Your next Enterprise Registration Certificate amendment in Vietnam must answer one question: which living person, if any, ultimately owns or controls your company?

Between July and September 2026, the Government issued three decrees that affect most foreign-invested enterprises. The first expands and systematizes Vietnam's beneficial ownership rules introduced by Decree 168/2025/ND-CP. The second brings the Apostille Convention into force, removing consular legalization for many foreign documents. The third sets a new penalty regime for personal data protection breaches.

This update explains each change and the steps your business should take now:

(1) Decree 296/2026/ND-CP – beneficial owner declarations (effective 23 July 2026)

(2) Decree 293/2026/ND-CP – Apostille for foreign public documents (effective 11 September 2026)

(3) Decree 330/2026/ND-CP – penalties for cybersecurity and personal data violations (effective 19 August 2026)

Decree 296: Vietnam beneficial ownership now part of enterprise registration

Decree No. 296/2026/ND-CP amends Decree No. 168/2025/ND-CP on enterprise registration. It took effect on 23 July 2026, the day it was issued.

Decree 296 requires each enterprise to identify the individuals who, in practice, ultimately own or control it. The enterprise must review every tier of its ownership structure and apply the identification criteria in a fixed order. Decree 168 already recognized indirect ownership and certain control rights; Decree 296 expands and systematizes those rules.

Fewer documents for enterprise registration

The provincial Business Registration Authority will now retrieve information from the National Database on Business Registration and other national databases. It no longer requires copies of the Enterprise Registration Certificate (ERC), Tax Registration Certificate, Investment Registration Certificate (IRC) or M&A approval. It may ask for copies only where the data is missing, incomplete, or inaccurate.

Who is a beneficial owner

A beneficial owner is an individual who, directly or indirectly, ultimately owns or controls the enterprise in practice. Individuals representing State capital are excluded. Every enterprise must apply three criteria strictly in this order:

(1) Ownership. An individual who owns 25% or more of the charter capital or voting shares, directly, indirectly, or both. Indirect ownership includes holdings through companies, trusts, nominees, and similar arrangements. Holdings of family members, or of individuals who agree to own jointly, are added together.

(2) Control. If no one meets Criterion 1, the enterprise identifies who controls it in practice. Control means the right to appoint or dismiss most of the board or the general director, amend the charter, restructure or dissolve the company, or set its financial, investment and operating policies. The same applies where evidence shows the person found under Criterion 1 is not the real owner.

(3) Senior manager. If no one meets Criterion 1 or 2, the enterprise names the manager with the greatest authority to act on its behalf.

Beneficial owner information must be declared following this order, from Criterion 1 to Criterion 3. Accordingly, companies must now disclose natural persons (meaning living persons, not corporations) who directly or indirectly own 25% or more of a Vietnamese company.

This covers any individual who, directly, indirectly or both, owns 25% or more of charter capital or voting shares. Indirect ownership includes holdings through companies or other legal arrangements (such as trusts, nominees and similar vehicles). Family members (as defined in the Law on Enterprises) or persons linked by contract who together hold 25% or more are each treated as beneficial owners.

Illustration: a foreign-owned subsidiary

By way of illustration, assume the following facts:

Step 1 – Criterion 1. ABC must look through XYZ to reach an individual. Through XYZ, Mr. D indirectly owns 60% of ABC. This exceeds the 25% threshold, so Mr. D is ABC's beneficial owner.

Step 2 – Aggregation. If Mr. D's family members, or persons who agree with him to own jointly, also hold shares in XYZ, their holdings are added to his. This does not change the conclusion, but those individuals may also need to be declared.

Step 3 – Criteria 2 and 3. Because Criterion 1 identifies a beneficial owner, ABC does not move on to Criterion 2 or 3. The exception is where evidence shows that Mr. D does not, in practice, own or control ABC.

Result. ABC declares Mr. D as its beneficial owner, holding 60% indirectly through XYZ.

Points to confirm. Decree 296 counts charter capital or voting shares. If XYZ has more than one share class, Mr. D's voting percentage may differ from his economic interest. ABC should confirm the correct figure against XYZ's latest corporate records. Dilinh Legal has not identified any exemption in Decree 296 for subsidiaries of foreign-listed groups.

What must be declared?

The enterprise declares each beneficial owner in the List of Beneficial Owners (Form No. 10 issued with Circular No. 121/2026). The form requires:

What does this mean for your business?

Companies incorporated before 1 July 2025 must file the List of Beneficial Owners with their next filing to amend their Enterprise Registration Certificate (ERC). Any later change must be notified within 10 days.

For foreign-invested enterprises, the practical bottleneck is the parent group. The personal details of an ultimate owner sit with the parent's corporate secretary, often several tiers up. Start collecting them now, before an ERC amendment is on the critical path.

Action steps:

Decree 293: Apostille replaces consular legalization in Vietnam

Vietnam acceded to the Hague Apostille Convention under Resolution No. 407/NQ-CP dated 12 December 2025. The Convention entered into force for Vietnam on 11 September 2026. Decree No. 293/2026/ND-CP, issued on 23 July 2026, implements it from the same date.

A single Apostille certificate now replaces consular authentication and legalization. This cuts the time and cost of using public documents between Vietnam and other Contracting States.

Documents covered

The exemption applies to public documents issued in one Contracting State for use in the other. These include:

Where consular legalization still applies

Consular legalization is still required for:

Translation and e-Apostilles

Unless otherwise provided, foreign public documents not in Vietnamese must still be translated into Vietnamese and notarized or certified. An electronic Apostille has the same legal validity as a paper one. Each Vietnamese Apostille carries a QR code linked to an online register for verification.

Issuing authorities and processing times in Vietnam

The Consular Department of the Ministry of Foreign Affairs, the Ho Chi Minh City Department of Foreign Affairs and authorized provincial agencies issue Apostilles. Time runs from receipt of a complete, valid application.

Number of documents Paper application Fully online application
1–4 1 working day Same day (if received before cut-off)
5–9 2 working days 1 working day
10 or more 4 working days 3 working days

What does this mean for your business?

Certificates of incorporation, good standing certificates and criminal record checks from the United States, Singapore, Japan and other Contracting States can now be used with an Apostille alone. This shortens timelines for license amendments, work permit applications and capital transactions.

One trap remains. Board resolutions, powers of attorney and other internal documents of a foreign parent are not "public documents." They must first be notarized in the home country. Only then can you obtain an Apostille.

Action steps:

Decree 330: new penalties for personal data protection breaches

Decree No. 330/2026/ND-CP sets penalties for administrative violations in cybersecurity and personal data protection. It took effect on 19 August 2026, the day it was issued. It gives teeth to the 2025 Personal Data Protection Law and Decree No. 356/2025/ND-CP.

Violations covered

Decree 330 penalizes breaches of the rules on, among others:

A multi-layered penalty regime

Fines are only the first layer. Decree 330 also provides for:

Violations showing signs of a crime are subject to criminal prosecution.

Sector-specific sanctions

Separate sanctions apply to data of vulnerable groups and to recruitment and employment. They also cover social networks, big data, AI, blockchain, cloud computing, location data, biometric data and recording in public places.

CCTV and recording systems

What does this mean for your business?

Every employer processes personal data. Recruitment files, payroll records, fingerprint attendance systems, and factory CCTV all fall within Decree 330. The decree singles out these areas for specific sanctions.

The largest exposure is not the fine. A suspension of up to 24 months, or an order to erase data beyond recovery, can stop core operations.

Action steps:

Next steps for your business

Decree 296 took effect on 23 July 2026 and applies to all enterprises, including foreign-invested enterprises. Map your ownership chain to the individual level now, so your List of Beneficial Owners is ready for your next ERC amendment.

Decree 293 has applied since 11 September 2026 to anyone using foreign public documents in Vietnam. Notarize internal corporate documents first, then obtain the Apostille, and allow time for certified Vietnamese translations.

Decree 330 took effect on 19 August 2026 and applies to every organization processing personal data. Start with an employee audit of biometric and CCTV data, where the decree sets specific sanctions.

For advice on how these changes affect your Vietnam operations, contact Dilinh Legal at contact@dilinh.com.

About the author

Michael Lee is a Partner at Dilinh Legal. He advises on Corporate & M&A, FDI, labor, and regulatory matters.

This article is for general information only and does not constitute legal advice. For further information, please contact Dilinh Legal at contact@dilinh.com | +84 (28) 73000864 | dilinh.com