How Vietnam's tax authority uses AI and big data, and how businesses should adapt

The short answer

Vietnam's tax administration is moving decisively from "planned audits" to "data-driven risk management". According to the Tax Department, the tax authority puts e-invoice data at the centre and matches it against bank cash flows to determine actual tax liabilities. Big data and artificial intelligence are used to analyse risk.

The 2025 Law on Tax Administration has also put three mechanisms into law:

• grouping taxpayers by compliance history;

• remote audits on electronic data;

• automated refunds, exemptions and reductions.

The implication for businesses is clear: any mismatch between data sources can become a question from the tax authority. The best way to adapt is to analyse your own data the way the tax authority does, and resolve mismatches before you are asked.

What data does the tax authority hold?

Data source	What the tax authority can see	Typical questions for the business
E-invoices (all output and input invoices nationwide)	Revenue, costs, counterparties, invoice and signing dates	Does invoiced revenue match the returns? Were purchases made from risky sellers?
Tax returns for every period	Filing history and unusual movements	Why did revenue or profit swing so sharply?
Bank cash flows	Actual receipts and payments	Are there receipts without invoices? Do payments match the sellers?
E-commerce and digital platforms	Online sales revenue	Is platform revenue fully declared?
Customs	Import and export values, customs values	Do export revenue and imported cost of goods match the books?
Business registration and identity data	Owners, legal representatives and links between companies	Are there undeclared related-party relationships?
Aggregated industry data	Average margins and cost ratios by industry	Why are margins far below the industry average?

Now that the 2025 Law on Tax Administration makes the individual tax code the same as the personal identification number, it is even easier to link data on companies, owners, managers and their relatives. This is the foundation for identifying related-party relationships, including those businesses have not declared themselves.

What is the data used for?

1. Grouping taxpayers. The tax authority groups businesses by sector, size, ownership and compliance history to decide the level of supervision.

2. Risk-scoring refund claims. Under Circular No. 94/2026/TT-BTC, VAT refund claims are risk-classified on the system. High-risk claims are moved to audit-before-refund, and the classification can change mid-process if risk indicators emerge.

3. Flagging risky invoices and sellers. The system automatically flags sellers showing anomalies, such as newly established companies issuing large invoices or invoices without matching costs.

4. Selecting audit targets. The 2026 audit programmes focus on long-term loss-makers, thin-margin businesses, sudden revenue spikes and related-party transactions. All of these are signals that can be detected from data.

5. Remote audits. Instead of visiting the premises, the tax authority can send requests for explanations based on specific data mismatches.

How should businesses adapt?

1. See yourself as the tax authority sees you. Every quarter, export output and input e-invoice data from the tax authority's system and reconcile it with ledgers, returns and bank statements. A mismatch found early is always cheaper than one you are asked about.

2. Track your own risk indicators against the industry:

• gross and net margins;

• cost-to-revenue ratios;

• VAT payable as a share of revenue;

• the share of costs paid to related parties.

Any unusual indicator should have a written explanation, with evidence, prepared in advance.

3. Clean up master data. Customer and supplier details (tax code, name, address) must be accurate and consistent across systems. Small master-data errors generate many "false mismatches" in automated matching.

4. Route business cash flows through company accounts. Collecting money through the owner's personal account, or a personal QR code, is one of the risks most easily detected when the tax authority matches cash flows.

5. Digitise explanation files. As audits move to remote formats, the ability to provide complete, well-organised electronic files quickly determines the outcome.

6. Data governance and security. Financial and customer data are assets that need protection, while also complying with personal data protection law.

Illustrative case

Company V runs a chain of food stores. Some retail customers paid by scanning a QR code displayed at the counter, but the QR code led to the director's personal bank account. This habit dated back to when the business was a household business.

When the tax authority matched cash flows against declared revenue, a large gap immediately appeared. With it came questions about revenue that had not been invoiced or declared.

Company V acted before receiving a formal request for explanations:

• it moved all QR codes to the company's account;

• it implemented e-invoices generated from cash registers;

• it reconciled and filed amendments for the omitted revenue within the permitted window.

FAQs

Can the tax authority see a company's bank accounts?

The tax authority is strengthening its access to and use of bank cash flow data to match against invoices and returns, in accordance with tax administration law. Businesses should treat their cash flows as data that may be matched.

Does AI automatically "penalise" businesses?

No. The systems analyse, score and flag risk. Conclusions and enforcement still require audit and verification under the rules. The Tax Department has also confirmed that a risk alert does not equal a finding of violation.

Are small businesses affected?

Yes, even more visibly. Invoice and cash flow data allow the tax authority to manage household and small businesses without on-site audits.

How often should data be reconciled?

At least quarterly, before each major filing and before the annual finalisation.

Legal basis

• Law on Tax Administration No. 108/2025/QH15 and Decree No. 252/2026/ND-CP.

• Circular No. 94/2026/TT-BTC on compliance management and risk management in tax administration.

• Decree No. 254/2026/ND-CP on invoices and e-documents.

• Official Letter No. 6936/CT-QLTT of the Tax Department dated 18 September 2026.

• Law on Personal Data Protection and implementing regulations.

How W&A can help

When the tax authority manages by data, businesses need to manage tax by data too. W&A supports businesses with:

• Periodic tax data analytics: reconciling e-invoices, ledgers, returns and cash flows to find mismatches the way the tax authority does.

• Building a tax risk indicator set benchmarked against the industry, with explanation files prepared in advance.

• Standardising collection, invoicing and master-data processes, especially for retail chains and e-commerce businesses.

• Support with remote audit explanations, providing complete and consistent electronic files.

• Data governance and personal data protection advice linked to finance and accounting systems.