Vietnam Civil Cryptography Trading License and Import Permit for encryption products and services

ExtendMax – Pursuant to Law No. 86/2015/QH13 on Cybersecurity and Decree 58/2016/ND-CP (amended and supplemented by Decree 53/2018/ND-CP), importer need Civil cryptographic product trading license (Civil cryptographic items trading license) and Civil cryptographic product import permit to import data encryption products to Vietnam such as security router, security gateway, appliances having civil cryptography encryptions functions, ITE and ICT product used in bank infrastructure, appliance and ITE used in VOIP systems, meeting room equipment, security handheld terminal or walkie talkie...Civil cryptography Exemption Letter is also recommend for none civil cryptographic product but its HS code trigger import requirement regulated by the Decree 53/2018/ND-CP

Requiring license and permit as follows:

- Civil Cryptography Products Trading License (Dealer License)

- Civil Cryptography Products Import Permit

1. What is civil cryptography product and product categories

Common data encryption products under the above license are: Firewall, VPN Security Router, IPS Security Gateway, ICT appliances having encryptions functions, ITE used in Bank infrastructure, Appliance and ITE used in VOIP systems, Security smart phone....and classified under 8 categories:

(1) The product generates a cryptographic key, manages or stores the cryptographic key.

(2) Cryptographic component in PKI system.

(3) Product security data retention

(4) Network data exchange security products

(5) IP and channel security products

(6) Analogue and digital voice security products

(7) Radio security products

(8) Fax, telegraph security products

2. Requirements and procedure to obtain Civil Cryptography Products and Services Trading License

Requirements for Civil Cryptography Products and Services Trading License:

Importer / Dealer must meet below requirements and conditions in order to be granted trading license by Government Cipher Department:

→ Having Vietnamese Investment Registration Certificate or Enterprise Registration Certificate which include  IT products under its scope

→ Meet requirements on qualification of technical team (engineer and manager):

- Having at least 02 technical engineers having appropriate education degrees which is one of electronic, tele-communication, cyber security, information and technology, or mathematics degree.

- Having at least a manager having appropriate education degrees which is one of electronic, tele-communication, cyber security, information and technology, or mathematics degree. If not one of the list degrees, the manager must be trained and obtain a license on Cyber Security

Requirements are lower if applicant applies for Civil Cryptography Product Trading License only and requirements are higher if applicant applies for both Civil Cryptography Products and Services Trading License

→ Meet requirements on infrastructure including working space, equipment, functional departments suitable for targeted sale volume of cryptography product and services  

→ Having technical plan meet requirements of national technical regulations and technical standards

→ Have suitable business plan

Application dossier:

(1) Application letter for CCP dealer license

(2) A copy of Vietnam Business Registration License or Investment License or equivalent certificate

(3) Copies of Education Degrees and certificates of technical team and manager(s)

(4) Technical plan for applied list of products

(5) Cyber security plan for applied scope

(6) Business plan for applied scope

Licensing Authority

- After preparing applications dossier, applicant send a hard copy set of application dossier to National Agency of Cryptography And Information Security (NACIS) of Government Cipher Committee (GCC) under Vietnam Ministry of Defense

- Process to review application documents should take around 1 month – 2 months depending how well the application documents were prepared.

Civil Cryptography Products and Services Trading License has validity of 10 years. If license holder would like to modify, add more products/services scope, license holder need to apply for license modification. After having the trading license, importer shall have also apply for import permit for importing encryption products 

3. Requirement and procedure to obtain Civil Cryptography Product import or export permit

- Import Permit application letter

- A copy of Civil Cryptography Products (and Services) Trading License

- A copy of Type Approval certificate for Civil Cryptography Products according to Ministry of Defense technical regulation(s) (not implemented but soon be in 2020)

Civil Cryptography Products import permit used to be granted at 02 years validity but now the Authority only grants import permit at 01 year validity since early of 2019.

4. What can ExtendMax offer you or help you?

With many years of experience in applying for business licenses and import and export licenses of civil cryptography products for many organizations, we can assist you:

→ Classify products into groups that do not require a license, require a license but do not have to certify for conformity, and require both a license and certification of conformity

→ Support clients to prepare documents in the fastest time according to the requirements of the authorities

→ Representing enterprises in carrying out testing and certification procedures for civil cryptography products

→ Support other legal procedures related to imported products such as applying for licenses and certificates of conformity from the Ministry of Information and Communications

→ In case your importer is not qualified to apply for a license to trade in civil cryptography products, ExtendMax can provide Importer of Record (IOR) services to support.

Learn more:

IOR and EOR service for Vietnam