Quản lý rủi ro hoạt động trong phát hành và thanh toán thẻ tại ngân hàng nông nghiệp và phát triển nông thôn việt nam tt tiếng anh

MINISTRY OF EDUCATION AND TRAINING THUONGMAI UNIVERSITY - NGUYEN NGOC SON OPERATIONAL RISK MANAGEMENT IN CARD ISSUANCE AND PAYMENT AT VIETNAM BANK FOR AGRICULTURE AND RURAL DEVELOPMENT Major: Economic Management Code : 62.34.04.10 Summary of doctoral thesis Hanoi, in 2019 This research is conducted in Thuongmai University Supervisors: DR VU XUAN DUNG ASSOC.PROF.DR NGUYEN THI MUI Reviewer 1: ASSOC.PROF.DR VU DUY HAO Reviewer 2: ASSOC.PROF.DR TRAN THANH TU Reviewer 3: ASSOC.PROF.DR DAO MINH PHUC This thesis shall be under defense before the Thesis Examination Board level, at Thuongmai University on Ho Tung Mau Street, Cau Giay, Hanoi At………, date…….month ….…year…… This thesis is available in: The National Library The Library of Thuongmai University INTRODUCTION The urgency of the topic Risk in card services is increasing and complicated, the level of fraud in card issuance and payment activities is always unpredictable changing, especially when banks have to face the attack of criminal organizations, forgery, fraud in card issuance and payment activities Thus, it reduces business performance, affects the reputation and brand of the banks In the trend of international integration, it requires Vietnamese commercial banks including Agribank to meet operational risk management requirements in general and card operational risk management in particular according to international standards However, card operational risk management at Agribank is still very limited in practice, customer information management is incomplete, the technology not meet the requirements of risk management, the card system is not synchronized, the security system is not high, there are many holes bringing about risks and complaints yet Besides, there is still a lack of mechanism for risk management activities In such a context, the thesis approaches to research the topic “Operational Risk Management in Card Issuance and Payment at Vietnam Bank for Agriculture and Rural Development” is necessary to contribute finding synchronous, effective and feasible solutions for Agribank's card operational risk management activities Research purposes and tasks - Research purposes The thesis offers solutions and recommendations with scientific and practical basis to improve card operational risk management at Agribank - Research tasks + Systematize and clarify the basic arguments about card opertaional risk and card operational risk management of commercial banks + Research on pratical card operational risk management of a number of domestic commercial banks to draw lessons for Agribank in card operational risk management + Analyze and evaluate the real situation of card operational risk management at Agribank to point out the limitations that need to be improved to meet the risk management activities; + Propose solutions and recommendations to make card operational risk management at Agribank more effective Objects and scope of research - Objects: The thesis researches into theoretical and practical issues on card operational risk management of commercial banks - Scope: + About content: Only focusing on researching card operational risk at commercial banks Credit risk, interest rate risk, currency risk, market risk related to the card only further card risk management + About space: The thesis researches on card operational risk management of Agribank + About time: The thesis researches on card operational risk management in practice of Agribank from 2012 to 2017 At the same time, proposing solutions and recommendations from now to 2025, vision to 2030 New contributions of the thesis - New contributions to theory: Clarify the concept of operational risks and impacts on card issuance and payment activities of commercial banks; analyze and explain the card risk management process, risk management tools, evaluation criteria, as well as factors affecting card operational risk management of commercial banks; analyze and learn some lessons for Agribank from card operation risk management practice of some Vietnamese commercial banks - New contributions to practice: Analyze and evaluate the status of card operational risk management of Agribank in the period of 2012 to 2017 regarding aspects such as policies, models, processes From there, pointing out the achieved results, limitations and causes of card operational risk management activities - New contributions to solution: To complete card operational risk management model; To build quality human resources to meet card operational risk management requirements; To check and complete card issuance and payment process, card operational risk management process; To invest and upgrade technology; Coordinate closely with law enforcement agencies and national and international card organizations; Develop an early warning system for card operation risks; Perform communication work to customers CHAPTER RESEARCH OVERVIEW AND METHODS 1.1 Overview of research situation related to the thesis 1.1.1 Studies on development of bank card services There are typical case studies relating to the development of card services, including: Tran Tan Loc (Doctoral thesis in 2004 ) "Basic solutions to develop bank card market in Vietnam"; Hoang Tuan Linh (Doctoral thesis in 2009) "The solutions for developing card services at the state-owned commercial banks in Vietnam"; Pham Ngoc Ngoan (Doctoral thesis in 2010 ) "Improving state management to card payment services at Vietnamese commercial banks"; Pham Thi Bich Duyen (Doctoral thesis in 2016) "Quality of debit card services at Vietnamese commercial banks"; CHANTHAVONE PHOMMATHEP (Doctoral thesis in 2018) "Developing card business of Laos agricultural bank" 1.1.2 Studies on card operation risk management The researches related to this issue include: Nguyen Danh Luong (Doctoral thesis in 2003) "Solutions to develop the form of card payment in Vietnam"; Pham Ngoc Ngoan (Doctoral thesis in 2010) "Improving state management to card payment services at Vietnamese commercial banks"; Le Thi Van Khanh (Doctoral thesis in 2016) "Operational risk management system at Vietnamese commercial banks"; Pham Thi Bich Duyen (Doctoral thesis in 2016) "Quality of debit card services at Vietnamese commercial banks"; CHANTHAVONE HOMMATHEP (Doctoral thesis in 2018) "Developing card business of Laos agricultural bank"; Johannes Jurgovsky, Michael Granitzer, Konstantin Ziegler, Sylvie Calabretto, Pierre-Edouard Portier, Liyun HeGuelton, Olivier Caelen (2018); Deshen Wang, Bintong Chen , Jing Chen (2018); Mohammed Alqahtani and Aad van Moorsel (2018) 1.2 Research gaps and research direction of the thesis By 2020, 10 pilot commercial banks have to meet Basel II requirements, have to calculate operational risks and deduct provisions for these risks and Agribank is no exception Previously published studies about cards in terms of information technology have not really developed, so some modern cards or non-contact payment facilities have not yet appeared But in recent years, many new types of card have been launched such as prepaid cards, non-physical cards , along with many forms of payment such as contactless card payments, Online card payments, card not present payment, linking ewallets with cards, So, how to manage card risks in the context of 4.0 technology applicated in most sectors of the economy, previous studies have not mentioned The application of modern technology in the card field entails security risks Because cybercriminals are trending to exploit technology and user vulnerabilities, commit frauds with unsafe links and websites This is also a matter of great concern but has not been mentioned in previous studies yet Previous studies have not assessed the impact of risk cards to banks in terms of money, prestige, labours, and even the loss of liquidity, ; to customers, to the economy 1.3 Questions of the thesis - What does the content of card operational risk management include? What are the reasons for card operational risk at commercial banks, especially in the context of applying modern technology in banking activities? - What are the criteria for evaluating the results of card operation risk management of commercial banks? - Which tools have Agribank used to manage card operational risk? How were the results? What are the inadequacies? Are there barriers? And what are their causes to card operational risk management at banks? - Which improvement trend should be applied to card operational risk management in the situation in which high-tech crime attacking network and ATM system is on the rise and regularly change the manner and method of intrusion? 1.4 Research methods 1.4.1 Data collection method - Primary data: Survey by questionnaires, interviewing some experts - Secondary data: Secondary information and data are collected from the database of the State Bank of Vietnam, some commercial banks, Agribank, Vietnam Bank Association, Vietnam Bank Card Association, 1.4.2 Data Processing - Primary data: Postgraduates use traditional statistical and data analysis method to synthesize the assessments and opinions of Agribank’s staffs and experts - Secondary data: Secondary figures after collection is processed and described on Excel software in the form of tables, diagrams, charts and illustrations CONCLUSION OF CHAPTER - The thesis refers to studies on developing bank card services and studies on the operational risk management of bank card; shows the gaps that the previous studies have not studied Since then, the thesis focuses on researching in-depth direction on operational risk management in card issuance and payment at chapter and CHAPTER THEORETICAL BASIS AND PRACTICAL EXPERIENCE ON OPERATIONAL RISK MANAGEMENT IN CARD ISSUANCE AND PAYMENT AT COMMERCIAL BANKS 2.1 Overview of card issuance and payment activities at commercial banks 2.1.1 Concept, characteristics, classification of bank cards 2.1.2 Parties in card issuance and payment process  Issuance bank, Payment bank, Cardholder, Card acceptance unit, Relevant organizations (International Card Organization, NAPAS) 2.1.3 Process of card issuance and payment  Process of bank card issuance and payment  Online card acceptance and payment process Step1: When having demand on purchasing goods and services, cardholders would access the websites that accept card payment from banks and comply with the requirements of those websites Specifically, cardholders must enter a minimum of information as follows: + For domestic cards: The cardholder's full name must be entered; card number; month/year of issuance of the card and OTP is necessary to make the transaction + For international cards: The cardholder's full name must be entered; card number; validity period of the card; CVV2/ CVC2 number Step 2: This information will be transferred to the Payment bank Step 3: Payment bank sends card information to the card providing service and Issuance bank to verify the validity and solvency of the card Step 4: If all information is correct and valid, Issuance bank sends information to Payment bank, decoded information is sent to seller and payment is made Step 5: Money will be transferred from the cardholder's account to the seller's account 2.2 Operational risks in card issuance and payment at commercial banks 2.2.1 Concept of operational risk in card issuance and payment  Operational risk Under Basel II, Operational risk is the risk of losses incurred for inadequate or failed internal processes, people and systems, or from external events Including legal risk but not including strategic risk and reputable risk [12] According to Circular 41/2016/TT-NHNN, Operational risk refers to the risk arising due to inadequate or failed internal processes, human factors, system errors and failures or external events that cause financial losses or non-financial negative 11 According to BIDV, Operational risk management is the process of determining scope, setting up apparatus, organizational structure, policies, management responsibilities, and using management resources and tools to identify, assess, measure, propose solutions to prevent/ minimize and monitor/ report identified operational risks [27] For card operational risk, this is part of the overall operational risk of all bank activities Therefore, it is possible to apply a number of previous documents and research works on risk management, operational risk management as a references in the research process of this thesis Through studying many various research works in risk management, operational risk management, postgraduates understand that operational risk management in card issuance and payment at commercial banks is the process that credit institutions conduct activities to impact operational risks in card issuance and payment, including setting up organizational structure, building a system of policies and management methods to implement the management process, it is the identification, measurement, evaluation, management, monitoring and inspection of operational risks in card services to limit to the minimum possible loss 2.3.2 Targets of operational risk management in card issuance and payment at commercial banks Firstly, Improve the ability to achieve the goal in the card business Secondly, Improve productivity and operational efficiency of card services Third, Be easier to identify opportunities and challenges 12 Fourthly, Help the risk management in bank card operations become systematic, methodical and professional Fifthly, Enhance the organization's understanding that positively affects organizational culture, staff's working spirit, and responsibility to the unit Sixth, Create trust with customers, improve brand value, build credibility for shareholders, economic organizations, and domestic and foreign credit institutions Seventh, Strengthen the capacity of the internal inspection and control system to prevent possible losses and manage incidents, minimize the risk of bank losses Eighth, Build risk management model according to international practice 2.3.3 Principles and Model of operational risk management in card issuance and payment at commercial banks - Card operational risk management principles: The Basel Committee on banking supervision has summarized four major issues with 10 golden principles in operational risk management and recommended banks to implement - Card operational risk management model: Commercial banks apply the management model of "Three layers of protection" and management level supervision to enhance the effectiveness of operational risk management, specifically:  1st protection layer - The card service providers themselves are responsible for managing risks within the unit  2nd protection layer - The centralized and independent risk management department is responsible for developing, maintaining and monitoring risk management of the whole bank  3rd protection layer - Internal audit, inspection and control department operates independently, supervises to ensure 13 compliance with the risk management strategies, policies and regulations  Management level supervision: The Board of risk monitoring and management is separated from The executive board Depending on the supervisory level, the commercial banks has decentralized the supervision of the process of risk management implementation at different levels 2.3.4 Process of operational risk management in card issuance and payment at commercial banks - Risk identification - Risk measurement - Risk control and preventing - Risk handling, financing and reporting 2.3.5 Tools of operational risk management in card issuance and payment of commercial banks -Risk Control Self Assessment(RCSA) -Key Risk Indicators (KRI) -Events Loss Management (ILM) 2.3.6 Criteria for assessing results of operational risk management in card issuance and payment at commercial banks - Qualitative criteria : Criterion of satisfied level of staffs in each position, criterion of compliance with mechanisms, policies and processes - Quantitative criteria: Criterion of reducing the number of faults and errors, criterion of reduction of losses 2.3.7 Factors affecting the operational risk management in card issuance and payment at commercial banks 14 - Internal elements: Control mechanism, reporting information mode, risk management apparatus, information technology system, supporting tools - External elements: Legal environment, iInput information system, customers, card acceptance unit 2.4 Experience of operational risk management in card issuance and payment of some commercial banks and lessons for Agribank 2.4.1 Experience of BIDV 2.4.2 Experience of Vietcombank 2.4.3 Experience of MUFG Union Bank 2.4.4 Lessons learned about the operational risk management in card issuance and payment for Agribank - Organizational structure - Procedures - Technology - Handle the communication crisis CONCLUSION OF CHAPTER The thesis has synthesized the theoretical basis of card issuance and payment activities, card operational risks, card operational risk management of commercial banks The thesis has set out the goals and principles of card operational risk management; Describe card operational risk management process; suggest risk management tools and at the same time provide criteria for evaluating card operational risk management results Besides, the thesis has studied the risk management experience of VietComBank, BIDV to draw lessons for Agribank in card operational risk management 15 CHAPTER CURRENT STATUS OF OPERATIONAL RISK MANAGEMENT IN CARD ISSUANCE AND PAYMENT AT VIETNAM BANK FOR AGRICULTURE AND RURAL DEVELOPMENT 3.1 Overview of vietnam bank for agriculture and rural development 3.1.1 The formation and development of Agribank 3.1.2 Organizational structure of Agribank 3.1.3 Business results of Agribank - Capital mobilization - Debit balance - Non-credit service collection - Financial results 3.2 Situation of the card issuance and payment of vietnam bank for agriculture and rural development 3.2.1 Advantages and disadvantages 3.2.2 Situation of the card issuance and payment at Agribank - Card issuance operation - Card payment operation 3.3 Status of policies and operational risk management models in card issuance and payment of agribank 3.3.1 Operational risk management policy in card issuance and payment of Agribank - Card operational risk management principles + To achieve the goal of development card services, Agribank accepts card operational risks as part of the matter need to be considered in the card business strategy and commitment to fully implement the card operational risk management activities in accordance with the regulations of the State Bank 16 Determination of goals, risk reserve capital, as well as risk management tools are included in Agribank’s business strategy from time to time + During the implementation process, the Board of Member is responsible for overseeing the process of setting up a framework of card operational risk management and reviewing the overall risk profile of Agribank; The Executive Board is directly responsible for card operational risk management approved by the Board of Member and ensures the proper and appropriate application of types of risk management + The risk management framework must be implemented consistently throughout the whole system and all employees are knowledgeable Each individual employee as well as the management of each unit shall be assigned responsibilities for managing and monitoring card operational risks; The Executive Board and The Board of Member are also responsible for setting out risk management policies, processes, procedures in card service products + Risk profile must be fully updated, controlled and validated independently of the profile establishing department It is also regularly reported to the Board of Member and the Executive Board to take the initiative in the decision-making process + To ensure card risk management activities to be effective, the Internal Control Department regularly assesses the compliance with the card risk management regulations and processes at the units in the system - Card risk management model: there are layers of protection: + First protection layer - subjects that own risks or take 17 direct risks: + Second protection layer - unit of risk control and supervision + Third protection layer - the unit ensures independence from deployed units + Management level supervision: Board of member, the Supervisory Board, the Executive Board , Committee of Risk Management, Board of Risk Handling 3.3.2 Models of the operational risk management in card issuance and payment of Agribank 3.3.3 Process of the operational risk management in card issuance and payment of Agribank - Risk identification - Risk measurement - Risk control and prevention - Handling and financing risks 3.3.4 Results of the operational risk management in card issuance and payment of Agribank - Card risk of Agribank: Risk of fraud, risk related to card acceptance units, risks due to technical problems, risks because bad guys destroy ATMs to take money, risk of special transaction - Handling card risk of Agribank 3.4 Evaluation of the operational risk management in card issuance and payment at Agribank 3.4.1 Survey of the operational risk management in card issuance and payment at Agribank a/ Survey results from customers who use Agribank card: Each bank's card services would bring different benefits for customers, but the security in card services is still the top concern of customers Therefore, customers surveyed said that using 18 BIDV's cards is the safest, second is Agribank’s The above survey result shows that Agribank's card risk management has not really met the requirements of customers b/ Survey results from experts who are knowledgeable about card services: Through the survey, experts said that, in order to limit card operational risk, Agribank needs to have solutions such as: technology investment, strengthening customer information security, building a strict process, raising awareness of employees about card risks, customer perceptions Building and managing a card database to look up, analyze and take effective risk prevention measures, meanwhile information needs to be collected regularly to serve card risk management 3.4.2 Achievements in risk management work of card operation at Agribank Agribank has actively cooperated with International Card Organizations to update information as well as learn experiences, closely monitor card transactions to limit and minimize the card risks that may occur Agribank is also rated by the International Card Organizations to be an effective and active bank in preventing frauds in card business Agribank always closely monitors suspicious card transactions, and also replaces cards that have transactions in high-risk markets The International Card Organizations and Vietnam public security agency have appreciated the close cooperation of Agribank in fighting and preventing fraud card transaction in Viet Nam market Thus, it can be seen that the card risk management 19 activities at Agribank have achieved some positive results 3.4.3 Limitations and causes in risk management work of card operation at Agribank a) Limitations: About organizational model, the process of card risk management, technology, result of risk tackling b) Causes: Relating to organizational model, technology, human, result of risk tackling CONCLUSION OF CHAPTER Postgraduates gave a general overview about Agribank, comprehensive analyse the status of card operational risk management of Agribank Through that to give the assessment of the card operational risk management at Agribank from the author's research situation, from the survey of customers using Agribank card, from expert opinion The author has summarized and pointed out the achieved results, limitations and causes to be the basis for the solutions given in chapter CHAPTER SOLUTIONS TO IMPROVE OPERATIONAL RISK MANAGEMENT IN CARD ISSUANCE AND PAYMENT AT VIETNAM BANK FOR AGRICULTURE AND RURAL DEVELOPMENT 4.1 Orientations, requirements of operational risk management in card issuance and payment at agribank by 2025, vision to 2030 4.1.1 Opportunities and challenges of operational risk management in card issuance and payment at Agribank 4.1.1.1 Opportunities - The legal framework: It is completed step-by-step towards facilitating for development of card services and card operational 20 risk management, expressed through government laws, circulars, decrees, directives, schemes,… - Heighten awareness of people and businesses: 4.1.1.2 Challenges - The impact of the 4.0 technology revolution will create a completely different picture of banking service market in the future - The rapid change of information technology and payment technology has made the software and hardware invested in card operation outdated quickly, causing huge waste of money as banks have to regularly update, changing new technology to keep pace with the trend of the times Risk management and informantion security of banks shall be put on the top in order not to lose money and prestige with partners and customers - The cost invested in upgrading payment technology is very high - The situation of card fraud is increasing, high-tech crime attacking banking business is on the rise and become more sophisticated - Modern banking services contain risks and errors such as account theft, cardholder information leak, - International criminals are flocking to Southeast Asian countries, including Vietnam 4.1.2 Orientations of operational risk management in card issuance and payment at Agribank by 2025, vision to 2030 - By 2020, being in the top of the commercial banks successfully applied Basel II on risk management activities - Establishing mechanisms and creating a process of operational risk management in general, card operational risk management in particular according to Basel II standards, 21 creating favourable conditions for safe and effective development of card operations - By 2020, keep being in Top of leading banks in Vietnam card market; Successfully converting to local card chip standard - Keeping innovating technology, diversifying card service products, developing cards towards safety, security and ensure benefits for cardholders, stakeholders and Agribank - Application of modern technology to improve the efficiency of card system operation - Continuing to maintain the Agribank card brand as a famous and quality brand - Continuing to expand accepting all brand cards of International Card Organizations; 4.1.3 Requirements of operational risk management in card issuance and payment at Agribank Card risk management is a very important issue in the current era of globalization Therefore, card risk management should be built and implemented in accordance with the best international rules and practices Card operational risk management mission at Agribank must be grasp thoroughly from the leaderships to the operational staffs Card risk management is an integral part of risk management in banking business Security in card payment activities includes technology, process and people, in which people including bank staffs, customers and partners of bank are of special interest Agribank needs to link with other banks in the card payment alliance to create a common security system for card payment activities 22 4.2 Solutions to improve operational risk management in card issuance and payment at vietnam bank for agriculture and rural development - Completion of operational risk management models in card issuance and payment - Building quality human resources to meet the requirements of card risk management - Review and completion of card issuance and payment process at Agribank - Upgrade and nvestment in technology - Coordinate closely with law enforcement agencies and national and international card organizations - Development of an early warning system for card operation risks - Perform communication work to customers 4.3 Recommendations 4.3.1 For the Government The Government should soon issue regulations on counts and strict penalty frame in the Criminal Code for types of criminals using fake cards and collusion defrauding of falsifying card transactions 4.3.2 For the State Bank of Vietnam To complete the legal framework on card transactions and payments To complete the infrastructure to accept card payment at the selling places; To complete connection between electronic payment infrastructure of the banking system with the payment infrastructure of partners to manage card risks arising at each stage The State Bank Vietnam should build and complete a credit 23 information system for card activities promtly 4.3.3 For Vietnam Bank Card Association Card Association should provide general regulations for members in providing information and coordinating to prevent fraud and counterfeiting in the card field; Card Association is also a focal point for organizing and researching proposals to limit risks in card business, for working with International Card Organizations in card counterfeiting prevention activities 4.3.4 For some related ministries - For the Ministry of Public Security To cooperate with Agribank to strengthen measures to ensure security and confidentiality; detect, fight, prevent, stop and handle law violations in card issuance and payment, ATM, POS and other high-tech payment methods To work closely with the State Bank Vietnam to have a coordinative mechanism in providing information between banks and investigating agencies, ensuring both confidentiality of information as well as timely criminal investigation - For Ministry of Information and Communications To strengthen communication, promotion, dissemination, guidance and education activities in order to heighten awareness and strengthen the confidence of people, businesses on the benefits and effectiveness of card payment; create radical changes of people on card payments and people's habits of using cards in payment; To step up communication work to people about the benefits of using bank cards Disseminate widely in various and diversified forms, suitable with the characteristics of each target group, each region, especially deep-lying, remote and rural areas To awake the press agencies to tell the truth, reassure people 24 to use bank cards when there are incidents related to the loss of money in the account of customers CONCLUSION - Presenting the content of card operational risk management; The reasons leading to operational risk in card issuance and payment at commercial banks in the context of applying modern technology in banking activities - Providing criteria for evaluating operational risk management results in card issuance and payment of commercial banks - The tools to manage operational risk in card issuance and payment is applied by Agribank, the achieved results, the inadequacies and causes for the management of operational risk in card issuance and payment at Agribank - Proposing solutions and recommendations to perfect the operational risk management in card issuance and payment at Agribank in the situation in which high-tech crime attacking network and ATM system is on the rise and regularly change the manner and method of intrusion LIST OF PUBLISHED WORKS OF THE AUTHOR RELATED TO THE THESIS'S CONTENT Nguyen Thi Thanh Ha and Nguyen Ngoc Son, (2014), “Current status and solutions for Vietnam's exports in the period of 2012 - 2015 - Orientation to 2020”, Journal of Science & Technology, Danang University, No [77]/2014, (P112-116) Nguyen Ngoc Son, (2015), “Card payment activities at Vietnam Bank for Agriculture and Rural Development in Da Nang City”, Journal of Finance and Accounting Studies, No 01 (138) - 2015, (P42-45) Nguyen Ngoc Son, (2016), “Risks in card issuance and payment activities at commercial banks”, Journal of Finance and Accounting Studies, no 04 (153) – 2016, (P4546) Nguyen Ngoc Son, (2019), “Operational risk in card payment at Agribank - Current status and management solutions”, Journal of Finance and Accounting Studies, no 02 (187) – 2019, (P29-32) ... responsible for setting out risk management policies, processes, procedures in card service products + Risk profile must be fully updated, controlled and validated independently of the profile establishing... Supervisors: DR VU XUAN DUNG ASSOC.PROF.DR NGUYEN THI MUI Reviewer 1: ASSOC.PROF.DR VU DUY HAO Reviewer 2: ASSOC.PROF.DR TRAN THANH TU Reviewer 3: ASSOC.PROF.DR DAO MINH PHUC This thesis shall... data are collected from the database of the State Bank of Vietnam, some commercial banks, Agribank, Vietnam Bank Association, Vietnam Bank Card Association, 1.4.2 Data Processing - Primary data: