NepalInformation Technology Guidelines for Commercial Banks, Information Security Programme and Audit
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://www.nrb.org.np/bfr/it-guidelines-2012/In force.
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds commercial banks licensed by Nepal Rastra Bank (reached by declaring that you are a bank). The Guidelines state that banks should compulsorily comply with them.
- Have a board approved Information Security Policy addressing all electronic delivery channels and payment system, communicated to your employees, contractors, suppliers, consultants and officials (Information Security, item 1).
- Conduct a risk assessment periodically, at least annually, for each asset (Information Security, item 2).
- Deploy strong cryptography and end-to-end encryption to protect customer PINs, user passwords and other sensitive data in networks and in storage (Information Security, item 9).
- Conduct an information systems audit annually (IS Audit).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Nepal Rastra Bank, which examines compliance with the Guidelines during periodic onsite and offsite supervision.
Settledness
- As of
- Open questions
- Is a guideline issued by the Bank Supervision Department an order, directive or circular of Nepal Rastra Bank under section 79(2) of the Nepal Rastra Bank Act, 2058, so that section 99(1) of that Act reaches a breach of it?
What this law does
Nepal Rastra Bank’s Bank Supervision Department released its Information Technology Guidelines in August 2012. The Guidelines state that banks should compulsorily comply with them. The Guidelines aim to promote sound and robust technology risk management and to strengthen system security, reliability, availability and business continuity in commercial banks of Nepal. The Guidelines say that compliance will be examined during the periodic onsite and offsite supervision of Nepal Rastra Bank.
The Information Security part of the Guidelines calls for a board approved Information Security Policy addressing all electronic delivery channels and payment system. The Guidelines call for a bank to assess risk periodically, at least annually, for each asset. The Guidelines call for strong cryptography and end-to-end encryption to protect customer PINs, user passwords and other sensitive data in networks and in storage. The Guidelines call for an information systems audit annually.
Section 79(2) of the Nepal Rastra Bank Act, 2058 makes it the duty of a commercial bank to abide by the rules, bye-laws, orders, directives and circulars of the Bank. Section 99(1) of the Act lets the Bank fine a commercial bank that violates an order or directive issued by the Bank, up to the amount related to the violation.
When LexLint raises it
When your app profile says your app is a bank.