Bangladesh Bank (BB) is set to introduce an Artificial Intelligence (AI)-based cybersecurity policy to help banks and financial institutions tackle emerging cyber threats arising from the rapid advancement of AI and other new technologies.
The central bank has already formed a committee comprising government and Bangladesh Bank officials, private sector representatives, university teachers and IT experts to formulate a timely policy suited to the evolving cybersecurity needs of the country’s financial sector.
The proposed policy is expected to provide necessary guidelines for scheduled banks and financial institutions to strengthen their information technology (IT) infrastructure, improve threat detection and update security arrangements in response to increasingly sophisticated cyberattacks.
“We will formulate the policy soon and give necessary guidelines to the scheduled banks and financial institutions. As per the guidelines, banks and financial institutions will update their IT,” Muhammad Zakir Hasan, executive director of Bangladesh Bank’s Information and Communication Technology (ICT) department, told BSS.
Regarding the existing cybersecurity arrangements in the financial sector, he said Bangladesh Bank had already issued comprehensive guidelines for banks and financial institutions, which had taken steps to strengthen their security systems.
Hasan said the central bank had a trained team of cybersecurity professionals monitoring threats, adding that cyber risk management is a continuous process requiring constant vigilance and updated security measures.
He said the recent cybersecurity concerns were a global issue, although Bangladeshi banks had not faced any related problems so far.
Strengthening the financial sector’s cyber defences
The proposed AI-based policy comes as Bangladesh Bank is pursuing a broader initiative to strengthen cybersecurity across the financial sector.
On 29 March, 2026, the central bank issued its Cybersecurity Framework, Version 1.0 (2026), bringing scheduled banks, finance companies, mobile financial service providers, payment service providers and payment system operators under a common cybersecurity framework.
Bangladesh Bank has set 31 December , 2026, as the deadline for banks and other regulated financial service providers to implement the framework.
The framework requires institutions to strengthen cybersecurity governance, assess and manage risks, protect information and technological infrastructure, monitor threats, manage incidents and improve staff training and awareness.
It also addresses risks arising from third-party service providers and outsourcing arrangements, alongside security audits and compliance monitoring.
The framework follows six functional areas: Identify, Protect, Detect, Respond, Recover and Reporting. These cover the identification of critical systems and vulnerabilities, implementation of protective measures, early detection of suspicious activities, incident response, restoration of services and post-incident assessment.
The approach is designed to help financial institutions improve their preparedness before an attack, limit potential damage during an incident and restore operations more effectively afterwards.
AI presents new opportunities and challenges
The growing use of AI presents both opportunities and challenges for financial institutions.
AI-based tools can help security teams analyse large volumes of data, identify unusual transaction patterns and detect suspicious activities. However, malicious actors can also exploit advanced technologies to develop convincing phishing messages, automate attacks, impersonate legitimate individuals or organisations and create deceptive communications aimed at defrauding customers or compromising banking systems.
Banks, therefore, need to strengthen their technological safeguards while maintaining effective governance, trained personnel, timely software updates and clear incident-response procedures.
The proposed policy could provide a regulatory basis for financial institutions to review their existing systems and adopt appropriate security measures in line with the central bank’s forthcoming guidelines. Its specific provisions will depend on the committee’s recommendations and the final policy.
Recent cyber alert highlights urgency
The importance of strengthening cybersecurity was underscored when Bangladesh Bank temporarily took its official website offline on 22 October as a precaution following an international cybersecurity alert concerning serious vulnerabilities in PHP, a widely used programming language for web applications.
In a joint alert issued on 21 October, relevant agencies warned that attackers could exploit the vulnerabilities to execute malicious code on affected servers. Organisations were advised to take precautionary measures where security updates could not be applied promptly.
The Bangladesh Bank website was restored at 8:00 am on 25 October after the central bank’s IT team monitored the situation and worked to ensure the site’s security.
Bangladesh Bank spokesperson and executive director Arief Hossain Khan told BSS that no bank website had been hacked and there was no risk to banking transactions, including digital transactions, at that time.
The temporary shutdown demonstrated the importance of precautionary action, timely security updates and continuous monitoring, even when no confirmed breach has been reported.
Investment and skilled manpower crucial for implementation:
The effectiveness of the proposed AI-based policy will depend on its practical implementation across institutions with varying levels of technological capacity and resources.
Banks will need to review their IT infrastructure, identify security gaps, strengthen access controls, protect sensitive customer information and ensure their systems can detect and respond to suspicious activities.
Investment in modern security solutions, specialised personnel, employee training and secure third-party services will also be important.
Regular vulnerability assessments, security audits, incident-response exercises and business continuity planning can help institutions identify weaknesses and improve their ability to withstand cyber incidents.
Particular attention will be needed to ensure that employees understand common cyber risks, including phishing attempts, suspicious links, unauthorised access and the improper handling of sensitive information.
Banks will also need to assess the security of externally provided technology services, as weaknesses in interconnected systems can create risks beyond individual organisations.
SBAC Bank emphasises continuous cybersecurity measures:
Abdul Quaium Chowdhury, additional managing director (AMD) of South Bangla Agriculture and Commerce (SBAC) Bank PLC, said the bank had taken necessary measures to strengthen its cybersecurity arrangements in line with Bangladesh Bank’s guidelines.
“We are strengthening our cybersecurity infrastructure in accordance with Bangladesh Bank’s guidelines and giving importance to continuous monitoring, risk assessment and the protection of customers’ information. As cyber threats are becoming increasingly sophisticated with the advancement of artificial intelligence and other technologies, banks need to remain vigilant and regularly update their security systems,” he said.
He said ensuring cybersecurity required not only advanced technology but also skilled manpower, regular staff training and greater awareness among employees and customers.
“Cybersecurity is a continuous process, not a one-time initiative. Banks need to invest in modern security solutions, identify potential vulnerabilities and ensure prompt responses to suspicious activities. We are committed to maintaining the security of our banking services and protecting customers’ interests,” he added.
Chowdhury also emphasised the importance of close cooperation between banks and Bangladesh Bank in sharing information about emerging threats, strengthening institutional preparedness and ensuring the safe and uninterrupted delivery of digital financial services.
Maintaining public confidence in digital finance:
Bangladesh’s financial sector is becoming increasingly dependent on digital banking, mobile financial services, online payments and interconnected technology platforms.
Protecting these services is essential for safeguarding customer information, maintaining transaction security and ensuring uninterrupted financial operations.
A major cyber incident could disrupt banking services, expose sensitive information and undermine public confidence in digital financial channels.
Strong preventive measures and the capacity to respond to and recover from incidents are, therefore, important for the resilience of the entire financial system.
The proposed AI-based cybersecurity policy, together with the existing cybersecurity framework, represents a further step towards adapting Bangladesh’s financial-sector safeguards to rapidly evolving digital threats.
The central bank’s challenge will be to ensure that banks and other regulated institutions keep pace with emerging risks through consistent implementation, adequate investment, skilled professionals and continuous improvement of their security systems.
As AI and other technologies continue to transform financial services, closer cooperation between Bangladesh Bank and financial institutions will remain important in building a more secure, resilient and trustworthy digital banking environment.
About The Author
