On December 16, 2025, VNPAY was once again awarded the highest-level PCI DSS 4.0.1 security certification by international assessment body Control Case. The certification covers six of VNPAY’s key services: Cloud, Payment Gateway, SmartPOS, VNTAP-HCE, Tap to Phone, and PhonePOS - all of which fully comply with the globally recognized Payment Card Industry Data Security Standard (PCI DSS).

Meeting more than 250 security requirements under global standards

This marks the sixth consecutive year since 2020 that VNPAY has achieved the highest PCI DSS certification, aligned with evolving versions of the standard. The PCI DSS 4.0.1 standard, administered by the PCI Security Standards Council, is required for any business that stores, processes, or transmits payment card data.

To maintain compliance, VNPAY’s systems must pass more than 250 rigorous controls across 12 major security groups and satisfy six overarching security objectives. These include: building and maintaining secure networks and systems; protecting cardholder data; managing vulnerabilities; enforcing strict access controls; regularly monitoring and testing systems; and maintaining a robust security policy.

At the award ceremony, VNPAY’s Deputy CEO Tran Manh Cuong emphasized that this recognition reflects VNPAY’s ongoing commitment to upholding global security practices.

“Achieving PCI DSS 4.0.1 Level 1 certification demonstrates our dedication to securing customer data and building a sustainable, trusted digital payment ecosystem,” he said.

What is PCI DSS 4.0.1?

PCI DSS (Payment Card Industry Data Security Standard) is a globally mandated information security benchmark required for organizations handling payment card data. It is governed by five major international payment brands: Visa, MasterCard, American Express, Discover, and JCB.

The 4.0.1 version includes strict technical, procedural, and human-layer safeguards designed to protect cardholder data throughout collection, transmission, and storage.

Six VNPAY services meet international security standards

VNPAY Cloud provides enterprise-level cloud computing and AI services to large corporations, banks, and fintechs. Aligned with the future of Software-as-a-Service (SaaS), VNPAY’s cloud offerings aim to help businesses reach users more easily and expand digital ecosystems.

VNPAY SmartPOS delivers an all-in-one payment solution with card payments, QR code scanning via VNPAY-QR, invoice printing, and barcode scanning integrated into one device. It offers flexibility and efficiency to merchants across sectors.

Tap to Phone is a mobile-based contactless payment solution developed in partnership with Vietcombank (VCB). It allows any NFC-enabled Android device to serve as a Visa contactless terminal, removing the need for physical POS hardware. This helps businesses reduce investment costs while improving transaction convenience.

PhonePOS turns any Android phone into a payment terminal. Merchants can accept secure card payments simply by tapping on the device. This innovation is part of VNPAY’s broader effort to drive cashless transformation across Vietnam, especially at the point-of-sale level.

VNTAP-HCE (Tap2Pay) is an advanced contactless payment feature integrated into the VNPAY app. Encrypted and tokenized card information allows smartphones to function as secure virtual cards, enabling fast, seamless, and physical card-free payments at NFC-enabled POS terminals.

VNPAY Payment Gateway acts as an intermediary platform connecting merchants to banks. It supports payment via bank cards, accounts, VNPAY-QR on more than 40 mobile banking apps, the VNPAY app itself, and over 15 e-wallets. Currently, it secures over 450,000 merchant acceptance points using TLS 1.2 encryption and robust cryptographic protocols.

Achieving the highest-level PCI DSS certification for six consecutive years marks a significant milestone in VNPAY’s digital evolution. It highlights the company’s dedication not only to innovation in digital payments but also to ensuring that those innovations are secure, scalable, and globally compliant.

PV