Answer

Introduction

Information technology has transformed banking from branch-based manual operations to branchless, real-time digital banking (mobile banking, internet banking, ATMs, QR payments, card networks and core banking systems). In Nepal, this shift has been driven by Nepal Rastra Bank's payment systems policy and the rapid growth of digital transactions. While IT has brought speed, convenience and financial inclusion, it has also introduced new and serious risks. For a bank, IT risk is no longer a technical matter alone — it is a core operational, financial and reputational risk that must be governed at board level.

Risks Associated with Widespread Use of IT in Banking

1. Cyber security and hacking risk. Banks hold sensitive customer data and control large funds. Phishing, vishing, SIM swapping, malware, ransomware and Distributed Denial of Service (DDoS) attacks can steal credentials, freeze systems or transfer funds fraudulently. Recent ATM and card-skimming frauds in Nepal illustrate this risk.

2. Data privacy and confidentiality risk. Loss, leakage or unauthorized sharing of customer data violates privacy and banking secrecy, inviting legal action, regulatory penalty and loss of customer trust.

3. Operational and system failure risk. Core banking system (CBS) downtime, server failure, network outage, power failure or software bugs can halt transactions, cause wrong postings and damage customer confidence. Dependence on a single data centre or vendor increases this risk.

4. Third-party and outsourcing risk. Banks depend on vendors for CBS, ATMs, switches, cloud services and payment gateways. Vendor failure, weak service-level agreements (SLAs) or vendor lock-in can disrupt services.

5. Fraud and insider risk. Employees with privileged access can manipulate data, create ghost accounts or leak information. Weak segregation of duties and poor audit trails enable internal fraud.

6. Money laundering and terrorist financing risk. Digital channels allow rapid, anonymous and cross-border movement of funds, making AML/CFT monitoring more difficult.

7. Reputational and financial risk. A single high-profile breach can trigger mass withdrawal of deposits, regulatory sanctions, litigation and sharp share price fall.

8. Compliance and regulatory risk. Failure to meet Nepal Rastra Bank's IT guidelines, payment system directives, AML/CFT obligations and data localization requirements attracts penalties and licence-related action.

9. Business continuity risk. Natural disasters, pandemics, cyber-attacks or sabotage can disable critical systems if no tested recovery plan exists.

10. Human resource and skill risk. Shortage of trained IT and cyber security manpower, and low digital literacy among customers, increase vulnerability (social engineering, weak passwords, sharing of OTPs).

Measures for Minimizing These Risks

1. Strong IT governance and risk management framework.

   • Board-approved IT policy, IT security policy and risk appetite statement.
   • IT Steering Committee and Chief Information Security Officer (CISO) with independent reporting to the board.
   • Periodic IT risk assessment, risk register and key risk indicators (KRIs).

2. Robust cyber security controls.

   • Multi-factor authentication (MFA) for all digital channels and privileged accounts.
   • Encryption of data at rest and in transit; strong password and OTP policy.
   • Firewalls, intrusion detection/prevention systems, anti-malware, endpoint protection and regular patch management.
   • Security Operations Centre (SOC) for 24×7 monitoring; regular vulnerability assessment and penetration testing (VAPT).
   • Cyber incident response plan with defined escalation and reporting to Nepal Rastra Bank.

3. Data privacy and protection measures.

   • Data classification, access control on least-privilege principle, and data masking.
   • Compliance with privacy laws and banking secrecy; strict rules on sharing data with third parties.
   • Secure disposal of storage media and logs.

4. Strengthening operational resilience.

   • Redundant data centre / disaster recovery (DR) site at a geographically separate location.
   • Regular backup with off-site storage and periodic restoration testing.
   • Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP), tested at least annually.
   • Capacity planning and performance monitoring to avoid overload.

5. Vendor and outsourcing management.

   • Due diligence before selecting vendors; clear SLAs with security, availability and penalty clauses.
   • Right to audit vendor systems; exit strategy to avoid vendor lock-in.
   • Periodic review of third-party performance and security posture.

6. Internal control and fraud prevention.

   • Segregation of duties, maker–checker system, and rotation of staff on sensitive posts.
   • Comprehensive audit trails and log retention; monitoring of privileged user activity.
   • Surprise inspection, internal audit and concurrent audit of digital transactions.
   • Whistle-blower policy and disciplinary action for insider fraud.

7. AML/CFT and transaction monitoring.

   • Automated AML/CFT software for real-time monitoring and suspicious transaction reporting (STR).
   • KYC and customer due diligence, including for mobile and internet banking users.
   • Threshold-based alerts and periodic review of high-risk accounts.

8. Customer awareness and protection.

   • Public awareness campaigns on phishing, OTP sharing, safe passwords and reporting of fraud.
   • 24×7 helpline and quick card/account blocking facility.
   • Clear grievance redressal mechanism and compensation policy for unauthorised transactions.

9. Regulatory compliance and supervision.

   • Adherence to Nepal Rastra Bank's IT Guidelines, Payment Systems and Settlement Bylaws, and AML/CFT directives.
   • Timely submission of IT audit reports and incident reports.
   • Cooperation with NRB's off-site and on-site supervision and with the National Payment Switch.

10. Human resource development.

    • Continuous training and certification of IT and cyber security staff.
    • Digital literacy programmes for branch staff and customers.
    • Adequate budget for IT security and succession planning for key IT personnel.

11. Use of advanced technology.

    • Artificial intelligence and machine learning for fraud detection and anomaly alerts.
    • Biometric authentication, tokenisation and blockchain-based settlement where feasible.
    • Security Information and Event Management (SIEM) tools for centralised log analysis.

Conclusion

The widespread use of IT in banking is irreversible and beneficial, but it must be matched by equally strong risk management. A layered defence — sound governance, robust cyber security, resilient infrastructure, strict internal control, effective AML/CFT, customer awareness and regulatory compliance — can reduce IT risks to an acceptable level. For Nepal's banking sector, the priority is to build a strong cyber security culture, invest in skilled manpower and technology, and ensure strict compliance with Nepal Rastra Bank's directives so that digital banking remains safe, trustworthy and sustainable.

The objectives of Nepal Rastra Bank are laid down in Section 4 of the Nepal Rastra Bank Act, 2058 (2002). The Act states the primary objective and a set of supporting objectives as follows:

Primary objective

• To maintain price stability and balance of payments (external sector) stability in order to promote sustainable economic development of the country.

Supporting / secondary objectives

1. To formulate and implement monetary policy in a manner consistent with the primary objective.
2. To issue and manage currency notes and coins (banknotes and coins) as the sole issuing authority.
3. To act as the banker, adviser and financial agent of the Government of Nepal — handling government accounts, receipts and payments, and advising on economic and financial matters.
4. To act as the banker of the banks and financial institutions, including holding their reserves and providing lender-of-last-resort facilities.
5. To regulate, supervise and inspect banks and financial institutions, and to maintain the soundness, stability and reliability of the banking and financial system.
6. To determine and manage the exchange rate system and foreign exchange reserves of the country.
7. To promote and develop a secure, healthy and efficient system of payment, clearing and settlement.
8. To develop and strengthen the money market, capital market and the overall financial system in a manner conducive to the country's economic development.
9. To maintain the stability of the financial system and to protect the interests of depositors and the general public.
10. To carry out such other functions as are necessary to achieve the above objectives, including acting as the central depository of the nation's foreign exchange reserves.

In short: the core objective of Nepal Rastra Bank is to maintain price stability and balance of payments stability for sustainable economic development, and all its other objectives — currency issue, monetary policy, banker to government and banks, regulation and supervision of the financial sector, exchange rate and reserve management, and payment system development — are directed towards fulfilling that core objective.

Conditions for buy-back of own shares by a bank or financial institution (BFI)

A company may buy back its own shares only under the conditions of the Companies Act, 2063, and a BFI is further regulated by Nepal Rastra Bank (NRB) under the Banks and Financial Institutions Act and NRB directives. A BFI may buy back its shares only when the following conditions are met.

1. Authority in the Articles of Association — the AGM and the company's articles must permit buy-back.
2. Special resolution of the general meeting — shareholders must approve the buy-back by a special resolution.
3. Prior approval of NRB — a BFI must obtain NRB's approval before buying back shares.
4. Fully paid-up shares only — partly paid shares cannot be bought back.
5. Source of funds — payment must come from free reserves or distributable profit, not from capital or statutory reserves.
6. Solvency — after the buy-back the BFI must be able to pay its debts, deposits and other liabilities as they fall due.
7. Capital requirements maintained — the minimum paid-up capital and capital adequacy ratio prescribed by NRB must still be met.
8. Compliance record — the BFI must not be in default of NRB directives or under corrective action or similar regulatory restriction.
9. Prescribed limit and procedure — the number of shares, price, disclosure and reporting must follow the limits and procedure set by law and NRB.
10. Cancellation of shares — the shares bought back must be cancelled and the paid-up capital reduced accordingly within the prescribed period.

Conclusion: buy-back is allowed only with shareholder and NRB approval, from free reserves, and when the BFI remains solvent and well capitalised, so that depositors' and creditors' interests are protected.

Money laundering offences and punishments under the Money Laundering Prevention Act, 2064

Acts that constitute money laundering

A person commits the offence of money laundering if, knowing or having reason to believe that property is derived from a predicate (underlying) offence, he or she:

• converts or transfers the property in order to conceal or disguise its illicit origin, or to help another person evade legal consequences;
• conceals or disguises the true nature, source, location, disposition, movement or ownership of the property;
• acquires, possesses or uses the property while knowing, at the time of receipt, that it was derived from a predicate offence;
• attempts, aids, abets, conspires or counsels to commit any of the above.

Predicate offences are those listed in the Act, including corruption and abuse of authority, tax and customs evasion, foreign-exchange offences, narcotics, human trafficking, terrorism and organised crime, arms and smuggling offences, forgery, counterfeiting, fraud, kidnapping and other offences prescribed by the Government of Nepal.

Punishment

Cases are investigated by the Department of Money Laundering Investigation and prosecuted by the Government of Nepal. Financial institutions must report suspicious and threshold transactions to the Financial Information Unit (FIU) of Nepal Rastra Bank.

Conclusion: Nepal treats money laundering as a serious crime, punishing it with imprisonment, fines equal to the laundered amount and confiscation of the property, so that crime does not pay.

Banking Offence

Meaning: A banking offence is any act or omission punishable under the Banking Offence and Punishment Act, 2064 (2008) — i.e. any illegal act committed knowingly or with dishonest intention by a person, director, shareholder, auditor, employee or any other person against a bank or financial institution, or by a bank or financial institution itself, which harms or is likely to harm the property, assets, goodwill or the depositors' interest of that institution. In short, it is an offence relating to the misappropriation, embezzlement, fraud, forgery or misuse of the funds, assets and trust of a bank or financial institution.

The Act lists offences such as:

• Embezzlement or misappropriation of funds by directors, officials or employees (Sec. 4)
• Obtaining or attempting to obtain a loan by producing false or forged documents or by giving false security (Sec. 5)
• Misuse of authority or position to grant undue credit facilities (Sec. 6)
• Causing loss to the bank by negligence or by acting against the Act, rules or directives of Nepal Rastra Bank (Sec. 7)
• Obstructing or influencing an auditor, or refusing to submit records to NRB inspection (Sec. 8)
• Taking or giving a commission or bribe for granting a loan (Sec. 9)
• Not maintaining secrecy of depositors' accounts (Sec. 10)
• Issuing a cheque without sufficient balance (Sec. 13)
• Not returning the mortgaged property or documents after repayment of the loan (Sec. 14)
• Not submitting returns or statements to NRB within the prescribed time (Sec. 15)

Punishment ranges from fines to imprisonment depending on the gravity of the offence; for serious offences the Act provides imprisonment up to 10 years and a fine up to the amount embezzled or Rs 5 crore, whichever is higher. The Act also provides for special courts, recovery of the amount involved, and disqualification from holding office in a bank or financial institution.

Problems Faced in Implementation of the Banking Offence and Punishment Act, 2064

1. Lengthy legal process: Cases drag on for years through the Special Court and the Supreme Court. By the time a verdict is reached, the accused may have fled, the evidence may be lost, and the recovered amount is often negligible compared to the loss.

2. Weak enforcement and recovery: Even after conviction, recovery of embezzled funds is very difficult. Assets are often transferred in the names of relatives or benami persons before the case is filed, leaving nothing to attach.

3. Inadequate investigation capacity: The Nepal Police and the Special Court lack sufficient trained manpower, forensic accounting experts and modern technology to investigate complex banking frauds involving shell companies, cross-border transactions and digital channels.

4. Political and executive influence: Banks are closely linked with political leaders and business houses. Pressure is often exerted on investigators, prosecutors and even judges to weaken or delay cases. Many big loan scams have not reached a logical conclusion.

5. Ambiguity and gaps in the law: Some provisions are vague — for example, the distinction between "negligence" and "dishonest intention" in causing loss (Sec. 7) is not clearly defined. This gives room for interpretation and escape.

6. Dual regulatory overlap: NRB, the Special Court, the Commission for the Investigation of Abuse of Authority (CIAA) and the Nepal Police all have roles. Lack of coordination and unclear jurisdiction cause delay and duplication of work.

7. Non-cooperation of banks: Banks themselves often hesitate to report offences involving their own directors or big borrowers, fearing loss of reputation and depositor confidence. Internal settlement is preferred over legal action.

8. Insufficient punishment and weak deterrence: In many cases the fine imposed is small compared to the profit made from the offence, so the Act fails to act as a deterrent. Bail is easily obtained, and trials are delayed.

9. Lack of financial literacy and whistleblower protection: Depositors and junior staff often do not know their rights or the procedure to complain. Whistleblowers are not adequately protected, so offences remain hidden.

10. Rapid change in banking technology: The Act was drafted mainly for traditional banking. New risks such as digital fraud, ATM skimming, online loan fraud and cryptocurrency-related transactions are not adequately covered, making implementation outdated.

Conclusion: The Banking Offence and Punishment Act, 2064 is a progressive law in principle, but its effectiveness is limited by slow judicial process, weak investigation, political interference and inadequate recovery mechanisms. Strengthening the Special Court, building forensic capacity in NRB and the Police, ensuring whistleblower protection, and updating the Act to cover digital banking offences are essential for its proper implementation.