Fintech regulation in Bangladesh is built around one question: which regulated activity does your product actually carry out? Payments, mobile money, lending, deposit-taking, investment and insurance each have their own licences and rules, and Bangladesh Bank sits at the centre of most of them. The Payment and Settlement Systems Act 2024 gave payment businesses a firmer statutory footing, and digital banks, sandbox testing and stronger data and AML rules are reshaping the market.

How fintech regulation in Bangladesh is structured

Bangladesh regulates financial services by activity rather than by technology. A company that moves money, issues e-money, lends, takes deposits, sells investments or arranges insurance is regulated according to that activity, whether it uses an app, a website or an agent network. Fintech regulation in Bangladesh therefore starts with a careful description of what the product does, who holds customer money, who bears credit risk and how revenue is earned.

The main regulators are Bangladesh Bank for banking, finance companies, payments and foreign exchange; the Bangladesh Securities and Exchange Commission for capital market products; the Insurance Development and Regulatory Authority for insurance; and the Microcredit Regulatory Authority for microfinance. BFIU supervises anti-money laundering compliance across all reporting organisations. Our technology and digital practice helps fintech founders map products to these regimes.

Activities and the licences they require

Under fintech regulation in Bangladesh, many fintech companies avoid the heaviest licences by partnering with banks or finance companies, acting as technology or distribution partners while the licensed institution holds the funds and the credit risk.

The Payment and Settlement Systems Act 2024

Before 2024, payment businesses were regulated mainly through Bangladesh Bank regulations and guidelines issued under its general powers. The Payment and Settlement Systems Act 2024 created a dedicated statutory framework, giving Bangladesh Bank clear powers to license, supervise and take action against payment system operators and payment service providers, to protect settlement finality and to regulate electronic money.

For anyone navigating fintech regulation in Bangladesh, this Act is the starting point for payments. Operating a payment service without the required licence is unlawful, and Bangladesh Bank has publicly warned about unauthorised online payment platforms. Licensed providers must meet capital, governance, technology, settlement and consumer protection requirements and report regularly.

PSP and PSO licences

A PSP typically provides payment services to customers or merchants, such as wallets, payment gateways and bill payment. A PSO runs the infrastructure through which payments clear and settle. Applicants submit a detailed application to Bangladesh Bank's payment systems department with a business plan, ownership information, technology and security documentation, and evidence of the required capital. Customer funds are usually held in trust or settlement accounts at scheduled banks.

Mobile financial services and digital banks

Mobile financial services in Bangladesh follow a bank-led model under Bangladesh Bank's MFS regulations, under which providers are subsidiaries of banks or otherwise approved entities. MFS providers serve tens of millions of customers through agent networks and are subject to transaction limits, KYC rules, interoperability requirements and interest-free customer fund arrangements.

Bangladesh Bank issued a digital bank guideline in 2023 allowing branchless banks that operate mainly through digital channels, with a minimum capital requirement and restrictions such as no physical branches or over-the-counter services. A small number of applicants received approval in principle. The digital bank framework is an important part of fintech regulation in Bangladesh because it opens a route to full banking for technology-led sponsors, though the capital and governance bar is high.

Digital lending, BNPL and credit scoring

Digital lending is one of the most sensitive areas of fintech regulation in Bangladesh. A platform that lends its own money as a business, or funds loans through public deposits or notes, may need a finance company or bank licence. Most digital lenders therefore operate through partnerships, where a bank or finance company books the loan and the fintech provides origination, scoring, collection technology or distribution.

Buy-now-pay-later offerings and nano-loans delivered through MFS wallets usually follow this partnership model. Pricing must respect Bangladesh Bank rules on interest and fees for the lending institution, and lending rates are now market-based after the SMART reference rate was abolished on 8 May 2024. Credit scoring using alternative data raises consent and data protection issues that should be addressed in the product design.

Sandbox and innovation pathways

Bangladesh Bank has encouraged innovation through a fintech innovation hub and regulatory sandbox arrangements that allow eligible firms to test new products with real customers under conditions and limits. A sandbox does not replace a licence; it offers a supervised testing period after which the firm must either obtain the appropriate licence, partner with a licensed institution or stop the activity.

A strong sandbox application explains the innovation, the consumer benefit, the risks and safeguards, testing parameters, exit plans and how the firm will move to full compliance. For early-stage companies, the sandbox can be a useful way to engage the regulator and refine a product before investing in a full licence application.

Capital markets fintech

Within fintech regulation in Bangladesh, businesses that offer investment products, crowdfunding, robo-advice or digital distribution of mutual funds fall under BSEC. BSEC has issued crowdfunding rules and regulates brokers, asset managers and fund distributors, all of whom are increasingly digital. Equity crowdfunding platforms must be approved and operate within investment limits and disclosure rules. Our capital markets practice advises on BSEC approvals for digital investment models.

AML, KYC and e-KYC

Payment providers, MFS operators, banks and finance companies are reporting organisations under the Money Laundering Prevention Act 2012 and the Anti-Terrorism Act 2009. They must carry out customer due diligence, monitor transactions, file suspicious transaction reports with BFIU and keep records. BFIU's e-KYC guidelines allow digital onboarding using national ID verification, with tiered limits based on risk.

Weak AML controls are one of the fastest ways to lose a licence. Compliance with fintech regulation in Bangladesh requires a named compliance officer, risk assessments, staff training, sanctions screening and an independent audit function from the outset.

Data protection and cyber security

Fintech companies handle large volumes of personal and financial data, which makes privacy a core part of fintech regulation in Bangladesh. The cyber security law framework was overhauled in 2025 and again in 2026, when Parliament passed a new cyber security law, and personal data protection legislation has been introduced by ordinance; its status after April 2026 should be checked before relying on it. Bangladesh Bank's ICT security guidelines also apply to licensed institutions and their technology partners, covering access control, encryption, incident response and outsourcing.

Data localisation and cross-border transfer questions arise when fintech companies use foreign cloud providers or parent-company systems. These should be assessed under current law and Bangladesh Bank requirements before launch. Our data protection practice advises on consent, transfers and incident response.

Foreign investment and exchange control

Foreign investors are active in Bangladeshi fintech, and fintech regulation in Bangladesh treats their investment like any other foreign direct investment. Investment into a local company is registered with Invest Bangladesh (formerly BIDA) and must come through banking channels so that dividends and exit proceeds can later be repatriated under the Foreign Exchange Regulation Act 1947 and Bangladesh Bank's foreign exchange guidelines. Some licences, including payment and banking licences, carry ownership, sponsor and fit and proper requirements that affect how foreign investors structure their stake.

Cross-border payment services, such as inward remittance partnerships and international card acceptance, require specific Bangladesh Bank approvals and must comply with foreign exchange reporting rules. Outward payment services for residents are tightly restricted.

Consumer protection and conduct

Bangladesh Bank expects licensed providers to treat customers fairly: clear disclosure of fees and terms, secure authentication, prompt complaint handling and fair collections. The Consumer Rights Protection Act 2009 also applies to services offered to consumers. Aggressive digital collection practices, misleading marketing and hidden charges attract regulatory attention and reputational damage, and they are a recurring concern in fintech regulation in Bangladesh.

Steps to launch a regulated fintech product

1. Map the product. Identify every regulated activity involved and the regulator for each.
2. Choose the route. Decide between a direct licence, a partnership with a licensed institution or a sandbox test.
3. Structure the company. Incorporate locally, register foreign investment and plan capital to meet licence requirements.
4. Build compliance. Prepare AML, KYC, data protection, ICT security, consumer protection and outsourcing policies.
5. Apply. File the licence or approval application with complete documentation and respond to regulator queries.
6. Launch under supervision. Meet reporting obligations, conduct audits and manage incidents promptly.
7. Keep reviewing. Track new circulars and laws, because fintech regulation in Bangladesh is changing quickly.

Insurtech and regtech

Insurance technology businesses that sell, compare or administer insurance must work through licensed insurers or hold the appropriate agent or broker authorisation from IDRA. Embedded insurance in e-commerce or ride-hailing apps should be structured so that the insurer issues the policy and the platform acts within its permitted role. Regtech providers that sell compliance software to banks are not usually licensed themselves, but they become subject to outsourcing and ICT security requirements through their clients. In both cases, fintech regulation in Bangladesh reaches the business indirectly through contracts with licensed institutions.

Crypto assets and virtual currencies

Bangladesh Bank has repeatedly cautioned the public against dealing in virtual currencies and crypto assets, pointing to foreign exchange, money laundering and consumer protection risks. There is no licensing regime for crypto exchanges, and offering crypto trading, custody or crypto-funded payments to residents carries serious legal risk under foreign exchange and AML laws. Blockchain technology used for record-keeping, trade finance or supply chains, without issuing or trading virtual currencies, is a different matter and can be explored with proper advice. Anyone considering a digital asset model should take advice on fintech regulation in Bangladesh before writing a line of code.

Outsourcing, cloud and partner due diligence

Banks and finance companies that outsource technology or customer-facing functions to fintech partners must follow Bangladesh Bank outsourcing and ICT security rules, which often require approval or notification, audit rights and data protection clauses. For a fintech partner, this means expecting detailed due diligence, security assessments and contractual controls. Preparing a compliance pack in advance, including policies, certifications, penetration test results and incident history, shortens bank onboarding considerably and shows a mature approach to fintech regulation in Bangladesh.

Common compliance mistakes

• Launching a payment or wallet feature before obtaining a PSP licence or a licensed partner.
• Holding customer funds in the company's own operating account instead of a protected settlement account.
• Lending through a platform structure that in substance makes the fintech the lender.
• Collecting personal data without clear consent or using it for unrelated purposes.
• Receiving foreign investment informally, which later blocks dividend and exit remittances.
• Treating AML as paperwork rather than a working monitoring system.

Each of these mistakes can be avoided with early legal review, and fixing them after a regulator's inquiry is always more expensive. A periodic review of the business against fintech regulation in Bangladesh, at least once a year and whenever the product changes, keeps a growing company on the right side of the regulator.

Frequently asked questions about fintech regulation in bangladesh

How we can help

We advise founders, investors, banks and global technology companies on fintech regulation in Bangladesh: product mapping, PSP and PSO licensing, digital bank applications, lending partnerships, sandbox applications, AML and data compliance, and foreign investment structuring. Learn more about our technology and digital practice and our banking and financial services practice.

Primary sources: the Payment and Settlement Systems Act 2024, Money Laundering Prevention Act 2012 and Foreign Exchange Regulation Act 1947 on the Laws of Bangladesh portal; payment, MFS and digital bank regulations of Bangladesh Bank; AML guidance from BFIU; capital market rules from BSEC.

This article is general information about Bangladeshi fintech regulation as of October 2026 and is not legal advice. Licensing policy, circulars and data and cyber laws change frequently; confirm the current position with the regulator or a qualified lawyer before acting.