Blog Details

E-Commerce Laws in Bangladesh and Legal Requirements for Conducting Online Businesses

1. Introduction

1.1 There is, at present, no single consolidated statute governing electronic commerce in the People's Republic of Bangladesh. Any person who offers goods or services for sale by means of a website, mobile application or social-media platform is instead subject to a body of primary legislation, executive guidelines and regulatory directions issued by Bangladesh Bank, several of which have been enacted or substantially amended in 2025 and 2026.

1.2 The regulatory exposure of online businesses is considerable. In September 2026 the Hon'ble Minister for Commerce informed the Jatiya Sangsad that in excess of 58,000 complaints against e-commerce entities had been lodged with the Directorate of National Consumer Rights Protection (bdnews24). The competent authorities have responded by tightening registration requirements, enacting a statutory regime for the protection of personal data and formulating a draft framework for cross-border digital commerce.

1.3 This article sets out the legal and regulatory requirements with which an online business operating in, or directing its activities towards, Bangladesh must comply as at the date of publication, and identifies the principal reforms presently under contemplation.

2. The Statutory and Regulatory Framework

2.1 Electronic commerce in Bangladesh is regulated by the general law of contract and commerce, supplemented by the following instruments of specific application:

2.2 Two observations are apposite. First, the Digital Commerce Operational Guidelines 2021 are executive instruments and not an Act of Parliament; they are nonetheless given practical effect through the DBID approval process, proceedings under the Consumer Rights Protection Act 2009 and the controls exercised by Bangladesh Bank over payment systems. Secondly, the Cyber Security Ordinance 2025 and the Personal Data Protection Ordinance 2025 have since been repealed and re-enacted as Acts of the Thirteenth Jatiya Sangsad; any reference to those Ordinances in earlier commentary should accordingly be read as superseded.

3. Registration and Licensing Requirements

3.1 Every person carrying on an online business is required to possess a recognised legal status, a Digital Business Identity (DBID) and the requisite tax registrations. Certain categories of goods and services are, in addition, subject to sector-specific licensing.

3.2 Choice of business vehicle. An online business may be constituted as a sole proprietorship, a partnership or a private company limited by shares incorporated under the Companies Act 1994 and registered with the Registrar of Joint Stock Companies and Firms (RJSC). Incorporation confers limited liability and is the only practicable vehicle for foreign direct investment. Marketplace operators that receive and hold funds on behalf of consumers are strongly advised to incorporate.

3.3 Trade licence. A trade licence must be obtained from the City Corporation or other local authority having jurisdiction over the business premises or registered office. The Digital Commerce Operational Guidelines 2021 require every marketplace to hold at least one trade licence and to display it on its website or social-media page.

3.4 Digital Business Identity (DBID). The DBID regime was introduced by the Ministry of Commerce in February 2022 following the collapse of Evaly and similar platforms. Every e-commerce and social-media-based business is required to obtain a DBID in order to operate lawfully, and a DBID may be issued without a trade licence where the business maintains an online presence (Financial Express). The DBID number must be displayed on the website or page concerned (Financial Express).

3.5 Approval is not granted as of course. As at March 2026, more than 13,500 applications had been submitted but only approximately 2,100 businesses had been certified. The RJSC attributes the majority of rejections to incomplete documentation and, in particular, to the applicant's failure to publish its terms and conditions in Bangla (Financial Express). Applicants should therefore ensure that their website or page is fully compliant before an application is lodged.

3.6 Tax registration. The business must obtain an electronic Taxpayer Identification Number (e-TIN) from the National Board of Revenue and, where liable, a Business Identification Number (BIN) under the Value Added Tax and Supplementary Duty Act 2012 (see Part 8 below).

3.7 Sector-specific licences. The sale of regulated goods or services by electronic means requires the same authorisation as their sale through physical premises, including:

(a) in respect of medicines and health-care products, a licence from the Directorate General of Drug Administration;

(b) in respect of food, compliance with the requirements of the Bangladesh Food Safety Authority and, where mandatory, the certification marks of the Bangladesh Standards and Testing Institution;

(c) in respect of imported goods, an Import Registration Certificate; and

(d) in respect of financial, insurance, travel or courier services, the licence of the relevant sectoral regulator.

3.8 Banking and payment arrangements. A business bank account must be opened in the name of the business entity, and payment collection arrangements must be made with a payment gateway or mobile financial service duly licensed by Bangladesh Bank. Payment service providers will ordinarily require production of the trade licence or DBID, the e-TIN and the constitutional documents of the entity.

4. Operational Obligations under the Digital Commerce Operational Guidelines 2021

4.1 The Digital Commerce Operational Guidelines 2021 (the "Guidelines"), issued by the Ministry of Commerce on 4 July 2021, prescribe the manner in which online sales are to be conducted. They apply both to sellers and to the marketplaces and social-media pages through which sales are effected (VDB Loi).

4.2 Disclosure in Bangla. The terms governing refund, return, replacement, mode of delivery and delivery period shall be published clearly in the Bangla language. Product listings shall contain sufficient particulars to enable the consumer to make an informed decision, including country of origin, brand, model and delivery period (Mahbub & Company). In the case of services, the mode of delivery, the equipment or technology to be employed and the qualifications of the service provider shall be stated.

4.3 Delivery and refund periods. The Guidelines prescribe the following periods:

Sources: Mahbub & Company; The Business Standard.

4.4 Restriction on advance payment. Where goods are not in stock and cannot be delivered to the delivery agent within 48 hours, the seller shall not accept in advance more than ten per cent of the price, save where payment is made through an escrow service approved by Bangladesh Bank, in which case full payment may be received in advance (Mahbub & Company). This restriction was introduced in direct response to the advance-order schemes that collapsed in 2021.

4.5 Prohibited activities. The Guidelines prohibit, inter alia:

(a) the sale of addictive or otherwise prohibited substances;

(b) the organisation of online betting or gambling, or of lotteries and raffle draws in contravention of the law for the time being in force;

(c) the sale of medicines or medical supplies without a licence from the Directorate General of Drug Administration; and

(d) the conduct of multi-level marketing or network business by means of digital commerce.

4.6 Complaints and records. Every business shall maintain an accessible complaint-handling mechanism, preserve records of its transactions, and obtain the consumer's prior consent before collecting personal information, specifying the information to be collected, the place of its storage and the purposes for which it will be used. The consent requirement is now reinforced by the Personal Data Protection Act 2026 (see Part 7 below).

5. Consumer Protection

5.1 Consumers who purchase by electronic means are protected at two levels. The Guidelines impose pre-contractual and post-contractual obligations upon sellers, while the Consumer Rights Protection Act 2009 (the "CRPA") renders the more serious contraventions criminal offences. The same conduct may accordingly attract liability under both instruments.

A. Obligations of sellers under the Guidelines

5.2 Pre-contractual information. Every listing shall contain a full description of the product, including its picture, size, shape, weight, colour, place and date of manufacture, ingredients, any hazard to human or animal health or to the environment, and any quality-control certification. In respect of services, the mode of delivery, the equipment or technology to be used and the qualifications of the service provider shall be disclosed (Mahbub & Company).

5.3 Identification of the business. The website or page shall display, as applicable, the trade licence number, VAT registration number, TIN, DBID/UBIN or Personal Retail Account number of the business.

5.4 Terms and conditions in Bangla. Conditions relating to refund, return, replacement, mode and period of delivery and all other material terms shall be published clearly in Bangla, and may be published additionally in any other language. No term repugnant to the law for the time being in force in Bangladesh may be published.

5.5 Cookies and personal information. A visitor shall be informed forthwith upon accessing a website that uses cookies. Before any personal information is collected, the purchaser shall be informed of the information to be collected, the place of its storage, the purposes of its use and the manner of its processing, and shall signify consent by means of a checkbox or other declaration.

5.6 Post-contractual time limits.

5.7 Complaints, reviews and promotional schemes.

(a) Every platform shall publish a telephone number, e-mail address or other means of lodging complaints, and shall appoint a compliance officer to coordinate with the Directorate of National Consumer Rights Protection ("DNCRP").

(b) Every platform shall provide a facility for product reviews and ratings. No person connected with the business may submit a review, and no review may be deleted.

(c) No lottery or raffle draw may be organised without the prior permission of the Government; section 294B of the Penal Code 1860 applies.

B. Offences under the Consumer Rights Protection Act 2009

5.8 The offences created by the CRPA apply to online sellers as they apply to any trader. Those of principal relevance to electronic commerce are as follows:

5.9 Upon a subsequent conviction for the same offence, the offender is liable to twice the maximum punishment prescribed (section 55), and the court may order the confiscation of the goods concerned to the State (section 56). Source: BSS.

C. Enforcement and remedies

(a) Forum. Any consumer may lodge a written complaint with the Director General of the DNCRP or an officer authorised by him (section 76(1)). Complaints may be filed at the head office of the DNCRP at TCB Bhaban, Karwan Bazar, at its divisional offices or before the District Magistrate (The Daily Star Bangla).

(b) Limitation. A complaint shall be lodged within 30 days of the accrual of the cause of action (section 60).

(c) Reward to the complainant. Twenty-five per cent of any fine realised upon a written complaint shall be paid to the complainant, whether the fine is imposed administratively or upon conviction by a criminal court (section 76).

(d) Administrative action. The DNCRP may, after hearing the parties, impose administrative fines and may refer serious contraventions for prosecution.

(e) Exemption of innocent sellers. No seller shall be held liable for a contravention committed without his knowledge (section 78). This provision is of particular importance to marketplace operators, who should be in a position to demonstrate that they neither knew of nor participated in the misconduct of a merchant.

(f) Civil remedy. The consumer may, in addition, institute a civil suit for compensation.

5.10 The volume of enforcement is increasing: as at September 2026, the DNCRP had received in excess of 58,000 complaints against e-commerce entities.

6. Online Payments

6.1 Online payments are governed by the Payment and Settlement Systems Act 2024, the regulations and circulars issued by Bangladesh Bank, and the payment provisions of the Guidelines. Together they determine who may lawfully collect payment, the circumstances in which payment may be received in advance, and the manner in which refunds are to be effected.

A. The Payment and Settlement Systems Act 2024

6.2 The Act was passed by the Jatiya Sangsad in July 2024 to bring bank and non-bank payment services within a single statutory framework; such activity had previously been governed only by the Bangladesh Payment and Settlement Systems Regulations 2014 issued by Bangladesh Bank (VDB Loi). Its principal provisions of relevance to online businesses are as follows:

(a) Licensing. No person shall operate a payment system or provide payment services without a licence from Bangladesh Bank, and no bank shall provide electronic payment services without its approval. An online business must therefore collect payment only through a duly licensed bank, payment system operator ("PSO"), payment service provider ("PSP") or mobile financial service provider ("MFS"), and shall not itself operate a wallet or payment facility.

(b) Prepaid payment instruments. No person shall issue, purchase or sell a prepaid payment instrument without the approval of Bangladesh Bank. Store-credit wallets, gift cards, cash vouchers and prepaid balance schemes fall within this prohibition.

(c) Deposits and investment. No online or offline platform shall accept investment, extend credit, hold funds or conduct financial transactions with the public without authorisation. This provision is directed at the advance-deposit and "cycle offer" models that failed in 2021.

(d) Penalties. The foregoing offences are punishable with imprisonment for a term not exceeding five years, a fine not exceeding Tk 50 lakh, or both, and are cognizable, non-bailable and non-compoundable (VDB Loi). The furnishing of false information in any statement or report is punishable with imprisonment for up to three years, a fine of up to Tk 30 lakh, or both (Financial Express).

6.3 Bangladesh Bank is actively granting licences under the Act; as at August 2026, ten companies held PSP (e-wallet) licences (Financial Express). Its draft PSO Regulation would require every payment gateway to maintain, at the close of each business day, a balance in its trust and settlement account sufficient to discharge all outstanding liabilities to merchants, and would prohibit cash settlement (Ittefaq). Merchants may accordingly expect more secure settlement, accompanied by enhanced due diligence at the onboarding stage.

B. The escrow mechanism

6.4 By its circular dated 30 June 2021, Bangladesh Bank required payment gateways, with effect from 1 July 2021, to retain payments made by e-commerce customers and to release them to the merchant only upon confirmation of delivery (Daily Star). Under this mechanism:

(a) the purchaser's payment is held by the gateway, PSP or MFS and not by the merchant;

(b) the merchant submits confirmation of delivery in order to obtain release of the funds; and

(c) upon non-delivery or cancellation, the gateway refunds the purchaser from the funds so held.

6.5 The mechanism has been the subject of judicial scrutiny. In November 2021 the High Court Division directed Bangladesh Bank to investigate the failure of certain gateways, including bKash and Nagad, to refund moneys held in escrow (Financial Express), and Bangladesh Bank thereafter, in December 2021, instructed gateways to commence refunds (Dhaka Tribune). Merchants have, conversely, complained of delayed release notwithstanding confirmation of delivery. Proper documentary evidence of delivery is therefore essential to both parties.

C. Payment provisions of the Guidelines

Sources: Mahbub & Company; The Business Standard.

D. Compliance recommendations for merchants

(a) All payments should be received into a bank account held in the name of the business entity, and not into any personal bank or MFS account.

(b) Cash on delivery is lawful; a receipt or VAT invoice should nonetheless be issued and courier remittances reconciled against orders.

(c) No wallet, store credit, gift card or loyalty scheme redeemable for cash should be launched without first ascertaining whether the approval of Bangladesh Bank is required.

(d) Funds payable by a marketplace to its merchants should be held separately from its operating funds.

(e) Evidence of delivery, including courier records and purchaser confirmations, should be preserved to support escrow release and to answer complaints of non-delivery.

(f) Receipts from and payments to persons outside Bangladesh are subject to the foreign exchange regime described in Part 10 below.

7. Data Protection and Cyber Security

7.1 Every online business processes personal data. Customer names, telephone numbers, addresses and payment particulars all constitute "personal data", the processing of which has, since 2026, been subject to a comprehensive statutory regime.

A. The Personal Data Protection Act 2026

7.2 The Personal Data Protection Act 2026 (Act No. 63 of 2026) repealed and replaced the Personal Data Protection Ordinance 2025 and the Personal Data Protection (Amendment) Ordinance 2026. Its provisions of principal relevance to online sellers are as follows:

(a) Territorial application. The Act applies to any person processing personal data within Bangladesh, and to processing outside Bangladesh in connection with the supply of goods or services to, or the monitoring of, data subjects located in Bangladesh (section 1(2)). Foreign platforms selling into Bangladesh are accordingly within its scope.

(b) Lawful basis of processing. Processing requires consent that is voluntary, specific, unambiguous and revocable, obtained after the data subject has been informed of the purpose, the retention period and any transfer. The performance of a contract to which the data subject is party constitutes an alternative lawful basis (section 5). The burden of proving consent rests upon the data fiduciary.

(c) Rights of data subjects. Data subjects enjoy rights of access, portability, rectification, withdrawal of consent and erasure (sections 11 to 13). These rights cannot be excluded or derogated from by contract or notice.

(d) Security and records. Data fiduciaries shall adopt appropriate technical and organisational measures, including pseudonymisation and encryption (section 17), maintain records of processing for not less than five years (section 19), and notify the Authority of any personal data breach likely to cause significant harm (section 20).

(e) Liability for processors. A data fiduciary is liable for processing carried out on its behalf by any processor, such as a courier, cloud host or marketing agency (section 8).

(f) Cross-border transfer. Transfer of personal data outside Bangladesh is permitted with the consent of the data subject, for the performance of a contract with the data subject, or for the data subject's business, educational or travel purposes, and only to destinations meeting the prescribed standards (section 29).

(g) Penalties. The Authority may impose administrative fines of up to Tk 25 lakh for failure to honour data-subject rights or to secure personal data, up to Tk 50 lakh in the case of a significant data fiduciary, and additional fines for repeated contraventions, together with compensation to the aggrieved data subject (sections 32 to 35). Fines may also be imposed upon directors, managers and officers involved in the contravention (section 36). An appeal lies to the Cyber Tribunal within 30 days (section 37).

7.3 Commencement. The Act is deemed to have come into force on 6 November 2025. However, the provisions relating to complaints, penalties and compensation (sections 31 to 35) and the appointment of a Chief Data Officer (section 23) shall take effect on such date as the Government may notify upon the expiry of eighteen months, that is, not earlier than approximately May 2027 (section 1(3)). Businesses therefore have a limited period within which to bring their privacy notices, consent mechanisms and vendor agreements into conformity before enforcement commences.

B. The Cyber Security Act 2026

7.4 The Cyber Security Act 2026 (Act No. 81 of 2026), passed on 10 April 2026, repealed the Cyber Security Ordinance 2025 and is deemed to have come into force on 21 May 2025 (Somoy News). It criminalises, inter alia, unauthorised access, hacking, online fraud and offences committed by means of artificial intelligence, including deepfakes. By an amendment passed on 30 June 2026, section 20 (gambling) was omitted, online gambling being now governed by the Gambling Prevention Act 2026 (Bangla Tribune).

7.5 The Act operates in two directions for businesses: it affords remedies against account takeover, impersonating pages and payment fraud, while exposing any business that misuses the data or systems of others to criminal liability.

8. Taxation and Value Added Tax

8.1 Online businesses are subject to the same fiscal obligations as any other business. The VAT treatment of electronic commerce has, however, been altered by each of the last two Finance Acts and is now a frequent subject of dispute with the National Board of Revenue.

(a) Registration. Every business shall obtain an e-TIN and file returns under the Income Tax Act 2023. Depending upon its turnover, it shall either register for VAT (BIN) or enlist for turnover tax under the Value Added Tax and Supplementary Duty Act 2012.

(b) Marketplace commission. The Finance Act for fiscal year 2025-26 increased the rate of VAT on commission earned from online product sales from five to fifteen per cent (bdnews24).

(c) Finance Act 2026. The budget for fiscal year 2026-27 distinguished "online retail sale" from "marketplace" activity. Marketplaces account for VAT at fifteen per cent on their service fees or commission only, whereas online retailers may account for VAT substantially as traders, including the option of 7.5 per cent trade VAT or the standard rate of fifteen per cent (KPMG Bangladesh). Commentators have observed that these provisions sit uneasily with the classification of online retail sale as a service; the correct treatment should therefore be determined with reference to the particular business model.

(d) Withholding tax returns. E-commerce platforms and online marketplaces whose annual turnover exceeds Tk 100 million are now required to file withholding tax returns (KPMG Bangladesh).

(e) Foreign digital services. Non-resident suppliers of digital services to customers in Bangladesh are liable to VAT at fifteen per cent and must register through a local VAT agent; business recipients account for VAT on imported services under the reverse-charge mechanism.

8.2 VAT invoices (Mushak challans), purchase records and payment-gateway statements should be preserved for every transaction. In practice, most fiscal disputes in this sector turn upon the adequacy of records rather than upon the applicable rate.

9. Electronic Contracts, Intellectual Property, Advertising and Competition

9.1 Formation of electronic contracts. The Information and Communication Technology Act 2006 accords legal recognition to electronic records and digital signatures. A contract concluded by electronic means is therefore enforceable in accordance with the Contract Act 1872 and the Sale of Goods Act 1930. Standard terms of sale cannot, however, exclude or restrict the rights conferred upon consumers by the Consumer Rights Protection Act 2009 or upon data subjects by the Personal Data Protection Act 2026. Terms should be published in Bangla, accepted by an affirmative act of the purchaser, and archived together with the order.

9.2 Protection of brand and content. The trade name and logo of the business should be registered as trademarks with the Department of Patents, Designs and Trademarks under the Trademarks Act 2009; neither a DBID nor a trade licence confers any exclusive right in a name. Product photographs, descriptions and audiovisual content are protected under the Copyright Act 2023. The reproduction of a competitor's listings, or the sale of counterfeit branded goods, exposes the seller to civil and criminal proceedings.

9.3 Advertising and promotional schemes. Representations as to discounts, limited availability and endorsements, including endorsements by social-media influencers, must be truthful, the publication of a false advertisement being an offence under section 44 of the Consumer Rights Protection Act 2009. Lotteries, raffle draws and any scheme in the nature of betting are prohibited by the Guidelines and are further regulated by the Gambling Prevention Act 2026, which expressly extends to online and remote gambling and its promotion (Wikipedia summary).

9.4 Competition law. Operators of large platforms should have regard to the Competition Act 2012. Predatory pricing intended to eliminate competitors, exclusive dealing arrangements with sellers and concerted pricing among sellers may attract the jurisdiction of the Bangladesh Competition Commission.

10. Cross-Border Online Transactions

10.1 Every online sale or purchase involving a counterparty outside Bangladesh constitutes a foreign exchange transaction. Such transactions are governed principally by the Foreign Exchange Regulation Act 1947 (the "FER Act") and the circulars issued thereunder by Bangladesh Bank, together with the VAT law, the Personal Data Protection Act 2026 and the policy of the Ministry of Commerce. The operative instrument for exports, including e-commerce exports, is Bangladesh Bank's consolidated FEPD-1 Circular No. 26 dated 30 July 2026 (the "Circular"), which remains valid for one year from its issuance. References to Parts and paragraphs below are to the Circular.

A. General foreign exchange requirements

(a) Regulatory authority. Bangladesh Bank regulates export transactions in exercise of the powers conferred by section 20(3) of the FER Act, and all payments must be routed through an Authorised Dealer ("AD") bank or a channel approved by it.

(b) Registration of exporters. Every exporter must be registered under the Importers, Exporters and Indentors (Registration) Order 2023 (Part A, para 4).

(c) Declaration. Save where exempted, every export of goods must be declared on the EXP Form at its full invoice value (Part A, para 6).

(d) Repatriation. Export proceeds, whether in respect of goods or services, must be repatriated within four months; any delay or non-realisation renders the exporter liable to punitive action under the FER Act (Part A, para 8; Part H, para 4).

(e) Prohibition on retention abroad. The retention abroad of export proceeds in any form, including investment, assets, foreign accounts or cryptocurrency, contravenes section 5(1)(e)(i) of the FER Act and is cognizable under section 23(1) thereof, save for authorised merchant or notional accounts from which funds are swept to Bangladesh (Part H, para 5).

(f) Exporters' Retention Quota. An exporter may retain a portion of the proceeds in foreign currency in an Exporters' Retention Quota ("ERQ") account, and the AD bank shall not encash the whole without the exporter's consent (Part I, para 7).

B. Export of goods by means of electronic commerce

10.2 Bangladesh Bank permits business-to-consumer ("B2C") exports through the following channels, each subject to its own limits and conditions:

10.3 MFS providers and PSPs licensed by Bangladesh Bank may, after due diligence on the exporter, also receive proceeds of e-commerce exports of goods up to USD 1,000 without an EXP Form (Part I, para 6(6)).

C. Export of services and digital products

(a) Exemption from EXP procedure. Software, IT-enabled, data-processing and similar services exported in non-physical form are not subject to the EXP procedure; proceeds are realised in accordance with Parts H and I.

(b) Inward remittances. AD banks may credit inward remittances against service exports up to USD 20,000 without a declaration on Form-C; larger receipts require Form-C, or Form-C (ICT) in the case of IT services (Part H, para 2).

(c) Online payment gateway service providers. Proceeds of small-value service exports up to USD 10,000 per transaction may be received through internationally recognised online payment gateway service providers ("OPGSPs"). The exporter's notional account with the OPGSP must be swept automatically to Bangladesh, and the OPGSP remains responsible for resolving payment complaints (Part I, para 3).

(d) Marketplace accounts. Service exporters may maintain merchant accounts with international marketplaces and notional accounts with licensed foreign payment operators, subject to an undertaking to repatriate within the statutory period (Part I, para 5).

(e) Freelancers. Developers of mobile applications and games may receive income on dual-currency "Freelancer Cards" (Part I, para 4), and freelancers and individual service exporters are governed by a dedicated framework in Part K.

D. Payments for foreign goods, services and platforms

(a) International cards. International cards may be used for online payment abroad for legitimate goods and services up to USD 300 per transaction, within the cardholder's annual entitlement. They may not be used for goods or services originating and sold in Bangladesh, foreign exchange trading, foreign securities, cryptocurrency or lottery tickets (Bangladesh Bank, 2019).

(b) Cross-border digital payment service providers. A 2026 framework issued by Bangladesh Bank permits AD banks to partner with foreign payment platforms such as PayPal and Payoneer, covering payments such as membership fees, IT expenses and hotel bookings, and small-value cross-border online purchases capped at USD 300 per transaction (Daily Sun).

(c) Importation of goods for resale. A business importing goods for sale online must hold an Import Registration Certificate and is subject to customs clearance, import duties and VAT in the same manner as any other importer.

(d) Foreign digital services and advertising. Payments to foreign platforms for advertising, software or cloud services attract VAT at fifteen per cent. Non-resident suppliers must register through a local agent, Bangladeshi business recipients account for VAT on imported services under the reverse-charge mechanism, and withholding tax may also be applicable.

E. Foreign sellers and platforms supplying into Bangladesh

10.4 The Guidelines require every foreign digital commerce platform to be registered in Bangladesh and to obtain the necessary approvals before commencing business. A foreign investor intending to operate a local online business would ordinarily incorporate a private limited company, with investment and repatriation governed by the regulations of Bangladesh Bank and the Bangladesh Investment Development Authority.

10.5 The Ministry of Commerce has further published a draft Cross-Border Digital Commerce Policy 2026, which was open for public comment until 6 August 2026 (Prothom Alo). The draft provides, inter alia, that:

(a) foreign platforms and sellers shall obtain a DBID before undertaking any commercial activity in Bangladesh and shall comply with the VAT, income tax and other laws (Daily Observer);

(b) Meta, Google, YouTube, TikTok and similar platforms shall not run new paid advertisements in Bangladesh without DBID registration;

(c) payments for international online orders shall be held in an escrow supervised by Bangladesh Bank and released only upon confirmation of delivery (Dhaka Tribune); and

(d) sellers shall disclose after-sales service, refund, return, warranty and guarantee terms prior to purchase.

10.6 The policy remains in draft and is liable to amendment. Nevertheless, domestic businesses that advertise through foreign platforms or purchase through cross-border marketplaces should anticipate additional documentary requirements.

F. Cross-border transfer of personal data

10.7 Cross-border sales ordinarily entail the transfer of customer data to a foreign platform, payment processor or cloud host. Under section 29 of the Personal Data Protection Act 2026:

(a) personal data may be transferred abroad with the consent of the data subject, for the performance of a contract to which the data subject is party, or for the data subject's business, educational, emigration or similar purposes;

(b) such transfer is permitted only to a place or country possessing the technology and safeguards prescribed by regulation;

(c) any large-scale cross-border transfer of national identity, passport or taxpayer identification numbers, biometric or genetic data, or criminal records must be notified to the National Data Management Authority; and

(d) the Government may, by notification in the official Gazette, levy a fee or charge on the business profits of any entity derived from the use of the personal data of Bangladeshi citizens.

G. Compliance steps for cross-border sellers

☐ Obtain an Export Registration Certificate and engage an AD bank offering e-commerce acquiring services

☐ Select the appropriate export channel and observe its per-transaction limit

☐ Engage only licensed couriers and obtain a Bill of Export for every shipment

☐ Repatriate all proceeds within four months and refrain from retaining income in foreign wallets

☐ Utilise the ERQ account for platform fees and refunds to overseas buyers

☐ Ascertain VAT and withholding liabilities on payments to foreign platforms and advertisers

☐ Identify all customer data transferred outside Bangladesh and document the lawful basis for each transfer

11. Prospective Reforms: A Statutory E-Commerce Regulator

11.1 The most significant reform under contemplation is the establishment of a statutory regulator. The Ministry of Commerce prepared a draft Digital Commerce Act in 2023, subsequently recast as a Digital Commerce Development Authority law, under which every online business would be required to obtain a licence from the proposed authority as a condition of carrying on business (Prothom Alo). Later drafts contemplated that the authority would issue DBIDs, cancel the registration of fraudulent operators, and penalise the unauthorised issue of digital wallets, gift cards and online lotteries (Prothom Alo).

11.2 No such legislation has yet been enacted. On 31 August 2026 the Hon'ble Minister for Commerce stated that the Government was actively considering the constitution of an e-commerce authority (Jugantor). Businesses that already hold a DBID, transact through approved escrow arrangements and maintain proper records will be best positioned upon the introduction of a licensing regime.

12. Compliance Checklist

☐ Business entity duly constituted (sole proprietorship, partnership or company registered with the RJSC)

☐ Trade licence obtained and displayed on the website or page

☐ DBID obtained from the RJSC and its number displayed on the website or page

☐ e-TIN obtained; VAT registration (BIN) or turnover-tax enlistment completed

☐ Sector-specific licences obtained for regulated goods and services

☐ Terms of sale, refund, return and delivery published in Bangla

☐ Product listings disclose origin, brand, model and delivery period

☐ Delivery procedures conform to the 48-hour hand-over and 5/10-day delivery periods

☐ Advance payment for out-of-stock goods limited to ten per cent, or routed through approved escrow

☐ Refunds effected within the prescribed period through the original channel of payment

☐ Payments collected only through banks, gateways or MFS providers licensed by Bangladesh Bank

☐ Privacy notice and consent mechanism conform to the Personal Data Protection Act 2026

☐ Data processing agreements executed with couriers, cloud hosts and marketing vendors

☐ Security measures, breach-response procedure and five-year processing records in place

☐ Applications for registration of the trade name and logo as trademarks filed

☐ No multi-level marketing, lottery, betting or prohibited goods on the platform

☐ Complaint-handling mechanism published and a compliance officer appointed

13. Advisory Services of The Justice Corner

13.1 The cost of compliance is modest in comparison with the consequences of proceedings before the DNCRP, the rejection of a DBID application or the imposition of a penalty under the data protection regime. The Justice Corner advises entrepreneurs, social-media-based sellers, marketplace operators and foreign investors at every stage of the conduct of an online business in Bangladesh, including:

(a) the selection and registration of the appropriate business vehicle, trade licence and DBID;

(b) the drafting of terms of sale, refund and delivery policies and privacy notices, in Bangla and English, in conformity with the Guidelines and the Personal Data Protection Act 2026;

(c) the drafting and negotiation of merchant, vendor, courier and data processing agreements;

(d) the registration of trademarks and the institution of proceedings against counterfeiters and impersonating pages;

(e) foreign exchange compliance for cross-border sales and the structuring of VAT and tax affairs in consultation with the client's accountants; and

(f) representation before the DNCRP, the Cyber Tribunal and the courts of Bangladesh.

13.2 Enquiries may be addressed to the chambers of The Justice Corner, Dhaka.

Disclaimer: This article sets out the law as at 18 October 2026 for general information only and does not constitute legal advice. The laws, guidelines, circulars and fiscal measures referred to herein are subject to frequent amendment; specific advice should be obtained before any action is taken in reliance upon this article.

Principal Sources

Personal Data Protection Act 2026 — Laws of Bangladesh

Cyber Security Act 2026 — Laws of Bangladesh

Digital Commerce Operational Guidelines 2021 summary — Mahbub & Company

DBID applications and approvals, March 2026 — The Financial Express

Salient features of Finance Bill 2026 — KPMG Bangladesh

Draft Cross-Border Digital Commerce Policy 2026 — Prothom Alo