Unlicensed Digital Lenders and Payment Apps Draw Fresh Central Bank Scrutiny

Bangladesh Bank has stepped up efforts to protect the public from a rising wave of unauthorised digital financial services, warning that both unlicensed payment platforms and rogue loan applications pose serious risks to money and personal privacy.

In recent notices, the central bank identified 22 online payment aggregator platforms that are operating without any licence. These entities have been offering payment services in breach of the Payment and Settlement Systems Act, 2024, which requires prior approval from Bangladesh Bank before anyone can run a payment system or provide payment services. Operating without that approval is a punishable offence. The regulator has advised ordinary users, merchants and financial institutions to avoid conducting any transactions through the listed platforms, noting that funds sent through them sit outside the formal, supervised system and therefore enjoy no regulatory protection.

At the same time, the central bank has highlighted the separate but related threat posed by unauthorised mobile loan applications. These apps typically promise fast cash with little paperwork and no collateral. Once downloaded, many demand broad access to a user's device—contacts lists, photo galleries, messages, call logs and location data. Operators later exploit that access to pressure borrowers, demand additional payments, and threaten to publish private photographs on social media if the borrower fails to meet their terms. Bangladesh Bank has made clear that extending credit through such channels without its authorisation is illegal. Victims who fall into these traps often have limited practical recourse once their personal data has been taken.

The warnings arrive against a backdrop of rapid growth in digital payments and mobile financial services across the country. Licensed banks and mobile financial service providers have brought millions of people into formal finance, yet the same expansion has created openings for unregulated actors. Unlicensed platforms commonly advertise through social media and app stores, targeting individuals who need short-term money quickly and who may not verify whether a service is authorised. The central bank's notices are intended to interrupt that pattern before more people lose funds or face harassment.

Beyond the immediate financial risk, the use of unlicensed aggregators carries longer-term complications. Because these platforms are not supervised, there is no assurance that customer money is safeguarded, that transaction records are accurate, or that disputes can be resolved. In the case of the loan apps, the combination of aggressive collection methods and privacy violations has already produced a stream of complaints to law-enforcement agencies and the Bangladesh Financial Intelligence Unit. Users who share one-time passwords, banking credentials or extensive phone permissions with unknown apps effectively hand control of their financial and personal lives to operators who face little oversight.

Bangladesh Bank has urged the public to check the licensing status of any payment or lending service before using it. Authorised institutions are listed on the central bank's website, and licensed mobile financial services operate under clear regulatory rules and recognisable branding. People are also advised to limit the permissions they grant to unfamiliar apps, to refuse requests for sensitive banking information, and to report suspicious loan offers to the relevant authorities.

By publicly naming the unlicensed platforms and reiterating the penalties contained in the 2024 law, the regulator is attempting to draw a clearer line between legitimate digital finance and illegal activity. The practical impact of the warnings will depend on how widely they circulate and on whether enforcement actions follow against the operators themselves. For individual users, the central bank's message is direct: the convenience of an unauthorised app is rarely worth the potential cost in lost money or compromised personal data.