Bangladesh country pack.
Bangladesh pack for scheduled banks and Islamic banks, finance companies, microfinance institutions, MFS and payment providers, insurers, listed companies and large enterprises. It covers Bangladesh Bank's 2026 Internal Control Management System guidelines, its 2026 Cybersecurity Framework and ICT Security Guideline v4.0, Shariah governance for Islamic banks, finance company governance, the AML/CFT regime (MLPA 2012, ATA 2009 and BFIU circulars), MRA rules for microfinance, the BSEC Corporate Governance Code 2018, and the 2026 data protection and cyber security laws. Five checklist templates, a regulatory calendar, retention and rating rules are included.
Frameworks and regulations.
| Instrument | Applies to | Requirements | Status |
|---|---|---|---|
| Guidelines on Internal Control Management System in Banks Bangladesh Bank · BRPD-2 Circular No. 03, 21 July 2026 (issued under section 45 of the Bank Company Act 1991, amended up to 2023) | Banks, Islamic banks | 30 | Being confirmed |
| Cybersecurity Framework, Version 1.0 (2026) Bangladesh Bank · Version 1.0, announced 29 March 2026 | Banks, Islamic banks, Finance companies, Payment providers | 15 | Source checked |
| Guideline on ICT Security for Banks and Non-Bank Financial Institutions Bangladesh Bank · Version 4.0, 2023 | Banks, Islamic banks, Finance companies, Payment providers | 20 | Source checked |
| AML/CFT regime: Money Laundering Prevention Act 2012, Anti-Terrorism Act 2009 and BFIU circulars Government of Bangladesh; Bangladesh Financial Intelligence Unit · MLPA 2012 (amended 2015); ATA 2009 (amended 2012 and 2013); MLP Rules 2019; BFIU Circulars No. 26 (banks, 16 June 2020), No. 28 (financial institutions, 30 May 2023), No. 27 (insurers, 18 April 2022), No. 20 (MFS, 17 September 2017), No. 18 (capital market intermediaries, 19 October 2015) | Banks, Islamic banks, Finance companies, Insurers and more | 15 | Being confirmed |
| Shariah governance of Islamic banks (Islamic banking guidelines and Shariah Supervisory Committee policy) Bangladesh Bank · Guidelines for Islamic Banking (BB); Shariah Supervisory Committee instructions of BB's Islamic Banking Regulation and Policy Department, 2025, effective January 2026; BB Shariah Advisory Board policy 2025; ICMS guidelines chapter 7 (July 2026) | Islamic banks, Banks | 11 | Being confirmed |
| Finance Company Act 2023 and Bangladesh Bank governance instructions for finance companies Government of Bangladesh; Bangladesh Bank (DFIM) · Finance Company Act 2023 (passed 1 November 2023); DFIM Circular No. 01 of 29 February 2024; DFIM Circular Letter No. 09 of 16 April 2025 | Finance companies | 10 | Being confirmed |
| Microcredit Regulatory Authority Act 2006 and Microcredit Regulatory Authority Rules 2010 (as applied in MRA's audit terms of reference) Microcredit Regulatory Authority · MRA Act 2006; MRA Rules 2010; MRA terms of reference for audit of microcredit organisations (undated) | Microfinance | 10 | Being confirmed |
| Corporate Governance Code Bangladesh Securities and Exchange Commission · BSEC Notification No. BSEC/CMRRCD/2006-158/207/Admin/80, 3 June 2018 (Gazette 10 June 2018); condition 1(2)(a) amended by Notification No. BSEC/CMRRCD/2009-193/76/PRD/151, 4 April 2024 | Listed companies, Banks, Islamic banks, Finance companies and more | 22 | Source checked |
| Personal Data Protection Act 2026 Government of Bangladesh · Personal Data Protection Ordinance 2025 (gazetted November 2025), amended by Ordinance No. 23 of 2026, passed into law by Parliament in April 2026; regulator set up under the National Data Management Act 2026 | Large enterprises, Banks, Islamic banks, Finance companies and more | 10 | Being confirmed |
| Cyber Security Act 2026 (formerly the Cyber Security Ordinance 2025) Government of Bangladesh · Cyber Security Ordinance 2025 (Ordinance No. 25 of 2025, in force 21 May 2025, amended late 2025), passed into law by Parliament on 10 April 2026 | Large enterprises, Critical infrastructure, Banks | 8 | Being confirmed |
Checklists in the pack.
- Bangladesh Bank ICMS Internal Audit and Compliance Review
- Bangladesh Bank Cybersecurity and ICT Security Review
- AML/CFT Compliance Review (MLPA 2012 and BFIU circulars)
- BSEC Corporate Governance Code Compliance Review
- Islamic Bank Shariah Governance and Shariah Audit Review
Regulators.
- BB Bangladesh Bank
- BFIU Bangladesh Financial Intelligence Unit
- BSEC Bangladesh Securities and Exchange Commission
- IDRA Insurance Development and Regulatory Authority
- MRA Microcredit Regulatory Authority
- FRC Financial Reporting Council
- NCSA National Cyber Security Agency
- NDMA National Data Management Authority (data protection regulator)
Who it is for
Banks, Islamic banks, Finance companies, Microfinance, Insurers, Payment providers, Capital market firms, Listed companies, Large enterprises, Critical infrastructure.
Regulatory calendar.
20 recurring deliverables, each with the regulator, the instrument and the deadline rule. Some examples:
| Deliverable | Regulator | How often | Deadline |
|---|---|---|---|
| Next year's risk-based audit plan approved by the audit committee | BB | Every year | By September of the current year; plan reviewed at least quarterly |
| Audit committee report to the board on audit and inspection recommendations | BB | Every quarter | Every quarter |
| Head of Compliance report to the audit committee and senior management | BB | Every quarter | At least quarterly; significant breaches immediately |
| Enterprise-wide compliance risk assessment | BB | Every year | At least once a year, feeding the risk-based compliance monitoring plan |
| HoIA annual assurance report on the control environment | BB | Every year | Yearly, to the board through the audit committee (no fixed date confirmed) |
| Board annual review of internal control effectiveness and senior management certification | BB | Every year | At least one board review meeting a year, with results reported to shareholders; management certification to the board each year |
Reporting conventions.
- Reports in English
- Amounts in BDT
Bangladesh Bank and BSEC issue most guidelines in English, but Bangla is the language of government, Parliament and many regulator instruments: BFIU's circular list shows most AML/CFT circulars since 2012 (including the bank master circular No. 26 of 2020) published in Bangla only, and BB circulars carry both a Bangla-calendar and a Gregorian date (for example '03 Baishakh 1432 / 16 April 2025'). Plan for Bangla source texts and, where a client must publish notices or deal with courts and government offices, Bangla output. Amounts are in BDT, usually written Tk, with lakh (100,000) and crore (10 million) groupings. BB circulars are cited as '<Department> Circular No. NN' or 'Circular Letter No. NN' with the date (for example BRPD, BRPD-2, DFIM, DOS, PSD, FICSD); BSEC instruments by notification number (for example BSEC/CMRRCD/2006-158/207/Admin/80). Banks and finance companies report on a calendar year; MFIs' financial year ends on 30 June (MRA audit terms of reference), and most other companies follow the July-June income year, so calendar anchors must be set per client. Laws made by ordinance under the 2024-2026 interim government had to be passed by the new Parliament within 30 days of its first sitting (Article 93); Parliament converted most of them into Acts in April 2026, while some (for example the ACC amendment) lapsed, so always cite the 2026 Act where one exists.
Kept current.
Content version 2026.10, reviewed 29 October 2026. Descriptions are AuditHD's own; each framework links to the official text. License this pack on its own or with other countries; International standards are always included.
See it with your own checklists.
Open the live demo now, or book a walkthrough and we will load one of your frameworks or work programmes.