-medium.webp)
Table of Contents0sections
- What Counts as Cyber Crime in Nepal?
- Common Cyber Offences and Penalties Under ETA 2063
- Types of Cyber Crime Most Often Filed at the Cyber Bureau
- How to File a Cyber Crime Complaint in Nepal
- What to Do in the First 24 Hours After a Cyber Attack
- Trial Forum — District Court vs IT Tribunal
- Common Mistakes Victims and Accused Make
- Related Questions About Cyber Crime Laws in Nepal
- Conclusion
Most Nepalis discover cyber crime law the moment something happens to them — a hacked Facebook account, an OTP-fraud bank deduction, a sextortion message, a fake profile defaming them — and they suddenly need to know which Section, which authority, and how fast.
Under the Electronic Transaction Act 2063 (ETA 2063), Sections 45 to 58 set out the cyber offences punishable in Nepal, with the Cyber Bureau of Nepal Police at Bhotahity, Kathmandu as the primary investigating authority — and complaints can be filed online, by email, or in person.
Below is the working framework our criminal-defence and victim-advocacy teams use with clients — the catalogue of cyber offences, the section-by-section penalty map, the Cyber Bureau complaint process, and what to do in the first 24 hours after a cyber attack.
Cyber crime laws in Nepal are governed primarily by the Electronic Transaction Act 2063, supplemented by the Individual Privacy Act 2075 and privacy provisions of the Muluki Criminal Code 2074. The most-cited offence is Section 47 of ETA 2063 — publication of illegal electronic material — punishable with imprisonment up to 5 years, a fine up to NPR 100,000, or both. Other offences include unauthorised access (Section 45, up to 3 years and NPR 200,000), data damage (Section 46), computer fraud (Section 51), and pirating software (Section 49). Complaints are filed at the Nepal Police Cyber Bureau in Bhotahity, Kathmandu — in person, by email at cyberbureau@nepalpolice.gov.np, or through the online portal at cyberbureau.nepalpolice.gov.np.
Alpine Law Associates — trusted by 1,000+ clients across family, corporate, civil, and criminal cases in Nepal.
Speak with our lawyers today →
Our cyber-crime practice runs both sides — defending clients facing Section 47 charges over a viral Facebook post, and representing victims of OTP fraud, account takeover, sextortion, and data breach. The most common friction we see is the first 48 hours — victims either delete the evidence in panic, or wait too long expecting Facebook or NRB to "do something". As a full-service law firm in Nepal, we coordinate the Cyber Bureau complaint, evidence preservation, bank freeze (in fraud cases), and follow-through to the IT Tribunal or District Court depending on offence type.
What Counts as Cyber Crime in Nepal?
"Cyber crime" in Nepal is the umbrella term for any criminal act in which a computer, network, or digital communication is the tool, target, or context of the offence. The Electronic Transaction Act 2063 (ETA 2063), brought into force in 2008, is the principal statute — but several adjacent laws operate in parallel where the conduct also has a non-digital dimension.
For the foundational law-explainer on ETA 2063 itself — its 80+ sections, OCC, IT Tribunal — see our companion guide on the Electronic Transaction Act 2063. This article focuses on the cyber offences specifically and how the criminal-justice system treats them in 2026.
Three statutes most often operate together in a cyber-crime case:
| Statute | Cyber Role |
|---|---|
| Electronic Transaction Act 2063 | Sections 45-58 enumerate cyber offences and prescribe penalties |
| Individual Privacy Act 2075 | Privacy violations through electronic means — image leak, unauthorised disclosure |
| Muluki Criminal Code 2074 | Cyber-adjacent offences — criminal defamation, intimidation, extortion when conducted online |
The classification matters because the prosecution route, the trial forum, and even the limitation period differ depending on which statute the prosecutor leads with. A defamation case under the Criminal Code goes to the District Court; a Section 47 ETA case can also go to the IT Tribunal under Section 60.
Common Cyber Offences and Penalties Under ETA 2063
The most heavily prosecuted sections of ETA 2063 in Nepal cover the cyber acts that show up at the Cyber Bureau every week. The penalty figures below are the statutory maximums — actual sentences depend on the case and the bench.
| Section | Offence | Maximum Penalty |
|---|---|---|
| Section 45 | Unauthorised access to computer / system | Up to NPR 200,000 fine + up to 3 years imprisonment |
| Section 46 | Damage to computer or data | Up to NPR 200,000 fine + up to 3 years imprisonment |
| Section 47 | Publication of illegal electronic material — obscene, hateful, defamatory, false content | Up to NPR 100,000 fine + up to 5 years imprisonment, or both |
| Section 48 | Confidential information disclosure | Up to NPR 10,000 fine + up to 2 years imprisonment |
| Section 49 | Pirating, destruction or alteration of computer source code | Up to NPR 50,000 fine + up to 3 years imprisonment |
| Section 51 | Computer fraud — using computer for fraudulent benefit | Up to NPR 100,000 fine + up to 5 years imprisonment |
| Section 52 | Acts that aid in commission of cyber crime | Same penalty as principal offence |
| Section 53 | Acts done outside Nepal but affecting computers in Nepal | Same penalty as if the act was done in Nepal |
Key takeaway: Section 47 is the most frequently invoked Section in Nepal's cyber-crime prosecutions — covering everything from a defamatory tweet to morphed images. The breadth of "illegal electronic material" is also why Section 47 has been the most controversial provision and the focus of the pending Information Technology and Cyber Security Bill that proposes to replace ETA 2063.
Types of Cyber Crime Most Often Filed at the Cyber Bureau
Among the cases the Nepal Police Cyber Bureau actually receives every week, eight categories dominate. Each maps to one or more sections of ETA 2063:
| Cyber Crime Type | Typical ETA Section | Real-World Example |
|---|---|---|
| Hacking and Account Takeover | Section 45 + 46 | Facebook, Instagram, Gmail, eSewa account hijacked; passwords changed; messages sent in victim's name |
| Online Financial Fraud (OTP, phishing, e-wallet) | Section 51 + Banking Offence Act | Caller pretending to be NRB, eSewa or bank manager, asking for OTP; phishing SMS for "KYC update" |
| Fake Profile and Identity Theft | Section 47 | Fake Facebook profile in victim's name posting defamatory content; fake job offers using victim's identity |
| Cyber-Bullying and Online Harassment | Section 47 + Privacy Act 2075 | Sustained abuse via social media DMs; leaking screenshots out of context to harass |
| Sextortion and Image-Based Abuse | Section 47 + Privacy Act 2075 | Demand for money in exchange for not releasing intimate images; revenge pornography after breakup |
| Child Sexual Abuse Material (CSAM) | Section 47 + Children's Act 2075 | Production, sharing, or possession of CSAM; coercion of minors online |
| Data Breach and Information Theft | Section 46 + 48 | Database leak from a company server; unauthorised disclosure of customer data |
| Ransomware and Malware Attacks | Section 46 + 51 | System encrypted with ransom demand in cryptocurrency; banking trojan extracting credentials |
For the social-media-specific application of these sections, see our social media crime laws guide — it goes deeper on Section 47 in the social-media context.
How to File a Cyber Crime Complaint in Nepal
The Nepal Police Cyber Bureau headquartered at Bhotahity, Kathmandu is the lead investigating agency for cyber offences. There are three filing routes — pick whichever lets you submit fastest while preserving evidence.
Three Channels to File a Complaint
| Channel | How to Use It | Best For |
|---|---|---|
| In Person | Visit Cyber Bureau, Bhotahity, Kathmandu with citizenship and printed evidence | Sextortion, fraud over NPR 1 lakh, ongoing threats |
| Send to cyberbureau@nepalpolice.gov.np with screenshots and details attached | Defamation posts, fake profiles, harassment, low-value fraud | |
| Online Portal | cyberbureau.nepalpolice.gov.np — register, choose category, attach evidence | Any straightforward case where the victim can scan/upload evidence |
Step-by-Step Complaint Process
- Preserve evidence first. Take dated screenshots of posts, messages, profile URLs, transaction IDs, bank SMS. Do NOT delete the original — investigators need the live trail.
- Choose channel. If amount > NPR 1 lakh or threats are continuing, go in person. Otherwise email or online portal.
- Draft a clear complaint. Identify yourself; describe the offence in chronological order; list the URLs, account names, transaction IDs; attach the evidence.
- For financial fraud, simultaneously alert your bank and Nepal Rastra Bank — request a freeze on the destination account before the funds disperse.
- Submit the complaint. The Bureau registers it, assigns a Case Number, and an investigating officer.
- Investigation phase. The officer collects digital evidence, may issue notices to platforms (Facebook, Instagram, banks) for log records.
- Decision. If sufficient evidence, the case is forwarded to the Government Attorney for prosecution at the District Court or, in some cases, the Information Technology Tribunal under Section 60 of ETA 2063.
- Trial and judgment. Standard criminal trial procedure; victim may participate as informant; appeal lies with the High Court.
What to Do in the First 24 Hours After a Cyber Attack
Speed is the single most important factor in cyber-crime cases. The first 24 hours separate recoverable from unrecoverable loss. The action checklist by category:
If Your Bank or eSewa Account Is Drained (OTP / Phishing Fraud)
- Call your bank's 24x7 helpline immediately and request the destination account be frozen
- File a written complaint at the bank branch the same day, citing the unauthorised transactions
- Email NRB at the consumer-protection address and the Cyber Bureau in parallel
- Lodge a formal Cyber Bureau complaint with all transaction IDs and SMS screenshots
- Change all banking and email passwords; enable two-factor authentication
If Your Social Media Is Hacked or Impersonated
- Report the fake profile or hijacked account to the platform (Facebook / Instagram / Twitter) immediately
- Take dated screenshots before the platform takes content down — investigators need them
- File a Cyber Bureau complaint with profile URLs, IDs, and any messages exchanged
- Notify contacts about the impersonation to prevent secondary fraud
If You Are a Victim of Sextortion or Image-Based Abuse
- Do NOT pay the ransom or send more material — paying confirms reachability and triggers more demands
- Save all communications, account names, and transaction demand details
- File at Cyber Bureau immediately — sextortion cases carry compounded charges under Section 47 plus Privacy Act 2075
- Consider professional counsel — sextortion victims often face same-day cross-pressure
If You Are Defamed Online or Targeted With a Fake Profile
- Capture the defamatory content with timestamps and URLs
- Report to the platform in parallel with the Cyber Bureau filing
- Section 47 + Section 305 of Muluki Criminal Code 2074 may both apply
- Consider a parallel civil suit for damages if reputational harm is significant
Key takeaway: evidence preservation in the first hour beats 30 hours of legal strategy a week later. Take screenshots, save URLs, write down what happened — then call the Cyber Bureau.
Trial Forum — District Court vs IT Tribunal
Once the Government Attorney decides to prosecute, the trial forum depends on the offence:
| Forum | Jurisdiction | Case Types |
|---|---|---|
| District Court | Original criminal jurisdiction for most cyber offences | Section 47 publication offences, financial fraud cases routed via the General Criminal Procedure Code |
| Information Technology Tribunal | Specialised forum under Section 60 of ETA 2063 | Technical cyber offences, OCC-related disputes, digital signature matters |
| High Court | Appellate jurisdiction | Appeals from District Court / IT Tribunal decisions |
| Supreme Court | Final appeal + writ jurisdiction under Article 46 of the Constitution | Constitutional questions, ultra vires challenges, Section 47 free-speech defences |
Because Section 47 has been challenged on free-speech grounds since 2015, several cases now reach the Supreme Court on whether a particular prosecution was within the Act's bounds. For the underlying constitutional rights involved, see our fundamental rights guide — Articles 17 (freedom of expression) and 28 (privacy) are the two most-litigated.
Common Mistakes Victims and Accused Make
From our cyber-practice experience, the recurring errors on both sides:
Mistakes Victims Make
- Deleting evidence in panic. The original message, the post, the WhatsApp chat — destroying these destroys the case. Screenshot first, then report.
- Waiting for the platform to act. Facebook / Instagram takedowns can take days. Cyber Bureau action is parallel, not after.
- Paying sextortion demands. Almost always escalates the demand rather than ending it.
- Filing only at the local police station. Cyber crimes need the Cyber Bureau's technical capacity — local stations refer them up anyway.
- Naming a private platform as respondent. Facebook / Twitter cannot be sued in Nepal as primary respondents — the Cyber Bureau acts against the user.
Mistakes the Accused Make
- Talking to the Cyber Bureau without counsel. Section 47 cases often turn on what was said in the first interview.
- Trying to delete the post after notice. Aggravates the offence and can amount to evidence tampering.
- Treating it as a "Facebook problem". A Section 47 conviction carries up to 5 years and creates a criminal record.
- Ignoring the bail window. Bail in cyber matters often hinges on early procedural compliance.
Key takeaway: the cyber-crime forum is fast, technical, and unforgiving on procedure. Whether victim or accused, get counsel involved at the first sign of formal action — by the time of trial, most cases are decided on the evidence and procedure of the first 72 hours.
Related Questions About Cyber Crime Laws in Nepal
These are the questions our cyber-crime team is asked most often during consultations in Kathmandu — short answers below, with links to deeper guides.
What Is the Punishment for Cyber Crime in Nepal?
Under ETA 2063, the maximum penalty for the most serious cyber offences is up to 5 years imprisonment plus a fine of up to NPR 200,000, depending on the section. Section 47 (publication of illegal electronic material) carries up to 5 years and NPR 100,000. Section 51 (computer fraud) up to 5 years and NPR 100,000. Sections 45-46 (unauthorised access and damage) up to 3 years and NPR 200,000. Aiding offences under Section 52 carry the same penalty as the principal offence.
Can I File a Cyber Crime Complaint Online in Nepal?
Yes. The Nepal Police Cyber Bureau accepts complaints through three channels — in person at the Bhotahity, Kathmandu headquarters; by email at cyberbureau@nepalpolice.gov.np; and through the online portal at cyberbureau.nepalpolice.gov.np. Online filing is best for routine cases where the victim can attach screenshots and evidence directly. Cases involving large financial fraud or ongoing sextortion are better filed in person for faster response.
How Long Does a Cyber Crime Case Take in Nepal?
Investigation by the Cyber Bureau typically takes 3 to 12 weeks depending on whether platform records (from Facebook, Google, banks) are needed. After the file goes to the Government Attorney, prosecution and trial at the District Court or IT Tribunal can take 6 to 24 months. Sextortion and high-value fraud cases are often expedited; defamation cases tend to move slower.
Is Online Defamation a Cyber Crime in Nepal?
Yes. Defamatory content posted online falls within Section 47 of ETA 2063 (publication of illegal electronic material) and may also attract criminal defamation under Section 305 of the Muluki Criminal Code 2074. The two routes can run together — the prosecutor will lead with whichever fits the facts. The civil defamation route under tort law is a separate option for damages compensation.
Can a Foreign National Be Prosecuted for Cyber Crime in Nepal?
Yes — Section 53 of ETA 2063 explicitly extends the Act's reach to acts done outside Nepal that affect computer systems within Nepal. Cross-border cyber-fraud cases are increasingly common, and Nepal cooperates with international cybercrime networks for evidence sharing. The challenge is enforcement — extradition treaties and platform cooperation determine whether the prosecution can be carried through.
Conclusion
Cyber crime laws in Nepal under the Electronic Transaction Act 2063 cover a broader landscape than most people realise — from Section 45's unauthorised access to Section 47's publication offences to Section 51's computer fraud. The penalty range goes up to 5 years imprisonment and NPR 200,000 in fines, with the IT Tribunal and District Court sharing trial jurisdiction and the High Court hearing appeals. The pending Information Technology and Cyber Security Bill may overhaul this regime in the years ahead, but until Parliament authenticates a successor statute, ETA 2063 remains the operative framework.
For citizens, the practical lesson is simple — evidence preservation in the first hour, prompt filing at the Cyber Bureau, and not paying ransom demands. For accused persons, the equivalent lesson is to engage counsel before the first interview rather than after charges are filed. Most cyber-crime outcomes are decided in the first 72 hours, not in court.
For end-to-end help with cyber-crime complaints, victim representation, defence in Section 47 prosecutions, sextortion cases, online financial fraud recovery, and IT Tribunal proceedings, speak with our lawyers today → — Alpine Law Associates is a full-service law firm in Kathmandu with a dedicated cyber-crime team handling cases at the Cyber Bureau, District Court, IT Tribunal, and Supreme Court.
Last reviewed: April 2026
Frequently Asked Questions
Cyber crime laws in Nepal are governed primarily by the Electronic Transaction Act 2063 (Sections 45-58), supplemented by the Individual Privacy Act 2075 and privacy provisions of the Muluki Criminal Code 2074. They are enforced by the Nepal Police Cyber Bureau and tried at the District Court or IT Tribunal.
Section 47 of ETA 2063 punishes the publication of illegal electronic material — obscene, hateful, defamatory or false content — with imprisonment up to 5 years, a fine up to NPR 100,000, or both. It is the most-prosecuted section in Nepal's cyber-crime jurisprudence.
Report to the Nepal Police Cyber Bureau in Bhotahity, Kathmandu — in person, by email at cyberbureau@nepalpolice.gov.np, or through the online portal at cyberbureau.nepalpolice.gov.np.
Hacking is prosecuted under Section 45 (unauthorised access) and Section 46 (damage) of ETA 2063. The maximum penalty is up to 3 years imprisonment plus a fine up to NPR 200,000, or both. Account takeover, password theft, and unauthorised system access all fall within these sections.
Online financial fraud — including OTP fraud, phishing, fake e-wallet transactions, and computer-aided fraud — falls under Section 51 of ETA 2063 (computer fraud), often combined with Banking Offence Act provisions. The penalty is up to 5 years imprisonment and a fine up to NPR 100,000. The Banking Offence Act may add further sentencing in serious banking-related cases.
Yes. The Cyber Bureau online portal at cyberbureau.nepalpolice.gov.np accepts complaints from any victim with internet access. Register an account, choose the offence category, attach screenshots and evidence, and submit. Email at cyberbureau@nepalpolice.gov.np is also accepted for cases where attachments are needed.
Yes. Defamatory content posted online is prosecuted under Section 47 of ETA 2063 and may also attract criminal defamation under Section 305 of the Muluki Criminal Code 2074. The civil defamation route under tort law is available separately for damages compensation. The prosecutor typically leads with whichever route best fits the facts.
Investigation at the Cyber Bureau takes 3 to 12 weeks depending on whether platform records (from Facebook, Google, banks) are needed. Trial at the District Court or IT Tribunal then takes 6 to 24 months. Sextortion and high-value fraud cases are often expedited; lower-value defamation cases take longer.
First, take dated screenshots of any unauthorised activity before the content is removed. Report the account compromise to the platform immediately. File a Cyber Bureau complaint with all relevant URLs, IDs, and screenshots — sections 45 and 46 of ETA 2063 cover unauthorised access and account takeover. Change all related passwords and enable two-factor authentication.
Do not pay or send more material — paying confirms reachability and escalates demands. Save all communications, account names, and transaction-demand details. File a Cyber Bureau complaint immediately. Sextortion cases combine Section 47 of ETA 2063 with the Individual Privacy Act 2075 and often carry serious penalties for the perpetrator.
Cyber crime cases are tried at either the District Court (most ETA 2063 prosecutions, including Section 47 publication offences) or the Information Technology Tribunal under Section 60 of ETA 2063 (technical and OCC-related cases). Appeals lie with the High Court, and the Supreme Court hears final appeals plus writs on constitutional questions.
Yes. Section 53 of ETA 2063 explicitly extends the Act's reach to acts committed outside Nepal that affect computer systems within Nepal. Cross-border prosecutions depend on extradition arrangements, mutual legal assistance, and platform cooperation, all of which determine whether the case can proceed to actual trial in Nepal.
The Electronic Transaction Act 2063 is the primary statute and contains the cyber-crime provisions in Sections 45 to 58. There is no separate "Cyber Crime Act" in Nepal — cyber crime is prosecuted under ETA 2063, supplemented by the Individual Privacy Act 2075 and the Muluki Criminal Code 2074. The pending Information Technology and Cyber Security Bill, if enacted, would replace ETA 2063 with a dedicated regime.
No. Platforms like Facebook and Twitter cannot be sued in Nepal as primary respondents in cyber-crime cases. The Cyber Bureau acts against the user who committed the offence, not the platform that hosted the content. Platforms are issued notices for log records and content removal, but not prosecuted as principals under ETA 2063.
Strongly recommended for both victims and accused. For victims, counsel ensures proper evidence preservation, complaint drafting, and follow-through. For accused persons, counsel is critical from the first Cyber Bureau interview — Section 47 cases often turn on what is said in the first 72 hours. Pro se petitioners frequently lose on procedure even when the merits favour them.
Disclaimer:
This article is intended solely for informational purposes and should not be interpreted as legal advice, advertisement, solicitation, or personal communication from the firm or its members. Neither the firm nor its members assume any responsibility for actions taken based on the information contained herein.