SEBON Introduces IT Policy to Strengthen Cybersecurity in Nepal’s Capital Market

The Securities Board of Nepal (SEBON) has introduced an Information Technology Policy, 2083 to strengthen cybersecurity and prevent potential cyberattacks in Nepal’s stock market. The policy, which came into effect on 4 November 2026 (Kartik 18, 2083 BS), replaces the outdated 2076 BS guidelines and introduces mandatory security standards for all market participants.

The policy comes after a ransomware attack targeted Nepal’s stock market infrastructure, prompting SEBON to act swiftly to protect investors, brokers, and the broader financial system.

What is the SEBON IT Policy 2083?

The SEBON IT Policy 2083 (नेपाल धितोपत्र बोर्ड सूचना प्रविधि नीति, २०८३) is a regulatory framework requiring market institutions to meet minimum cybersecurity standards. It applies to the Nepal Stock Exchange (NEPSE), securities brokers, clearing and settlement institutions, and other market participants.

Key requirements

Requirement	Details
ISO/IEC 27001 certification	Mandatory for critical market institutions
Annual IT audit	Required for market infrastructure institutions
Biennial audit	Required for brokers and rating agencies
Disaster recovery site	Minimum 25 km from primary data centre
Data sovereignty	All exchange data must be stored within Nepal
Incident reporting	Same-day for catastrophic incidents, 72 hours for lesser ones
Immutable backups	Read-only, unalterable data backups required
Air-gapped backups	Offline backups disconnected from the internet

Why SEBON introduced the policy

The policy was introduced following a ransomware attack on Nepal’s stock market infrastructure, which highlighted serious gaps in cybersecurity preparedness.nepalontheweb+1

A ransomware attack can block access to brokers’ trading systems, client details, and other data required to conduct transactions, making it a direct threat to market stability.notifynepal

Background: NEPSE ransomware attack

Nepal’s stock market experienced a ransomware attack that exposed vulnerabilities in the trading system and related infrastructure. In response, NEPSE prepared a cybersecurity report with recommendations, which SEBON incorporated into the new IT policy.notifynepal

What the policy requires

1. ISO/IEC 27001 certification

Critical market institutions like NEPSE and CDS and Clearing Limited (CDSC) must obtain ISO/IEC 27001 certification, the globally recognised standard for information security management.

2. Disaster recovery and business continuity

Market institutions must establish disaster recovery mechanisms and business continuity plans to ensure trading and related services can resume after cyberattacks, technical failures, or other disruptions.

A disaster recovery site must be at least 25 km from the primary data centre, providing a buffer against localised disasters like earthquakes.

3. Data sovereignty

All securities and commodities exchange data must be stored exclusively within Nepal’s borders, protecting sensitive financial data from foreign jurisdictions and external cloud breaches.

4. Regular audits and testing

Annual IT audits for market infrastructure institutions
Biennial audits for brokers and rating agencies
Regular vulnerability assessments and penetration testing
Stress testing and disaster recovery drills

Audit reports must be submitted to SEBON within three months, and sensitive findings must be addressed within 30 days.

5. Incident reporting portal

SEBON plans to establish an integrated cyber incident reporting portal through which market institutions must report cyberattacks and other security incidents.

Catastrophic incidents: Report same day
Lesser incidents: Report within 72 hours

6. Stronger backup strategies

The policy mandates a multilayered backup strategy including:

Immutable snapshots — read-only data that cannot be altered or deleted
Air-gapped backups — offline backups disconnected from the internet or primary network

These measures protect against ransomware and malware that could encrypt or destroy backups.

7. Outsourced service oversight

Contracts with external service providers must include:

Service-level agreements (SLAs)
Data security and confidentiality provisions
Liability arrangements
Audit and inspection rights
Exit strategiese

Who must comply?

Institution type	Compliance requirement
NEPSE, CDSC (critical infrastructure)	ISO 27001, annual audit
Brokers, rating agencies	Biennial audit, minimum IT standards
All market participants	Incident reporting, backup requirements

Impact on Nepal’s capital market

For investors

Better protection of trading accounts and personal data
More reliable trading systems with backup and recovery
Faster incident response if attacks occur
Increased confidence in Nepal’s financial markets

For brokers and market institutions

Higher compliance costs for certification, audits, and infrastructure
Need for skilled cybersecurity staff
Mandatory investment in disaster recovery and backup systems
Stricter oversight from SEBON

For Nepal’s digital economy

Stronger cybersecurity culture across the financial sector
More investment in cybersecurity infrastructure and talent
Improved resilience against future cyberattacks
Better alignment with international standards

Connection to Nepal’s broader cybersecurity push

The SEBON policy is part of a broader push to strengthen Nepal’s digital infrastructure:

Nepal Oil Corporation is nearing ERP completion and plans AI integration and a data centre.
Kathmandu is hosting its first BSides cybersecurity conference in November.
Over 42,000 youths applied for free online AI training within 24 hours, showing growing interest in digital skills.
Nepal and Pakistan are exploring cooperation in AI and digital connectivity.

What happens next?

Market institutions must begin compliance efforts immediately
SEBON will establish the incident reporting portal
Audits and certifications will be rolled out over the coming months
Further policy refinements may follow based on implementation feedback
Investors should expect more secure but potentially more regulated trading systems

This is a developing story. Global IT Services will update this article as implementation details emerge.

Frequently Asked Questions

What is the SEBON IT Policy 2083?

The SEBON IT Policy 2083 (नेपाल धितोपत्र बोर्ड सूचना प्रविधि नीति, २०८३) is a regulatory framework requiring market institutions to meet minimum cybersecurity standards, including ISO 27001 certification, disaster recovery, and incident reporting.

When did the policy come into effect?

The policy came into effect on 4 November 2026 (Kartik 18, 2083 BS).

Who must comply with the policy?

NEPSE, CDS and Clearing Limited (CDSC), securities brokers, clearing and settlement institutions, and other market participants must comply.

Is ISO 27001 certification mandatory?

Yes, for critical market institutions like NEPSE and CDSC.

What happens if there's a cyberattack?

Institutions must report incidents through SEBON's portal—same day for catastrophic incidents, within 72 hours for lesser ones—and take steps to contain, restore, and prevent recurrence.

Does this affect regular investors?

Indirectly, yes. Investors benefit from more secure trading systems, better data protection, and faster incident response, though brokers may pass some compliance costs to clients.

Where is data stored under the new policy?

All securities and commodities exchange data must be stored exclusively within Nepal's borders (data sovereignty requirement).

SEBON Introduces IT Policy to Strengthen Cybersecurity in Nepal’s Capital Market

What is the SEBON IT Policy 2083?

Key requirements

Why SEBON introduced the policy

Background: NEPSE ransomware attack

What the policy requires

1. ISO/IEC 27001 certification

2. Disaster recovery and business continuity

3. Data sovereignty

4. Regular audits and testing

5. Incident reporting portal

6. Stronger backup strategies

7. Outsourced service oversight

Who must comply?

Impact on Nepal’s capital market

For investors

For brokers and market institutions

For Nepal’s digital economy

Connection to Nepal’s broader cybersecurity push

What happens next?

Frequently Asked Questions

What is the SEBON IT Policy 2083?

When did the policy come into effect?

Who must comply with the policy?

Is ISO 27001 certification mandatory?

What happens if there's a cyberattack?

Does this affect regular investors?

Where is data stored under the new policy?

Sources

Business & Finance Nepal

SEBON Introduces IT Policy to Strengthen Cybersecurity in Nepal’s Capital Market