Digital Payments in Nepal: What SMEs Should Do

If you run a business in Bharatpur, Butwal or Baneshwor, you have already felt this: customers stopped asking whether you take QR. They just scan. The shift is not coming, it happened, and the official numbers are now blunt enough that you can plan against them instead of guessing.

This piece pulls the current figures from Nepal Rastra Bank and the Nepal Telecommunications Authority, then works backwards to what an SME should actually change in the next quarter. No forecasts, no vision statements. Just what the data supports and what it costs you to ignore.

What the Nepal Rastra Bank payment data actually says

NRB's Payment Systems Department publishes monthly payment systems indicators. The latest, for Asar 2083 (mid-June to mid-July 2026), covers a single month. Read the QR line twice.

Instrument (one month)	Transactions	Value (NPR million)	Value change vs. same month 2025
QR-based payments	69,589,977	189,906	+67.8%
Mobile banking	82,605,104	696,938	+31.4%
Wallets	57,040,563	58,045	+19.8%
ATM cash withdrawal	9,986,538	78,437	−15.8%
Point of sale (POS) terminals	769,150	4,183	−36.7%
E-commerce (online card payments)	323,833	1,951	+33.1%

Three things fall out of that table, and each one has a decision attached.

QR is the retail rail, and cards are not

In that one month, QR moved NPR 189.9 billion. Online card payments moved NPR 1.95 billion. That is a ratio of roughly 97 to 1. Over the full fiscal year 2024/25, NRB's Payment Systems Oversight Report puts QR volume at NPR 958.4 billion against NPR 13.5 billion of online card spend, with QR transaction counts up 92.5 percent year on year.

Nepal also has only 330,518 credit cards in issue against 13.7 million debit cards. If your online checkout is built card-first, you have designed for the smallest rail in the country. Wallet and bank-transfer checkout, plus a QR fallback on the order confirmation page, will collect more money than a card gateway will.

Cash handling is shrinking, and so is POS hardware

ATM withdrawals fell 9.9 percent by count and 15.8 percent by value against the same month a year earlier. POS terminal value fell 36.7 percent. The installed base of ATMs dropped from 5,263 to 5,115 over the year.

The practical read: if a vendor is quoting you for a card-swipe terminal and a monthly rental, ask what it does that a static QR standee and your bank's merchant app do not. For most retail and food businesses in Nepal, the answer is very little. Spend the difference on reconciliation instead.

Reconciliation is now your real problem

Volume moved to instruments that settle into a bank account with a reference string, not into a till. NRB counted roughly 2.9 million QR-accepting merchants in FY 2024/25. Most of them are matching settlement reports to sales by hand, at night, badly.

This is where a small amount of software pays for itself. A daily job that pulls your bank statement, matches settlement batches to invoice numbers and flags the unmatched rows is a two-week reconciliation build, not a platform migration. Do that before you consider anything larger.

Connectivity: mobile-first is the market, not a preference

NTA's MIS report for Shrawan 2083, using data to end-July 2026, records 31,309,001 broadband subscriptions. The split is the part that matters:

• Mobile broadband: 27,728,170 subscriptions, 88.56 percent of the total, with 95.07 percent population penetration.
• Fixed wired broadband: 3,550,689 subscriptions, 11.34 percent of the total. NTA converts these to 53.20 percent population penetration using the census household size of 4.37, so read that figure as households reached, not individual lines.
• Fixed wireless broadband: 30,142 subscriptions, effectively a rounding error.

Inside mobile broadband, 26,982,960 subscriptions are on 4G and 745,210 remain on 3G. NTA's table lists no commercial 5G line. Nepal Telecom and Ncell split the mobile broadband market 55.31 to 44.69 percent. On fixed lines, WorldLink holds 30.80 percent with 1,102,984 connections, ahead of Nepal Telecom at 11.27 percent and Vianet at 10.60 percent.

Two engineering consequences, both cheap to act on:

1. Budget your page weight against 4G, not fibre. If your storefront or booking page is above roughly 1 MB on first load, you are losing customers who never see an error, they just leave. Test on a mid-range Android phone on a mobile connection, not on office wifi.
2. Assume the connection drops. A form that loses its contents on a failed submit turns one flaky moment on a mobile network into a lost order, and the customer rarely tries twice. Save drafts locally, retry idempotently, and never make a customer retype an address.

Even on NTA's own generous household conversion, fixed broadband reaches only about 53 percent of the population. Anything you build that assumes a stable desktop connection is built for a minority.

Government digitisation is now a compliance deadline, not a convenience

The part of digitisation that will actually reach into your operations is regulatory. Three items are already live.

The Electronic Commerce Act, 2081

Nepal's Electronic Commerce Act, 2081 received assent on 16 March 2025 and, in the Act's own words, comes into force on the thirty-first day of assent. If you sell goods or services through a website, an app or a social media page, it applies to you. The obligations are specific:

• Listing. You must apply to be listed on the Department of Commerce, Supplies and Consumer Protection's electronic portal, supplying your PAN or VAT number, business description, contact details and branch locations. The Department issues a listing number within seven days. Businesses already trading when the Act commenced had three months to apply. Branch changes must be updated within seven days.
• Disclosure. Section 6 requires the final selling price including tax, any separate delivery charge, the delivery date or window, accepted payment methods, warranty terms, and the country of origin for imported goods, all displayed on the platform.
• Returns. If goods do not match the description you published, the buyer may return them unused and undamaged, and you must accept them unconditionally. If the buyer declines an exchange, you refund the amount paid including tax.
• Grievances. You must run an online complaint mechanism, register each complaint, decide it within fifteen days, and give the buyer written reasons if you cannot resolve it.
• Penalties. Fines run from NPR 20,000 to NPR 100,000 for the lesser offences under section 22, and NPR 50,000 to NPR 500,000, imprisonment of six months to three years, or both, for offences under section 23.

Most of this is a content and workflow problem, not a coding problem. A product page template with mandatory fields for tax-inclusive price, delivery window and origin, plus a ticketed inbox with a fifteen-day timer, covers the bulk of it.

Tax filing and electronic invoicing

The Inland Revenue Department runs filing, PAN registration and tax clearance through its taxpayer portal. Electronic billing is governed by IRD's own Electronic Billing Procedure, 2074, now in its fourth amendment, which IRD publishes on its electronic invoice page.

The practical instruction is narrow and worth following exactly: before you choose accounting or billing software this year, open that IRD page, read the current procedure and its amendments, and confirm the product you are about to buy is approved under that procedure. Do that first and compare features second. Switching billing software after you have a year of invoices in it is far more expensive than making a narrower choice now. If your own turnover is anywhere near a published threshold, get your accountant to confirm your position in writing rather than inferring it from a vendor's marketing page.

Who the digital service tax actually hits

This one is widely misread, including by people selling you software. Nepal levies a 2 percent digital service tax on non-resident providers supplying digital services into Nepal above an annual transaction threshold of NPR 2 million, alongside 13 percent VAT, and IRD has amended the procedures governing both. The rates are real. The scope is the part that gets dropped.

The regime turns on the word "consumer", and the definition carries an explicit carve-out: a consumer is a person who consumes services and normally resides in Nepal, but a person who purchases goods or services by separate arrangement for business purposes, or to use in business, is not a consumer. That is a business-to-consumer regime. A registered Nepali company buying a SaaS subscription to run its own operations sits outside it, and the obligations described in the amended procedures, including the requirement for the non-resident provider to obtain a PAN and file monthly VAT and annual income tax returns online, are triggered by sales to consumers above the threshold, not by your subscription.

Two honest consequences follow. First, do not budget an extra 15 percent onto your business SaaS bill on the strength of this regime, because that is not what it says. Second, the procedures are silent on how a Nepali business purchaser should treat imported digital services, and silence is not the same as exemption, so ask your accountant what your VAT position on imported services actually is rather than assuming either answer. Audit your subscriptions once a quarter anyway. Unused seats are a cost problem whatever the tax treatment.

Separately, paying foreign providers at all is a real operational constraint for a small business in Nepal. Before you architect anything that needs a growing monthly bill in US dollars, ask your own bank, in writing, what it will release for software and cloud payments and what documentation it wants. Get that answer before the architecture decision, not after it.

Cloud: pick for the constraints you actually have

The cloud question for a Nepali SME is rarely about capability. It is about payment mechanics, latency and who you are handing your customer data to.

Latency to Singapore or Mumbai regions is workable for ordinary web workloads. Local hosting is faster on the last hop and payable in NPR, which removes the foreign exchange problem entirely, but operational maturity varies sharply between providers. A sensible default for a small business: keep the customer-facing application on a foreign region if your bank will fund it, keep an NPR-payable local backup, and pair managed hosting with tested restores rather than backups nobody has ever read back.

On personal data, the Individual Privacy Act, 2075 is more specific than most summaries suggest, and the specifics matter. Section 12(2) requires consent when personal or family data is collected. Section 12(3) says data collected by a public body or body corporate with consent may be used only for the purpose it was collected for, and the Act defines a body corporate to include a company established under prevailing law, so a registered SME is inside that duty. Section 26(1) prohibits using or handing on that information without the concerned person's consent outside a short list of exceptions.

Note what the Act does not say. The express duty in section 25 to make arrangements against unauthorised access, use, change or disclosure is written for public bodies, not for private companies. Encryption at rest, a written retention period and access limited to staff who need it are therefore good engineering and good defence, not a statutory checklist you can point at. Purpose limitation and consent are the parts that bind you directly.

Choose your payment provider like an auditor would

NRB's on-site inspections in FY 2024/25 found material problems at licensed institutions, including antivirus software left unrenewed, bi-annual system audits not performed, no disaster recovery plan implemented, vulnerability assessment and penetration testing not conducted on wallet systems, wallet sessions that did not expire, and a significant number of customers recorded without verified KYC. In one case a compliance officer held super-admin privileges and moved funds from a settlement account into wallets.

The count of licensed payment service providers fell from 23 in mid-July 2025 to 19 in mid-July 2026, and payment system operators from nine to eight. Consolidation is under way. Before you integrate a provider into your checkout, ask for their most recent system audit date, their VAPT date, and whether NRB approved publication of their last financial statements. A provider that cannot answer those three questions is a provider you may have to migrate away from mid-year.

A 90-day plan for a Nepali SME

1. Days 1–15. Confirm you accept an interoperable QR that any bank or wallet app can scan, and that settlement lands in an account you reconcile daily. Print the QR properly and place it where a customer standing at the counter can reach it.
2. Days 15–30. If you sell online, apply for your Department of Commerce listing number and fix your product pages to carry tax-inclusive price, delivery charge, delivery window, warranty terms and country of origin.
3. Days 30–45. Stand up a single complaints inbox with a fifteen-day clock and a named owner. Write the refund and return policy the Act already requires you to honour.
4. Days 45–60. Build the daily reconciliation job. Bank statement in, invoice numbers matched, unmatched rows to a human. This is the highest-return software an SME can commission in Nepal right now.
5. Days 60–75. Test your site on a 4G connection on a mid-range Android handset. Cut whatever pushes first load past 1 MB. Fix every form that loses data on submit failure.
6. Days 75–90. Audit subscriptions, confirm with your bank what it will fund in foreign currency, check your billing software against IRD's approved list, and run one restore from backup end to end.

If you cannot tell which of those six blocks is your binding constraint, that is the question a short paid diagnostic should answer before you commission any build at all.

What to skip

• A native mobile app, until your mobile web traffic is large enough that install friction is the binding constraint. It rarely is for an SME under a few thousand monthly customers.
• A card-present POS terminal, unless you serve international cardholders in volume. The POS numbers are moving the wrong way.
• A custom ERP, before your reconciliation and invoicing are clean. Automating a broken process just breaks it faster.
• Anything priced in US dollars per seat that you have not first checked your bank will actually fund month after month.

Frequently asked questions

Do I have to register my business under the Electronic Commerce Act if I only sell through Facebook or Instagram?

The Act covers commercial trading of goods and services through electronic platforms, which includes selling through social media pages. You need to apply for a listing number on the Department of Commerce, Supplies and Consumer Protection's electronic portal and supply your PAN or VAT registration number along with your business and contact details. Registration is a prerequisite, not an optional formality, and fines under the Act start at NPR 20,000.

Should my online store accept cards, wallets or both?

Both, with wallets and bank transfer first. NRB's monthly indicators show online card payments at NPR 1.95 billion against NPR 189.9 billion of QR volume in the same month, and Nepal has only 330,518 credit cards in issue. Card acceptance is worth having for international buyers and corporate customers, but building your checkout around it means optimising for the smallest rail.

Does the 2 percent digital service tax make my foreign SaaS subscriptions more expensive?

Not under that regime. The 2 percent DST and the 13 percent VAT on non-resident digital services apply to supplies to consumers in Nepal, and the definition of consumer expressly excludes a person buying by separate arrangement for business purposes or to use in business. A company subscribing to software to run its own operations is outside that scope. The amended procedures do not spell out how a business purchaser should treat imported digital services, so confirm your VAT position with your accountant instead of assuming either outcome.

Is it safe to host my customer data outside Nepal?

Nothing in the Individual Privacy Act, 2075 requires a Nepali SME to keep personal data on servers inside Nepal. The duties in sections 12 and 26, consent at collection and use limited to the purpose you collected for, attach to you as the body corporate that collected the data, so moving the storage abroad does not move the obligation off you. The real constraints are commercial: you need your bank to fund the subscription in foreign currency, and you need a provider whose restores you have actually tested.

How do I check whether a wallet or payment gateway is properly licensed?

NRB's Payment Systems Department publishes the list of licensed payment service providers and payment system operators, along with its annual Payment Systems Oversight Report naming the institutions inspected each year. Ask a prospective provider for their most recent system audit and VAPT dates, and whether NRB approved publication of their last financial statements. NRB also operates a public complaints channel for payment disputes, which is worth knowing about before you need it.