Bangladesh Bank has made alternative digital credit scoring the required basis for setting limits on a new instant micro-credit product, in a circular that is binding immediately and never mentions artificial intelligence, model validation or bias

The product, and where the model sits inside it

The facility is small and tightly bounded. It is a fee-based credit of up to BDT 10,000, carrying a fee schedule and no interest, disbursed only for direct payment to a designated biller through an approved digital payment channel, for utility bills, mobile recharge, education fees, healthcare expenses, tolls and tickets, taxes and government service fees, deposit instalments, insurance premiums, and other items Bangladesh Bank approves. Clause 2(d) prohibits conversion to cash, crediting to a wallet, or transfer to any account of the customer. Tenures are 7, 15 or 30 days with a published fee table, and principal and fee are recovered in full on the due date.

Clause 2(r) is where the underwriting goes, and it is in force now: "Banks shall utilize alternative digital credit-scoring models and determine risk-based credit limits in accordance with the board-approved policy". The model is not offered as an option. It is the stated basis on which the limit is set.

Clause 2(f) closes the loop around it. All activities related to the loan are to be conducted through an end-to-end digital process using bank-approved applications. Clause 2(g) replaces wet signatures on the loan application with electronic authentication of customer identity. Clause 2(s) has onboarding run through bank-approved digital channels on the customer's registered mobile number, with identity verified by one-time password together with two-factor or multi-factor authentication or another secure mechanism the bank approves.

What the circular does not say about the model

We counted. Across the four-page English circular now in force, artificial intelligence does not appear. Neither does machine learning, nor algorithm. The word model appears once, in clause 2(r). Scoring appears once, in the same clause. Validation, bias, explanation and human do not appear at all.

So the only governance attached to the scoring model is the phrase in accordance with the board-approved policy. There is no independent validation requirement, no fairness or bias testing, no monitoring for drift, no requirement to explain a limit to a customer, and no route by which a customer can ask a person to look again at a limit a model set.

That is an observation about the text, not an accusation. A product circular is not a model risk instrument, and Bangladesh Bank has other instruments. The circular itself points to two of them in clause 2(u), the Guidelines on Cloud Computing and the Cybersecurity Framework, and clause 2(v) requires compliance with all applicable Bangladesh Bank regulations and risk management requirements. Whether any of those reaches credit scoring models is a question we did not test and do not answer here.

The distinction worth holding is between a regulator that has decided algorithmic underwriting needs no extra governance and a regulator that has not yet written that part. This circular does not tell you which of those it is.

The credit bureau step the circular suspends, and why it compounds

Clause 2(m) is in force and it is the clause most likely to be underestimated: "Until API-based automated CIB system becomes fully operational (24/7), CIB inquiries shall remain temporarily relaxed. However, CIB inquiry reports must be collected and preserved immediately after loan approval/disbursement".

Read that against clause 2(r). At launch, the limit is set by a scoring model, and the credit bureau check that would normally sit beside it is relaxed until an automated interface is running around the clock, moving to after disbursement rather than before. The circular gives no date for the API-based system becoming fully operational.

Clause 2(n) is the correction mechanism: where an adverse Credit Information Bureau report or concealment is detected, the loan is to be adjusted immediately. Clause 2(q) adds a self-declaration step, with banks obtaining a customer's digital Yes or No on overall loan classification status and existing e-Payment Credit borrowings, and a clause on financial or non-financial penalties for a false self-declaration to be written into the Product Program Guidelines. Clause 2(p) requires measures to prevent lending to defaulted borrowers under section 27(kaka) of the Bank-Company Act, 1991.

In sequence: a model sets the limit, the bureau check moves after the money, and a customer's own yes-or-no declaration fills part of the gap in between. That is a defensible design for a BDT 10,000 bill payment product. It is also a design in which the model carries more of the decision than it would in ordinary lending.

Data, third parties, and the pilot

Clause 2(u) requires that customers' personally identifiable information and loan-related data be stored in data warehouses located within Bangladesh, in accordance with the Guidelines on Cloud Computing and the Cybersecurity Framework, with banks ensuring data security and privacy under relevant regulations issued by Bangladesh Bank and the Government. For anyone building the scoring model, that is a constraint on where training and inference data can sit.

Clause 2(t) permits banks to engage third-party service providers including Mobile Financial Services providers, Payment Service Providers, Payment System Operators and other FinTech companies as service delivery channels, subject to compliance with applicable Bangladesh Bank regulations. The circular frames them as delivery channels. It does not address a third party supplying the scoring model itself.

Paragraph 3 sets the sequence before any of this goes live commercially. Banks are to run a pilot for a minimum of six months, finalise a Product Program Guideline on the evaluation and feedback, obtain board approval, and notify Bangladesh Bank within 15 working days of commercial launch with the pilot evaluation report and approved Product Program Guideline. Reporting afterwards is quarterly on Annexure-Ka, a form whose columns cover disbursed amount, outstanding, overdue and classified percentage, and monthly to the Statistics Department on the prescribed template.

Why an AI news desk is covering a bill-payment circular

Because the instrument is where automated decision-making usually arrives in a market: not in an AI strategy, but in a product rule that assumes a model and moves on.

The Annexure-Ka return asks for disbursed, outstanding, overdue and classified figures. It does not ask anything about the model: not its approval date, not its inputs, not its rejection rate, not its performance. A supervisor reading those returns would see portfolio outcomes and would not see the scorecard that produced them.

That is the gap to watch, and naming it is ours to do, not the regulator's. The six-month pilot is the window in which a bank's own board, which has to approve the policy under clause 2(r) and the Product Program Guideline under paragraph 3, decides how much of that the institution documents for itself.

What we did not verify

What we opened: the four-page official English PDF of BRPD-1 Circular No. 17 on bb.org.bd, read as extracted text end to end, including the fee table, clauses 2(a) to 2(y), paragraphs 3 to 5, the signature block of the Director (BRPD-1), and the Annexure-Ka column headings. The term counts in this piece were run against that extracted text.

A sourcing note. A first request to the PDF returned a bot-protection interstitial served as HTML with HTTP 200 rather than the document. The text used here comes from a subsequent request that returned a 4-page PDF, and we repeated it to confirm a stable byte count before reading. Anyone checking this should confirm they have the PDF and not the interstitial.

What we did not open: the Bangla version of the circular at sep062026brpd-117.pdf, the Guidelines on Cloud Computing, the Cybersecurity Framework, the Bank-Companies Act 1991 sections 27(kaka), 45 and 109, any prior BRPD circular on digital lending or credit scoring, and any Product Program Guideline or pilot approval. We therefore do not state whether any other Bangladesh Bank instrument imposes model governance duties that would reach the scoring models required by clause 2(r).

What we refuse to claim: we do not say the circular regulates AI, because it does not use the term and imposes no AI-specific duty. We do not say Bangladesh Bank has decided algorithmic underwriting needs no governance, because the circular's silence is silence and not a decision on the record. We do not say alternative digital credit scoring means machine learning, because the circular does not define the phrase. We do not compare this with the Bangla text, which we did not read, and where the two differ the official Bangla version may govern.

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.

Related briefings

• Indonesia's OJK rule on alternative credit scoring
• Indonesia's OJK on credit scoring in P2P lending
• The EBA on credit scoring as high-risk under the EU AI Act
• Asia Pacific AI regulation tracker
• AI Regulation News hub