Fintech

NRB licenses fall into categories under the Payment Systems Department's regulations: Payment System Operators (PSOs) — entities operating clearing and settlement systems; Payment Service Providers (PSPs) — entities providing payment instruments and services including wallets; and Payment Related Institutions. Each carries different capital, governance, technology, and reporting requirements. Foreign-affiliated entities face additional FITTA and NRB approvals. U.R.P. & Associates supports both first-time licensing and renewals.

Customer funds held in digital wallets must be segregated from operator funds, typically held in escrow accounts at scheduled commercial banks. The auditor must verify: that segregation is real and continuous (not just at year-end), that the escrow balance reconciles to aggregate customer balances on a daily basis, that no commingling or operator borrowing from customer funds has occurred, and that customer-level records reconcile to bank statements. Failures here are NRB enforcement priorities.

Fintech operators are designated reporting entities under the Asset (Money) Laundering Prevention Act 2064 and its rules. Obligations include customer due diligence at onboarding, enhanced due diligence for high-risk customers and PEPs, ongoing transaction monitoring, suspicious transaction reporting to the Financial Information Unit, record-keeping, and an AML compliance officer. NRB's AML directives layer on additional sector-specific requirements.

Digital lending in Nepal currently sits in an evolving regulatory space. Lenders extending credit at scale require appropriate institutional licensing — typically a finance company or BFI license — rather than operating as unlicensed lenders or marketplace platforms. NRB has signalled intent to formalise digital lending regulations; operators should not assume continued tolerance of unlicensed structures.

Beyond the standard financial audit: settlement reconciliation testing, customer funds escrow verification, AML/CDD sample testing, system change control review, business continuity and disaster recovery testing, cyber controls walkthrough, regulatory reporting accuracy, and review of customer complaints and resolution. NRB inspections increasingly cross-reference auditor working papers, so quality matters beyond the audit opinion.