The Securities Board of Nepal (SEBON) has issued a new information technology policy for the country's capital and commodity markets, replacing a framework that had been in place for the past six years. The market regulator has brought the 'Nepal Securities Board Information Technology Policy, 2083' into implementation, retiring the Information Technology Policy, 2076. According to a RatoPati report, the revised policy is designed to make the capital and commodity markets modern, risk-free and internationally competitive. Its introduction follows a cyber attack on the share market, an incident that has sharpened attention on the security of the digital systems on which Nepali investors rely.

Six years on, a technology reset for the market

The 'Nepal Securities Board Information Technology Policy, 2083' replaces the Information Technology Policy, 2076 (Bikram Sambat), which had governed SEBON's approach to technology for six years. Policies of this kind set out how the board manages and oversees technology, from the security of its own systems to the digital resilience of the markets it regulates. Because both technology and the threats that travel with it evolve quickly, frameworks that are several years old can fall behind the risks of the moment. The 2083 policy is intended to close that gap.

The stated ambition behind the revision is threefold: a modern market, a risk-free market and an internationally competitive market. Significantly, the policy does not limit itself to the share market alone. By naming the commodity market alongside the capital market, SEBON has placed both segments under the same technology vision, a sign that the board sees digital resilience as a whole-of-market concern.

Key provisions: round-the-clock vigilance and yearly testing

Among the measures the new policy contains, two provisions stand out for the way they approach market security:

  • 24-hour monitoring: The policy provides for continuous, round-the-clock monitoring of systems. The idea is that unusual activity, technical disruption or intrusion can be spotted as it happens, rather than being discovered after damage has already been done.
  • Annual testing: The policy also calls for testing to be carried out every year. Periodic testing of technology systems is a standard cyber security practice, allowing weaknesses to be identified, controls to be verified and vulnerabilities to be closed before they can be exploited.
  • A risk-focused design: Taken together, the provisions give effect to the policy's central promise of a risk-free market, building vigilance into the routine operation of market systems rather than treating security as a one-time achievement.

Why continuous monitoring matters

For a securities market, where trading, clearing and investor services all run on digital platforms, timing is everything when things go wrong. The difference between catching a threat in real time and discovering a breach weeks later can determine how much damage is done, both to systems and to investor confidence. The 24-hour monitoring requirement is aimed at shrinking that window to zero, while the annual testing mandate creates a recurring, scheduled check on the health of the market's technology.

A policy shaped by a cyber attack

The timing of the new framework is difficult to ignore. SEBON has issued the policy in the aftermath of a cyber attack on the share market, and the emphasis on monitoring and testing speaks directly to the kind of incident the market has just experienced. The attack served as a reminder that as markets become digital, they also become targets, exposed to actors who seek to disrupt trading, steal data or exploit weaknesses in critical infrastructure.

The response embedded in the 2083 policy reflects a view of cyber security that regulators internationally have increasingly adopted: that protecting market systems is not a one-off investment but a continuous discipline of watching, testing and improving. By writing 24-hour monitoring and annual testing into policy, SEBON has moved that discipline from good practice to formal requirement.

What it means for investors and the market

The policy's stated goals of a modern, risk-free and internationally competitive market point to what SEBON hopes the revision will deliver:

  • For investors, the measures are aimed at making dealings in the share market safer, with systems watched around the clock and examined every year.
  • For the capital and commodity markets, the ambition of international competitiveness signals an intent to bring Nepal's market technology up to a standard that can stand comparison with markets elsewhere.
  • For SEBON itself, the new policy provides an updated mandate for overseeing technology across the markets it regulates, six years after its previous framework was introduced.

As with any policy document, the real test will lie in implementation. The requirements for round-the-clock monitoring and annual testing will now have to translate into day-to-day practice across the capital and commodity markets. If they do, SEBON's technology reset, arriving six years after its predecessor, may prove a significant step toward a share market that is safer for investors and more competitive by comparison.