital certificates and digital signatures to investors’ securities transactions shall comply with specific guidelines given by the SSC;

e)⁶ When rendering transaction services via telephone, the telephone exchange or another device with call recording, management and search functions must be equipped. Any calls for placing orders of investors must be recorded and stored in a manner that ensures information and data security;”

g) Technical or regulatory measures shall be adopted in order to set limits on purchase and sale of securities by investors using online securities transaction services as prescribed by law. These limits shall be disclosed to investors on the online securities transaction page and there must be a procedure for approving changes to such limits.

2. Fund management companies and fund certificate distribution agents that provide online securities transaction services shall comply with the requirements specified in Points a, b and e Clause 1 and Clause 3 of this Article.

3. SEs, VSD and online securities transaction service providers shall formulate a backup plan for the online securities trading system and adopt an alternative transaction method in case the online securities trading system has any breakdown.

Article 7. Regulations on information security and confidentiality and data storage by online securities transaction service providers

1. Websites and email systems of online securities transaction service providers shall be authenticated by digital certificates.

2. The online securities trading system shall be set up to prevent unauthorized access to internal business systems through online transactions. System privileges shall be granted to specialized divisions that may present a potential conflict of interest according to the internal control process.

3. Before putting application software into operation, it is required to review and scan any confidentiality vulnerability and there must be an assessment report. The environment for operating the online securities trading software system shall be separated from the testing environment and the software development environment. Cyberinformation security risks of the online securities trading system shall be assessed once a year.

4. The online securities trading system shall have technical solutions for ensuring cyberinformation and confidentiality of data of the system.

5. Electronic documents, orders and data, and call recordings of orders placed by clients, including cancellation orders shall be retained for at least ten (10) years in their original form.

6. Information about online transaction service users, transaction orders and information exchanged on the system must be encrypted on the transmission line and at the application level, and must be kept confidential in accordance with regulations of law unless requested by competent authorities.

Article 8. Regulations on authentication

1. The safety level of authentication solutions applied to online securities transactions shall be at least equivalent to that of the multi-factor authentication solution or higher, including:

a) Two-factor authentication solution;

b) Authentication solution using digital certificates;;

c) Other authentication solutions permitted by law and in accordance with regulations of competent authorities.

2[4]. When placing an order via telephone, the investor shall use the order placement telephone number and provide information for authentication as prescribed in Point a Clause 1 of this Article. The transaction shall only be executed if the information provided by the investor matches his/her information registered and stored on the online securities trading system.

3. Investors are entitled to select the authentication solutions offered by online securities transaction service providers when registering to use online securities transaction services and are entitled to re-register authentication solutions if needed.

4[5]. Investors are required to carry out authentication as prescribed in this Article whenever they conduct online securities transactions.

Article 9. Regulations on electronic orders

1[6]. An electronic order shall, inter alia, include the following information:  Number and type of order, number of the account whose holder places the order, transaction method, ticker symbol or name of security, quantity and transaction price, transaction date and time, identity of order placement device.

2. A cancellation order shall include the following information: serial number of the order, volume to be

3[7]. An electronic order must bear a digital signature or logically associated or combined with the investor’s identity as prescribed in Article 8 hereof and comply with legislative documents on e-transactions.

4. Electronic orders intended for fund certificate transactions shall include all information according to regulations of law on fund certificate transactions and comply with Clause 3 of this Article.

Section 2. REGISTRATION FOR AND REVOCATION OF APPROVAL FOR PROVISION OF ONLINE SECURITIES TRANSACTION SERVICES

Article 10. Applicants for provision of online securities transaction services

An applicant for provision of online securities transaction services must be a member securities company affiliated to an SE, has been connected to the SE’s trading system and shall not:

1. be under dissolution or bankruptcy process, have its operation or transaction suspended to terminate its membership at the SE.

2. have its brokerage terminated or be following the procedures for terminating its brokerage.

3. be under control or special control.

4. Other cases of suspension of its operation as prescribed by law.

Article 11. Application for provision of online securities transaction services

An application for provision of online securities transaction services includes:

1. An application form, which is made using the form in the Appendix 01 hereof.

2. A list and curriculum vitae of experts managing the online securities trading system, which are made using the form in the Appendix 02 hereof.

3. A report on design of the online securities trading system, which is made using the form in the Appendix 03 hereof.

4. Certified true copies of SE’s written approval and record on inspection of the online securities trading system in the case of a trading member.

Article 12. Procedures for approving provision of online securities transaction services

The securities company shall make an application as prescribed in Article 11 of this Circular and submit it to SSC through SSC’s online public service system or in person or by using public postal services.

1. Within five (05) working days from the receipt of the application prescribed in Article 11 of this Circular, the SSC shall request the applicant in writing to supplement the application if the application is required to be supplemented or provide a written explanation if the application is invalid.

2. Within ten (10) working days from the receipt of the written request, the securities company shall complete the application as requested and submit it to the SSC. If, upon expiry of the aforesaid period, the securities company fails to supplement the application as requested, the SSC may refuse to grant approval.

3. Within twenty (20) working days from the receipt of a sufficient and valid application, the SSC shall consider granting approval for provision of online securities transaction services to the securities company. In case of refusal, the SSC shall provide explanation in writing.

Article 13. Revocation of decision on approval and suspension of provision of online securities transaction services

1. In the cases where a securities company has its operation, brokerage or entire operation suspended, it shall suspend the provision of online transaction services until such situation is handled.

2. A securities company shall have its decision on approval for provision of online securities transaction services revoked in the following cases:

a) The company has applied for termination of securities brokerage and has been granted approval by the SSC;

b) The company has its securities brokerage terminated;

c) The company has its membership at the SEs terminated;

d) The company is merged, fully divided or consolidated;

dd) The company is dissolved, goes bankrupt or has its establishment and operation license revoked;

e) The company fails to maintain satisfaction of or satisfy the regulations specified in Clause 2 Article 5, Clauses 1 and 3 Article 6, Article 7, Clause 1 Article 8 and Clause 3 Article 9 of this Circular;

g) The application for provision of online securities transaction services contains untruthful information;

h) Other cases where any regulatory agency requests or the company voluntarily submits an

3. The securities company whose decision on approval for provision of online securities transaction services is revoked as prescribed in Points b, c, e and g Clause 2 of this Article may re-apply for provision of online securities transaction services.

4. The securities company whose decision on approval for provision of online securities transaction services is revoked as prescribed in Clause 2 of this Article shall maintain and ensure the duration of storage of data of the online securities trading system to fulfill obligations in accordance with regulations of law.

5. The sequence of revoking the decision on approval for provision of online securities transaction services shall comply with the SSC’s guidelines.

Section 3. REPORTING AND PUBLISHING INFORMATION DURING ONLINE SECURITIES TRANSACTION ACTIVITIES

Article 14. Regulations on reporting during online securities transaction activities

1. A securities company granted approval for provision of online securities transaction services shall submit the following reports to the SSC:

a) Annual report on online securities transaction activities, which is prepared using the form in the Appendix 04 hereof. The report shall be submitted within thirty (30) days from the end of the year;

b) Report enclosed with relevant documents when there is any upgrade or change of the online securities trading system: change of the core of the system, change of the transaction method, changes of information technology personnel and change of the location of the system, which is prepared using the form in the Appendix 08 hereof. The report shall be submitted within seven (07) working days after the securities company upgrades or changes the system.

2. An SE shall submit the following reports to the SSC:

a) Annual report on online securities trading system, which is prepared using the form in the Appendix 05 hereof. The report shall be submitted within thirty (30) days from the end of the year;

b) Report on changes to the regulations on technological standards applied to transaction members of the SE. The report shall be submitted within seven (07) working days after the change is made.

3. The VSD shall submit to the SSC an annual report on the status of online securities transaction prepared using the form in the Appendix 06 hereof within thirty (30) days from the end of the year.

4. Within twenty-four (24) hours since the occurrence of a serious breakdown related to the online securities trading system, the SE, the VSD or the securities company shall submit a report thereon prepared using the form in the Appendix 07 hereof.

5. A fund management company or fund certificate distribution agent shall submit to the SSC a report on the document mentioned in Clause 3 Article 11 of this Circular at least five (05) working days before the day on which the online securities transaction services are provided to investors; and prepare an annual report on online securities transaction activities using the form in the Appendix 04 hereof within thirty (30) days from the end of the year.

6. Reports shall be submitted electronically through electronic information exchange systems under the SSC’s guidance.

Article 15. Publishing information during online securities transaction activities

1. Regulations on online securities transaction services and risks that may be incurred when investors conduct online securities transactions shall be published on securities companies’, fund management companies’ and fund certificate distribution agents’ official websites and application software serving online securities transaction services for investors. These risks include:

a) A risk that during internet transmission, transaction orders may be suspended, stopped or

b) A risk that that he identification of organizations or investors may be inaccurate, and errors arising from protection of confidentiality may occur;

c) A risk that that market prices and other information relating to securities may be incorrect or contain errors;

d) A risk that may be incurred during adoption of a method of authenticating orders placed by investors;

dd) Other risks that competent authorities, securities companies, fund management companies or fund certificate distribution agents consider necessary to publish.

2. Every SE shall publish on its website the regulations on electronic transactions on securities market and documents providing for electronic transactions promulgated by the SE.

3. The VSD shall publish on its website the list of online securities transaction products and services that are allowed to be provided; the regulations on electronic transactions on securities market and documents providing for electronic transactions promulgated by the VSD.

4. The SSC shall publish on its website the list of securities companies licensed to provide online securities transaction services, procedures for and regulations on applications for registration of provision of online securities transaction services and the list of securities companies whose decisions on approval for provision of online securities transaction services are revoked.

Chapter III

ELECTRONIC INFORMATION EXCHANGE

Article 16. Regulations on electronic information exchange

1. The electronically exchanged information comprises information to be exchanged via the internet

a) Public offer of securities, securities registration, securities depositing, listing, transaction registration and securities transaction;

b) Management of organizations and individuals prescribed in Clause 2 Article 2 of this Circular;

c) Disclosure of information on securities market;

d) Other activities related to securities market in accordance with regulations of law on securities.

2. Every electronic information exchange service provider shall:

a) create a website that is used as a portal for electronic information exchange services;

b) keep confidentiality of information for applicants for services and ensure information safety for the electronic information exchange system;

c) issue regulations and guidelines for electronic information exchange services.

3. Participants in exchange of electronic information shall apply for services and comply with regulations and guidelines of electronic information exchange service providers.

4. The use of digital certificates and digital signatures in exchange of electronic information shall comply with regulations of the law on e-transactions in financial operations.

Chapter IV

RESPONSIBILITIES OF ORGANIZATIONS AND INDIVIDUALS PARTICIPATING IN E-TRANSACTIONS ON SECURITIES MARKET

Article 17. Responsibilities of organizations and individuals participating in e-transactions on securities market

1. Comply with regulations on securities transaction activities and securities market.

2. Comply with regulations on protection of information during e-transactions activities and regulations on safety and confidentiality, on personnel and on data system.

3. Sufficiently archive documents relating to online securities transactions of the company. Prepare applications for provision of online securities transaction services and confirm that they contain accurate information, amend or supplement these applications if any inaccurate information is found and do not ignore any important content in accordance with regulations. Store reported information in accordance with regulations of law.

4. A securities company is not allowed to provide online securities transaction services if the SSC is yet to grant approval or the approval decision is revoked.

5. Submit reports on schedule and report sufficient contents in accordance with regulations of law or at the request of the SSC.

Article 18. Inspection and supervision of e-transactions on securities market

1. The SSC shall carry out periodic or unscheduled supervision and inspection of implementation of e-transactions on securities market by SEs, VSD, securities companies, fund management companies, fund certificate distribution agents and other organizations and individuals according to regulations or when there is any breakdown that affects the investors’ interests and safety of the securities market.

2. SEs and VSD shall cooperate in supervising online securities transaction activities of online securities transaction service providers and relevant organizations and individuals at the request of the SSC.

3. Organizations and individuals participating in e-transactions on securities market shall sufficiently and promptly provide information, data and documents on e-transactions at the request of competent authorities.

Chapter V

IMPLEMENTATION CLAUSE[8]

Article 19. Effect

This Circular comes into force from March 01, 2018 and replaces the Circular No. 87/2013/TT-BTC dated June 28, 2013 of the Minister of Finance.

Article 20. Implementation

1. Within six (06) months from the effective date of this Circular, any securities company granted by the SSC the approval for provision of online securities transaction services before the effective date of this Circular shall complete the online securities trading system, satisfy the requirements for services, technical infrastructure, security and confidentiality, data authentication and storage in accordance with regulations of this Circular.

2. The SSC shall provide guidance and issue technical standards for application of information technology to e-transactions on securities market.

3. The SSC, SEs and VSD and organizations and individuals participating in e-transactions on securities market are responsible for the implementation of this Circular./.