Procedures for applying for an import/export license for civil cryptographic products

International trade in civil cryptographic products is subject to strict oversight by the competent State authorities. Where an enterprise wishes to export or import products falling within the list regulated under Appendix II of Decree No. 341/2026/ND-CP, it must not only satisfy the general requirement of holding a Business License, but is also required to carry out the procedures for applying for an Import/Export License for Civil Cryptographic Products, which is issued directly by the Government Cipher Committee.

Scope of application

When exporting or importing civil cryptographic products included in the List of Civil Cryptographic Products Subject to Export/Import Licensing under Appendix II of Decree No. 341/2026/ND-CP, an enterprise must hold an Import/Export License for Civil Cryptographic Products issued by the Government Cipher Committee.

Validity period: The Import/Export License for Civil Cryptographic Products is valid for 03 years.

Principles for applying the List: The List of Civil Cryptographic Products Subject to Export/Import Licensing applies only to products for which the HS code, the goods description, and the description of the cryptographic technical characteristics all match the List issued together with the Decree. Where there is a discrepancy in determining the goods code between this List and the Vietnam Export and Import Commodity Nomenclature, the goods code shall be determined in accordance with the law on customs.

Note: For dual-use products (having both civil cryptographic functions and cybersecurity functions), the Ministry of Public Security is the authority that issues the Import/Export License, after obtaining a written opinion from the Government Cipher Committee on the civil cryptographic functions.

Conditions for issuance for an import/export license for civil cryptographic products

Holding a valid Business License for the corresponding civil cryptographic products and services;
Imported civil cryptographic products must be certified and declared as conformant with applicable technical regulations;
The subjects and purposes of use of the civil cryptographic products must not cause harm to national defense, national security, or public order and social safety.

Dossier for application for an import/export

An application form for an Import/Export License for Civil Cryptographic Products, which declares the list of products for which an export/import license is requested, including:

Product Name;
Manufacturer name;
Model/Part number;
HS code;
Country and year of manufacture;
Quantity and technical standards/regulations;
Technical characteristics;
Purpose of export/import.

The dossier shall be prepared in 01 set and submitted in person, via the postal system, or via the National Public Service Portal to the Government Cipher Committee; a dossier submitted online must be digitally signed in accordance with the law on digital signatures.

Sequence of produres for applying for an import/export license for civil cryptographic products

Process	Detailed Description
Step 1	The enterprise shall prepare and submit 01 set of the dossier to the Government Cipher Committee in person, via the postal system, or via the National Public Service Portal (online submissions must be digitally signed).
Step 2	Within 01 working day from the date of receiving the dossier, the Government Cipher Committee shall verify the validity of the dossier. If the dossier is invalid, the Government Cipher Committee shall notify the enterprise in writing of the contents requiring amendment or supplementation; The enterprise has 01 working day from the date of receiving the notification to complete the dossier; Where the amendment or supplementation still fails to meet requirements, or is made after the deadline, the Government Cipher Committee shall, within 01 working day, notify the enterprise in writing of the reasons for refusing to issue the license.
Step 3	Within 06 working days from the date of receiving a complete and valid dossier, the Government Cipher Committee shall appraise the dossier and issue the Import/Export License for Civil Cryptographic Products. In case of refusal to issue the license, the Government Cipher Committee shall notify the enterprise in writing, clearly stating the reasons.

Processing time

01 working day to verify and notify the validity of the dossier;
01 working day for the enterprise to supplement the dossier, where requested;
01 working day to notify in writing of the reasons for refusing to issue the license, where the amendment or supplementation still fails to meet requirements or is made after the deadline for completion;
06 working days from the date of receiving a complete and valid dossier for the Government Cipher Committee to appraise the dossier and issue the License.

Checklist for enterprises: import/export license for civil cryptographic products

Step 1. Review and classify the products to be exported or imported: Cross-check the entire list of products intended for export/import against the List of Civil Cryptographic Products Subject to Export/Import Licensing under Appendix II of Decree No. 341/2026/ND-CP. Please note that the List applies only where all 03 elements (HS code, goods description, and description of cryptographic technical characteristics) match the actual product;

Step 2. Determine the licensing authority: Determine whether the product is a civil cryptographic product or also has cybersecurity functions (a dual-use product), and thereby identify the correct authority for receiving the dossier and the applicable procedures.

Step 3. Verify the prerequisite conditions: Review before submitting the dossier to ensure that all 03 conditions under Clause 1, Article 10 of Decree No. 341/2026/ND-CP are satisfied, namely: the License, the certification and declaration of conformity of the product, and the purpose of use in relation to national defense, national security, and public order and social safety;

Step 4. Standardize the technical dossier: Prepare the application form together with a detailed declaration schedule for each product;

Step 5. Review the obligations to maintain the validity of the License: Establish a mechanism to monitor the validity period of the License (03 years) and carry out exports/imports within the granted validity period, so as to avoid revocation.

COMMITMENT TO SERVICES

On time

All that we do will be planned specifically in terms of time and content. You can control what we do, and the time to completion, and in all cases, we help you maintain the enterprise’s compliance with the deadlines with competent authorities and employees.

Exactly

We commit to the accuracy of the contents of consultation, established documents, and services we provide to customers. We aim to provide you with a safe and effective legal solution for your business operations.

Security

We establish a confidentiality commitment with you, so information about the enterprise, human resources, finance, etc., and other contents related to enterprises and investors will only be disclosed with your consent or in accordance with the laws of Vietnam.

SERVICE PERFORMANCE PROCESS

Assign

CDLAF assigns designated personnel responsible for ensuring information security, ensuring that only assigned individuals have the right to access information and handle client communication.

Collect information and prepare the service contents

Assigned personnel are responsible for collecting clients information, reviewing regulations and preparing service content.

Control the quality

The Board of Lawyers and Counsels reviews the service content prepared by the assigned personnel before it is sent to clients for their review.

Clients’ approval

Clients review and approve the service content prepared by CDLAF. When requested, meetings are held to explain the prepared content.

Completion

Personnel responsible for service completion directly implement it at the competent authority (if required). They also monitor the progress, report the results, and hand them over to clients.

After-service support

Guide clients to perform necessary tasks related to the delivered results and provide updates on changes in legal regulations.

People

Contact Us

Are you confused? If you want to discuss your problem more specifically, let us help you, please fill in the information in the table below and send it to us. A free 45-minute consultation email or meeting will be arranged to help you better understand your problem solving problem.

FAQ QUESTIONS: Procedures for applying for an import/export license for civil cryptographic products

What are “civil cryptographic products” and “civil cryptographic services”?

Civil cryptographic products: These are hardware, software, documents, technical equipment, and cryptographic professional equipment designed and manufactured to protect information.

Civil cryptographic services: These comprise information protection services using civil cryptographic products; civil cryptographic product assessment services; and security and cybersecurity consulting services using civil cryptographic products.

Must foreign enterprises providing services in Viet Nam store data in Viet Nam?

Yes. The law provides that domestic and foreign enterprises providing services on telecommunications networks, the Internet, and value-added services in cyberspace in Viet Nam, if they engage in the collection, exploitation, analsys, or processing of the categories of data within the scope prescribed by the Law, may be required to store such data in Viet Nam for a period prescribed by the Government.

Is the provision of cybersecurity inspection and assessment service a conditional business line?

Yes. The Law lists “cybersecurity inspection and assessment services” within the group of cybersecurity services. In addition, there are other services such as information security using civil cryptography, civil cryptography, cybersecurity consulting, cybersecurity monitoring, incident response, data recover, cyberattack prevention and combat, and other cybersecurity services.

According to Article 29, enterprises trading in cyber security products and services must have a license to trade in cyber security products and services, and at the same time must meet the responsibilities of maintaining business conditions, service quality, confidentiality of customer information, managing records and coordinating with specialized forces when required.

Why are civil cryptographic products required to be inspected, certified and declared conformity before commercial circulation?

Mandatory requirements: Civil cryptography products must be inspected and certified for conformity before being circulated on the market to ensure the quality of cryptography meets standards

Management mechanism: The Government Cipher Committee is responsible for managing the quality of civil cryptography products and services through the appointment and management of activities of civil cryptography conformity assessment and certification organizations

This helps protect end users from products that contain dangerous encryption vulnerabilities or are installed with spyware and protect national security in cyberspace.

What are the necessary and sufficient conditions for an enterprise to be granted a license to export and import civil cryptographic products?

According to Article 10, Clause 1, the enterprise must fully meet the following 03 mandatory conditions:

Having a valid license to trade in corresponding civil cryptographic products and services.
Imported civil cryptographic products must be certified and declared technical-regulation conformity according to Vietnamese technical standards.
The objects to which the products are transferred and the purpose of using these civil cryptographic products do not harm national defense and security and social order and safety.