Bangladesh Bank has introduced a comprehensive cybersecurity framework to strengthen the digital resilience of the country’s financial system.
The framework was issued on Sunday, making compliance mandatory for all scheduled banks, financial institutions, mobile financial service providers, payment service providers, and payment system operators.
All regulated entities must ensure full compliance by December 31, 2026.
Rising cyber threats, including hacking, phishing, and ransomware, drove the move as rapid digitalisation has expanded vulnerabilities across financial platforms.
The framework aims to protect financial stability by ensuring the confidentiality, integrity, and availability of sensitive data.
Built around seven core functions, the system covers preparation, identification, and protection, along with detection, response, recovery, and reporting.
Institutions have been directed to establish clear governance structures, defining roles and responsibilities for cybersecurity management.
Each organisation must appoint a Chief Information Security Officer to lead risk management and oversee implementation.
The policy also requires the formation of a Cyber Incident Response Team to manage cyber risks and take immediate action based on incident severity.
Stricter access controls have been mandated, including multi-factor authentication, centralised authentication, and the principle of least privilege for user access.
Banks and financial institutions must deploy technical safeguards such as network encryption, Domain Name System protection, and secure email protocols.
The framework further requires formal incident response plans and regular security drills.
Any critical cyber incident must be reported to Bangladesh Bank and internal stakeholders within 72 hours.
The central bank has also emphasised regular cyber hygiene training for employees to strengthen awareness and preparedness.
The framework aligns with international and national standards, including ISO 27001, national ICT security policies, and Bangladesh Bank’s ICT security guidelines.
