Vietnam Civil Cryptography Imports and HS Code Checks

Updated: 23 September 2026

An HS code is important but insufficient to establish whether a product requires a civil cryptography export or import licence. Article 9 of Decree No. 341/2026/ND-CP requires simultaneous assessment of the HS code, goods description and cryptographic characteristics against the list. Checking only the code may overlook a decisive product feature.

Three criteria that must match the list

Annex II to Decree No. 341 lists civil cryptography products subject to export and import licensing. Under Article 9, all three criteria must be met: HS code, product description and cryptographic characteristics. Technical documents must identify the exact version, functions and configuration intended for import.

Two devices in the same commercial product family may have different cryptographic functions or uses. A generic description of the entire range may be insufficient. Obtain documents for the correct product code and check consistency across the contract, invoice, technical records and application.

Business licences and import licences are different

A business licence establishes the conditions and scope in which an enterprise may operate. An export or import licence governs activities involving listed products. Article 10 requires review of business licensing, applicable quality or conformity requirements and lawful intended use.

A civil cryptography business licence therefore does not replace an import licence. Conversely, an import licence does not waive business conditions or responsibilities for placing products on the market. Customs and quality procedures must be assessed under their respective laws.

Where to submit the dossier

Article 10 prescribes Form No. 05 in Annex III and supporting documents. The Government Cipher Committee handles matters within the civil cryptography remit. Use the published submission and electronic filing procedures, ensuring documents accurately describe the product, quantity or requested scope required by the form.

The process includes one working day for validity checking and one working day for supplementation as prescribed. Processing takes six working days from receipt of a complete valid dossier. Article 9 provides a three-year export and import licence term. These periods do not replace monitoring the contents and conditions of the issued licence.

Products also classified as cybersecurity products

Article 9 provides a mechanism for products within both civil cryptography and cybersecurity: the Ministry of Public Security acts within its authority after receiving the Government Cipher Committee's opinion. Assess Decrees Nos. 332 and 341 together to choose the correct procedure.

A classification record should identify technical sources, cybersecurity functions, cryptographic functions and conclusions against each list. It is a preparation and explanation tool; the competent authority still determines the application outcome.

What to monitor after import

Article 12 of Decree No. 341 sets business responsibilities, including information management and reporting. Maintain traceability between products, import dossiers, customers and licence scope. Changes in functions or configurations, or new products, require reassessment rather than automatic reliance on an earlier product code's paperwork.

Further review when products enter use

An import licence addresses one stage of bringing goods across a border. Deployment also requires review of cybersecurity plans, access rights and data protection duties. A device transmitting diagnostic logs or enabling remote support should be assessed for data, recipients and processing locations rather than assumptions based on its label.

If transmitted information is personal data within a cross-border transfer, assess Article 20 of the Personal Data Protection Law. If the device forms part of a system's level-based protection plan, its actual configuration must match that plan. The security level dossier and cloud articles connect import requirements with operational responsibilities.

Frequently asked questions

Can a previous classification be reused for the same HS code? Also check the description and cryptographic characteristics; identical codes do not establish identical outcomes.

Is a manufacturer's statement that no licence is needed sufficient? Manufacturer documents provide technical information. Vietnamese obligations must be checked against current rules and lists.

Does a licence guarantee customs clearance? No. Clearance also depends on documentation, classification and legal requirements applicable to the shipment.