Bangladesh Banking Regulations: A Practical 2026 Guide

Bangladesh banking regulations are not a single rulebook. They are a layered system of legislation, Bangladesh Bank directions, supervisory expectations and sector-specific operating rules. The result matters to more than banks. A lender, foreign investor, payment business, borrower, outsourcing provider or prospective acquirer can all be affected by the regulatory perimeter and by the terms on which a regulated institution may act.

This guide explains the framework as at 19 October 2026. It focuses on the practical questions that recur in a commercial context: when a Bangladesh Bank licence is needed; what directors and senior management must organise; why credit, AML/CFT and foreign-exchange controls have to work together; and what the 2026 resolution and deposit-protection reforms mean. It is deliberately careful about areas where the operative position depends on a current circular, implementing instrument or a transaction’s facts.

Summary

• A bank’s core legal framework includes the Bangladesh Bank Order, 1972 and the Bank Company Act, 1991, which Bangladesh Bank’s current legislation index identifies as amended up to 2023.[1] [2]
• The statutes sit alongside binding and supervisory instruments issued by Bangladesh Bank. Those materials cover licensing, capital and risk, lending, internal control, financial crime, foreign exchange, payment services and digital delivery.[3]
• Running a financial business is not the same as being a bank. A conventional bank, digital bank, finance company, mobile-financial-service provider, payment service provider and payment system operator can have different authorisation routes and ongoing obligations.[3] [9] [10]
• The Bank Resolution Act, 2026 and the Deposit Protection Act, 2026 are material additions to the framework. They should be assessed alongside, not substituted for, continuing prudential, governance and conduct duties.[1] [11] [12]
• For a live project, the starting point should be a scope-and-authorisation analysis, then a current circular review. Numbers, deadlines and approvals should not be taken from an old checklist without checking the latest primary materials.

Table of contents

Banking regulations: start with the legal hierarchy

The first practical distinction is between statutory law and regulatory material. The distinction is not academic. It determines the source of a duty, its legal basis, whether it applies to a particular firm, and how a conflict should be addressed.

Statutes and legal authority

The Bangladesh Bank Order, 1972 established the central bank to manage Bangladesh’s monetary and credit system. Its published text describes objectives including stabilising domestic monetary value and maintaining a competitive external value of the taka while fostering growth and development.[2] The Order is the central institutional foundation, but it does not answer every operational question faced by a bank or market participant.

For banking companies, the Bank Company Act, 1991 is the principal company-specific statute. Bangladesh Bank’s current laws index lists it as amended up to 2023.[1] Among other things, the Act is the key statutory reference point for licensing and Bangladesh Bank’s powers to issue directions in the banking sector. The regulator’s published establishment guidance states that no company may carry on banking business in Bangladesh without a licence from Bangladesh Bank under section 31 of the Act.[4]

Other legislation may become central depending on the activity. Bangladesh Bank’s official index currently identifies, among other materials, the Financial Institutions Act, 1993; the Foreign Exchange Regulation Act, 1947 and its amendment; the Money Laundering Prevention Act, 2012; the Payment and Settlement System Act, 2024; the Offshore Banking Act, 2024; the Secured Transactions (Movable Property) Act, 2023; the Bank Resolution Act, 2026; and the Bank Deposit Insurance Act, 2000.[1] The list is useful as a map, not a substitute for reading the applicable text and later amendments.

A statutory analysis should therefore begin with four questions:

1. What is the proposed activity? Taking deposits, extending credit, arranging payments, running a platform, dealing in foreign exchange, offering wallet functionality and outsourcing a material operational function are not interchangeable descriptions.
2. Which entity will perform it? The answer may differ for a local company, a foreign bank branch, a group affiliate, a bank subsidiary or an external technology provider.
3. What permission, restriction or reporting power is engaged? A corporate registration alone is not banking permission.
4. Which current directions implement the legal obligation? The precise operational burden often appears in a Bangladesh Bank circular, regulation or guideline.

Regulations, circulars and guidelines

Bangladesh Bank publishes a substantial body of regulations and guidance under topic headings including scheduled banks, core risk management, AML, foreign exchange, payments, digital banks and customer service.[3] In this article, “guidance” should not be read as a suggestion that can safely be ignored. Some documents labelled guidelines are issued under statutory powers or are incorporated into a licence condition, direction or supervisory programme. They can therefore be operationally mandatory for the entities within their scope.

At the same time, a document’s title does not settle its legal effect. A business should check its enabling provision, stated application, date of effect, amendments and any later circular. For example, Bangladesh Bank’s loan-classification master circular says it is issued under section 49(1)(Cha) of the Bank Company Act and takes effect from 1 April 2025.[5] That is different from a consultation draft or from a document framed as good practice for a sector not covered by it.

Where a statute and a subordinate instrument pull in different directions, the statute normally prevails within the legal hierarchy. Bangladesh Bank’s 2025 resolution regulations expressly state that the Ordinance prevails in the event of inconsistency.[11] Since the Bank Resolution Act, 2026 was subsequently published in the official Gazette, current transaction work should identify the Act and any post-Act regulations or circulars rather than assume that every Ordinance-era provision or explanation continues unchanged.[1] [12]

Why a live-source check is essential

Bangladesh Bank’s current regulatory index lists both long-standing and new material, including a March 2026 e-KYC guideline, a 2026 cybersecurity framework, a 2026 partner-network guideline, and the Deposit Protection Act, 2026.[3] That tells a compliance team where to investigate. It does not prove the scope, transition period or detailed control standard for a particular product.

For this reason, a compliance memorandum, launch plan or financing condition precedent should retain the official URL and date checked for each proposition. It should also distinguish: (a) legislation; (b) a final, applicable Bangladesh Bank instrument; (c) a draft or proposal; and (d) an internal policy response. That discipline reduces the risk of relying on an attractive but obsolete summary.

Who regulates banking and connected activities?

Bangladesh Bank

Bangladesh Bank is the central bank and the main banking regulator. Its official material reflects a broad role: it maintains the legal and regulatory framework, issues directions and operates through specialist departments responsible for banking policy, supervision, payments, foreign exchange, financial stability and resolution.[1] [3]

For a banking company, the regulator is not only a gatekeeper at the licensing stage. It expects continuing reporting, risk management, internal controls and responsiveness to inspection or supervisory engagement. In practice, regulatory questions should be tested against the business model early, before capital is committed, contracts are signed or customer journeys are built.

Bangladesh Financial Intelligence Unit

The Bangladesh Financial Intelligence Unit (BFIU) is a separate unit within Bangladesh Bank for the purposes of the Money Laundering Prevention Act, 2012.[7] The Act gives Bangladesh Bank powers to analyse cash and suspicious-transaction information, request information, issue directions, monitor compliance and conduct on-site inspections; it also provides for BFIU’s establishment.[7]

This matters because financial-crime governance is not merely a front-office account-opening issue. It affects product design, transaction monitoring, escalation, records, outsourcing, management information and how a board receives assurance. BFIU’s 2024–25 annual report says its supervisory programme is risk-based and uses on-site inspection, off-site review and intelligence to update risk assessments.[8]

Payment Systems Department and the authorisation perimeter

Bangladesh Bank’s Payment Systems Department covers regulation, policy, licensing and oversight for payment systems. The Department describes itself as responsible for, among other things, mobile financial services, payment service providers (PSPs), payment system operators (PSOs) and regulatory fintech facilitation.[10]

The difference between a PSP and a PSO is commercially important. Bangladesh Bank explains that a PSP facilitates payments or payment processes directly for customers and settles transactions through a scheduled bank or financial institution. A PSO operates a settlement system between or among participants, where the principal participant must be a scheduled bank or financial institution.[10] The categorisation depends on what the business actually does, not the label used in its marketing materials.

Other authorities and legal regimes

Bangladesh Bank is not the only authority that may matter. Corporate formation, tax, data, consumer, competition, sectoral licences, securities activity, land security, insolvency, court process and contractual enforcement can each involve different legal frameworks or public bodies. A bank’s regulatory status should not be used as shorthand for clearance under every other law.

The same point applies to finance companies. Bangladesh Bank’s legislation index separately lists the Finance Company Act, 2023 and the Financial Institutions Act, 1993.[1] A project that is viable as a finance-company or payment-business proposition may not be permitted as a bank, and vice versa. Regulatory perimeter analysis must precede entity selection and product launch.

Licensing and market entry

A bank licence is a substantive regulatory decision

The published guidelines for establishing a banking company state that Bangladesh Bank decides whether to grant a licence after considering the need for the bank and whether the proposal fits the country’s overall monetary and financial-sector policy.[4] The licence process is therefore not a mechanical company-registration exercise.

Those guidelines say a new commercial bank must be a public limited company incorporated in Bangladesh, and they set out expectations on capital, sponsors, fit-and-proper assessment, governance, management and the supporting application package.[4] They require a feasibility report, business plan, projections and sensitivity analysis, alongside detailed information concerning sponsors, proposed leadership and control functions.[4]

The same published document includes a stated BDT 400 crore paid-up-capital requirement for the banks contemplated by that document.[4] It is an important historical and regulatory reference point, but it should not be treated as a stand-alone, permanent answer for every applicant. Capital requirements can be affected by the current legal framework, category of bank, Bangladesh Bank directions and the terms of an approval. A prospective applicant should obtain and document the current written position from the regulator rather than rely only on a general web guideline.

Sponsors, ownership and governance are part of the application

The establishment guidance links admission to the quality and source of capital. It calls for capital contributed in liquid, unencumbered form and subject to Bangladesh Bank verification and lien, and it contemplates fit-and-proper review of sponsors and proposed directors.[4] It also addresses matters such as ownership concentration, capital-maintenance commitments, sponsor eligibility and conflicts.

For investors, this has several practical consequences. Source-of-funds evidence, tax and legal-status diligence, shareholder arrangements and the credibility of projected management cannot be deferred until after the incorporation paperwork. They are integral to a credible regulatory case. A group should ensure that its shareholder agreement, governance documents, business plan, technology arrangements and funding timetable tell the same story.

Digital-bank entry is not an unregulated shortcut

Bangladesh Bank’s version 2 Guidelines to Establish Digital Bank treat a digital bank as a distinct classification while retaining core regulatory discipline. The guidelines state that a digital bank must obtain a licence under section 31 of the Bank Company Act and comply with the Payment and Settlement Systems Act, 2024, Bangladesh Bank directives, circulars and prudential regulations.[9]

A digital bank is to be a public limited company licensed under section 31. The version 2 guideline states a minimum paid-up capital of BDT 300 crore, subject to Bangladesh Bank’s power under section 13 of the Bank Company Act, and requires the initial capital to be provided by sponsors.[9] It also requires detailed feasibility, business, ICT and business-resolution plans as part of the application material.[9]

The commercial lesson is simple: digital delivery changes the control environment; it does not remove it. The guideline says digital banks face the same categories of risk identified in Bangladesh Bank’s risk-management framework and are expected to maintain effective governance and risk management, including the corporate-governance standards applicable to conventional banks.[9] KYC design, transaction limits, technology security and two-factor authentication are among the matters Bangladesh Bank may review before licensing.[9]

A practical entry workstream

A disciplined market-entry process usually has five connected workstreams:

1. Classify the activity and entity. Determine whether the proposition is banking, a digital bank, finance-company activity, a PSP/PSO service, mobile financial services, agent banking, outsourced technology or a combination.
2. Map approvals and dependencies. Include Bangladesh Bank permissions, foreign-exchange considerations, group approvals, company-law steps and any sector-specific permissions.
3. Build the evidence pack. Align the feasibility study, financial model, capital plan, source-of-funds dossier, governance structure, management biographies, risk framework and ICT architecture.
4. Design the target operating model. Document accountability for credit, treasury, AML/CFT, technology, security, internal audit, complaints and regulatory reporting before the application represents those functions as ready.
5. Control communications. Do not describe a business as licensed, authorised or bank-like in customer or investor materials before the relevant authority and licence conditions support that statement.

Prudential management: capital, credit, governance and controls

Capital is a risk-management process, not only a ratio

Bangladesh Bank’s risk-based capital adequacy framework applies to scheduled banks on both solo and consolidated bases in the circumstances stated in the framework.[6] It is structured around minimum capital for credit, market and operational risk; an internal process to assess capital adequacy against the bank’s risk profile and capital plan; and public disclosure of capital, risk and risk-management information.[6]

The framework’s supervisory-review section places responsibility on bank management to assess capital in relation to the risk profile and to maintain a strategy for adequate capital. It also makes clear that capital is not a substitute for sound risk management and internal control.[6] This is a useful corrective to a common misconception: satisfying a minimum number at one reporting date does not, by itself, establish prudent management.

A bank’s board and senior management should therefore ask whether the capital plan captures concentrations, connected exposures, liquidity stress, foreign-exchange exposures, operational disruption and business-model change. The precise ratio, buffer, measurement basis and reporting frequency must be checked against current applicable Bangladesh Bank materials. This guide intentionally does not state a single universal capital percentage because an unverified or superseded figure could mislead.

Credit classification and provisioning affect lending decisions

Bangladesh Bank’s November 2024 master circular on loan classification and provisioning came into force on 1 April 2025.[5] It groups loans and advances into four categories for classification purposes: continuous loans, demand loans, fixed-term loans and short-term agricultural credit.[5]

The circular requires classification using both objective delinquency criteria and qualitative judgment, with the final classification being the worse result. It identifies the unclassified categories as Standard-0, Standard-1, Standard-2 and Special Mention Account, and classified categories as Sub-Standard, Doubtful and Bad/Loss. Sub-Standard, Doubtful and Bad/Loss are treated as non-performing loans under the circular.[5]

The published objective timetable is consequential: for all loan categories, a loan is Sub-Standard when past due or overdue for at least three months but less than six; Doubtful at least six but less than 12 months; and Bad/Loss at 12 months or more.[5] Qualitative factors can also require a lower classification where repayment is unlikely or there are serious weaknesses in the borrower or bank’s file and controls.[5]

The circular specifies minimum provisioning rates of 1% for Standard-0, Standard-1 and Standard-2 exposures, 5% for SMA, 20% for Sub-Standard, 50% for Doubtful and 100% for Bad/Loss, subject to its prescribed provisioning base and collateral treatment.[5] It says those are absolute minimums and encourages continuing assessment of adequacy. It also introduces an IFRS 9 expected-credit-loss implementation plan by 2027.[5]

For lenders, the implication is that underwriting, security perfection, valuation, file maintenance, covenant monitoring, rescheduling and recovery strategy are prudential issues as well as commercial ones. For borrowers, transparent information, realistic cash-flow forecasts, promptly documented amendments and timely engagement with the lender may affect the quality of the credit file. They do not guarantee a particular classification outcome.

Governance needs clear accountability and challenge

Bangladesh Bank’s internal-control-and-compliance guidelines place responsibility on the board for establishing effective internal control and risk management appropriate to the bank’s complexity, size, scope and risk profile. They call for an internal audit process that is independent from management and reports to the audit committee.[13]

The same guidelines say the board should review audit-committee reports quarterly in relation to recommendations from internal and external audits and Bangladesh Bank inspection reports. They also require a board-approved compliance policy and contemplate a compliance unit with separate status, access to information and the ability to report findings freely to the audit committee or board.[13]

These statements have practical design implications. A board pack should not simply report that a policy exists. It should show who owns an issue, whether there is a breach or overdue remediation, whether a control has been tested independently and whether a risk acceptance has been recorded at the right level. Independence can be undermined where a compliance or audit function depends on a revenue owner for scope, staffing or escalation.

Records, reporting and audit trails

Prudential obligations become enforceable in operational reality through reliable records. The loan-classification circular requires quarterly classification activity, written justification for each individual loan classification, and retention of documentation for Bangladesh Bank inspection. It requires head-office scrutiny and consolidated reporting, including specified returns to Bangladesh Bank.[5]

A defensible control environment therefore needs more than a policy library. It needs data lineage, approval records, evidence of exception decisions, current collateral documentation, access controls, issue tracking and testing that traces a regulatory requirement to a real process. This is particularly important when a bank uses group systems, cloud services, agents or outsourced operations.

AML/CFT, sanctions and customer due diligence

The statutory baseline

Section 25 of the Money Laundering Prevention Act, 2012 requires reporting organisations to maintain complete and correct information about customer identity during account operation, retain transaction records for at least five years after an account closes, provide maintained information to Bangladesh Bank when required and report a suspicious transaction or attempted suspicious transaction immediately on their own initiative.[7]

The statute also gives Bangladesh Bank powers to seek information, issue directions, monitor compliance and inspect reporting organisations. The Act provides for financial penalties and, in defined circumstances, suspension or cancellation of a licence or authorisation for failures to meet relevant duties.[7] The exact sanction analysis is fact-specific and should be made against the current statutory text and procedural context.

Customer due diligence is an ongoing control

Bangladesh Bank’s published AML/CFT guideline explains that identity verification is foundational. It refers to section 25(1)(a) and says a business relationship should not proceed unless complete and correct identity information is obtained in good time.[14] It also addresses beneficial ownership, non-face-to-face verification, politically exposed persons, enhanced due diligence, sanctions and the review and update of customer information.[14]

The operational point is that KYC is not completed merely by collecting an identity document. A bank must be able to understand the person or legal entity behind the relationship, the authority of those operating the account, the anticipated purpose and activity, and the circumstances that should trigger escalation. The level of due diligence must be proportionate to risk and must be connected to monitoring.

A bank or fintech should test its customer journey against difficult cases before launch: a company with a multi-layer ownership chain; a trust or nominee structure; a remotely onboarded customer; a politically exposed person; a customer acting through a representative; and a trade-related transaction that is inconsistent with known business. A rule that cannot be applied at scale in the actual system is not an effective control.

Monitoring, reporting and confidentiality of escalation

The AML/CFT guideline describes suspicious-transaction reports and suspicious-activity reports as part of the reporting process and requires staff awareness and regular training. It also expects records to be retained, including account-opening, identity, transaction, beneficial-ownership and suspicious-report records.[14]

BFIU’s 2024–25 annual report confirms that its supervisory work is risk-based. It says supervision considers sectoral, customer, geographic, delivery-channel and product/service risks, and draws on national, sector-specific and enterprise-level risk assessments.[8] In a commercial setting, a risk assessment should be specific enough to influence controls: customer acceptance rules, product settings, alert scenarios, investigation capacity and board reporting.

Where a potential suspicious transaction is identified, staff should follow the institution’s established escalation and reporting process. They should not improvise communications with the customer or counterparties. Whether an external report is required, how it is made and what information may be disclosed are matters for the statute, the current BFIU requirements and the institution’s approved procedures.

Financial-crime controls in a transaction

A borrower, investor or supplier interacting with a bank can reduce avoidable friction by preparing a clear ownership chart, source-of-funds or source-of-wealth evidence where appropriate, identification and authority documents, tax and corporate records, trade documents and a coherent explanation for the proposed transaction. This does not replace a bank’s own legal obligations. It helps the bank undertake its assessment without relying on incomplete or inconsistent information.

For boards, the practical issue is resourcing. An AML/CFT programme needs trained staff who can investigate and challenge unusual activity, technology that produces usable alerts, and independent assurance. A high alert volume with poor triage, unexplained overrides or recurring data gaps can be as material as an absence of written policy.

Foreign exchange, payments and digital delivery

Foreign-exchange activity needs a separate workstream

Cross-border lending, deposits, trade finance, guarantees, dividends, intercompany funding, remittances and hedging can engage foreign-exchange law and Bangladesh Bank requirements in addition to ordinary banking rules. A transaction should not assume that an offshore counterparty, a foreign-currency payment clause or a foreign group treasury arrangement is automatically permitted simply because the underlying commercial arrangement is valid.

Bangladesh Bank updated its Foreign Exchange Risk Management Guideline in February 2025 and asked authorised dealers to comply immediately.[15] The accompanying December 2024 guideline links foreign-exchange risk to trade finance, remittances, offshore business and foreign-currency balance-sheet positions. It calls for governance, independent risk limits, ongoing monitoring, documentation and a strong middle-office function with a separate reporting line.[15]

This is both a treasury issue and a transaction-planning issue. A bank should identify the product, currency, counterparty, settlement route, underlying documentation, approval basis and reporting obligations at the outset. A corporate should align its commercial timetable with the authorised dealer’s information needs, rather than treating regulatory documentation as an end-stage formality.

Payments, wallets and platform models

Bangladesh Bank’s payment-systems page describes the Payment Systems Department as responsible for law, regulation, licensing and oversight across payment systems. It identifies the Bangladesh Payment and Settlement Systems Regulations, 2014 and the Regulations on Electronic Fund Transfer, 2014 as part of the current regulatory architecture on that page.[10]

For PSPs and PSOs, Bangladesh Bank says it reviews market demand, business rationale, regulatory requirements, risk management systems, settlement arrangements and eligibility under the 2014 regulations when considering licence applications.[10] A technology provider should not assume that it falls outside that regime because money is ultimately held or settled by a bank. The operational roles, customer interface, flow of funds, safeguarding arrangements and settlement architecture require close analysis.

Bangladesh Bank also describes mobile financial services as a bank-led model. Its page states that domestic MFS payment services are permitted within the stated framework, while cross-border money transfer is not allowed through MFS; local disbursement of inward foreign remittance through banking channels is separately permitted.[10] The boundaries must be tested against the current service rules and product design.

Cybersecurity, outsourcing and operational resilience

Bangladesh Bank’s current index includes core-banking controls, ICT-security guidance, cloud-computing guidance and 2026 cybersecurity and partner-network materials.[3] The presence of these topics is a reminder that regulatory compliance and operational resilience are linked. A bank cannot safely outsource accountability for customer data, access management, incident response, business continuity, transaction integrity or vendor oversight.

The current-source caveat is important here. The index alone is not enough to define a vendor’s contractual duties, a cloud deployment model or cyber-control thresholds. Before signing a material technology contract, the bank should review the final applicable instrument, map it to the architecture, identify cross-border data and subcontracting questions, and ensure it has audit, access, exit, incident-notification and continuity protections that it can actually enforce.

Resolution, deposit protection and distressed-bank planning

The 2026 resolution framework

Bangladesh Bank’s official legislation index now lists both the Bank Resolution Ordinance, 2025 and the Bank Resolution Act, 2026.[1] An official Gazette publication dated 10 April 2026 records the enactment of the 2026 Act.[12] Bangladesh Bank’s Bank Resolution Department says the Act establishes the current legal framework for bank resolution and that the Department is responsible for the restructuring, resolution and liquidation of distressed banks and finance companies.[16]

According to the Department’s public description, the framework includes temporary administration, purchase-and-assumption transactions, mergers and acquisitions, recapitalisation, bail-ins and liquidation.[16] Those are resolution tools, not routine commercial remedies that a counterparty can select at will. Their use, order, effect on shareholders and creditors, and procedural safeguards depend on the governing statute and the specific action taken by the authority.

The 2025 Regulations for Bank Resolution were made under the then Bank Resolution Ordinance and described resolution planning, resolvability assessment and resolution tools for scheduled banks, including Islami banks, with application to finance companies where applicable.[11] They remain valuable context, but businesses should take care over the transition. They should check the text of the 2026 Act, any formal savings or transitional provisions, and the latest regulations, directions and notices before basing a decision on Ordinance-era terminology.

What changes for boards, investors and counterparties

Resolution planning broadens the lens of due diligence. A board of a regulated institution should know which critical functions, service providers, data, payment connections, funding sources and intragroup arrangements would be needed in a stress scenario. Contracts should be reviewed for termination, set-off, collateral, change-of-control, information-access and continuity provisions. A plan that relies on a vendor or group affiliate without robust access rights may not be workable in a resolution environment.

Investors and counterparties should assess a bank’s governance, asset quality, liquidity, connected exposures, collateral, regulatory history and contractual rights as part of ordinary risk diligence. The existence of a statutory resolution regime does not eliminate credit risk or guarantee a particular treatment in a distress event. It supplies a framework for an orderly public-authority response.

Deposit protection: do not assume blanket coverage

Bangladesh Bank’s regulatory index lists the Deposit Protection Act, 2026, and an official 2026 Gazette circular hosted by Bangladesh Bank records legislation establishing a Deposit Protection Department within Bangladesh Bank.[3] [17] The presence of the Act is important for confidence and crisis-management architecture, but it is not a basis for claiming that every balance, depositor, product or entity is protected to a given amount.

For an actual deposit, account agreement, prospectus or customer communication, verify the current statute, applicable rules and Bangladesh Bank notices. Check the institution’s covered status, the type of account, exclusions, limits, aggregation rules, payout mechanism and any implementation or transition provisions. Until those elements are confirmed from the current primary materials, statements about guaranteed recovery should be avoided.

Commercial implications for market participants

Banks and finance companies

The regulatory burden is cumulative. A proposed product may require a credit-policy review, AML/CFT risk assessment, technology controls, foreign-exchange analysis, customer disclosures, reporting changes and board approval at the same time. Treating each as a separate late-stage sign-off commonly creates avoidable launch delays.

A useful approach is to build a single product-governance file. It should state the legal basis, intended customer, fund flow, permissions, risk assessment, applicable circulars, operational controls, outsourcing dependencies, complaints route, reporting outputs and approval record. It should also record why a particular requirement does or does not apply. That makes future inspection, audit and change management more manageable.

Corporate borrowers and depositors

A corporate borrower should understand that lender information requests are not merely commercial negotiation points. Credit classification, provisioning and inspection expectations can affect a bank’s appetite for incomplete documentation, unsupported projections or loosely recorded restructuring. A well-prepared borrower can provide current financial statements, cash-flow evidence, ownership and authority records, collateral documents, insurance information and a realistic explanation of payment capacity.

Depositors should distinguish between a bank’s contractual terms, a bank’s financial condition, and statutory deposit protection. Before placing material funds, review the account product, signatory and withdrawal rules, maturity and early-withdrawal terms, charges, digital-security arrangements and the current position on deposit-protection coverage. General web commentary should not replace a direct check of the current primary rules and the bank’s terms.

Foreign investors, fintechs and payment businesses

For foreign entrants, the most important early question is often not “how quickly can we incorporate?” but “what activity are we truly proposing?” An unlicensed deposits-and-payments proposition may need to be redesigned as a partnership with an authorised institution, a PSP/PSO application, a fintech pilot, a technology service or another permitted structure. The answer affects capital, governance, data, contracts, revenue model, customer communications and transaction timing.

A regulated bank partnering with a fintech should also identify who owns the customer relationship, who performs KYC, who holds or moves funds, who resolves complaints, who monitors fraud and suspicious activity, and who can halt the service during an incident. A contract that leaves these questions vague creates both legal and operational risk.

M&A, restructurings and major financing

A control transaction involving a regulated institution requires early regulatory analysis. In addition to ordinary corporate, tax, finance and competition work, the parties may need to consider ownership and fit-and-proper expectations, capital, governance, connected lending, confidential supervisory information, foreign exchange and the effect of the 2026 resolution framework. A post-signing plan should be realistic about approval conditions and integration steps.

For debt transactions, lenders and investors should separate legal enforceability of security from regulatory treatment of collateral and provisioning. The loan-classification circular’s rules on eligible collateral and valuation inform the prudential calculation; they do not by themselves cure defects in title, registration, priority, insurance or enforcement strategy.[5] Both analyses are needed.

Practical next steps

1. Prepare an activity map. Describe the service, customer, money flow, data flow, entities, jurisdictions, currencies and third parties in plain language. Map each feature to a possible banking, payment, foreign-exchange, AML/CFT or data-control issue.
2. Create a source register. For each requirement, record the statute, final regulation/circular, issue date, effective date, official URL, owner and implementation evidence. Flag drafts and uncertain points separately.
3. Test the authorisation perimeter before launch. Confirm whether the model needs a bank licence, digital-bank licence, finance-company status, PSP/PSO permission, an MFS arrangement, a pilot or a regulated-bank partner. Do not let product branding decide the legal analysis.
4. Turn governance into evidence. Ensure the board and committees have appropriate terms of reference, policies, management information, escalation routes, audit independence and documented follow-through on findings.
5. Run a control-to-process review. Trace a sample customer from onboarding through payment or lending, monitoring, reporting, complaint, incident and exit. Test whether the system, staff and outsourced providers can deliver what the policy promises.
6. Stress the credit and funding position. Review classification triggers, collateral files, provisioning logic, concentration risks, liquidity and foreign-exchange exposure. Escalate material data gaps and model assumptions rather than masking them with manual workarounds.
7. Plan for regulatory change and distress. Maintain a circular-monitoring process, a regulatory engagement protocol and a practical continuity/resolution-readiness review. Reassess material contracts for access to data, systems, service continuity and termination rights.

For help identifying the legal workstreams relevant to a particular Bangladesh banking, finance or payments matter, see TRW’s practices or contact TRW. Any engagement should begin with the current facts, applicable permissions and latest official materials.

Frequently asked questions