The Securities Board of Nepal (SEBON), the country's capital market regulator, has introduced an information technology (IT) policy aimed at strengthening cybersecurity across Nepal's securities market, with the new framework coming into effect on Wednesday. The move follows a ransomware attack on a data centre that forced the country's stock market to shut down on September 21, an incident that halted trading outright and drew attention to the vulnerability of the systems on which the market depends. Alongside the policy, SEBON is also considering the development of a separate central data bank for the stock exchange market, an initiative intended to ensure that securities market data can be stored safely within Nepal.

A regulatory response to a digital-age threat

The introduction of the IT policy represents a formal, regulatory-level response by SEBON to the growing cyber risks facing the capital market. As reported by OnlineKhabar, the policy came into effect on Wednesday and is designed to strengthen cybersecurity in the capital market, placing technology governance at the heart of the regulator's oversight of the securities industry.

The emphasis on cybersecurity reflects the realities of a modern exchange. Securities trading is an almost entirely digital exercise: orders are placed through electronic systems, records of ownership are maintained on centralized databases, and regulators depend on continuous data flows to supervise the market. In such an environment, the failure or compromise of a single piece of infrastructure can interrupt trading across the board, which is precisely what the market experienced when the data centre came under attack. By adopting a dedicated IT policy, SEBON is signalling that the protection of trading systems and market data is now a core regulatory concern rather than a technical afterthought.

The September 21 ransomware shutdown

The immediate trigger for the new framework was the ransomware attack that forced the stock market to shut down on September 21. Ransomware attacks typically involve malicious software that infiltrates a computer system, locks or encrypts its data, and demands payment for the restoration of access. When such an attack hits infrastructure as critical as the data centre serving the country's securities market, the effect is immediate and total: trading cannot proceed, brokers are unable to execute orders, and investors are left without access to the market.

According to My Republica, SEBON has turned stern on preventing cyber attacks on the stock exchange platform in the wake of the incident. The September 21 shutdown was more than an inconvenience for traders; it was a reminder that the market's continuity rests on a narrow set of technological systems, and that a single successful intrusion can suspend the buying and selling of securities nationwide. For a market that depends on the confidence of its participants, demonstrating that such an interruption cannot easily be repeated has become an urgent priority for the regulator.

A central data bank to keep market data at home

In addition to the policy, SEBON is weighing a structural initiative: the development of a separate central data bank for the stock exchange market. The stated aim is that securities market data can be stored safely within Nepal, keeping the records that underpin the market under domestic control.

Such a repository could serve several purposes for the market:

  • providing a single, authoritative home for securities market data;
  • giving the regulator a clearer line of sight into the market's information flows, strengthening both routine supervision and the response to any future incident; and
  • ensuring that sensitive market data is stored safely within Nepal, where domestic institutions can protect and oversee it directly.

The idea speaks to a broader principle of data sovereignty, the notion that information as critical as securities ownership and trading records should remain within the country's borders and under domestic oversight. SEBON has framed the data bank as a consideration at this stage rather than a completed project, but its emergence alongside the IT policy suggests the regulator is looking beyond immediate cyber defences toward the long-term resilience of the market's data infrastructure.

What is at stake for the market

For investors, brokers and listed companies alike, the significance of these measures lies in continuity and trust. Market participants need assurance that the systems through which they trade and hold securities are protected against intrusion, and that a repeat of the September 21 disruption can be prevented. The IT policy, now in force, and the proposed central data bank are the regulator's most visible answers to that concern since the attack.

As with any regulatory framework, the test will be implementation: whether the cyber defences envisaged in the policy are put into practice across the market's institutions, and whether the data bank moves from consideration to construction. What is already clear is that cybersecurity has moved to the centre of Nepal's capital market agenda, with SEBON signalling that the protection of the market's technology now ranks alongside its financial supervision.