SBV Deputy Governor Warns Banks on Cyber Monitoring as TPB Goes 99.5% Digital

Overview

State Bank of Vietnam (SBV) Deputy Governor Pham Tien Dung used the Smart Banking conference on 22 October to press credit institutions on cyber resilience, disclosing that hackers had operated inside bank systems for months without detection. The remarks land directly on TPBank (TPB), whose chief executive said 99.5% of the bank’s transactions now run through digital channels, among the highest disclosed ratios in the sector.

Key Facts

• SBV Deputy Governor Pham Tien Dung spoke at the Smart Banking event on 22 October.
• The banking system processes roughly 100 million payment transactions per day, valued at about VND 1.2 quadrillion.
• Dung said hackers remained inside some bank systems for several months undetected, with hundreds of irregular transactions worth tens of billions of dong occurring overnight before business units responded.
• The SBV has instructed credit institutions to set up a separate transaction-monitoring function alongside the existing cyber-security monitoring system.
• The SBV has issued a circular guiding responsible AI adoption by credit institutions, aligned with the national AI strategy.
• TPBank CEO Nguyen Hung said 99.5% of the bank’s transactions are digital, running to hundreds of millions of transactions per month.
• Dung noted many banks now conduct over 95% of transactions through digital channels.

What Happened

Speaking at the Smart Banking conference in Hà Nội on 22 October, Deputy Governor Pham Tien Dung framed cyber risk as a business and reputational issue rather than a technical one. He described incidents in which intruders stayed inside bank systems for months without triggering alarms, and where hundreds of anomalous transactions worth tens of billions of dong executed overnight drew no immediate operational response. His prescription was a shift from pure defence toward detection, rapid response, maintenance of essential services and recovery, backed by serious investment in monitoring infrastructure.

The SBV has paired that guidance with two concrete requirements: a dedicated transaction-monitoring unit separate from the cyber-security function, and a new circular governing responsible AI deployment. TPBank General Director Nguyen Hung, speaking at the same event, said AI represents the next wave after digital banking but also gives attackers more sophisticated tools. He confirmed TPBank’s near-total digital transaction share, a figure the bank has cited in prior disclosures on its digital strategy.

Market Context

TPB closed at VND 12,750 on 22 October on HOSE, the same session as the conference. The stock trades in the low-teens range that has characterised much of its post-listing history, and the bank’s digital-first positioning has been a core part of its equity story. The SBV’s tone fits a broader supervisory push in Vietnamese banking toward operational-risk standards, data protection and AI governance, themes that carry compliance-cost implications across the sector rather than for any single lender.

Strategic Significance

For TPB, a 99.5% digital transaction ratio is both a margin advantage and a concentrated operational risk. Digital channels lower cost-to-serve and support fee income, but they also mean a security failure reaches nearly the entire customer base at once. The SBV’s demand for dedicated transaction monitoring and responsible AI governance implies higher technology and compliance spending ahead, which favours banks with existing platform investment like TPB but compresses the cost advantage that digital leadership confers. The AI circular also sets the rules of the road before adoption scales, reducing regulatory uncertainty for banks building AI-driven credit and service models.

What to Watch

• TPBank’s next annual or interim report for disclosure on technology and cyber-security spending as a share of operating costs.
• The full text and effective date of the SBV circular on responsible AI adoption in credit institutions.
• Any SBV inspection findings or follow-up guidance on the separate transaction-monitoring requirement.
• TPB’s digital transaction mix and fee income trends in upcoming quarterly results.
• Sector-wide disclosures on reported cyber incidents or operational losses under new monitoring rules.