Kathmandu – The Securities Board of Nepal (SEBON) has introduced a new Information Technology Policy to strengthen cybersecurity across the country’s capital market following a ransomware attack that disrupted stock trading in September.
The policy, which came into effect on November 4, 2026, aims to improve the security and reliability of digital systems used by the Nepal Stock Exchange (NEPSE), securities brokers, clearing and settlement institutions, and other market participants.
The decision follows a September 21 trading suspension caused by a ransomware attack affecting a data centre that hosted trading systems used by several brokerage firms. The incident raised concerns about the security of Nepal’s stock market infrastructure and its ability to recover from cyberattacks.
Under the new policy, critical market institutions must establish disaster recovery mechanisms and business continuity plans to ensure that trading and related services can resume following cyberattacks, technical failures or other disruptions.
The policy also introduces stronger security standards, including ISO/IEC 27001 certification requirements, regular system audits, vulnerability assessments and penetration testing to identify potential weaknesses in digital infrastructure.
SEBON plans to establish an integrated cyber incident reporting portal through which market institutions will report cyberattacks and other security incidents. Institutions will also be expected to respond promptly, contain threats and restore affected systems.
The framework strengthens oversight of outsourced technology services. Agreements with external providers must address service standards, data protection, confidentiality, audit rights, responsibilities and arrangements for ending service contracts.
Market institutions will be subject to different security requirements based on their functions. The policy also calls for stronger monitoring of cyber threats and improved arrangements for backing up and recovering important market data.
SEBON is considering the development of shared data infrastructure to improve the management and protection of securities market information.
The policy additionally promotes the use of emerging technologies, including artificial intelligence, regulatory technology and supervisory technology, to improve market oversight and institutional efficiency.
Through these measures, the securities regulator aims to reduce technology-related risks, strengthen investor confidence and make Nepal’s capital market more secure, reliable and resilient against future cyber threats.
