Decision 877/QĐ-UBCK on the Regulation for Using the State Securities Commission's Information Disclosure System

---

MINISTRY OF FINANCE STATE SECURITIES COMMISSION

No.: 877/QĐ-UBCK

SOCIALIST REPUBLIC OF VIETNAM Independence - Freedom - Happiness

Hanoi, August 05, 2024

DECISION Issuing the Regulation on the Use of the State Securities Commission's Information Disclosure System

CHAIRMAN OF THE STATE SECURITIES COMMISSION

Pursuant to the Securities Law dated November 26, 2019;

Pursuant to Decision No. 48/2015/QĐ-TTg dated October 08, 2015 of the Prime Minister regulating the functions, tasks, powers, and organizational structure of the State Securities Commission under the Ministry of Finance;

Pursuant to Decree No. 155/2020/NĐ-CP dated December 31, 2020 of the Government detailing the implementation of some articles of the Securities Law;

Pursuant to Circular No. 96/2020/TT-BTC dated November 16, 2020 of the Minister of Finance guiding information disclosure on the securities market;

Pursuant to Circular No. 118/2020/TT-BTC dated December 31, 2020 of the Minister of Finance guiding certain contents on securities offering, issuance, public tender offer, share repurchase, registration of public companies, and cancellation of public company status;

Pursuant to Circular No. 134/2017/TT-BTC dated December 19, 2017 of the Minister of Finance guiding electronic trading on the securities market; and Circular No. 73/2020/TT-BTC dated August 07, 2020 of the Minister of Finance amending and supplementing some articles of Circular 134/2017/TT-BTC dated December 19, 2017 of the Minister of Finance on guiding electronic trading on the securities market;

At the request of the Director of the Information Technology Department and the Head of the Public Company Supervision Department.

DECIDES:

Article 1. Issuing herewith this Decision the Regulation on the Use of the State Securities Commission's Information Disclosure System.

---

Article 2. This Decision takes effect from August 15, 2024, and replaces Decision No. 245/QĐ-UBCK dated February 29, 2024 of the Chairman of the State Securities Commission on issuing the Regulation on the Use of the State Securities Commission's Information Disclosure System.

Article 3. The Chief of Staff, Director of the Information Technology Department, Head of the Public Company Supervision Department, Head of the Securities Offering Management Department, General Director of the Vietnam Stock Exchange, General Director of the Hanoi Stock Exchange, General Director of the Ho Chi Minh City Stock Exchange, public companies, and relevant organizations and individuals are responsible for implementing this Decision./.

For distribution:

• As per Article 3;
• Chairman of SSC (for reporting);
• File: VT, CNTT (10 copies).

KT. CHAIRMAN VICE CHAIRMAN (Signed) Hoang Van Thu

---

MINISTRY OF FINANCE STATE SECURITIES COMMISSION

REGULATION On the Use of the State Securities Commission's Information Disclosure System (Issued alongside Decision No. 877/QĐ-UBCK dated August 05, 2024 of the Chairman of the State Securities Commission)

Chapter I GENERAL PROVISIONS

Article 1. Scope of Regulation This Regulation stipulates the use of the State Securities Commission's (SSC) Information Disclosure System to perform reporting and information disclosure in electronic form as prescribed by law on information disclosure on the securities market.

Article 2. Subjects of Application

1. Public companies as prescribed in Clause 1, Article 32 of the Securities Law (excluding securities companies and securities investment fund management companies).
2. Organizations listing shares or registering for trading at the Hanoi Stock Exchange.
3. Organizations listing shares at the Ho Chi Minh City Stock Exchange.

Article 3. Interpretation of Terms In this Regulation, the following terms are understood as follows:

1. The SSC's Information Disclosure System includes the following subsystems:

• The IDS subsystem with the address https://ids.ssc.gov.vn.
• The subsystem for centralized reporting and information disclosure: Receives reports and disclosed information from the subjects of application prescribed in Clause 2 and Clause 3 of Article 2 of this Regulation sent via the Hanoi Stock Exchange System or the Ho Chi Minh City Stock Exchange System (hereinafter collectively referred to as the Stock Exchange System) into the IDS subsystem.
• The electronic information page displaying information disclosed received from the IDS subsystem and the centralized reporting and information disclosure subsystem, with the address https://congbothongtin.ssc.gov.vn.

2. The company profile on the IDS subsystem includes information about the public company, the public company profile as prescribed by the Securities Law; lists of insiders and related parties, lists of shareholders (founding shareholders and major shareholders); information on securities offering, issuance, public tender offer; financial information, and history of changes in public company information.
3. Complex password means a password meeting the following requirements:

• Has a minimum of eight (08) characters, does not contain the account name;
• Consists of at least three (03) out of four (04) types of characters as follows: uppercase letters (A-Z), lowercase letters (a-z), numbers (0-9), other characters on the computer keyboard (~ ! @ # $ % ^ & * ( ) _ - + = { } [ ] \ | ; : ' " < > , . ? /) and space. It is encouraged to use passwords with a length of 12 characters or more.

4. Public digital certificate means a digital certificate issued by an organization providing public digital signature certification services.
5. Token is a device meeting the standards of the Ministry of Information and Communications to store public digital certificates and the user's private key.
6. Feedback email, mobile phone number means the email address and mobile phone number that the public company registers with the SSC to receive information from the IDS subsystem, including: IDS subsystem account usage information, notifications of successful report submission, notifications of rejected report submissions, and other notifications from the SSC.
7. Report date on the SSC's Information Disclosure System: a) For reports and disclosed information sent directly by the public company on the IDS subsystem: the date the information is received on the IDS subsystem. b) For reports and disclosed information received via the centralized reporting and information disclosure subsystem: the date the information is received on the Stock Exchange System.
8. Information disclosure date on the SSC's Information Disclosure System: a) For information disclosed via the IDS subsystem: the date the information appears on the IDS subsystem; b) For information disclosed via the centralized reporting and information disclosure subsystem: the date the information appears on the Stock Exchange System.
9. XBRL (eXtensible Business Reporting Language) is the open business reporting language data standard.
10. XBRL form is the financial report form in XBRL format on the IDS subsystem, allowing public companies to download, input data, and push financial report data to the IDS subsystem.
11. The Hanoi Stock Exchange System is the CIMS enterprise information management system used to receive reports and disclosed information from organizations listing or registering for trading at the Hanoi Stock Exchange.
12. The Ho Chi Minh City Stock Exchange System is the ECM electronic document management system used to receive reports and disclosed information from organizations listing at the Ho Chi Minh City Stock Exchange.
13. User Guide is the electronic document posted on the IDS subsystem with the address https://ids.ssc.gov.vn and the SSC's electronic portal with the address https://www.ssc.gov.vn to guide users in performing transactions on the SSC's Information Disclosure System.

Article 4. General Principles for Using the Information Disclosure System

1. Companies and organizations subject to this Regulation are responsible for disclosing information fully, accurately, and timely in accordance with the law on information disclosure on the securities market, and are legally responsible for the content and timing of the disclosed information.
2. Information reported and disclosed via the SSC's Information Disclosure System includes: a) Reports and information disclosure as prescribed in Chapter II, Chapter III of Circular No. 96/2020/TT-BTC dated November 16, 2020 of the Ministry of Finance guiding information disclosure on the securities market (Circular No. 96/2020/TT-BTC); b) Reports and information disclosure related to securities offering and issuance as prescribed in Chapter II of Decree No. 155/2020/NĐ-CP dated December 31, 2020 of the Government detailing the implementation of some articles of the Securities Law (Decree 155/2020/NĐ-CP), and Circular No. 118/2020/TT-BTC dated December 31, 2020 of the Ministry of Finance guiding certain contents on securities offering, issuance, public tender offer, share repurchase, registration of public companies, and cancellation of public company status (Circular 118/2020/TT-BTC).
3. Principles for sending reports and information disclosure a) Unlisted public companies that have not registered for trading perform reporting and information disclosure on the IDS subsystem. b) Organizations listing or registering for trading at the Stock Exchange:

• Perform periodic, abnormal, and capital usage reporting as prescribed in Chapter II, Chapter III of Circular 96/2020/TT-BTC via the Stock Exchange System where the organization is listed or registered for trading, and do not need to perform via the IDS subsystem.
• Perform reporting and information disclosure as required by the State Securities Commission; information on securities offering and issuance as prescribed in Chapter II of Decree No. 155/2020/NĐ-CP, Circular No. 118/2020/TT-BTC, and other company activities via the IDS subsystem.

Chapter II PROVISIONS ON THE USE OF THE IDS SUBSYSTEM

Article 5. General Requirements

1. Public companies use the IDS subsystem account issued by the SSC and the company's public digital signature to perform electronic reporting and information disclosure on the IDS subsystem in accordance with the guidance in this Regulation.
2. Public companies perform reporting and information disclosure related to the person performing the disclosure as prescribed in Article 6 of Circular 96/2020/TT-BTC and register information about the person performing the disclosure on the IDS subsystem. The registered information about the person performing the disclosure on the IDS subsystem is in accordance with the User Guide.

Article 6. Technical Requirements

1. Computer used to send reports and information disclosure:

• The computer uses one of the following browsers: Microsoft Edge, Firefox, or Chrome.
• The computer must be connected to the internet.

2. Public digital certificate storage device (Token) issued by the public digital certificate service provider to the company.

Article 7. Data Requirements for Reports

1. Public companies send reports and disclosed information in the form of electronic data files to the IDS subsystem.
2. Report file format:

• The form file for reports and information disclosure on the IDS subsystem has the Excel or XBRL file format. Public companies only use the latest form files downloaded from the IDS subsystem, ensuring the order of columns and cells matches the form file exactly.
• Attached files must be in PDF format.

3. Font format: Information entered into the IDS subsystem must use Vietnamese with the Unicode TCVN 6909:2001 font.
4. Public companies are not allowed to arbitrarily change the report form format on the IDS subsystem. In case changes or corrections are needed, a written request must be submitted and approved by the SSC.

Article 8. Security Requirements

1. Report document files and disclosed information on the IDS subsystem must be signed by the public company's digital signature.
2. Public companies participating in the use of the IDS subsystem must comply with regulations on usage rights allocation; account management and usage; must not distribute computer viruses; must not use accounts other than those issued by the SSC to access the system.
3. Computers used to send reports and information disclosure on the IDS subsystem must meet the following requirements:

• The computer is installed with antivirus software, uses a licensed operating system, and is updated with patches as recommended by the manufacturer;
• Do not use public computers to access the system;
• Do not save login names and passwords on web browsers;
• Log out of the IDS subsystem when not in use;
• Have measures to scan and ensure security for computers frequently used to perform reporting and information disclosure.

Article 9. Regulations on Issuing IDS Subsystem Accounts

1. Public companies not yet issued an IDS subsystem account perform the following process: Step 1: The public company completes the Registration Form for Participating in the Use of the IDS Subsystem according to the model in the User Guide and sends it to the SSC (Information Technology Department) or sends a soft copy with a digital signature to the email: hotroids@ssc.gov.vn; Step 2: The SSC (Information Technology Department) bases on the information on the Registration Form to create an account and allocate usage rights for the IDS subsystem to the public company. Information about the IDS subsystem account is automatically sent via email to the company's registered email by the IDS subsystem. Step 3: After receiving the account information, the public company accesses the address: https://ids.ssc.gov.vn, and performs the following tasks:

• Log in to the system with the issued account;
• Change the password immediately after successful login;
• Update the public company profile (if any).

2. In case of forgetting the password, the public company performs the following tasks:

• Access the address: https://ids.ssc.gov.vn;
• Click the "Forgot Password" button;
• Enter the Login Name and the email address registered with the SSC;
• The IDS subsystem will automatically send account information to the company's email;
• After receiving the account information email, the company performs according to Step 3 of Clause 1 of this Article.

Article 10. Process for Sending Reports and Information Disclosure on the IDS Subsystem

1. In case of sending reports and information disclosure belonging to the financial report group, the user performs the following steps: Step 1: Access the address https://ids.ssc.gov.vn. Step 2: Log in to the IDS subsystem with the issued account. Step 3: Select the "Report Management" menu and select the "Financial Report Group"; select the Report Form and click the "Add" button. On the report sending screen, the user enters data into the information fields (information fields marked with * are mandatory). Note: The IDS subsystem supports the following data entry methods: Method 1: Enter data directly into the cells according to the program interface Form. Method 2: Enter data from an Excel file:

• Download the Excel form from the IDS subsystem and enter data into the Excel file;
• On the "Send Report" screen, click "Load Excel Data", at which point the data is displayed on the program interface. Method 3: Enter data from XBRL
• Download the XBRL form from the IDS subsystem and enter data into the XBRL file;
• On the "Send Report" screen, click "Load XBRL Data", at which point the data is displayed on the program interface. Step 4: Upload to the IDS subsystem the full-text report file signed digitally. Step 5: Click the "Submit for Approval" button.

2. In case of sending reports and information disclosure belonging to the securities offering and issuance group, the user performs the following steps: Step 1: Access the address https://ids.ssc.gov.vn. Step 2: Log in to the IDS subsystem with the issued account. Step 3: Select the "Report Management" menu and select the "Securities Offering and Issuance Report Group"; select the Report Form and click the "Add" button. On the report sending screen, the user enters data into the information fields (information fields marked with * are mandatory). Note: The IDS subsystem supports the following data entry methods: Method 1: Enter data directly into the cells according to the program interface Form. Method 2: Enter data from an Excel file (if available):

• Download the Excel form and enter data into the Excel file;
• On the "Send Report" screen, click "Load Excel Data", at which point the data is displayed on the program interface. Step 4: Upload to the IDS subsystem the full-text report file signed digitally. Step 5: Click the "Submit for Approval" button.

3. In case of sending abnormal reports, information disclosure as required, and other periodic information disclosure, the user performs the following steps: Step 1: Access the address https://ids.ssc.gov.vn. Step 2: Log in to the IDS subsystem with the issued account. Step 3: Select the "Report Management" menu and select the corresponding Report Group; select the Report Form and click the "Add" button. On the report sending screen, the user enters data into the information fields (information fields marked with * are mandatory). Step 4: Attach the signed report file. Step 5: Click the "Submit for Approval" button. (Details of the steps for the report sending process, report management, public company profile management, and digital signature usage are in the User Guide).
4. Digital Signature of Report Documents: Public companies sign report documents using the digital signature tool of the digital signature service provider before uploading the report document file to the IDS subsystem.
5. In case the SSC rejects the public company's report, the reason for rejection is notified by the SSC on the "Report Management" screen of the IDS subsystem. The public company must resubmit the report to the SSC within twenty-four (24) hours from the time of receiving the SSC's notification.

Article 11. Regulations on Updating "Public Company Profile"

1. After receiving the IDS subsystem login account from the SSC, the public company accesses the IDS subsystem at the address https://ids.ssc.gov.vn and selects the "Company Profile" item to declare and update the company profile according to the content prescribed in Clause 2, Article 3 of this Regulation.
2. Public companies are responsible for updating information about the company profile when there are changes related to the company profile. The update of the company profile is performed simultaneously with sending reports and information disclosure via the IDS subsystem as prescribed in Article 4 of this Regulation.

Article 12. Handling Incidents or Changes in System Reporting Address

1. In case the SSC's IDS subsystem encounters an incident or changes in the reporting and information disclosure system address, the SSC notifies the public company via: the IDS subsystem or the SSC's electronic portal or via email, mobile phone number of the person performing the disclosure of the public company registered with the SSC.
2. In case sending electronic reports via the IDS subsystem encounters an incident as notified by the SSC, the public company sends the report in writing (outside the envelope clearly marked: Report and Disclosure Documents and Incident Content), specifically as follows:

• Send to the Public Company Supervision Department the report and disclosure documents related to the public company;
• Send to the Securities Offering Management Department the report and disclosure documents related to securities offering and issuance. In this case, the time of receiving the disclosed information in writing is determined by the postmark. After the incident is resolved, the SSC notifies via the methods stated in Clause 1 of this Article on the same working day, and the public company resends the electronic report via the IDS subsystem.

Article 13. Regulations on Account Management and Usage

1. Public companies are issued only one account to access the IDS subsystem, including the login name and password; Public companies are responsible for managing, using, and securing the issued account.
2. Public companies using the IDS subsystem must change the account password at the first login and at least every three (03) months must change the password; The account password must be set at the "complex password" level.
3. In case the company detects a risk of leakage of information about the account and password used, the public company reports immediately to the SSC (Information Technology Department) via email (file sent with digital signature)/fax and/or official letter. The SSC (Information Technology Department) will lock the account immediately after receiving the report from the public company. The SSC (Information Technology Department) will reissue the account to the public company within one (01) working day from the time of receiving the report from the public company. The reissuance of the account or notification to the company is performed via the company's registered email.
4. In case the SSC detects a leakage or risk of leakage of information about the user's account and password of the public company, the SSC (Information Technology Department) will lock the user's account and notify the public company via the company's registered email. After receiving the report from the public company via email (file sent with digital signature)/fax and/or official letter, within one (01) working day, based on the company's report, the SSC (Information Technology Department) will assess the risk and reissue the account to the company or notify the company to eliminate the risk before requesting the reissuance of the account. The reissuance of the account or notification to the company is performed via the company's registered email.

Chapter III ORGANIZATION OF IMPLEMENTATION

Article 14. Organization of Implementation

1. The SSC organizes the implementation of technical and professional support for public companies using the SSC's Information Disclosure System as follows:

• The Information Technology Department is responsible for managing, administering, and operating the SSC's Information Disclosure System; guiding and providing technical support to public companies and related units during registration and use of the IDS subsystem; guiding public companies on the use of digital signatures in electronic transactions as prescribed.
• The Public Company Supervision Department is responsible for guiding and providing professional support to public companies related to information disclosure activities.
• The Securities Offering Management Department is responsible for guiding public companies related to reporting and information disclosure on securities offering and issuance on the IDS subsystem.

2. Public companies, listed organizations, and organizations registering for trading are responsible for organizing the implementation according to the provisions of this Regulation.
3. Stock Exchanges organize the implementation of technical and professional support for listed organizations and organizations registering for trading using the Stock Exchange System.

Article 15. Information on Technical and Professional Support Units

1. For technical requirements: Information Technology Department - State Securities Commission, Phone: 024.3934.0750; 024.3935.0177; 024.3926.2545; Email: hotroids@ssc.gov.vn.
2. For professional requirements:

• Public Company Supervision Department - State Securities Commission: Phone: 024.3934.0750.
• Securities Offering Management Department - State Securities Commission: Phone: 024.3934.0750; Email: quanlychaoban@ssc.gov.vn.

3. Detailed information on technical and professional support for the SSC's Information Disclosure System is posted on the Information Technology Application Support Page of the State Securities Commission's electronic portal at the address https://www.ssc.gov.vn and on the homepage of the IDS subsystem.

Article 16. Amendments and Supplements

1. During the implementation, if the normative legal documents referenced for application in this Regulation are amended, supplemented, or replaced by new documents, the amended, supplemented, or replaced documents will be applied.
2. During the implementation of this Regulation, if difficulties or obstacles arise, organizations and individuals are requested to report promptly to the SSC at the address in Article 15 of this Regulation for support and resolution.
3. The replacement, amendment, and supplementation of this Regulation are decided by the Chairman of the SSC./.