Bangladesh Bank is drafting a cybersecurity policy built around artificial intelligence, aiming to give banks and other financial institutions clearer guidance on threats that AI tools make faster, cheaper and more convincing. The central bank has formed a committee to shape it, bringing together government and central bank officials, private-sector representatives, university teachers and IT specialists.
Muhammad Zakir Hasan, executive director of the central bank’s ICT department, told the state news agency BSS that the policy would be formulated soon and handed to scheduled banks and financial institutions as guidelines. No draft has been published and no date has been given. The broad aim is to help lenders upgrade their IT infrastructure, improve threat detection and refresh their security arrangements, but the specific requirements will depend on what the committee recommends.
Why the timing matters
The announcement follows an uneasy fortnight for the financial sector. On 21 October, a joint alert flagged serious flaws in PHP, the programming language behind a large share of the world’s websites, warning that attackers could use them to run malicious code on servers. The next day Bangladesh Bank took its own website offline as a precaution, and several commercial banks did the same. The central bank’s site came back on 25 October after three days.
Officials have stressed that nothing was breached. The central bank’s spokesperson, executive director Arief Hossain Khan, said no bank website had been hacked and that banking and digital transactions were not at risk. Internet banking and mobile financial services kept running throughout. Hasan added that Bangladeshi banks had not faced problems linked to the flaws, and that a trained team at the central bank monitors threats.
Even so, the episode showed how quickly a weakness in widely used software can ripple across a sector, and how much of the response still depends on switching systems off and waiting.
The new policy would sit on top of an existing rulebook. In March, Bangladesh Bank issued its Cybersecurity Framework, Version 1.0, which covers scheduled banks, finance companies, mobile financial service providers, payment service providers and payment system operators. It is organised around six functions: identify, protect, detect, respond, recover and report. It also reaches into governance, staff training, incident handling, third-party and outsourcing risk, audits and compliance checks. Institutions have until 31 December 2026 to put it in place.
What it means here
AI cuts both ways for lenders. The same tools that can sift through huge volumes of transactions and flag unusual activity can also write convincing phishing messages, automate attacks and impersonate bank staff or customers. In a country where a growing share of everyday payments runs through mobile wallets and banking apps, a scam that sounds exactly like a real bank officer is a bigger worry than a defaced website.
An AI-specific policy could help most where the sector is weakest: smaller banks, finance companies and payment firms that lack large in-house security teams and lean heavily on outside vendors. Clear minimum standards for detection and infrastructure would give them a benchmark to work toward, and give the regulator something concrete to audit.
The real test will be in the detail. Bankers will want to know whether the policy sets firm requirements or broad principles, how it treats AI tools that banks deploy themselves, and whether its deadlines are realistic alongside the December framework cut-off. As one SBAC Bank executive put it, cybersecurity is “a continuous process, not a one-time initiative”. The central bank’s draft will show how it plans to keep pace.
