Biometric authentication in a mobile banking app is not one decision, it is five separate engineering tradeoffs stacked on top of each other: which modality to default to, how to detect spoofing without killing conversion, where biometric templates get stored, how liveness checks hold up against deepfakes, and how all of that maps to a specific regulator's rulebook. In Vietnam, that rulebook is unusually prescriptive.
SBV Decision 2345/QD-NHNN requires biometric verification for online transfers above 10 million VND per transaction or 20 million VND cumulative per day, and for every first-time login on a new device, with live facial data checked against the chip-based citizen ID card or the national VNeID database. Any team that treats biometrics as a UX feature rather than a compliance-plus-security system will rebuild it after a regulator audit, not before.
TL;DR
Fingerprint and Face ID are not interchangeable: Apple documents a False Acceptance Rate of 1 in 1,000,000 for Face ID versus 1 in 50,000 for Touch ID, which changes where each should sit in a transaction-risk tier.
Vietnam's SBV Decision 2345 sets a hard transaction threshold (10M VND single / 20M VND daily) that forces biometric step-up authentication, not an optional UX layer.
Liveness detection must meet ISO/IEC 30107-3 Level 2 Presentation Attack Detection to defend against printed photos, video replay, and increasingly, deepfakes.
Biometric templates are classified as sensitive personal data under Decree 13/2023/ND-CP, meaning explicit consent, a Data Processing Impact Assessment, and appropriate data storage practices under Vietnam's Cybersecurity Law are not optional.
38 million+ Vietnamese bank accounts were biometrically verified within three months of the July 2024 mandate, but NFC-device gaps and rural digital literacy remain real adoption barriers a product team has to design around.
About the author: 724SOFTWARE is a Vietnam-based engineering partner that has built biometric-adjacent transaction flows for mobile banking clients, including in-app stock trading integrated into the MyVIB banking app with eKYC onboarding and real-time core-banking integration, and derivatives trading platforms (SHS) handling millisecond-sensitive execution under strict risk controls. That delivery history, combined with ISO 27001:2022-aligned security practice, is the basis for the operational detail below.
What Is Biometric Authentication in a Mobile Banking Context?
Biometric authentication verifies a user's identity using a physical or behavioral trait, most commonly a fingerprint scan or facial geometry, instead of or in addition to a password. In mobile banking specifically, the pattern has settled into a two-step model: a face scan unlocks the app, and a fingerprint authorizes the transaction itself. That split is not arbitrary. Face unlock is fast and low-friction for the frequent, low-risk action of opening an app. Fingerprint authorization adds a second, independent factor at the moment money actually moves, which matters more under regulatory scrutiny than at login.
Globally, this pattern is now the default, not the exception. Banks have steadily expanded their use of physical biometrics to fight fraud, and the banking biometrics market is projected to grow from roughly $5 billion in 2022 to $23 billion by 2032. For a Vietnam engineering team building for this market, the question isn't whether to build biometrics. It's which modality handles which risk tier, and how to prove the system resists spoofing when a regulator asks.
How Do FaceID, Fingerprint, and Liveness Checks Actually Differ in Risk?
Each modality has a documented, quantifiable error profile, and conflating them leads to the wrong control being applied to the wrong transaction.
Modality | Documented FAR | Typical use in-app | Primary weakness
|
|---|---|---|---|
Face ID (Apple) | 1 in 1,000,000 | App unlock, step-up auth | Static-image or mask spoofing without liveness |
Touch ID / fingerprint | 1 in 50,000 | Transaction authorization | Residual-print lifting, sensor wear |
Android BiometricPrompt (Class 3) | ≤ 1 in 50,000 required | Platform-level gate | Fragmented hardware quality across OEMs |
Android's BiometricPrompt API requires Class 3 ("strong") biometrics to hold a FAR of 1 in 50,000 or better, a Spoof Acceptance Rate between 0 and 7%, and a False Rejection Rate under 10%. That SAR range is the number engineering teams underweight: a biometric system can pass FAR benchmarks on genuine users and still accept a meaningful share of presentation attacks (photos, masks, replayed video) unless liveness detection is layered on top separately.
This is why liveness detection is a distinct control, not a feature of the biometric sensor itself. A fingerprint sensor answers "does this print match the enrolled template." Liveness detection answers a different question: "is this a live human presenting the biometric right now, or a photo, video, or synthetic replica." Leading vendors implement Presentation Attack Detection systems aligned to ISO/IEC 30107-3 Level 2 and NIST guidance specifically to close that gap, because match accuracy and spoof resistance are measured and attacked differently.
Why Does Vietnam's Regulatory Framework Change the Engineering Approach?
Building on the modality tradeoffs above, the harder question for a Vietnam-facing or Vietnam-delivered banking app is not "which biometric is better" but "what does the regulator require, and when." SBV Decision 2345/QD-NHNN is explicit: biometric verification is mandatory for online transfers exceeding 10 million VND in a single transaction or 20 million VND cumulative in a day, and for any first-time login on a new device. That live facial data must be matched against the chip-based citizen ID (CCCD) or the national VNeID database, not just against a locally stored template.
That single requirement cascades into several engineering decisions:
Step-up authentication logic has to track cumulative daily transaction value per user, not just per-transaction value, which means the risk engine needs a running daily ledger, not a stateless check.
PAD compliance (ISO/IEC 30107-3 Level 2) becomes a hard gate for any facial verification flow, not a nice-to-have, because the live-match-against-national-database requirement assumes the face presented is genuinely live.
Device-binding logic must distinguish "new device" cleanly, since the mandate triggers specifically on first-time logins on unrecognized hardware.
Separately, biometric templates are classified as sensitive personal data under Decree 13/2023/ND-CP. That classification requires explicit user consent, documented security measures, and submission of a Data Processing Impact Assessment to the Ministry of Public Security or Department of Cybersecurity depending on scope.
Vietnam's Cybersecurity Law, as implemented through Decree 53/2022/ND-CP, adds a further constraint: data localization is mandatory for domestic service providers, while foreign enterprises are only required to store data on servers located within Vietnam if they receive a formal request from the Ministry of Public Security, typically following a violation of the law or a failure to cooperate with authorities.
A team architecting this from Singapore, Australia, or the US should still plan for the possibility of an in-country storage requirement being triggered rather than assuming it never applies.
What Does Real-World Adoption Tell Us About Design Priorities?
Following the July 2024 biometric mandate, over 38 million Vietnamese bank accounts were biometrically verified within three months, against 113 million active individual accounts after cross-checking with the national database. That is fast adoption by any measure, but the remaining gap is informative, not just a rounding error. Documented adoption barriers include a lack of NFC-enabled smartphones needed to read chip-based ID cards, low digital literacy in rural areas, and persistent consumer concern about data privacy and technology reliability.
For an engineering team, this translates into a concrete design requirement rather than a demographic footnote: the onboarding flow needs a non-NFC fallback path (manual document capture plus liveness check, for example) that still satisfies the same PAD and matching standards, because a hard NFC dependency silently excludes a measurable share of the addressable user base. A fintech outsourcing partner that has actually shipped eKYC and onboarding flows for banking apps, rather than only prototyped them, will have hit this fallback requirement already in production and sized the engineering effort around it instead of discovering it post-launch.
How Should a Team Sequence This Work Before Launch?
Treat the five tradeoffs as a dependency chain, not a feature list:
Define transaction-risk tiers first (login, low-value transfer, high-value transfer) and map each to a modality and threshold, using SBV 2345's 10M/20M VND lines as the regulatory floor.
Select a PAD-compliant liveness vendor or library before writing the matching logic, since retrofitting liveness onto an existing face-match pipeline is materially more rework than building it in together.
Design the data layer with the flexibility to support in-country storage if triggered, not as a later migration.
Build the DPIA and consent flow in parallel with the technical build, since the assessment has to describe the actual system, not a planned one.
Plan the non-NFC fallback path alongside the primary chip-based flow, sized against the documented adoption gap above.
Frequently Asked Questions
Is fingerprint or Face ID more secure for a banking app?
Face ID carries a lower documented False Acceptance Rate (1 in 1,000,000 vs. 1 in 50,000 for Touch ID), but security in practice depends more on whether liveness detection is layered on top than on the raw FAR number alone.
Does Vietnam law require biometric authentication for all mobile banking transactions?
No. SBV Decision 2345 mandates it specifically for transfers above 10 million VND per transaction, 20 million VND cumulative daily, and for first-time logins on new devices, not for every transaction regardless of value.
Can biometric data be stored outside Vietnam?
Under Decree 53/2022/ND-CP, domestic service providers are required to localize data. Foreign enterprises are not automatically required to store data within Vietnam, but they must do so if the Ministry of Public Security issues a formal request, typically following a violation of the law or a failure to cooperate with authorities.
What is liveness detection and how is it different from biometric matching?
Biometric matching confirms a presented face or fingerprint matches an enrolled template. Liveness detection separately confirms the biometric is being presented by a live person in real time, defending against photos, video replay, and synthetic spoofing, typically benchmarked against ISO/IEC 30107-3 Level 2.
Why do some users still fail biometric onboarding in Vietnam despite the mandate?
Documented barriers include smartphones without NFC capability (needed to read chip-based ID cards), lower digital literacy in rural regions, and user hesitation around data privacy, not failures of the matching algorithm itself.
Is biometric data considered sensitive under Vietnamese law?
Yes. Decree 13/2023/ND-CP classifies biometric data as sensitive personal data, which requires explicit consent, documented security controls, and a Data Processing Impact Assessment submitted to the relevant authority.
About 724SOFTWARE
724SOFTWARE is a Vietnam-based engineering partner working with Fintech, Digital Healthcare, and Enterprise clients across 10+ countries, with 200+ professionals and 58% senior-level experts. The company's banking and capital-markets delivery includes MyVIB's in-app stock trading integration with eKYC onboarding, SHS's derivatives platform with real-time risk controls, and multi-year engagements building trust and digital-asset infrastructure with embedded compliance engines. Work is aligned with ISO 9001 and ISO 27001:2022 standards and GDPR requirements, and teams scale from 1 to 50+ pre-vetted engineers within 2-4 weeks under a follow-the-sun delivery model with sub-10-minute incident response. For fintech software outsourcing engagements where regulatory precision and security architecture both matter from day one, this operational history is the differentiator, not a generic claim of capability.
If your team is scoping a biometric authentication build for a Vietnam-facing banking product, or needs delivery capacity to meet an SBV 2345 compliance deadline, get in touch at 724SOFTWARE.
