BD-S15Payment systems and listed MFS providers
Bangladesh Bank
Lists MFS services including bKash, Nagad and Rocket and identifies their business entities.
Open official sourceBangladesh Bank's current MFS list identifies bKash Ltd. as the business entity for bKash. That verified identity does not authorise a casino, agent, recipient number or gambling transaction.
Bangladesh Bank's Payment and Settlement Systems page places bKash in row two of its MFS provider list and names bKash Ltd. as the business entity. The page describes the Payment Systems Department's regulation, licensing and oversight role and lists domestic MFS categories such as cash-in, cash-out, P2P, P2B, B2P, P2G and G2P. We rechecked the page and stored a local evidence capture on 13 August 2026.
The record verifies the regulated MFS identity, nothing more. A bKash logo, personal number, agent label or merchant-looking instruction in casino chat is not an endorsement by bKash Ltd. Recipient control, transaction purpose and any relationship to an operator need separate primary evidence.
| Field | Record | Do not assume |
|---|---|---|
| MFS service | bKash | The service name is the recipient |
| Business entity | bKash Ltd. in the BB list | Every bKash account is company-owned |
| Recipient | Exact app name, number or merchant code | Casino operator or affiliate |
| Instruction source | Domain, account and message time | A bKash-approved channel |
| Transaction | TrxID, amount, time and status | The underlying activity is lawful |
Open bKash through the access method you already trust instead of a support link or cloned interface. On the final confirmation screen, compare recipient identifier, display name, transaction type, amount, charge and reference. A personal account, agent or unrelated merchant does not prove the promised casino-balance relationship. Cancel on a mismatch; that is more reversible than trying to recover a completed transfer.
Never provide an OTP, PIN, screen-sharing session, remote-control app or verification APK to a recipient. CIRT's 17 May advisory says familiar local payment names, including bKash, were used as social-engineering lures. That is not a finding against bKash; it is a warning that brand familiarity should not replace recipient verification. Deal with device and credential exposure before a casino dispute after an unknown installation.
Keep originals; redact only the complaint copy.
Bangladesh Bank's current CIPC procedure directs bank, finance-company and MFS customers to the provider first, then the provider complaint cell, and only then to CIPC when unresolved or unsatisfactory. CIPC sits under the Technology Risk and Digital Banking Supervision Department and lists hotline 16236, email, online and written channels. The final step may require the provider's response and supporting documents.
CIPC is not presented as a forum for casino withdrawals, wager balances, bonus terms or offshore contract disputes. Define the narrow bKash issue: account service, unauthorised access, transaction execution or provider complaint handling. The official page excludes matters outside Bangladesh Bank's purview, anonymous complaints, unauthorised third-party submissions and sub judice cases. Do not relabel a casino loss as an MFS complaint.
| Event | First action | Scope |
|---|---|---|
| Wrong recipient or unknown transaction | Contact bKash through a known channel | Transaction and account service |
| Provider answer remains unresolved | Complaint cell, then CIPC | MFS-provider handling |
| Phishing link or malicious APK | Secure the device; consider CIRT | Cyber incident triage |
| Suspected fraud, threat or identity misuse | Online GD or police by facts | Police classification |
| Casino balance remains pending | Preserve evidence | No CIPC recovery guarantee |
When bKash requests a transaction or security review, verify that the request came through a genuine provider channel. A casino agent claiming to unblock bKash in exchange for an NID image, selfie, PIN or OTP is not automatically part of a provider process. Record the requesting entity, data purpose, secure channel and acknowledgement separately.
After an account restriction, check essential funds, linked accounts, active sessions and recent activity. Preserve the provider's exact wording and do not invent a compliance reason publicly. A blocked casino account belongs to a second chronology; MFS status does not establish who controls the casino.
When a confirmation displays a merchant code or business name, ask the provider about the transaction category and complaint path. Do not present that screenshot as a Bangladesh Bank approval certificate. The merchant account holder, payment aggregator and casino operator may be three different entities. Use unknown until a relationship record exists.
Preserve the exact app display but keep personal mobile numbers out of an indexable page. Archive a provider correction with its date. Treat every changed recipient as a separate transfer; one successful casino credit does not authorise the next recipient.

BD-S15Bangladesh Bank
Lists MFS services including bKash, Nagad and Rocket and identifies their business entities.
Open official sourceBD-S05Bangladesh Bank
Sets out provider-first escalation and then CIPC escalation for bank, finance-company and MFS complaints.
Open official sourceBD-S09BGD e-GOV CIRT
Records a dated campaign involving fake software, malware and local-payment lures; it does not justify claims about unrelated domains.
Open official sourceRegulator capture dated 13 August 2026; it does not prove any casino-payment relationship. Each source supports only the narrow proposition stated beside it. Recheck the live authority page before acting. Search snippets, advertising, forums and operator statements are not proof by themselves.
No. MFS identity does not establish casino-merchant approval or gambling legality.
CIPC has a narrow remit over provider service and complaint handling; it is not a casino-balance recovery guarantee.
The genuine app's TrxID, amount, time, recipient, status and provider complaint reference.
No. Do not disclose credentials; use a known provider channel to secure the account.