From March 1, 2026: Blocking banking apps on rooted, jailbroken, and unbootloaded phones.
The State Bank of Vietnam has just issued Circular 77 stipulating that mobile banking applications will cease to function on insecure devices such as rooted or jailbroken phones from March 1, 2026.
From March 1, 2026, mobile devices that do not meet security standards, such as those that are rooted, jailbroken, or have their bootloaders unlocked, will be officially blocked from accessing banking applications in Vietnam. This is the central content of Circular No. 77/2025/TT-NHNN, recently signed and issued by the Governor of the State Bank of Vietnam (SBV), aimed at tightening the security of digital transactions.
New regulations on digital banking security.
Circular 77/2025/TT-NHNN amends and supplements several articles of Circular 50/2024/TT-NHNN regulating safety and security for online services in the banking industry. Accordingly, credit institutions must assess the security level of their Mobile Banking versions at least every three months to detect technical vulnerabilities or the risk of malware injection early.
Three risk groups for application access denial.
Mobile banking applications will be programmed to automatically disconnect or cease operation immediately if the system detects that the device falls into one of the following three risk categories:
- The device has an insecure operating system:This includes phones that have been jailbroken (for iOS, rooted for Android) or have had their bootloader security compromised (unlocked).
- The application has been tampered with:Mobile banking software may be injected with foreign code to record transactions, steal data, or the application may have been modified or repackaged compared to the original version provided by the bank.
- Unsafe operating environment:The device has a built-in debugger or the application is running in an emulator or virtual machine.
Preventing cybercrime and protecting users.
The tightening of regulations comes amid a surge in cybercrime. Fraudsters are increasingly using sophisticated methods such as malware, deepfake technology, and fake accounts to gain control of devices and steal users' assets through banking applications.
Challenges for mobile phone users
The new regulations are expected to directly impact users of domestically imported (grey market) Android smartphones. The majority of these devices currently require bootloader unlocking to install international ROMs that add Vietnamese language support and Google services.
According to the State Bank of Vietnam's new security standards, unlocking the bootloader can cause banking applications to automatically stop working. This requires users to carefully consider the trade-off between interfering with the system software and the ability to maintain payment and financial transaction features on their mobile devices in the near future.
