There is no single open banking statute equivalent to the regimes in the UK or EU. Instead, open banking style arrangements in Bangladesh are shaped by Bangladesh Bank's directions on banking, payments, outsourcing and ICT security, the Payment and Settlement Systems Act 2024 where payments are involved, and the Personal Data Protection Act 2026 for customer data. Bangladesh Bank continues to issue guidance on digital finance, so we check the current position for each product and build regulatory change provisions into the agreement so it can adapt without full renegotiation. We revisit this as new guidance is issued.

It can, but only within limits. Banks owe customers duties of confidentiality and must comply with data protection law and Bangladesh Bank expectations. Sharing usually depends on clear customer consent or another lawful basis, a defined purpose and adequate security at the receiving end. The open banking agreement should restrict what the fintech may do with the data, prohibit onward sharing without permission, require deletion when consent ends and give the bank audit rights. We review the data fields and use cases before advising on the right structure and consent wording. Clear deletion records also help in later disputes.

Liability should track control and fault. If the bank's interface goes down, the bank should usually bear responsibility under agreed service levels; if a fintech's systems are compromised, the fintech should bear the consequences. Shared incidents need a process for investigation, customer communication and allocation of losses once the cause is known. We draft indemnities, caps and carve-outs that reflect this, with specific provisions for regulatory fines, customer refunds and third-party claims, so open banking partners are not left arguing about responsibility while customers wait for answers. Customer refunds should not wait for that allocation.

Usually the marketplace does not need its own licence if a licensed bank or financial institution makes the loan and the marketplace only refers or displays the product. Problems arise when the platform starts setting credit terms, collecting repayments or holding funds, which may amount to regulated activity. We review the customer journey, the flow of money and the marketing materials, then structure the embedded finance arrangement so the licensed lender keeps the regulated functions and the platform's role is clearly documented in the agreement and in customer-facing terms. We also review the platform's marketing language.

Consent should be specific, informed and easy to withdraw. In practice that means a clear screen showing which party will access which data, for what purpose and for how long, recorded in a way that can be evidenced later. The Personal Data Protection Act 2026 adds formal requirements that consent wording and records must meet. We draft consent language, privacy notices and record-keeping obligations for open banking journeys, and include contractual duties to update them when the product changes, so consent stays valid as features evolve after launch. Consent records should be retained for the agreed period.

Possibly, depending on the data, the regulated status of the parties and the transfer rules in the Personal Data Protection Act 2026. Banks may also face Bangladesh Bank expectations on where certain records and systems are hosted. A foreign fintech using regional cloud infrastructure should expect the bank to ask for detailed hosting information, security certifications and audit rights. We map the data flows and advise on transfer mechanisms, localisation questions and the contractual protections needed before any data leaves the country, coordinating with overseas counsel where group entities are involved. Transfer terms should be reviewed periodically.

Models vary: per-call fees, monthly access fees, revenue shares on loans or payments, or free access in exchange for distribution. Where a foreign party is paid, foreign exchange documentation and withholding tax become relevant, and payments for data or technology may be characterised differently for tax purposes. We draft fee mechanics, invoicing, audit and set-off provisions, and coordinate with tax advisers so the open banking commercial model can be implemented and remitted lawfully. We also address price changes, most-favoured terms and any exclusivity requested by either side. Fee changes should require advance written notice.

The agreement should allow immediate suspension for security threats or regulatory instructions, with a defined process for restoring access once the issue is fixed. On exit, it should set out notice periods, customer communications, data return or deletion, continuing confidentiality and cooperation with any replacement provider. For embedded finance products, outstanding loans, wallets or policies must be serviced until they end or are transferred. We draft these provisions so exit does not harm customers or expose either party to regulatory criticism, and so disputes can be resolved through our dispute resolution team if needed.