FinTech law

Table of Contents

FinTech law in Nepal is governed by a multi-layered regulatory structure that has been rapidly expanded since 2019. The Payment and Settlement Act 2075 serves as the primary statute, while Nepal Rastra Bank (NRB) issues directives that shape how fintech companies are licensed, monitored, and penalized. Over 24.6 million mobile banking users and 18.94 million registered digital wallet users are now served by approximately 10 licensed Payment System Operators (PSOs) and 27 licensed Payment Service Providers (PSPs). Consequently, compliance with fintech regulations in Nepal has become essential for every startup, investor, and technology partner entering this market.

What Is FinTech Law in Nepal and Why Does It Matter?

Definition of Fintech Regulation in Nepal

FinTech law in Nepal refers to the complete body of statutes, directives, and guidelines that regulate technology-driven financial services. It is administered primarily by NRB's Payment Systems Department, with oversight from SEBON, Beema Samiti, and the Department of Money Laundering Investigation (DMLI). The framework covers digital wallets, mobile banking, QR payments, digital lending, remittance platforms, and emerging innovations tested under the regulatory sandbox.

Importance of Digital Financial Laws

Digital financial laws are necessary because Nepal's payment ecosystem has grown from a single wallet (e-Sewa, launched in 2009) to a nationwide network processing approximately 74 million mobile banking transactions worth Rs 618 billion per month. Without NRB fintech regulations, consumer funds, data privacy, and systemic stability would be exposed to uncontrolled risk. Furthermore, the National Statistics Office reports that 73% of Nepal's population now owns a smartphone, and mobile data costs have fallen from $2.25 per GB in 2019 to $0.43 per GB in 2023. Therefore, robust digital payment laws in Nepal are no longer optional; they are mandatory for market participation.

FinTech Law in Nepal: Primary Legal Framework

The fintech legal framework in Nepal is built upon several core statutes. Each law addresses a distinct aspect of digital financial operations.

Legislation	Year	Key Provisions for FinTech
Payment and Settlement Act 2075	2019	Core payment system regulation, licensing authority for PSOs and PSPs, National Payment Board formation
Nepal Rastra Bank Act 2058	2002	Central bank powers, monetary policy, draft 2026 amendment proposes reclassifying PSPs/PSOs as financial institutions
Banks and Financial Institutions Act 2073	2017	Banking regulation, BFI supervision, digital lending authorization
Electronic Transactions Act 2063	2008	Digital signatures, e-contracts, cybercrime prosecution, electronic evidence
Asset (Money) Laundering Prevention Act 2064	2008	AML/CFT obligations, suspicious transaction reporting to FIU-Nepal
Consumer Protection Act 2075	2018	Consumer rights, grievance redressal, data privacy protections
Companies Act 2063	2006	Company incorporation, governance structure for fintech entities
Foreign Investment and Technology Transfer Act 2075	2019	Foreign ownership, technology transfer, automatic route eligibility
Foreign Exchange Regulation Act	1962	Currency control, cross-border transaction approvals

Additionally, the Unified Payment System Directive 2082 (issued April 2026) and the Cyber Resilience Guidelines 2023 set the current operational standards for licensed institutions. Moreover, the Digital Lending Guideline 2078 (First Amendment, 2026) governs how banks and financial institutions may disburse loans through electronic channels.

How FinTech Licensing in Nepal Is Governed by NRB

Payment System Operator License Requirements

A Payment System Operator (PSO) license is required by institutions that operate clearing houses, electronic card networks, and online payment infrastructure. The license is issued by NRB under the Payment and Settlement Act 2075. Furthermore, PSOs must maintain minimum paid-up capital of NPR 100 million and connect to the Retail Payment Switch. The license validity is set at 5 years, after which renewal is mandatory following on-site examination.

Payment Service Provider License Requirements

A Payment Service Provider (PSP) license is needed for companies offering mobile wallets, QR acceptance, payment gateways, and fund transfer services to end users. PSPs are categorized into Class A and Class B. Notably, PSPs must back 100% of customer float through a settlement bank agreement. The end-of-day wallet balance cap is fixed at Rs 50,000 per user under current payments related unified directives.

Capital Requirements for FinTech Companies

License Type	Minimum Paid-Up Capital (NPR)	Primary Activities
PSO	100,000,000	Clearing, switching, card networks, settlement infrastructure
PSP Class A	500,000,000	Large-scale digital wallets, nationwide QR, payment gateways
PSP Class B	100,000,000	Smaller wallets, niche payment services
Payment Aggregator	25,000,000	Merchant aggregation, multi-channel payment collection
Remittance Provider	10,000,000	Inbound and outbound remittance services

The licensing process follows a structured path. First, a company must be incorporated at the Office of Company Registrar. Second, a Letter of Intent is submitted to NRB. Third, a full license application is filed within 6 months. Fourth, NRB conducts infrastructure inspection within 30 days. Finally, the license is granted within 60 days of application submission, provided all conditions are satisfied.

FinTech Compliance Requirements in Nepal

Anti-Money Laundering Obligations

Every fintech entity is required to comply with the Asset (Money) Laundering Prevention Act 2064. Customer Due Diligence (CDD) must be performed at onboarding. Additionally, ongoing transaction monitoring, sanctions screening, and Suspicious Transaction Report (STR) filing to FIU-Nepal are mandatory. Records must be retained for a minimum of 5 years. A dedicated compliance officer must be appointed for AML oversight.

Cyber Resilience and Data Protection

The Cyber Resilience Guidelines 2023 mandate that licensed institutions implement data residency requirements, encryption at rest and in transit, and 7+ year audit log retention. Annual vulnerability assessments and business continuity planning are compulsory. Moreover, incident reporting to NRB is required whenever security breaches occur. Data localization is strictly enforced; consumer financial records and biometric data must be stored on servers physically located within Nepal.

Consumer Protection Standards

Under the Consumer Protection Act 2075, fintech companies must provide clear information regarding fees, interest rates, repayment obligations, and grievance-handling mechanisms. Pre-checked consent boxes are considered legally invalid. Customer data cannot be used for unrelated purposes, and third-party vendors must not access unencrypted personally identifiable information.

Compliance Pillar	Requirement	Governing Law/Directive
KYC Verification	Biometric and document-based identity verification	AML Act 2064, NRB Unified Directives
Data Localization	Servers must be located within Nepal	Cyber Resilience Guidelines 2023
Audit Logs	Minimum 7-year retention	Cyber Resilience Guidelines 2023
Float Backing	100% settlement-bank backing of customer funds	Payments Related Unified Directives
Annual Audit	Financial and system audits mandatory	Payment and Settlement Act 2075, Section 25
Grievance Handling	Digital complaint mechanism required	Consumer Protection Act 2075

Digital Lending Regulations Under FinTech Law in Nepal

Loan Limits and Eligibility

The Digital Lending Guideline 2078 (First Amendment, 2026) was issued to facilitate paperless lending. Only licensed Banks and Financial Institutions (BFIs) are permitted to offer digital loans. The revised limits are as follows:

Borrower Category	Maximum Loan Amount	Maximum Tenure
Individuals with salary/business accounts	NPR 500,000	3 years
Other individual borrowers	NPR 200,000	3 years
SMEs (short-term working capital)	NPR 500,000	1 year
SMEs (long-term working capital)	NPR 1,000,000	As per bank policy

Technology Partner Requirements

Banks are allowed to partner with licensed Payment Service Providers and technology service providers for customer outreach and credit analysis. However, the bank bears all lending risks. Extra service fees cannot be charged for using third-party partners. Furthermore, board-approved digital lending policies are mandatory before any loan product is launched. Real-time Credit Information Bureau (CIC) verification must be integrated through API interfaces.

Regulatory Sandbox for FinTech Innovation in Nepal

The Regulatory Sandbox Guidelines were finalized by NRB on 14 May 2026. This framework allows controlled testing of new financial products under live market conditions.

Eligible Products and Technologies

The sandbox permits testing of APIs, mobile money services, digital KYC tools, digital lending products, smart contracts, embedded finance solutions, regulatory technology (regtech), and cybersecurity products. Testing periods last up to 6 months, with a possible 6-month extension.

Excluded Activities

Cryptocurrency, virtual assets, Central Bank Digital Currency (CBDC), and online betting or gaming products are explicitly barred from sandbox testing. Any activity already prohibited under existing Nepali law is automatically excluded.

Application Requirements

Applicants must be incorporated in Nepal. A fit and proper assessment is conducted on beneficial owners, board members, and senior management. At least two full-time technical staff (software developers or cybersecurity specialists) and one project manager with 2+ years of fintech experience are required. Unlicensed fintech companies must partner with an existing licensed financial institution before testing begins.

Foreign Investment in Nepal FinTech Sector

Ownership Structure and FITTA Provisions

Foreign investment in Nepal's fintech sector is permitted under the Foreign Investment and Technology Transfer Act 2075. In most fintech sectors, 100% foreign ownership is allowed. The automatic route covers 102 sectors, and IT-related fintech activities may qualify for zero minimum investment. However, foreign investors must obtain approval from the Department of Industry (DOI) or the Investment Board Nepal (IBN) before applying for NRB licensing.

Automatic Route Eligibility

For investments up to NPR 500 million, the automatic route applies. Approval is typically granted within 7 days. For investments exceeding NPR 6 billion, IBN jurisdiction is triggered. Capital injection must follow a staged schedule: 25% within the license date, 15% within 1 year, 10% within 2 years, and the remainder before commercial operation.

Penalties for FinTech Law Violations in Nepal

Violation	Penalty	Enforcing Authority
Operating without NRB license	License suspension, criminal prosecution	NRB Payment Systems Department
Security compliance failure	Fine up to NPR 1,000,000	NRB
KYC/AML violation	DMLI referral, criminal charges	DMLI, FIU-Nepal
Data localization breach	Regulatory enforcement, suspension of services	NRB
Unauthorized transaction processing	Fine, license revocation	NRB
Predatory data collection	Suspension of digital lending privileges	NRB

Step-by-Step Guide to FinTech Company Registration in Nepal

Company Incorporation at OCR

A legal entity must first be registered with the Office of Company Registrar under the Companies Act 2063. The Memorandum of Association must clearly state fintech or payment-related objectives. PAN registration with the Inland Revenue Department is subsequently required.

NRB License Application Process

The application is submitted to NRB's Payment Systems Department with the following components: business plan, technical infrastructure documentation, capital proof, compliance policies, governance structure, and risk management framework. The timeline from application to full license issuance typically spans 12 to 24 months.

Post-License Compliance Obligations

Once licensed, the company must execute a settlement bank agreement, deploy interoperable QR standards, appoint a compliance officer, and submit quarterly digital lending reports (if applicable). Annual financial audits and system audits are mandatory. License renewal must be initiated before the 5-year expiry.

Frequently Asked Questions About FinTech Law in Nepal

Q1: What is fintech law in Nepal?
FinTech law in Nepal refers to the regulatory framework established by Nepal Rastra Bank and other authorities to govern digital financial services, including licensing, consumer protection, AML/CFT, and cybersecurity standards.

Q2: Which license is required to start a fintech company in Nepal?
A PSO license is needed for payment infrastructure, while a PSP license is required for wallets and merchant payments. Remittance providers need a separate remittance license. All are issued by NRB.

Q3: How much capital is required for a PSP license in Nepal?
PSP Class A requires NPR 500 million paid-up capital, while PSP Class B requires NPR 100 million. PSOs need NPR 100 million.

Q4: Can foreigners own 100% of a fintech company in Nepal?
Yes. Under FITTA 2075, 100% foreign ownership is permitted in most fintech sectors through the automatic route.

Q5: What is the regulatory sandbox in Nepal?
The regulatory sandbox, effective May 2026, allows fintech innovators to test products under NRB supervision for up to 6 months with reduced regulatory requirements.

Q6: What are the digital lending limits in Nepal?
Individuals with salary accounts can borrow up to NPR 500,000 digitally, while other individuals are limited to NPR 200,000. SMEs can access up to NPR 1,000,000 for long-term working capital.

Q7: Is cryptocurrency legal in Nepal?
No. Cryptocurrency trading, mining, and sandbox testing are explicitly prohibited under NRB guidelines and Nepal Rastra Bank Act provisions.

Q8: What cybersecurity standards must fintech companies meet?
Data residency, encryption, 7-year audit log retention, annual vulnerability assessments, and incident reporting to NRB are all mandatory under the Cyber Resilience Guidelines 2023.

Q9: How long does fintech licensing take in Nepal?
The complete process, from company registration to final license issuance, typically takes 12 to 24 months.

Q10: What penalties apply for operating a fintech without a license?
Criminal prosecution, fines up to NPR 1 million, and permanent license suspension may be imposed by NRB and DMLI.

Conclusion

FinTech law in Nepal has matured into a comprehensive regulatory ecosystem that balances innovation with financial stability. From the Payment and Settlement Act 2075 to the Regulatory Sandbox Guidelines 2026, every fintech entrepreneur, investor, and technology partner must navigate these rules carefully. The draft amendment to the Nepal Rastra Bank Act, which proposes reclassifying PSPs and PSOs as financial institutions, signals further evolution ahead.

Therefore, professional legal guidance is strongly recommended before entering this market. Attorney Nepal Pvt Ltd provides end-to-end fintech licensing support, NRB compliance advisory, foreign investment structuring, and regulatory sandbox application assistance. Contact our team today to ensure your fintech venture is built on a fully compliant legal foundation.

Disclaimer: This guide is published for informational and educational purposes only. It does not constitute legal advice, advertisement, solicitation, or inducement of any kind. Attorney Nepal Pvt Ltd shall not be liable for any consequences arising from actions taken based on the information contained herein. For specific legal advice tailored to your fintech venture, please consult a qualified legal professional.