# Government-Customer Compliance Policy Operational policy for any Tech Sequence Holdings entity classified as **Tier 1** or **Tier 2** under decision [D17](../notes/decisions.md). Adopted at incorporation, not retrofitted. Driving Vietnamese laws referenced throughout: - Luật Đấu thầu 2023 (Law No. 22/2023/QH15) — Public Procurement - Luật Phòng chống tham nhũng 2018 (Law No. 36/2018/QH14) — Anti-Corruption - Luật Bảo vệ bí mật nhà nước 2018 (Law No. 29/2018/QH14) — State Secrets Protection - Luật An ninh mạng 2018 (Law No. 24/2018/QH14) + Nghị định 53/2022 — Cybersecurity + Data Localization - Nghị định 13/2023 — Personal Data Protection (PDPD) - Nghị định 01/2021 — Enterprise Registration (governs shareholder structures) --- ## Scope This policy applies to any TS entity that: - Has government, SOE, or public-sector entities as material customers (Tier 1 or Tier 2 per D17), OR - Operates in a sector regulated by foreign-ownership caps with government nexus, OR - Handles data that meets the legal definition of state secret under Luật Bảo vệ bí mật nhà nước 2018 Tier 3 entities (no government touch) are not subject to this policy. Standard discipline under D6 and D7 is sufficient. --- ## The 12 operating disciplines ### 1. Legal representative is not the founder Each gov-facing entity has its own Người đại diện theo pháp luật. Requirements: - Vietnamese citizen (mandatory for many regulated sectors) - Clean criminal record verified via Phiếu lý lịch tư pháp số 2 (Criminal Record Statement Type 2) - Compensated for personal-liability exposure: base premium above market salary + entity indemnification + D&O policy from Vietnamese carrier - Succession plan documented — if a legal rep is investigated or arrested, the swap procedure executes within 5 business days without operational disruption - The founder is never the legal representative anywhere in the Vietnamese stack ### 2. D&O insurance from a Vietnamese carrier Acceptable primary carriers: PVI Insurance, Bảo Việt, AIG Vietnam, Allianz Vietnam, Liberty Mutual Vietnam. International D&O policies frequently exclude Vietnamese regulatory action — Vietnamese-issued policies are required as primary coverage. International D&O may be carried as excess but does not replace local primary. Minimum coverage targets at incorporation: VND 10 billion (~$400K) per claim, VND 30 billion aggregate annually. Increase as entity revenue grows. ### 3. Independent Compliance Officer at each entity Reports to the entity board, not to TS Shared Services Compliance lead. Cross-entity disclosure during investigation is the failure mode this prevents — a centralized Compliance function becomes a single point of evidence-collection across the group. The Shared Services Compliance lead supports, advises, and trains entity Compliance Officers but does not direct them. ### 4. No intercompany loans involving gov-facing entities Cost-plus services billing only, at arm's length, with full legal review of the underlying services agreement. Any cash movement that is not standard service billing becomes "related party benefit" evidence in investigations under the Anti-Corruption Law. This is a tightening of D7. D7 says no co-mingling. For gov-facing entities, no inter-entity lending of any form, regardless of documentation quality. ### 5. Physical office separation Gov-facing entities do not share office space with the rest of TS. When investigators execute a search warrant (Lệnh khám xét), they take everything in the physical space — laptops, paper files, servers, phones — regardless of which entity owns it. Co-located gov-facing and commercial entities = one search warrant collects evidence from both. ### 6. Banking separation by tier Recommended bank allocation: | Tier | Suggested banking | |---|---| | Tier 1 entities | Vietcombank or BIDV (state-affiliated, structurally harder for investigators to weaponize via political channel) | | Tier 2 entities | Their group's primary bank, but separate accounts from the Singapore parent's primary banking | | Tier 3 entities | Techcombank, VPBank, HSBC Vietnam, Standard Chartered Vietnam | | Singapore parent and TS Shared Services | DBS Singapore + UOB Singapore (geographic separation) | Asset preservation orders during investigation operate at the bank-relationship level. Bank diversification slows contagion. ### 7. Document retention in Vietnam (not Singapore) 10-year retention, physical and digital, in Vietnam for: - Government contracts and amendments - Bid documents (winning and losing) per Luật Đấu thầu - All written communications with government counterparties (email, letters, meeting minutes) - Gift register and entertainment register - Anti-corruption training records per employee - Conflict-of-interest declarations - Compliance Officer audit reports Investigators expect paper trails physically present in Vietnam. Documents held only in Singapore create cooperation problems with Vietnamese authorities even when production is willing. ### 8. Gift and entertainment register Mandatory under Anti-Corruption Law. Threshold: VND 500,000 (~$20). Above threshold, all gifts to or from government counterparties logged with: - Date, recipient name and title, recipient ministry/agency - Item or activity, fair-market value - Business purpose, related contract or bid (if any) - Approver Quarterly review by entity Compliance Officer. Annual review by Shared Services Legal. Vietnamese cultural baseline includes routine gift-giving in business contexts. The compliance task is not to forbid all gifts but to document everything above threshold and refuse anything that creates appearance of inducement. ### 9. No nominee shareholder structures Vietnamese law (Nghị định 01/2021 on enterprise registration) is explicit: nominee arrangements where the registered shareholder does not bear real economic interest are illegal and expose both nominal and beneficial holders to criminal liability under Anti-Corruption Law and Penal Code provisions. Where Vietnamese majority is required by sector regulation: - Use a real Vietnamese co-shareholder with real economic interest - Common patterns: Vietnamese strategic co-investor (SCIC, FPT, Viettel, VNPT, Vietcombank, BIDV minority); senior Vietnamese executive with vested equity that they actually paid for at fair value - Real shareholders' agreement with arm's-length terms (drag-along, tag-along, ROFR, board rights — all genuinely negotiated, not pre-determined) - Real dividend flow that goes to the Vietnamese shareholder's actual bank account and is not pass-through to TS Holdings If you cannot find a real Vietnamese co-shareholder, do not incorporate. Operate via a different structure (e.g. white-label partnership with a fully-Vietnamese entity) or decline the sector. ### 10. Anti-corruption training, annual, external counsel Documented training completion per employee, conducted by external Vietnamese counsel — not internal HR, not Shared Services Compliance. - Frequency: annual minimum, plus on-hire for new employees within 30 days - Role-specific modules for sales, BD, GR, finance, and procurement functions - Materials reviewed annually for updates to Vietnamese law - Completion tracked in HR system, reportable on demand Vietnamese cultural baseline considers small facilitating payments normal in some contexts. This must be addressed explicitly with documented training and paper trail — not assumed away. ### 11. Whistleblower channel bypassing entity management Reports route to TS Shared Services Legal directly, not to the entity CEO or entity Compliance Officer. Requirements: - Anonymous reporting available (email, phone, web form) - Intake logged with timestamp, even when anonymous - Acknowledgment to reporter within 5 business days - Investigation log with status updates - Resolution documented and retained for 10 years - Non-retaliation policy with whistleblower-protection language drawn from Anti-Corruption Law Articles 65–67 Reports involving the entity CEO or entity Compliance Officer route to Shared Services Legal AND to a designated TS Holdings board member directly, bypassing entity leadership entirely. ### 12. No founder personal guarantees The founder does not guarantee entity contracts, entity debt, entity tax obligations, entity regulatory compliance, or entity bid bonds. Full stop. Any contract, financing, or bid that requires founder personal guarantee is declined or restructured. Entity-level guarantees (entity guaranteeing its own subsidiary, sub-holding guaranteeing its operating entity) are acceptable subject to legal review. --- ## State secrets handling Several Tier-1 entities will handle material that meets the legal definition of state secret under Luật Bảo vệ bí mật nhà nước 2018. Likely exposure by entity: | Entity | Possible state-secret exposure | |---|---| | Blue Dot Technology | Environmental data above certain thresholds; certain monitoring data classified by MoNRE | | Vitrine | Cultural heritage cataloguing including provincial-level inventory data | | TS Data Services (gov-cloud arm) | Any data classified by customer ministry; cloud infrastructure metadata | | Argus | Virtually all customer data; vulnerability assessments; incident response data | | **TS National AI** | **Fine-tuned models for gov customers** (the models themselves can be state-secret-classified post-training); gov customer training data; classified-domain knowledge embedded in model weights. **Specific AI operational requirements:** Vietnamese-citizen-only access for state-secret model fine-tuning; air-gapped training pipelines for sensitive workloads; model-artifact provenance tagging with sensitivity classification; one-way data flow from TS Intel (no gov data flows back to commercial); annual third-party AI-compliance audit (KPMG / PwC technology-risk practice); explicit source-code review provisions in gov contracts | | **TS Field** (drone + IoT + applied robotics) | **Aerial imagery of sensitive sites** (border zones, military facilities, government infrastructure, certain economic infrastructure); IoT data from gov-customer deployments; dual-use surveillance data. **Specific operational requirements:** licensed secure facility for processing sensitive imagery; background-checked pilots and image-analysts for state-secret-handling roles; encrypted offline storage for protected imagery (NOT on TS Data Services cloud); strict separation of sensitive-imagery operations from commercial drone operations; CAAV + MoD pre-clearance for any flight in sensitive zones; **sensitive-imagery AI analytics routed through TS National AI** (not directly to TS Intel) per D23 | | TS Land | Detailed mapping data, certain zoning data, surveying data above resolution thresholds | | Hogcare | National-level agricultural data; food-security adjacent data | | **TS Notary** | Notarized transaction data on state-asset transfers, foreign-invested transactions, certain SOE transactions; integration with national digital ID (CCCD/VNeID), land registry, e-tax systems means handling of national-systems data. **Low-to-moderate exposure** at launch (Tier 2 provisional). Tier-1 reassessment trigger: if state notary office customer share exceeds 40% of revenue. Sensitive document handling per PDPD + statutory notary retention requirements. | | Intelomics (provisional) | Certain bioinformatic data on Vietnamese population genetics; pathogen sequencing data | Where state secrets are involved, additional requirements: - Licensed secure facility with state-secret protection certification from Ministry of Public Security - Background-checked personnel: Phiếu lý lịch tư pháp + ministry-level clearance specific to the secret classification - Encrypted offline storage on dedicated infrastructure — no cloud, including no TS Data Services cloud - Designated state-secrets compliance officer per entity, separate from general Compliance Officer where appropriate - Network segmentation isolating state-secret systems from non-state-secret operations - Document destruction protocols approved by relevant ministry Scope which entities will touch state secrets at incorporation, not after the first contract is signed. Retrofitting state-secret compliance after signing a contract is a common failure mode. --- ## Government contract bid hygiene For every public-procurement bid (Luật Đấu thầu 2023): - Tender documentation reviewed by external counsel before submission, not just internal legal - Bid evaluation criteria documented and retained - Conflict-of-interest declaration per bid team member, fresh per bid - Post-award contract execution log with full audit trail - No bid runners, facilitators, or "consultants" outside the documented bid team - Sub-contractors and partners disclosed in bid; later additions require fresh disclosure - Bid bonds (Bảo lãnh dự thầu) and performance bonds from Vietnamese banks, not personal guarantees Common failure pattern: an outside "consultant" promises to "manage relationships" for a percentage of contract value. This is a facilitation payment regardless of how it is invoiced. Any engagement with this structure is declined. --- ## Source code review provisions For Argus, TS Data Services gov-cloud, TS Intel work involving government, and other cybersecurity/data-handling entities: - Standard Vietnamese government contract clauses now require source code review provisions - Negotiate scope at contract signing: which code, which reviewers, where (in-country requirement common), what IP carve-outs apply - Vietnamese-citizen-only access provisions are common for state-secret-adjacent work; plan engineering capacity accordingly - IP terms must protect underlying TS Intel models and shared infrastructure from derivative-ownership claims by government customers - Foundational models trained on non-government data must be clearly delineated from customer-specific fine-tunes that may incorporate government data --- ## Founder personal protection These are not entity-level disciplines but apply to the founder personally as the long-term beneficial owner: - **Exit ban risk** (Lệnh cấm xuất cảnh): real preliminary measure during Vietnamese investigations, often pre-charge. Founder maintains backup Singapore Permanent Residence (or equivalent residency optionality) and ensures travel documentation is current. Founder considers cadence of time spent in Vietnam vs. Singapore in light of any active or pending investigation at any portfolio entity. - **No legal representative role**: founder is not Người đại diện at any Vietnamese entity, ever. - **Separate legal counsel**: founder maintains personal Vietnamese legal counsel separate from entity counsel and from TS Shared Services Legal. Conflicts arise during investigations. - **Personal D&O coverage**: founder carries D&O coverage separate from entity D&O policies. International D&O policy covering Singapore directorships is appropriate. - **Asset structuring**: founder personal assets held via the Singapore vehicle (per D2), not directly in Vietnam. Personal real estate, vehicles, and investments in Vietnam are minimized. --- ## Incorporation checklist for any new Tier 1 / Tier 2 entity Before incorporation: - [ ] Tier classification confirmed in writing, signed by founder and Shared Services Legal - [ ] Sector-specific foreign ownership caps researched; structure designed accordingly - [ ] Vietnamese co-shareholder identified (if Vietnamese majority required); shareholders' agreement drafted at arm's length - [ ] Người đại diện theo pháp luật identified, criminal record verified, compensation agreed, succession plan drafted - [ ] D&O policy from Vietnamese carrier quoted and committed - [ ] Independent Compliance Officer identified; reporting line to entity board documented - [ ] Physical office space identified and committed, separate from other TS entities - [ ] Banking relationship at the assigned bank for the tier - [ ] Document retention infrastructure (physical and digital) in Vietnam ready - [ ] State-secrets handling assessment if applicable; secure facility plan if state secrets confirmed - [ ] External counsel for anti-corruption training engaged - [ ] Vietnamese SOE/quasi-government minority co-investor identified for Tier 1 entities Before first government contract: - [ ] Anti-corruption training completed for all employees on payroll - [ ] Gift register and entertainment register operational with logging procedure - [ ] Whistleblower channel published internally with clear routing - [ ] Bid hygiene policy adopted; external counsel relationship for bid review established - [ ] State-secrets compliance officer designated if state secrets involved - [ ] First-year compliance audit scheduled with Big 4 (Vietnamese-licensed practice) --- ## Related documents - [../notes/decisions.md](../notes/decisions.md) — D17 establishes the structural framework this policy operationalizes; D1, D5, D6, D7 are the related foundational decisions - [../README.md](../README.md) — tier classification per entity is tracked in the entity index - [year-1-deployment-plan.md](year-1-deployment-plan.md) — incorporation timeline for TS Public Sector Holdings sub-holding