Bangladesh

PDPA 2026 s.5 makes consent the main lawful basis: it must be voluntary, specific, clear and withdrawable, the data subject must be told the purpose, retention period, transfers and withdrawal process, and the fiduciary must prove it. Section 5(3) lists cases needing no consent. Data subjects have access and portability (s.11), correction (s.12, concerned parties told within 30 days of a correction) and withdrawal of consent and erasure (s.13). Section 15(2) adds transparency information. Response times for access and erasure are left to regulations.

The guideline requires banks and finance companies to disclose sustainability and climate-related information in the annual report from the financial year starting January 2024 (s.5) and to make semi-annual submissions to Bangladesh Bank's Sustainable Finance Department (s.8(c)). Section 9 requires limited assurance on the reported information in the annual report.

FE Circular No. 24 of 15 September 2022 tells banks, authorised dealers, mobile financial service providers and financial institutions to refrain from dealing in virtual assets and virtual currencies and from facilitating their exchange, transfer or trading. It also bars retaining export proceeds abroad in any form, including crypto. No licensing route for virtual asset service providers was found.

MLPA 2012 s.25(1)(gha) requires a reporting organisation to file a suspicious transaction report with the BFIU, on its own initiative and without delay, when it notices a suspicious transaction or an attempt at one. Section 25(2) allows a fine of BDT 50,000 to 2.5 million, and cancellation of the licence or permission to operate or referral to the licensing authority, for breach of s.25(1).

MLPA 2012 s.25(1)(kha) requires reporting organisations to keep a customer's account and transaction records for at least five years after the account is closed, and s.25(1)(ga) to give them to the BFIU when asked.