NRB Issues Unified Payment Directive with Revised ATM Limits and Stronger Security Rules

Nepal Rastra Bank (NRB) has issued the “Unified Payment System Directive, 2082,” introducing new limits and tighter security measures for digital transactions.

Under the new rules, debit card users can withdraw between Rs. 500 and Rs. 20,000 per transaction from ATMs, with a daily limit of Rs. 50,000 and a monthly cap of Rs. 300,000. Before this rule the users were able to withdraw 25 thousands per transaction, one lakh per day and 4 lakhs per months.

Banks may extend the daily limit up to Rs. 100,000 based on customer risk assessment. For prepaid cards, the limits are Rs. 10,000 per transaction, Rs. 20,000 per day, and Rs. 200,000 per month. Credit card cash withdrawals are capped at 10% of the approved credit limit.

NRB has also mandated faster resolution of failed transactions, requiring settlement by the next day if handled by the same bank, or within three days if different institutions are involved.

To enhance security, banks must block lost or stolen cards immediately and issue replacements within 24 hours. ATM CCTV footage must be stored for at least 90 days, ensuring customer identity visibility without exposing PIN details.

Additionally, customers using digital banking services from abroad must inform their bank in advance and use two-factor authentication. The directive also allows banks to issue RFID-based prepaid tags for road toll payments.

The central bank has restricted issuance of multiple similar cards from a single account and requires all payment cards to be chip-based. Banks must also conduct system resilience tests at least once every two years.

Existing transaction limits remain unchanged for mobile banking (Rs. 300,000 per day) and web banking (Rs. 20 lakh per day), while wallet-to-bank transfers are capped at Rs. 10 lakh per month.