How banks must keep digital trade documents safe, which outside platforms and service providers they may use, what they report, how the pilot starts and grows, and why Part E still applies to everything outside the pilot.
In Lesson 19, The legal base and e-documents in collections and LCs, Evelyn learned that her export documents can travel as electronic records under the pilot, and count like paper where they meet the legal and operational requirements. She left Habib's branch in Dhaka feeling very modern. Her T-shirts for Hamburg could soon be paid for without a single courier envelope.
Then, on the drive back to Gazipur, a worry crept in. "Paper sits in a locked cupboard," she thinks. "But a file on the internet? Anyone could copy it, change the price, or send it twice. And who is running these platforms anyway?"
Next morning she phones Habib. He laughs. "You sound like our compliance team. In fact, someone from that world is visiting us this week." The visitor is Ihsaan, a compliance and anti-money-laundering expert who has spent years spotting fake trade deals and weak systems. Ihsaan listens to Evelyn's worry and nods. "Good. Worry is the first security tool. The circular turns it into rules."
This lesson covers the last five paragraphs of Part F: technology, security and data integrity (F-9), using technology service providers (F-10), reporting (F-11), how the pilot is rolled out (F-12) and why Part E stays in force (F-13).
F-9 is the security chapter of the pilot. It has four parts, and they are mainly about what the AD (the bank) must do, not the exporter.
1. A safe road for the documents
ADs must make sure documents travel through secure transmission channels that have all four of these:
Encryption: the data is scrambled so outsiders can't read it.
Authentication: the system checks who is sending and receiving.
Time-stamping: every document carries a reliable record of when it was sent or received.
Tamper-proof audit logs: a record of every step that nobody can quietly change.
Think of a bank locker: a strong lock, an ID check at the door, a register with times, and CCTV that can't be erased. All four, not just one.
2. Recognised standards
The systems must comply with internationally recognised information security standards. The circular doesn't name a particular standard.
3. Where sensitive data sits
Sensitive document data shall not be mandatorily stored in shared or public infrastructures. Read simply, storing sensitive data on shared or public systems must not be made compulsory. The circular doesn't define "sensitive" or say more about who might require such storage.
4. A front door for customers
ADs must set up and maintain digital interfaces, platforms or secure channels so customers can submit, access, track and manage trade documents and data electronically. These must ensure data security, user authentication, auditability and compatibility with interoperable digital trade document systems.
At the desk
Evelyn asks Habib how she will actually send her e-documents. Habib shows her the bank's customer portal: she logs in with a password and a one-time code, uploads her invoice, and can see each step and its time as the file moves. Ihsaan points at the screen. "Log-in check, time stamps, a trail of every step. That is F-9 at work, from the customer's side."
Key words
Encryption
Scrambling data into a secret code so that only someone with the right key can read it.
Time-stamping
Recording, in a reliable way, the exact date and time a document was sent, received or changed.
Tamper-proof audit log
A record of every action on a document that nobody can secretly change or delete afterwards.
Information security standards
Recognised sets of good practice for keeping computer systems and data safe.
(2) Systems shall comply with internationally recognized information security standards.
(3) Sensitive document data shall not be mandatorily stored in shared or public infrastructures.
(4) ADs shall establish and maintain appropriate digital interfaces, platforms, or secure channels to enable their customers to electronically submit, access, track, and manage trade documents and related data flows under this framework. Such interfaces shall ensure data security, user authentication, auditability, and compatibility with interoperable digital trade document systems.
Source: Bangladesh Bank, FEPD-1 Circular No. 26, 30 July 2026, Part F, paragraph 9 (page 29). The original circular is the authority.
A bank doesn't have to build every piece of technology itself. F-10 says ADs may use digital trade platforms, service providers or open-source solutions, as long as they meet three tests:
They support interoperability, meaning they can work with other systems.
They enable independent verification of documents, so another party can check a document is genuine without simply trusting the platform.
They meet acceptable governance and security standards.
Then come two softer points:
Preference should go to solutions that avoid vendor lock-in and support cross-platform compatibility. Vendor lock-in is like buying a phone charger that fits only one brand: change phones, and the charger is useless. The word is "preference", not a ban.
Costs of these services may be treated as normal banking charges. The circular doesn't set an amount or a ceiling for them.
Notice what F-10 doesn't do. It doesn't name any approved platform or provider. It gives the tests, and the AD applies them.
At the desk
Habib's head office is choosing between two platforms. Both support interoperability, let the buyer's bank verify documents on its own, and meet governance and security standards. But one stores everything in its own special format, so moving away from it later would be hard and costly; the other works smoothly across platforms. Ihsaan advises, "Both pass the basic tests, but F-10 says to prefer the one that avoids lock-in and supports cross-platform compatibility." The bank picks the second one.
Key words
Interoperability
The ability of different systems to work together and exchange documents and data.
Vendor lock-in
Being stuck with one supplier's system because moving to another would be too hard or too costly.
Open-source solution
Software whose code is published openly, so anyone can check, use and improve it.
Read the rule as written (Para F-10)
(1) ADs may utilize digital trade platforms, service providers, or open-source solutions that:
(a) Support interoperability;
(b) Enable independent verification of documents; and
(c) Meet acceptable governance and security standards.
(2) Preference should be given to solutions that avoid vendor lock-in and support cross platform compatibility.
(3) Costs associated with such services may be treated as normal banking charges.
Source: Bangladesh Bank, FEPD-1 Circular No. 26, 30 July 2026, Part F, paragraph 10 (page 29). The original circular is the authority.
F-11 is one sentence, and it is about reporting. ADs must:
keep following their usual reporting requirements (the pilot doesn't switch them off); and
follow any additional instructions that Bangladesh Bank gives based on the pilot's outcomes.
So a deal done through a digital corridor is still reported the usual way. And because this is a pilot, Bangladesh Bank may ask for more as it learns what works. F-11 doesn't say what those extra instructions will be or when they will come.
At the desk
Evelyn's first e-document collection is paid, and she asks Habib, "Since everything was digital, does the bank skip its usual reports?" Habib shakes his head. "Same reports as always. And if Bangladesh Bank sends extra instructions after looking at the pilot, we follow those too."
Key words
Reporting requirements
The returns and information a bank must regularly send to Bangladesh Bank.
Pilot basis
Trying a new way of working first on a small scale, before using it widely.
Read the rule as written (Para F-11)
ADs shall observe usual reporting requirements, including additional instructions based on pilot outcomes.
Source: Bangladesh Bank, FEPD-1 Circular No. 26, 30 July 2026, Part F, paragraph 11 (page 29). The original circular is the authority.
F-12 tells us how the pilot starts and how it can grow.
Phased: the pilot is rolled out on a phased basis, step by step, not all at once.
Only on approved trade corridors: it runs under approved trade corridors. A deal outside an approved corridor is not a pilot deal. F-12 doesn't list the corridors.
Growth is earned: expansion depends on satisfactory performance and regulatory assessment. Like a new driver who first drives around the neighbourhood before the highway, the pilot widens only once it has shown it works.
The old rules still stand: existing foreign exchange regulations remain applicable unless otherwise modified. Going digital changes how documents travel. It doesn't cancel the rules on things like declaring exports and bringing the money home.
At the desk
Evelyn's cousin, who exports jute bags, asks whether he can use the digital pilot for a buyer in a different country. Habib explains that the pilot works only on approved trade corridors, so the first question is whether that route has been approved. "And even inside the pilot," Ihsaan adds, "the existing foreign exchange rules still apply unless they have been modified."
Key words
Phased basis
Rolling something out step by step, in stages, rather than all at once.
Approved trade corridor
A trade corridor approved for the pilot: an approved route between two countries or regions through which banks pilot the digital processing of trade documents.
Read the rule as written (Para F-12)
(1) The pilot framework shall be implemented on a phased basis under approved trade corridors.
(2) Expansion shall be subject to satisfactory performance and regulatory assessment.
The last paragraph of Part F answers a simple question: what happens to Part E now?
Part E stays in force. Part E is the circular's part on electronic presentation of export documents under documentary collections. The pilot doesn't replace it.
Part E covers what the pilot doesn't. Its instructions apply, mutatis mutandis (with the necessary changes), to transactions not covered by the pilot framework.
So there are two lanes. A transaction under the pilot, on an approved corridor, follows Part F. A transaction outside the pilot still has Part E to guide it. Nothing falls between the lanes.
At the desk
Evelyn has two shipments this month: one on a route that is part of the pilot, and one to a buyer outside any approved corridor, by documentary collection with electronic presentation. Habib explains that the first follows the Part F pilot rules, while the second follows Part E as before. Ihsaan smiles. "Two lanes, one road. Nobody is left without rules."
Key words
Mutatis mutandis
A Latin phrase meaning "with the necessary changes": the same rules apply, with the details adjusted to fit.
Documentary collection
The seller's bank sends the shipping documents to the buyer's bank, which hands them over only when the buyer pays or accepts a bill. No bank promise to pay.
Read the rule as written (Para F-13)
The provisions of Part-E of this circular shall continue to remain in force. The instructions contained therein shall apply, mutatis mutandis, to transactions not covered under the present pilot framework.
Source: Bangladesh Bank, FEPD-1 Circular No. 26, 30 July 2026, Part F, paragraph 13 (page 29). The original circular is the authority.
So far: under the pilot, ADs must send documents through channels with encryption, authentication, time-stamping and tamper-proof audit logs, follow recognised security standards, and give customers a secure digital front door. They may use outside platforms, providers or open-source tools that are interoperable, allow independent verification and meet governance and security standards, preferring those that avoid vendor lock-in. Usual reporting continues, the pilot grows in phases on approved trade corridors, existing foreign exchange rules still apply, and Part E keeps covering everything outside the pilot.
Next: Part F of the export room is complete. Part G, on developing alternative trade finance mechanisms, starts in Lesson 21, New ways to finance exports.
Check yourself
30 questions, in 3 sets of up to 10. Nobody sees your answers but you.
Set 1 of 3
F-9(1) lists all four: encryption, authentication, time-stamping and tamper-proof audit logs. (F-9)
F-9(1) puts the duty on ADs to ensure secure transmission channels. (F-9)
A tamper-proof audit log is a record of actions that cannot be quietly altered; F-9(1)(d) requires it. (F-9)
F-9(2) says systems must comply with internationally recognised information security standards. (F-9)
F-9(4) lets customers submit, access, track and manage trade documents and data; it says nothing about changing LC terms. (F-9)
True. F-9(3) says sensitive document data shall not be mandatorily stored in shared or public infrastructures. (F-9)
F-9(4) requires ADs to give customers digital interfaces to submit, access, track and manage trade documents. (F-9)
F-9(4) says customer interfaces must ensure data security, user authentication, auditability and compatibility. (F-9)
F-9(1) needs time-stamping and tamper-proof audit logs as well as encryption and authentication. (F-9)
Set 2 of 3
F-10(1) lists interoperability, independent verification and acceptable governance and security standards. (F-10)
F-10(2) prefers solutions that avoid vendor lock-in and support cross-platform compatibility. (F-10)
F-10(3) says such costs may be treated as normal banking charges. (F-10)
Vendor lock-in means being tied to one supplier; F-10(2) prefers solutions that avoid it. (F-10)
True. F-10(1) says ADs may use digital trade platforms, service providers or open-source solutions that meet its tests. (F-10)
F-10(1)(b) requires solutions that enable independent verification of documents. (F-10)
F-10(3) allows costs of these services to be treated as normal banking charges. (F-10)
F-10(1)(a) requires solutions that support interoperability, and F-10(2) prefers those that avoid vendor lock-in and support cross-platform compatibility. (F-10)
F-11 keeps the usual reporting and adds any instructions based on pilot outcomes. (F-11)
F-11 refers to additional instructions based on pilot outcomes. (F-11)