An Entrepreneur’s Guide to Online Business Laws in Bangladesh

The Growth and Governance of Digital Commerce

The digital commerce landscape in Bangladesh has transitioned from an era of unchecked expansion to one of structured oversight. While the success of pioneers like Daraz and Chaldal demonstrated the market’s vast potential, the “wild west” period, marked by the high-profile collapses of fraudulent platforms such as Evaly and e-Orange, exposed systemic vulnerabilities in consumer protection.

In response, the Ministry of Commerce has implemented a rigorous regulatory framework designed to purge the market of predatory actors. For the modern entrepreneur, legal compliance is no longer a bureaucratic hurdle; it is the baseline for institutional legitimacy. Transitioning from an informal operation to a regulated entity is the only viable pathway to achieve sustainability and build lasting consumer equity in Bangladesh’s digital economy.

For burgeoning entrepreneurs and interested parties, the following processes and steps should serve as an initial guide to setting up an Online Business in Bangladesh.

Establishing a Legal Identity and Ensuring the Protection of Assets

To operate legally, all digital commerce businesses (DCBs), including Facebook-based (F-commerce) ventures, must establish a formal legal identity. Regulatory transparency laws require that these formal identifiers be prominently displayed in the “About” section of social media pages and the footers of official websites.

All online businesses, hoping to operate in Bangladesh, must possess a set of Mandatory Identifiers. These include a valid:

• Trade License;
• Tax Identification Number (TIN);
• Business Identification Number (BIN); and the
• Digital Business Identification (DBID).

From a risk management perspective, it is strongly advised that entrepreneurs elect to pursue Strategic Incorporation. This is the case as incorporation as a Private Limited Company provides a vital shield for personal assets against civil claims. That being said, it does not offer immunity for criminal conduct. Under Section 73 of the 2009 Act, directors can still face personal prosecution for company offenses such as “fraud” or “non-delivery.”

The rules are slightly different for Foreign Entities. It is vital to note that Foreign Digital Commerce Businesses must obtain prior government permission and complete local registration before commencing any operations within the territory of Bangladesh.

Delivery, Payments, and Service Standards

Daily operations are governed by the Digital Commerce Operation Guidelines 2021. These rules are designed to prevent the liquidity traps that previously destabilized the sector.

At present, there are several Payment and Escrow Restrictions. Under these stipulations, businesses may only accept 100% advance payments for goods that are “ready to ship.” For goods not “ready to ship” within 48 hours, direct advance payments are legally restricted. Entrepreneurs must utilize a Bangladesh Bank-authorized escrow system, where 100% of the payment is held by a third party until successful delivery is verified.

Strict Delivery and Refund Timelines must also be adhered to. Rules pertaining to delivery and refund timelines include the following:

• Handover: Goods must be handed to a delivery agent within 48 hours of payment. This handover must be communicated to the buyer via telephone, email, or SMS.
• Final Delivery: Delivery must be completed within 5 days for intra-city transactions and within 10 days for nationwide orders.
• The Refund Rule: If a product cannot be supplied, the buyer must be notified within 48 hours. The refund process must be initiated within 72 hours, with the full amount returning to the customer’s original payment method within a maximum of 10 days.

Businesses must also follow certain Linguistic and Service Requirements. As such, all Terms and Conditions must be provided in Bangla (additional languages are permitted). For service-based DCBs, the platform must explicitly state the provider’s qualifications, the technology used, and the delivery method to ensure transparency.

Data Privacy & Cybersecurity

We are currently witnessing a significant shift in digital policy. The legal landscape has shifted with the repeal of the Cyber Security Act, 2023. In its place stands the Cyber Protection Ordinance, 2025, which introduces more stringent requirements for data transparency and the National Cyber Protection Agency’s oversight.

Under the new Ordinance, there are certain requirements around Mandatory Transparency. In regard to this DCBs must explicitly inform users what data is collected, where it is stored, how it is processed, and its intended future use.

Consent Protocols must also be considered by those looking to operate an online business. Websites must implement immediate cookie consent notifications upon a user’s arrival on the webpage. Furthermore, explicit consent for data usage terms must be obtained via active mechanisms, such as checkboxes, before any personal information is processed.

Enforcement and Liability

The Consumer Rights Protection Act, 2009 grants the Directorate of National Consumer Rights Protection (DNCRP) extensive powers to ensure market discipline.

The DNCRP is endowed with specific Enforcement Powers. Under these, the DNCRP is permitted to conduct market raids and investigate complaints filed through the national hotline which can be contacted via the following number: 16121. Under the Mobile Court Act, 2009 magistrates may also conduct on-the-spot trials for violations.

Online business practitioners must also be aware of Financial and Criminal Penalties. Administrative fines for violations, such as misleading advertisements or failure to deliver, range from Tk 25,000 to Tk 200,000. Under the Act, repeat offenders face doubled penalties and potential imprisonment of up to three years.

The Act also outlines a Complainant Incentive. This is a unique feature of the law. It establishes a 25% reward system: which means that when a consumer’s complaint leads to a fine, the DNCRP awards 25% of that fine amount to the complainant, incentivizing high levels of public vigilance.

Compliance Infrastructure and Intellectual Property Protection

Proper administrative and financial infrastructure is the hallmark of a professional enterprise.

Entrepreneurs must not use personal bank accounts for business. For smaller-scale vendors, the Bangladesh Bank has introduced the Personal Retail Account (PRA), which allows micro-entrepreneurs to accept digital payments legally without a full commercial bank account.

Under the Trademarks Act 2009, registering all Intellectual Property – such as the brand name and logo – is a strategic necessity. It provides the legal basis to combat counterfeiters and ensures that a brand’s unique identity is protected in a crowded digital marketplace.

Every DCB is required to appoint a Compliance Officer to act as a liaison with the DNCRP. This Compliance Officer is responsible for resolving consumer grievances; a solution must be communicated to the complainant within 72 hours of the grievance being filed.

Compliance as a Competitive Advantage

In the current regulatory climate, legal compliance should be viewed as a strategic asset rather than a burden. By adhering to registration mandates, strict delivery timelines, and the new 2025 cybersecurity standards, professional entrepreneurs distinguish themselves from the fraudulent actors that have previously tarnished the sector. Rigorous compliance fosters consumer trust, attracts institutional investment, and shields the entrepreneur from the severe personal liabilities and reputational damage associated with non-compliance. Regulatory excellence is the new gold standard for consumer trust in Bangladesh.

By aligning with these standards today, you are doing more than just following the law, you are future proofing your brand for institutional investment and long-term sustainability.

At Sadat Sarwat and Associates, we regularly advise clients on the legal requirements associated with starting and running a business. Our goal is to deliver practical, effective, and highly relevant legal advice for all our clients.

Disclaimer: This article is intended for general informational purposes only and does not constitute legal advice. Specific legal counsel should be sought before undertaking any public offering. Sadat Sarwat and Associates, a full-service law firm, in association with our partner firms, is well-positioned and fully equipped to provide comprehensive legal assistance in this regard. Interested parties are encouraged to reach out.

References:

Consumer Rights Protection Act 2009
Digital Commerce Operation Guidelines 2021
Cyber Security Ordinance 2025
Trademarks Act 2009
Mobile Court Act 2009
Food Safety Act 2013
Essential Commodities Act 1956
Cyber Security Act 2023 (Repealed)

Share this Article

Find Here More Articles