Bangladesh Bank Cybersecurity Framework 2026: What Banks, MFS and Payment Providers Must Do Before 31 December
Byte Capsule IT Security Team · · 4 min read
Bangladesh Bank's Cybersecurity Framework 1.0 (2026) in plain language: who must comply, the 31 Dec 2026 deadline, and the testing, vendor and training rules.
On 29 March 2026, Bangladesh Bank issued BRPD-2 Circular No. 02: the Cybersecurity Framework, Version 1.0 (2026). It sets a mandatory baseline for the financial sector, and the deadline for full implementation is 31 December 2026.
This guide summarises what the framework asks for and where most institutions will need outside help. It is not legal advice — always read the circular itself and confirm with Bangladesh Bank's ICT Audit, Inspection and Compliance Wing.
Who must comply
According to Bangladesh Bank, the framework applies to:
- scheduled banks;
- finance companies;
- mobile financial service (MFS) providers;
- payment service providers (PSPs);
- payment system operators (PSOs).
How the framework is built
The framework is aligned with the NIST Cybersecurity Framework, and its controls are described as mostly based on ISO 27001. It is organised around the NIST functions — Identify, Protect, Detect, Respond and Recover — plus a Reporting function, and covers governance, risk management, access control, incident management, audit and compliance assurance, and staff training.
It sits alongside Bangladesh Bank's existing Guideline on ICT Security, Version 4.0 (2023), which already set baseline controls for audit, patching and incident response.
The requirements that need the most work
1. Vulnerability assessment and penetration testing
- Internal and external VA and penetration testing at least annually, and after significant changes to infrastructure or applications (section 5.1.2.25).
- VAs should combine automated tools with manual techniques, and web systems must be tested for issues such as SQL injection and cross-site scripting (4.1.8.12).
- Penetration tests and compromise assessments should simulate actual attacks (4.1.8.13).
- Critical security patches should be installed within one month of release (4.1.4.12).
What to do now: if your last test was more than 12 months ago, or you have launched a new app, API or core system since then, schedule a test before the deadline. Make sure the report shows manual testing and real attack paths, not only scanner output.
2. Third-party, vendor and cloud risk
- Contracts with suppliers must require security measures that meet your cybersecurity programme's objectives (3.1.6.2).
- Suppliers must be assessed routinely through audits, test results or other evaluations (3.1.6.3), and response and recovery plans should be tested with them (3.1.6.4).
- Cloud providers must be audited and covered by an SLA on data security, under Bangladesh Bank's cloud guideline (3.1.7.7–3.1.7.9).
- Outsourced development must be supervised (4.1.4.5), and service providers monitored with periodic reassessment (5.1.2.32).
What to do now: list every vendor that touches customer data or core systems — software houses, payment gateways, cloud hosts, call centres — and decide how you will assess each one: questionnaire, contract clause, their ISO 27001 certificate, or an independent test.
3. Incident response and exercises
- External communication plans must cover Bangladesh Bank and BGD e-GOV CIRT, with pre-scripted messages (6.1.2.4).
- Incident response exercises are expected at least annually (7.1.1.13), and the regulator must be contacted for major or critical cyber incidents (7.1.3.3).
- A cybersecurity incident reporting system must be introduced (6.1.3.6).
What to do now: run a tabletop exercise on a realistic scenario — ransomware on a branch network, a compromised MFS agent account, or a leaked customer database — and fix the gaps it exposes.
4. People and training
- Periodic security training for all staff, with extra training for privileged users, senior executives, physical security staff and information security personnel (2.12).
- Awareness or training for third parties and vendors (2.12(e)).
- Standard certifications such as CISSP, CISA and OSCP for information security staff (2.12(c)).
- Training completion rates are treated as a KPI (7.1.2.4).
5. Self-assessment
Institutions are expected to self-assess their current and target implementation tiers. The framework says this can be done internally or by seeking a third-party assessment (section 2.6). An independent gap assessment is usually the fastest way to produce an honest baseline before the deadline.
A 7-week plan to the deadline
| Weeks | Action |
|---|---|
| 1–2 | Gap assessment against the framework; list of critical systems and vendors |
| 2–4 | External and internal VAPT on priority systems; start fixing critical findings |
| 3–5 | Vendor assessments and contract clause updates |
| 5–6 | Incident response tabletop exercise; update communication plans |
| 6–7 | Retest of fixed findings; board-level summary and evidence pack |
Related standards you may also need
- ISO/IEC 27001:2022 — certificates against the 2013 edition expired on 31 October 2025, so check that your own and your vendors' certificates are on the 2022 edition.
- PCI DSS v4.0.1 — for card-processing environments, all of the previously "future-dated" requirements became mandatory on 31 March 2025.
How Byte Capsule can help
Byte Capsule IT is an ISO 27001 certified cybersecurity company in Dhaka. For the Bangladesh Bank framework we provide:
- gap assessments and ISO 27001 consulting;
- penetration testing and VAPT for web, mobile, API and network;
- incident response readiness and tabletop exercises;
- staff awareness training in Bangla and English.
Book a free consultation to scope a gap assessment before 31 December 2026.
Sources: Bangladesh Bank BRPD-2 Circular No. 02 (29 March 2026) and Cybersecurity Framework, Version 1.0 (2026); Bangladesh Bank Guideline on ICT Security, Version 4.0 (2023); PCI Security Standards Council; IAF transition guidance for ISO/IEC 27001:2022.