SOC 2 · Fintech

SOC 2 for Vietnamese fintech

Vietnamese fintech faces two distinct compliance pressures at the same time. Externally: US customers and investors ask for SOC 2 reports. Domestically: Vietnamese law, particularly Vietnam's Personal Data Protection Law (Law 91/2025) and Circular 09/2020/TT-NHNN for digital banking, sets binding obligations. This page maps which framework applies to which situation.

By pTrackly Compliance Team · Updated July 2026 · AICPA SOC 2 & PCI DSS v4

When does US expansion trigger SOC 2?

SOC 2 is not law, but these situations make it effectively unavoidable.

Vendor contract with a US enterprise

A US fintech or bank integrating your API asks for SOC 2 Type II. Without it, onboarding stalls for months.

Series A/B due diligence with a US fund

US funds expect SOC 2 Type II or a 12-month roadmap to it. Without one, you must explain and commit to a timeline.

Partnership with a US payment processor or BaaS provider

Stripe, Marqeta, Synapse, and similar BaaS providers commonly require security evidence before production access. SOC 2 is the most accepted proof.

SWIFT membership or correspondent banking relationship

Some correspondent banks and SWIFT participants require independent control evidence from higher-risk markets. SOC 2 Type II provides exactly that.

Framework comparison for fintech

Framework	Required by	Covers	When you need it
SOC 2	US customers, US investors	Data security for service orgs	Selling to US enterprise, raising US capital
ISO 27001	Japan, EU, Singapore customers	Full ISMS	International expansion beyond US
PCI DSS	Payment card networks	Cardholder data	Any card payment processing
PDPD / Luật 91/2025	Vietnamese law	Personal data of Vietnamese citizens	Operating in Vietnam (mandatory)

Control overlap between SOC 2 and PCI DSS

With PCI DSS, many SOC 2 controls already exist (below), but SOC 2 is not free. The audits are separate: SOC 2 needs an AICPA-licensed CPA firm, PCI DSS a Qualified Security Assessor (QSA). Evidence, the observation period (6+ months for Type II), and auditor questions also differ.

Access control Encryption Logging & monitoring Incident response Vulnerability management

Compliance stack for Vietnamese fintech

Minimum (Vietnam only)

PDPD / Luật 91/2025 Mandatory when processing personal data of users in Vietnam.

Thông tư 09/2020/TT-NHNN Mandatory for credit institutions and licensed digital banking fintech: system security and technology risk management.

Expanding to SEA / Japan / EU

ISO 27001 Japan and Singapore weigh ISO 27001 heavily in vendor due diligence.

US market or US investors

SOC 2 Type I first for a quick report, Type II later for long-term enterprise contracts.

Card payment processing (any geography)

PCI DSS v4 SAQ versus ROC level depends on transaction volume and payment integration.

Frequently asked questions

Does Vietnamese fintech need SOC 2?

It depends on expansion strategy. If targeting the US market or raising capital from US investors, SOC 2 is commonly required during due diligence. If operating only in Vietnam or Southeast Asia, ISO 27001 and PDPD are typically sufficient.

If fintech already has PCI DSS, is SOC 2 still needed?

PCI DSS and SOC 2 serve different purposes. PCI DSS is required for payment card processing; SOC 2 is about B2B data trust for enterprise customers. The two frameworks have some control overlap but do not replace each other. Many US fintech customers require both.

Do US investors require SOC 2 when investing in Vietnamese fintech?

It is commonly raised during Series A and later due diligence, especially with US-based funds. SOC 2 Type II or at least a clear roadmap to achieve it is typically expected. Seed-stage startups face less pressure.