Enforcement of Cyber Laws: On Paper, but in Practice?

Imagine that an anti-religious post spreads online and sparks unrest across the country. The government asks the platform to remove it, but the platform refuses. With no other option, the authorities block the entire service, cutting millions of lawful users off from content they are entitled to access. The scenario is fictitious, but it captures the practical challenges Bangladesh faces.

Technology has opened up remarkable opportunities for Bangladeshis, but its widespread adoption has also created greater scope for misuse. The state can punish offenders within its borders, but the platforms hosting harmful content, and often the individuals posting it, operate beyond them.

The Cyber Security Act 2026 and the Bangladesh Telecommunications Act 2001, as amended in 2026, are the primary laws governing content safety and the removal of unlawful content.

Section 8 of the Cyber Security Act 2026 sets out the procedures for removing, transferring or blocking certain material. The Act criminalises content that undermines the country’s integrity, security, defence or public order; religious, communal or ethnic hate speech that incites violence; and instructions intended to facilitate disorder or criminal activity. It also criminalises sexual harassment, blackmail, revenge pornography and hate speech that incites hostility.

Where a law enforcement agency has reason to believe that information published through digital or electronic media falls within one of these categories, it may act through the Director General of the Cyber Security Agency or request the Bangladesh Telecommunication Regulatory Commission (BTRC) to take action. Upon receiving a request or a tribunal order, the BTRC or the relevant agency within the ICT Division must ask the technology company to remove the content or, where applicable, block access to it.

Neither the Agency nor the BTRC is empowered to remove content directly from a platform; the law only allows these authorities to request its removal. However, it does not adequately address the consequences of a company’s refusal to comply with such a request or even a court order. As a result, the effectiveness of enforcement depends largely on the technology company’s willingness to comply, rather than on the authority’s ability to ensure compliance.

The BTRC does, however, have other enforcement tools. The Telecommunications Act 2001 grants it broad powers to block access at the internet service provider (ISP) level, and these powers were expanded in 2026 to cover cross-border and online services. But ISP-level blocking closes the road without fixing the problem. Shutting down an entire service because of a single fraudulent account can deprive millions of lawful users of services they rely on. It is also a measure particularly susceptible to misuse against legitimate speech. Instead, technology companies and the relevant Bangladeshi authorities should establish technical arrangements for removing specified content, reducing the need for ISP-level blocking.

The law takes a positive step towards transparency on the state’s part by requiring the authority to provide information when content is blocked. The same principle of transparency should apply to decisions made by technology companies.

Although these laws have extraterritorial effect, allowing action to be taken in respect of certain offences committed outside Bangladesh, enforcement remains challenging. Offshore service providers may have no physical presence in Bangladesh. The cross-border digital trade framework governing them does not require a local presence, and a business may be registered through a legally appointed representative. However, the law does not clearly define the rights and liabilities of such representatives. It is therefore uncertain whether a representative can be held responsible when a company refuses to comply with a request or an order. The draft Digital Trade Cross-Border Policy 2026, which has yet to become law, is also unclear about whether offshore companies must establish a physical presence in Bangladesh. In practice, where an entity has no local presence or other effective means of enforcement, the authority’s ability to compel compliance may be severely limited.

Bangladesh’s VAT framework addresses similar situations involving services supplied by offshore entities. It requires a non-resident that does not carry on economic activity from a fixed place in Bangladesh to appoint a VAT agent and specifies the agent’s functions. The Finance Act 2021 went further by addressing the allocation of liability between the agent and the non-resident principal. Subsequent amendments have exempted the agent from certain liabilities, as the tax authorities have other means of reaching the non-resident principal, including through payment flows, registration and assessment.

Following a similar approach, content-removal legislation should require offshore technology companies to appoint a representative in Bangladesh, whether a legal entity or a named officer. The representative should be authorized to accept service of Section 8 requests and tribunal orders and to facilitate compliance with them. Liability should arise from failure to comply with a valid, tribunal-approved notice or order, rather than from the content itself.

Brazil also offers a comparable approach: its Supreme Court has required platforms to maintain a legal representative in the country who can respond to authorities and comply with judicial and regulatory obligations.

A recent development in India shows what happens when takedown procedures are unclear. The government sends takedown notices to platforms through its Sahyog portal, relying on Section 79(3)(b) of the Information Technology Act and arguing that platforms that ignore them risk losing their safe-harbor protection. X (previously known as Twitter) challenged this approach, arguing that blocking must instead follow Section 69A, the Act’s formal blocking mechanism. Bangladesh should act before facing similar disputes, by enacting clear and certain laws that protect the interests of the government, users and technology companies alike.

Bangladesh does not lack a law on harmful online content. It lacks a way to make that law bind the companies it is meant to reach. What the country needs is clear and certain law, together with an effective mechanism that lets authorities secure the removal of specific content through valid orders or notices, so that ISP-level blocking becomes a last resort rather than the default.

Fateen Farhan is Barrister-at-Law and a technology law enthusiast.

The Crisis in Our Digital Commercial Laws

Five years ago, in the wake of Bangladesh's biggest e-commerce fraud wave, there was a widespread clamor for a dedicated, operational, and enforceable digital commerce law. In response, the Ministry of Commerce formed a panel to enact a dedicated Digital Commerce Act. That draft act has since been written, reviewed, debated at industry roundtables, revised and quietly shelved without being passed into law.

The guidelines are nonetheless subject to statutory ambiguities. A more specific example of this vagueness lies at the very first step a foreign business must take, i.e., registration. The 2021 guidelines require every digital commercial establishment to obtain a Unique Business Identification (UBID) from "the authority," but never define who that authority is. The Digital Business Identification Registration Guidelines, 2022, later filled in that blank, naming the Ministry of Commerce and the Office of the Registrar of Joint Stock Companies and Firms (RJSC) as the relevant bodies, and routing the application itself through the Ministry of Commerce. That clarified the "who", nonetheless it did nothing to clarify the "what."

What the 2022 guidelines never spell out is whether obtaining a Digital Business Identification (DBID) is simply a registration formality, or whether it presupposes that the applicant already has an actual local presence in Bangladesh. Neither guideline explicitly demands local physical presence as a precondition. Yet the application form asks for the address of the commercial establishment's office, which reads as an assumption that a physical office already exists. The guidelines further allow a power-of-attorney holder to file the application on the applicant's behalf, which impliedly waives the requirement of the local presence. As such, on one hand, the application form assumes an office and on the other hand the filing method assumes there might not be one. The application form also fails to clarify whether the address of a parent company located outside Bangladesh would be acceptable.

Today, digital commerce in Bangladesh is governed primarily by a handful of instruments rather than a single law: the Digital Commerce Operations Guidelines 2021, the Digital Business Identification Registration Guidelines 2022, and the Cross-Border Digital Commerce Policy 2026. Of these, only the first two are currently in force and the Cross-Border Digital Commerce Policy 2026 remains in draft form and has yet to be adopted as law or formal guidelines.

At the center of these instruments sit the Digital Commerce Operations Guidelines, 2021. The guidelines lay out a comprehensive set of obligations and restrictions that raised hopes for a better-regulated and more efficient digital commerce framework.

For an instance, a Singapore-based digital marketplace that wants to start selling its digital products to consumers in Bangladesh without opening any physical office there. Under the current guidelines, there is no clear answer to a basic question: can it obtain a DBID purely through a locally appointed representative, or must it first incorporate a branch office with the RJSC under the Companies Act, 1994? The guidelines gesture at both possibilities without committing to either leaving the company to guess or to seek informal confirmation from the Ministry on a case-by-case basis.

Bangladesh's VAT law shows what a resolved version of this problem looks like. Under Section 19 of the Value Added Tax and Supplementary Duty Act, 2012, a non-resident who does not carry on economic activity from a fixed place in Bangladesh is required to appoint a VAT agent, and Rules 16–17 of the VAT and Supplementary Duty Rules, 2016, spell out exactly what that agent does: file returns, remit VAT, and handle compliance on the non-resident's behalf. The Finance Act, 2021, goes a step further and addresses how liability is shared between the agent and the non-resident principal.

Digital commerce law has no equivalent carve-out. It is silent on whether a similar agency arrangement can satisfy the DBID requirement, or whether "authority to file paperwork" is being quietly treated as identical to "authority to represent a locally established business".

Moreover, the framework fails to establish a dedicated cause of action for aggrieved individuals. Instead, it relies on unrelated and older statutes such as the Penal Code 1860, the Money Laundering Prevention Act, 2012, and the Consumers' Rights Protection Act 2009, to penalize anything more severe than a minor warning. Because these older laws were never designed with modern e-commerce fraud in mind, their use opens the door to widespread procedural abuse and operational gridlock. For example, because the Penal Code 1860 lacks clear technical definitions for digital transactions, authorities struggle to assess the core ingredients of physical "cheating" or "forgery" in a virtual environment. Conversely, aggressive over-application of the heavy-handed Money Laundering Act 2012, means minor logistical delays or standard merchant-consumer disputes can be misclassified as criminal asset diversion. This subjects small online business owners to frozen bank accounts and immense administrative harassment.

Additionally, the guidelines' sanctions such as cancellation of a trade license, company registration, or VAT registration are largely symbolic against a platform that has already moved customer money elsewhere.

There has been public outcry over such weak protections and uncertainties since the guidelines were enacted; nonetheless, the debate has resurfaced following the publication of the Cross-Border Digital Commerce Policy 2026. Although there was an expectation that the new policy would offer better protection to consumers and add clarity to the guidelines, none of the uncertainties have been addressed adequately.

In an age when digital commerce is only growing, these are not loose ends that can be left indefinitely. They need to be tied off precisely because doing so is what would give foreign investors the confidence to enter and build in Bangladesh's digital economy, rather than sit on the sidelines waiting for the rules to settle. What the sector needs is not another guideline that exists mainly on paper and is enforced rarely, but a regulation that stipulates clear thresholds, real penalties and a designated authority accountable for applying both.

This article is written by Fateen Farhan. He is a Barrister-at-Law and currently works as a Lecturer at LCLS (South) and an Associate at The Law Counsel. The author can be reached at fateenfarhan62@gmail.com

The Suspension of Folarin Balogun’s Sanction: A Threat to FIFA’s Autonomous Integrity?

During the match on 1 July 2026, Balogun was sent off with a direct red card for serious foul play following a VAR review. However, just four days later on 5 July 2026, FIFA announced the suspension of the automatic one-match ban, placing it instead under a one-year probationary period. The move has fueled widespread discussion about the certainty of disciplinary rules and the neutrality of official decisions in high-stakes international tournaments. This article intends to examine the legal validity of such suspension of the implementation of the sanction.

FIFA operates within a well-established disciplinary framework. The fundamental Laws of the Game prepared by The International Football Association Board (IFAB), sets the universal rules and procedures for football. Additionally, the FIFA World Cup 2026 is regulated by some key regulations, including the FIFA Disciplinary Code May 2026, FIFA World Cup Competition Regulations 2026, official Circulars, and the FIFA Code of Ethics.

The first issue is whether the decision of the referee during the match can be challenged later in any other forum. Such a scope of review has been addressed in the Regulations for the FIFA World Cup 2026. Article 9.6 of the Regulation stipulates that no protests may be made about the referee’s decisions regarding facts connected with play. Such decisions are final and not subject to appeal, unless otherwise stipulated in the FIFA Disciplinary Code.

Article 9 of the FIFA Disciplinary Code further reinforces this position. It states that decisions taken by the referee on the field of play are final and may not be reviewed by the FIFA judicial bodies. However, in cases where a decision by the referee involves an obvious error, such as mistaking the identity of the person penalised, the FIFA judicial bodies may review only the disciplinary consequences of that decision.

Balogun’s situation does not meet any of these exceptions. Therefore, the standard rules have been applied and as such the red card and the automatic one-match suspension is irreversible.

Therefore, it can be concluded that there was no scope for overturning the red card. It is to be noted that the sanction remained in place, but the enforcement of the sanction was suspended.

The controversy does not center around whether the red card was correct. Rather, it raises concerns over whether the suspension of the implementation of the sanction was appropriate and fell within the scope of the Law.

The issue of an automatic one-match suspension following a red card is explicitly addressed across multiple regulatory frameworks. For instance, Article 10.5 of the Regulations for the FIFA World Cup 2026 stipulates that if a player or team official is sent off as a result of either a direct or indirect red card, they are "automatically" suspended from their team’s subsequent match. This principle is further reinforced by Article 66.4 of the FIFA Disciplinary Code, which mandates that a sending-off automatically incurs a suspension from the following match.

Additionally, FIFA World Cup 2026 Circular No. 16, distributed to all participating member associations on 12 May 2026, affirms this protocol and confirms a one-match automatic suspension following a red card.

Consequently, the position of the law is absolute, i.e., any sending-off results in an immediate suspension from the subsequent match. The consistent inclusion of the word "automatic" throughout these regulations underscores the mandatory nature of the rule, leaving no room for discretionary interpretation.

Therefore, having received a red card, Balogun was expected to serve an automatic one-match suspension. However, on 5 July 2026, the FIFA Disciplinary Committee intervened by invoking Article 27 of the FIFA Disciplinary Code to suspend the enforcement of the automatic ban. This decision rendered Balogun immediately eligible for selection, allowing him to play in the United States' Round of 16 fixture against Belgium.

Article 27 of the Code states that the judicial body may decide to fully or partially suspend the implementation of a disciplinary measure. Further discretionary powers have been provided in Article 25. Article 25(1) empowers the judicial body to determine the type and extent of sanctions by considering the objective and subjective elements of the offence, along with any aggravating and mitigating circumstances. Although these articles grant significant post-hoc flexibility to the Disciplinary Committee, nevertheless, the flexibility in the absence of clear guidelines leaves the door open for the abuse of the due process of the law.  

On one hand, the regulations establish a clear and absolute principle of automatic suspension following a red card. In contrast, other articles introduce considerable flexibility that appears to undermine the mandatory nature of the automatic suspension rule. The tension between these provisions raises serious concerns about consistency, predictability, and the integrity of the disciplinary framework.

If the suspension is truly automatic, the broad discretionary powers under Articles 25 and 27 risk rendering that word meaningless. Conversely, if judicial discretion is intended to prevail, then the automatic rule loses its force and invites selective enforcement. Although judicial flexibility of such nature is common, nevertheless, absence of the transparent codification of what constitutes "exceptional circumstances" questions the very certainty of the law.

The application of Article 27 in the Balogun case has triggered widespread criticism centred on perceived political interference in FIFA’s disciplinary process. Reports indicate that US President Donald Trump contacted FIFA President Gianni Infantino to advocate for the suspension of Balogun’s automatic ban. Similarly, UK MP Noah Law’s letter requesting a review for Jarell Quansah’s red card suspension further illustrates how external political actors are now seeking to influence outcomes, using the Balogun precedent as justification. Such political leverage contradicts Article 15 of the FIFA Code of Ethics that requires the FIFA and its officials to remain politically neutral.

The Cristiano Ronaldo precedent from World Cup qualifying shows that Article 27 has been used before, often weighing factors such as disciplinary history and specific circumstances. However, the recent red card received by England’s Jarell Quansah on 6 July 2026, which triggered the standard automatic suspension for England’s quarter-final against Norway, has exposed the inconsistency.

While each case may involve unique mitigating or aggravating factors and FIFA is not required to reach identical outcomes. However, the Balogun ruling has created legitimate expectations that similar sanctions could potentially be reviewed under Article 27. Once FIFA demonstrates willingness to suspend automatic sanctions in selective cases, the criteria for when such discretion applies become unclear and open to challenge.

Such inconsistencies in the law and its application have significantly prejudiced public confidence in the integrity of the game. FIFA should clarify its legal position, particularly on the fundamental question of whether a general discretionary power such as that found in Article 27 can override an automatic consequence expressly stipulated under the special rules on expulsion and match suspensions.

If such an override is permitted, FIFA should clearly define the objective criteria that govern when this power may be exercised. Ultimately, these issues go to the heart of the regulatory framework: when does an automatic suspension stop being automatic, and what safeguards exist to maintain confidence in the regularity and fairness of competitions?

Without clear and transparent explanations, the current framework risks appearing arbitrary and susceptible to external influence. This not only weakens the authority of on-field decisions but also distorts the very peace and unity that FIFA claims to promote through the game.

---

The author is a Barrister-at-Law and can be reached at fateenfarhan62@gmail.com