NEPSE Shutdown Exposed a Bigger Problem

NEPSE closed for a day on 21 September after ransomware locked 72 of 90 brokers out of their terminals. The exchange is 89% owned by the state and its institutions has no chief executive and its restructuring plan has been at the Ministry of Finance since December 2023.

On Sunday 20 September a ransomware attack on a private data centre locked 72 of Nepal's 90 brokerage firms out of their own trading terminals. On Monday the Nepal Stock Exchange closed the market for a full day. On Tuesday it reopened.

The exchange's own trading engine was never breached. What failed was everything around it and what the week exposed is that nobody is in a position to fix that.

NEPSE is 89.39% owned by the state and its institutions. Its chief executive post is vacant. The plan to restructure it has been at the Ministry of Finance since December 2023 and the report commissioned to evaluate that plan was finished in January 2026 and has not been acted on.

This is an argument about why. It is not that anybody has done anything wrong. It is that an exchange owned by the government, the central bank, the state pension fund and two of the banks it supervises has no mechanism by which anything gets fixed.

Who owns it

The Government of Nepal holds 58.66%. Rastriya Banijya Bank holds 11.23% and is itself 99.97% government owned so the government controls 69.89% directly and through it. The Employees Provident Fund holds 10%. Nepal Rastra Bank holds 9.50%.

That is 89.39% in state hands or the hands of institutions the state controls.

The remaining meaningful stakes belong to Laxmi Sunrise Bank and Prabhu Bank, 5% each. Both are listed companies whose shares trade on the exchange they part-own, and both are supervised by Nepal Rastra Bank which owns another 9.50%.

Put that in proportion. The Employees Provident Fund is the custodian of the retirement savings of Nepal's formal workforce. It owns a tenth of the exchange and is among the largest buyers of the securities that exchange prices. Nobody has suggested it uses that position improperly and the point is not that it does. The point is that no structure prevents it and no disclosure would reveal it.

The same applies to Nepal Rastra Bank which owns 9.50% of the venue on which the banks it supervises are valued and which has reportedly sought to divest that holding for some time without the government permitting it. The central bank appears to understand the conflict better than its majority shareholder does.

The web

Draw the relationships and the problem is not any single conflict but that there is no vertex without one.

The central bank owns 9.50% of the exchange and regulates three of its other shareholders. The government owns the exchange, owns the bank that owns 11.23% of it and appoints the board of the regulator that supervises it. The provident fund owns 10% of the exchange and is simultaneously one of the largest institutional investors in the securities traded on it. Two commercial banks own 10% of the venue where their own shares are priced.

In most markets an exchange is separated from these relationships deliberately, because the exchange's three jobs sit awkwardly together: operating a trading venue, supervising the companies listed on it and earning a return for its owners. Nepal has not separated them. It has concentrated all three in a single body whose owners are the state, the regulator of half its listed universe and two of its listed companies.

The counter-argument to all of this is that ownership and operation are separate and that NEPSE's shareholders do not direct its day-to-day rules. Formally that is true.

But the board that approves those rules is appointed by those shareholders, the government's own committee has recommended dissolving it and the chief executive post that would run the operation independently of the board is vacant. The separation between ownership and operation is a matter of formal structure rather than of anybody actually standing between the two.

What that body actually decides

The conflicts would matter less if the exchange's decisions were technical. They are not.

The opening price band for a new listing runs from Rs 100 to Rs 300. The post-listing screen published here on 18 September found eleven hydropower companies sharing a fifty-two week low of exactly Rs 300 which is the band's ceiling recorded as a floor.

The circuit limit is 15% a day raised from 10% on 20 April 2026. The Take of 16 September showed that it traps a margin lender who cannot sell into a fall and the Take of 23 September showed it traps a short seller who cannot buy into a rise.

Free float is not published for any company. The float index introduced in 2008 to exclude untradeable shares, uses ordinary shares as a proxy because no mechanism for measuring float has ever been built. Sunday's piece set that out.

Market depth visible to retail investors is limited so an investor cannot judge whether a price move reflects genuine demand or a handful of coordinated orders.

And in 2014 the exchange removed broker identifying numbers from the public floorsheet, citing privacy. Investors read it as covering for possible cartel behaviour. The regulator intervened and the numbers were restored within weeks.

None of these is a law passed by parliament. Each is an operating decision of a company the government owns and each has been examined in these pages within the last four weeks.

The week it closed

Data Hub Pvt Ltd detected ransomware at around 5:30 on the morning of Sunday 20 September. It hosts the trading management system for 72 of Nepal's roughly 90 active brokers. It notified YCO Pvt Ltd which manages the shared trading software used across the industry and described the incident in writing as ransomware rather than an ordinary fault.

By Monday the intrusion had spread across linked systems including the depository and clearing side, payment gateways and other connected services. The affected infrastructure was isolated.

NEPSE's own online trading system was not breached. But it shares a network with the data centre, and the exchange judged that continuing to trade while the breach was live elsewhere on that network carried cybersecurity, operational and data theft risk. It also cited fairness: letting the 18 unaffected brokers trade while 72 sat locked out would have been an uneven playing field.

So the whole market closed for Monday 21 September. It reopened at 11 a.m. on Tuesday with the index up 7.06 points to 2,654.28 and turnover of Rs 7.053 billion higher than the Rs 6.745 billion of the previous session.

Data Hub's backups from 90 minutes before detection survived. Whether any ransom was paid has not been publicly confirmed.

The reopening deserves a note because it argues against panic. The index rose. Turnover was higher than the last session before the closure. Of 356 securities traded, 137 gained and 131 fell which is an ordinary day.

Investors did not flee. The market absorbed a full-day closure caused by a criminal attack on its infrastructure and resumed as though nothing had happened.

That is reassuring about confidence and troubling about consequence. An institution that can close the national market for a day and face no measurable market reaction has very little external pressure to prevent a repeat.

Why one vendor

The obvious question is how 80% of a national exchange's brokers came to sit on one company's servers and the answer is reasonable at the level of each individual decision.

A properly redundant data centre is expensive. For a small Nepali brokerage, building one independently does not pencil out. Consolidating with a specialist vendor lets brokers focus on broking. Each firm made a sensible choice.

The aggregate is a single point of failure for a national market and no individual broker had any reason to consider the aggregate. That is exactly the kind of systemic risk an exchange or a regulator exists to identify, because nobody inside the industry is positioned to.

Neither did.

The fairness reasoning behind the full closure is worth examining because it is the one decision in the week that was genuinely NEPSE's to make and it went the right way.

Eighteen brokers were unaffected and could have traded. Letting them do so would have created a market in which a fifth of the industry had access and four fifths did not, with prices set by whoever happened to be on unaffected infrastructure. Any investor using one of the 72 would have been unable to act on news, unable to cut a position and unable to do anything about it.

Closing everyone was the correct call and NEPSE applied the same logic on the way back in, holding the unaffected brokers until all could resume together.

That is a well-run exchange making a defensible decision under pressure. It is worth saying plainly because the argument in this piece is not that the institution is incompetent. It is that a competent institution has been left without the capital, the leadership or the authority to fix what it can see.

This was not the first time

On 23 July the NEPSE website and the shared trading management system showed the index collapsing by more than a thousand points, close to 37%, to 1,717 about fifteen minutes after the market had closed. That was attributed to a technical glitch rather than an attack. A headline crash of that size spreading on social media does damage regardless of cause.

More broadly, disruptions tied to broker infrastructure to Data Hub or to YCO have become a recurring feature rather than isolated events. The pattern described by analysts is that responsibility moves between NEPSE, the brokers, the data centre operator and the software vendor each time something breaks while investors absorb the disruption.

Which is the structural point. When four parties share responsibility and none owns it, the outcome after each incident is an investigation and no change.

The international comparison is worth making because it cuts against the easy conclusion.

The Tokyo Stock Exchange halted trading for an entire day on 1 October 2020 after a hardware failure affecting more than 3,500 listed companies. India's Bombay Stock Exchange halted for three hours in July 2014 on a network outage. The National Stock Exchange of India lost three hours in July 2017 and nearly four in February 2021, the latter serious enough that regulators took enforcement action against three senior exchange executives. The New York Stock Exchange suspended trading in Amazon and Alphabet in April 2018. Deutsche Boerse lost three hours in 2020 to third-party software.

None of those markets is state-owned in the way NEPSE is, and all of them went down. Exchange outages are not a symptom of Nepali governance; they are a feature of complex systems.

What distinguishes Nepal is not the outage. It is the concentration that made it a national event rather than a partial one and the absence of any mechanism that responds to it. The Indian regulator took enforcement action against named executives. Nepal's regulator has asked for a report.

The reform that exists on paper

NEPSE submitted its own restructuring action plan to the Ministry of Finance on 14 December 2023. It proposed issuing shares to the public, bringing in a foreign strategic partner, and involving domestic institutions with good corporate governance. As of mid-2025 it had been pending for eighteen months.

In January 2026 a five-member committee chaired by Prakash Jung Thapa, formed by cabinet decision on the finance minister's proposal and given fifty days, completed a report evaluating and building on those proposals.

Its recommendations are specific. Raise paid-up capital from Rs 1 billion to Rs 3 billion. Float 30% through a public issue. Bring in a foreign strategic partner. On the government's stake, two options: retain 25% and sell the rest or divest fully. Reconstitute the board with at least five members, one Nepal Rastra Bank representative, at least one woman and a majority of independent directors. Dissolve the current board to implement it. Apply the same governance model to CDS and Clearing. Commission a full system audit by an internationally recognised auditor. Give brokers access to application programming interfaces.

The board recommendation and the system audit recommendation are the two that speak directly to what happened this month. Neither has been implemented.

There is a reading of the fifteen-year delay that is less damning than it sounds and deserves airing.

Licensing a second exchange in a market this size may genuinely not be viable. NEPSE runs 305 listed companies and Rs 7 billion of daily turnover. Splitting that across two venues would leave both sub-scale, fragment liquidity that this publication has already shown is thin and duplicate the infrastructure costs neither could afford.

Several small markets have tried competing exchanges and consolidated back to one. The government's caution may reflect that rather than protectiveness of its own asset.

If so, the honest position is to say it, close the licensing question and accept that a monopoly exchange must therefore be held to standards a competitive one would face from rivals. What has happened instead is fifteen years of an open file which delivers neither competition nor the regulation that would substitute for it.

The API recommendation in the January report is worth pulling out because it speaks to this month's failure more directly than anything else in it.

Giving brokers access to application programming interfaces would let a firm connect to the exchange through its own systems rather than through a shared trading management system hosted by a third party. That is the structural alternative to the arrangement that failed on 20 September.

It was recommended in January. It was not implemented. In September, 72 brokers went dark because they had no other way in.

That is the clearest available illustration of the cost of a stalled file: a specific, technical, already-endorsed recommendation that would have reduced the blast radius of the exact incident that then occurred.

The case for leaving it alone

The argument against restructuring is stronger than the reform lobby allows and it has three parts worth stating properly.

State ownership has delivered continuity. NEPSE has operated since 1994 through a civil war, a royal massacre, a constitutional transition, an earthquake, a blockade and a government changing roughly every eighteen months. A privately owned exchange dependent on commercial revenue might not have survived several of those. Whatever else state ownership has failed to produce, it has produced an exchange that is still there.

A commercial exchange has its own conflict. An exchange owned by profit-seeking shareholders earns from listing fees and trading volume and both incentives cut against strict supervision. Delisting a company reduces revenue. Suspending trading reduces revenue. Several markets that demutualised discovered this and had to move supervision to a separate body at considerable cost which is the outcome the reform would have to build for.

Who would actually buy it. Nepal's institutional investor base is thin. A 30% public issue would be bought by retail applicants, as every issue is and by the same commercial banks the exchange supervises. Selling the government's stake would most likely mean transferring control from a passive state owner to the financial institutions that dominate the listed universe which is not obviously an improvement in independence.

Each of those is true. None of them explains why the CEO post is vacant, why the plan has sat for nearly three years or why 80% of brokers ended up on one vendor without anyone noticing.

There is also a question about what the exchange earns and where it goes which nothing located answers.

NEPSE takes a fee on every transaction. On Rs 7 billion of daily turnover across roughly 240 trading sessions, the gross flow through the venue is in the region of Rs 1.7 trillion a year. Whatever fraction the exchange retains, it is a business with a monopoly, no marketing cost and a captive customer base.

A company in that position is ordinarily highly profitable. Whether NEPSE is, what it earns, what it distributes to its state shareholders and what it retains for investment is not published in any form this piece could find.

That absence is itself part of the argument. An exchange demanding disclosure from 305 listed companies publishes less about its own finances than any of them.

What state ownership actually produced

The defence above describes a well-run state exchange. That is not what the record shows.

The exchange has a paid-up capital of Rs 1 billion and runs a market capitalised at Rs 4,550 billion. It is capitalised at one four-thousand-five-hundred-and-fiftieth of the market it operates. The paid-up value of the listed shares alone, Rs 945.54 billion is 945 times the exchange's own capital.

The restructuring report's proposal to raise capital to Rs 3 billion would leave the ratio at 1,517 to one.

An institution that thin cannot invest in resilient infrastructure, cannot pay for the technical staff a modern exchange requires and cannot absorb the cost of an internationally audited system rebuild. It is not underinvesting through negligence. It has nothing to invest.

And the reason it has nothing is that its owners have never recapitalised it. A commercial owner facing a market this size would have raised capital years ago, because the business case is obvious. A state owner with no return expectation and no competitive pressure has no reason to.

The capital question also explains a pattern that has run through this publication all month without being named.

Every structural gap documented here is a gap that costs money to close. Publishing free float requires a system to collect and maintain it. An eligibility list for short selling requires surveillance. Market depth requires a data feed retail can access. Broker redundancy requires someone to audit and enforce it. Consolidated allotment statistics require a database.

None of these is conceptually difficult and all of them are investments. An exchange capitalised at Rs 1 billion, earning fees on Rs 7 billion of daily turnover with owners who have never asked for a return and never supplied more capital does not make investments.

The governance failure and the disclosure failure are the same failure. The exchange does not publish what it does not collect and it does not collect what it cannot afford to collect.

There is one more consequence of the ownership that shows up in the pricing rules rather than in the governance and it is the least examined of all.

An exchange earning fees on turnover has an interest in turnover. The rules that suppress it, the circuit limits, the opening band, the absence of intraday trading, all reduce the exchange's own revenue. A commercially motivated exchange would have argued against every one of them years ago.

NEPSE has not, and the reform package that would introduce intraday trading came from the government rather than from the venue that would earn from it. An institution indifferent to its own revenue is not obviously safer than one motivated by it; it is simply inert and inertia has produced the rules this publication has spent a month documenting.

The monopoly underneath

All of this rests on one structural fact: NEPSE is the only stock exchange in Nepal.

A former SEBON chairman described the exchange as exercising the full power of a monopolist by disregarding rules set by its own regulator. The panel led by a former NRB deputy governor concluded that market competition is the only reliable catalyst for accelerating reform after finding the pace of reform and restructuring over the past decade and a half extremely slow.

SEBON has been seeking guidance from the Ministry of Finance on licensing new exchange operators for roughly fifteen years. The panel urged the government to grant the regulator greater autonomy in that matter.

So the argument that competition would force modernisation is not new, is not contested by the people who have studied it and has not produced a second exchange in fifteen years. The body that would have to authorise one is the same body that owns the first.

A specific objection deserves answering here because it is the one a defender of the current arrangement would make.

Nothing in the shutdown was NEPSE's fault. The breach was at a private vendor. The exchange's own engine held. It closed the market as a precaution, reopened within a day and the index rose. By any operational measure it handled the incident correctly.

All of that is true and it misses what the week revealed. The question is not whether NEPSE responded well to a crisis. It is why a national exchange had no visibility into the fact that 80% of its members depended on a single private data centre and why, having discovered it, nothing in the structure will compel a fix.

An exchange's job includes knowing where its systemic risks sit. Nobody outside the brokerage industry knew this one existed until a criminal found it.

The comparison with SEBON is instructive, because the two institutions have opposite problems and the same root.

SEBON is the regulator. Its board is appointed by the government. It has spent roughly fifteen years seeking ministerial guidance on licensing a second exchange has been publicly critical of NEPSE's disregard for its rules and intervened in 2014 to force the restoration of broker identifiers on the floorsheet.

So the regulator has repeatedly tried to act and has been constrained by the same ministry that owns the entity it regulates. It intervened successfully on the floorsheet, a small matter and has achieved nothing on the licensing question, a large one.

A regulator whose authority depends on a ministry that is also the majority shareholder of its principal supervised entity is not independent in any meaningful sense, whatever the statute says. That is the second conflict in Figure 2 and it is the one with the longest record of consequences.

The cooling market

The shutdown happened in a market already contracting. Nepal Rastra Bank's report published 18 September puts market capitalisation at Rs 4,550 billion in mid-August against Rs 4,660 billion a year earlier, a fall of 2.4%. The index at 2,643.84 is 5.2% below the 2,788.37 of twelve months ago. Capitalisation as a share of GDP has slipped from 75.1% to 68.9%.

Listed companies rose to 305 from 302 in a month so the market is adding issuers while losing value. Banks and insurers hold 50.9% of that value and hydropower 18.3%.

None of this is caused by the exchange's governance. It matters because an institution that cannot modernise in a growing market has no chance of doing so in a shrinking one and because the window in which reform is politically easy is closing.

One more feature of the ownership deserves stating before the recommendations because it determines whether any of them can happen.

A company 58.66% owned by the government cannot restructure itself. It cannot raise capital, change its board, issue shares to the public or appoint a chief executive without the majority shareholder agreeing and the majority shareholder is a ministry with a file open since December 2023.

So the failure is not NEPSE's in any meaningful sense. The exchange submitted a plan nearly three years ago. A committee the government itself formed endorsed and extended it in January. What has not happened has not happened at the Ministry of Finance.

That matters for where the pressure should go. SEBON can investigate the data centre and should. It cannot appoint NEPSE a chief executive or recapitalise it.

Reform also has a window that is narrowing for a reason nobody controls.

A 30% public issue of NEPSE would be bought instantly. Monday's Signal established that two to three million Nepalis apply to every issue and that the primary market has produced no losing IPO in either sample examined. An exchange issue would be the most heavily subscribed in the country's history.

That demand exists while the market is buoyant and the folklore holds. In a market contracting 2.4% a year with capitalisation to GDP falling from 75.1% to 68.9%, it may not persist indefinitely. The easiest moment to raise Rs 2 billion of new capital for the exchange is while everybody still wants to buy anything issued at par.

What should happen

The report that would answer most of this was finished in January. Publishing it, in full is the first thing.

Of its recommendations, three are worth separating from the rest because they do not depend on resolving the ownership question at all.

The board. A majority of independent directors and a reconstituted board can be done under the current ownership. It requires the shareholders to appoint different people which requires no legislation and no divestment.

The system audit. An internationally recognised auditor reviewing the trading platform is a procurement decision. After a ransomware incident that closed the market it is difficult to argue against and it does not wait on anything else.

Mandated redundancy for broker infrastructure. Requiring brokers or their vendors to hold backup systems hosted separately from their primary setup is a rule SEBON can make. It addresses the actual cause of this month's closure, which was not NEPSE's systems at all.

The capital raise, the public issue and the government's stake are harder and they are where the genuine disagreement lies. They should be argued about. They should not be the reason the three above wait another three years.

One clarification on what this argument is not claiming because the distinction matters.

It is not claiming that state ownership causes corruption, that the shareholders interfere in pricing or that any conflict described here has been exercised. No evidence located suggests any of that, and the exchange's handling of the closure was correct.

It is claiming something narrower and harder to fix: that a structure in which every owner is also a regulated party, a listed company or the appointing authority for the regulator has no independent voice in it. Nobody at the table is positioned to say that the exchange needs recapitalising, that the board should change or that broker infrastructure is a systemic risk because every person at the table represents an institution with a different primary interest.

Conflicts of that kind do not produce scandals. They produce nothing, for years which is precisely what the record shows.

It is worth naming what a fixed version would look like because the argument is easier to dismiss without one.

An exchange with a chief executive, a board with a majority of independent directors, Rs 3 billion of capital, a public float and a published annual report showing what it earns and what it invests. A regulator able to license a competitor without ministerial permission. Brokers connecting through their own systems via published interfaces with mandated backup hosted separately. Free float published monthly for every listed company.

Not one of those is novel. Every item is either in the January committee report or in ordinary practice across the region. The package would cost a fraction of a single year's turnover through the venue.

What to watch

The 28 September report. NEPSE is required to submit its account of the suspension to SEBON. Whether it addresses vendor concentration or confines itself to the technical sequence will indicate how the institution reads its own responsibility.

SEBON's inspection findings. A five-member team led by a deputy executive director is examining the technical and procedural causes. If the recommendations include mandated redundancy for broker infrastructure, the regulator has understood the problem. If they concern Data Hub alone, it has not.

The chief executive appointment. The post is vacant. Filling it is the single cheapest signal available that the ownership intends the exchange to be run rather than held.

Whether the January report is published. It has existed for nine months. A government that will not publish its own commissioned review of a company it owns 58.66% of is making a statement about how the restructuring will proceed.

The December benchmark index. The reform plan promises a new index by mid-December and Sunday's piece set out that a genuine free-float index requires a free-float figure NEPSE has never produced. That deadline is a test of whether the exchange can deliver anything the plan asks of it.

The conclusion

An exchange is not a normal company. It is the place where a country decides what things are worth, and every rule it sets propagates into every valuation, every collateral decision and every portfolio statement in the market.

Nepal has put that function inside a Rs 1 billion company owned 89% by the state, part-owned by two of the banks it supervises and by the regulator of half its listed universe with no chief executive, a board the government's own committee has recommended dissolving and a restructuring plan that has been waiting at a ministry since December 2023.

Then a private vendor nobody was supervising got hit with ransomware and the market closed for a day.

The temptation is to read that as a cybersecurity failure and commission a cybersecurity response. SEBON has deployed a five-member inspection team and required NEPSE to report by 28 September which is the correct immediate step and will produce a document about data centres.

The failure is older and duller than that. It is that nobody with the authority to modernise the exchange has any reason to and the people who have documented this repeatedly, two government panels and a regulator have been saying so for fifteen years into a ministry that does not answer.

The ransomware will be fixed. The reason it took a week and a regulator's intervention to produce a report will not be and it is the same reason eleven companies share a fifty-two week low of exactly Rs 300, a bank can lend 80% against a price set by twenty-five trades and nobody in Nepal can find out how many shares of any company are actually available to buy.

A closing observation about timing. This piece runs two days after NEPSE's report to SEBON was due and nine months after the restructuring committee finished its work.

The report will describe a data centre. The committee described an institution. Both documents will sit with the same ministry, and on the record of the last two years and nine months, neither will produce a decision before the next incident.

That prediction is not cynicism. It is the base rate.