Bank of Bhutan system failure and RMA penalty (2026)

The 2026 Bank of Bhutan system-failure incident was a banking and regulatory episode in which an IT system migration at the Bank of Bhutan Limited caused approximately Nu 1.46 billion to be wrongly credited to a single customer's account between late February and mid-March 2026. By the time the bank detected the error on 16 March 2026, around Nu 191 million had already been transferred or spent. The Royal Monetary Authority (RMA) announced a Nu 228.46 million penalty against the bank on 17 April 2026, alongside a series of supervisory directives.^[1]^[2]

The bank filed a complaint with the Royal Bhutan Police (RBP) on 18 March 2026, leading to the detention of the businessman who held the affected account. Police are examining the case under sections 240 and 253 of the Penal Code of Bhutan, which deal with larceny and larceny of property delivered by mistake.^[4]^[5] No criminal charges have been filed in court at the time of the RMA's announcement, and the businessman has not been publicly named in the press accounts reviewed for this article.

The incident has raised questions about IT controls, anti-money-laundering (AML) compliance, and board governance at state-owned commercial banks. The RMA action is a regulatory penalty, not a judicial ruling, and the parallel criminal matter remains at the police investigation stage.

Background

The Bank of Bhutan is the country's oldest and largest commercial bank. It is majority-owned by Druk Holding and Investments (DHI), the commercial holding arm of the government, with a minority stake held by the Government of India through the State Bank of India. As a domestic systemically important bank, it is supervised by the RMA under Bhutan's banking and AML legislation.^[2]

According to Kuensel and BBS, the bank had been migrating to a new core banking system in the period preceding the incident. The fault that caused the wrongful credit originated during this migration. Independent technical audits of the migration have not been published.^[1]^[3]

The system glitch and discovery

According to The Bhutanese, the wrongful credit appeared on the customer's account around 28 February to 1 March 2026 in connection with the system migration. The total amount mistakenly credited was approximately Nu 1.46 billion.^[4]

Between the appearance of the funds and their detection on 16 March 2026, the account holder is reported to have moved roughly Nu 191 million out of the account. The Bhutanese reported that the funds were used to repay an existing loan with the Royal Insurance Corporation of Bhutan Limited (RICBL) and a loan with Druk PNB Bank, to purchase land, and to make payments to roughly 45 suppliers and counterparties.^[4]^[5] Press accounts have not provided a complete public itemisation of these transactions, and the figures cited above are as reported by The Bhutanese.

The bank says it identified the discrepancy through internal reconciliation on 16 March 2026, two days before filing a police complaint.^[1]^[4] The exact mechanism by which the error was detected, and why it took roughly two weeks to surface, has not been disclosed in the available press coverage.

Police investigation

The Bhutanese reported that the Bank of Bhutan filed a formal complaint with the Royal Bhutan Police on 18 March 2026, and that the businessman whose account had received the funds was taken into custody on 19 March 2026.^[5] The RBP has been examining the matter under section 240 of the Penal Code (larceny) and section 253 (larceny of property delivered by mistake), according to the same report.^[5]

Two third-party recipients have been named in The Bhutanese's coverage as having received funds traced back to the wrongly credited account: Kinley Penjor and Ugyen Pelzang. According to the paper, the bank reversed payments to these and other recipients without their prior knowledge or consent. The recipients dispute the reversal, arguing that they received the payments in good faith for legitimate business or personal transactions.^[5] The legality of unilateral reversals by the bank, and whether they fall within its terms and conditions or require a court order, has not been settled in any public ruling reviewed for this article.

Neither the businessman who held the original account nor the third-party recipients have been convicted of any offence. The matter is at the investigation stage. The Bhutanese is the principal source for the criminal-investigation timeline; Kuensel and BBS have provided more limited reporting on this aspect.

RMA enforcement action

On 17 April 2026, the Royal Monetary Authority announced supervisory action against the Bank of Bhutan. BBS and Kuensel reported the headline measures the following day.^[1]^[2]

The principal elements of the RMA's action, as reported, were:

A monetary penalty of Nu 228.46 million for failures relating to AML compliance and regulatory reporting obligations.^[1]^[2]
A bar on the bank declaring or distributing dividends for the 2025 financial year.^[1]
A reservation requirement of approximately Nu 149 million against the unrecovered portion of the wrongly credited funds.^[1]
A freeze on further changes to the bank's IT and core banking systems pending an independent review.^[2]
A directive to Druk Holding and Investments, as principal shareholder, to assess the competency and composition of the bank's board.^[1]^[2]
A mandate that the bank initiate disciplinary proceedings against staff found responsible for control failures.^[1]
A direction that the bank restore affected customer accounts and compensate customers for losses arising from account freezes and reversals related to the incident.^[2]

The RMA framed the action as a supervisory and administrative penalty under its regulatory powers. It is distinct from any criminal liability that may eventually be determined by a court in connection with the underlying transactions.^[1]

Reactions

The Bank of Bhutan, in statements quoted by BBS, acknowledged the supervisory action and said it would comply with the RMA's directives, restore affected customer accounts, and cooperate with the police investigation.^[3] The bank has not, in the press coverage reviewed, published a detailed technical post-mortem of the migration failure.

Druk Holding and Investments has not, as of mid-April 2026, issued a substantive public statement on the board-competency review beyond confirming receipt of the RMA directive, according to BBS.^[3]

Lawyers and family members of the detained businessman, quoted in The Bhutanese, have argued that the funds were credited to his account by the bank's own systems and that subsequent transactions did not involve concealment or fraudulent representation. They have questioned whether the conduct meets the elements of larceny under the Penal Code.^[5]

Kinley Penjor and Ugyen Pelzang, the two named third-party recipients, have publicly contested the reversal of payments to them, according to The Bhutanese. They maintain that they received the funds in the ordinary course of business and that the bank's reversal was carried out without notice or due process.^[5]

The Ministry of Finance has not issued a public statement specific to the incident in the press accounts reviewed.

Implications

Commentators quoted in the Bhutanese press have raised several concerns in the wake of the incident:

The Bhutanese noted that the incident has reopened questions about governance at state-owned banks and the independence of boards composed largely of nominees from a single shareholder.^[6]
Both Kuensel and The Bhutanese highlighted weaknesses in AML monitoring and transaction reporting, given that movements of the order of Nu 191 million from a single account did not trigger earlier intervention.^[1]^[6]
BBS reported the RMA's view that the episode pointed to deficiencies in IT change management and operational risk controls during core-banking migrations.^[2]
Customer-protection lawyers cited by The Bhutanese have argued that retail customers affected by account freezes and unilateral reversals need clearer recourse mechanisms.^[5]
Several commentators have observed the boundary between regulatory action and criminal prosecution: the RMA penalty addresses the bank's supervisory failures, while the question of individual criminal liability remains for the police and, eventually, the courts to determine.^[6]

As of late April 2026, no court judgement has been issued in connection with the incident, and the criminal investigation is ongoing.