Effective May 16, 2026, Vietnam’s General Department of Standards, Metrology and Quality (STAMEQ) introduced a new import requirement targeting biometric authentication devices—marking a significant regulatory shift for exporters and supply chain actors in the global identity verification ecosystem. The rule directly impacts manufacturers, traders, and logistics providers engaged in the Vietnamese market, reflecting growing national emphasis on digital identity integrity and anti-spoofing resilience.

Event Overview

On May 16, 2026, STAMEQ announced that all imported biometric readers—including fingerprint scanners, palm vein terminals, and 3D structured-light facial recognition devices—must be accompanied by a liveness attack detection test report issued by a China National Accreditation Service for Conformity Assessment (CNAS)-accredited laboratory, compliant with ISO/IEC 30107-3:2025. Shipments lacking such documentation will be detained at Hanoi Port and granted only 72 hours to submit valid reports; failure to comply results in mandatory re-exportation.

Industries Affected

Direct trading enterprises face immediate operational risk: customs clearance delays, port detention fees, and potential cargo rejection introduce cost volatility and contractual liability—especially where Incoterms place compliance responsibility on the exporter (e.g., DAP or DDP). Unlike previous self-declaration or third-country certification models, this mandate requires direct engagement with CNAS-accredited labs, narrowing acceptable conformity pathways.

Raw material procurement enterprises are indirectly impacted—not through direct regulatory exposure, but via upstream pressure. Suppliers of optical modules, IR illuminators, or sensor substrates may now need to provide traceable liveness-relevant performance data (e.g., spectral response stability under spoof attempts) to support downstream test reporting. This shifts technical due diligence earlier into the sourcing cycle.

Manufacturing enterprises must reassess product architecture and firmware validation protocols. ISO/IEC 30107-3:2025 testing evaluates resistance to sophisticated presentation attacks (e.g., textured silicone masks, dynamic video replay, multi-layered print overlays), requiring hardware-level design considerations (e.g., multispectral capture, temporal depth consistency checks) beyond basic algorithmic liveness flags. Retrofitting legacy platforms is often infeasible; new product launches now require concurrent test planning from R&D phase.

Supply chain service enterprises, including customs brokers, freight forwarders, and regulatory consultants, must upgrade their documentation verification workflows. They now need to validate not only report authenticity (via CNAS public registry cross-check) but also scope alignment—e.g., whether the tested model number, firmware version, and physical configuration match the declared shipment. Automated document-matching tools lacking version-aware logic risk false clearance approvals.

Key Focus Areas and Recommended Actions

Verify CNAS lab accreditation status against current STAMEQ-recognized scope

Not all CNAS-accredited labs are authorized for ISO/IEC 30107-3:2025 testing. Enterprises must confirm the issuing lab appears on STAMEQ’s updated list (if published) or, absent that, cross-reference CNAS’s official database for “biometric liveness evaluation” under testing scope code CNAS-CL01-A019.

Align test reports with exact commercial unit configurations

Reports must reflect the precise hardware revision, firmware build, and optical module batch shipped—not generic platform-level certifications. Discrepancies in lens coating, IR LED wavelength tolerance, or sensor gain settings can invalidate test validity per STAMEQ’s enforcement interpretation.

Factor in 4–6 week lead time for full-cycle liveness testing

CNAS-accredited labs report average turnaround of 28–42 days for end-to-end ISO/IEC 30107-3:2025 evaluation—including sample submission, attack vector selection, iterative retesting after failure, and report issuance. This cannot be compressed via expedited processing without compromising test rigor.

Maintain version-controlled documentation archives

Enterprises should retain dated copies of test reports, firmware binaries, BOMs, and calibration logs for each export lot. STAMEQ reserves the right to request retrospective verification if post-clearance audits identify anomalies in field performance.

Editorial Perspective / Industry Observation

Observably, this requirement signals Vietnam’s deliberate move toward harmonizing its biometric regulatory framework with EU-aligned assurance levels—not merely adopting international standards, but enforcing them through nationally controlled verification gates. Analysis shows that STAMEQ’s choice of CNAS (rather than local or ASEAN-accredited labs) likely reflects pragmatic capacity constraints and existing bilateral technical cooperation, rather than geopolitical preference. From an industry perspective, this is less about protectionism and more about risk containment: Vietnam’s rapid rollout of national ID-linked e-government services increases exposure to identity fraud, making pre-market liveness assurance operationally urgent. Current more critical concern lies in interoperability—whether future STAMEQ-accepted reports will recognize equivalent testing from ILAC-MRA signatories (e.g., UKAS or DAkkS), or remain CNAS-specific as a de facto technical barrier.

Conclusion

This regulation underscores a broader global trend: biometric device markets are transitioning from feature-driven competition to assurance-driven compliance. For stakeholders, the implication is structural—not just procedural. Success no longer hinges solely on accuracy benchmarks or user experience metrics, but on verifiable, auditable, and jurisdictionally aligned security claims. A rational reading suggests this is not a temporary hurdle, but the baseline for market access in digitally ambitious emerging economies.

Source Attribution

Official notice issued by the General Department of Standards, Metrology and Quality (STAMEQ), Vietnam, dated May 16, 2026. Reference: STAMEQ Circular No. 2026/TT-TCCL (provisional designation pending formal publication in Official Gazette). Note: STAMEQ has not yet published an English-language version or clarified whether reports issued prior to May 16, 2026 under ISO/IEC 30107-3:2017 remain valid. These points remain under active observation.