SEBON Introduces IT Policy to Strengthen Cybersecurity in Nepal’s Capital Market

The Securities Board of Nepal (SEBON) has introduced an Information Technology Policy, 2083 to strengthen cybersecurity and prevent potential cyberattacks in Nepal’s stock market. The policy, which came into effect on 4 November 2026 (Kartik 18, 2083 BS), replaces the outdated 2076 BS guidelines and introduces mandatory security standards for all market participants.

The policy comes after a ransomware attack targeted Nepal’s stock market infrastructure, prompting SEBON to act swiftly to protect investors, brokers, and the broader financial system.

What is the SEBON IT Policy 2083?

The SEBON IT Policy 2083 (नेपाल धितोपत्र बोर्ड सूचना प्रविधि नीति, २०८३) is a regulatory framework requiring market institutions to meet minimum cybersecurity standards. It applies to the Nepal Stock Exchange (NEPSE), securities brokers, clearing and settlement institutions, and other market participants.

Key requirements

Why SEBON introduced the policy

The policy was introduced following a ransomware attack on Nepal’s stock market infrastructure, which highlighted serious gaps in cybersecurity preparedness.nepalontheweb+1

A ransomware attack can block access to brokers’ trading systems, client details, and other data required to conduct transactions, making it a direct threat to market stability.notifynepal

Background: NEPSE ransomware attack

Nepal’s stock market experienced a ransomware attack that exposed vulnerabilities in the trading system and related infrastructure. In response, NEPSE prepared a cybersecurity report with recommendations, which SEBON incorporated into the new IT policy.notifynepal

What the policy requires

1. ISO/IEC 27001 certification

Critical market institutions like NEPSE and CDS and Clearing Limited (CDSC) must obtain ISO/IEC 27001 certification, the globally recognised standard for information security management.

2. Disaster recovery and business continuity

Market institutions must establish disaster recovery mechanisms and business continuity plans to ensure trading and related services can resume after cyberattacks, technical failures, or other disruptions.

A disaster recovery site must be at least 25 km from the primary data centre, providing a buffer against localised disasters like earthquakes.

3. Data sovereignty

All securities and commodities exchange data must be stored exclusively within Nepal’s borders, protecting sensitive financial data from foreign jurisdictions and external cloud breaches.

4. Regular audits and testing

• Annual IT audits for market infrastructure institutions

• Biennial audits for brokers and rating agencies

• Regular vulnerability assessments and penetration testing

• Stress testing and disaster recovery drills

Audit reports must be submitted to SEBON within three months, and sensitive findings must be addressed within 30 days.

5. Incident reporting portal

SEBON plans to establish an integrated cyber incident reporting portal through which market institutions must report cyberattacks and other security incidents.

• Catastrophic incidents: Report same day

• Lesser incidents: Report within 72 hours

6. Stronger backup strategies

The policy mandates a multilayered backup strategy including:

• Immutable snapshots — read-only data that cannot be altered or deleted

• Air-gapped backups — offline backups disconnected from the internet or primary network

These measures protect against ransomware and malware that could encrypt or destroy backups.

7. Outsourced service oversight

Contracts with external service providers must include:

• Service-level agreements (SLAs)

• Data security and confidentiality provisions

• Liability arrangements

• Audit and inspection rights

• Exit strategiese

Who must comply?

Impact on Nepal’s capital market

For investors

• Better protection of trading accounts and personal data

• More reliable trading systems with backup and recovery

• Faster incident response if attacks occur

• Increased confidence in Nepal’s financial markets

For brokers and market institutions

• Higher compliance costs for certification, audits, and infrastructure

• Need for skilled cybersecurity staff

• Mandatory investment in disaster recovery and backup systems

• Stricter oversight from SEBON

For Nepal’s digital economy

• Stronger cybersecurity culture across the financial sector

• More investment in cybersecurity infrastructure and talent

• Improved resilience against future cyberattacks

• Better alignment with international standards

Connection to Nepal’s broader cybersecurity push

The SEBON policy is part of a broader push to strengthen Nepal’s digital infrastructure:

• Nepal Oil Corporation is nearing ERP completion and plans AI integration and a data centre.

• Kathmandu is hosting its first BSides cybersecurity conference in November.

• Over 42,000 youths applied for free online AI training within 24 hours, showing growing interest in digital skills.

• Nepal and Pakistan are exploring cooperation in AI and digital connectivity.

What happens next?

• Market institutions must begin compliance efforts immediately

• SEBON will establish the incident reporting portal

• Audits and certifications will be rolled out over the coming months

• Further policy refinements may follow based on implementation feedback

• Investors should expect more secure but potentially more regulated trading systems

This is a developing story. Global IT Services will update this article as implementation details emerge.

Frequently Asked Questions

What is the SEBON IT Policy 2083?

The SEBON IT Policy 2083 (नेपाल धितोपत्र बोर्ड सूचना प्रविधि नीति, २०८३) is a regulatory framework requiring market institutions to meet minimum cybersecurity standards, including ISO 27001 certification, disaster recovery, and incident reporting.

When did the policy come into effect?

The policy came into effect on 4 November 2026 (Kartik 18, 2083 BS).

Who must comply with the policy?

NEPSE, CDS and Clearing Limited (CDSC), securities brokers, clearing and settlement institutions, and other market participants must comply.

Is ISO 27001 certification mandatory?

Yes, for critical market institutions like NEPSE and CDSC.

What happens if there's a cyberattack?

Institutions must report incidents through SEBON's portal—same day for catastrophic incidents, within 72 hours for lesser ones—and take steps to contain, restore, and prevent recurrence.

Does this affect regular investors?

Indirectly, yes. Investors benefit from more secure trading systems, better data protection, and faster incident response, though brokers may pass some compliance costs to clients.

Where is data stored under the new policy?

All securities and commodities exchange data must be stored exclusively within Nepal's borders (data sovereignty requirement).

Sources

• SEBON — Press Release: नेपाल धितोपत्र बोर्ड सूचना प्रविधि नीति, 2083sebon.gov

• OnlineKhabar — SEBON introduces IT policy to strengthen cybersecurity

• My Republica — SEBON steps up effort to prevent cyber attacks

• Nepal on the Web — SEBON introduces new cybersecurity policy

• NEPSE Trading — Securing the Bourse: SEBON Mandates Data Sovereignty

• HamroPatro — SEBON rolls out IT policy

• Notify Nepal — NEPSE’s cybersecurity report

• Clickmandu — SEBON mandates Rs 200 million capital for brokers