Bangladesh: technology regulation at a glance

Framework: No dedicated crypto statute. Use/trading is prohibited by Bangladesh Bank under the Foreign Exchange Regulation Act 1947 (FER Act), the Money Laundering Prevention Act 2012, and the Anti-Terrorism Act 2009, communicated through central-bank public notices. A nascent regulatory perimeter is set out in the National Blockchain Policy of Bangladesh 2026 (ICT Division), which assigns Virtual Asset Service Provider (VASP) oversight to Bangladesh Bank's AML/CFT framework and tokenised-securities oversight to the Bangladesh Securities and Exchange Commission (BSEC).

Cryptocurrency is not legal tender and is effectively prohibited for use, trading, exchange and remittance in Bangladesh: the central bank treats all virtual-currency transactions and their facilitation as impermissible under foreign-exchange and AML law. There is no operational licensing regime for exchanges, custodians or stablecoin issuers. The 2026 National Blockchain Policy creates a forward-looking regulatory perimeter (Bangladesh Bank for VASPs, BSEC for tokenised securities) but stops short of legalising private crypto, which it groups with high-risk assets.

Framework: Draft National AI Policy 2026-2030 (ICT Division, under finalization); supported by enacted Personal Data Protection Ordinance 2025 and National Data Governance Ordinance 2025

Bangladesh has no enacted, AI-specific binding law as of May 2026. The ICT Division released successive draft AI policies (2024 draft, then 2026-2030 drafts v1.1 and v2), with public consultation closing in February 2026; the policy had not been formally adopted or gazetted at that date. Existing enacted instruments, the Personal Data Protection Ordinance 2025 and the Cyber Safety Ordinance 2025, provide partial data-governance and cybersecurity coverage but contain minimal AI-specific provisions, with dedicated AI Act drafting directed to begin by 2028.

Framework: Personal Data Protection Ordinance, 2025 (Ordinance No. 61/2025), gazetted 6 November 2025; enforced by the National Data Governance Authority (NDGA) established under the companion National Data Governance Ordinance, 2025

Bangladesh enacted its first comprehensive personal data protection law via the Personal Data Protection Ordinance, 2025, approved by the Council of Advisers on 9 October 2025 and gazetted on 6 November 2025. The Ordinance recognises citizens as owners of their personal data, mandates explicit consent for collection and processing, and establishes the National Data Governance Authority as the supervisory body. Full enforcement mechanisms are phased in over 18 months from gazette, making the regime fully operational around May 2027.

Framework: Bangladesh Bank (central bank), Payment Systems Department, Payment and Settlement Systems Act, 2024; Bangladesh Payment and Settlement Systems Regulations, 2014 (BPSSR-2014); and the Bangladesh Mobile Financial Services (MFS) Regulations, 2022.

Bangladesh operates a clear, in-force licensing regime for digital payments and fintech under Bangladesh Bank, which issues distinct licenses for Payment Service Providers (PSPs), Payment System Operators (PSOs) and Mobile Financial Services (MFS) providers. This regime now rests on the Payment and Settlement Systems Act, 2024 (passed July 2024), which for the first time gives statutory footing to the previously regulation-based framework and brings non-bank providers under formal supervision. Some adjacent areas, notably BNPL and open-banking/payment-initiation services, remain under draft or developing rules rather than a finalized dedicated framework.

Framework: Immigration Act 1952 (as amended); Foreigners Act 1946; Bangladesh Investment Development Authority (BIDA) Act 2016; Department of Immigration & Passports, Ministry of Home Affairs, governing all foreign-national visa and work-permit issuance

Bangladesh offers no dedicated digital nomad or remote-work visa. Independent remote workers working for foreign employers have no specific long-stay visa category available to them; the country's visa system is built around employer-sponsored employment visas, investor visas requiring substantial capital, and short-stay tourist or business visas that do not permit work. The only route to long-term residence is through the investor visa program (minimum ~USD 100,000 invested via a BIDA-registered entity) or conventional employment with a Bangladeshi-registered employer.

Framework: Cyber Security Ordinance 2025 (promulgated 21 May 2025, replacing Cyber Security Act 2023 and Digital Security Act 2018); Bangladesh Telecommunication Regulatory Commission (BTRC) under the Telecommunications Act 2001 and Telecommunications (Amendment) Ordinance 2025 (December 2025)

Bangladesh has governed online content through a succession of increasingly contested laws, ICT Act 2006 (s.57), Digital Security Act 2018, Cyber Security Act 2023, and the current Cyber Security Ordinance 2025, each primarily designed as criminal-law instruments to police online speech rather than to impose EU/UK-style platform accountability. The post-August 2024 interim government introduced meaningful reforms: reducing penalties, making speech offences bailable, banning internet shutdowns, and recognising internet access as a civic right. However, BTRC retains broad, judicially unreviewed content-blocking authority, proposed OTT/social-media regulations would deepen centralised control, and Freedom House continues to rate Bangladesh 'Not Free' on the internet.

Framework: Cyber Security Ordinance, 2025 (Ordinance No. 25 of 2025), administered by the National Cyber Security Agency (NCSA) under a National Cyber Security Council (NCSC); operational response by BGD e-GOV CIRT

Bangladesh enacted the Cyber Security Ordinance, 2025, gazetted on 21 May 2025, repealing the Cyber Security Act, 2023 (which had itself replaced the Digital Security Act, 2018). The Ordinance constitutes a comprehensive statutory framework covering critical information infrastructure (CII) protection, cybercrime offences, incident response, and institutional governance under a newly structured NCSA. Civil-society concerns persist over vague definitions and residual speech-restricting provisions, but the law is in force and operative.

Framework: Companies Act 1994 (Act XVIII of 1994), administered by the Registrar of Joint Stock Companies and Firms (RJSC) under the Ministry of Commerce; Bangladesh Investment Development Authority (BIDA) for industrial investment registration

Foreign investors may incorporate a private limited company in Bangladesh with up to 100% equity in most sectors via the RJSC's online portal, with no statutory minimum paid-up capital for incorporation itself. The process involves several sequential steps, including a mandatory inward capital remittance and bank-issued encashment certificate before shares can be allotted, making the typical end-to-end timeline 3-5 weeks. Industrial enterprises must additionally register with BIDA and remit at least USD 50,000 within two months of approval.