Nepal: technology regulation at a glance

Framework: Foreign Exchange (Regulation) Act, 1962 (amended 2019); Act Restricting Investment Abroad, 1964; Nepal Rastra Bank Act, 2002 (2058 BS); enforced via NRB Official Notices (2017, Sep 2021, Apr 2023) and Nepal Police Cyber Bureau

Nepal maintains a comprehensive ban on all private cryptocurrency activities, trading, mining, holding, investing, NFTs, and DeFi, enforced through the Foreign Exchange (Regulation) Act and multiple Nepal Rastra Bank official notices, most recently expanded in April 2023 to explicitly cover DeFi, NFTs, and all virtual assets enabling offshore capital flows. No licensing or regulatory framework exists for any crypto service provider; penalties include up to seven years' imprisonment and fines of three times the transaction value. NRB is separately developing a sovereign CBDC (Hyperledger Fabric, BIS-supported) targeting an FY 2025/26 pilot, while a government task force established in December 2025 is reviewing whether the blanket ban should be reconsidered.

Framework: National Artificial Intelligence Policy 2082 (2025), approved by Cabinet on 11 August 2025; Ministry of Communication and Information Technology

Nepal adopted its first National AI Policy (2082/2025) via Cabinet decision in August 2025, establishing guiding principles, planned institutional bodies, and sectoral integration goals. The policy is a non-binding executive instrument, not a parliamentary law, and explicitly calls for future AI-specific legislation, standards, and regulations to be developed. As of mid-2026, no comprehensive AI law has been enacted.

Framework: Individual Privacy Act, 2075 (2018) and the Privacy Regulation, 2077 (2020), founded on Article 28 of the Constitution of Nepal (2015), supplemented by the Electronic Transactions Act 2008 and the National Penal Code 2017

Nepal has a dedicated, economy-wide privacy statute, the Individual Privacy Act 2075 (2018), in force since 18 September 2018, supplemented by the Privacy Regulation 2020, that regulates the collection, use, storage and disclosure of personal and sensitive data and grants data-subject rights including consent, access, rectification and erasure. However, it is not a full GDPR-equivalent: it establishes no independent data-protection authority (complaints go to the District Court), and lacks mandatory breach notification, data-portability and clear cross-border transfer rules. A proposed IT Bill that would tighten these obligations has been pending since 2022 and remains stalled.

Framework: Payment and Settlement Act, 2075 (2019) + NRB Act 2002, implemented via Nepal Rastra Bank's Licensing Policy for Institutions that Perform Payment-Related Work 2079 (2023); regulator: Nepal Rastra Bank (NRB), Payment Systems Department

Nepal operates a dedicated, in-force licensing regime for digital payments. The Payment and Settlement Act, 2019 makes it unlawful to operate as a Payment System Operator (PSO) or Payment Service Provider (PSP) without prior NRB approval, and NRB has issued and updated a specific Licensing Policy (latest version 2079/2023) governing letters of intent, capital, validity and renewal. As of mid-July 2024, 35 institutions were licensed (9 PSOs and 26 PSPs), and national instant-payment rails (the National Payment Switch / NEPALPAY) are operational, though there is no formal statutory open-banking framework.

Framework: Economic Reform Implementing Work Plan 2025 (Office of the Prime Minister and Council of Ministers); Department of Immigration Act; Visa Law of Nepal; immigration.gov.np regulations

Nepal formally announced a dedicated five-year, multiple-entry Digital Nomad Visa as part of its Economic Reform Implementing Work Plan released in May 2025, with a stated rollout target of within one year. As of May 2026, the visa is in its final implementation phase, the policy framework and eligibility criteria are publicly defined, but the dedicated category is not yet listed as an active, accepting visa type on the Department of Immigration's official portal. In the interim, remote workers can enter on extendable tourist visas for up to 150 days per calendar year.

Framework: Electronic Transactions Act 2063 (2008) + Directives for Managing the Use of Social Media 2080 (2023), enforced by Ministry of Communication and Information Technology (MoCIT); Social Network Bill 2081 pending in National Assembly

Nepal regulates online content primarily through the Electronic Transactions Act 2063, which criminalises publication of 'illegal' or morality-offending material, and the Social Media Directives 2080, which require platforms to register, appoint local grievance officers, and moderate content. A more comprehensive Social Network Bill 2081 was tabled in the National Assembly in January 2025 and remains under parliamentary review as of mid-2026, meaning no single consolidated online-safety law is yet in force. Nepal briefly banned 26 major platforms, including Facebook, WhatsApp and YouTube, in September 2025 for non-compliance with registration requirements, reversing the ban after nationwide protests.

Framework: Electronic Transactions Act 2063 (2008); National Cyber Security Policy 2080 (2023); Nepal Rastra Bank Cyber Resilience Guidelines (2023); Information Technology and Cyber Security Bill 2082 (passed lower house August 2025, enactment pending)

Nepal's operative cybersecurity framework rests on the Electronic Transactions Act 2063, which criminalises hacking and unauthorised access but contains no mandatory breach-notification or cross-sector incident-reporting duties. The Cabinet-approved National Cyber Security Policy 2080 (2023) and the newly established National Cyber Security Centre (NCSC, January 2024) provide a policy and coordination layer. A comprehensive Information Technology and Cyber Security Bill 2082 passed Nepal's House of Representatives in August 2025 and, once fully enacted, would replace the ETA 2063 with modern mandatory incident-reporting and Critical Information Infrastructure (CII) protection obligations.

Framework: Foreign Investment and Technology Transfer Act 2075 (2019) (FITTA); Companies Act 2063 (2006); Industrial Enterprise Act 2076 (2019), administered by the Department of Industry (DOI) and Office of Company Registrar (OCR)

Nepal permits foreign direct investment with up to 100% foreign ownership in most sectors not on the statutory negative list, but foreign investors must first obtain approval from the Department of Industry (DOI) through the One Stop Service Centre (OSSC) before registering with the OCR. A minimum capital threshold of NPR 20 million (≈ USD 150,000) applies to most sectors, and the end-to-end process, from DOI approval through OCR registration and PAN issuance, typically takes 3-6 weeks.