Getting structured data out of Agribank Plus, the authorized way

Vietnam's central bank set 1 March 2025 as the day its Open API rules took effect, and Agribank Plus sits squarely inside their scope. The app is the retail banking front end built by VNPAY for the Vietnam Bank for Agriculture and Rural Development, and behind a single login it holds the records most integrators actually want: account balances, dated statements, transfers, online savings, loan repayment schedules, and a long tail of bill and QR payment history. The data is real and structured. The question is the route, and right now Vietnam gives you two honest ones running in parallel.

Our read: for teams that need data this quarter, authorized protocol analysis of a consenting Agribank account is the practical path, and the move to the State Bank's consent API is made the moment Agribank's account-information phase is published. That switch is a configuration change in what we build, not a second project.

What Circular 64 changes for an Agribank integration

Circular 64/2024/TT-NHNN was issued on 31 December 2024 and took effect on 1 March 2025 (per the State Bank of Vietnam press release). It is the first regulation to put a real consent framework around bank data sharing in Vietnam, and it names the standards a build has to meet: OAuth 2.0 with OpenID Connect for authorization, TLS 1.2 or higher in transit, and JSON over REST, with ISO 20022 and ISO 8583 compatibility on the message side. Customer consent is the hinge of the whole thing.

The rollout is phased, and that detail shapes timing more than anything else. Information queries come first, consent-based account information lands around the 18-month mark, and payment initiation at 24 months, with banks expected to file API catalogs by mid-2025 and reach full compliance by 1 March 2027 (per Brankas's Circular 64 analysis). For an Agribank statement or balance read, the relevant phase is the consent-based account-information services layer. Until Agribank publishes that layer, the consented-account route below carries the same data under the customer's own authorization.

What sits behind an Agribank Plus login

These are the surfaces the app exposes to a logged-in user, mapped to what an integrator does with each. Domains and field names follow how the app describes them in its store listing.

Routes into the account data

Three approaches genuinely apply to Agribank Plus. Each is described by what it reaches, how much it takes to stand up, and how it holds up over time.

1. SBV consent API under Circular 64

The regulated account-information path. Reaches balances, statements and standing data through OAuth 2.0 with explicit, revocable customer consent. Highest durability once Agribank's account-information phase is live, because it is the route the regulator is steering every covered bank toward. Effort on our side is the consent-handshake and token lifecycle plumbing; we arrange the onboarding and any sandbox access with you as part of the engagement.

2. Authorized protocol analysis of a consenting account

We observe and reimplement the app's own traffic against an account whose holder has authorized the work. Reaches everything the app shows the user, including surfaces the consent API has not yet phased in. Moderate durability: the client front end changes periodically, so we keep a re-check step in maintenance. This is the route that delivers data now.

3. User-consented credential access plus native export

Where a workflow only needs periodic statements, we drive the app's own free statement inquiry under the user's consent and normalize the output. Lightest to run, narrowest in scope, useful as a backfill alongside either route above.

A statement read, sketched

Illustrative shapes only; exact paths, headers and error codes are confirmed during the build against the live interface. The pattern is an OAuth 2.0 consent grant followed by a dated statement query, with consent re-validation on expiry.

# 1) Consent-grant exchange (OAuth 2.0 / OpenID Connect, per Circular 64)
POST /openapi/v1/oauth2/token
  grant_type=authorization_code
  code=<consent_code>  client_id=<id>  ...
  -> 200 { access_token, refresh_token, expires_in: 1800, consent_id }

# 2) Dated statement query for one account
GET /openapi/v1/accounts/{acctId}/transactions?fromDate=2026-05-01&toDate=2026-05-31
  Authorization: Bearer <access_token>
  X-Consent-Id: <consent_id>
  -> 200 {
       account: "VCBA…",  currency: "VND",
       transactions: [
         { txnId, postingDate, amount: 250000,   // integer VND, no minor units
           drCr: "D", counterparty, vietqrRef, balanceAfter }
       ]
     }
  -> 401 { error: "consent_expired" }   // re-run the consent handshake; AIS consent is time-boxed
      

Amounts stay integer VND end to end. The VietQR reference is preserved so a downstream ledger can match a transfer to its QR origin.

What you get at handover

Everything below is built around the surfaces in the table above, not a generic kit.

• An OpenAPI/Swagger spec covering the account, statement, transfer, savings and loan endpoints we implement for you.
• A protocol and auth-flow report: the OAuth 2.0 consent grant, token refresh, and the consent-id lifecycle as they behave for this app.
• Runnable source for the key reads in Python or Node.js, with VND amount handling and VietQR reference mapping already wired in.
• Automated tests against representative responses, including the consent-expiry path.
• Interface documentation an engineer who has never seen the app can follow.
• Compliance and data-retention guidance fitted to Circular 64 consent records and Vietnam's data rules.

Engineering notes specific to this app

Concrete things we account for so the integration behaves on the first run.

• VND has no decimals. We model every amount as an integer dong and keep the VietQR and VNPAY-QR reference fields intact, so reconciliation against a counterparty ledger matches to the unit.
• Signing path stays separate. The app authorizes transactions with Soft OTP and Face ID. We design the flow so a read-only statement or balance sync never crosses into the transaction-signing path; the read integration cannot move money.
• The app is a super-app. Alongside banking it bundles flight, train, bus, boat, hotel, taxi and cinema booking plus VnShop through VNPAY partners. We scope the build to the banking surfaces you ask for and leave the merchant catalog out unless it is part of the brief.
• Phase-aware sequencing. Because Circular 64 phases account-information and payment-initiation differently, we ship the reads against what is live now and stage anything that depends on a later phase, and we design the sync around the consent-refresh window so it does not silently lapse.

Where teams plug this in

• An accounting platform syncing Agribank VND statements into ledgers for its SME clients, end of every business day.
• A treasury dashboard pulling balances across the Big Four banks, Agribank among them, into one cash view.
• A lender reading consented statement history to underwrite cash flow for rural and farm borrowers.
• A reconciliation engine matching VietQR and VNPAY-QR settlement records back to merchant payouts.

Screens from the listing

Store screenshots, useful for seeing the surfaces named above. Tap to enlarge.

The Vietnamese banking-app neighbourhood

A unified integration usually spans several of these. Each holds comparable account data and falls under the same Circular 64 regime, so the same consent-and-normalize approach generalizes.

• VCB Digibank (Vietcombank) — accounts, transfers and card management for one of the Big Four state banks.
• BIDV SmartBanking — balance inquiry, intra- and interbank transfers, and bill payment.
• VietinBank iPay — transfers, account inquiries and a broad bill-payment catalog.
• MB Bank — personal and SME banking, consistently near the top of the finance charts.
• Techcombank Mobile — no-fee accounts and money-management tools.
• TPBank — app-first retail banking with strong digital onboarding.
• VPBank NEO — account, savings, card, loan and bill management in one app.
• Timo — a digital-only bank launched in partnership with a commercial bank.
• MoMo — the largest e-wallet, with peer transfers, bill pay, insurance and investment records.
• ZaloPay — wallet built into Vietnam's main messaging app, strong on social transfers.

What was checked, and when

In June 2026 we reviewed the Agribank Plus store listing for its feature surfaces and currency handling, and read the State Bank of Vietnam's own notice plus two independent explainers for the Circular 64 standards, consent model and phased timeline. Where a fact was not publicly disclosed, it is not asserted here.

• Agribank Plus on Google Play
• SBV press release on Circular 64/2024/TT-NHNN
• Brankas: how Circular 64 reshapes open banking in Vietnam
• WSO2: Vietnam's move into open banking

Mapped by the OpenBanking Studio integration desk · June 2026.

Questions integrators ask about Agribank Plus

Does Circular 64 mean Agribank Plus data is reachable through a consent API right now?

Not uniformly yet. Circular 64/2024/TT-NHNN took effect on 1 March 2025 and phases the work in: information queries first, consent-based account information at the 18-month mark, and payment initiation at 24 months, with full compliance set for 1 March 2027. Agribank, as a covered bank, falls under it. We build account and statement reads against what is live now and stage the consent-API switch for when Agribank's AIS phase lands.

What identifies a single transaction once it is pulled from Agribank Plus?

A normalized record carries a transaction id, the posting date, the amount in integer VND, a debit or credit flag, the counterparty, the running balance after the entry, and the VietQR or VNPAY-QR reference where one exists. The dong has no minor units, so we model amounts as whole integers to keep reconciliation exact.

Can read-only statement access be kept apart from the Soft OTP transfer path?

Yes. The app uses Soft OTP and Face ID to authorize transactions. We design the consent and auth flow so a statement or balance sync never touches the transaction-signing path; read scopes and any initiation scope are separated end to end, and the read integration cannot move money.

If Agribank's AIS phase is not live yet, can you still build the integration now?

Yes. We run the build against authorized protocol analysis of a consenting account and the information-query surfaces already available, then switch the same client to the State Bank of Vietnam consent API once Agribank's AIS phase is published. That switch is a configuration change in what we ship, not a rewrite.

Source code for the Agribank Plus endpoints you need lands in one to two weeks, and you pay from $300 only after it is delivered and you are satisfied. If you would rather not run anything yourself, the same integration is available as a hosted API you call and pay for per request, with nothing upfront. Tell us the app name and what you want from its data at /contact.html and we handle access, consent and the rest with you.