Loan Documentation

by Tahmidur Remura Wahid | Sep 4, 2025 | Corporate, M&A, Finance

Loan Documentation in Bangladesh

Why this guide matters:

Whether you are a Bangladeshi conglomerate raising working capital or a foreign lender financing a greenfield project, the loan documents you sign will govern your cash flows, security, risk allocation, and remedies for years. Bangladesh is a documentary jurisdiction: correct stamping, registration, approvals, and charge perfection are essential to create valid, enforceable obligations. This guide distills the critical legal and commercial points you must address, mapping them against common-law expectations in London, and civil/common-law hybrids in Dubai (DIFC/ADGM and on-shore UAE), so your financing can stand up to regulatory scrutiny and enforcement realities.

If you prefer hands-on support, speak to TRW’s Banking & Finance team (Dhaka • Dubai • London). Start here: TRW Law Firm.

1) The core documents in a Bangladesh loan

A. Facility Agreement (FA)
The central contract setting out the amount, tenor, purpose, drawdown mechanics, interest, fees, representations and warranties (R\&Ws), undertakings (affirmative/negative), financial covenants, events of default (EoDs), and enforcement provisions.

B. Security Documents (tailored to the collateral)

• Mortgage Deed (immovable property): Creates a legal mortgage over land/buildings; requires stamping and registration with the relevant Sub-Registrar.
• Hypothecation Deed (movables/inventory/receivables): Charges movable assets while the borrower keeps possession; typically backed by insurance assignment.
• Pledge Agreement (shares/negotiable instruments): Transfers possession/control to pledgee or its agent; typically includes undated transfer forms.
• Assignment of Receivables/Contracts/Insurance: Absolute or by way of security; notice to counterparties is best practice.
• Charge over Bank Accounts/DSRA/Collection Accounts: Control agreements and waterfall mechanics (more below).
• Intellectual Property Security: Security over trademarks/patents is often perfected with sector registries.
• Ship/Aircraft/Special Collateral: Sectoral filings and liens may apply.

C. Guarantees

• Corporate Guarantee: From a strong group entity.
• Personal Guarantee: From promoters/owners (common in SME/Mid-market).
• Sponsor Support/Completion Guarantee: In project finance until commercial operation.

D. Intercreditor & Security Agency
Where there are multiple lenders, a Security Trustee/Agent holds security on trust, with Intercreditor Agreement (ICA) setting ranking, voting, enforcement mechanics, turnover provisions, and standstill rules.

E. Ancillary Documents

• Board/Shareholder resolutions, incumbency certificates, signature verifications.
• Legal opinions (Bangladesh law; and, where relevant, English/UAE law).
• Insurance endorsements (loss payee, assignment, 30-day notice of cancellation).
• Undertakings and compliance certificates.
• CP/CS (Conditions Precedent/Subsequent) checklist.

2) Status of law and enforcement framework in Bangladesh (practical view)

• Contract enforceability is robust where stamping/registration/compliance are correct.
• Security perfection hinges on (i) proper stamping; (ii) correct registry filings (Sub-Registrar for mortgages, corporate charge filings with RJSC for company borrowers, and sector registries where applicable); and (iii) notice to counterparties for receivable assignments.
• Artha Rin Adalat (Money Loan Court) provides a dedicated route for recovery of bank/financial institution loans. Cheque dishonour actions (Negotiable Instruments regime) remain complementary tactics.
• Insolvency & restructuring regimes exist; however, lenders typically rely on security enforcement, restructuring as per central bank circulars/policies, and negotiated solutions, rather than long insolvency processes.
• Foreign loans require Bangladesh Bank registration/approval routes, and repatriation of interest/principal must follow foreign exchange control norms.

3) Conditions Precedent (CP) and Conditions Subsequent (CS): the “never skip” list

Typical CP package (Bangladesh + cross-border sensibilities)

• Executed FA, security documents, guarantees, ICA/security trust deed (if any).
• Corporate authorizations (Board/Shareholder resolutions; constitutional docs).
• Evidence of Bangladesh Bank registration/approval (for foreign currency loans) or lender eligibility (for local banks/NBFIs).
• KYC/AML documents for borrower/guarantors/sponsors (beneficial ownership).
• Updated tax registrations and compliance status.
• Title due diligence and non-encumbrance certificates for immovable collateral; valuation reports where relevant.
• Insurance binders with assignment/loss payee endorsements.
• Account control agreements for DSRA/Collection Accounts.
• Legal opinions (Bangladesh law; and, if LMA-style or English-law governed FA, an English law opinion from London counsel).
• Required regulatory consents (e.g., BTRC for telecom asset charges; energy regulator consents, if any; sector-specific NOCs).
• Financial statements, model, and covenant compliance certificate at signing.

Typical CS items

• Post-signing perfection filings (registrations with Sub-Registrar, RJSC, sector registries).
• Notices of assignment to offtakers/insurers and acknowledgements.
• Final CIB references (if applicable).
• Delivery of stamped originals within a specified period.

Dubai/London overlay: Align CP with LMA expectations where English law governs the FA; add DIFC/ADGM or on-shore UAE legal opinions if any UAE nexus exists (sponsor, account, or asset). For English-law facility documents, lenders expect a Bangladesh law capacity and enforceability opinion covering local security and corporate actions, plus a conflict-of-laws note (Governing Law & Jurisdiction clauses).

4) Covenants you should actually negotiate (beyond boilerplate)

Information covenants: Audited/unaudited financials, compliance certificates, project progress, default notices, and regulator notices.

Affirmative covenants:

• Maintain assets, insurances, permits, and key contracts.
• Keep accounts at specified banks; maintain DSRA and minimum balance.
• Ensure tax/VAT filings and payments are timely.
• Implement ESG/HSSE policies (fast becoming lender expectations).

Negative covenants:

• No additional debt or liens except permitted baskets.
• No distributions (dividends, shareholder loans) beyond thresholds.
• No disposals of core assets outside ordinary course.
• No change in business, control, or key management without consent.
• No affiliate transactions on non-arm’s-length terms.
• Sanctions/AML/Anti-bribery compliance kept current.

Financial covenants:

• Leverage (e.g., Net Debt/EBITDA), Interest Cover, DSCR, Minimum Net Worth, Current Ratio for working capital deals.
• Project finance ratios (LLCR/PLCR/DSCR) with robust equity cure mechanics.
• Materiality thresholds sized to business cycles (avoid tripwire defaults on seasonal swings).

Dubai/London overlay: LMA schedules often contain detailed definitions and calculation mechanics; replicate that precision in Bangladesh documents. For sponsors with UAE or UK holdings, ensure restricted payments and upstream guarantees comply with local corporate benefit rules (especially in UAE free zones and under English law fiduciary standards).

5) Pricing, yield protection, and tax gross-up

Interest & fees: Base rates (e.g., local benchmarks or agreed floating rate) plus margins, commitment fees, upfront fees, agency/security trustee fees (if syndicated), and prepayment/breakage costs.

Increased costs & illegality: Standard LMA concepts—if regulatory changes increase lender costs or render performance illegal, borrower must prepay or bear the increased cost.

Tax gross-up & withholding: Draft clear gross-up so the borrower bears withholding tax on interest (subject to treaty relief where applicable). Build tax indemnity and FATCA/CRS provisions to avoid lender drag.

Dubai/London overlay: In English-law FAs, detailed gross-up/indemnity regimes and FATCA wording are standard. For UAE nexus, assess local withholding/treaty positions and ensure the documentation anticipates on-shore vs free-zone tax treatments.

6) Security package architecture (Bangladesh realities)

Immovables:

• Mortgage by registered deed; verify title chain (mutation, rent receipts, surveys).
• Perfection: Stamping + registration at Sub-Registrar within statutory periods.
• Practical tip: Map all parcels; borrowers often mortgage only a portion inadvertently.

Movables:

• Hypothecation over inventory, machinery, receivables; ensure after-acquired property language and proceeds clause.
• Pledge over shares (Bangladeshi company) with undated share transfer forms, control of share certificates and updates to members’ register upon enforcement.

Accounts:

• Charge/Assignment over DSRA, collection, and escrow accounts; control agreements with cash-waterfall; lender step-in rights on default.

Contracts & receivables:

• Assignment of offtake, EPC/O\&M contracts, leases; issue notices and obtain acknowledgements where strategic (power purchase agreements, anchor offtakers).

Insurance:

• Loss payee and assignment endorsements; require insurer acknowledgements and copies of policies.

Intellectual property:

• Charge/Assignment over trademarks/patents; sector registry filings.

Sector-specific:

• Telecom: Ensure BTRC consent for assignment/charge where required.
• Power & infrastructure: Align with implementation agreements and government approvals; check negative pledge in concession documentation.

Perfection checklist (Bangladesh):

1. Adequate stamping of each instrument.
2. Registration of mortgage with Sub-Registrar.
3. Company charge filings for security created by a Bangladeshi company (to be filed with RJSC within the statutory timelines).
4. Sector filings as applicable (IP, shipping, aviation, telecom).
5. Notices and acknowledgements to counter-parties and insurers.
6. Possession/control for pledges and bank accounts.

Dubai/London overlay:

• England & Wales: Use a debenture (fixed and floating charges), share charge, account charge; register charges at Companies House within statutory time limits; assign contracts/receivables with notice.
• UAE: Free-zone vs on-shore rules differ; DIFC/ADGM provide common-law style security registries; on-shore UAE uses civil-law security regimes and notarial/registry mechanics. Share pledges require ADGM/DIFC or on-shore corporate approvals and registry filings; bank account control is document-driven.

7) Governing law, jurisdiction, and dispute resolution

• Governing law: Many cross-border facilities adopt English law for the FA and Bangladesh law for local security. This dual-track approach is market practice.
• Jurisdiction: English courts or international arbitration (LCIA/SIAC/ICC) are common. If arbitration is chosen, specify seat (often London/Singapore).
• Enforcement in Bangladesh: Foreign judgments/awards are generally enforceable under applicable statutes and treaties, subject to public policy, due process, and reciprocity tests. Security enforcement on Bangladeshi assets follows Bangladesh law procedures regardless of FA governing law.
• BIAC is a local institutional option for arbitration clauses.

Dubai/London overlay:

• London lenders prefer English law + English courts or English law + LCIA.
• For UAE borrowers or sponsors, DIFC/ADGM courts can be selected for disputes where the nexus exists; judgments can be recognized across local systems under specific protocols.

8) Foreign currency loans and exchange control checkpoints

• Bangladesh Bank approval/registration is needed for private sector foreign loans. Terms (tenor, interest benchmark, margin, fees) must adhere to prevailing policy parameters.
• Drawdown & repatriation: Inbound flows via Authorized Dealer (AD) banks; interest and principal repayments scheduled per registered terms.
• Prepayment/refinancing: Often requires notification or updated registration; ensure the FA contemplates make-whole and break costs.
• Security in favor of foreign lenders: Permissible, but local perfection rules apply; share pledges in favor of foreign lenders should be structured with approvals where applicable.

Dubai/London overlay:

• English-law FAs often contain robust sanctions, AML, anti-corruption representations due to global bank policies; align with Bangladesh compliance regimes.
• For UAE platforms (regional treasury centers), structure intercompany on-lending carefully to avoid regulatory leakage or tax inefficiencies.

9) Working capital, term loans, project finance, and Islamic structures

Working Capital Facilities

• Overdraft/Cash Credit (CC): Inventory/receivable-backed; monthly stock statements; borrowing-base covenants.
• LCs/Trade Finance: Documentary credits, SBLCs, guarantees; collateral includes cash margins and hypothecation of goods.
• Short-term loans: For seasonal bulges; ensure alignment with cash conversion cycle.

Term Loans

• Amortizing or bullet; prepayment flexibility vs yield protection.
• Security: fixed assets, DSRA, insurance.

Project Finance (Non-recourse or limited recourse)

• Sponsorship undertakings, completion guarantees, and EPC/O\&M back-to-back provisions.
• Accounts & waterfall: Revenue accounts, O\&M accounts, DSRA, MRA, capex reserve; trustee-controlled.
• Direct agreements with offtakers/contractors/insurers for step-in rights.
• Detailed technical, environmental, and social covenants.

Islamic Finance

• Murabaha (cost-plus), Ijara (lease), Musharaka/Mudaraba (equity-style), and Commodity Murabaha (Tawarruq) structures.
• Documentation mirrors conventional risk allocation through asset sale/lease/agency sequences while meeting Shariah standards.
• Security and perfection generally mirror conventional; ensure Shariah Board approvals and asset trail integrity.

Dubai/London overlay:

• LMA and LMA-AFL templates are prevalent in London.
• In Dubai, both on-shore and DIFC/ADGM Islamic documents are common; align Bangladesh assets with conventional or Shariah structures chosen.

10) Syndication and agency mechanics

• Roles: Mandated Lead Arranger (MLA), Facility Agent, Security Trustee, Account Bank, Hedging Bank.
• Voting: Majority lender thresholds (often 66⅔% or 75%), sacred rights require all-lender consent.
• Transfers: Lender assignment/novation mechanics; borrower consent not required for defaults; ensure KYC flexibility for incoming lenders.
• Hedging: ISDA/Islamic hedging; ensure close-out netting recognition and security sharing/hedging priority in ICA.

Dubai/London overlay:

• London syndications default to LMA agency frameworks; replicate agency protections in Bangladesh law security documents so the Security Trustee can enforce without frequent re-papering.

11) Events of Default (EoDs) that truly matter

• Payment default (with short grace period).
• Breach of financial covenants.
• Misrepresentation and breach of undertakings (with cure periods where sensible).
• Cross-default to material indebtedness.
• Insolvency/insolvency proceedings.
• Invalidity of security/guarantees.
• Change of control.
• Unlawfulness/illegality (sanctions, AML).
• Material adverse change (MAC)—negotiate objective triggers or disclosure-based formulations to avoid subjectivity.

Remedies: Acceleration, enforcement over security, cash sweep, step-in, account blocking, appointment of receiver (where available), litigation/arbitration.

12) Stamping, registration, and perfection—non-negotiables

• Stamp duty: Pay at execution (or within permitted grace) to avoid penalties and inadmissibility issues. Each instrument (FA, mortgage, hypothecation, pledge, guarantees) carries duty per schedule; confirm with current NBR rates.
• Registration:
• Mortgages must be registered with the Sub-Registrar.
• Company charges must be registered with RJSC within the statutory timeline to preserve priority and validity against liquidators/creditors.
• Sector filings (IP, telecom, aviation, shipping) as applicable.
• Notices: To lessees, offtakers, insurers, account banks for assignments/charges.
• Custody: Secure originals; control access (escrow/closing sets).

Dubai/London overlay:

• England & Wales: Strict Companies House charge registration time windows; unstamped/unregistered security risks invalidity against liquidators/creditors.
• UAE: Notarial steps and registry filings vary on-shore vs DIFC/ADGM; follow formalities to avoid priority loss.

13) Sector overlays: what changes in regulated industries

Telecom:

• Spectrum licenses and network assets often have assignment restrictions; seek BTRC approvals where necessary; structure security over permissible asset classes (equipment, receivables, accounts).

Power & Infrastructure:

• Concession agreements and implementation agreements may include negative pledge/assignment rules; align direct agreements with offtaker (e.g., utility) to allow step-in and payment redirection.

Financial Services & Fintech:

• Additional Bangladesh Bank oversight; ensure consumer funds segregation and data governance; tailor covenants for capital adequacy/compliance reporting.

Real Estate & Hospitality:

• Land title diligence is decisive; zoning/building permits as CP; presales escrow mechanics; construction finance monitors.

Export-oriented industries:

• Trade finance lines tied to export proceeds; assignment of export receivables, EEFC accounts (if applicable), and export credit insurance.

14) Common mistakes that derail enforcement (and how to avoid them)

1. Under-stamping or late stamping → leads to inadmissibility or penalties.
2. Missing RJSC charge filings → security loses priority (or validity against liquidators/creditors).
3. Inadequate property diligence → boundary disputes/title defects surface at enforcement.
4. Unnotified receivables assignments → debtors continue paying borrower; hard to redirect cash.
5. Loose bank account control → DSRA/collections get siphoned.
6. Mismatched governing law vs asset location → foreign governing law for Bangladeshi security may complicate enforcement.
7. Vague covenants → difficult to monitor; defaults become subjective.
8. Ignoring regulatory consents → security later challenged as void/voidable.
9. No hedging alignment → interest/currency risk overwhelms business covenants.
10. Poor conditions subsequent tracking → perfection windows missed.

15) Cross-border structuring with Dubai and London sponsors

Typical patterns we execute at TRW:

• English-law LMA FA + Bangladesh law security.
• Why: Preserves lender familiarity and documentation discipline while ensuring local enforceability.
• Add: English law legal opinion; Bangladesh law capacity & enforceability opinion.
• On-shore UAE sponsor guarantee + share pledge in a UAE SPV + Bangladesh operating company security.
• Why: Regional sponsor nexus and treasury efficiency.
• Add: DIFC/ADGM or on-shore pledge filings; cross-default alignment across jurisdictions.
• Cash-waterfall via controlled accounts in Bangladesh, with DSRA top-up from UAE/London.
• Why: Keeps revenue capture local but allows cross-border liquidity support.
• Add: FX approvals for upstreaming and support payments.
• Arbitration with London seat (LCIA/SIAC) + submission to Bangladesh courts for security enforcement.
• Why: Efficient dispute resolution plus local asset enforcement.

Sanctions & compliance: Draft to UK/EU/US/UAE standards; Bangladesh borrowers must adopt equivalent internal policies (KYC, PEP screening, beneficial ownership registers, whistleblowing lines, anti-bribery procedures).

16) Restructurings, waivers, and early-warning triggers

Early indicators: Covenant headroom narrowing, delayed MIS, supplier stretch, churn in receivables age, capex deferrals, auditor emphasis-of-matter notes.

Restructuring tools:

• Standstill & waiver letters tied to an information pack and cash-sweep discipline.
• Amend & extend (margins, tenor, cures).
• Security top-ups (additional collateral, enhanced DSRA).
• Intercreditor resets (waterfall, voting thresholds).
• New money with super-priority or pari passu baskets.

Bangladesh practicalities: Central bank rescheduling guidelines often frame what banks can offer (provisions, classification). Align the documentary changes with regulatory rules to avoid later impairment challenges.

17) ESG, data, and operational covenants modern lenders expect

• ESG metrics and reporting: Board-approved policy, compliance attestations, EHS audits for plants and logistics, grievance mechanisms, modern slavery clauses in supply chains.
• Data protection & cybersecurity: Incident reporting SLAs, disaster recovery/RPO-RTO targets, encryption/AWS regions if cloud-hosted ERPs hold financial data relevant to waterfall.
• Audit rights & site visits: Unannounced audits for inventory-backed facilities; IoT/telemetry feed covenants in logistics-heavy borrowers.

Dubai/London overlay: UK lenders often prescribe Sustainability-Linked Loans (SLL) mechanics (margin ratchets for KPI attainment). For UAE borrowers, align with local ESG reporting frameworks emerging in free zones and on-shore.

18) Practical negotiation strategies (borrower & lender)

For borrowers:

• Calibrate financial covenants to seasonality; insert equity cure rights.
• Shape restricted payments to permit minimum dividend flows under performance thresholds.
• Seek MAC carve-outs and objective standards.
• Cap increased cost pass-throughs with market flex only during syndication.
• Ensure reasonable reporting intervals to avoid operational drag.

For lenders:

• Insist on perfection proof (filed receipts, certified copies).
• Secure control over cash accounts and receivable flows.
• Require direct agreements with critical offtakers and insurers.
• Use security agent structure to future-proof syndicate changes.
• Build step-in and pre-agreed enforcement playbooks (receivership/waterfall triggers).

19) Model clauses and schedules worth emulating

• Definitions & Interpretation: Precision reduces disputes—mirror LMA engineering (Consolidated Net Debt, EBITDA, Finance Charges, etc.).
• Financial Covenants Schedule: Include testing dates, cure mechanics, and auditor confirmation.
• Security Principles: Enumerate jurisdictions, asset classes, perfection steps, and timing.
• Compliance Certificate template: With ratio calculations and director sign-off.
• Know-Your-Customer (KYC) pack schedule: BO registers, IDs, sanction checks, shareholding trees.
• Insurance Schedule: Minimum cover, deductibles, change notification, loss payee, co-insureds.
• Accounts & Waterfall Schedule: Operating/Collection/Revenue/DSRA/MRA flows, permitted withdrawals, and default-mode sweep.

20) A step-by-step roadmap to your closing in Bangladesh

1. Term sheet agreed (commercials, covenants, security).
2. Diligence: corporate, regulatory, title, litigation, financial, ESG.
3. First drafts: FA (often English-law if cross-border), Bangladesh-law security, guarantees, ICA/security trust.
4. Regulatory liaison: Bangladesh Bank (foreign loan registration), sector consents.
5. CP collection: Board approvals, KYC, insurance binders, valuations, account opening/control.
6. Signing: Execute documents with proper witnessing; e-sign only where permissible.
7. Stamping: Calculate and pay duty per instrument.
8. Registration & perfection: Sub-Registrar (mortgage), RJSC (company charges), sector registries; issue notices to offtakers/insurers/banks.
9. Legal opinions: Bangladesh law; English/UAE opinions if required.
10. First drawdown: Upon CP satisfaction; confirm FX approvals for foreign currency loans.
11. CS tracking: File evidence of perfection, notices, and acknowledgements within contractual windows.

21) What foreign companies should be extra careful about

• Foreign exchange controls: Build realistic timelines for Bangladesh Bank registrations/approvals and for AD bank operational steps.
• Security localization: Bangladesh-law governs security over Bangladeshi assets—do not rely on foreign-law security for local enforcement.
• Perfection calendars: Put a D-Day+X calendar for stamping and filings; missing windows can be fatal to priority.
• Withholding tax & gross-up: Model net-of-tax returns; design precise gross-up and tax indemnity language.
• Sector consents: Power, telecom, aviation, ports—get regulator comfort before signing.
• Sponsor support enforceability: Verify corporate benefit, capacity, and any financial assistance issues in sponsor jurisdictions (UAE, UK).
• Sanctions & AML: Your global bank will impose UK/EU/US compliance standards; ensure your Bangladesh ops can meet them (policy roll-out, training, testing).
• Arbitration seat and recognition: Choose a seat with predictable courts (London/Singapore); ensure award recognition path in Bangladesh is clear; keep Bangladesh-law security outside the arbitration stay where possible.
• Data & operational transparency: Prepare to deliver frequent MIS, operational telemetry for borrowing base, and audit access—a cultural/operational shift for some businesses.

22) Quick checklists

A. Borrower CP checklist (abbreviated)

• Corporate approvals, specimen signatures, constitutional docs.
• Audited financials; latest management accounts.
• Insurance binders with loss payee & assignment; insurer acknowledgements.
• Account opening and control agreements for DSRA/collection accounts.
• Title docs and valuation (immovables); asset schedules (machinery/rolling stock).
• Bangladesh Bank foreign loan registration (if applicable).
• KYC/AML pack (including beneficial ownership).
• Draft compliance certificate template approved.

B. Lender enforcement readiness

• Custody of original share certificates, undated transfer forms (pledge).
• Copy of registered mortgage and RJSC charge filings.
• Executed notices of assignment and receipt of acknowledgements.
• Access to account control triggers; pre-agreed enforcement steps.
• Legal opinions and reliance letters stored.

23) Sample clause pointers (plain-English prompts for your drafts)

• Pari passu ranking: “Obligations rank at least pari passu with all unsecured and unsubordinated obligations, save for statutorily preferred debts.”
• Sanctions/AML: “The Group complies with all applicable Sanctions, AML and anti-corruption laws of Bangladesh, UK, EU, US, and any jurisdiction of incorporation or operation.”
• Financial Covenants testing: “Quarterly testing on the last day of each financial quarter; cure within 15 business days via equity injection counted in EBITDA for ratio purposes.”
• Change of Control: “Any person or group acquiring >X% voting rights or the right to appoint/remove a majority of directors triggers an EoD unless lender consent is obtained.”
• Accounts Waterfall: “All revenues to the Collection Account; daily sweep to the Revenue Account; monthly DSRA top-up to the Required Balance; restricted withdrawals per Approved Budget.”

(Your actual drafting should be in full legal language; the above are conceptual anchors to brief counsel.)

24) How TRW structures your deal (Dhaka • Dubai • London)

Integrated execution: We draft and negotiate English-law FAs (LMA-based) with our London team while our Dhaka team perfects Bangladesh security and liaises with Bangladesh Bank and sector regulators. In Dubai, we structure sponsor support and UAE share pledges (DIFC/ADGM/on-shore) and align treasury flows.

Closing discipline: We manage CP rooms, stamping/registration calendars, notices & acknowledgements, and issue coordinated legal opinions. For syndicates, we run intercreditor setups, security trust mechanics, and hedging integration.

Restructuring & disputes: We handle standstills, amend-and-extends, and—if enforcement is inevitable—security enforcement before Money Loan Courts, arbitration with London/Singapore seats, and recognition in Bangladesh.

25) FAQs (short, practical answers)

Q1. Can an English-law facility be enforced in Bangladesh?
Yes, but Bangladesh-law will govern the enforcement over Bangladeshi assets. Keep the FA in English law if preferred, but prepare Bangladesh-law security and follow local perfection rules.

Q2. Do foreign lenders need special permissions to take security?
They can take security, but perfection must follow Bangladesh procedures and Bangladesh Bank rules for foreign currency loans. Sector consents may also apply.

Q3. How are receivables effectively secured?
Use assignment by way of security, issue notices to debtors, and implement account control so cash cannot be diverted.

Q4. What is the most common perfection pitfall?
Late or missing filings (Sub-Registrar, RJSC) and under-stamping. Maintain a perfection calendar from day one.

Q5. Can we choose arbitration in London?
Yes; it’s common in cross-border deals. Keep Bangladesh security outside any stay, and be ready to recognize and enforce awards locally.

26) Executive checklist for CEOs/CFOs

• Set covenant headroom realistically; insist on equity cure.
• Demand a clear waterfall and account control terms you can operate.
• Approve an insurance program aligning with lender requirements.
• Require a perfection tracker with dates, responsibilities, and proofs.
• Confirm regulatory consents (telecom, power, special assets) are obtained.
• Lock down tax gross-up and withholding sizing in the model.
• Align governing law/jurisdiction with your group’s litigation/arbitration appetite.
• Ensure sanctions/AML policies exist at the Bangladesh opco level—not just at HQ.
• Obtain board/shareholder approvals with precise authority wording.

27) Summary table (print-friendly)

28) How TRW Law Firm can help—end-to-end

• Structuring: Cross-border term sheets, tax & FX analysis, security architecture.
• Documentation: LMA-based FAs, Bangladesh-law security, ICA, guarantees, hedging.
• Regulatory: Bangladesh Bank registrations; sector approvals (BTRC, energy, etc.).
• Perfection: Stamping, Sub-Registrar & RJSC filings, sector registries, notices.
• Opinions: Bangladesh, English, UAE (with our London/Dubai desks).
• Closing & Agency: CP management, signing mechanics, digital data rooms.
• Restructuring/Workout: Standstills, amend-and-extend, enforcement strategy, arbitration/litigation.

Contact TRW Law Firm

Tahmidur Remura Wahid (TRW) Law Firm
Contact Numbers: +8801708000660 • +8801847220062 • +8801708080817
Emails: info@trfirm.com • info@trwbd.com • info@tahmidur.com

Global Law Firm Locations:

• Dhaka: House 410, Road 29, Mohakhali DOHS
• Dubai: Rolex Building, L-12 Sheikh Zayed Road.

Disclaimer: This guide is informational and does not constitute legal advice. Financing structures should be tailored to your transaction and current regulations. For a transaction-specific playbook, reach out to TRW’s Banking & Finance team.

Whistleblower Programs

by Tahmidur Remura Wahid | Sep 3, 2025 | Corporate, M&A, Finance

Whistleblower Programs in Bangladesh: The Best, Most Practical Guide for Companies in Bangladesh — With Dubai & London Context for Foreign Investors

By TRW Law Firm — Investigations, Compliance & Employment (Dhaka • Dubai • London)

Executive snapshot (read this first)

• Whistleblowing is a business control, not just a policy. In Bangladesh, it’s how you catch bribery, procurement collusion, payroll ghosts, bonded-warehouse diversion, harassment, and data leaks before regulators or buyers do.
• Bangladesh has a public-interest disclosure law (and sectoral expectations for banks and listed companies) plus serious criminal exposure around corruption and fraud. Treat all reports as legally sensitive and investigation-worthy.
• UAE & UK add extra layers. DIFC/ADGM in the UAE have explicit whistleblowing regimes; the UK’s PIDA framework and sectoral rules (e.g., FCA/PRA) set a high bar on anti-retaliation, confidentiality, and “qualifying disclosures.” If you operate across Dhaka–Dubai–London, build one program with local addenda.
• Design choices matter: anonymity vs. confidentiality, law-firm privilege, Bangla-first communications, WhatsApp intake, SLAs, domestic inquiries (Bangladesh), and careful cross-border data handling.
• Winning formula: easy intake + strong protection + disciplined investigations + visible remediation + board metrics. That’s what regulators, donors, lenders, buyers—and your own people—expect.

Part A — What a whistleblower program really is (and isn’t)

A whistleblower program is a system that lets employees, contractors, suppliers, distributors, and even customers report concerns safely, and ensures those concerns are investigated fairly, with protection from retaliation. It’s not a poster or inbox. It’s the junction of:

1. Governance (policy, scope, roles, independence)
2. Intake (channels that people actually trust and use)
3. Protection (anti-retaliation measures that work in practice)
4. Investigation (lawful evidence + due process)
5. Outcome (remediation, discipline, and feedback)
6. Reporting (board dashboards and continuous improvement)

In Bangladesh, this system must “speak” Bangla and work on WhatsApp (or SMS/USSD) for hourly and field staff. In Dubai and London, it must slot into free-zone or UK statutory frameworks and satisfy sectoral regulators (banking, financial services, telecom).

Part B — Legal and regulatory context you must internalize

We’ll stay practical and high-level. Specifics evolve by circular or amendment; use this as your operating blueprint and confirm numbers and forms when you implement.

Bangladesh (core points)

• Public-interest whistleblowing exists. A dedicated statute enables disclosure of public-interest information and aims to protect the discloser from victimization. In practice, your corporate policy should mirror that logic: good-faith reporting → protection from adverse action.
• Corporate governance for listed companies expects an ethical conduct and reporting mechanism under the audit committee’s oversight, with channels to report concerns, confidentiality, and fair treatment.
• Banking & financial services: Bangladesh Bank guidance expects banks and NBFIs to maintain whistleblowing policies, fraud-risk controls, and escalation mechanisms; many approvals (e.g., digital banking) scrutinize complaint/reporting channels.
• Labour realities: Disciplinary action against employees requires due process (show-cause, domestic inquiry, reasoned order). If a reporter is punished without process, expect litigation and reinstatement risk.
• Criminal law exposure: Bribery, gratification, forgery, false accounting, and money laundering are crimes. Reports touching these issues must be triaged with legal privilege and evidence preservation from hour one.
• Harassment cases: Binding court guidelines require a Complaint Committee (woman-chaired, with external member) for sexual-harassment matters—your whistleblowing SOP must integrate with that process.
• Data & cyber: A comprehensive privacy regime is imminent; today’s cyber and sector rules still expect log retention, incident response, and lawful handling of personal data in your case files.

UAE (Dubai and the federal context)

• DIFC/ADGM (the two financial free zones) have explicit whistleblowing regimes: protected disclosures to specified persons; requirements for regulated firms (e.g., DFSA/FSRA) to maintain effective arrangements; anti-retaliation expectations; and confidentiality.
• Mainland UAE does not yet have a single, sweeping whistleblowing statute, but sectoral and corporate-governance rules push firms—especially in financial services—to implement speak-up frameworks, protect reporters, and escalate to regulators where appropriate.
• Defamation and cyber-crime laws: External/public allegations can create legal risk if false or malicious. A strong internal program is not optional; it’s protective.

United Kingdom (London)

• PIDA (Public Interest Disclosure Act): robust protection for workers making qualifying disclosures about wrongdoing (criminal offenses, health/safety dangers, environmental damage, etc.), to employers or prescribed persons (regulators).
• Sector rules (FCA/PRA): regulated firms must have independent channels, named champions, internal training, and reporting. Non-retaliation is actively policed.
• NDAs cannot gag whistleblowers on protected disclosures. Culture and outcomes really matter in the UK: boards are expected to see metrics and act.

Takeaway: For Dhaka–Dubai–London operations, adopt a single global standard that meets the highest bar (often UK free-to-speak principles), then add Bangladesh and UAE annexes addressing local procedures, labour due-process, free-zone specifics, and defamation/data-handling cautions.

Part C — What should be “in scope” (and what should not)

Include (always): bribery/kickbacks, procurement collusion and bid rigging, fraud/asset misappropriation, financial reporting manipulation, AML/sanctions breaches, customs/bonded-warehouse abuses, health & safety violations, sexual harassment and bullying, data-privacy violations, cyber incidents, environmental harms, competition/antitrust concerns, human-rights/child-labour risks, and serious policy breaches.

Route specially:

• Sexual harassment → to the Complaint Committee process (Bangladesh) with privacy and survivor-safety guardrails.
• Immediate danger (fire/structural/violence) → emergency response first, investigations later.
• Labour grievances (pay errors, leave, overtime disputes) → HR grievance route, but keep the door open if retaliation emerges.
• Customer complaints → service desk, unless they allege bribery/fraud/harassment—then treat as whistleblowing.

Part D — Program architecture that actually works in Bangladesh (and scales to Dubai & London)

1) Governance & independence

• Board/Audit Committee oversight with a named Whistleblowing Officer (WBO) or “Speak-Up Officer.” The WBO should report functionally to Legal/Compliance, not to line management.
• Investigation Charter approved by the board: authority to preserve data, interview staff, access premises, and engage external counsel/forensics.
• Conflicts wall: anyone named in a report (or their chain of command) is walled off from triage, decisioning, and investigation.

2) Policy suite (Bangla + English; Arabic where relevant)

• Whistleblowing Policy (plain language): scope, examples, channels, anonymity vs. confidentiality, how investigations work, anti-retaliation, and feedback timelines.
• Anti-Retaliation Standard: clear list of prohibited behaviours (termination, demotion, shift changes, roster punishment, denial of leave, exclusion, harassment), interim protection measures, and sanctions for violators.
• Investigation SOP: intake → triage → legal hold → plan → evidence → interviews → analysis → outcome → remediation → closure letters → board reporting.
• Data Handling SOP: who sees what; personal-data minimization; cross-border transfer rules; retention and secure archiving.

3) Intake channels (make them real)

• 24×7 web form (mobile-first), email, hotline, and WhatsApp number. Place a QR code on posters, payslips, ID card backs, and canteen boards.
• Third-party/outsourced option for higher trust (especially helpful in Bangladesh for factory/field conditions).
• Physical drop-boxes in plants (with daily dual-control collection).
• Anonymous option: allowed, but encourage confidential named reports by explaining protections and how identity is shielded from local management.
• Language: Bangla and English in Bangladesh; Arabic and English in Dubai; English (plus relevant community languages) in London.

4) SLAs & communications

• Acknowledge within 48 hours (or next business day) if contact details exist.
• Triage decision within 5–7 days: open, route, or close (with reason).
• Status updates at least every 30 days until closure (even if just “in progress”).
• Closure letters explaining outcome without disclosing confidential personnel info.

Part E — Anti-retaliation that people believe

• Immediate shield: once a report is opened, HR and line management receive a hold notice prohibiting changes to the reporter’s role, pay, shift, or benefits without WBO approval.
• Safety assessment: for harassment or intimidation risk, consider shift swaps, re-assignment, or no-contact orders (without penalizing the reporter).
• Confidentiality: limit identity knowledge to the small core team; use code names in project trackers.
• Monitoring: for 6–12 months post-closure, HR runs a retaliation check—performance ratings, overtime approvals, transfers, and leave decisions are reviewed.
• Discipline: retaliation is a stand-alone misconduct with serious penalties up to dismissal.

UAE twist: Balance whistleblower protection with defamation/cyber exposure—encourage internal disclosure first and keep identity tightly controlled. Free zones (DIFC/ADGM) set explicit anti-retaliation expectations—mirror them group-wide.

UK twist: Train managers on PIDA concepts: do not dismiss, demote, or treat detrimentally a worker for a protected disclosure. Review NDAs to ensure they expressly preserve protected disclosures.

Part F — Triage and scoping (first 72 hours done right)

1. Risk sort: life/safety risk, criminal exposure, regulator notice triggers, data breach involving personal data, senior-management implication, public-interest sensitivity.
2. Legal hold: send Bangla + English hold to named custodians; suspend auto-deletion for email, chats, drives, WhatsApp exports (where lawful), logs, CCTV, access control, ERP.
3. Team & conflicts: assign a case lead; check conflicts; if senior leadership is implicated, escalate to board/audit chair and external counsel.
4. Plan: write a scoping memo—allegations, issues, elements to prove, custodians, systems, third-parties, initial hypotheses, and timeline.

Part G — Evidence and investigations (Bangladesh-fit, UAE/UK-compliant)

1) Digital evidence you will actually use

• Messaging: WhatsApp/IMO/Messenger are primary in Bangladesh. Use targeted exports with consent/policy; forensically image devices when proportionate and lawful.
• Email & cloud: preserve mailboxes and shared drives (Google/Microsoft), including admin logs.
• Operational systems: ERPs, attendance/biometrics, access control, CCTV DVRs (short retention!), POS, RFID, GPS, bonded-warehouse logs.
• Financial: bank statements, mobile-money (MFS) ledgers, LC files, invoices/packing lists/B/L, customs declarations, VAT returns.
• Telecom (for operators/ISPs): CDRs, interconnect logs, CLI integrity, spam/A2P records.

2) Collection standards

• Document chain of custody; hash images; use evidence bags and seals.
• Keyword strategy: English, Bangla Unicode, and phonetic English for common terms (chai-pani, commission, manage, adjust).
• Minimization: keep collections tight; segregate personal data; redact where feasible.

3) Interviews

• Offer Bangla or English; trained interpreters; no manager present for junior staff.
• Start with witnesses → then subjects; show documents; ask time-anchored questions.
• Keep contemporaneous notes; for critical sessions, audio record only with consent or use two-investigator notes.

4) Analysis frameworks that save time

• AP/GL forensics: duplicate invoices, weekend postings, round sums, split POs beneath approval limits, Benford checks.
• Trade tests: HS code and price vs. market benchmarks; LC amendment patterns; third-country routing; inventory reconciliation.
• Network links: shared phones/addresses among vendors and employees; bKash/Nagad wallet clusters; distributor hub-and-spoke patterns.

5) Due process and outcomes

• Bangladesh: for employees, follow domestic inquiry steps before dismissal—show-cause, inquiry, reasoned order.
• UAE: observe free-zone rules for regulated entities; maintain strict confidentiality; verify visa/employment consequences with HR.
• UK: ensure fairness and reasonableness; keep records anticipating tribunal scrutiny; preserve protected disclosure status.

Part H — Integration with harassment and dignity-at-work processes

• Complaint Committee (Bangladesh): whistleblowing intake routes sexual-harassment matters to the Committee. Maintain victim-centric safeguards, privacy, and time-bound investigations.
• Training: supervisors and committee members need specialized training; keep case logs and closure actions.
• Overlap: where harassment involves bribery or procurement coercion, run a joint plan: safety first, then financial and conduct aspects.

Part I — AML, sanctions, and financial-crime disclosures

• If reports suggest money laundering or sanctions violations, escalate to Legal/Compliance immediately.
• For regulated entities (banks, NBFIs, PSPs), trigger internal AML escalation; assess whether to file suspicious reports under financial-intelligence rules.
• For non-regulated corporates, still treat findings like criminal exposure; tighten controls; consider law-enforcement engagement through counsel.

Part J — Competition/antitrust and trade disclosures

• Bangladesh: watch for hub-and-spoke information flows via shared distributors or trade associations.
• UAE/UK: sector regulators (and UK CMA) take collusion seriously; first-in leniency can matter. Your policy should encourage prompt internal reporting and counsel review for leniency strategies.

Part K — Data protection and cross-border handling

• Bangladesh: treat case files as sensitive personal data; restrict access; prepare for a modern privacy regime.
• Dubai (UAE): free zones have privacy regimes; mainland has sectoral expectations. Be careful with external disclosures.
• London (UK): personal data in case files must meet UK data-protection standards; redact and minimize exports.
• General rule: keep investigations on-shore where possible; if you must export, use secure transfer, need-to-know, and anonymization/pseudonymization where feasible.

Part L — Foreign companies in Bangladesh: the 24 big cautions

1. No “facilitation” payments—they’re bribes.
2. Use a third-party hotline to boost trust among factories/field staff.
3. Bangla-first everything (policy, posters, auto-replies, closure letters).
4. WhatsApp intake increases usage; just handle data lawfully and proportionately.
5. Protect identities—share on a need-to-know basis; use code names.
6. Domestic inquiries before dismissal; shortcuts lose in court.
7. Complaint Committee for harassment is non-negotiable.
8. Labor contractors: ensure they have their own speak-up route—or include their workers in yours.
9. Customs/C\&F brokers: high-risk third parties; encourage reports from them and about them; build non-retaliation into contracts.
10. Bonded-warehouse controls: invite anonymous tips; audit diversions rigorously.
11. MFS wallets: kickbacks often flow via mobile money—add these traces to your analytics.
12. Defamation risk (UAE): encourage internal reports first; handle reputational matters with counsel.
13. PIDA awareness (UK): managers must understand protected disclosures.
14. Subsidized “rewards”: if you pilot small recognition for high-value tips, do so privately and carefully (UK competition enforcers sometimes publicize informant rewards; Bangladesh corporates should avoid market-wide bounties that could encourage frivolous claims).
15. Supplier speak-up: QR codes on POs and contracts; enable non-employee reporting.
16. Data minimization: don’t mirror whole phones if message exports will do.
17. Metric discipline: track retaliation audits and time to closure—buyers ask for these.
18. Union engagement: reassure worker reps that whistleblowing isn’t anti-union; share aggregate stats.
19. Dawn-raid readiness: whistleblowing can lead to raids—train reception/security.
20. Privilege: route high-risk matters through counsel; mark communications appropriately.
21. Document hygiene: avoid loose chat comments (“we all know they pay chai-pani”)—these sink defenses.
22. Public-interest reports: some disclosures may properly go to authorities—help employees do this safely and lawfully.
23. Contract clauses: add anti-retaliation, audit rights, and speak-up requirements to distributor/agent contracts.
24. Close the loop: send closure letters; publish anonymized case studies—people need to see the system working.

Part M — Technology & process design that staff will actually use

• Case-management platform with role-based access, audit logs, and time-stamped actions.
• Multi-channel intake (web, email, hotline, WhatsApp, SMS, drop-box).
• Language detection and auto-translation for first pass; always human-review.
• Auto-acknowledgments that promise protection and timelines.
• Investigation workspace with legal holds, evidence tagging, and document review.
• Analytics plug-ins for AP/GL, payroll, procurement, and mobile-money patterns.
• Retention & deletion automation per policy.
• Board dashboard built-in (see Part S).

Part N — Training and culture

• All-hands, 20-minute primer (Bangla/English/Arabic) on what to report, how, and protection guarantees.
• Supervisor modules on how not to retaliate; how to preserve evidence; what to say when approached.
• Investigator school: interviewing skills, digital evidence, documentation, bias awareness.
• Harassment training for Complaint Committee.
• Micro-nudges: poster refreshes, payslip reminders, lanyard QR codes, short WhatsApp gifs.
• Leadership messages: quarterly notes from the CEO underscoring zero tolerance for retaliation and celebrating resolved cases (anonymized).

Part O — 30/60/90-day rollout for first-time implementers

Days 1–30 — Stabilize

• Appoint Whistleblowing Officer and approve Investigation Charter.
• Publish plain-language policy (Bangla/English; Arabic for Dubai teams).
• Stand up intake channels (web, WhatsApp, hotline, email, boxes); test anonymously.
• Draft Anti-Retaliation Standard; push a CEO note: “Report. We’ll protect you.”
• Select external partners (hotline provider, forensics, translators).
• Create legal hold templates and chain-of-custody forms.

Days 31–60 — Institutionalize

• Train managers and investigators; run a tabletop investigation.
• Integrate harassment Complaint Committee process.
• Add speak-up clauses to supplier and contractor agreements.
• Turn on analytics for AP/GL, procurement, payroll.
• Launch Board dashboard v1 (intake volume, categories, SLA compliance).

Days 61–90 — Assure

• Complete two investigations end-to-end; issue closure letters; publish an anonymized case study.
• Run a retaliation audit on the first batch of reporters.
• Adjust SLAs and resources; conduct a poster/QR campaign at plants and depots.
• Present quarterly results to the board; lock the FY improvement plan.

Part P — Twelve-month maturity roadmap (what “great” looks like)

1. Hotline awareness >80% and trust >70% (surveyed).
2. Time to triage <7 days; median case closure <45 days (varies by complexity).
3. Anonymous share initially high, trending toward more named reports as trust grows.
4. Retaliation cases: zero—and staff believe it (prove with audits).
5. Cross-border discipline: UK and UAE teams say the process “works here too.”
6. Supplier/contractor reports make up 10–25% of intake (that’s healthy).
7. Control fixes shipped on the back of cases (procurement, bonded-warehouse, payroll, IT).
8. Board asks smart questions—and gets crisp answers grounded in data.

Part Q — Templates you can copy (short-form)

1) Whistleblowing Policy (one-page version)

• Purpose: enable safe reporting of wrongdoing (list examples).
• Who can report: employees, ex-employees, contractors, suppliers, customers.
• Channels: web/QR, WhatsApp, hotline, email, drop-box (list).
• Anonymous or named: both allowed; confidentiality assured.
• Process: acknowledge in 48 hours; triage in 7 days; updates every 30; fair investigation; outcome and remediation.
• Protection: zero tolerance for retaliation; interim safety measures; discipline for retaliators.
• Privacy: data minimization; secure handling; limited access; retention rules.
• No gagging: nothing in this policy restricts lawful disclosures to authorities.
• Contacts: WBO name/number/email; external hotline provider.

2) Anti-Retaliation Pledge (wallet card)

Retaliation is misconduct. No demotions, pay cuts, roster punishments, shift changes, harassment, or exclusion due to reporting or cooperating. Breach = discipline up to dismissal.

3) Intake Form (web/WhatsApp)

• What happened? When and where? Who was involved?
• Urgency (safety/criminal risk)?
• Evidence exists (docs, chats, photos, CCTV, logs)?
• Reporter contact (optional, confidential).
• Language preference.
• “I understand my report will be handled confidentially and that retaliation is prohibited.”

4) Legal Hold (Bangla + English)

• Matter name, dates, systems, custodians, do-not-delete instructions, FAQ, contact, acknowledgment link.

5) Investigation Plan (skeleton)

• Allegations & elements; custodians; systems; search terms (Bangla/English/phonetic); evidence tasks; interview list; timeline; risk log; communications plan.

6) Closure Letter (to reporter)

• Thank you; summary of steps (without naming disciplined persons); whether substantiated; high-level remediation; next steps; reiteration of anti-retaliation and contact for any concerns.

Part R — Special scenarios & playbooks

1) Procurement/Kickbacks

• Indicators: split POs under limits; new vendors days before award; shared phone/email DNA with staff; vague “marketing” invoices.
• Actions: freeze payments; legal hold; vendor KYC (TIN/BIN, UBO); three-way match; interview evaluation committee; remediate with pre-qualification and conflict declarations.

2) Bonded-Warehouse Diversion

• Indicators: yield anomalies; scrap volumes surge; night dispatches.
• Actions: reconcile BoE/GRN/dispatch; weighbridge logs; GPS routes; CCTV; tighten scrap tenders and route seals.

3) Payroll Ghosts

• Indicators: shared phones/bank accounts; no photos; overtime clusters under one supervisor.
• Actions: HRIS ↔ bank/mobile-wallet reconciliation; physical headcount checks; liveness on biometrics; policy and roster fixes.

4) Harassment

• Use the Complaint Committee route; protect complainant; no forced mediation; time-bound outcomes; training.

5) Cyber/Data

• Contain; image devices; rotate credentials; examine logs; classify incident; notify as per policy; remediate with MFA, PAM, DLP.

Part S — Board dashboard (quarterly)

• Volume: reports by source (employees, suppliers, customers), by site, by category.
• Speed: acknowledgment SLA, median days to triage/close.
• Outcomes: substantiation rate; financial recovery; control fixes shipped; repeat-finding rate.
• Protection: retaliation audits; zero-case confirmation; any allegations of retaliation and outcomes.
• Culture: awareness survey scores; anonymous vs. named trend; training completion rates.
• Cross-border: UK/UAE specific metrics; regulator interactions (if any).
• Serious matters: high-risk cases, escalations to authorities (count, not details), lessons learned.

Part T — Frequently asked questions (fast, practical answers)

Q: Should we allow anonymous reports in Bangladesh?
Yes. Provide both anonymous and confidential named channels. Anonymous options increase intake early; as trust builds, more reporters will identify themselves.

Q: Can we review WhatsApp chats on personal phones?
Only where lawful and proportionate, and consistent with BYOD or consent frameworks. Prefer targeted exports and minimize collection.

Q: Do we have to tell authorities immediately about bribery allegations?
Not automatically. Assess credibility and evidence with counsel. Where credible and material, design an engagement plan with authorities. Never obstruct.

Q: How do we stop false or malicious reports?
State clearly that bad-faith reporting is misconduct. But do not weaponize this—most reports mix facts and misunderstandings. Investigate proportionately.

Q: Can NDAs stop someone from going to a regulator (UK)?
No. Protected disclosures are preserved. Make this explicit in NDAs and handbooks.

Q: Will people use the hotline?
Only if it’s visible, Bangla-first, multi-channel, and seen to work (closure letters, anonymized case studies, and visible fixes).

Q: What about defamation risk in the UAE?
Encourage internal reporting; keep strict confidentiality; investigate promptly; escalate externally through counsel as needed.

Q: Can suppliers use our program?
They should. Encourage supplier and contractor reports; add non-retaliation obligations to contracts.

Part U — How TRW makes this painless (and effective)

• Program build: policies, SOPs, anti-retaliation standard, bilingual templates, third-party hotline selection, poster/QR assets.
• Training: all-hands, manager, investigator, and Complaint Committee modules (Bangla/English/Arabic).
• Case management: selection and configuration of platforms; lawful data handling in Bangladesh/UAE/UK.
• Analytics: AP/GL and trade-based red-flag libraries; mobile-money and procurement patterning.
• Investigations: rapid legal holds, digital forensics (devices, chats, cloud, ERP), interviews, documentation, and outcome memos fit for regulator or court.
• Remediation: control fixes, supplier contract re-papering, culture campaigns, and quarterly board dashboards.
• Cross-border alignment: one global standard with Bangladesh and UAE/UK addenda so you clear audits in Dhaka, Dubai, and London without rewriting the book every time.

Contact TRW Law Firm
Phones: +8801708000660 · +8801847220062 · +8801708080817
Emails: info@trfirm.com · info@trwbd.com · info@tahmidur.com
Offices: Dhaka — House 410, Road 29, Mohakhali DOHS • Dubai — Rolex Building, L-12 Sheikh Zayed Road

Final word

A credible whistleblower program in Bangladesh isn’t a formality—it’s your early-warning radar for bribery, safety failures, harassment, payroll fraud, bonded-warehouse diversions, and cyber risk. If you operate across Dhaka, Dubai, and London, build to the highest common denominator (UK-style protection, UAE free-zone discipline), then tune for Bangladesh realities: Bangla-first communications, WhatsApp-friendly intake, domestic-inquiry due process, and genuine anti-retaliation. Do that, and your program will not just “comply”—it will protect people, margins, and your license to operate.

Compliance Audits & Training

by Tahmidur Remura Wahid | Sep 3, 2025 | Corporate, M&A, Finance

Compliance Audits & Training (2025): The Complete Playbook for Companies in Bangladesh — with Dubai & London Context

By TRW Law Firm — Regulatory, Investigations & Workforce Compliance (Dhaka • Dubai • London)

Why this guide

Compliance is no longer a binder on a shelf; it’s an operating system that protects licenses, clears bank approvals, satisfies buyers/donors, keeps insurers comfortable, accelerates M\&A and, bluntly, stops bad headlines. In Bangladesh—where your business likely touches multiple regulators (NBR, Bangladesh Bank, BSEC, BTRC, DIFE, environment, local authorities)—a smart audit-and-training program is the single best way to detect risk early and embed the right behaviors.

If you’re a foreign company entering or scaling in Bangladesh, you also need cross-border alignment with your head-office standards and with rules your teams in Dubai (UAE mainland and free zones) and London (UK) already follow. This guide gives you a field-tested, step-by-step method to build and run a program that works in all three locations without fragmenting your controls.

Use this as your operating blueprint. Statutory rates, thresholds, and formats evolve; confirm numbers at implementation. No external links are included, by request.

Part A — What “compliance audits & training” really mean (done right)

• Compliance audits: recurring, risk-based checks of whether your policies, controls, and records meet law, license conditions, standards you’ve promised to customers/bankers/buyers, and your own code of conduct. They are independent of line management, documented to a forensic standard, and culminate in remediation that actually gets done.
• Compliance training: task-focused, role-based learning that changes behavior: short modules, local language, examples from your processes, manager toolkits, and measurement of behavior change. It is not a one-off slideshow.

Design principle: Treat both as part of one loop: Risk map → Controls → Audits → Findings → Remediation → Training → Metrics → Board. Rinse and repeat. When this loop runs monthly/quarterly, you stop “unknown unknowns.”

Part B — The regulatory landscape you must build for

Bangladesh: multisector, document-heavy

• NBR (Tax & VAT): registrations, withholding, VAT credits, transfer pricing, e-filings, e-BIN, e-TIN, and documentation of supply chains.
• Bangladesh Bank (BB): foreign exchange approvals and reports, outward remittances (royalties/dividends/management fees), AML/CFT, payments/PSP/MFS rules, ICT & cloud standards for banks and digital banks.
• BSEC (listed companies): governance, insider trading, related-party approvals, financial reporting, and investor communications.
• RJSC (company secretarial): filings, annual returns, resolutions, share allotments, capital changes, charges.
• DIFE/Labour: standing orders/service rules, registers, wages/OT/payslips, POSH (anti-harassment) committee, safety & welfare.
• BTRC/Telecom: service/user licenses, type approval, import NOCs, spectrum, lawful interception, data retention, spam/A2P hygiene.
• Environment: ECA/ECR, site clearances, effluent and emissions monitoring, waste manifests.
• Local authorities: trade licenses, fire licenses, factory licenses, signage, and site usage.
• Data & cyber: evolving data-protection regime; cyber incident and log-retention expectations; banking/telecom sector specifics.

Dubai / UAE: license-first, sector overlays

• Mainland economic departments and free zones (DIFC/ADGM/JAFZA etc.) set license scopes, governance, and in free zones often whistleblowing/data standards.
• Sector regulators (especially DFSA/FSRA in financial centers, telecom, health, and education) impose control and training requirements.
• AML/CFT for designated non-financial businesses & professions (DNFBPs), and financial institutions.
• Labor and immigration compliance, corporate governance for larger entities and government-related entities.

London / UK: control culture, individual accountability

• Company law and FRC/BEIS governance expectations for boards and audit committees; robust whistleblower protection.
• FCA/PRA (if regulated): systems & controls (SYSC), conduct rules training, SMCR accountability maps.
• Health & Safety Executive standards, ICO data-protection enforcement, competition law scrutiny.
• Strong expectations for documented risk assessments, board oversight, and management attestations.

Takeaway: Build one global standard that meets UK-level expectations (documentation, independence, anti-retaliation), then bolt on Bangladesh specifics (registers, approvals, sector filings) and UAE nuances (licensing, free-zone regimes). This avoids three different programs and keeps your auditors, buyers, and banks calm.

Part C — The 10-component compliance framework (copy this)

1. Risk taxonomy: legal, financial, operational, cyber, safety, third-party, ESG.
2. Risk register with owners, inherent/residual risk, controls, KRIs.
3. Control library mapped to laws, licenses, and contracts.
4. Audit universe listing locations, processes, and systems.
5. Annual audit plan risk-weighted; include surprise checks.
6. Issue lifecycle with severity ratings, owners, and due dates.
7. Training curriculum by role/function with languages.
8. Case & incident management (hotline/discipline/data incidents).
9. Board dashboard (KPIs, trends, red flags).
10. Policy & SOP library with version control and attestations.

Part D — Building the audit program, step by step

Step 1: Map your obligations (Bangladesh core)

• Corporate/RJSC: annual returns, director changes, share allotments, charge creation/satisfaction, minutes books.
• Tax/VAT/NBR: registrations, returns, source tax deduction and deposit, VAT e-filings, TP documentation, customs records for HS codes and bonded warehouses.
• FX/BB: BOI/registration or approvals for foreign investment; reporting for inbound equity; dividend repatriation files; royalty/service fee approvals; export proceeds realization; BAFEDA rates alignment; AML/CFT program.
• Securities/BSEC (if applicable): board composition, audit committee, RPT approvals, insider lists, periodic disclosures.
• Labour/DIFE: appointment letters, standing orders, wages/OT, registers (attendance, leave, fines, accidents, maternity), safety committee minutes, POSH committee functioning.
• Telecom/BTRC: service or user licenses, type approvals, import NOCs, numbering/short codes, spectrum logs, LI and data retention setup, spam/A2P controls.
• Environment: ECC, ETP/STP operations, stack/effluent testing, hazardous waste manifests.
• Trade: LC files, import/export documentation, BoE and shipping papers, Incoterms, inspection certificates.
• Data/Cyber: security baselines, incident handling, log retention, vendor security.

Dubai & London add-ons: license scope in the UAE (free zone vs. mainland), governance and AML expectations; UK board/audit-committee documentation, training attestations, and data-privacy controls.

Step 2: Build your audit universe

List all auditable entities: head office, factories, warehouses, branches, depots, call centers, data centers/cloud tenants, shared services, C\&F agents (documentation), large suppliers (if contractually auditable), distributors (for competition/brand compliance), and high-risk third-party processors (payroll, IT).

Step 3: Risk-rate and prioritize

Score by regulatory impact, financial exposure, frequency of errors, history, and change (new system/vendor/regulator). In Bangladesh, anything touching NBR, BB, BSEC, BTRC, DIFE, or environment should land in the top tiers.

Step 4: Audit plan and cadence

• Quarterly: tax/VAT, FX/BB outward remittances, payroll/wages/OT, procurement & AP, bonded-warehouse/inventory, telecom spam/A2P and LI tests, cyber incident register review.
• Biannual: corporate secretarial, environment, safety & POSH, data-privacy baseline, third-party due diligence.
• Annual: full governance review (board, audit committee), training effectiveness, competition/antitrust health check, ESG claims.

Step 5: Fieldwork (Bangladesh-fit)

• Data room: registers and filings in Bangla/English, payment challans, bank SWIFT/BEFTN proofs, customs packs, numbering/spectrum letters, safety logs, and board/audit committee minutes.
• Sampling: risk-based; for wages, draw samples across grades and shifts; for VAT, sample input credits and mismatched invoices; for FX, sample each category (dividend, royalty, service fee, freight).
• Walkthroughs: payroll run, OT approvals, invoice intake, GRN/three-way match, LC opening and amendment, data-incident playbook, spam/A2P throttling, LI test calls (for operators).
• Interviews: HR/payroll clerks, tax lead, FX desk, procurement, warehouse, QA, safety officer, hotline owner, IT/security.

Step 6: Grading and reporting

• Severity (Critical/Major/Moderate/Low) and themes (policy gap, control design, execution, documentation).
• Issue facts with evidence, risk, root cause, owner, due date, and fix.
• Close-out: require evidence of fix, not just an email promise.
• Board pack: top ten risks, overdue issues, repeat findings, improvement trend.

Part E — The training program that actually changes behavior

1) Architecture

• Foundational (all staff): code of conduct, anti-bribery/anti-retaliation, data hygiene, speak-up, safety basics.
• Role-based:
• Finance/Tax: VAT, WHT, TP basics, documentation, invoice red flags.
• Treasury/Legal: FX approvals, dividend files, royalty/supporting docs, AML gatekeeping.
• HR/Factory: wages/OT math, registers, POSH committee, domestic inquiries.
• Procurement & Logistics: conflicts, vendor due diligence, bonded-warehouse controls, Incoterms.
• Sales/Distribution: competition/antitrust (RPM, MFN, trade associations), advertising claims, channel policies.
• IT/Security: incident classification, logging, LI and data retention where applicable, vendor access.
• Telecom operations: license conditions, numbering hygiene, spam/A2P filters, lawful-interception testing.
• Board & C-suite: fiduciary and oversight duties, audit committee playbook, dawn-raid and crisis roles.
• Locales & language: Bangla-first for Bangladesh; Arabic/English in Dubai; English in London, with accessibility for non-native speakers.

2) Modality & frequency

• Micro-learning: 10–15 minute modules; one topic per week for frontline staff, monthly for corporate teams.
• Workshops: quarterly deep-dives for finance/tax, FX/BB, procurement, and safety/POSH committees.
• Simulations: dawn-raid tabletop, FX file “build & defend,” bonded-warehouse spot check, LI test call drill, data-incident tabletop.
• Manager toolkits: five-minute huddles with talking points and job aids.
• Attestations: annual for code and key policies; event-based for role changes.
• Refresher cadence: annual baseline modules + rolling micro-nudges.

3) Measurement & effectiveness

• Pre/post tests; target 80%+ mastery.
• Behavioral KPIs: drop in repeat audit findings; reduction in invoice exceptions; on-time FX filings; hotline usage and zero-retaliation rate; safe behavior observations.
• Manager scorecards: training completion, audit issue closure, incident response quality.
• Board dashboard: training coverage, pass rates, behavior change metrics.

Part F — Bangladesh “hot spots” your audits and training must cover

1. Wages & OT math: correct base, legal multipliers, payslip transparency; alignment with sector minimums; registers accurate and contemporaneous.
2. Standing orders/service rules: certified where required; disciplinary due-process (show-cause → inquiry → reasoned order).
3. POSH: functioning complaint committee with woman chair and external member; case logs; protection from retaliation; periodic training.
4. FX/BB: dividend repatriation files; royalty/management fee approvals; export proceeds realization; service import documentation; AML/CFT risk assessments.
5. VAT/TAX: e-filings, input credit support, withholding deposits on time, TP files, customs classification and valuation consistency.
6. Telecom/BTRC: correct license class; type approvals; import NOCs; numbering/short codes; spam/A2P controls; LI testing and data retention; spectrum logs.
7. Environment & safety: ECC, ETP/STP performance; waste manifests; fire drills; PPE; safety committee action logs.
8. Competition: RPM and MFN creep in distribution; trade association hygiene; hub-and-spoke risks via shared distributors.
9. Third-party risk: C\&F agents, customs brokers, distributors, and cash-collection agencies; due diligence, contracts with audit rights, and payment transparency.
10. Data & cyber: incident playbook; log retention; vendor security; proportionate handling of personal data in case files.

Part G — Foreign companies: 25 cautions when operating in Bangladesh

1. “Facilitation” payments are bribes—train and enforce zero tolerance with real scenarios.
2. Document everything—boards in the UK/UAE expect forensic-grade files; Bangladesh regulators often ask for originals/certified copies.
3. Bangla-first policies, posters, and training for frontline teams.
4. Chain-of-custody for documents and devices; courts and regulators value it.
5. Domestic inquiries mandatory for dismissals—skipping them loses cases.
6. Supplier & contractor inclusion—extend hotline and training to their staff.
7. Distributors—competition training (no RPM/MFN without legal review); licensed channels only.
8. Bonded-warehouse—frequent spot checks; reconcile yield, scrap, and night dispatches; GPS and weighbridge controls.
9. C\&F agents—UBO checks, site visits, control clauses, audit rights, payment terms via bank only.
10. FX remittances—require documentation; plan timelines; keep central bank engagement professional and complete.
11. VAT credits—don’t book without matching documentation and supplier compliance.
12. Payroll—biometrics with liveness; headcount roll calls; bank/MFS reconciliation; payslips match registers.
13. POSH—do it properly; buyers check this first.
14. Data—collect minimally; keep investigations on-shore when feasible; use secure transfers if cross-border.
15. Telecom tech—no unapproved devices; type approval first; import NOCs for shipments.
16. Numbers/codes—short codes and sender IDs must be allocated; throttle spam; keep complaint logs.
17. Whistleblowing—confidential internal channels; anti-retaliation that actually works.
18. Board oversight—quarterly dashboards with trends, not anecdotes.
19. Dawn-raid readiness—front-desk scripts; counsel on speed dial; log everything taken/copied.
20. M\&A—clean teams for competitively sensitive info; pre-close conduct rules.
21. Leases & licenses—sites must match trade and factory licenses; mismatches invite inspection.
22. Training proof—attendance, tests, and manager confirmations; buyers and regulators request them.
23. CSR/Donations—screen beneficiaries; avoid political or front entities; require reports.
24. Gifts/Hospitality—strict thresholds; prior approvals; transparent registers.
25. Speak-up culture—publish anonymized case studies and fixes; this makes the system real.

Part H — Cross-border alignment: Dhaka ↔ Dubai ↔ London

• One policy set, three addenda: global code, anti-bribery, competition, privacy, investigations; then Bangladesh, UAE, and UK annexes for local specifics (hotline prescriptions, due-process, free-zone rules, PIDA).
• Shared controls: same AP/GL red-flag analytics, procurement approvals, third-party due diligence, and incident playbooks across offices.
• Training translations: Bangla and Arabic plus English; same scenarios localized (e.g., bonded-warehouse in BD; free-zone customs in UAE; SMCR conduct in UK).
• Board reporting: one dashboard with geography filters; consistent severity ratings and issue taxonomy.

Part I — 30/60/90-day build plan (greenfield or turnaround)

Days 1–30 — Stabilize

• Appoint Compliance Lead and Audit Manager; publish a CEO note.
• Map obligations and create your risk register with owners.
• Stand up a compliance calendar (Bangladesh filings, Dubai license anniversaries, UK board events).
• Select a case/audit tool (even a disciplined spreadsheet can work at the start) and set issue lifecycle rules.
• Run two quick audits: (1) wages/OT/payslips & POSH, (2) FX outward remittances and supporting files.
• Launch foundational training (code, speak-up, anti-bribery, safety basics).

Days 31–60 — Institutionalize

• Approve annual audit plan and perform two process audits (VAT/AP; bonded-warehouse/inventory).
• Build role-based training tracks and manager toolkits; implement attestations.
• Create hotline (web, WhatsApp, phone) and anti-retaliation standard; integrate with HR and investigations.
• Start a third-party due-diligence sweep: top 50 vendors/agents by spend/risk; re-paper contracts (audit rights, ABC/AML clauses).
• Test data-incident and dawn-raid simulations.

Days 61–90 — Assure

• Close findings with evidence of fix; run a repeat test on one area to prove improvement.
• Conduct board briefing with dashboard; agree on quarterly targets.
• Publish an anonymized case study of a finding and its fix; celebrate behavior change.
• Lock the 12-month roadmap (below).

Part J — Twelve-month maturity roadmap

1. Coverage: audit 100% of high-risk processes and 60–70% of medium risk; rotate the rest.
2. Findings: reduce repeat findings by 50%; close 90% of “Major+” issues within target time.
3. Training: >95% completion for foundational modules; role-based modules >85% within 90 days.
4. Behavior change: measurable drops in invoice exceptions, FX file returns, LI/Spam infractions, and POSH procedural gaps.
5. Speak-up: rising hotline usage with zero retaliation; monthly checks prove it.
6. Third-party: all high-risk partners vetted and contracted with audit rights; at least one audit performed on each of the top ten.
7. Data & cyber: incident tabletop twice; patch cadence meets policy; logs retained and sampled quarterly.
8. Cross-border sync: Dhaka, Dubai, and London share one dashboard and taxonomy; local annexes updated twice a year.

Part K — Functional audit checklists (ready to use)

1) Tax & VAT (NBR)

• Registrations valid; e-TIN and e-BIN mapped to all sites.
• VAT credits supported by compliant invoices; supplier compliance verified.
• WHT deducted and deposited on time with certificates issued.
• TP documentation current; intercompany agreements consistent.
• Customs files complete; HS codes consistent; bonded-warehouse reconciliations.

2) FX & Bangladesh Bank

• Dividend files: audited accounts, board resolutions, tax clearance, banker confirmations, and remittance approvals.
• Royalties/management fees: agreements, benchmarking, approvals, Form usage, remittance proofs.
• Export proceeds: realization within time; discrepancy handling; bank statements reconciled.
• AML/CFT: risk assessment, KYC files, STRs if applicable; training records.

3) Labour & POSH

• Appointment letters and ID; standing orders certified where needed.
• Wages/OT math compliance; payslips accurate; registers up to date.
• Safety committee, drills, PPE logs; accident register and closures.
• POSH committee functioning; case handling timelines; anti-retaliation proofs.

4) Telecom/BTRC (where applicable)

• Correct license category; valid type approvals and import NOCs.
• Numbering/short codes allocation and utilization; spam/A2P throttling; complaint logs.
• LI interfaces tested; data retention per license; spectrum logs.
• Partner agreements (aggregators, resellers) reviewed and compliant.

5) Procurement & AP

• Vendor due diligence; UBO and conflict disclosures.
• Three-way match; duplicate and round-sum flags monitored.
• Segregation of duties; approval hierarchies enforced in ERP.
• Gifts/hospitality registers; marketing services tied to deliverables.

6) Data & Cyber

• Incident classification; 24/72-hour playbook; past incident logs complete.
• Access controls (MFA, least privilege); vendor access and offboarding.
• Log retention; DLP and CASB baselines; periodic access reviews.
• Investigations data handling proportionate; cross-border transfers minimized.

Part L — Training outlines (plug-and-play)

Foundational (All staff, 45–60 minutes total, micro-modules)

• Speak-Up & Anti-Retaliation (10 minutes)
• Anti-Bribery & Gifts (10 minutes)
• Data Hygiene & Phishing (10 minutes)
• Safety Basics (10 minutes)
• Competition Basics for Sales/Marketing (optional 10 minutes)

Role-based (Quarterly)

• Finance/Tax: VAT credits and WHT traps; invoice red flags; TP essentials (30 minutes)
• FX/Governance: dividend/royalty file “build & defend”; AML gatekeeper role (30 minutes)
• HR/Factory: registers, payslips, POSH case flow, domestic inquiries (45 minutes)
• Procurement/Logistics: conflicts, bonded-warehouse controls, C\&F risks (30 minutes)
• Sales/Distribution: RPM/MFN, trade associations, online channel rules (30 minutes)
• IT/Security: incident classification, logs, vendor access, investigations data (45 minutes)
• Telecom Ops: license conditions, LI/data retention, spam/A2P (30 minutes)
• Board/C-suite: oversight, dashboards, crisis/dawn-raid roles (30 minutes)

Part M — How to prove effectiveness (and satisfy any regulator or buyer)

• Audit evidence: complete workpapers, samples, screenshots, reconciliations, walk-through notes.
• Before/after charts: issue counts, severity mix, closure times, repeat rates.
• Training lift: pre/post assessment deltas; behavior KPIs moving the right way.
• Culture: whistleblowing awareness scores, hotline usage trends, zero retaliation confirmations.
• Management attestations: quarterly sub-certifications by process owners.
• Independent assurance: annual external review of the program’s design and effectiveness.

Part N — FAQs (fast, practical answers)

Do we need a separate “compliance audit team” if we already have internal audit?
Not necessarily. Many firms run compliance audits within Internal Audit but with a dedicated compliance specialist and a legal/compliance sign-off. What matters is risk-based planning, independence, and issue closure discipline.

How often should we train?
Foundational annually (with micro-nudges during the year); role-based quarterly for high-risk teams; new joiners within 30 days. Managers need targeted refreshers aligned with audit findings.

Should training be the same across Dhaka, Dubai, and London?
Core content should match; local addenda should address Bangladesh registers and due-process, UAE licensing/free-zone nuances, and UK conduct/data expectations.

What’s the biggest cause of repeat findings?
Ownership and incentives. Fix it by naming a single owner, setting a deadline, tying part of managers’ KPIs to issue closure, and re-testing within one quarter.

Can we rely on vendor certifications instead of auditing them?
Start with certifications, but sample audit high-risk vendors annually. Paper alone won’t catch reality in logistics, bonded-warehouse, or call-center environments.

What if a finding suggests criminal conduct?
Escalate to Legal immediately; preserve evidence; consider whistleblower protection; assess regulator notifications; and plan a defensible investigation with due-process.

Part O — The TRW method (how we make this painless)

• Blueprint & build: risk registers, calendars, policy stacks, control libraries mapped to Bangladesh, UAE, and UK requirements.
• Audit factory: workpaper templates, sampling plans, issue lifecycles, dashboards; shadow audits to embed skills in your team.
• Training studio: Bangla/English/Arabic micro-learning, workshops, simulations, manager toolkits, and certification tracking.
• Rapid remediation: FX files rebuilt, VAT packs reconstructed, POSH committees operationalized, telecom license hygiene restored, dawn-raid drills run.
• Board packs: clear metrics and “storyline” every quarter; we present alongside management if desired.
• Cross-border alignment: one program across Dhaka, Dubai, and London—localized where it matters, harmonized where it counts.

Contact TRW Law Firm
Phones: +8801708000660 · +8801847220062 · +8801708080817
Emails: info@trfirm.com · info@trwbd.com · info@tahmidur.com
Offices: Dhaka — House 410, Road 29, Mohakhali DOHS • Dubai — Rolex Building, L-12 Sheikh Zayed Road • London — (by appointment)

Final word

A great compliance program in Bangladesh isn’t mysterious: know your obligations, build controls people can actually use, audit them with rigor, fix what you find, and train the exact teams who run the risks—then show the board the movement in numbers. If you operate across Dhaka, Dubai, and London, aim high and harmonize: UK-grade governance, UAE licensing discipline, and Bangladesh document reality, all in one loop. Do this well and inspections are routine, bank and buyer audits are uneventful, exports and remittances flow, and your people know exactly how to do the right thing—every month, not just once a year.

Corporate Investigations

by Tahmidur Remura Wahid | Sep 2, 2025 | Corporate, M&A, Finance

Corporate Investigations in Bangladesh (2025): A Complete Field Manual for Local & Foreign Companies

By TRW Law Firm — Investigations, Compliance & Disputes (Dhaka & Dubai)

Why this matters

Bangladesh is a high-growth market with dense supply chains (RMG, leather, light engineering), fast-rising services (fintech, logistics, e-commerce), and significant government touchpoints (permits, customs, taxation, utilities). Those touchpoints create real investigative workloads: procurement collusion, kickbacks, inventory shrink, payroll fraud, grey traffic in telecom, trade-based money laundering (TBML), workplace harassment, data leaks, and cyber incidents. If you operate here—especially as part of a multinational—you need a repeatable, defensible investigation playbook that respects local law and culture while aligning with global standards (anti-bribery, AML, sanctions, data & labour rules).

This guide gives you the end-to-end “how”: governance and privilege, scoping, evidence, interviews, digital forensics, regulator engagement, remediation, and a foreign-investor caution list tailored to Bangladesh.

Important: numbers and procedures can change via notifications and circulars. Use this as your operating blueprint and confirm specifics when you implement.

Part A — What counts as a “corporate investigation” (Bangladesh reality)

Common triggers

• Allegations via hotline or HR: harassment, discrimination, bullying, retaliation
• Procurement & sales: bid rigging, kickbacks, conflict of interest, resale price maintenance (RPM) attempts
• Finance: false invoicing, round-tripping, payroll ghosts, expense fraud, asset misappropriation
• Trade: HS code manipulation, over/under-invoicing, sham third-party freight or inspection fees, bonded-warehouse abuse
• AML/sanctions: suspicious flows via banks and mobile financial services (MFS), third-country routing, cash-to-digital conversion
• Data/cyber: account takeovers, exfiltration, malware/RAT infections, vendor breaches
• HSE/OSH: reportable accidents, falsified logs, safety equipment tampering
• Competition: competitor information exchanges through shared distributors, hub-and-spoke coordination
• Workplace conduct: substance abuse, extortion, intimidation, theft
• IP & information: leak of tech packs, patterns, BOMs, customer files

Where matters usually arise

• Factories, depots, bonded warehouses, customs yards
• Finance shared services, call centers, field sales, agent networks
• Import/export desks (LCs, BoE, B/L), C\&F agents, logistics vendors
• Digital ecosystems: WhatsApp/IMO/Facebook Messenger groups, Google/Microsoft suites, local ERPs, MFS wallets (bKash, Nagad), POS, ride-along apps

Part B — The legal & enforcement backdrop (what you must internalize)

• Criminal law & corruption: Bribery and “speed money” are criminal; the Anti-Corruption Commission (ACC) investigates/prosecutes. Donor-funded projects add debarment exposure.
• Money laundering & TFS: Proceeds of corruption/fraud can trigger AML obligations; the central bank’s financial intelligence unit issues directives and freeze orders; regulated entities must file STRs/SARs.
• Corporate/securities: Listed-company governance rules expect internal control, related-party discipline, and fair disclosure; violations invite enforcement and shareholder litigation.
• Labour & domestic inquiries: Discipline must follow due process—show-cause → impartial inquiry → reasoned order—or courts can reinstate with back wages.
• Data & cyber: A formal personal data regime is emerging; cyber offenses are policed under current cyber laws. Treat PI and system logs as sensitive; implement lawful, proportionate collection.
• Dawn raids: ACC, police units, tax/VAT intelligence and other authorities can conduct searches/seizures with due process. Know your response script.
• Extraterritorial overlays: FCPA/UKBA and other foreign laws can apply to conduct within Bangladesh, especially for multinationals or USD-cleared payments.

Takeaway: Your investigation playbook must anticipate criminal exposure, labour due-process, regulatory notifications, data sensitivity, and cross-border legal risks—all at once.

Part C — Governance & privilege: build the right cockpit

1. Investigation Charter

• Board-approved document that sets scope, authority, and independence of the investigations function (Legal/Compliance with HR and Internal Audit).
• Defines thresholds for external counsel, forensic firms, and when to brief the board/audit committee.

1. Independence & conflicts

• Segregate investigators from local management in scope. Require conflict declarations for each matter (no one investigates their own chain).

1. Legal privilege & work product

• Engage counsel early and document that the purpose is to obtain legal advice. Limit distribution, watermark drafts, and log access.

1. Anti-retaliation

• Board-backed “no retaliation” policy with Bangla-language communications. Track for reprisals after reports/interviews.

1. Case lifecycle controls

• Unique case IDs, matter triage, SOX-style evidence repository, chain-of-custody logs, investigation hypotheses, decision memos, remediation tracking.

Part D — Intake, triage & scoping (the first 72 hours)

1. Stabilize

• Preserve devices, email, chat, shared drives, ERP, CCTV, access logs, visitor registers, and—critically—phones (WhatsApp/IMO). Suspend auto-deletion.
• Issue a legal hold to custodians in Bangla and English (plain, specific, time-bounded).

1. Initial risk screen

• Criminal exposure? Reputational risk? Safety at risk? Regulator notifications likely? If yes, escalate to counsel and the audit committee.

1. Scope & hypotheses

• Draft a scoping memo: allegations, time frame, custodians, systems, third-parties, money/goods flows, legal issues, decision-makers.

1. Stakeholder map & comms

• Identify internal stakeholders (Legal/Compliance, HR, IT, Security, Finance) and external (counsel, forensics, PR).
• Set one communications channel; enforce need-to-know.

Part E — Evidence & forensics (Bangladesh-specific realities)

1) Digital forensics & data sources

• Messaging apps: WhatsApp, IMO, Messenger, Viber, Telegram—collect chat exports and, where lawful, forensically image devices. Expect hybrids (personal device used for work). Use consent and policy for BYOD.
• Email & cloud: Google/Microsoft tenants; preserve mailboxes, Drive/SharePoint, audit logs; collect admin logs for group changes and deletions.
• Local systems: On-prem ERPs, attendance/biometrics, access control, CCTV DVRs (short retention!), POS, weighbridges, RFID, GPS trackers.
• Financial: Bank statements, MFS ledgers (wallet transactions), LC files, invoices, BoE, B/L, packing lists, inspection certificates, customs files, tax/VAT returns, e-BIN/e-TIN records.
• Telecom: For telecom cases, CDRs, interconnect CDRs, routing tables, CLI integrity reports, spam/A2P logs.
• Physical: Delivery challans, gate passes, store ledgers, machine utilization logs, quality reports, scrap registers.

2) Chain of custody

• Use evidence bags for drives/phones; photo each hand-off; assign seals; maintain a custody log with signatures and timestamps.

3) Collection protocols

• Imaging: Prefer bit-by-bit where feasible; if not, documented logical collections with hash values.
• Keyword strategy: English and Bangla (Bangla Unicode & phonetic English), plus common slang (chai-pani, commission, adjust, manage).
• Data minimization: Collect only what’s relevant; segregate PI; apply search term audit to show proportionality.

4) Analytics

• Transaction testing: three-way match (PO–GRN–Invoice), duplicates, weekend postings, round sums, split POs under approval thresholds, Benford analysis.
• Network analysis: shared addresses/phones among vendors and employees; graph links to bKash/Nagad wallets; hub-and-spoke in distributor networks.
• Trade tests: price/quantity anomalies vs. market; HS code consistency; Incoterms mismatch; repeated LC amendments.
• Payroll: ghost identities, bank/MFS accounts linked to supervisors, overtime anomalies.

Part F — Interviews (doing them right in Bangladesh)

• Language & setting: Offer Bangla or English. Use trained interpreters; avoid managerial presence for rank-and-file.
• Notice & fairness: Explain purpose, process, and anti-retaliation. For employees facing discipline, outline rights per policy/standing orders.
• Sequencing: Start with neutral witnesses, then supporting, then subjects. Cross-verify facts; use documents to anchor.
• Style: Fact-first, neutral, no promises. Avoid leading questions or threats.
• Records: Contemporaneous notes; ask the witness to review key points. For critical interviews, audio (with consent) or two-investigator notes.

Part G — Playbooks for the most common Bangladesh cases

1) Procurement kickbacks & bid rigging

Red flags: new vendor incorporated days before award; shared contact data with staff; sequential quotes with identical typos; split POs under thresholds; “consulting” invoices post-award.

Steps

• Pull vendor master data; match NPWP/TIN/BIN, bank accounts, directors/UBOs; cross-link to staff phone numbers and addresses.
• Review tender files, price models, evaluation sheets; re-score bids independently.
• Examine rebate/marketing service invoices; look for no deliverables.
• Interview procurement, finance, and warehouse on receipt and quality checks.
• If collusion suspected, prepare a self-reporting path and supplier debarment plan.

Remediation

• Rewrite vendor policy; introduce pre-qualification, conflict declarations, audit rights. Install three-way match and duplicate invoice alerts.

2) Trade-Based Money Laundering (TBML)

Red flags: price mismatch vs. indices; odd Incoterms; repeated LC amendments; third-party payments outside contract; goods never seen at gate; frequent BoE value disputes.

Steps

• Build a trade file (contract, PI, LC, invoice, packing list, B/L/AWB, inspection, insurance, COO, port/warehouse logs).
• Check HS codes, values, and quantities; compare with market ranges.
• Map money flows: bank and MFS; identify third-country hops.
• Coordinate with bank AML teams; consider STRs and control tightening.

Remediation

• Introduce end-use/end-user statements for sensitive goods; require independent price checks; strengthen C\&F agent controls.

3) Inventory shrink & scrap diversion

Red flags: negative yield variances, “rework” escalation, night dispatches, scrap sale cash.

Steps

• Reconcile BoM to production and dispatch; review CCTV and access logs; surprise stocktakes; analyze scale logs at entry/exit.
• Map truck GPS to gate passes; test vendor weights vs. your scales.
• Interview line supervisors and security.

Remediation

• Lock scrap sales into a controlled tender; add weighbridge cameras; enforce route seals; segregate duties in stores.

4) Payroll ghosts & expense fraud

Red flags: employees without photos, multiple bank/MFS accounts tied to one phone, identical addresses, unusual per diems.

Steps

• HRIS–bank/MFS reconciliation; device/phone clustering; physical headcount checks.
• Recheck overtime approvals, supervisor benefit links, and duty rosters.

Remediation

• Biometric attendance with liveness; geo-fenced field attendance; expense policy with receipt OCR and random audits.

5) Harassment & workplace conduct

Red flags: repeated complaints about an individual, sudden exits, patterns by shift/department.

Steps

• Trigger Complaint Committee (woman-chaired, external member per court guidance).
• Protect complainant and witnesses; consider interim measures (shift changes, supervisor swap).
• Evidence: messages, CCTV near incident areas, duty rosters.
• Conclude with a reasoned order; discipline proportionate; remedial training.

6) Grey traffic & telecom fraud (for operators/ISPs)

Red flags: abnormal A-to-B ratios, CLI spoofing, international inbound spikes, SIMbox patterns, sender-ID look-alikes.

Steps

• Traffic analytics (CDR/SDR), test call programs, KYC checks on high-usage SIMs, anti-spam throttling.
• Coordinate with interconnect partners; enforce blacklists; document enforcement.

Remediation

• Strengthen RA (revenue assurance), routing tables, SIM lifecycle, and fraud desk staffing.

7) Cyber/data leakage

Red flags: unusual outbound traffic, mass file downloads, credential reuse, vendor remote access at odd hours.

Steps

• Contain (disable accounts, isolate endpoints), image devices, rotate credentials, check logs, identify exfil paths.
• If personal data is involved, trigger data incident SOP (assessment, notifications as required).

Remediation

• MFA everywhere; privileged access management; vendor access segmentation; DLP and CASB; regular phishing drills.

Part H — Working with regulators & law enforcement

• When to notify: If there’s material criminal exposure, significant customer impact, or regulatory reporting triggers (e.g., STRs for AML), brief counsel on whether and when to notify.
• Searches & seizures: Have a dawn-raid SOP: verify warrant/order, call counsel, escort the team, log everything taken/copied, assert privilege, and request sealed copies of digital images.
• Witnesses: Prepare staff; insist on counsel’s presence for formal statements; avoid speculation; correct inaccuracies in writing.
• Media: Centralize comms. No casual quotes. Internal memo first; external messaging vetted by counsel/PR.

Part I — Outcomes & remediation (what “good” looks like)

1. Decision memo

• Facts established; law applied; credibility assessment; financial impact; root causes; disciplinary outcomes; regulator actions taken; recovery actions (clawbacks, claims).

1. Control fixes

• Policy/SOP changes, system rules (e.g., duplicate invoice alerts), vendor contractual re-papering, segregation of duties, new approval matrices.

1. Restitution & recovery

• Demand letters; settlement agreements; insurance notifications (crime policies); civil claims; police complaints if appropriate.

1. Training & culture

• Targeted refreshers for procurement, logistics, finance, supervisors; Bangla-first “what to do when asked for a bribe” scripts.

1. Board reporting

• Quarterly pack: new matters, time to close, substantiation rates, controls fixed, open actions, and trendlines.

Part J — Foreign-investor caution list (Bangladesh-specific)

1. “Speed money” is a bribe. There is no legal facilitation exception.
2. Third-party risk: Customs brokers, C\&F agents, distributors, consultants—run real due diligence (UBO, site visit, references, litigation/blacklist checks).
3. Cash & MFS flows: Kickbacks route via mobile wallets; correlate phone numbers and device IDs with employees/vendors.
4. Trade corridors: TBML risk around HS codes and price manipulation; insist on independent checks.
5. Bonded warehouse: High diversion risk; inventory controls must be tight and audited.
6. Shared distributors: High chance of hub-and-spoke info sharing—hard line on competitor data.
7. Labour due-process: Don’t terminate without a domestic inquiry; courts punish shortcut discipline.
8. POSH compliance: A functioning complaint committee is non-negotiable for buyers and courts.
9. Data transfer & privacy: Treat PI and logs sensitively; use proportionate collection; be ready for data-authority scrutiny as rules mature.
10. Books & records: No vague GLs (“market development”), no off-book cash, no “marketing services” without outputs.
11. Gifts/hospitality: Public officials—extremely conservative; document approvals; pay vendors directly, not per diems.
12. Distributor RPM: Don’t police retail prices; focus on quality standards and availability KPIs.
13. Call centers: Use licensed routes; avoid grey VoIP.
14. IP leakage: Guard tech packs and patterns; lock down supplier access; watermark files.
15. Security & safety: Genuine fire drills, PPE, lock-out/tag-out—buyers audit this.
16. Speak-up channels: Provide Bangla-language hotline/email/WhatsApp; protect whistleblowers in practice.
17. Language & documents: Keep Bangla-English versions of contracts, handbooks, notices; staff must understand them.
18. Notarization & stamping: Budget time for certified copies and stamping where needed; courts expect originals or certified dupes.
19. Board oversight: Quarterly MI on investigations; audit committee timeboxed remediations.
20. Exit strategies: If you must exit a distributor or employee, follow contract + law—notice, cure, inquiry, settlement.
21. Dawn-raid readiness: Train reception/security; keep an evidence room; know your counsel’s number.
22. Foreign law overlays: FCPA/UKBA risks—ban “success fees” with vague services; structure FMV consulting.
23. Charity/CSR: Vet beneficiaries; avoid political or front charities; require reports and photos.
24. M\&A clean team: No competitively sensitive sharing pre-close; clean team for pricing and customer-level data.
25. Travel & security: For sensitive sites or disputes, use security briefings and escorts; never carry original master records off-site without chain-of-custody.

Part K — Toolkits you can copy today

1) Investigation intake form (one page)

• Reporter details (may be anonymous)
• Allegation summary (who/what/when/where)
• Urgency/safety risks
• Systems and people implicated
• Evidence known to exist (chats, documents, CCTV, logs)

2) Legal hold (Bangla + English)

• Clear description of records and dates
• Prohibition on deletion/alteration
• How to preserve chats, phones, laptops, cloud folders
• Contact for questions; acknowledgment required

3) Digital forensics kit list

• Evidence bags and seals; Faraday bags
• Write-blockers; imaging software; hash tools
• External encrypted drives; chain-of-custody forms
• SIM/microSD adapters; device chargers/cables
• Camera and label printer

4) Interview checklist

• Case facts summary; exhibits; witness history
• Neutral opening; rights explanation; interpreter booked
• Specific, time-anchored questions; no leading
• Notes, signatures or audio (with consent)

5) Dawn-raid SOP (wallet card)

• Verify IDs and warrant/order
• Call counsel and investigations lead
• Escort officials; allocate a room; log copies/seizures
• Assert privilege; request sealed images
• No deletion, no obstruction, no speculation

6) Third-party due-diligence questionnaire (top items)

• Legal name, address, TIN/BIN; trade licence
• Directors/UBOs; PEP links; bank account in same legal name
• Litigation/blacklist/debarment checks
• References; premises photos; staff list
• Scope, deliverables, and fee basis (no success fees without outputs)

Part L — 30/60/90-day program to professionalize investigations

Days 1–30 — Stabilize

• Approve the Investigation Charter; nominate the Investigations Lead.
• Launch a Bangla-English speak-up channel and anti-retaliation notice.
• Draft legal hold templates; run a tabletop on evidence preservation.
• Create a case register with role-based access and chain-of-custody module.
• Pick external providers (forensics, translators, PR) under master terms.

Days 31–60 — Institutionalize

• Train HR, Finance, Procurement, IT, Security on intake and preservation.
• Publish interview and BYOD protocols.
• Install analytics for AP/GL (duplicates, round sums, split POs).
• Run third-party due diligence on top 50 vendors/agents by risk/spend; re-paper contracts (audit rights, ABC, AML, termination).
• Write the dawn-raid SOP; drill reception/security.

Days 61–90 — Assure

• Close two test matters end-to-end (documentation gold standard).
• Present the board dashboard: caseload, closure time, substantiation rate, recoveries, control fixes.
• Launch targeted trainings: procurement integrity, trade red flags, POSH investigator skills.
• Integrate investigations MI into enterprise risk and internal audit plans.

Part M — Board dashboard (quarterly)

• New matters opened/closed; average time to close
• Substantiation rates by category (procurement, trade, payroll, POSH, cyber)
• Financial impact and recoveries; insurance claims lodged
• Disciplinary outcomes; litigation filed/settled
• Control fixes shipped and verified; repeat-finding rate
• Third-party DD status; high-risk partner monitoring
• Dawn-raid drills; data incident tabletop results
• Speak-up volumes, anonymous %, retaliation cases (target: zero)
• Training completion for investigators and line managers

Part N — Fast FAQs

Can we copy employee WhatsApp chats on personal phones?
Only with lawful basis and in line with your policy (e.g., BYOD consent) and proportionality. Prefer targeted exports over full device images. In sensitive cases, seek employee consent or use work-managed apps.

Do we have to tell the ACC immediately about bribery allegations?
Not automatically. Assess credibility and evidence quickly under counsel. If substantiated or if there’s immediate public risk, design a regulator engagement plan. Maintain evidence integrity at all times.

Can we dismiss without inquiry if theft seems obvious?
No. Bangladesh labour law expects due process. Conduct a domestic inquiry and issue a reasoned order, or you risk reinstatement with back pay.

How do we handle vendors threatening to “expose” us if we terminate them?
Stick to contracts and facts. Document breaches, issue cure notices, and terminate per terms. Have litigation and PR plans ready; never pay hush money.

What about moving evidence out of Bangladesh for review?
Minimize personal data exports; anonymize where possible; use secure channels and logs; check contractual and regulatory duties before transfer.

Part O — The TRW advantage (how we help end-to-end)

• Rapid response: 72-hour containment, legal holds, device and cloud preservation, chain-of-custody.
• Forensics & analytics: mobile/chat/email/ERP imaging; AP/GL and trade analytics; MFS flow mapping; link analysis.
• Investigations: interviews (Bangla/English), documentary tests, reconstruction, quantification, and narrative.
• Regulator strategy: ACC/central bank/securities/tax engagement; dawn-raid defense; disclosure or settlement pathways.
• Remediation: policy/SOP rebuilds, vendor re-papering, control fixes, trainings, and board MI.
• Cross-border: FCPA/UKBA alignment, privacy-aware collections, and global reporting packs for HQ.

Contact TRW Law Firm
Phones: +8801708000660 · +8801847220062 · +8801708080817
Emails: info@trfirm.com · info@trwbd.com · info@tahmidur.com
Offices: Dhaka — House 410, Road 29, Mohakhali DOHS • Dubai — Rolex Building, L-12 Sheikh Zayed Road

Final word

Great investigations are operational systems, not heroic one-offs. In Bangladesh, that means (1) lawful evidence, (2) clean interviews, (3) forensic accounting that sees both bank and mobile money, (4) respect for labour due-process, and (5) control fixes that stop repeat incidents. Put this playbook in motion, and your investigations will be fast, fair, and defensible—at home and in front of any regulator or court.

BIDA Post-Approval Compliance

by Tahmidur Remura Wahid | Sep 2, 2025 | Corporate, M&A, Finance

BIDA Post-Approval Compliance in Bangladesh (2025): The Complete, Practical Playbook for Foreign Companies

By TRW Law Firm — Foreign Investment, Regulatory & Disputes

No links. No fluff. This is a field manual you can drop straight into your implementation plan after you receive a Bangladesh Investment Development Authority (BIDA) approval or registration.

1) What “BIDA post-approval” really means

Getting a BIDA approval or registration (for a new industrial/commercial project, a branch/liaison/representative office, or specific facilitation like work permits and visa recommendations) is only your starting gun. The real work is the post-approval build-out: entity setup, tax/VAT, banking & FX, land/building/environment, labour & immigration, sectoral permits, import/export readiness, and ongoing reporting to BIDA and other regulators.

Think in layers:

1. Corporate & tax identity (company/branch/liaison, TIN, BIN, trade licence)
2. Banking & FX (FDI remittances, share issuance/ reporting, foreign loans, dividends, service fees)
3. People & immigration (work permits, visa recommendations, expat-local ratios)
4. Facilities & operations (land, building, fire, factory, environmental)
5. Trade permits (IRC/ERC, standards, telecom/health/plant/animal NOCs)
6. BIDA & cross-regulator reporting (activity updates, renewals, changes of shareholding/management)
7. Governance & controls (boards, policies, registers, evidence trail)

This guide walks you through each layer with checklists, timelines, and pitfalls.

2) Who is this for?

• Foreign-owned greenfield companies (manufacturing, services, trading)
• Branch and liaison/representative offices of foreign companies
• Investors entering economic/hi-tech parks or EPZ/EZ regimes
• Acquirers of existing Bangladeshi companies (post-deal regularisation)
• Multinationals adding expatriates, foreign loans, or intragroup services to an existing set-up

3) The Post-Approval Master Checklist (copy/paste)

Corporate & identity

• ☐ Finalise entity form: company vs. branch vs. liaison (per BIDA approval)
• ☐ Obtain e-TIN (income tax) and BIN (9-digit VAT registration)
• ☐ Obtain trade licence from city/municipality for your office/facility address
• ☐ Open bank accounts with an authorised dealer (AD) bank (local & foreign currency as applicable)
• ☐ Approve board resolutions: signatories, bank mandates, leases, policies

Foreign capital & FX

• ☐ Inward FDI remittance through AD bank referencing the approved project
• ☐ Issue shares (for companies) within the prescribed internal timeline after receipt; update share register and statutory filings
• ☐ Ensure FDI reporting via the AD bank’s reporting channels; keep bank certificates, swift copies, valuation/equity workings
• ☐ For branch/liaison: bring in initial establishment funds within the period in your approval letter; use only for permitted expenses
• ☐ Map future flows: dividends, royalties/tech fees, management fees, service agreements, intercompany loans (with prior registrations/clearances where required)

Immigration & staffing

• ☐ BIDA work permit pathway for expatriates (sponsor entity, proof of necessity, role descriptions)
• ☐ Visa recommendation letters (entry/extension) per role; maintain police/security clearances where prescribed
• ☐ Observe expat-to-local staffing ratios and progressive localisation plans expected in many sectors
• ☐ Contracts, payroll tax withholding, social benefits, and personal tax onboarding for expatriates and local staff

Facility & operations

• ☐ Office/land/lease finalised; title/lease chain due diligence completed
• ☐ Factory/establishment registration (where applicable)
• ☐ Fire Service & Civil Defence clearance and ongoing drills/maintenance
• ☐ Department of Environment: Site/EIA/Environmental Clearance (SCC/ECC) and compliance with effluent/emission/waste norms
• ☐ Building plan approvals, occupancy, utilities (power/gas/water/telecom)
• ☐ Department of Inspection for Factories & Establishments (labour compliance), OHS management, grievance processes

Trade readiness

• ☐ IRC (import) and ERC (export) per business model
• ☐ HS code map (8-digit) for all products/services; duty/SD/VAT/AIT/AT/RD calculated
• ☐ Sector NOCs: BSTI (standards/compulsory marks), BTRC (wireless/telecom/RF), DGDA (drugs/medical), plant/animal quarantine, explosives/atomic energy as relevant
• ☐ Customs broker (C\&F) on SLA; shipment pack templates; bonded regime (if exporter)
• ☐ Bangladesh Bank: export declarations (EXP), import reporting (LCA/OIMS), proceeds realisation playbook

Ongoing BIDA & regulator interactions

• ☐ Activity/implementation updates to BIDA as requested in approval conditions
• ☐ Renewals: BIDA permissions (branch/liaison), work permits, visa recommendations, sector NOCs, ECC/fire/trade licences
• ☐ Material change notifications: shareholding/control changes, capital changes, principal activities, address moves, key officers
• ☐ Audit readiness: files indexed by topic (BIDA, FX/FDI, labour, ECC/fire, tax/VAT, customs)

4) Choosing the right structure (company vs. branch vs. liaison)

Company (subsidiary or JV)

Pros: Full operating scope; easier revenue recognition; clearer dividend pathway; limited liability; eligibility for tax incentives or bonded regimes.
Cons: Requires full corporate compliance; transfer pricing and withholding on intercompany flows; takes longer to wind down.

Post-approval watch-outs

• Timely share issuance against FDI receipts; equity valuation discipline for future rounds; reporting through AD bank
• Board setup with independent oversight for governance and bank/FX signatories
• Tax & VAT registrations and monthly compliance rhythm from Day-1

Branch office

Pros: Can conduct approved business activities of the foreign head office; revenue may be permitted if approval scope includes it.
Cons: Direct tax nexus to parent; profit repatriation requires tax clearance; regulatory approvals are narrower; winding up includes settlement with regulators and tax.

Post-approval watch-outs

• Spend only within scope in the BIDA approval letter; update approvals if scope expands
• Maintain books in Bangladesh; obtain audits as required; keep head-office recharges arm’s-length and well-documented

Liaison/Representative office

Pros: Easiest to open; ideal for market research, coordination, quality control with no commercial trading.
Cons: No revenue-earning; expenses funded by inward remittances only; heavy scrutiny if activities look “commercial”.

Post-approval watch-outs

• Strictly non-commercial: no invoices, no local revenue, no purchase-and-sale on own account
• Quarterly/periodic activity reports and inward fund documentation; keep payroll and vendor taxes fully compliant

5) The first 100 days (timeline you can run)

Days 1–15: Mobilise

• Incorporate/register the approved form (company/branch/liaison)
• Obtain TIN and BIN; open AD bank accounts
• Assign implementation owners for FX, permits, tax/VAT, labour, facility, trade

Days 16–45: Capital & identity lock-in

• Bring in initial capital/funds as per approval conditions
• For companies: issue shares, update cap-table, complete statutory filings, and bank/FDI reporting
• For branch/liaison: align expenses to inward remittances and scope

Days 46–75: People & premises

• File work permits/visa recommendations for expatriates; initiate police/security clearances where required
• Finalise leases, building approvals, utility connections
• Initiate fire and environmental clearances (if applicable)

Days 76–100: Trade & operations

• Obtain IRC/ERC; complete HS mapping, sector NOCs; appoint C\&F broker
• Go live with VAT (monthly returns) and withholding workflows
• Submit any BIDA progress updates/renewals due within the period

6) Banking & FX: the traps that catch foreign investors

• FDI evidence trail: Every foreign equity remittance must be traceable via bank certificates and swift/credit advice; your share issuance and statutory registers must match the bank’s FDI reporting.
• Share issuance timing: Do not sit on foreign remittances. Issue shares within your internal deadline policy and keep audited reconciliation of “advance against equity.”
• Foreign loans: Obtain the required registrations/clearances before drawdown; ensure pricing, tenor, and security comply with policy; obtain a loan registration number from the central bank (via your AD bank) where applicable.
• Intercompany services: Put written contracts in place (scope, deliverables, pricing); apply withholding tax correctly; consider VAT on imported services (reverse charge) when applicable; maintain transfer-pricing documentation.
• Dividend repatriation: Board resolution, audited financials, tax/VAT clearance where relevant, bank documents and working papers—all lined up. Don’t declare if you have unresolved non-compliance that could block the bank.
• Expense funding for branch/liaison: Keep remittances within scope; avoid local borrowings; avoid mixing local sales receipts (not permitted for liaison) with remitted funds.

7) Immigration & staffing: being both fast and compliant

• Work permits: Anchor each expatriate role to a specific business need; include JD, organisation chart, and localisation plan. Expect the authorities to test whether a local could fill the role over time.
• Visa recommendations: Plan entry and extension cycles well in advance; keep passport, police verification, tax ID, and lease/utility proofs ready.
• Ratios & localisation: Many sectors expect conservative expat-to-local ratios (often expressed as a maximum share of expats on payroll) and a transition plan to train local successors.
• Payroll & personal tax: Register expats for TIN; operate withholding correctly from month one; issue salary certificates; ensure immigration and tax records match.
• Contractors & agents: If you deploy third-party headcount, ensure they are lawful, paid lawfully, and not a backdoor to exceed expat limits.

8) Facility, environment, safety & labour: the inspection triangle

• Land & title: Check chain of title and permitted land use before you sign; zone authorities add their own conditions.
• Building approvals: Secure plan approval/occupancy certificates; keep as-built drawings on site.
• Fire safety: Approval, equipment commissioning, drills calendar, maintenance logs; display evacuation plans.
• Environmental clearance: Category (Green/Orange/Red), IEE/EIA where required, ECC on display; run your ETP/stack within limits; maintain lab reports and logs; prepare for surprise inspections.
• Labour & OHS: Written contracts, wages/benefits, hours & overtime, leave, OHS risk assessments, PPE, machine guards, LOTO, confined space permits, first-aiders and fire wardens, grievance channels.
• Registers & evidence: Visitor log, inspection log, training records, incident reports, root-cause analyses, corrective actions with due dates.

9) Trade readiness: import/export without surprises

• IRC/ERC: Obtain the right type (industrial vs. commercial) and renew on time.
• HS classification: Build a master at 8 digits; nothing moves until HS is confirmed—this drives permits and taxes.
• Sector NOCs:
• BSTI compulsory certification for many foods, electrics, construction & consumer items
• BTRC type approval/NOCs for any wireless/telecom/RF hardware
• DGDA for drugs/medical devices/APIs
• Plant/animal quarantine for agrifood
• Explosives/BAERA/DoE for hazardous/regulated items
• Customs & brokers: Put SLAs into your C\&F contracts (draft filing, response times, amendment windows); demurrage is usually a process failure, not a policy problem.
• Bonded regime (exporters): Apply early, map input-output and wastage norms, and set up daily issue/return logs; reconcile monthly.
• Banking systems: Use your AD bank’s electronic channels for import reporting and EXP issuance; diary export proceeds realisation dates and follow-up cadence.

10) Tax & VAT rhythm (because banks and buyers will look)

• TIN/BIN in place before transactions start; trial-run a VAT return early to test master data and invoice hygiene.
• Withholding at source: Install an AP blocking rule—no payment without the right withholding section/rate; auto-issue certificates to vendors.
• Reverse charge VAT: On imported services; coordinate with FX payments and bank packs.
• Quarterly tax provision: Avoid year-end scrambles; hold board certification for financials; reconcile tax/VAT to GL regularly.
• Refunds/credits (VDS, import advances): Track certificates and claim windows; missing documents cost real money.

11) BIDA-specific ongoing actions

• Activity/progress reports: Many approvals (especially branch/liaison) require periodic activity statements; diarise them.
• Renewals: Keep a renewal calendar for BIDA permissions, work permits, visa recommendations, and any project registration validity.
• Material changes: Notify BIDA if you change registered office, project scope, key officers, shareholding/control, or project cost structure, as your approval may reference these.
• Facilitation through OSS: Use the One-Stop Service channels where they work—but maintain parallel relationships with the underlying agencies; practical progress often requires direct follow-through.

12) Sector mini-maps (what changes in practice)

Manufacturing (RMG, textiles, light engineering, electronics)

• Bonded regime; ETP non-negotiable; BSTI marks for certain inputs/products; labour & fire audits by buyers; structural safety expectations.

Agro-food & FMCG

• SPS permits; cold-chain & hygiene; BSTI marks; labelling; waste management for by-products.

Pharma & medical

• DGDA licensing/product registration; controlled storage; audit-ready quality systems.

Telecom/ICT & devices

• BTRC RF approvals; cyber & data controls for cloud/services; software licensing audits.

Power & heavy industry

• EIA with modelling; stack/ash handling; large-scale fire and emergency planning; land & right-of-way sensitivities.

Services (consulting, tech, BPO, e-commerce)

• Foreign tech-fee/royalty/management fee contracts; cross-border VAT on imported services; data privacy & cybersecurity expectations; consumer protection if B2C.

Branch/Liaison

• Scope discipline; activity reports; funding via inward remittance; no local invoicing for liaison.

13) High-risk pitfalls (we see these most)

1. Sitting on FDI cash without timely share issuance—breaks your audit trail and spooks banks.
2. Using the wrong vehicle (liaison doing commercial work; branch straying outside its scope).
3. Expired ECC/fire/trade licences—one surprise inspection shuts doors.
4. HS misclassification to “save duty”—leads to back assessments and penalties.
5. Missing sector NOCs (BSTI/BTRC/DGDA/SPS)—shipments detained or destroyed.
6. Off-book agent payments for permits—ABC/AML exposure, debarment risk, and impossible audits.
7. Ignoring expat ratios/localisation—work permit renewals slow or stall.
8. Transfer pricing on autopilot—intercompany charges without proof of service or benchmarking invite disallowances.
9. Weak grievance & OHS—injuries, labour findings, buyer delisting.
10. No evidence culture—“We’re compliant” without logs, lab sheets, permits, or board minutes.

14) Evidence first: your audit-proof file plan

• BIDA file: approvals, renewals, activity reports, change notifications, correspondence
• FX/FDI file: bank certificates, swift, equity issue documents, valuation notes, dividend packs, loan registrations, interest workings
• Work permits/visas: applications, approvals, police/security clearances, payroll and tax IDs, renewal diary
• Facility: leases, title checks, building plans, fire licences, maintenance & drill logs, ECC/IEE/EIA, lab test reports
• Trade: IRC/ERC, HS master, sector NOCs, shipment packs (import & export), bonded registers, broker SLAs
• Tax & VAT: returns, challans, VDS certificates, WHT certificates issued, reverse-charge workings, trial balances, reconciliations
• Governance: board & committee minutes, policy suite (ABC/AML, sanctions, whistleblowing, OHS, environment, data/cyber), training records

Digitise everything; index by topic and date; appoint a document controller.

15) Model SOPs (short versions you can expand)

SOP: Foreign equity receipt & share issuance

1. Receive FDI via AD bank; collect bank certificate.
2. Pass board resolution for allotment; issue shares within your policy timeline.
3. Update share register and statutory filings; provide documents to AD bank for FDI reporting closure.
4. Archive full pack (swift, allotment, filings, cap-table).

SOP: Work permit & visa

1. Business case + JD + org chart; file work permit application.
2. On approval, obtain visa recommendation; process visa/entry.
3. Register for TIN; add to payroll; initiate security/police verification if required.
4. Diary renewals 60–90 days in advance; track localisation plan.

SOP: Import of regulated goods

1. Confirm HS; map BSTI/BTRC/DGDA/SPS/other NOCs needed.
2. Insert NOCs/PSI as conditions precedent in PO/LC.
3. Broker files entry; pay duties/taxes; retain shipment pack.
4. Post-clearance: reconcile to ERP; update permit dashboards.

16) Board & CEO dashboard (quarterly)

• BIDA: approvals due/renewals; activity reports filed/pending
• FX/FDI: capital received; shares issued; loans registered; dividend/fees remitted
• Immigration: expats on roll; permits/visas expiring; localisation status
• Facility: ECC/fire/trade licence validity; incidents; audits; corrective actions
• Trade: shipments & TTI; NOC status; detentions/queries; bonded reconciliations
• Tax/VAT: returns filed; audits/notices; refunds/credits; WHT/VDS compliance
• Governance: policies/training; whistleblowing & investigations; ABC/AML reviews

17) FAQs (fast answers you’ll actually use)

Do branch/liaison offices need VAT registration (BIN)?
Often a BIN is needed for invoices from counterparties and for withholding/VAT compliance even if you don’t sell goods/services. Assess your exact flows; when in doubt, register early.

Can a liaison office sign sales contracts?
A liaison is fundamentally non-commercial. If you need to conclude contracts or book revenue, switch to a company or a branch with explicit approval.

Is dividend remittance pre-approved?
Generally no prior approval is required if you meet banking, tax and company-law conditions. But your AD bank will only process if your evidence pack is clean and there are no regulatory flags.

Can we import capital machinery before ECC?
Plan sequencing carefully. Many zones and projects expect at least environmental site clearance before major equipment moves. Don’t risk importing machinery you cannot install legally.

What’s the fastest way to get stuck?
Missing NOCs (BSTI/BTRC/DGDA/SPS) on arrival; no share issuance after FDI; expired fire/ECC; a liaison doing commercial acts; and poor evidence.

18) The TRW 30-Day Diagnostic (optional but powerful)

• Gap map against this playbook (BIDA, FX, immigration, facility, trade, tax/VAT)
• Document health check (do you actually have the evidence?)
• Priority fixes (top 10 with owners and due dates)
• Regulator-ready packs (dividend, work permit, ECC renewal, export proceeds)
• Board briefing (what’s red/amber/green; what could block operations or remittances)

19) Final word

BIDA approval is permission to begin, not the finish line. Foreign investors who succeed in Bangladesh do three things better than everyone else:

1. They sequence permits, people, capital, and trade so nothing idles at the port or in a drawer.
2. They document everything—so banks, buyers, and inspectors say “yes” on the first pass.
3. They localise—not just staff, but also the compliance rhythm: VAT close, ETP logs, fire drills, and expat renewals become habits.