Complete Security Technology Guide for Bangladesh's Banking & Financial Sector

Bangladesh's banking sector is one of the most heavily regulated industries in the country — and physical security is a significant part of that regulatory landscape. With 61 scheduled banks, over 12,000 branches nationwide, and thousands of ATM installations, the scale of the sector's physical security infrastructure requirement is substantial. Bangladesh Bank's ICT Security Guideline v4.0 sets the compliance framework. Getting physical security technology right is not optional — it is a regulatory obligation with direct consequences for branch licences and institution ratings.

This guide covers the complete technology stack for banking security: from branch-level CCTV and vault access control through head office data centre physical security, ATM monitoring, intrusion alarm systems, and fire safety for server rooms. Whether you are a security manager at a private commercial bank, a head of technology at a digital bank, or a procurement officer handling branch fit-outs, this guide gives you the technical framework and regulatory context you need.

Regulatory Framework: Bangladesh Bank ICT Security Guideline v4.0

Bangladesh Bank's ICT Security Guideline v4.0 is issued under the authority of the Financial Intelligence Unit and the Department of Off-site Supervision. It applies to all banks, non-bank financial institutions (NBFIs), and payment service providers licensed by Bangladesh Bank. The guideline is structured in thematic sections covering data centre security, network security, endpoint security, and physical security — the last of which is directly relevant to the systems covered in this article.

The physical security section of the guideline establishes requirements in four main areas:

CCTV surveillance: All branches must have CCTV coverage of customer areas, teller counters, vault areas, ATM lobbies, and entry/exit points. Footage must be retained for a minimum of 90 days. CCTV systems must be operational during all business hours and ideally 24/7.

Access control: Server rooms, data centres, UPS rooms, and treasury areas must have electronic access control — biometric or card-based — with complete access logs. Physical key backup must be managed with equivalent control to electronic access.

Visitor management: Visitors to restricted areas must be registered, authenticated, and escorted. Visitor logs must be maintained and retained.

Environmental monitoring: Data centres and server rooms must have temperature, humidity, and fire detection monitoring, with automated alerts to the responsible team.

Non-compliance with these requirements is noted in Bangladesh Bank inspection reports. Institutions with persistent non-compliance face increased oversight scrutiny and may face licence restrictions.

Branch Security Design

A standard commercial bank branch has four distinct security zones, each requiring different technology.

Customer Area and Teller Counters

The customer-facing area is the highest-traffic zone and the most visible from a security perspective. CCTV coverage must be comprehensive: cameras covering the entrance and exit, cameras covering each teller counter (angled to capture both the teller and the customer), cameras covering the queue area, and cameras covering any self-service kiosks. Camera angles should capture facial images at the entrance — this requires cameras positioned at head height or slightly above, with adequate lighting behind the subject.

For branch CCTV, Hikvision and Dahua cameras are widely deployed across Bangladesh's banking sector due to their combination of image quality, reliability, and cost-effectiveness. For branch networks requiring consistent image quality, Hikvision's DS-2CD series (2 MP to 8 MP) with WDR (Wide Dynamic Range) capability handles the challenging lighting contrast between bright exterior and darker interior at branch entrances.

Video retention for 90+ days requires NVR storage dimensioned accordingly. For a branch with 8 cameras at 2 MP resolution, 15 fps, H.265+ compression, 24/7 recording, 90-day retention requires approximately 4–6 TB of storage per NVR. Specify enterprise-grade NVR units with RAID-1 (mirrored) storage for resilience against hard drive failure during the retention period.

Vault and Strong Room Access Control

The vault room is the most security-critical area in any bank branch. Access to the vault requires multiple layers of control that go beyond a single card reader.

Recommended vault access control configuration:

• Outer vault door: Biometric (fingerprint or iris) plus RFID card reader. Two-factor authentication as standard; dual-person authentication (dual custody) for after-hours access.
• Vault door itself: High-security mechanical combination lock (certified to UL Class TL-30 or equivalent) operated in parallel with electronic access control. The combination lock is the physical last line of defence.
• Vault CCTV: At minimum 2 cameras inside the vault — one covering the entire vault space, one covering the door area. Inside-vault cameras must maintain visibility even at very low light levels (motion-triggered IR illumination is recommended).
• Motion detection alarm: PIR motion sensor inside the vault, connected to the intrusion alarm panel. After-hours motion in the vault triggers an immediate alarm to the central monitoring centre.

Key management for vault keys uses an intelligent key cabinet, as described in our dedicated article on banking key management. The cabinet is located in the branch manager's office or in the security room adjacent to the vault.

ATM Lobby and ATM Monitoring

ATMs present specific security challenges: they are often in semi-public locations, sometimes accessible 24 hours, and frequently targeted for card skimming, cash trapping, and physical attacks. ATM security technology has three components.

ATM camera coverage: A camera positioned inside or above the ATM captures facial images of every user. This camera is typically provided by the ATM manufacturer and integrated with the ATM's own management system. An additional external camera covers the approach to the ATM lobby, capturing individuals before they reach the machine — useful for identifying persons who attempt fraud at the ATM. A third camera covers the ATM interior for cassette swap detection.

ATM tamper detection: ATM management systems include vibration sensors and door contact monitors that alert when the ATM cabinet is opened or subjected to physical attack. These alerts must be routed to the bank's central monitoring centre and to local police simultaneously.

ATM CCTV integration with branch system: ATM camera footage should be captured and stored alongside branch CCTV footage on the same NVR or a linked NVR, with a common VMS interface that allows the security team to review ATM footage alongside branch footage during investigations.

IT Infrastructure Areas: Server Room and Network Room

Every branch has at least a small server room or network equipment room containing core banking terminal servers, network switches, and UPS systems. These areas must have access control and monitoring that meets the ICT Security Guideline requirements.

Biometric access control: A fingerprint or card reader at the server room door, logging all access events. Only IT-designated staff and authorised maintenance personnel should have access profiles for this area. Branch manager access should be limited to exceptional circumstances and logged accordingly.

CCTV inside server room: One camera covering the server racks and the entry area. Essential for monitoring maintenance activities and detecting any unauthorised equipment removal.

Environmental monitoring: Temperature and humidity sensors with alerts to the IT team. Server rooms in Bangladesh branches often lack dedicated precision cooling — monitoring catches temperature excursions before they cause equipment damage.

Head Office Security Design

The head office presents a more complex security environment than a branch. Multiple business units with different sensitivity levels, a large staff population, visiting clients and regulators, and critical IT infrastructure concentrated in one location.

Data Centre Physical Security

Bangladesh Bank's ICT Security Guidelines dedicate specific attention to data centre physical security. Requirements include multi-layer access control (perimeter of building → data centre floor → individual cage or cabinet), biometric authentication for data centre entry, visitor escort policy, and environmental monitoring.

Recommended data centre access control architecture for a head office:

• Building perimeter: Access control with CCTV at all entry points
• Data centre floor entry: Biometric plus card, audit logged to access control platform
• Individual server cage: Card access with audit log, or combination padlock for physical security of specific tenant cages in shared data centre environments
• Visitor access: Visitor management system generating time-limited visitor passes; escort required at all times; video intercom at entry for remote authorisation

Data centre CCTV should achieve 100% visual coverage of all server aisles and equipment rows. PTZ (Pan-Tilt-Zoom) cameras at the ends of aisles combined with fixed cameras in the middle provide coverage without blind spots. All footage is retained for a minimum of 90 days on a dedicated NVR system — separate from the building's general CCTV system for data security reasons.

Security Operations Centre (SOC) / Video Monitoring Room

Large banks typically operate a centralised video monitoring room where trained security personnel watch live feeds from branches, ATMs, and head office cameras simultaneously. This is a critical investment — the technology is only as effective as the human monitoring it.

The head office SOC should have:

• Video wall or multi-monitor display system: Sized for the number of camera feeds being monitored simultaneously. A video wall from Samsung or Hikvision, with a centralised VMS providing layout management.
• Alarm management integration: CCTV, access control, and intrusion alarm events all visible from a single integrated management platform.
• Analytics integration: AI video analytics (object left behind, perimeter breach, crowd detection) to assist operators in identifying events that need attention across a large camera count.
• Communication equipment: Radio or intercom to branches and security personnel in all building areas.

Intrusion Alarm for After-Hours Protection

During non-business hours, branches and head office areas must be protected against unauthorised intrusion. The intrusion alarm system is the primary detection mechanism.

A bank branch intrusion alarm system includes:

• PIR motion sensors: In the customer area, teller area, vault lobby, and all internal areas accessible after-hours
• Door and window contacts: On all entry/exit points, including emergency exits
• Vibration sensors: On vault doors and strong room walls
• Glass break sensors: On branch entrance glazing
• Panic buttons: At teller positions and the branch manager's desk
• Hold-up alarms: Silent alarm buttons at teller positions for silent activation during robbery

The alarm panel connects to the bank's central monitoring station (either operated by the bank or by a contract alarm monitoring company) via dual-path communication — typically GSM and PSTN or GSM and IP — ensuring alarm transmission even if one path is disrupted.

For banks, intruder alarm systems should be certified to EN 50131 Grade 3 — the grade appropriate for high-risk sites including financial institutions. Grade 3 systems have specific requirements for tamper resistance, detection equipment performance, and communication reliability that are appropriate to the bank's risk profile.

Fire Safety for Data Centres and Branches

Fire safety in bank data centres requires a different approach from standard building fire protection. A conventional water sprinkler system is entirely inappropriate for a data centre — water destroys electronic equipment. Instead, data centres require gaseous or clean agent fire suppression systems.

Clean agent suppression systems: FM-200 (HFC-227ea) and Novec 1230 (3M) are the most commonly used agents for data centre fire suppression in Bangladesh. Both agents suppress fire by interfering with the combustion chemistry rather than by removing oxygen (which would be dangerous in an occupied space). Both agents are safe for occupied spaces when used at design concentrations, discharge rapidly (within 10 seconds), and leave no residue that would damage equipment.

The suppression system is triggered by a double-knock detection sequence — both an ionisation and a photoelectric smoke detector must activate before the suppression agent is discharged, preventing false discharges due to single detector malfunctions. A 30-60 second discharge delay (with audible and visual pre-discharge warning) allows personnel to evacuate the protected area before discharge.

For bank branches (non-data-centre areas), conventional addressable fire alarm with smoke detectors, heat detectors, and manual call points per BNBC 2020 requirements is the standard. All bank fire alarm systems should be connected to the FSCD central monitoring system and should have direct notification to the local fire station as required by FSCD NOC conditions.

AMC Requirements for Bank Security Systems

Bank security systems — CCTV, access control, intrusion alarm, fire alarm — must be maintained under formal Annual Maintenance Contracts (AMC) to ensure continuous operational readiness. Bangladesh Bank inspections specifically assess whether security systems are operationally functional, not merely installed.

An AMC for bank security systems should include:

• Scheduled quarterly preventive maintenance visits (camera cleaning, NVR health check, access control reader testing, alarm panel battery testing)
• 24/7 helpdesk support for fault reporting
• Maximum 4-hour response time for critical system failures during business hours
• Maximum 8-hour response time outside business hours
• Guaranteed spare parts availability for critical components
• Monthly health reports submitted to the bank's security manager

SSAL provides AMC services for bank security systems across Bangladesh, with service teams in Dhaka and Chittagong. Our AMC programmes are specifically designed to align with Bangladesh Bank inspection reporting requirements — our monthly health reports are formatted to support the bank's own compliance documentation.

SSAL's Banking Security Expertise

SSAL has designed, supplied, installed, and maintained security systems for commercial banks across Bangladesh. Our banking projects range from single-branch security fit-outs through nationwide deployment programmes. We understand Bangladesh Bank ICT Security Guideline v4.0, the practical requirements of branch security management, and the technology platforms that deliver compliant, reliable performance.

Our banking security installations use Hikvision and Dahua CCTV systems, ZKTeco and Honeywell access control platforms, Bosch and DSC intrusion alarm systems, and Hochiki and Apollo fire alarm systems — all appropriate for the Bangladesh banking environment and available with local technical support.

Get Free Consultation — Contact our banking security specialists to review your branch or head office security posture. We will assess compliance gaps against Bangladesh Bank ICT Security Guideline v4.0 and propose a technology programme that achieves compliance, improves security, and fits your budget.