SEBON Introduces IT Policy 2083 to Strengthen Digital Security and Transparency in Capital Market

The Securities Board of Nepal (SEBON) has implemented the SEBON Information Technology Policy, 2083, effective from Kartik 18, 2083, with the aim of promoting the secure use of information technology in Nepal’s capital market, strengthening regulatory capacity, reducing technology-related risks, and enhancing market transparency and investor confidence.

The policy introduces an integrated framework covering emerging technologies and aims to make the operations of the securities and commodities markets more effective, measurable, result-oriented, and accountable through the development and expansion of IT infrastructure.

Under the new policy, IT security standards have been classified into three levels based on the nature of operations and responsibilities of entities associated with the securities market and market infrastructure institutions.

The first level covers SEBON, market operators and the central depository service. The second level includes securities brokers, securities dealers and merchant bankers, while the third level covers credit rating agencies and share registrars.

The policy seeks to promote standardized and systematic use of information technology across the securities and commodities markets while supporting digital transformation in market regulation, operations and investment.

The policy also provides a framework to facilitate the adoption of emerging technologies, including FinTech and Regulatory Sandbox initiatives. It aims to encourage innovation and the adoption of modern technological solutions in the capital and commodities markets.

To ensure the secure and reliable operation of trading, clearing and settlement systems, central depository systems and warehouse-related records, the policy requires the establishment and management of internationally aligned Disaster Recovery Mechanisms (DRM).

Market infrastructure institutions and other critical market participants will also be required to maintain Business Continuity Plans (BCP) and Disaster Recovery Plans (DRP). Annual drills or simulations of such plans will be mandatory, with institutions required to submit the related reports to SEBON.

The policy makes Vendor Due Diligence and Vendor Risk Management mandatory when procuring technology-related tools and services for market regulation and operations.

For IT outsourcing arrangements, contracts will be required to clearly address Service Level Agreements (SLA), data security responsibilities, regulatory audit rights, and vendor exit strategies, among other requirements to be established through relevant guidelines.

Market infrastructure institutions must also establish a Security Operations Centre (SOC) or engage an authorized Managed Security Service Provider (MSSP) to ensure 24-hour monitoring of cyber threats.

The policy is expected to expand the use of technology in market regulation and activities while enhancing SEBON’s supervisory capacity through Supervisory Technology (SupTech) and Regulatory Technology (RegTech).

SEBON expects the policy to provide a strong foundation for the safe, reliable, and standardized use of information technology, while making the securities and commodities markets more transparent, resilient, and trustworthy.

The policy is also aimed at aligning Nepal’s capital market regulatory framework with international practices and supporting the market’s broader digital transformation.