Securing the Bourse: SEBON Mandates Data Sovereignty and Stringent Cyber Guardrails

Kathmandu — In a definitive move to shield Nepal’s financial infrastructure from escalating digital vulnerabilities, the Securities Board of Nepal (SEBON) has implemented a sweeping technological overhaul. The newly enforced 'Information Technology Policy, 2083', which officially took effect on Kartik 18, replaces the increasingly obsolete 2076 BS guidelines. Far more than a routine update, this regulatory framework represents a paradigm shift—anchoring the capital market in strict data sovereignty, aggressive cyber defense, and proactive disaster management.

The cornerstone of the new policy is a strict data localization mandate. By legally requiring all securities and commodities exchange data to be stored exclusively within Nepal's borders, SEBON is actively protecting sensitive national financial data from foreign jurisdictions and external cloud breaches. To complement this, the regulator has conceptualized a 'Central Data Bank.' This initiative is interpreted as a strategic effort to streamline market intelligence, ensuring that vast troves of investor data are systematically archived, easily accessible for regulatory scrutiny, and fortified against leaks.

Recognizing that a standardized approach places undue burdens on smaller firms, SEBON has introduced a pragmatic, three-tiered regulatory system. Top-tier market pillars like the Nepal Stock Exchange (NEPSE) and CDS and Clearing Limited (CDSC) are now mandated to adopt the globally recognized ISO 27001 information security standard. These critical infrastructures must endure rigorous annual IT audits, whereas mid-to-lower-tier entities like brokerages and rating agencies are required to undergo biennial reviews. To mitigate the ripple effects of a systemic hack, the board has drastically shrunk the reporting window: catastrophic cyber incidents must be flagged on the exact same day, while lesser infractions carry a strict 72-hour deadline.

Perhaps the most practical aspect of the 2083 policy is its focus on physical and digital resilience, clearly tailored to Nepal’s geographic realities and the global surge in ransomware. Financial institutions are now obligated to establish a Disaster Recovery Site (DRS) at a minimum distance of 25 kilometers from their primary data centers—a crucial buffer designed to keep the market running even if a localized natural disaster, such as an earthquake, strikes Kathmandu. Furthermore, to combat digital extortion, institutions must maintain air-gapped, immutable, and multi-layered backups, guaranteeing that core financial records cannot be encrypted or wiped by malicious software.

Crucially, the regulatory body is also preempting the challenges of next-generation finance. As Artificial Intelligence (AI), blockchain, and algorithmic trading begin to disrupt global markets, SEBON has drawn a hard line to prevent tech-driven market manipulation. The deployment of any algorithmic trading software now requires explicit prior approval. More importantly, the policy mandates a "human-in-the-loop" philosophy: AI cannot operate unchecked. Any automated, machine-learning-driven decisions must feature compulsory human oversight and remain fully explainable, safeguarding the bourse from algorithm-induced flash crashes.

Ultimately, this decisive policy intervention signals the maturation of Nepal’s capital market. By adopting international best practices and demanding robust, proactive digital defenses, SEBON is moving beyond merely policing financial transactions. It is actively engineering a resilient, future-ready financial ecosystem designed to inspire investor confidence in an era defined by digital volatility.