FATF Follow-Up Review Shows Vietnam Strengthening AML Framework but Still Struggling With Deep-Rooted Gaps

FATF’s most recent follow-up review of Vietnam portrays a system that is gradually reinforcing its defences but still grappling with structural shortcomings that shape how banks, intermediaries and designated non-financial professions manage the risks of money laundering and terrorism financing. The evaluation acknowledges visible progress, yet it also confirms that several technical weaknesses continue to prevent Vietnam from reaching full alignment with global AML standards.

In this second enhanced review, FATF concentrates on the most sensitive elements of Vietnam’s regime: the national risk-based architecture, the statutory money-laundering offence, targeted financial sanctions for both terrorism and proliferation financing, and the framework for suspicious transaction reporting. These pillars sit at the heart of an effective system, and their condition explains why Vietnam remains under expedited follow-up instead of entering a standard monitoring cycle.

Overall, the country presents a picture of improvement coupled with persistent deficiencies that carry operational consequences. Vietnam’s refreshed national risk assessments for both money laundering and terrorism financing have grown more sophisticated and now play a role in shaping concrete policy decisions. However, major gaps remain in the criminalisation of money laundering, in the enforceability of sanctions regimes, and in the breadth and flexibility of suspicious transaction reporting duties—exposures that continue to create heightened financial-crime vulnerability.

Vietnam’s progress is reflected in its current set of ratings: sixteen FATF recommendations are now deemed compliant or largely compliant, while more than twenty remain at only partially compliant and a handful continue to be assessed as non-compliant. The balance represents movement in the right direction but also signals that technical strengthening is still required across most areas.

Where the country has seen the clearest step forward is in the risk-based model. Vietnam has completed updated national risk assessments for 2018–2022 for both money laundering and terrorism financing. These assessments probe vulnerabilities associated with legal persons and arrangements, beneficial ownership, cross-border movement of goods and funds, and high-risk predicate crimes including online gambling, tax evasion and various forms of fraud. They now draw on a more structured evidence base, including statistics from law-enforcement authorities, questionnaires completed by reporting entities and analytical products issued by the financial intelligence unit.

The terrorism-financing component undertakes similar examinations, assessing domestic and foreign threats, weaknesses in the non-profit sector and potential misuse of virtual assets and related service providers. One gap persists: the terrorism-financing risk of commercial legal entities has not yet been comprehensively evaluated. Given how central companies and partnerships are to cross-border commerce, the absence of this assessment leaves space for terrorist networks to exploit corporate structures undetected.

A notable departure from earlier periods is Vietnam’s use of these risk assessments to guide real action plans. The government has approved a phased post-assessment strategy for terrorism financing, the central bank has issued its own risk-mitigation plans, and key ministries have published operational guidance designed to translate the national findings into reforms, inspections and coordinated activities.

Reporting entities are now required to align their internal assessments with national conclusions. The 2022 AML law obliges private-sector actors to incorporate national findings into customer classification and risk management. Implementing circulars lay out detailed criteria for assigning risk ratings based on behaviour, product types, delivery channels and geographic factors. Some microfinance institutions and people’s credit funds identified as genuinely low-risk can apply simplified measures under defined conditions, consistent with international practice.

Yet significant shortcomings persist. Internal AML policies do not always require formal sign-off from senior management, which undermines governance and contributes to uneven implementation of risk-based controls. Requirements for internal audit and oversight remain incomplete for extra-small enterprises and natural persons that fall under reporting-entity obligations, leaving pockets of the sector with weaker supervision.

Gaps in criminalisation remain one of the most consequential obstacles to Vietnam’s FATF alignment. The money-laundering offence still fails to fully meet international benchmarks. The statutory wording does not clearly cover all forms of transfer and conversion of criminal proceeds, and although the civil code recognises broader concepts, these are not integrated directly into the criminal provision. As a result, prosecuting complex layering schemes or value-transfer operations becomes more difficult.

A second major deficiency is that Vietnam’s framework does not fully extend corporate criminal liability for predicate offences such as corruption, drug trafficking, arms trafficking and certain categories of fraud. When these offences are committed by corporate bodies or some types of non-commercial legal persons, the absence of liability means that the resulting proceeds may fall outside the reach of the money-laundering offence.

A third unresolved issue concerns indirect proceeds. While the AML law defines proceeds broadly to include assets obtained “directly or indirectly” from unlawful conduct, this definition is not directly embedded in the criminal offence. That disconnect makes confiscation of transformed, reinvested or substituted assets more challenging and opens loopholes in investigation and prosecution.

FATF has also noted that penalties for natural persons convicted of money laundering are still not sufficiently proportionate or dissuasive. Corporate liability also does not extend to all necessary categories of legal persons. These combined weaknesses justify maintaining the offence at partially compliant.

For financial institutions, such legislative gaps create tangible challenges. If certain crimes or corporate arrangements are not explicitly covered, institutions face difficulties in mapping typologies, escalating red flags and supporting law-enforcement efforts. Criminals can intentionally exploit areas where prosecutorial uncertainty exists, forcing compliance teams to apply elevated scrutiny even when domestic regulations do not explicitly require it.

Improvements in targeted financial sanctions for terrorism financing are notable but incomplete. A revised decree now extends freezing obligations to both natural and legal persons, mandates freezing without delay or prior notice, and establishes penalties for non-compliance. Vietnam has also expanded domestic designation powers to include entities owned or controlled by designated persons or acting on their behalf.

Yet several technical shortcomings remain. Authorities have not clarified the evidentiary threshold for making a designation proposal, nor demonstrated how identifying information is shared with foreign jurisdictions during designation requests. Public guidance for institutions on freezing, unfreezing and handling potential false positives is limited, and some key operational instructions have not been formally published.

Communication of designations has improved, but gaps in practical guidance mean institutions may interpret obligations differently, particularly in complex cases involving mixed accounts or layered asset structures. Without clearer supervisory expectations, implementation may vary widely between institutions.

Proliferation-financing controls lag even further. Vietnam has aligned its structure with relevant UN Security Council resolutions and uses the defence ministry as the central publishing authority for designations. A dedicated website with automated alerts has improved transparency.

However, freezing obligations related to proliferation lists are not yet fully enforceable. Penalties for non-compliance are weak or missing, and prohibitions on providing funds or other assets are not binding on all relevant actors. Reporting obligations similarly lack strong enforceability, limiting supervisors’ ability to drive adequate compliance. These weaknesses create space for a box-ticking approach rather than a robust operational regime, requiring institutions—especially those engaged in correspondent relationships—to maintain controls well beyond the minimum domestic threshold.

Suspicious-transaction reporting stands out as one of Vietnam’s most significant structural gaps. At present, reporting entities are required to file a report in two scenarios: when a transaction is conducted at the request of a suspect, defendant or convicted individual and the property is suspected of being owned or controlled by that person, and when a transaction triggers one of the specific indicators set out in the AML law and implementing circulars.

These narrow criteria fall short of the global requirement to report whenever there are reasonable grounds to suspect that funds constitute criminal proceeds or relate to terrorism financing. Over-dependence on predetermined indicators raises the risk of failing to capture unusual or emerging behaviours that do not fit into existing templates.

The framework for terrorism-financing reporting is even more fragmented. Certain provisions direct reports to the central bank’s AML department, while others require reporting to the ministry of public security. A new decree requires suspected terrorism-related assets to be reported within twenty-four hours, but the relationship between overlapping obligations has not been clearly mapped. This lack of harmonisation increases the likelihood of uncertainty or duplicated reporting.

Vietnam’s FIU also faces legal ambiguity. Although the AML department continues to function as the de facto FIU, the founding regulation that originally established it has expired, and the replacement instrument had not entered into force during the review period. This uncertainty could undermine the legal stability of intelligence operations and complicate international cooperation.

Attempted transactions are reportable and there is no minimum reporting threshold, both of which align with global standards. But these strengths cannot counterbalance the limited scope of what constitutes a reportable suspicion.

For banks and other obliged entities, the most prudent course is to define internal suspicion triggers far more broadly than domestic rules require. Training must emphasise behavioural and transactional analysis that reflects international good practice rather than relying exclusively on domestic indicator lists. This broader perspective is especially critical for terrorism-financing cases, where early detection often relies on subtle, atypical patterns that do not match standardised typologies.

By fLEXI tEAM