The Electronic Transactions Act, 2063 (2008) — commonly referred to as ETA 2063 — is Nepal's primary cyber law governing electronic transactions, digital signatures, electronic records, and cyber offences. Enacted on 24 Bhadra 2063 (September 2, 2006) by the House of Representatives, the Act provides the legal foundation for Nepal's digital economy by establishing the validity of electronic records, regulating certifying authorities, defining cyber crimes, and creating a specialized judicial structure for IT disputes. The Act is divided into 12 chapters and 80 sections, covering everything from digital authentication to penalties for hacking and data theft.
The ETA 2063 was enacted to address four key objectives: providing legal recognition to electronic records and digital signatures; ensuring the security, integrity, and reliability of electronic communications; deterring unauthorized access and illegal alteration of electronic data; and establishing a regulatory framework for digital transactions including e-governance and e-commerce. The Act aligns with international standards, particularly the UNCITRAL Model Law on Electronic Commerce, facilitating Nepal's participation in cross-border digital trade.
Under the Act, information that is generated, sent, received, or stored electronically has the same legal validity as paper-based records. Electronic records are admissible as evidence in court proceedings. This fundamental provision enables electronic contracts, digital receipts, online communications, and electronic government documents to be legally enforceable — forming the backbone of Nepal's e-commerce and e-governance framework.
A digital signature is an electronic signature that uniquely identifies the signatory and verifies the authenticity and integrity of a digital record. Under the Act, digital signatures are created using asymmetric cryptographic systems (e.g., RSA) and hash functions. A subscriber can authenticate any electronic record using their personal digital signature. Any person can verify the record using the subscriber's public key. Digital signatures certified by a licensed Certifying Authority are legally binding — equivalent to handwritten signatures on paper documents.
The Act establishes the office of the Controller — appointed by the Government of Nepal — who oversees all Certifying Authorities, manages the public key infrastructure (PKI), and sets cryptographic standards. Certifying Authorities (CAs) are licensed entities responsible for issuing, verifying, suspending, and revoking digital signature certificates. CAs must renew their licenses annually and comply with Controller directives. The licensing framework ensures trust and security in Nepal's digital authentication system.
| Role | Function |
|---|---|
| Controller | Oversees CAs, issues/revokes licenses, manages PKI, sets standards, conducts audits |
| Certifying Authority (CA) | Issues digital signature certificates, verifies identities, suspends compromised certificates |
| Subscriber | Holds digital signature, authenticates electronic records, maintains key security |
To obtain a digital signature certificate, an applicant submits an application with required identification documents to a licensed Certifying Authority. The CA verifies the applicant's identity and issues the certificate, typically within 7 days. The certificate links the subscriber's public key to their verified identity. Certificates can be suspended if compromised or if the Controller directs suspension for national security reasons. Revocation occurs upon insolvency of the subscriber entity, proof that issuance requirements were not met, or if material facts in the certificate are proven false.
The Act defines a comprehensive range of cyber offences with corresponding penalties:
| Offence | Fine (NPR) | Imprisonment |
|---|---|---|
| Unauthorized access to computer system (hacking) | Up to 2,00,000 | Up to 3 years |
| Damage to computer system or data | Up to 2,00,000 | Up to 3 years |
| Publishing obscene or illegal content | Up to 1,00,000 | Up to 5 years |
| Computer fraud / identity theft | Up to 1,00,000 | Up to 2 years |
| Spreading viruses or malware | Up to 2,00,000 | Up to 3 years |
| Unauthorized copying of software (piracy) | Up to 1,00,000 | Up to 3 years |
| Fraudulent use of digital signature certificate | Up to 3,00,000 | Up to 3 years |
| General violations (no specific penalty) | Up to 50,000 | Up to 6 months |
For a detailed overview of cybercrime provisions and enforcement, see our guide on cybercrime law in Nepal.
The Act establishes the Information Technology Tribunal (ITT) — a specialized 3-member judicial body consisting of one member each from law, information technology, and commerce. The law member serves as chairperson. The Tribunal adjudicates cyber offences, electronic transaction disputes, and appeals against decisions of the Controller or Certifying Authorities. Members are appointed by the Government for a 5-year term and are eligible for reappointment.
The Information Technology Appellate Tribunal (ITAT) hears appeals against decisions of the IT Tribunal, the Controller, and Certifying Authorities. It also consists of 3 members (law, IT, commerce) with the law member as chairperson. Appeals must be filed within 35 days of the disputed decision. This two-tier structure ensures specialized and timely resolution of cyber disputes.
Network Service Providers (ISPs, hosting companies) are not automatically liable for content generated or hosted by users. Liability attaches only if the provider knowingly hosted illegal material or failed to remove it after proper notification. This safe harbour provision mirrors international standards and encourages the growth of internet services in Nepal without exposing providers to unlimited liability for user actions.
The Act authorizes government agencies to conduct official business electronically — including issuing and accepting electronic forms, applications, certificates, tender notices, vacancy announcements, and public procurement documents. Government documents can be published in electronic form with digital authentication. This forms the legal basis for Nepal's Digital Nepal Framework and ongoing efforts to digitize public services.
The Act does not apply to certain types of transactions that still require paper documentation:
| Excluded Document | Governing Law |
|---|---|
| Negotiable instruments (cheques, promissory notes) | Negotiable Instruments Act, 2034 |
| Power of Attorney documents | Prevailing civil law |
| Sale/transfer of immovable property (land deeds) | Real estate law |
| Wills and testamentary dispositions | Inheritance law |
| Court pleadings and filings | Court procedural rules |
Complaints for offences under the Act must be filed within 35 days from the date the violation was known. Offences are prosecuted by the Government of Nepal as government cases under the Government Cases Act, 1992. Police must seek assistance from the Controller or relevant IT experts during investigations. The Act applies to any person, wherever residing, who commits an offence targeting Nepali systems or users — giving it extraterritorial reach.
The ETA 2063 remains Nepal's foundational cyber law, but gaps have emerged as technology evolves. An IT Bill has been under discussion to address online payment regulation, social media governance, data protection, and hate speech definitions. The bill also proposes integrating blockchain technology for tamper-proof electronic records. Until the new legislation is enacted, businesses must comply with the current Act supplemented by Nepal Rastra Bank directives for digital financial services and the data privacy framework.
The ETA 2063 works alongside several other laws in Nepal's digital and business legal framework. For businesses operating online, the E-Commerce Act provides additional consumer protection provisions. The cybercrime provisions under the Muluki Criminal Code supplement the ETA's offence definitions. Businesses involved in international trade should also consider VAT compliance for electronic commerce transactions and intellectual property protection for digital content.
While Nepal Divorce Services is known as Nepal's first specialized divorce and family law firm, our legal team also advises on matters related to electronic transactions, digital compliance, and cyber disputes. We can assist with understanding your obligations under the ETA, responding to cyber offence allegations, navigating IT Tribunal proceedings, and ensuring your business meets digital compliance requirements.
For legal assistance, contact us at +977 9841114443 or on WhatsApp.
| Topic | Guide |
|---|---|
| Cybercrime law | Cybercrime Law in Nepal |
| E-commerce law | E-Commerce Law in Nepal |
| Data privacy | Data Privacy Law in Nepal |
| VAT compliance | VAT Law in Nepal |
| IP protection | Trademark & IP Law in Nepal |
| Company registration | Company Registration in Nepal |
The Electronic Transactions Act, 2063 (2008) is Nepal's primary cyber law. It provides legal recognition to electronic records and digital signatures, regulates electronic transactions, defines cyber offences and penalties, and establishes the Information Technology Tribunal. The Act came into effect on 24 Bhadra 2063 (September 2, 2006) and applies throughout Nepal.
Yes. Under the ETA 2063, electronic records have the same legal validity as paper-based records, provided they meet authentication standards using digital signatures. Information that is generated, sent, received, or stored electronically is legally admissible as evidence in court proceedings.
A digital signature is an electronic signature that uniquely identifies the signatory and verifies the authenticity and integrity of an electronic record. It is created using an asymmetric cryptographic system (e.g., RSA) and hash functions. Digital signatures issued by a licensed Certifying Authority are legally binding under the Act.
A Certifying Authority (CA) is a licensed entity authorized to issue, verify, suspend, and revoke digital signature certificates. CAs must obtain a license from the Controller by submitting required documents and meeting prescribed standards. Licenses must be renewed annually. Banks, government agencies, and designated private entities can serve as CAs.
The Act defines offences including:
Penalties range from NPR 50,000 to NPR 3,00,000 in fines and 6 months to 3 years imprisonment. For detailed cybercrime provisions, see our guide on cybercrime law in Nepal.
Penalties vary by offence:
The IT Tribunal is a specialized judicial body established under the Act to adjudicate cyber offences and electronic transaction disputes. It consists of 3 members — one each from law, information technology, and commerce — with the law member as chairperson. The IT Appellate Tribunal hears appeals against decisions of the IT Tribunal or the Controller.
Yes. The Act authorizes e-governance — government agencies can issue and accept electronic forms, applications, certificates, and notices. Government documents can be published in electronic form. Digital signatures are valid for official government workflows, supporting Nepal's Digital Nepal Framework for modernizing public services.
The Act does not apply to: negotiable instruments under the Negotiable Instruments Act, 2034; power of attorney documents; contracts for sale or transfer of immovable property (land deeds); wills and testamentary dispositions; and court documents that require physical filing. These must still be executed in paper form.
Apply to a licensed Certifying Authority with required identification documents. The CA verifies your identity and issues the certificate, typically within 7 days. The certificate links your public key to your identity and can be used to authenticate electronic records. Certificates can be suspended or revoked if compromised or misused.
No. Under the Act, Network Service Providers (ISPs) are not automatically liable for content generated or hosted by users — unless it is proven that the provider knowingly hosted or failed to remove illegal material after being notified. This safe harbour provision is similar to international standards.
A complaint regarding any violation or offence under the ETA must be filed within 35 days from the date the violation or offence was known. Offences are prosecuted by the Government of Nepal as government cases under the Government Cases Act, 1992. Police must seek assistance from the Controller or relevant IT experts during investigations.
Yes. The ETA 2063 extends throughout Nepal and applies to any person, wherever residing, who commits an offence under the Act. This means foreign nationals who commit cyber offences targeting Nepali systems or users can be prosecuted under this law.
The Act provides the legal foundation for e-commerce in Nepal by recognizing electronic contracts, digital payments, and online business transactions as legally valid. However, the Act does not contain specific provisions for online payment regulation — this is addressed through Nepal Rastra Bank directives and the cybercrime framework.
Yes. An IT Bill has been under discussion to modernize the Act and address gaps including online payment regulation, social media governance, data protection, and alignment with international cybersecurity standards. However, the bill has been stalled since 2022. Businesses should monitor legislative updates and ensure compliance with the current Act and related Nepal Rastra Bank directives.
At Nepal Divorce Services, Nepal's first specialized divorce law firm, we understand that taking the first step toward divorce can feel overwhelming. Our experienced divorce lawyers are here to guide you through the legal process and help you move forward with confidence and clarity.
Whether you're inside or outside Nepal and need assistance with filing a divorce case, our services are accessible worldwide. Contact us at +977 9841114443, on WhatsApp, or Viber.
