Civil Cryptography Under Decree No. 341/2026/ND-CP: Licensing of Dual-Use Products and 12 Exemptions

For businesses importing equipment, integrating systems or distributing technology hardware, civil cryptographic licenses have long been the most likely bottleneck at the customs clearance stage. The biggest practical problem for businesses does not lie in the refusal to comply, but in the ambiguous boundary: A network device with integrated security (such as a firewall, router or VPN infrastructure) must apply for a cybersecurity license at the Ministry of Public Security or a civil cryptographic license at the Government Cipher Board. At the same time, there is the worry of having to apply for sub-licenses for even common IT products just because the device contains a few sub-encryption algorithms. Officially effective from September 1, 2026, Decree 341/2026/ND-CP has directly solved these problems. The new document clearly establishes a one-stop interdisciplinary coordination mechanism for “dual-use products”, and at the same time officially clearly defines for enterprises by filtering 12 groups of common IT products that are completely exempt from the obligation to apply for business licenses.

1. Decree No. 341/2026/ND-CP applies to which group of subjects?

Scope of Application: Decree No. 341/2026/ND-CP applies to Vietnamese agencies, organizations and individuals; foreign agencies, organizations and individuals in Vietnam; and other entities involved in civil cryptography activities in Vietnam. For enterprises, the key activities subject to regulation include the business of civil cryptography products and services and the export and import of civil cryptography products subject to regulatory management.

Note on the Scope of Licensing: Similar to the previous regulations, in practice, not every enterprise engaged in the business of network and security equipment or the import of IT hardware and software is automatically required to obtain a civil cryptography license. The licensing obligation must be determined based on the specific products, services and activities falling within the regulatory scope of the Decree. Enterprises should continue to review the functions, intended use, technical characteristics and product lists set out in the Appendices to determine the corresponding legal obligations. Under Decree No. 341/2026/ND-CP, the obligation to obtain a license only arises when the enterprise’s products and activities simultaneously satisfy the following specific technical and legal conditions:

• Regarding the technical nature and functions of the product: A product is subject to regulation only when it is specifically designed to protect information outside the scope of state secrets by means of cryptographic techniques (using symmetric or asymmetric algorithms). If the cryptographic function serves only a supporting role, is pre-integrated into common IT devices, or falls within the 12 excluded groups under Appendix I (such as non-data-encrypting identity authentication, SED hard drives, TPM chips, cyberattack prevention tools, etc.), the enterprise is not required to obtain a business license.
• For distribution and commercial supply activities (Business License): A Business License (valid for 10 years) issued by the Government Cipher Committee is mandatory if an enterprise conducts business in products belonging to the 07 specialized groups under Appendix I (such as HSM hardware modules, PKI Tokens, specialized storage encryption software/devices, IP flow security devices using IPsec/MACsec VPN, etc.) or provides 03 specialized services (information protection services using civil cryptography products, civil cryptography product assessment services, and security consulting services using civil cryptography products).
• For Customs Clearance Activities (Import/Export License): An enterprise is only required to obtain an Export/Import License (valid for 03 years) when the goods fully satisfy the “Three-Point Match” principle set out in Appendix II: matching HS code, matching product name/description, and matching cryptographic technical characteristics. If any one of these three elements is missing, the product is not subject to the specialized import/export licensing requirements.
• In the case of cybersecurity products integrating cryptography (Dual-Use Products): For new-generation network devices that simultaneously integrate cybersecurity features (such as firewalls and intrusion prevention systems (IPS)) and civil cryptography features (traffic encryption), enterprises do not submit a separate application for a civil cryptography business license to the Government Cipher Committee, but instead must carry out procedures to obtain a Business License for cybersecurity products and services from the Ministry of Public Security; in such cases, the Ministry of Public Security will proactively seek written professional assessment opinions from the Government Cipher Committee before granting the license.

The focus of Decree no. 341/2026/ND-CP: This Decree regulates civil cryptographic products and services; conditions for trading in civil cryptographic products and services; export and import of civil cryptographic products; and at the same time stipulates the competence, dossiers, order and procedures for granting, amending, supplementing, suspending and revoking licenses for trading in civil cryptographic products and services and licenses for export and import of civil cryptographic products.

The spirit of transparency: Clearly delineate the interdisciplinary licensing mechanism, shorten the time for processing administrative procedures and officially specify in Appendix I the technology products exempted from business licensing.

• Clearly delineate the interdisciplinary licensing mechanism: The Government Cipher Board assumes the prime responsibility for licensing civil cryptography activities. For dual-use products/services related to both civil cryptography and cybersecurity, the Ministry of Public Security grants licenses after consulting the Government Cipher Committee.
• Shortening and concretizing administrative procedures: Decree 341/2026/ND-CP clearly stipulates the time limit for settlement of each procedure. Dossiers for issuance of new licenses for trading in civil cryptographic products and services shall be checked for validity within 01 working day and appraised and licensed within 12 days from the date of receipt of complete and valid dossiers. In case of modification due to change of name or legal representative, the time limit for settlement is 05 working days. For export and import licenses, the time limit for settlement is up to 06 working days.
• The list of products is specifically determined: The Decree promulgates Appendix I on the list of civil cryptographic products and services and Appendix II to import and export products under licenses. Enterprises only have to apply for permission for products on the list; the determination is based on HS codes, descriptions of goods and cryptographic technical characteristics, helping enterprises to clearly define the scope and obligations of licensing.

2. Licensing Mechanism for “Dual Use Products” (Cybersecurity and Civil Cryptography)

Dual-use product concept: Devices and software that simultaneously integrate cybersecurity features (such as firewalls, monitoring/prevention of cyber attacks) and civil cryptography features (transmission encryption, data encryption).

The “One-Stop” mechanism at the Ministry of Public Security:

• The Ministry of Public Security is the focal agency for receiving dossiers, appraising and granting licenses for trading in cyber security products and services as well as export and import licenses for dual-use products within the scope of regulations.
• Responsibility for inter-sectoral coordination: Before granting a license, the Ministry of Public Security is required to obtain written appraisal opinions from the Government Cipher Committee on the civil cryptography feature.

Thus, the “one-stop” mechanism only simplifies the procedural focal point, not eliminates the requirement for specialized appraisal of cryptography. If in the past, the group of products with civil cryptography as the main and important feature would be handled at the Government Cipher Committee, while the rest of the products would be considered at the Ministry of Public Security, now we have the concept of dual-use products, and the focal point for consideration and settlement will be carried out directly from the Ministry of Public Security.

Mandatory technical conditions: Although licensed by the Ministry of Public Security, civil cryptography features on dual-use products are still required to fully meet specialized technical standards and regulations on civil cryptography.

Before the Ministry of Public Security grants a license, the Government Cipher Committee is responsible for giving a written opinion on the civil cryptography feature of the product. This mechanism simplifies and facilitates procedures while still ensuring professional control over the cryptographic function of the product.

3. Filter 12 IT product groups excluded from business licensing (Appendix I)

Decree No. 341/2026/ND-CP specifies 12 groups of information technology products that use cryptography techniques but are not within the scope of conditional civil cryptographic products and services, has clarified the list of products that use cryptographic techniques but are not considered conditional business products, helping businesses avoid applying for redundant licenses or customs clearance congestion:

Group 1: Consumer products and general commercial software

• Operating systems, Internet browsers, built-in cryptographic software are available (the cryptographic function is not the main function), which are installed by the user himself. Products that have built-in cryptography components but the function of protecting information by cryptographic techniques is not the main function, are widely used and allow users to install them themselves without support from the supplier
• Universal IT products with secondary cryptographic features: Tablets, DVD players, digital cameras, cameras, other corresponding civil electronic products, in which the cryptographic function is not the main function.
• Mobile phones without end-to-end encryption capabilities: Mobile phones without end-to-end encryption capabilities are excluded from the category of conditional business civil cryptography products.

Group 2: Common network infrastructure, management and network security equipment

• The product only has the Authentication function, there is no data encryption function at all.
• The product uses cryptography technology only for the purpose of monitoring, preventing, and detecting cyber attacks.
• Devices/solutions that use cryptography for the purpose of remote access, internal device administration.
• Devices/solutions that use cryptography to protect access to wireless networks (Wi-Fi).

Group 3: Storage hardware and integrated components

• Storage hard drives with SED (Self-Encrypting Drive) technology are widely used.
• The integrated circuit uses TPM (Trusted Platform Module) technology to identify devices, authenticate information, and protect passwords.

Group 4: Specialized license, card, and medical applications

• Smart cards and readers/writers are for general access only, protecting personal information only.
• Copyright and intellectual property protection products (DRM, anti-copying software, media).
• The product is specifically designed for end-to-end use only in the medical field.

The Decree shifts from approaching management according to the use of cryptography techniques by products to determining according to the purpose, main functions and scope of use of products, contributing to ensuring the management of the right subjects, reducing compliance costs and facilitating business activities and product circulation.

4. Conditions for trading in civil cryptographic products under the new decree

Enterprises are forced to be granted the right to do business, then the right to import civil cryptographic products. In which, a business license is considered a prerequisite and an export-import license is understood as a sufficient condition, currently Decree 341/2026/ND-CP is stipulating the validity period of a license to trade in civil cryptographic products and services with a term of up to 10 years, and a license to export and import civil cryptographic products with a term of 03 years.

Compared to the previous regulations, Decree 341/2026/ND-CP concretizes personnel conditions in the direction of clearly quantifying the number, position and professional qualifications, helping enterprises easily determine and prove their ability to meet licensing conditions, whereby:

• At least 02 technical staff: University diploma or higher in electronics – telecommunications, IT, mathematics or information security.
• At least 01 manager and executive officer: Graduated from one of the above majors, or graduated from another specialized university with a certificate of training in information security and security.

Shortening the time limit for appraisal and licensing according to new regulations:

• Receiving and checking the validity of the dossier: Processing within 01 working day. The Government Cipher Committee shall check the composition and validity of the online dossier; in case of incompleteness, it must notify in detail the contents to be amended and supplemented, ensure that the dossier is processed in a timely manner, and limit the repeated addition.
• Issuance of a new business license: Appraisal and licensing within 12 days from the date of receipt of a complete and valid dossier (instead of the previous extended time).
• Issuance of import and export licenses: Appraisal and licensing within 06 working days.
• Amendment (05 working days), additional grant (09 working days).

5. Post-inspection obligations and reporting responsibilities of enterprises

Obligation to manage customer information: Enterprises are responsible for establishing, storing and maintaining customer information, the quantity, type and purpose of use of civil cryptographic products.

Annual report: Enterprises are required to submit reports on business, import and export and synthesis of customer/end-user information to the Government Cipher Board before December 31 (according to Form No. 07, Appendix III).

Strengthening post-inspection sanctions – Risk of suspension and revocation of licenses: Enterprises may be suspended from business for up to 06 months if they fail to maintain sufficient personnel/technical conditions; at the same time, their licenses will be revoked if they do not deploy services for 01 year or provide false information in the licensing documents.

The above regulations shift the focus from pre-licensing control to a combination of pre-inspection and post-inspection, whereby enterprises must not only meet the conditions at the time of licensing but also must continuously maintain business conditions, ensure the accuracy of information and take responsibility throughout the operation process.

📩 BOOK A CONSULTATION WITH CDLAF’S LEGAL TEAM

Do not let procedural errors disrupt your business plans. Contact CDLAF today to receive a preliminary risk assessment from our team of Lawyers and E-commerce Legal Experts:

Hotline/Zalo: [+84 909 668 216]

Email: info@cdlaf.vn

You can refer for more information:

• Transferring Employees to Perform Other Works: Key Considerations for Enterprises
• Lawful Labor Discipline: Procedures and Key Notes for Enterprises
• Non-Compete Agreements In Employment Relationships: Are They Enforceable In Vietnam?
• Determining “Serious Damage” in Disciplinary Dismissal
• What Must Social Networks and Online Platforms Do to Comply with the Personal Data Protection Law 2025?