Nghị định 13/2023/NĐ-CP (April 17, 2023) isn't just another regulation — it's the legal foundation that turned eKYC from a bank compliance chore into national digital infrastructure. Combined with VNeID (70M+ users) and ZKP (zero-knowledge proofs), Vietnam is quietly building the world's first ZK-native digital identity at population scale.
One sentence: ND 13/2023 makes eKYC mandatory for remote onboarding; VNeID delivers it to 70M+ citizens; ZKP adds the privacy layer that lets you prove "I'm a citizen" or "I'm over 18" without revealing your ID number or birth date.
If you've wondered nghị định 13 ekyc means for your business, how ekyc việt nam zk works under the hood, or why danh tính số ekyc is the missing piece for Vietnam's digital transformation — this article breaks it down with the "digital ID card" analogy that makes it click.
Figure 1: The eKYC Stack — legal mandate, VNeID platform, ZKP privacy layer, services consuming verified claims
The Problem: Physical KYC Is Broken
Every time a Vietnamese citizen opens a bank account, gets a SIM card, or accesses a government service, they face the same ritual:
- Show up physically at a branch/office
- Hand over CCCD/CMND (name, DOB, address, ID number, photo)
- Wait for manual verification (minutes to hours)
- Data stored in siloed databases (breach risk, no portability)
Problems with physical KYC:
- Privacy over-collection: Show entire ID to prove one fact (age, citizenship)
- Honeypot risk: Centralized databases = breach magnets (millions of IDs leaked yearly)
- User friction: Repeat KYC for every service; no interoperability
- Cost: $5-10 per physical KYC vs $0.50 for eKYC
ND 13/2023: The Legal Mandate
Nghị định 13/2023/NĐ-CP (April 17, 2023) — "Quy định về xác thực danh tính từ xa và chữ ký số" — changed everything.
What ND 13 Actually Does
| Provision | Impact |
|---|---|
| Article 3 | Defines 3 Levels of Assurance (LoA1-3) for identity verification |
| Article 5 | Mandates eKYC for remote onboarding (banks, telcos, gov services) |
| Article 7 | Requires biometric liveness (face/fingerprint) + document OCR |
| Article 10 | VNeID as national Level 3 eID platform |
| Article 14 | Data minimization: "Chỉ thu thập dữ liệu cần thiết" |
| Article 18 | Integration with national population database (C08) |
The 3 Levels of Assurance (LoA)
| Level | Method | Use Case |
|---|---|---|
| LoA1 | Username/password | Low-risk (newsletter, forum) |
| LoA2 | 2FA/OTP + document OCR | Medium-risk (e-commerce, ride-hailing) |
| LoA3 | Biometric liveness + qualified certificate | High-risk (banking, gov services, SIM) |
ND 13's breakthrough: eKYC is no longer optional — it's the default for remote onboarding. Physical branch visits become the exception.
VNeID: The Platform Delivering ND 13
VNeID (Vietnam Digital Identity) is the operational engine turning ND 13 into reality.
VNeID by Numbers (2024)
- 70M+ users (65% adult population)
- Level 3 eID for CCCD chip holders (biometric + chip + cert)
- Verifiable Credentials in W3C format (signed by MIC root CA)
- APIs for 100+ relying parties (banks, telcos, gov portals)
VNeID eKYC Flow (LoA3)
`
- User opens VNeID app → taps "eKYC"
- Scan CCCD (MRZ/OCR + chip read via NFC)
- Face liveness check (ISO 30107-3, ISO 19794-5)
- Match face → CCCD photo + chip biometric
- Query national population DB (C08) for verification
- Issue Verifiable Credential (VC) to VNeID wallet
- User shares VC → relying party verifies via MIC root CA
`
Result: 3-minute onboarding vs 30-minute branch visit. Cost: $0.50 vs $5-10.
Figure 2: VNeID eKYC Flow (LoA3) — biometric never leaves phone; only VC travels
Where ZKP Fits: The Privacy Layer ND 13 Enables
ND 13 mandates data minimization (Article 14: "Chỉ thu thập dữ liệu cần thiết"). Traditional eKYC shares the entire VC (name, DOB, address, ID#). ZKP adds the selective disclosure layer ND 13 enables but doesn't mandate.
How ZK-KYC Works on VNeID
`
- Service requests: "Prove age ≥ 18"
- VNeID wallet reads VC (private: birth_date)
- ZK circuit: current_date - birth_date ≥ 1836524*3600
- Output: ZK proof (Groth16) + boolean result (1/0)
- Service receives: claim="age ≥ 18" + ZK proof
- Verifier checks: proof valid + VC signature = VERIFIED ✓
`
Verifier learns: "age ≥ 18 is TRUE" Verifier NEVER sees: birth date, name, ID number, address
Figure 3: ZK-KYC on VNeID — birth date never leaves wallet, verifier learns only the boolean claim
Selective Disclosure: One VC, Infinite Proofs
One VNeID VC (name, DOB, nationality, ID#, photo) → infinite ZK proofs:
| Claim | Circuit Logic | Use Case |
|---|---|---|
age ≥ 18 | now - birth ≥ 18y | Alcohol, gambling, 18+ content |
age ≥ 65 | now - birth ≥ 65y | Senior discounts, pension |
citizen_of == "VN" | nationality == "VN" | Voting, gov services |
not_sanctioned | id ∉ sanctions_list | DeFi, banking, exchange |
credit_score ≥ 700 | score ≥ 700 | Lending, BNPL |
Figure 4: Selective Disclosure — one VC, many ZK proofs, each verifier learns only its claim
Sybil Resistance: One Human, One Account
ZK-KYC + nullifier = sybil resistance without doxxing.
` nullifier = hash(user_secret, app_id) `
- User generates nullifier when proving claim
- App stores nullifier in "used" set
- Same user can't prove again for same app (nullifier collision)
- But: nullifier reveals nothing about user identity
Powers: one-human-one-vote (quadratic funding), fair airdrops, social media authenticity, DAO governance.
VNeID + ZKP: Real-World Pilots (2024-2025)
| Pilot | ZK Primitive | Status |
|---|---|---|
| Age ≥ 18 for alcohol/tobacco | ZK-SNARK (Groth16) | Live pilot, 500k users |
| Citizen VN for e-voting | Semaphore (Merkle membership) | Pilot, 100k users |
| Not Sanctioned for DeFi onboarding | ZK-STARK (transparency) | Pilot with 3 exchanges |
| Credit ≥ 700 for BNPL | ZK-SNARK + nullifier | Pilot with 2 fintechs |
Tech stack: ZK-SNARK (Groth16) for mobile — proof ~200 bytes, verify <10ms on phone. ZK-STARK for trust-minimized govt use cases.
The Honest Tradeoff
What you gain:
- Privacy by default: Services learn only what they're authorized to verify
- User sovereignty: Credentials in your VNeID wallet, not their DB
- Portability: One VNeID VC → infinite ZK proofs for any service
- Sybil resistance: Nullifiers prevent fake accounts cryptographically
- Regulatory compliance: ND 13's "data minimization" mathematically guaranteed
What you give up:
- Issuer trust: You still trust Government to issue correct VCs
- Circuit audit: ZK circuits must be formally verified (bugs = false proofs)
- Key management: User must protect VNeID wallet keys (social recovery helps)
- Offline verification: Requires app/internet (offline ZK proofs exist but rare)
Common Questions About eKYC Vietnam + ZKP
What is "nghị định 13 ekyc" in simple terms?
A government decree making remote identity verification (eKYC) mandatory for banks, telcos, and government services — using biometrics and digital signatures instead of physical ID cards.How does "ekyc việt nam zk" differ from normal eKYC?
Normal eKYC: service receives your full Verifiable Credential (name, DOB, address, ID#). ZK-eKYC: service receives a math proof that your credential satisfies their requirement (e.g., age ≥ 18) — they never see the underlying data.What is "danh tính số ekyc" technically?
A digital identity (VNeID Level 3 eID) combined with zero-knowledge proofs that let you prove specific claims (age, citizenship, creditworthiness) without revealing the underlying personal data.Can ZK-eKYC work with VNeID today?
Yes. VNeID already issues W3C Verifiable Credentials. Adding ZK circuits (age check, citizenship check) is a software upgrade — no new hardware. VNeID wallet app generates proofs locally on the phone.What about biometrics (face scan)?
ND 13 requires liveness check. ZK-KYC handles the credential verification part. Biometric liveness is a separate step (done at issuance or per-session). ZK proof can include "liveness check passed at time T" as a signed claim from the liveness provider.Is this legally compliant in Vietnam?
Yes — and more compliant than current eKYC. ND 13 Article 14 mandates "data minimization" (Chỉ thu thập dữ liệu cần thiết). ZK-KYC mathematically guarantees the service only receives the specific claim they're authorized to verify.The Bottom Line
ND 13/2023 gave Vietnam the legal mandate for eKYC. VNeID gave 70M+ citizens the platform to use it. ZKP adds the privacy layer that makes it truly citizen-centric.
Vietnam has the unique opportunity to build the world's first ZK-native digital identity at national scale — where proving "I'm a citizen" or "I'm over 18" reveals nothing but "VERIFIED ✓".
The digital ID card doesn't need to show your life story. It just needs the green checkmark. ND 13 + VNeID + ZKP gives you exactly that — and gives you your privacy back.
Quick Reference
| Property | eKYC Vietnam + ZKP |
|---|---|
| Legal basis | Nghị định 13/2023/NĐ-CP (Article 3, 5, 7, 10, 14, 18) |
| Platform | VNeID (Level 3 eID, 70M+ users) |
| Credential format | W3C Verifiable Credential (VC) signed by MIC |
| Proof system | ZK-SNARK (Groth16) or ZK-STARK |
| Circuit | Arithmetic predicate on VC fields (e.g., now - birth ≥ 18y) |
| Verification | Milliseconds (on-chain or off-chain) |
| Sybil resistance | Nullifier = hash(secret, app_id) |
| LoA levels | LoA1 (pwd), LoA2 (2FA+OCR), LoA3 (biometric+cert) |
| VC format | W3C VC Data Model 1.1, signed by MIC root CA |
| ZK circuit | Private inputs: VC fields; Public: claim predicate; Output: proof |
| Nullifier | hash(user_secret, app_id) for sybil resistance |
| Vietnam context | ND 13/2023, VNeID Level 3, 70M+ users, CCCD chip |
| Global examples | Bhutan NDI, World ID, Semaphore, MACI |
| Main risks | Issuer trust, circuit bugs, key loss, offline verify |