Bangladesh Bank disconnects DGePay from NPSB over security concerns

Bangladesh Bank has disconnected online payment gateway DGePay from the National Payment Switch Bangladesh (NPSB) over security concerns, including alleged server access from India, The Daily Star reported. The step was taken on 29 October.

What the central bank says

Bangladesh Bank Executive Director and Spokesperson Arief Hossain Khan told The Daily Star the decision followed an inspection that identified several security breaches. He said cybersecurity and citizens’ data privacy are the bank’s highest priorities, and a serious allegation that an institution is operating from outside Bangladesh is treated as a threat to data confidentiality and security.

He said action would be taken on the allegations, and as an investigation takes time, the disconnection serves as a preliminary measure.

DGePay’s response

DGePay Managing Director and CEO Rashed Mahmud said the move came without prior discussion and that he learnt of it on 1 November. He said only NPSB-routed transactions were affected, other services remain operational, and the company has had no security breach or incident to date.

According to him, the central bank’s main concerns were:

• Staffing: no dedicated database administrator, as the role is handled by an employee with other duties. He called the requirement for separate personnel impractical.
• Security controls: additional firewalls and a specific Microsoft security product, which he said the company has already bought and implemented.
• Server access from India: the system was built by an India-based R&D team whose developers were given infrastructure access solely for development, he said.

Talks with Bangladesh Bank are ongoing, and the company expects more clarity afterwards.

Background

NPSB, owned and operated by Bangladesh Bank, is the country’s central interbank digital payment network for real-time electronic transactions. DGePay Services Limited received its payment system operator (PSO) licence in August 2023 and operates as a white-label merchant acquirer under the DG e-pay brand, offering POS, QR and e-commerce acquiring to 600 to 1,000 merchants. It is a sister concern of Dipon Group.