Legal Support for AI, Blockchain and Fintech in Bangladesh

Bangladesh is experiencing a rapid digital transformation, positioning itself as an emerging hub for technological innovation in South Asia. The convergence of Artificial Intelligence (AI), blockchain technology, and financial technology (Fintech) is reshaping the nation's economic landscape. From mobile financial services (MFS) dominating daily transactions to local startups developing AI-driven SaaS solutions and exploring decentralized ledger technologies, the digital economy is expanding at an unprecedented rate. However, this explosive growth necessitates robust legal frameworks to ensure innovation does not outstrip compliance.

Navigating the regulatory environment for emerging technologies in Bangladesh requires specialized legal expertise. The intersection of traditional corporate law, financial regulations enforced by the Bangladesh Bank, and digital security mandates under the Cyber Security Act creates a complex compliance matrix. Tech founders and investors must address issues ranging from algorithmic bias and data localization to the legality of smart contracts and tokenomics. Without proper legal structuring, innovative tech ventures risk severe regulatory penalties, operational shutdowns, or intellectual property theft.

As explained in Wikipedia's overview of financial technology, Fintech encompasses any technological innovation in the financial sector. In Bangladesh, this primarily manifests through MFS, digital lending, and payment gateways. Concurrently, Artificial Intelligence and Blockchain are being adopted to optimize supply chains, enhance cybersecurity, and automate services. The legal challenge lies in applying existing statutes—designed for a pre-digital era—to cutting-edge technologies.

This comprehensive guide outlines the essential legal support required for AI, blockchain, and fintech ventures in Bangladesh. It is designed for tech founders, software developers, venture capitalists, and international tech companies seeking to establish a compliant and scalable presence in the country. Engaging a specialized technology legal service in Bangladesh is strongly recommended to navigate this rapidly evolving regulatory frontier.

The legal framework governing emerging technologies in Bangladesh is a multi-tiered structure involving corporate registration, financial regulation, data protection, and digital security. Tech founders must navigate both national laws and the administrative guidelines issued by regulatory authorities to establish a legally sound enterprise.

Primary Legislation

• The Cyber Security Act, 2023 — The primary statute governing digital communications, cybercrimes, and data protection. It outlines the legal framework for digital signatures, electronic records, and penalties for cyber offenses, which is critical for both AI and blockchain operations.
• The Bank Company Act, 1991 & Financial Institutions Act, 1993 — Govern the broader financial sector. While traditional banks are regulated under these acts, fintech companies often partner with banks to provide services, requiring strict adherence to these regulations.
• The Companies Act, 1994 — The foundational statute for incorporating a tech startup as a private limited company or a One Person Company (OPC) in Bangladesh.
• The Copyright Act, 2000 — Governs the protection of software source code, databases, and algorithms. Unlike some jurisdictions, Bangladesh does not specifically patent software, making copyright the primary protection mechanism for AI code.
• Bangladesh Bank Guidelines on MFS and PSP — The central bank's regulatory frameworks for Mobile Financial Services and Payment Service Providers, dictating the operational boundaries for fintech companies.

According to Wikipedia's overview of AI regulation, governments worldwide are grappling with how to balance innovation with public safety. Bangladesh's framework broadly reflects this cautious approach, ensuring that while digital businesses can thrive, consumer data and financial stability are protected. Seeking the assistance of a qualified fintech and tech legal service is essential to navigate these overlapping legislative regimes effectively.

Selecting the appropriate legal vehicle is a critical strategic decision for tech founders in Bangladesh. The choice of entity dictates personal liability, the ability to raise venture capital, regulatory complexity, and tax exposure. For AI and blockchain startups, the structure must accommodate rapid scaling, employee stock options, and foreign direct investment.

Private Limited Company

A Private Limited Company is the globally recognized standard for venture-backed tech startups. Registered under the Companies Act, 1994, it requires a minimum of two shareholders and two directors. It offers limited liability protection, ensuring that the personal assets of the founders are shielded from business debts or regulatory fines. For tech startups looking to attract angel investors or institutional venture capital, a Private Limited Company is practically mandatory.

One Person Company (OPC)

Introduced via the Companies (Amendment) Act, 2020, an OPC allows a single founder to establish a company without needing a co-founder. This is ideal for solo AI developers or independent blockchain consultants who want the limited liability of a corporate entity. An OPC must convert to a Private Limited Company if its paid-up capital exceeds BDT 50 lakh or if it plans to issue shares to foreign investors.

Foreign Owned Tech Subsidiary

If an international tech company wishes to establish a blockchain or AI development center in Bangladesh, it can register a 100% foreign-owned subsidiary. This requires prior approval from the Bangladesh Investment Development Authority (BIDA). While foreign equity is generally encouraged in the IT sector, fintech subsidiaries face stricter scrutiny from the Bangladesh Bank regarding foreign shareholding caps and data localization.

Partnership Firm

A partnership is formed under the Partnership Act, 1932. It is relatively inexpensive to set up but partners have unlimited liability. This structure is generally discouraged for high-growth tech startups but may be suitable for small, localized IT consulting businesses. Consulting a qualified tech lawyer before drafting the incorporation documents is strongly advised to ensure the correct entity is chosen.

In the digital economy, contracts are the foundation of commercial relationships. For AI, blockchain, and fintech companies, standard service agreements are insufficient. These businesses require specialized tech contracts that address unique risks such as algorithmic liability, data breaches, API usage rights, and the execution of decentralized code.

SaaS and AI Service Agreements

Software-as-a-Service (SaaS) agreements for AI platforms must clearly define the boundaries of algorithmic decision-making. Unlike traditional software, AI models learn and evolve, which can lead to unpredictable outputs. The contract must include robust disclaimers regarding the accuracy of AI-generated content, limitations of liability, and specific warranties regarding the training data's legality. It must also address data ownership—clarifying whether the AI provider has the right to use client data to further train its models.

Smart Contracts and Legal Enforceability

A smart contract is a self-executing contract with the terms of the agreement directly written into code, typically running on a blockchain. As Wikipedia explains in its article on smart contracts, these protocols automatically enforce obligations without intermediaries. In Bangladesh, smart contracts occupy a legal gray area. While the Cyber Security Act, 2023 recognizes electronic records and digital signatures, the automatic execution of code without traditional signatures challenges the conventional requirements of the Contract Act, 1872. Legal practitioners must ensure that smart contracts are backed by a traditional "wrapper" agreement that outlines the parties' intent and jurisdiction.

API Terms of Service and Data Processing Agreements

Fintech platforms often rely on third-party APIs (e.g., bank APIs for balance checks). API usage agreements must define rate limits, data retention policies, and liability in case of API downtime. Furthermore, any tech company processing user data must have a Data Processing Agreement (DPA) in place, complying with the data protection principles outlined in the Cyber Security Act.

Open Source Compliance

Many blockchain and AI projects utilize open-source codebases (e.g., Linux, TensorFlow, Ethereum clients). Tech companies must ensure their use of open-source software complies with the respective licenses (like GPL or MIT) to avoid intellectual property contamination. Engaging an expert technology contract drafting service ensures that these digital agreements are legally robust and commercially balanced.

The fintech sector in Bangladesh is heavily regulated by the Bangladesh Bank (BB). Unlike general tech startups, fintech companies cannot simply incorporate and launch; they must obtain specific operational licenses. The regulatory approach is designed to protect consumer funds, prevent money laundering, and maintain macroeconomic stability.

Mobile Financial Services (MFS) License

MFS providers—like bKash and Nagad—dominate the digital payment landscape. Obtaining an MFS license from the Bangladesh Bank requires a joint venture between a bank and a mobile network operator (MNO) or a tech company. The stringent requirements include a minimum paid-up capital, strict KYC/AML protocols, and comprehensive data security architecture. The BB closely monitors the commission structures and fund float management of MFS providers.

Payment Service Provider (PSP) and Gateway Licenses

For tech startups focusing on online payment aggregation (like aamarPay or SSLCOMMERZ), a PSP or Payment Gateway license is required. The Bangladesh Bank's "Guidelines on Payment Service Provider (PSP) and Payment Service Provider-Aggregator (PSP-AG)" outline the licensing framework. Applicants must demonstrate robust IT infrastructure, PCI-DSS compliance, and a dispute resolution mechanism. The BB also mandates that customer funds be kept in an escrow account with a scheduled bank.

Digital Lending and Nano-Loans

Startups leveraging AI for alternative credit scoring and digital lending must partner with a licensed bank or Non-Bank Financial Institution (NBFI). The actual lending must be conducted under the NBFI's license, while the tech startup provides the software, algorithms, and customer interface. The Bangladesh Bank strictly regulates interest rate caps and loan recovery practices.

Regulatory Sandbox

The Bangladesh Bank has introduced a regulatory sandbox framework, allowing fintech startups to test innovative products in a controlled environment with a limited number of customers. Engaging a fintech licensing legal service is crucial for drafting the sandbox application and ensuring compliance with the BB's pilot testing conditions.

The regulatory environment for blockchain and cryptocurrencies in Bangladesh is highly nuanced. While the government actively promotes blockchain as an underlying technology for public services and supply chain optimization, it maintains a strict prohibition on the trading and use of cryptocurrencies as legal tender.

The Ban on Cryptocurrencies

The Bangladesh Bank has repeatedly issued circulars stating that using Bitcoin, Ethereum, or any other cryptocurrency as a medium of exchange is illegal under the Foreign Exchange Regulation Act, 1947 and the Money Laundering Prevention Act, 2012. The central bank's primary concern is the inability to regulate cross-border crypto transactions, which poses severe risks of capital flight and money laundering. Tech startups must explicitly avoid incorporating crypto payment gateways or token-based crowdfunding (ICOs) into their business models.

Blockchain as an Enterprise Technology

While crypto is banned, blockchain technology itself is legal and encouraged. Startups developing enterprise blockchain solutions—such as land registry management, supply chain tracking, or digital identity verification—can operate freely. The government's ICT Division and the a2i program have piloted several blockchain projects to enhance transparency in public service delivery.

Non-Fungible Tokens (NFTs) and Digital Assets

The legal status of NFTs in Bangladesh remains undefined. While they are not explicitly banned like cryptocurrencies, their trading falls into a legal gray area regarding capital gains tax and intellectual property rights. Tech founders exploring NFT marketplaces must tread carefully, ensuring they do not facilitate secondary trading that could be construed as an unlicensed securities exchange.

Smart Contract Audits

For startups deploying decentralized applications (dApps), it is critical to have smart contracts legally and technically audited. An experienced blockchain legal advisory service can review the code's legal logic, ensuring it does not inadvertently violate the country's financial regulations.

Artificial Intelligence relies heavily on vast datasets to train its models. In Bangladesh, the legal framework governing data protection is primarily embedded within the Cyber Security Act, 2023 (CSA), with a dedicated Personal Data Protection Act (PDPA) currently in draft stages. AI startups must navigate these regulations to avoid severe penalties for unauthorized data scraping or privacy breaches.

Consent and Data Collection

Under the CSA, the collection of personal data requires explicit consent from the data subject. AI startups developing facial recognition, sentiment analysis, or healthcare prediction models must ensure their data collection mechanisms include clear opt-in clauses. The law restricts the collection of data beyond what is strictly necessary for the stated purpose, challenging the "collect first, ask later" approach common in big data analytics.

Algorithmic Bias and Discrimination

While Bangladesh does not yet have specific AI anti-discrimination laws, general constitutional protections against bias apply. If an AI model used for hiring, loan approval, or university admissions produces biased outcomes based on gender, religion, or ethnicity, the startup could face public backlash and legal challenges. Ethical AI deployment requires auditing training data for historical biases and implementing fairness metrics.

Data Localization vs. Cross-Border Transfer

The proposed PDPA is expected to introduce strict data localization requirements, mandating that critical personal data of Bangladeshi citizens be stored on servers physically located within the country. AI startups currently using cloud infrastructure like AWS or Google Cloud (which may route data through Singapore or India) must prepare architecturally for these changes. An experienced data protection legal service can assist in structuring data architecture to comply with localization norms.

Deepfakes and AI-Generated Content

The Cyber Security Act contains stringent provisions against the dissemination of fake or defamatory content. AI startups generating synthetic media (deepfakes, AI voice cloning) must implement safeguards to prevent the misuse of their technology for fraud or defamation, which are criminal offenses in Bangladesh.

For AI, blockchain, and fintech startups, intellectual property (IP) is often their most valuable asset. Protecting algorithms, source code, and brand identity is essential to maintain a competitive edge and attract investors. In Bangladesh, IP protection is governed by the Copyright Act, 2000, the Trademarks Act, 2009, and the Patents and Designs Act, 1911.

Copyright Protection for Software and AI Models

Unlike some jurisdictions that allow software patenting, Bangladesh primarily protects software through copyright. The Copyright Act protects the source code and object code of a program as literary works. However, copyright only protects the expression of an idea, not the idea itself. For AI startups, this means the specific code of a machine learning model is protected, but the underlying mathematical concept or algorithmic logic is not. Startups must register their software with the Copyright Office to establish prima facie evidence of ownership.

Trade Secrets for Algorithms

Due to the limitations of copyright, many tech companies rely on trade secret protection for their core algorithms. A trade secret is protected as long as it remains confidential and provides a competitive advantage. Startups must implement strict non-disclosure agreements (NDAs) with employees and partners, restrict access to source code repositories, and use robust cybersecurity measures to maintain trade secret status.

Trademarking Tech Brands

A trademark protects the startup’s brand name, logo, or slogan. Registering a trademark with the Department of Patents, Designs and Trademarks (DPDT) grants exclusive nationwide rights. For fintech apps, the brand name is often the primary driver of consumer trust. The process involves a formal search, filing, examination, and publication.

IP Assignment Agreements

A critical legal mistake tech founders make is failing to formally assign IP rights from individual developers to the company. All employees, freelancers, and co-founders must sign IP Assignment Agreements, ensuring that any code, smart contract, or AI model created belongs to the corporate entity. As Wikipedia's article on intellectual property explains, clear ownership of intangible assets is the foundation of a tech startup's valuation. A qualified IP legal adviser can draft these agreements and manage DPDT registrations.

AI and cloud-based tech startups inherently rely on cross-border data flows. A fintech app developed in Dhaka might use an AI model hosted on Amazon Web Services (AWS) in Singapore, processing data from users in Bangladesh. The legal framework governing such cross-border data transfers is complex and heavily scrutinized by the Bangladesh Bank and the BTRC.

Foreign Exchange and BIDA Approval

If a Bangladeshi tech startup pays subscription fees to foreign cloud providers (like AWS, Google Cloud, or GitHub), it must remit foreign currency. This requires BIDA approval and a Bangladesh Bank declaration. The startup must obtain a Foreign Inward Remittance Certificate (FIRC) for any foreign investment and process outward remittances through authorized dealer banks, justifying the technological necessity of the foreign service.

Data Localization for Financial Data

The Bangladesh Bank strictly mandates that all financial transaction data and customer KYC data of MFS and PSP platforms must be stored within Bangladesh. While the processing can happen in the cloud, the primary database must be located on local servers. Fintech startups must architect their systems to ensure compliance, often requiring hybrid cloud setups (processing abroad, storage locally).

Cross-Border AI Processing

For AI startups sending local user data to foreign servers for model training, the proposed Personal Data Protection Act will require explicit consent from the data subject and approval from a data protection authority. The transfer must not compromise national security or the sovereignty of Bangladeshi citizens' data. Consulting a cross-border tech legal adviser is highly recommended to structure these data flows legally.

Tax compliance for AI, blockchain, and fintech companies involves navigating complex rules regarding software exports, digital service VAT, and the treatment of digital assets. The National Board of Revenue (NBR) is the central authority for tax administration in Bangladesh.

Tax Exemptions for IT and ITES

The government offers significant tax incentives to boost the IT sector. If a tech startup registers as an IT/ITES entity with the Bangladesh Hi-Tech Park Authority (BHTPA) or the Bangladesh Association of Software and Information Services (BASIS), it can avail of a tax holiday for several years. This exemption applies to software development, IT-enabled services, and AI model exports, drastically reducing the startup's operational costs.

VAT on Digital Services

Under the Value Added Tax (VAT) and Supplementary Duty Act, 2012, businesses must obtain a Business Identification Number (BIN). While traditional software sales are subject to VAT, the export of IT services is generally zero-rated, allowing startups to claim input tax credits. However, if a SaaS platform is sold to local consumers, VAT is applicable. Proper accounting is essential to differentiate between taxable local sales and zero-rated exports.

Taxation of Cryptocurrencies

Since cryptocurrency trading is illegal in Bangladesh, there is no legal framework for taxing crypto capital gains. However, if a blockchain development company earns revenue by building enterprise blockchain solutions for foreign clients, that revenue is treated as standard IT export income and is subject to regular corporate tax (or exempt if BHTPA registered).

Withholding Tax on Foreign Tech Subscriptions

When a Bangladeshi company pays subscription fees for foreign SaaS products (like Microsoft Azure or AI APIs), a withholding tax (often 10-20%) must be deducted at the source and deposited with the NBR. An experienced tech tax advisory service can ensure compliance with these digital tax regulations.

For fintech and AI platforms handling sensitive user data, cybersecurity is not just a technical requirement; it is a legal mandate. The Cyber Security Act, 2023 imposes strict obligations on organizations to protect digital infrastructure and report cyber incidents. Non-compliance can result in massive fines and imprisonment for executives.

PCI-DSS Compliance for Fintech

Any fintech startup processing, storing, or transmitting credit card data must comply with the Payment Card Industry Data Security Standard (PCI-DSS). The Bangladesh Bank mandates this compliance for all PSPs. Achieving PCI-DSS certification requires rigorous network architecture, encryption protocols, and annual audits by certified security assessors.

Data Breach Notification Protocols

Under the CSA, organizations must report cyber incidents to the Bangladesh Computer Emergency Response Team (BD-CIRT) and the Cyber Crime Unit of the police. A legal protocol must be established to ensure that any data breach affecting user information is reported within the legally mandated timeframe (usually 72 hours) to avoid regulatory penalties.

Smart Contract Security Audits

For blockchain startups deploying smart contracts, a technical and legal audit is imperative. A single bug in a smart contract can lead to irreversible financial loss. Legal advisors must work alongside technical auditors to ensure the contract's logic aligns with the legal agreement and does not violate financial regulations. An experienced technology compliance service can coordinate these audits and establish robust cybersecurity policies.

The AI, blockchain, and fintech sectors in Bangladesh are attracting significant interest from venture capital (VC) funds and international tech conglomerates. Structuring these investments requires specialized legal expertise to navigate valuation, foreign exchange, and regulatory approvals.

Term Sheets and Share Subscription Agreements

When a tech startup receives VC funding, the transaction is governed by a Term Sheet, followed by a Share Subscription Agreement (SSA) and a Shareholders' Agreement (SHA). For tech companies, these agreements must include specific clauses regarding intellectual property ownership, non-compete periods for developers, and milestone-based tranching of funds. The SHA dictates board composition and investor veto rights on major decisions like pivoting the tech stack or selling user data.

Foreign Direct Investment (FDI) in Tech

Foreign VCs investing in Bangladeshi tech startups must comply with the Foreign Exchange Regulation Act. The investment requires BIDA approval and must be remitted through official banking channels. The startup must obtain a Foreign Inward Remittance Certificate (FIRC) and report the share transfer to the RJSC. Share pricing for foreign investors must be justified by a Fair Market Value (FMV) certificate.

Mergers and Acquisitions (M&A)

If an international tech company acquires a Bangladeshi AI or fintech startup, the transaction requires clearance from the Bangladesh Competition Commission (BCC) if it crosses certain financial thresholds. Fintech acquisitions also require a No Objection Certificate (NOC) from the Bangladesh Bank. A tech-focused corporate legal service is essential for managing due diligence and regulatory filings.

Bangladesh is increasingly becoming an attractive destination for foreign tech investment, particularly in AI and software development. However, foreign investors must adhere to specific regulatory frameworks depending on the tech sub-sector.

100% Foreign Equity in IT/AI

The government actively encourages foreign investment in the IT and AI sectors. Foreign investors can generally establish 100% foreign-owned software or AI development companies with BIDA approval. These companies can repatriate profits and dividends subject to standard tax withholding.

Restrictions in Fintech

Fintech is a more restricted sector. While there is no statutory cap on foreign equity for PSPs, the Bangladesh Bank exercises tight discretion. Foreign investors looking to acquire stakes in MFS providers or digital banks may face hurdles if the acquisition threatens local financial stability or if the foreign shareholding exceeds practical thresholds acceptable to the regulator.

Work Permits for Tech Expats

If a foreign-funded tech startup requires expatriate experts (like senior AI researchers or blockchain architects), it must obtain work permits from the Bangladesh Investment Development Authority (BIDA) and security clearance from the Ministry of Home Affairs. Our team at Aeenx assists international tech firms in navigating these foreign investment and employment regulations.

Disputes in the tech sector often involve complex technical evidence, intellectual property theft, or failures in algorithmic performance. Traditional litigation in Bangladeshi civil courts can be slow and may lack the technical expertise to fully comprehend blockchain architectures or AI models.

Arbitration for Tech Disputes

The Arbitration Act, 2001 provides a robust framework for domestic and international arbitration in Bangladesh. Tech contracts should mandate arbitration as the primary dispute resolution mechanism. The Bangladesh International Arbitration Centre (BIAC) offers institutional rules and panels of arbitrators with commercial expertise. Arbitration is faster, confidential, and allows parties to select technical experts as arbitrators.

Cyber Crime Litigation

In cases of data theft, source code leakage, or cyberattacks, startups must pursue both civil remedies (injunctions and damages) and criminal prosecution under the Cyber Security Act. The Cyber Tribunal has exclusive jurisdiction over these offenses. A qualified tech litigation legal adviser can guide founders through these specialized proceedings.

The following checklist provides a comprehensive and practical guide for tech founders seeking to launch an AI, blockchain, or fintech venture in Bangladesh.

Phase 1: Foundation

• Incorporate as a Private Limited Company via RJSC.
• Draft comprehensive IP Assignment and Non-Disclosure Agreements for developers.
• Consult a qualified tech legal service in Bangladesh to map out the regulatory pathway.

Phase 2: Sector-Specific Compliance

• For Fintech: Apply for PSP/MFS licenses or enter into partnerships with scheduled banks.
• For Blockchain: Ensure the business model avoids cryptocurrency trading to comply with Bangladesh Bank regulations.
• For AI: Review data collection mechanisms for compliance with the Cyber Security Act.

Phase 3: Operations & Tax

• Register with BASIS or BHTPA to secure IT tax holidays.
• Obtain BIN and structure VAT compliance for SaaS sales.
• Conduct PCI-DSS audits for fintech platforms.
• Draft Terms of Service and Privacy Policies reflecting local data protection laws.

Launching an AI, blockchain, or fintech venture in Bangladesh requires a deep understanding of both technological innovation and regulatory compliance. The guidance of an experienced tech and fintech legal service in Bangladesh is the single most important factor in ensuring your venture's success and scalability.

Aeenx provides comprehensive legal services to tech founders, software developers, and international investors across the full spectrum of digital business formation. Our team combines deep expertise in corporate law, data protection, and financial regulations to deliver integrated, practical, and forward-looking legal solutions.

Our Tech Legal Services Include

• Initial consultation and legal structuring for AI, Blockchain, and Fintech startups.
• Fintech licensing (MFS, PSP) and Bangladesh Bank regulatory compliance.
• Drafting SaaS agreements, Smart Contract wrapper agreements, and API terms.
• Intellectual property protection for software, algorithms, and databases.
• Data protection compliance under the Cyber Security Act.
• BIDA approvals and foreign direct investment (FDI) structuring.
• Venture capital funding, Term Sheets, and tech M&A due diligence.
• Tax exemption registration with BASIS and BHTPA.
• Cybersecurity policy drafting and PCI-DSS compliance advisory.
• Tech dispute resolution and arbitration.

Key Government & Regulatory Authorities

• Bangladesh Bank (BB): For fintech, MFS, and PSP licensing.
• Bangladesh Investment Development Authority (BIDA): For foreign tech investment approvals.
• Department of Patents, Designs and Trademarks (DPDT): For software copyright and trademark registration.
• Bangladesh Hi-Tech Park Authority (BHTPA): For IT tax exemptions and tech park facilities.
• Bangladesh Computer Emergency Response Team (BD-CIRT): For cybersecurity incident reporting.

Useful Reference Materials

• Financial Technology — Wikipedia
• Artificial Intelligence — Wikipedia
• Blockchain — Wikipedia
• Smart Contract — Wikipedia
• Cryptocurrency — Wikipedia
• Regulation of AI — Wikipedia
• Data Protection — Wikipedia
• Cybersecurity — Wikipedia
• Software as a Service — Wikipedia
• Venture Capital — Wikipedia