Central bank threatens show-cause notices as ITCL restores services for about 30 banks; sanctioned vendor allegedly sabotaged servers

Card and ATM services across Bangladesh resumed late on Tuesday after a two-day outage left millions of customers unable to withdraw cash, pay in shops or even check balances. The outage followed allegations that a Russian software supplier under sanctions sabotaged the country's main payment network.

Information Technology Consultants Ltd (ITCL), which operates the Q-Cash network, said on social media on Tuesday 6 October that all services now work normally. Shortly after midnight, Bank Asia texted customers to confirm that its ATM, card, POS, NPSB, e-commerce and QR services had fully recovered.

Services for roughly 30 banks stopped after 9pm on Sunday 4 October. Banks offered no advance notice. Some told customers services would return after noon on 10 October, the end date ITCL had posted for what it called maintenance.

A vendor dispute

The Business Standard reported that the crisis grew out of a quarrel over software migration between ITCL and Compass Plus, a Russian supplier. ITCL says it learned that Compass Plus had started to lose its place to Way4, an enterprise payments platform from the Brussels-based firm OpenWay.

ITCL told the paper the Russian company then planted a malicious script on its servers. The script restarted the machines every eight hours, wiped routing tables and halted data processing across the network.

The dispute had sharpened in August, when ITCL announced a phased replacement of the Compass Plus platform over 12 to 18 months. Compass Plus allegedly threatened to withdraw technical support, demanded an immediate $1.5m migration fee and sought an advance payment guarantee backed by Bangladesh Bank. Compass Plus has not commented in the reports reviewed here, and the allegations remain unverified.

Kazi Saifuddin Munir, ITCL's managing director, said he alerted partner banks, including the mobile wallet bikash, as soon as his team identified the problem. He insisted customer data remains secure.

Bangladesh Bank stepped in on Monday, brokering talks between the vendor and ITCL. Officials still voiced anger that ITCL took systems offline without warning.

Arif Hossain Khan, the bank's spokesman, called the failure a plain technical fault but said the inability to contain it quickly had inflicted severe hardship on cardholders. He confirmed the central bank will issue show-cause notices to member banks. Rules require institutions to warn the public through national media, television and direct text messages well before any planned maintenance.

One central bank official said ITCL told regulators only on Sunday evening that it needed to go offline urgently. "Emergency" conditions, the official added, do not excuse a clear breach of the regulatory framework. Banks had earlier told the regulator that a security and capacity upgrade would suspend card services from 28 October to 2 November. The central bank's payment systems department said the ITCL migration originally targeted late October.

ITCL provides core payment processing and gateway infrastructure to 33 commercial banks. It runs the National Payment Switch Bangladesh, ATMs, POS terminals, cash recycling machines and internet banking fund transfers. Industry estimates suggest it handles about 70% of the country's bank card transactions.

Banks described reputational damage. Mahfuzur Rahman, chief financial officer of Trust Bank, said ITCL informed lenders on Sunday evening, the same day it pulled the plug, leaving no time to warn customers. He called the move thoroughly unprofessional and said it damaged public trust in every member bank.

Trust Bank's debit cards kept working on Visa and the domestic NPSB network. Its credit cards, prepaid cards and Q-Cash ATMs stayed dead.