Bangladesh Bank Plans an AI Rulebook for Banks After Months of Cyber Scares

Bangladesh Bank says it will roll out an artificial intelligence focused cybersecurity policy for the country's banks and financial institutions, a move that comes less than two weeks after the central bank's own website went dark for three days over fears tied to a global software flaw. The announcement, made on November 1, is less about a single incident and more about an admission that the technology banks are rushing to adopt for fraud detection and customer service is also, in the wrong hands, a new weapon for attacking them.

Key takeaways

• Bangladesh Bank plans a dedicated AI cybersecurity policy to guide scheduled banks and financial institutions on using AI safely while defending against AI enabled threats.
• A joint committee including government officials, central bank staff, private sector representatives, academics and IT experts is drafting the policy, with no public release date yet beyond "soon."
• The move follows a 21 October warning about a serious PHP software vulnerability that led Bangladesh Bank to take its own website offline from 22 to 25 October.
• A 2026 study found nearly 60 percent of local banks have no AI cybersecurity policy at all, and only 40 percent have any guidelines on the subject.

Why this is landing now

The timing is not a coincidence. On October 21, Bangladesh Bank and other regulators issued a joint alert about a critical PHP vulnerability that attackers could exploit across many web platforms. A day later, the central bank took its own website offline as a precaution, and it stayed dark through the Durga Puja holiday before coming back online on the morning of October 25. Officials were adamant throughout that no bank website had actually been breached and that banking transactions were never at risk, but the episode exposed how quickly a software flaw halfway across the world can force Bangladesh's financial regulator into a defensive crouch.

Rather than treat that as a one off scare, Bangladesh Bank appears to be using it as the trigger for something more structural. Muhammad Zakir Hasan, executive director of the central bank's ICT department, said the bank would "formulate the policy soon and give necessary guidelines to the scheduled banks and financial institutions," while noting that Bangladeshi banks had not faced related problems so far. Arief Hossain Khan, the central bank's spokesperson, reiterated that no bank website had been hacked and that there was no risk to transactions at the time of the website shutdown.

What the policy is actually trying to solve

The new policy sits on top of a cybersecurity framework Bangladesh Bank already issued in March 2026, which set out six functional areas, identify, protect, detect, respond, recover and reporting, for scheduled banks, finance companies, mobile financial service providers, payment service providers and payment system operators. Regulated institutions have until the end of December 2026 to implement that framework in full. The AI specific policy is meant to go further, addressing a problem the existing framework was not built for: artificial intelligence itself cuts both ways.

On one side, AI can help banks spot unusual transaction patterns faster than human analysts, flag likely fraud in real time and improve customer service through automated systems. On the other, the same technology lets criminals write far more convincing phishing messages, automate attacks at a scale no human fraud ring could match, and generate deepfake audio or video good enough to impersonate a customer or even a bank official over the phone. A committee of government officials, Bangladesh Bank staff, private sector representatives, university academics and independent IT experts has been assembled to work through those risks and recommend concrete guidelines.

"Cybersecurity is a continuous process, not a one time initiative," said Abdul Quaium Chowdhury, additional managing director of SBAC Bank PLC.

Earlier reporting on Bangladesh Bank's AI ambitions, from when the central bank first assembled a seven member ICT team to study the issue, suggested the bank also wants to build its own large language model so that sensitive financial data does not have to be sent to foreign AI providers for processing. That plan, framed around uses from inflation and GDP forecasting to credit and liquidity risk management, points to a central bank trying to capture the upside of AI for itself even as it writes rules to blunt the downside for the wider banking sector.

A sector that is mostly unprepared

The underlying numbers explain the urgency. A study by the Bangladesh Institute of Bank Management found that nearly 60 percent of banks in the country have no policy at all covering AI use in cybersecurity, and only about 40 percent have any guidelines whatsoever on the subject. That leaves a majority of the sector exposed at exactly the moment criminals are gaining access to cheaper and more capable AI tools. Implementing real AI defences, as the central bank's own officials acknowledge, is not free: it requires investment in security software, hiring or training skilled staff, running regular vulnerability assessments, and vetting third party vendors whose systems plug into a bank's own network.

What it means for you

For an ordinary bank customer, this is not a story about your money being at risk today. Bangladesh Bank and bank spokespeople have been consistent that no customer transactions were compromised during the October website shutdown, and the new policy is explicitly a forward looking, preventive measure rather than a response to an actual breach. The more practical takeaway is about vigilance on your own end. As banks lean harder on AI for fraud detection, criminals are leaning just as hard on AI to make scam calls, fake customer service messages and phishing links look more convincing than ever. Treat any unexpected call or message asking you to confirm account details, OTPs or card numbers with the same suspicion you always should, regardless of how polished or personalised it sounds.

For businesses, especially smaller ones that rely on digital banking and mobile financial services for payroll or supplier payments, the policy is worth tracking once Bangladesh Bank publishes it, since it will likely set expectations for how banks vet AI powered tools and vendors, and that in turn shapes what kind of security questions your own bank may start asking you.

The bottom line

Bangladesh Bank's AI cybersecurity policy is still a work in progress, with a committee rather than a finished document, and "soon" rather than a hard deadline. But the direction is clear: after a year that included a major website shutdown over a global software flaw and growing evidence that most local banks have no AI security policy to speak of, the central bank is trying to get ahead of a threat that is evolving faster than most of the sector's defences.