Full Guide to Bangladesh Bank ICT Security Guideline v4.0: Physical Security Requirements for Banks

Bangladesh Bank issued its ICT Security Guideline version 4.0 with an effective date in 2022. Every scheduled bank operating in Bangladesh — commercial banks, Islamic banks, specialised banks, and foreign bank branches — must comply. Non-compliance is not a minor administrative issue; it carries regulatory penalties, adverse audit findings, and in serious cases, licence implications that boards and senior management cannot ignore.

This guide breaks down the physical security requirements of the guideline in plain language. We explain what is required, where it applies, and how your bank can achieve full compliance through a structured programme. We also cover the data centre and IT room requirements that are often overlooked until a Bangladesh Bank inspection reveals the gap.

Why Physical Security Is Central to Bangladesh Bank ICT Guideline v4.0

Information and Communications Technology security is not purely a software or network problem. Physical access to servers, network equipment, and communication lines is the most direct path to data theft, system sabotage, or service disruption. Bangladesh Bank recognised this when it expanded the physical security requirements significantly in version 4.0 compared to earlier editions.

The guideline treats physical security as a foundational control layer. If someone can walk into your server room, no amount of firewall investment protects your core banking system. The guideline therefore mandates specific physical controls for every branch, every ATM, every IT facility, and every data centre operated by a scheduled bank.

Scope: Who Must Comply

Every scheduled bank licensed by Bangladesh Bank must comply. This includes:

• All branches operating within Bangladesh, including sub-branches and agent banking outlets
• All ATM and CDM (Cash Deposit Machine) installations
• Head office and regional office premises
• Primary and disaster recovery data centres
• Any third-party facility where bank IT equipment is co-located or hosted

Foreign bank branches operating in Bangladesh are also subject to the guideline for their Bangladesh operations. A parent bank's global security policy does not substitute for Bangladesh Bank compliance unless it meets or exceeds all local requirements.

CCTV Requirements: Branch, ATM, Vault, and Server Room Coverage

Branch Premises

The guideline mandates CCTV coverage at all bank branches. Coverage must include the main banking hall, teller counters, cash counting areas, the entrance and exit points, and all areas where customers interact with cash or documents. Cameras must be positioned to capture clear facial images of persons entering and exiting.

Resolution requirements have been tightened in v4.0. Cameras must deliver sufficient image quality to identify individuals in investigation scenarios. In practice, this means full HD (1080p) minimum for most areas, with higher resolution required at ATM vestibules and cash vault areas where identification evidence is most critical.

ATM and CDM Installations

Every ATM and CDM must have dedicated CCTV coverage. The camera must capture the face of the person using the machine, the keypad area (though care must be taken not to capture PIN entry), and the immediate surrounding area to identify accomplices or surveillance activities. Vandal-resistant camera housings are required for ATM vestibule installations given the risk of physical tampering.

Cameras at ATMs must record continuously. Gaps in ATM CCTV recording have been a specific finding in Bangladesh Bank inspection reports. If your ATM runs on a separate power circuit from the branch, you need an independent UPS (Uninterruptible Power Supply) for the CCTV system at that location.

Cash Vault and Treasury Areas

Cash vaults, currency chests, and treasury areas require dedicated CCTV coverage with no blind spots. Cameras must cover vault door approaches, the interior of vaults where access is permitted, and the counting areas adjacent to vaults. Pan-tilt-zoom (PTZ) cameras are often used in larger treasury areas to supplement fixed cameras.

Server Rooms and IT Rooms

Server rooms, network equipment rooms, and any area housing core banking or critical IT infrastructure require CCTV coverage at entry and exit points. Internal coverage is also required for larger facilities. The guideline specifies that server room CCTV must be on a separate recording path from the general branch CCTV, ensuring IT room access is independently logged and reviewable.

90-Day Minimum CCTV Footage Retention

This is one of the most operationally significant requirements in the guideline. All CCTV footage must be retained for a minimum of 90 days. Many banks operating on older DVR (Digital Video Recorder) systems with limited storage were recording only 15-30 days when v4.0 came into effect.

Achieving 90-day retention requires proper storage capacity planning. The calculation depends on the number of cameras, their resolution, the frame rate, and whether H.265 compression (which reduces file size by approximately 50% compared to H.264) is used. A properly specified NVR (Network Video Recorder) or VMS (Video Management System) with sufficient attached storage is required.

For a typical branch with 12 cameras at 1080p resolution, H.265 compression, and 15 frames per second, 90-day storage requires approximately 4TB of dedicated storage. Larger branches with more cameras require proportionally more. Bangladesh Bank inspectors will check actual retention by requesting footage from specific dates 60-80 days in the past.

Cloud backup of CCTV footage is permitted as a supplementary storage solution, but the primary storage must be on-premise for branches. Data centre footage retention requirements may be met through centralised storage connected via secure network links.

Biometric Access Control Requirements

IT Rooms and Server Rooms

Biometric access control is mandatory for all IT rooms, server rooms, and any area containing critical network or computing infrastructure. The guideline specifies that access must be restricted to authorised personnel only, with biometric verification as the authentication method. Single-factor card access alone does not satisfy this requirement.

Acceptable biometric modalities include fingerprint recognition, facial recognition, and iris recognition. Fingerprint readers from certified manufacturers such as ZKTeco, Suprema, or HID Global are the most commonly deployed solution in Bangladesh bank branches. Facial recognition terminals are increasingly used at larger facilities where hygiene concerns have reduced preference for contact-based fingerprint readers.

Treasury and Cash Vault Access

Treasury and cash vault areas require both biometric access control and dual-authorisation (two-person integrity) for high-value areas. This means two authorised individuals must each authenticate before the vault door can be opened. The access control system must enforce this rule electronically, not just through procedural policy.

Data Centre Access

Data centres require the most rigorous access control implementation. The guideline specifies multi-factor authentication — something you have (access card), something you are (biometric), and for particularly sensitive areas, something you know (PIN). Mantrap (airlock) entry systems are required for primary data centres to prevent tailgating, where an unauthorised person follows an authorised person through a controlled door.

Physical Access Log Requirements

Every access event — entry, exit, attempted access, and access denial — must be logged with timestamp, person identity, and door or area accessed. These logs must be:

• Retained for a minimum of 180 days (note this is longer than the CCTV retention requirement)
• Protected from modification (tamper-evident or write-once storage)
• Available for review within 24 hours of a Bangladesh Bank or internal audit request
• Reviewed regularly by security management (the guideline suggests at least monthly exception reporting)

Access control systems from manufacturers like ZKTeco, Honeywell, Gallagher, or HID all support compliant audit logging when properly configured. The key implementation requirement is that logs must be stored on a server separate from the access control management workstation, so that a compromised workstation cannot be used to delete or alter access records.

Visitor Management at Head Offices

The guideline includes specific requirements for visitor management at head offices and significant regional offices. Visitor management must include:

• Photo capture of the visitor at point of registration
• Capture of national ID (NID) or passport details
• Issuance of a temporary visitor badge with access limitations
• Escort by an authorised employee throughout the visit
• Badge return at departure and log entry of departure time

Electronic visitor management systems that integrate with the access control platform are the compliant approach. Paper visitor registers alone do not meet the requirement for head offices. Solutions like the Honeywell Pro-Watch visitor management module or standalone systems from manufacturers like Envoy or WhosOnLocation (integrated into the access control system) fulfil the requirement.

Security Guard Integration with Electronic Systems

The guideline requires that security guard operations be integrated with the electronic security systems, not operated in parallel as separate silos. Practical requirements include:

• Guards must have access to CCTV monitoring feeds (either dedicated monitoring workstations or video wall displays)
• Guard patrol routes must be electronically monitored using guard tour systems with NFC or QR code checkpoints
• Guards must be able to trigger alarm notifications through panic buttons integrated into the access control or alarm system
• Guard shift handover must be documented through the electronic access control system

This integration requirement means banks cannot treat electronic security as an IT department function separate from physical security operations. The systems must be configured to support guard operations, with appropriate training provided to security personnel.

IT and Data Centre Physical Security: Annex IV Requirements

Tier III Minimum for Primary Data Centres

Bangladesh Bank requires that primary data centres meet at minimum Tier III specifications as defined by the Uptime Institute. Tier III provides N+1 redundancy for all power and cooling systems, multiple distribution paths, and a minimum availability of 99.982%. This means planned maintenance can be performed without shutting down IT operations.

Banks that host their primary data centre in shared facilities must confirm that the facility holds Tier III certification (or equivalent TIA-942 certification) and provide evidence to Bangladesh Bank on request. Several co-location facilities in Dhaka — including the BTCL National Data Centre and private facilities in Tejgaon and Gulshan — meet this standard.

Clean Agent Fire Suppression for Server Rooms

Water-based sprinkler systems cannot be used in active server rooms — water and live electrical equipment are incompatible. The guideline specifies clean agent fire suppression for server rooms and data halls. Clean agent systems discharge a gas that suppresses fire without leaving residue or causing equipment damage.

Approved clean agents include FM-200 (HFC-227ea), Novec 1230, and CO2 (though CO2 is generally avoided in occupied spaces due to asphyxiation risk). The suppression system must be designed with pre-discharge alarms and abort switches so personnel can evacuate before discharge. Automatic discharge must be linked to the fire detection system but must also allow manual activation.

Environmental Monitoring

Server rooms must have continuous monitoring of temperature, humidity, and water ingress. Acceptable ranges are typically 18-27°C and 40-60% relative humidity as per ASHRAE standards. Monitoring systems must:

• Alert operations staff when readings approach but have not yet reached out-of-range values (pre-alarm thresholds)
• Log all readings at intervals of no more than 15 minutes
• Be connected to an alerting system that notifies responsible staff via SMS or email when thresholds are breached

N+1 Power Redundancy

Critical IT equipment must have N+1 power redundancy. This means one more power source or UPS unit than the minimum required, so that if one fails, operations continue without interruption. UPS systems must be on regular maintenance schedules with battery replacement at manufacturer-specified intervals — typically every 3-5 years for VRLA batteries.

Generator backup for data centres must provide at least 72 hours of autonomous operation at full load. Fuel supply agreements with local suppliers should ensure that resupply can occur within the generator's autonomous operating period.

Consequences of Non-Compliance

Bangladesh Bank conducts annual ICT security inspections of scheduled banks. Findings are graded by severity. Physical security gaps typically result in:

• Major findings: requiring corrective action within 90 days with written evidence of remediation
• Critical findings: escalated to bank board and executive management, requiring immediate corrective action and a board resolution confirming the remediation plan
• Repeat findings: where the same gap appears in consecutive annual inspections, Bangladesh Bank may impose monetary penalties, restrict new branch approvals, or in extreme cases, initiate licence review proceedings

Banks with significant physical security gaps have faced public regulatory censure through Bangladesh Bank circulars. This reputational exposure adds urgency beyond the direct regulatory consequences.

How Banks Achieve Compliance: SSAL's Structured Programme

We work with scheduled banks across Bangladesh to achieve and maintain ICT Security Guideline v4.0 physical security compliance. Our structured programme includes:

Phase 1: Compliance Gap Assessment — We conduct a branch-by-branch and facility-by-facility audit against the guideline requirements. We produce a prioritised gap register with cost estimates for remediation.

Phase 2: Design and Specification — We design compliant CCTV, access control, and environmental monitoring systems for each location. Designs account for existing infrastructure to minimise unnecessary replacement cost.

Phase 3: Supply and Installation — We supply and install compliant equipment from approved manufacturers including Hikvision, Dahua, Bosch, ZKTeco, and Honeywell. We hold authorised integrator status for these brands in Bangladesh.

Phase 4: Documentation and Policy Support — We provide the technical documentation your compliance team needs for Bangladesh Bank submission, including system specifications, commissioning certificates, and retention policy documentation.

Phase 5: Annual Maintenance — We provide Annual Maintenance Contracts (AMC) to keep systems operational and ensure you maintain compliance between inspection cycles.

Get Started on Your Compliance Programme

Bangladesh Bank ICT Security Guideline v4.0 compliance is not optional, and the inspection cycle means non-compliance will be discovered. The question is whether you discover and remediate the gaps before the inspector does, or after.

We offer a complimentary initial compliance consultation for scheduled banks. In this session, we review your current state against the guideline requirements and identify the highest-priority gaps. There is no obligation — but the conversation may save you from an adverse inspection finding.

Get Free Consultation — contact us today to schedule your Bangladesh Bank ICT Guideline v4.0 physical security compliance review.