EXTENDMAX – During the procedure of consulting and helping importers, dealer to apply for civil cryptography products (CCP) trading license (CCP trading license or CCP dealer license) CCP import and export permit, ExtendMax constantly receives many similar questions from different customers. Therefore, we are writing this article to guide practical cases and to address common miss-understandings. First of all, we need to understand the important definitions and regulations on CCP specified in the Law on Network Information Security No. 86/2015/QH13 and Decree 58/2016/ND-CP (amended and supplemented by the Decree 53/2018/ND-CP):
The conditions for trading in civil cryptographic products (in Vietnam)?
Enterprises must have a license for trading the civil cryptographic products and services before trading civil cryptographic products and services specified by Decree 58/2016/ND-CP (amended and supplemented by the Decree 53/2018/ND-CP and Decree 32/2023/ND-CP.
How does Decree 58/2016/ND-CP stipulate the product list?
Decree 58/2016/ND-CP regulates 02 lists of products and 01 list of civil cryptographic services:
(1) Appendix I: Section I - List of civil cryptography products
(2) Appendix I: Section II - List of civil cryptographic services
(3) Appendix II: List of civil cryptography products exported and imported under permit
Answers to frequently asked questions - Q&A:
Question 1: Our company purchases CCP through another domestic company to distribute, trade, and not import directly from oversea countries. So, our company has to apply for a CCP dealer license for trading those products or not?
Ext answer: In case the company does not import products but buys from another importer the products listed in Appendix I: I - List of civil cryptography products, your Company must still have an CCP dealer license.
In fact, there are many CCP on the list specified in Appendix I but not on the list specified in Appendix II, so many companies have violated the regulations (unintentionally) when doing business of trading CCP without CCP dealer license.
Question 2: Our company imports CCP like firewalls, Ethernet switches, service routers, security gateway, security appliances, servers for internal use within the company, not for business purposes. Do we have to apply for CCP dealer license?
Ext answer: Pursuant to the Law on Network Information Security No. 86/2015/QH13 and Decree 58/2016/ND-CP:
→ Enterprises importing CCP specified in the list of CCP exported or imported under permit, must have import import permit.
→ Enterprises are granted the CCP import permit only when they meet the specified conditions in which having the CCP dealer license is a mandatory condition.
Therefore, in the case of CCP your company importing is only specified in Appendix I of Decree 58/2016/ND-CP (amended and supplemented by Decree No. 53/2018/ND-CP), your company does not have to apply for CCP trading license and CCP import permit.
In the case of CCP your company importing is specified in Appendix II of Decree 58/2016/ND-CP (the list of CCP subjected to export and import permit), your company must still apply for CCP trading license to be eligible to apply for CCP import permit
Question 3: We are the Vietnam representative office of a foreign company that importing, receiving CCP from the parent company sent to Vietnam and to set up an internal LAN system for internal use, not for business purposes. Can we apply for CCP trading license and CCP import license to import those products?
Ext answer: According to the current regulations of Vietnam, the Representative Office of a foreign company has no business function, so it is not the subject of "business licenses" including business licenses. license to trade in civil cryptographic products and services. Because it is not subject to a business license, your Representative Office will not be eligible to apply for a license to import civil cryptographic products. In this case:
→ If the imported civil cryptographic product is a specific type that is not available in the Vietnamese market, or the goods are civil cryptographic devices with pre-installed internal software, the Representative Office should use Importer of Record IOR services provided by a company that is qualified and licensed in accordance with regulations, or orders to buy from Vietnamese distributors who have a license to trade that product.
→ If the intended imported civil cryptographic product is available in the Vietnamese market and does not have special requirements for internal management software, enterprises should contact Vietnamese distributors to buy product. Please note that you should only buy products from distributors or importing companies that have a license to trade that product (the products are listed on the appendix of their CCP license) to ensure compliance with regulations of competent authorities.
Question 4: The product our company intends to import for business is a firewall device that has both civil cryptographic and network information security functions. So do we have to apply for CCP license to trade and import Civil Cryptographic products (issued by the Government Cipher Committee) and a license to trade and import Cybersecurity products (issued by the Ministry of Information and Communications) at the same time or not
Ext answer: The above two licenses do not apply to the same product at the same time, the reasons are as follows:
→ Pursuant to Point c, Clause 6, Article 38 of the Law on Cyber Information Security No. 86/2015/QH13, civil cryptographic products are not within the scope of responsibility of the Ministry of Information and Communications
→ Pursuant to Clause 1, Article 42 of the Law on Cyber Information Security No. 86/2015/QH13, civil cryptographic products are not within the scope of licensing for trading in cybesecurity products and services.
Therefore, civil cryptographic products, which have been granted a civil cryptographic license, do not need to apply for a cybersecurity license anymore. Your company only needs an CCP license to be able to import and do business in accordance with regulations
Question 5: Our company sells products that are security software which has civil cryptography function and installed for customers remotely (via cloud), so does our company have to apply for CCP dealer license and CCP import permit?
Ext answer: The software product with civil cryptography function is a product on the list of CCP, so your company must to have the CCP dealer license.
→ In case your company sells software with civil cryptography features to customers via cloud, your company does not have to apply for CCP import permit.
→ In case your company sells software with civil cryptography features contained in an hard drive, smart card, or computer .. and product description, HS Code coincides with the listed product in Annex II of Decree 58/2016, the Company needs to apply for CCP import permit as prescribed
Question 6: How do I determine if a product has a civil cryptographic feature and need to apply for an CCP dealer license?
Ext answer: All civil cryptographic features are listed in Appendix I of Decree No. 58/2016/ND-CP. In case you are not able to figure out, you can send an email request to the following addresses for expert help:
1. ExtendMax's consulting and business support portal
- Email: consultant@extendmax.vn
- Tel: +84 24 6666 3088
2. Portal of National Agency of Cryptography and Information Security (NACIS) - Government Cipher Committee
- Email: info@nacis.gov.vn
- Phone: +84 24 3775.6896
Question 7: We have contacted the web portal of the NACIS and it was confirmed that our importing products are not CCP, however, the Customs has requested a written letter of confirmation issued by the NACIS, so what do we do?
Ext answer: Previously, the NACIS used to issue written letter of confirmation, but since 2018, the NACIS only confirmed via email (via the web portal). In that case, your company can print the reply email, confirmation of the NACIS to present to Customs officers for clearance.
Question 8: We have contacted the NACIS’s portal have been verified that the importing product is a civil cryptography product. So do we have to apply for CCP import permit to get clearance?
Ext answer: Usually enterprises only send product technical documents to the NACIS in order to get confirmation whether the product is a CCP or not. In that case, you need to determine whether the importing CCP falls into any of the following two cases:
Case 1: Civil cryptography products which listed on Appendix II of Decree 58/2016/ND-CP (both HS Code and product description) → Your company needs to apply for CCP dealer license and CCP import permit to import
Case 2: Civil cryptography products are included in Appendix I but not listed on Appendix II of Decree 58/2016/ND-CP (do not match the HS Code or do not match the product description) → Your company don’t need to apply for the CCP import permit, but still need to apply for a CCP dealer license if the product is for commercial purposes.
Question 9: Does our company import phone SIM cards, describe the goods as "smart cards" and have the code HS 8523.52.00 in Appendix II LIST OF CIVIL CODE PRODUCTS FOR EXPORT AND IMPORT LICENSE issued under Decree No. 58/2016/ND-CP dated July 1, 2016 of the Government. Do we have to apply for a license to import MMDS products?
Ext answer: Ordinary phone SIM products do not have encryption function, so they are not MMDS products, so they do not have to apply for CCP import license when importing (except for some very rare special SIM types). For example, SIM M2M - Machine to Machine has symmetric or asymmetric encryption to secure the data in the SIM, embedded directly into the SIM). Regarding ordinary phone SIM, there is currently a lot of confusing information on the internet, there is even an online consulting website that states that the phone SIM must apply for a CCP import license. Currently, NACIS of the GCC is the only agency that has the authority to confirm whether a product is a civil cryptographic product or not. Your company should contact directly with the Department of Civil and Commercial Affairs Management and Proclamation to be properly verified.
Question 10: Does our company import and sell POS payment machines (MasterCard, VisaCard, domestic payment cards), is this product a Civil Code product?
Ext answer: POS machines (MasterCard, VisaCard, domestic payment cards) will normally have encryption function (usually symmetric encryption) to protect the card's PIN, so this is civil cryptographic products. POS payment machines usually do not have IP flow and channel security features, so they will not be covered by Appendix 2 - Decree No. 58/2016/ND-CP, your company does not have to apply for a CCP import license to import products, but must obtain a license to trade in civil cryptographic products to be eligible for legal business.
Question 11: We are importing and trading Wi-Fi router and Access Point. Are they civil cryptographic products?
Ext answer: Wifi transmitters (Wifi Routers or Access Points) typically feature symmetric encryption to protect passwords, but typically encryption to protect passwords is not within the scope of cryptographic use cases need to be managed by NACIS. However, there are many cases where WiFi transmitters having VPN and IP security features (typically Meraki MR series devices) that must be imported and exported under a civil cryptographic license. Because the HS code of the Wifi transmitter is 85176251, your company needs to check which of the following 2 cases your product belongs to.
→ Case 1: In case the Wifi transmitter device (Wifi Router or Access Point) has VPN or IPS features, your company must apply for both a CCP trading license and and CCP import license.
→ Case 2: In case the Wifi transmitter device (Wifi Router or Access Point) does not have VPN or IPS features, your company does not have to apply for CCP trading license and and CCP import license.
→ You can find more details on this case via our separate article to guide market access requirements for Routers or Access Point.
Question 12: Our CEO is a foreigner and using a personal account of a foreign bank. Currently, that bank has sent to Vietnam a device to generate an OTP code (bank token) to authenticate payment for a personal account. Can our CEO apply for a civil cryptographic license or not?
Ext answer: According to the current legal regulations, individuals are not the subject of business licenses to import civil cryptographic products, so in the case of bank tokens sent in the name of an individual will not legally pass customs clearance. In this case, CEO of your company can choose one of the options in accordance with current law as below:
→ Option 1: Bring this bank token as personal luggage (hand carry) to Vietnam
→ Option 2: Change the importer into an organization (importing under the company's name) and apply for a business license, import products under the company's name
→ Option 3: Hire a professional Importer of Record IOR service supplier like ExtendMax to import products in accordance with the law
Question 13: Is the civil cryptographic product we are importing required to be certified for conformity? Where to certify conformity, according to which technical regulations?
Ext answer: Some civil cryptographic products belonging to the channel stream security group using IPSec and TLS technologies or stored data security products are subject to CCP conformity certification according to national technical regulations issued by the Ministry of Defense. Please find detailed instructions through ExtendMax's own article on the procedure to apply Type Approval for civil cryptographic products.
Question 14: Currently, we are planning to import civil cryptographic products urgently to serve the self-use needs of businesses, but the time to apply for a license may not meet the production plan. So what measures do we have to import faster?
Ext answer: In case your company needs to import urgently, you can use the commercial service of civil cryptographic products or the importer of record (IOR) service of ExtendMax to ensure that you meet the requirements. production plan of the factory.
Question 16: How long does it take to obtain a civil cryptography license? Are there ways to expedite the process?
Ext answer: The processing time for applying for a civil cryptography license is regulated by law as follows:
- Processing time for the first-time application for a civil cryptography business license: 30 working days
- Processing time for an additional application for products or services under an existing civil cryptography business license: 10 working days
However, to calculate the timeline more accurately, you should consider the following:
- Time to prepare the application dossier: 2-3 weeks
- Waiting time for the licensing authority to officially accept the application: 2-5 days
If the first-time licensing process does not meet your project timeline, purchasing products from a domestic supplier or using ExtendMax's IOR & EOR services can be a better alternative.
Above are the views and instructions of ExtendMax. Please feel free to contact us with other questions or your case not listed above.
Contact information for market access requirements consulting
EXTENDMAX VIETNAM COMPANY LIMITED
Hotline: +84 915 836 555 | Hanoi: +84 24 6666 3066
Email: consultant@extendmax.vn | phuong.tran@extendmax.vn
HO: ExtendMax Villa, C01-L18 An Vuong, Duong Noi urban area, Duong Noi ward, Ha Dong district, Hanoi City, Vietnam
If you find our article useful and valuable in practice applications, please support us by rating it, leaving your comment at the bottom of this article, and sharing it with your colleagues or the industry. Your review will be a great motivation for us to write more detailed and valuable procedural guides for importing, exporting organizations.
↓ ↓ ↓ ↓ ↓ ↓ ↓
