01 / Market Reality
Vietnam is Southeast Asia's fastest-growing verification corridor
2.1M+ IT-outsourcing workforce. Mid-transition from legacy CMND to chip-based CCCD. BHXH as centralised employment source. Law 91/2025 replacing Decree 13/2023. Provincial governance creates baseline variability.
0
IT-outsourcing workforce
VNISA, 2024
600+
MoET-recognised HEIs
Universities and colleges
63
Provinces
Decentralised judiciary
Law 91
Data protection
Effective Jan 2026
Vietnam's verification landscape is developing fast, but unevenly
Structural risk profile for offshore workforce screening
What's happening
Rapid IT-outsourcing growth concentrated in Ho Chi Minh City, Hanoi, and Da Nang. China+1 manufacturing diversification bringing Samsung, Intel, and Foxconn factories with distinct screening demand profiles.
Why it matters
Two parallel verification corridors: IT/BPO and manufacturing. Each requires fundamentally different screening models. A vendor optimised for one may fail at the other.
Where it breaks
CCCD/CMND transition creates dual-identity complexity. Provincial Justice Departments have variable responsiveness. No centralised criminal database. Rural candidate pools lack institutional infrastructure.
Reality insight
Vietnam's BHXH social insurance system provides a centralised employment trace comparable to India's EPFO. This is the single most reliable independent verification source in the market.
Samsung
Largest private employer
Bac Ninh and Thai Nguyen
Intel
Chip assembly/test
HCMC (Saigon Hi-Tech Park)
Foxconn
Electronics assembly
Bac Giang and Bac Ninh
CCCD
Chip-based national ID
Transition in progress
Cross-border complexity
Verification complexity increases in foreign-invested and cross-border environments. Samsung, Intel, and Foxconn supply chains introduce multi-jurisdictional candidate pools where screening must navigate both Vietnamese regulatory frameworks and parent-company compliance requirements.
Decision trigger
Does your vendor differentiate its Vietnam screening model between IT/BPO candidates and manufacturing corridor workers, or does it apply a single workflow to both?
02 / Hiring Risks
Four structural red flag patterns in Vietnamese screening
CCCD/CMND transition confusion, BHXH contribution gaps, provincial non-response, and unrecognised credentials. Detection rates from 1.1% to 2.6% across IT-outsourcing programmes.
Identity transition creates operational complexity
CCCD vs CMND: dual-identity risk during national transition
What's happening
Vietnam is mid-transition from the 9-digit CMND (old ID) to the 12-digit CCCD (chip-based ID). Both are currently valid. Phase-out deadline varies by region, with dual validity expected through 2026-2027.
Why it matters
Candidates may provide CMND when a CCCD exists. Claims can differ between versions: different name transliteration, different address. Transition-period confusion is a legitimate red flag, not always fraud.
Where it breaks
Screening programmes that accept either document without cross-referencing both. CCCD chip verification is available but not all vendors use it. Legacy systems built for 9-digit CMND may not validate 12-digit CCCD.
Reality insight
CCCD/CMND inconsistency detection rate is approximately 1.8% across IT-outsourcing programmes. Most cases are transition confusion, not deliberate fraud, but the distinction requires investigation.
detection frequency
Red flag detection rate: Vietnamese IT-outsourcing programmes
Per 1,000 candidates verified. IT services and outsourcing client base, 2024-2025.
BHXH contribution gapclaimed vs actual employment
21 / 1k
CCCD/CMND inconsistencyID transition confusion
18 / 1k
Provincial Justice delaynon-response beyond 21 days
13 / 1k
Unrecognised institutionnot on MoET list
11 / 1k
Source: OutsourceVerify Vietnam operating data, IT-outsourcing programmes, 2024-2025.
BHXH contribution gaps reveal employment history discrepancies
Social insurance records as independent verification layer
What's happening
BHXH (Bao Hiem Xa Hoi) maintains comprehensive contribution records for every formally employed worker. Every formal employer is required to register employees and make monthly contributions, creating an independent employment history trail.
Why it matters
When a candidate claims three years at an employer but BHXH records show contributions for only 18 months, the discrepancy warrants investigation. Detection rate: approximately 2.1% of IT-outsourcing candidates.
Where it breaks
Informal-sector and contractual workers may lack BHXH records entirely. The VssID mobile app allows candidates to view their own history, but screenshots should be treated as self-reported evidence, not primary-source verification.
Reality insight
Unlike India's UAN portal with nationwide digital access, Vietnam's BHXH records are managed at the provincial level. HCMC and Hanoi have more developed digital systems; provincial offices may still rely on manual retrieval.
2.1%
BHXH gap detection
IT-outsourcing programmes
1.8%
CCCD/CMND inconsistency
Transition-period cases
63
Provincial BHXH offices
Variable digital maturity
VssID
Self-service app
Not third-party verification
Access vs existence
Information may exist within the system, but verification depends on whether it can be legally accessed and confirmed. BHXH records are comprehensive, yet provincial access controls and institutional response determine what can be independently verified.
Decision trigger
Does your vendor request BHXH records directly from provincial offices, or rely on candidate-provided VssID screenshots? The difference determines whether employment verification is independent or self-reported.
03 / Compliance Landscape
Law 91/2025 elevated data protection from decree to statute
No longer an administrative regulation. This is a National Assembly law with statutory enforcement authority, defined penalties, and mandatory Ministry of Public Security registration.
Law 91/2025 on Personal Data Protection: the binding compliance framework
Replaces Decree 13/2023. Effective 1 January 2026. Implementing regulations in Decree 356/2025.
What's happening
Law No. 91/2025/QH15 on Personal Data Protection was enacted by the National Assembly, effective 1 January 2026. This replaces Decree 13/2023 with a full statutory framework. Decree 356/2025/ND-CP provides implementation details.
Why it matters
A decree is an executive regulation. A law is a statute. The elevation gives the framework stronger enforcement authority, clearer penalties, and greater legal certainty. BGV vendors now have direct statutory obligations as data processors.
Where it breaks
Vendors who began candidate screening without completing MPS registration are in statutory violation. Cross-border transfers require data impact assessments and pre-registration. Processing Vietnamese data on foreign servers without registration is a violation.
Reality insight
Most BGV contracts signed before January 2026 do not reference Law 91/2025 compliance. The transition from Decree 13/2023 creates a window where existing contracts may be operating under an outdated framework.
91/2025
Law number
National Assembly statute
Jan 2026
Effective date
Replaces Decree 13/2023
356/2025
Implementing decree
Promulgated 31 Dec 2025
MPS
Regulator
Ministry of Public Security
Key changes from Decree 13/2023
- Statutory authority. Decree 13/2023 was an executive regulation. Law 91/2025 is a statute enacted by the National Assembly, with higher legal force and more durable enforcement mechanisms.
- Mandatory pre-registration. Organisations processing sensitive personal data (criminal records, health data, biometric data used in BGV) must register with the Ministry of Public Security before processing begins.
- Cross-border transfer controls. Data impact assessments are now a statutory requirement. The MPS maintains a registration portal for transfer approvals.
- Data processor obligations. BGV vendors now have direct statutory obligations as data processors, not just contractual ones derived from their relationship with the controller.
Consent as constraint
Verification depends not only on process, but on what the candidate permits and what institutions are able to disclose. Under Law 91/2025, consent is not a formality: it defines the boundary of what can be lawfully verified.
Data residency and cross-border registration
Law 91/2025 strengthens restrictions on international data transfers. Employer BGV programmes must document where candidate data is processed and stored. Cross-border transfers require a data impact assessment and pre-registration with the Ministry of Public Security. Vendors should clarify their data residency model and MPS registration status.
Decision trigger
Has your BGV vendor completed mandatory registration with the Ministry of Public Security under Law 91/2025? Can they produce evidence of MPS registration, data residency documentation, and breach notification protocol on demand?
04 / Operational Gaps
Every check type has its own dependency chain, timeline, and failure mode
Provincial governance creates variable response times. HCMC and Hanoi resolve faster. Provincial and rural verification incurs higher costs and longer timelines.
Verification process: where it stalls
1
Candidate consent
Law 91/2025 compliant
2
Identity (CCCD)
Chip verification, 0-1 day
3
Employment
BHXH + HR confirm
Stall: provincial BHXH access
4
Education
MoET + registrar contact
Stall: provincial non-response
5
Criminal
Provincial Justice Dept
Gap: no national DB
6
Address
Field visit, geo-tagged
Identity: CCCD transition creates dual-document complexity
- CCCD (Citizen ID Card): 12-digit unique ID with embedded chip, biometric-linked. Issued by Ministry of Public Security. New primary identity document.
- CMND (Old ID Card): 9-digit ID, no chip. Still valid but being phased out. Dual validity expected through 2026-2027.
- Passport: acceptable for identity but not primary for domestic employment screening.
- Temporary Residence Book: issued by local ward authorities. Supports address and residence status verification for inter-provincial workers.
Employment: BHXH is the independent verification layer
- BHXH contribution records show every formally registered employer, contribution periods, and employment dates. The most reliable independent source.
- VssID mobile app allows individuals to view their own contribution history, but this is self-service, not a third-party verification portal.
- Provincial variation: HCMC and Hanoi BHXH offices have more developed digital systems. Provincial offices may still rely on manual record retrieval. Response times range from 2 to 7 days depending on province.
- Gaps: informal-sector workers, contractual roles without BHXH registration, new hires with registration delays.
Education: no centralised digital depository
- MoET (Ministry of Education and Training) maintains the accredited institution list. Degrees from institutions not on the list are not recognised.
- Education verification requires direct registrar contact, typically via email. No centralised digital depository like India's NAD exists.
- Vietnamese-language institutional responses are typical. Provincial institutional quality and responsiveness vary significantly.
- HCMC and Hanoi institutions typically respond within 5-7 days. Provincial institutions may take 10-14+ days.
Provincial institutional variance
Some provincial institutions have limited email infrastructure and may require phone or in-person contact. Programme accreditation status must be verified separately from institutional recognition. An institution on the MoET list does not guarantee all its programmes are accredited.
Permission-based system
Access to information is controlled, and verification outcomes are shaped by regulatory permissions and institutional response. Provincial BHXH offices, Justice Departments, and educational registrars each operate within their own disclosure frameworks.
Criminal: province-by-province, no national database
- No single national criminal record portal exists. Verification must be requested from the specific province where the candidate resides or worked.
- Each province's Justice Department issues Judicial Record Certificates (Ly lich tu phap). Response times vary by province and workload.
- Standard certificate format shows "No Record" or "With Record." Specifics require follow-up inquiry or case review.
turnaround time by check
Realistic TAT range per check type (days)
Observed ranges across Vietnam IT-outsourcing programmes, 2024-2025. Gold marker = typical median.
IdentityCCCD verification
0-1 days
EmploymentBHXH + HR confirm
2-4 days
EducationMoET + registrar
3-10 days
Criminalprovincial Justice Dept
4-12 days
Address, urbanfield-visit, HCMC/Hanoi
2-4 days
Address, provincialfield-visit, regional
5-10 days
Source: OutsourceVerify Vietnam operating data, IT-outsourcing programmes, 2024-2025.
What companies assume
Consistent timelines across all provinces
Single national criminal database search
BHXH records accessible digitally nationwide
CCCD has fully replaced CMND
Education verification is straightforward
IT/BPO vendor can handle factory screening
What actually happens
6-9 days for HCMC/Hanoi, 9-14 days for provincial candidates. Institutional non-response can extend TAT to 3+ weeks.
No national DB exists. Provincial Justice Departments issue certificates individually with variable response times.
Provincial variation is significant. HCMC and Hanoi have digital systems; other provinces may rely on manual retrieval.
Both remain valid. Dual validity expected through 2026-2027. Cross-referencing both is operationally necessary.
No centralised depository. Direct registrar contact required. Vietnamese-language responses. Provincial institutions may take 10-14+ days.
Different screening models. Factory ramp-ups require 500+ screenings in two weeks. Identity-focused, not education-focused.
Decision trigger
When your vendor reports "completed" on a criminal check, does that mean a Judicial Record Certificate from the relevant provincial Justice Department, or a database search against a system that does not exist nationally?
Defining insight
Verification confirms what can be accessed and disclosed. It does not always reveal what exists outside permitted access. In Vietnam, the distance between process completion and outcome completeness is defined by institutional access, consent scope, and provincial responsiveness.
05 / Decision Impact
Three scenarios. Three different risk exposures.
Your operating context determines your verification risk. Each scenario maps to a distinct failure mode in Vietnam.
Manufacturing Ramp-Up
500+ factory worker screenings in a two-week window. Samsung, Intel, or Foxconn supply chain requirement. Identity-focused, high-volume, seasonal surges. Vendor needs distinct operational model from IT/BPO.
Risk: IT/BPO-optimised vendor cannot scale to factory throughput requirements.
High exposure
IT/BPO Market Entry
First outsourcing engagement in Vietnam. No baseline for provincial variation. Vendor selection based on HCMC/Hanoi performance without testing provincial reach.
Risk: Programme designed for metro candidates fails when provincial hiring begins.
Medium-high exposure
Law 91/2025 Compliance Audit
Client or regulator audit requires evidence of data protection compliance. MPS registration, consent trails, data residency documentation, breach notification protocol under Decree 356/2025.
Risk: Vendor cannot produce MPS registration evidence, data impact assessment, or consent audit trail.
High exposure
Decision trigger
The right question is not "which vendor covers Vietnam." It is: does this vendor have provincial reach, manufacturing throughput capability, and documented Law 91/2025 compliance?
Business impact
In regulated environments, verification outcomes affect compliance, audit readiness, and operational risk. When verification reflects permitted access rather than complete information, the gap between process completion and outcome reliability becomes a business-level concern.
Operating reality
These conditions are not exceptions. They represent common operating realities across most verification programmes in Vietnam. The regulatory framework is developing, consent requirements are defined, and institutional access is controlled. Verification outcomes reflect these structural realities.
Executive Intelligence Summary
Vietnam: 7 conclusions for decision-makers
Provincial governance is the defining operational constraint. 63 provinces, no national criminal database, variable BHXH access, and province-by-province Justice Department certificates. The infrastructure is decentralised by design.
BHXH is the single most reliable independent employment verification source. Comparable to India's EPFO. Every formally registered employer appears in contribution records. But access is provincial, not national, and response times vary from 2 to 7 days.
The CCCD/CMND transition creates a verification complexity window through 2026-2027. Both documents remain valid. Cross-referencing is operationally necessary. Vendors must validate both formats, not just accept whichever the candidate provides.
Law 91/2025 is a statutory framework, not an administrative guideline. MPS registration for sensitive data processing and cross-border transfers must be completed before processing begins. Vendors operating without registration are in statutory violation.
Manufacturing and IT/BPO require fundamentally different screening models. Factory ramp-ups need 500+ identity-focused screenings in two weeks. IT/BPO needs deep credential verification on 50 candidates per month. A single vendor model rarely serves both.
Education verification has no centralised digital depository. Direct registrar contact in Vietnamese is required. Provincial institutions may take 10-14+ days. Programme accreditation must be verified separately from institutional recognition.
Vendor evaluation should test for provincial reach, not metro performance. HCMC and Hanoi are fast. The real test is whether your vendor can resolve a provincial Justice Department request, access a rural BHXH office, or field-visit an address in Bac Giang.
Country benchmark
Vietnam Verification Benchmark Pack
Market-specific constraints, institutional access data, typical timelines, and source verification pathways. PDF format, designed for internal circulation.
Request benchmark
Delivery in this market
Verification in this jurisdiction is executed by a regional cell with direct institutional access, operating under our central programme office. Cases run in parallel with other active markets. Evidence standards, quality gates, and escalation protocols are identical regardless of geography. Surge capacity is pre-built, not assembled on demand.
About this brief. Reflects the regulatory and operational landscape as of May 2026, incorporating Law 91/2025 on Personal Data Protection (effective January 2026) and Decree 356/2025. Workforce data sourced to Vietnam IT Software Association (VNISA). Manufacturing corridor data sourced from MPI and JETRO reports. Operational TAT ranges and red flag detection rates are first-party data from OutsourceVerify programmes, presented as observed ranges, not benchmarks.
References
- Vietnam IT Software Association (VNISA). IT and outsourcing industry statistics and workforce estimates. https://www.vnisa.org.vn
- Law No. 91/2025/QH15 on Personal Data Protection. Statutory law enacted by the National Assembly, effective 1 January 2026, replacing Decree 13/2023. thuvienphapluat.vn
- Decree 356/2025/ND-CP. Implementing regulations for Law 91/2025, promulgated 31 December 2025. thuvienphapluat.vn
- Vietnam Social Security (BHXH). Employment contribution records and member portal. https://bhxh.gov.vn
- Ministry of Education and Training (MoET). Higher education accreditation and institution list. moet.gov.vn
- Ministry of Justice. Provincial Justice Department coordination and Judicial Record Certificates. moj.gov.vn
- Credit Information Centre (CIC). Credit information system regulated by State Bank. cic.gov.vn
- Ministry of Public Security. CCCD and CMND issuance; civil registry; criminal records coordination; data protection registration under Law 91/2025. bocongan.gov.vn
- State Bank of Vietnam. Financial services regulator. sbv.gov.vn
- PDDikti (Higher Education Database). Database of higher education institutions and graduates. pddikti (access restricted)
- National Centre for Civil Registry (NCCIR). CCCD and CMND registration coordination. bocongan.gov.vn
- Da Nang Immigration Department. Example of provincial Justice Department structure for criminal records. bocongan.gov.vn
- HCMC Department of Police. Criminal record certificate requests for HCMC province. police.gov.vn (HCMC)
- Hanoi Department of Police. Criminal record certificate requests for Hanoi. police.gov.vn (Hanoi)
- Vietnam Post (VNPost). Postal services for certified record requests to Justice Departments. vnpost.vn
- VssID Mobile Application. Vietnam Social Insurance digital self-service portal for contribution history. bhxh.gov.vn (VssID)
- Ministry of Planning and Investment (MPI). FDI statistics and industrial zone development reports. mpi.gov.vn
- JETRO (Japan External Trade Organization). Vietnam manufacturing sector analysis and supply chain reports. jetro.go.jp
- Samsung Vietnam. Samsung Electronics manufacturing operations in Bac Ninh and Thai Nguyen. samsung.com/vn
- General Statistics Office (GSO). Vietnam workforce and employment statistics. gso.gov.vn
- National Assembly of Vietnam. Legislative proceedings and enacted laws including Law 91/2025. quochoi.vn