BB issues draft regulation for payment system operators, sets Tk30 lakh fine for merchant liability shortfall

Highlights

• Directors, CEOs, and treasury officers personally liable for TSA shortfalls
• If shortfall exceeds 14 days, an extra Tk10,000 per day fine applies
• New regulation will be integrated to Payment and Settlement Systems Act, 2024
• Major PSOs in Bangladesh: SSLCOMMERZ, shurjoPay, IT Consultants Ltd, aamarPay, PayStation

The Bangladesh Bank has published the full draft of the Payment System Operator (PSO) Regulation 2025, outlining stricter financial and operational requirements for licensed PSOs, including a fine of up to Tk30 lakh for any shortfall in their Trust and Settlement Account (TSA) balance.

According to the draft, each PSO must maintain, at the end of every business day, a sufficient balance in its TSA to cover all outstanding merchant liabilities. 

Any shortfall in this account will attract a penalty equivalent to either the prevailing Standing Lending Facility rate – currently 11.50% – or Tk30 lakh, whichever is lower.

Additionally, the directors, CEO, and treasury officers will be held personally liable for any TSA shortfall. If the shortfall continues for more than 14 days, an additional fine of Tk10,000 per day will apply.

The central bank recently published the draft regulation seeking public feedback. After consultations with stakeholders, a committee will finalise the regulation.

According to a senior official from the relevant BB department, the regulation will be integrated with the Payment and Settlement Systems Act, 2024.

PSOs, acting as intermediaries, provide payment channels that facilitate acquiring, processing, and clearing of payment instructions, as well as settlement of obligations. However, they are not permitted to issue e-money, and all settlements must occur through scheduled commercial banks.

Currently, authorised PSO services include merchant acquiring, ATM acquiring, and payment switching. Prominent PSOs operating in Bangladesh include SSLCOMMERZ Ltd, shurjoPay, IT Consultants Ltd, aamarPay, and PayStation.a

Licensing, capital requirements

To qualify for a licence, a company must be incorporated under the Companies Act 1994, with payment services explicitly mentioned in its Memorandum of Association. 

The licensing process will be completed in two stages – first by obtaining a No Objection Certificate (NOC) and then the main licence. The application fee is Tk50,000, while the licence fee is Tk5 lakh. A licensed PSO must commence operations within 120 days, according to the draft.

Minimum capital requirements vary by service type – Tk1 crore for digital merchant acquiring and up to Tk20 crore for ATM/CRM services. 

Additionally, PSOs must maintain ongoing capital equivalent to 0.3% of their average monthly transaction volume (over the past 12 months) for merchant acquiring and payment initiation, and 0.1% for switching, ATM, and card scheme services.

Governance, management standards

According to the draft, each PSO must have a board of at least five members, two-thirds of whom must be non-executive directors. The chairman must also be a non-executive member. 

Moreover, board members must have a minimum of five years of professional experience and meet integrity standards. Directors cannot be loan defaulters or hold positions in any other PSO simultaneously.

The CEO or managing director must have a graduate degree and five years of experience in finance, payments, fintech, IT, or telecom — including at least two years in a senior leadership role. Appointment of a CEO requires prior approval from Bangladesh Bank, along with a background check, educational verification, and CIB report.

Operational, compliance rules

PSOs are required to complete KYC verification for all merchants, maintain written settlement agreements, and ensure that sales proceeds are settled within five working days. Cash settlement is strictly prohibited.

ATM and CRM outlets must be located in secure and accessible areas, with downtime not exceeding 12 hours in urban areas or 24 hours in rural areas without prior approval. A central monitoring system will be mandatory.

Risk management, supervision

As per the draft, each PSO must establish a comprehensive risk management framework covering liquidity, operational, custody, fraud, and money laundering risks. Boards will define risk appetite and strategy, while senior management will oversee implementation, monitoring, and stress testing.

Sponsor shareholders will be prohibited from transferring shares within five years without central bank approval. PSOs will be subject to both off-site and on-site inspections by Bangladesh Bank.

Any customer charges will require prior approval from the central bank, and all transaction data must be preserved for at least 12 years.

If a major operational incident occurs, PSOs must report it within 24 hours, and any data breach must be reported within 72 hours.