Bangladesh Bank cybersecurity for banks, finance companies and payment providers
Bangladesh Bank Cybersecurity Framework 2026 and the ICT Security Guideline
What Bangladesh Bank's Cybersecurity Framework, Version 1.0 (2026) asks of banks, finance companies, MFS providers and payment operators by 31 December 2026, how it sits beside the 2023 Guideline on ICT Security, and how to evidence your programme.
In short
Bangladesh Bank sets cyber security and technology risk requirements for the institutions it regulates. Since 2005 the reference point has been its Guideline on ICT Security, now in Version 4.0 (2023). On 29 March 2026 it issued a Cybersecurity Framework, Version 1.0 (2026), often shortened to the Bangladesh Bank CSF, built on the NIST Cybersecurity Framework functions and mandatory for scheduled banks, finance companies, MFS providers, PSPs and PSOs by 31 December 2026. It requires a qualified Chief Information Security Officer with the staff and budget to do the job, and it is a baseline: Bangladesh Bank expects each institution to analyse its own risks and go further where they call for it.
The ICT Security Guideline and the 2026 Cybersecurity Framework
Most security programmes at Bangladeshi banks were built on the Guideline on ICT Security and updated with each version. The 2026 Cybersecurity Framework adds a cyber-specific baseline organised the way NIST organises cybersecurity, and it draws its controls from ISO 27001, the national ICT security policies and Bangladesh Bank's own guidelines. Your policies and audit findings probably refer to the Guideline, so map them to the Framework rather than starting again.
| Instrument | Issued | What it covers |
|---|---|---|
| Guideline on ICT Security, Versions 1.0 to 3.0 | 2005, 2010 and 2015 | ICT security for scheduled banks and, from later versions, non-bank financial institutions |
| Guideline on ICT Security, Version 4.0 | 2023 | ICT governance, risk management, business impact analysis and incident handling for banks, NBFIs, MFS providers, PSPs, PSOs, white label ATM operators and merchant acquirers |
| Guidelines on Cybersecurity Framework, Version 1.0 (2026) | 29 March 2026, full compliance by 31 December 2026 | A mandatory cybersecurity baseline built on the NIST Cybersecurity Framework functions, with CISO, incident response and reporting requirements |
In the sources we checked, Bangladesh Bank does not say the 2026 Framework withdraws the 2023 Guideline. Treat both as in force, and confirm with your supervision team how findings will be assessed against each.
What the 2026 Cybersecurity Framework requires
The Framework follows the NIST Cybersecurity Framework: identifying assets and risks, protecting systems and data, detecting attacks, responding to incidents and recovering from them. Published summaries list six functions but differ on the sixth, so read the function list in the circular. Bangladesh Bank describes the Framework as a baseline and says existing laws prevail where they conflict with it.
The headline requirements that summaries agree on are these.
- A qualified CISO. The institution recruits a qualified Chief Information Security Officer with industry-accepted academic and professional certification, and approves the people and the budget the role needs.
- The CISO leads on incidents. The head of information security or CISO leads the team for every cybersecurity incident.
- Strong authentication. Multi-factor authentication for access to systems and services.
- Monitoring. Real-time monitoring, so that attacks are detected while they are happening rather than found in a later review.
- Incident response and reporting. A structured incident response process, and reporting of critical incidents to Bangladesh Bank.
- Your own risk analysis. The Framework is the minimum. Bangladesh Bank expects institutions to assess their own risks and reach a higher maturity where the risk calls for it.
What the Guideline on ICT Security covers
The Guideline sets out how institutions should manage IT and security risk and what Bangladesh Bank expects to see when it supervises them. Version 4.0 reaches beyond banks to non-bank financial institutions, MFS providers, payment service providers, payment system operators, white label ATM operators and merchant acquirers.
Its aim is to establish ICT governance in the financial sector. It asks for an ICT security unit that runs periodic ICT risk assessments, covering inherent and residual risk, alongside business impact analysis and a process for handling incidents. Those records are the ones an inspection samples, and they are also the starting evidence for the 2026 Framework.
Reporting a cyber incident
The 2026 Framework requires critical incidents to be reported to Bangladesh Bank. Summaries of the Framework report a 72-hour window for reporting critical incidents to Bangladesh Bank and to the national computer incident response team; another commentary says the Framework does not set tightly defined reporting timelines. Take the window and the recipients from the circular itself.
| Recipient | Basis | Window |
|---|---|---|
| Bangladesh Bank | Cybersecurity Framework, Version 1.0 (2026) | Within 72 hours for critical incidents, as reported in summaries; confirm in the circular |
| National CIRT | Cybersecurity Framework, Version 1.0 (2026), as summarised | As above; confirm whether and how the Framework requires it |
| Your board and senior management | Your incident response plan | Set by your own escalation rules |
Whatever the final window, agree in advance how incidents are classified as critical, who makes that call, and who reports to whom. The CISO leads the response, so the reporting route should run through that role.
How Bangladesh Bank requirements relate to NIST CSF, ISO 27001 and PCI DSS
Because the 2026 Framework is built on the NIST Cybersecurity Framework functions and draws its controls from ISO 27001, an institution that already runs ISO 27001 or uses NIST CSF has most of the structure in place. The work is mapping: which existing control answers each Framework requirement, and which requirements are new.
PCI DSS applies wherever card data is stored, processed or transmitted, and banks connected to SWIFT also attest each year against SWIFT's Customer Security Controls Framework. Much of the technical evidence, such as access reviews, patching records, logs and vendor assessments, serves all of them at once.
Getting to the 31 December 2026 deadline
Most institutions already have an ICT security programme built on the Guideline. The work is to map it to the Framework, close what is new and be able to show it.
-
01
Read the circular for your institution
Confirm the Framework applies to your licence, note the function list, the reporting rules and anything specific to your institution type.
Your compliance and legal teams
-
02
Confirm the CISO role
Appoint or confirm a qualified CISO, with approved staff and budget, and record the approval.
Your board and senior management
-
03
Map existing controls
Map the controls, policies and evidence built for the ICT Security Guideline, ISO 27001 or NIST CSF to the Framework requirements.
Your compliance team, in Certifyi
-
04
Close the gaps
Record each requirement you do not yet meet, assign an owner and a date, and track it against the risk register.
Your CISO and risk owners, in Certifyi
-
05
Prepare incident reporting
Agree what counts as a critical incident, who decides, and how reports reach Bangladesh Bank within the required window.
Your CISO and incident response team
Who does what
Bangladesh Bank regulates and inspects. The institution owns its cyber security. Certifyi is software and does not report to Bangladesh Bank or any national CIRT on your behalf.
| Task | Your team | Certifyi | Bangladesh Bank |
|---|---|---|---|
| Governance | A qualified CISO with approved staff and budget; board oversight | Holds policies, the risk register and management review records | Reviews during supervision and inspection |
| Risk assessment | Periodic ICT risk assessments, inherent and residual | Records risks with likelihood, impact, treatment and owner | Reviews during inspection |
| Incident response | A structured process led by the CISO; report critical incidents | Records incidents, severity, owners and follow-up actions | Receives reports |
| Third parties | Assess and oversee technology vendors | Records vendor intake and risk assessments | Reviews arrangements |
| Audit | Independent assurance over controls | Opens the evidence to auditors through scoped, read-only access | Considers audit results |
How Certifyi helps
Run the Bangladesh Bank programme on one control set
Bangladesh Bank's Framework and Guideline are not in Certifyi's published framework catalogue today. Certifyi holds the controls, evidence, risks, vendors and incidents they ask about, alongside the frameworks they draw on.
-
NIST CSF 2.0 and ISO 27001 in the catalogue
The two frameworks the 2026 Framework is built on are in the catalogue. In the unified frameworks module you map a control once and reuse it for ISO 27001, NIST CSF and PCI DSS, which does most of the groundwork for mapping to Bangladesh Bank's requirements.
-
Risk register
Record ICT and cyber risks with likelihood, impact, treatment and owner, on a heatmap, linked to the controls that treat them.
-
Incident records
Log each incident in the incident module with its severity, owner and follow-up actions, from first report to closure. Certifyi records the incident; your team makes the reports.
-
Technology vendors
Run vendor intake and risk assessments in third-party risk. Vendors answer through their own portal rather than by email.
-
Vulnerabilities matched to assets
The vulnerability register matches your assets against the NVD and records each vulnerability as a risk.
-
Auditor and inspector access
Give auditors scoped, read-only access to the evidence for their engagement. When an inspection team asks who added or changed a piece of evidence, and when, the tamper-evident activity log shows it.
Sources
Where these facts come from
- Bangladesh Bank: Guideline on ICT Security, Version 4.0 (2023) Primary source
- Bangladesh Bank: Regulations and guidelines, listing the Guidelines on Cybersecurity Framework, Version 1.0 (2026) Primary source
- Bangladesh Bank: Guideline on ICT Security for Banks and Non-Bank Financial Institutions, Version 3.0 Primary source
- UNB: BB unveils new Cybersecurity Framework to safeguard financial sector Secondary source
- The Financial Express: Bangladesh Bank's 2026 Cybersecurity Framework and road to resilience Secondary source
- Regulation Asia: Bangladesh sets 2026 deadline for new cybersecurity framework Secondary source
- Bangladesh Pratidin: Bangladesh Bank issues uniform cyber security framework for financial sector Secondary source
Questions
Bangladesh Bank cybersecurity, answered
What is the Bangladesh Bank Cybersecurity Framework (CSF)?
The Guidelines on Cybersecurity Framework, Version 1.0 (2026), issued by Bangladesh Bank on 29 March 2026. It sets a mandatory cybersecurity baseline, built on the NIST Cybersecurity Framework functions, for scheduled banks, finance companies, MFS providers, PSPs and PSOs.
Is the Bangladesh Bank Cybersecurity Framework mandatory?
Yes. It is mandatory for scheduled banks, finance companies, MFS providers, payment service providers and payment system operators.
When must banks comply with the Bangladesh Bank Cybersecurity Framework?
Bangladesh Bank's circular requires full compliance by 31 December 2026.
How does the Bangladesh Bank CSF relate to NIST CSF 2.0?
It is built on the NIST Cybersecurity Framework functions and draws its controls from ISO 27001, national ICT security policies and Bangladesh Bank's own guidelines. An institution that already uses NIST CSF 2.0 or runs ISO 27001 can map its existing controls to the Bangladesh Bank requirements instead of starting again.
Who helps institutions implement the framework?
Bangladesh Bank's ICT Audit, Inspection and Compliance Wing is named as supporting institutions during implementation. Raise interpretation questions with it early, given the 31 December 2026 deadline.
Does the 2026 Framework replace the ICT Security Guideline?
The sources we checked do not say so. The Guideline on ICT Security, Version 4.0 (2023), covers ICT governance and risk more broadly, and the Framework adds a cybersecurity baseline. Treat both as in force and confirm with your supervision team.
What does the Framework say about the CISO?
The institution must recruit a qualified CISO with industry-accepted academic and professional certification, and approve the staff and budget the role needs. The CISO or head of information security leads the team for cybersecurity incidents.
How quickly must a cyber incident be reported to Bangladesh Bank?
Summaries of the 2026 Framework report 72 hours for critical incidents, to Bangladesh Bank and the national CIRT; another commentary says timelines are not tightly defined. Take the window from the circular and agree your classification and reporting route in advance.
Who does the ICT Security Guideline apply to?
Version 4.0 applies to banks, non-bank financial institutions, MFS providers, payment service providers, payment system operators, white label ATM operators and merchant acquirers, among other regulated providers.
Is there a Bangladesh Bank cybersecurity certificate?
No. Bangladesh Bank regulates and inspects. Independent audit over controls supports the programme, but there is no certificate to hold.
Does Certifyi make us compliant with Bangladesh Bank requirements?
No. Compliance depends on your governance, controls and reporting. Bangladesh Bank's requirements are not in Certifyi's catalogue today; Certifyi is where you map your controls to them, keep the evidence and track the gaps.
Map your Bangladesh Bank programme in a 30-minute call.
Bring your current ICT security policy or your last inspection findings. We can look at how they line up with the ISO 27001 and NIST CSF controls you already run, and where the Framework's new requirements, your vendors and your incident records would sit in Certifyi.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them