Data residency for Bangladeshi financial institutions

Residency is about location: where the disks that hold your data sit, and where the servers that process it run. It is different from data sovereignty (which law applies) and from data security (how well it is protected), though the three overlap. A system hosted abroad can be secure and still fail a residency requirement.

The requirement usually covers more than the production database. Backups, disaster recovery replicas, logs and test copies that contain real customer records all count.

• Supervision. A regulator can inspect, audit and, if needed, seize systems inside its jurisdiction. It cannot do that abroad.
• Continuity. If an international link fails or a foreign provider changes terms, domestic banking must keep running.
• Privacy. Customer financial records are among the most sensitive data a country holds.

Bangladesh Bank's ICT guidelines set the expectations for banks and financial institutions; confirm the current version and the exact scope with your compliance team.

1. 01Map the data. List every system that holds customer or transaction data, including backups and DR. Residency failures are usually in the copies nobody drew on the diagram.
2. 02Host core systems in-country. Colocation for owned hardware, cloud servers for applications that need to scale. Mango's data centre and Mango Cloud both run in Dhaka.
3. 03Keep DR in-country too. A second site connected by a private circuit, or Backup-as-a-Service, gives you recovery without exporting data.
4. 04Sign transactions with a licensed CA. Digital signatures from a CCA-licensed authority keep approvals legally valid and auditable.
5. 05Keep the evidence. Contracts, facility details and network diagrams that show where data lives are what an auditor asks for.