ARCHIVES
Law Digest March 2026
bangladesh
Banking and Finance
BRPD-1 Circular Letter No. 07 dated 3 March 2026 issued by the Banking Regulation and Policy Department-1 on “Loan Facilities for the Payment of Salaries and Allowances to Workers and Employees of Active Export-Oriented Industrial Establishments”.
The circular introduces a special term loan facility specifically for export-oriented industries to cover worker salaries and allowances for February 2026 to address global economic disruptions and liquidity challenges. Eligible establishments, which are defined as those exporting at least 80% of their production and having a consistent payment record from November 2025 to January 2026, can access these loans outside of their existing working capital limits at prevailing market interest rates. The loan amount is capped at the average of the previous three months’ salary payments, and to ensure transparency, funds must be disbursed directly to workers’ bank or mobile financial service accounts. Borrowers are granted a one-year repayment period, which includes a three-month grace period, provided they secure certification from relevant trade bodies like the BGMEA or BKMEA.
FEID Circular No. 01 dated 8 March 2026 issued by the Foreign Exchange Investment Department on “Master Circular on Share Transfers and the Repatriation of Share Sale Proceeds for Non-Residents in Private/Public Limited Companies Not Listed on Stock Exchanges”.
The circular consolidates and liberalizes procedures for the transfer by non-residents of the shares of unlisted private and public companies and the repatriation of the sale proceeds. It allows authorized dealer banks to repatriate proceeds without prior approval in specified cases, introduces simplified valuation thresholds, and sets clear timelines for completing transactions. The circular outlines general instructions, such as signing a memorandum of understanding, using audited financials not older than six months, and ensuring compliance with tax, know your customer, and AML/CFT standards. It prescribes valuation methods (net asset value, market approach, and discounted cash flow) and requires qualified independent valuers to prepare reports under international standards. Post facto reporting obligations, capital reduction rules, and committee oversight within authorized dealer banks are also mandated.
These circulars repeal earlier circulars on the subject.
BRPD-1 Circular No. 07 dated 11 March 2026 issued by the Banking Regulation and Policy Department-1 on “Loan Facility Against Government Bonds (Treasury Bonds)”.
Under this circular, the Bangladesh Bank now permits scheduled banks to offer loans against Treasury bonds in an amount of up to 75% of the bond’s face value. These bonds must be marked as a “lien” in the Financial Market Infrastructure system before disbursement, with the loan tenure constrained by the bond’s remaining maturity. The regulations explicitly prohibit financing for the purchase of Treasury bonds to ensure the policy applies only to existing holdings.
laos
Technology
Law No. 87/NA on “Cybersecurity” issued by the National Assembly on 25 June 2025 and published on the Lao Official Gazette’s website on 20 March 2026
This law sets out the principles, regulations, and standards for the management and monitoring of cybersecurity affairs to protect IT systems and information from cybersecurity attacks.
Some of the highlights are outlined below.
1. Defined terms
This law introduces the following defined terms, which were not expressly provided under the Law on the Prevention and Combating of Cybercrimes No. 61 dated 15 July 2015.
- Artificial intelligence (“AI”)
- Cloud system
- Control system
- Cyberspace
- Computer emergency response team
- Cyber threat
- Cyberattack
- Distributed denial of service (DDoS)
- Firewall
- Malware
- Ransomware
- Secure digital ecosystem
2. Critical national information infrastructure
Section 3 of the law provides provisions on national critical information infrastructure (“NCII”), which is important to the stability, peace, and security of the nation. NCII includes infrastructure in the following sectors:
- National defense and public security
- Technology and communications
- Finance and banking
- Energy
- Commerce, transport, and logistics
This section further specifies that the Ministry of Technology and Communications (“MTC”), in coordination with the relevant authorities, is responsible for compiling a list of the NCII operators under the above sectors and submitting it to the Government of the Lao PDR (“GOL”) for approval at least once a year.
3. National Cybersecurity System
Operators of NCII must comply with any standards issued by the MTC in relation to the National Cybersecurity System (“NCS”), a centrally operated 24/7 system under the MTC. The NCS is equipped with modern technologies, big data and AI analysis capabilities, and expert personnel to monitor, analyze, issue alerts, and counter cyber threats, and to provide advice and technical assistance relating to cybersecurity.
4. Cybersecurity standards
All legal entities and organizations must comply with the following cybersecurity standards:
- Conduct risk assessments at least once a year.
- Implement access controls to limit accessibility, and multi-factor authentication.
- Protect sensitive and critical data through appropriate authentication measures, including strong passwords.
- Ensure network security protection, such as a firewall and a cyberattack detection system.
- Implement any additional measures as necessary.
Guidelines on the above will be provided in separate implementing regulations.
5. Cybersecurity emergencies
All legal entities and organizations must have the following cybersecurity emergency response measures:
- A 24/7 system to detect and analyze cyberattacks, with clear reporting and alert procedures, overseen by qualified experts, and supported by a backup response plan in case of emergencies.
- A clear cyberattack response plan, defining the roles and responsibilities of the cybersecurity team, setting out measures to mitigate damage, and establishing reporting and alert procedures to the relevant authorities and sectors.
In the event of a critical cybersecurity emergency that significantly affects the nation’s socioeconomic development, the MTC may request that the GOL declare a state of emergency. Following such declaration, the GOL will establish a committee composed of representatives from relevant ministries and sectors that may implement restrictive measures, including the partial or complete suspension of communication, internet, and telecommunication services.
During a state of emergency, all legal entities and organizations must ensure that data is securely stored in cloud systems and/or hardware to enable recovery, and must prepare and submit an emergency assessment, control, and restriction plan to the committee and the MTC.
6. Cybersecurity annual report
All legal entities and organizations must submit an annual report to the MTC in January of each year covering the following:
- The implementation of cybersecurity measures;
- Cybersecurity incidents that have occurred and the corresponding responses;
- Progress on the implementation of cybersecurity plans;
- Identified system vulnerabilities and remedial actions taken;
- Cybersecurity training conducted; and
- The cybersecurity plan for the forthcoming year.
7. Cybersecurity service businesses
Legal entities must apply to the MTC for a license to operate the following cybersecurity service businesses:
- Cybersecurity consultancy
- Cybersecurity system development and installation
- Penetration testing
- Countering cyberattacks
- Training
- Quality testing
- Surveillance and monitoring
- Data recovery
- Cloud systems
- Other cybersecurity services
Upon receipt of a complete application, the MTC will coordinate with the relevant sectors, and within 15 days thereafter, will review and make a decision. If approved, it will issue a business operation license; if rejected, it will notify the applicant in writing.
The cybersecurity business operation license is valid for one year and may be renewed within 30 days prior to its expiry.
8. Cybersecurity registration
Individuals, legal entities, and organizations that provide services that publish, distribute, or supply data through internet systems in the Lao PDR must register with the MTC for cybersecurity compliance on protecting systems, critical data, and personal data, and promoting a secure digital ecosystem.
Such services include, among others, database services, cybersecurity services (including those provided on a non-profit basis), website domain services, digital payment services, and telecommunications services.
After receiving a complete application for registration, the MTC will review and make a determination on whether to issue a registration certificate within 30 days.
Labor
Decision No. 850 dated 11 March 2026 issued by the Ministry of Labor and Social Welfare (“MOLSW”) on the “Management of Recruitment Agency Services”
This decision, which entered into effect on 25 April 2026, sets out the regulations and guidelines governing the establishment, requirements, and management of recruitment agencies providing employment recruitment services domestically and for overseas placement. It replaces the previous version dated 25 June 2022.
Key changes are provided below.
1. Approval authority
Under the 2022 decision, entities were required to apply for a recruitment agency business operation license through the One-Stop Service Office, with approval from the MOLSW (for domestic services) and the Ministry of Planning and Investment (for both domestic recruitment and overseas placement).
Under this decision, entities must now submit their application to the MOLSW’s Department of Employment (“DOE”), with confirmation from the Labor and Social Welfare Office at the central and provincial levels where the entity is located.
2. Requirements
Entities applying for a recruitment agency business operation license must meet the following requirements:
- Be a Lao national with full legal capacity (the business is restricted to Lao citizens).
- Not be subject to bankruptcy proceedings.
- Maintain registered capital of at least LAK1 billion for solely domestic recruitment (previously only LAK200 million), or LAK5 billion for both domestic recruitment and overseas placement (previously only LAK2 billion).
- Have a feasibility study and a business operation plan.
- Possess adequate office premises, equipment, tools, vehicles, and other facilities necessary for its operation.
- Establish a labor skills development center or enter into a cooperation agreement with a qualified center.
- Employ at least two qualified personnel with a minimum of two years’ relevant experience.
This decision removes several previous requirements, including: a minimum age of 25 years (now aligned with the legal capacity age of 18); educational qualifications; health requirements; the requirement for the investor to have a clean criminal record; and the obligation for the applicant to submit the application in person.
3. Renewal period
The recruitment agency business operation license is valid for three years. This decision extends the renewal application period from 45 days to 60 days prior to the expiry date.
4. Assessment of business operations
This decision introduces an annual assessment of recruitment agencies, to be conducted by a committee established by the MOLSW and chaired by the director general or deputy director general of the DOE. The DOE is responsible for submitting both the assessment plan and the assessment results to the minister of the MOLSW for approval.
The outcome of the assessment will determine the renewal period of each recruitment agency’s business operation license, as follows:
- Excellent: Awarded a certificate by the MOLSW and granted a three-year renewal term.
- Good: Issued a letter of commendation and granted a two-year renewal term.
- Average: Issued a written warning and granted a one-year renewal term.
- Poor: Subject to suspension of operations.
Agricultural
Decree No. 18 issued by the GOL on 26 February 2026 on “Rubber Plantations and Production”
This decree, which entered into effect on 20 April 2026, establishes the legal framework for the management of rubber plantations, latex harvesting, the manufacturing of rubber products, and related business activities, in alignment with the national roadmap for green and sustainable socioeconomic development.
Key highlights are provided below.
1. Registration of rubber plantations and confirmation of rubber trees
Individuals, legal entities, and organizations that own rubber plantations or rubber trees must register their rubber plantations and trees to verify ownership of latex and rubberwood. Registration is carried out with the agricultural and environmental authorities. For rubber trees planted on an area of less than 1,600 square meters, or planted in a non-systematic manner, confirmation is conducted at the subdistrict authority level.
The procedure for registration will be provided in a separate regulation.
2. Latex harvesting and rubberwood logging
Individuals, legal entities, and organizations that own rubber plantations or rubber trees may harvest latex, log rubberwood, and sell such products without prior approval; however, they must notify the district agricultural and environmental authorities for monitoring.
They are required to ensure the quality and storage life of the latex and comply with applicable technical requirements for latex harvesting, including that the trees must be at least five years old, the tapping height must not exceed 150 cm from the ground, the trunk circumference must be at least 50 cm, harvesting must be conducted between 1:00 a.m. and 6:00 a.m., and tapping must be carried out on an intermittent basis.
Detailed technical procedures for latex harvesting will be set out in a separate regulation.
3. Importation, exportation, and transportation of rubber trees, rubber products, and wood
Importation: The importation of rubber tree species, rubber products, and rubberwood for the purpose of supplying domestic demand must be supported by a certificate of origin from the country of export, must be approved by the agricultural and environmental authorities, and is subject to inspection by the plant quarantine authority and other relevant authorities.
Exportation: The exportation of rubber tree species, rubber products, and rubberwood must be approved by the agricultural and environmental authorities and be accompanied by a certificate of origin issued by the industry and commerce authority. In addition, rubberwood must be supported by a rubber plantation certificate and a rubber tree certificate.
Domestic transportation of rubber and rubber products: Notification must be provided to the district agricultural and environmental authorities specifying the quantity and weight to be transported, for monitoring purposes.
Domestic transportation of rubberwood: Notification must be provided to the district agricultural and environmental authorities, specifying the quantity, destination, and weight, for monitoring purposes.
4. Rubber businesses
All legal entities and organizations wishing to engage in the following rubber-related business activities must obtain a business operation license from the agricultural and environmental authorities, while individuals must first establish and register a company with the industry and commerce authority before applying for the license:
- Rubber tree seedling production
- Commercial rubber plantations
- Rubber processing
- Import or export of rubber tree species, rubber products, and rubberwood
- Sale and purchase of carbon credits derived from rubber plantations
- Purchase of rubber
- Other rubber-related business activities
Upon receipt of a complete application, the agricultural and environmental authorities will review the application and issue the business operation license or notify the applicant of its rejection in writing within 10 days.
The rubber business operation license is valid for two years and may be renewed within 60 days prior to its expiry.
myanmar
Taxation
“Excise Law” No. 13/2026 dated 7 March 2026 issued by the National Defence and Security Council
This law repeals the Myanmar Excise Act (1917). It establishes a new legal framework on the manufacturing, storage, transportation, distribution, sale, exportation, and importation of alcohol and other excisable products in Myanmar.
Effectiveness
The law will come into effect on the date specified by the President by notification.
Key Changes in the 2026 Excise Law
We highlight the key changes in the 2026 Excise Law in the sections below.
a) Formation of a new regulatory committee
An Excise Policy Committee will be formed. It will have up to 15 members and be chaired by the Union Minister of the Ministry of Home Affairs. The committee will adopt excise policies covering all areas, such as regulatory control of health and social impacts, exportation and importation of excisable products, and the establishment of breweries, distilleries, and wineries. The policies will be reviewed every five years.
b) Change in the alcohol content threshold for what constitutes alcoholic liquor
The alcohol content percentage threshold has been decreased from 2% to 0.5%. This means that any liquid containing 0.5% or more of ethyl alcohol is considered alcoholic liquor.
c) Eligibility and foreign equity specification
The most significant change is in Section 12, which sets a 49% foreign equity limit on excise business operators.
- Eligibility for excise licenses is now restricted to citizens or companies registered as “local” (i.e. having a foreign shareholding of 49% or less). (See the table below for a summary of those eligible, by category.)
- Those currently operating with a majority‑foreign ownership may no longer be able to renew their license once the pending legislation is formally proclaimed by the President.
| Category | Eligibility description |
| Individual | Citizens of Myanmar, associate citizens, or naturalized citizens under the Myanmar Citizenship Law |
| Corporate | Companies registered in Myanmar in accordance with the Myanmar Companies Law, which include Myanmar-owned companies or foreign companies with a foreign shareholding of 49% or less |
| Organizational | Myanmar national sole proprietorship companies, business organizations, or partnerships formed by Myanmar nationals |
Licensing and Registration
Sections 13–16 replace the previous licensing system with a five-tier approval chain. Applicants must undergo a review process starting at the district level, passing through township and regional governments, and concluding with the approval of the General Administration Department. All licenses expire at the end of the fiscal year, regardless of the issuance date.
A summary of the license categories and their scope is provided in the table below.
| License category | License scope |
| Manufacturing | The production of alcohol by any method, and redistilling, ageing, purifying, flavoring, coloring, or mixing it with any substance. |
| Value-added manufacturing | The production of alcohol using advanced technology for further processing. |
| Bottling | The transferring of alcohol into bottles, cans, or jars, as well as the labelling. |
| Distribution | The wholesale transfer of alcohol to a license holder in quantities exceeding the amount specified by the Ministry of Home Affairs. |
| Sale | The retail transfer of alcohol or excisable substances to a buyer. |
| Others | Excise businesses as designated by the General Administration Department under a notification. |
Establishment and Expansion of Factories
Under Section 38, the establishment of new factories, as well as a factory’s relocation, production expansion, or increase in land area now requires ministry‑level approval.
Social Safeguards and Labor Restrictions
The law introduces social safeguards that directly restrict existing marketing strategies, prohibiting the following:
- Billboard and leaflet advertising, free samples, and lucky draws
- Online sales and automated vending
- The employment of women in areas where alcohol is sold (Section 72)
Offenses and Penalties
Enforcement mechanisms have been updated to reflect current economic conditions. There are two types of actions:
- Administrative actions: Administrative actions cover fines and disciplinary penalties (such as license suspension or revocation), as imposed by the General Administration Department on an excise business license holder.
- Criminal penalties: The criminal penalties (mostly in relation to the manufacturing, storage, transportation, distribution, sale, exportation, and importation of alcoholic liquor without any relevant license) specified are fines ranging from MMK1 million to MMK100 million and imprisonment for a term ranging from six months to three years.
Finance
“Anti-Money Laundering Law” No. 16/2026 dated11 March 2026 issued by the National Defence and Security Council
This law repeals the 2014 Anti-Money Laundering Law. It has been updated to strengthen the compliance and obligations of all reporting organizations.
The previous law emphasized manual reporting, broad penalties, and basic identification of beneficial owners, with the threshold amount of transactions set by orders. This new law expands compliance obligations, granting the Ministry of Home Affairs new powers of digital surveillance, interception, and AI‑driven oversight. Thresholds remain order‑based but now extend to virtual assets and Central Bank digital currencies. Reporting is also digitized.
Governance and Oversight
The Central Body is chaired by the Union Minister of the Ministry of Home Affairs, is responsible for high-level policy formulation and national risk assessments.
Enforcement Powers
The Ministry of Home Affairs oversees the Myanmar Police Force’s Financial Intelligence Unit. Under this law, authorities may issue three-month renewable orders for:
- Digital surveillance: Access to computer systems, networks, and servers.
- Interception: Monitoring or seizing of faxes, electronic transmissions, and communication facilities.
- Observation: Audio/video recording of behaviors and conversations.
Reporting and Compliance Requirements
- Threshold transaction reporting: Mandatory reporting by reporting organizations of cash or property transactions exceeding limits set by the Central Body.
- Suspicious transaction reporting: Immediate submission for any transaction—regardless of size—lacking clear purpose or suspected as illicit proceeds.
- “No tipping off” rule: Strict prohibition against disclosing to a customer that a suspicious transaction report has been filed.
- Data retention: A mandatory five-year minimum for all transaction trails, metadata, and communication logs.
Offenses and Penalties
Non-compliance carries legal penalties, as follows:
- Corporate fines: MMK 100 million to MMK 500 million.
- Individual liability: Imprisonment of six months to five years and fines of up to MMK100 million.
- Asset sanctions: Provisions for the freezing and confiscation of suspected illicit proceeds.