Crisis Management for Bangladesh Startups: What to Do When Things Go Wrong

Many founders will recognise a scenario like this. A payment gateway holds settlements on a Thursday night. A delivery partner sits on two days of cash-on-delivery collections. A customer's screenshot spreads on Facebook before anyone on the team has read the complaint.

Crisis management for startups is not about avoiding every one of these moments. It is about what you do in the hours after one starts, and how ready you were before it did.

Bangladesh adds specific pressures: thin cash buffers, heavy reliance on a few payment and delivery platforms, laws that change quickly (two that affect most startups were updated in April 2026), and a public that still remembers the 2021 e-commerce scandals. Our breakdown of why Bangladeshi startups fail covers the slow causes. This guide covers the sudden ones.

Below you will find an emergency checklist, a way to rate severity, a 72-hour response plan, guidance on the most common crisis types and the Bangladeshi laws behind them, copy-ready templates, and a simple plan to build before you need it.

If You Are in a Crisis Right Now

Work through these six steps in order, then use the rest of this guide for detail.

1. Protect people. If anyone is in physical danger, call 999, the national emergency number, and get people out first.

2. Contain ongoing harm. Pause the faulty process, isolate compromised systems, or stop dispatch from an affected hub. Note what you did and why.

3. Assign a crisis owner and a deputy. Agree a way to reach them by phone or SMS if company systems or mobile data fail.

4. Preserve evidence. Keep logs, transaction records, screenshots, and the time of each decision.

5. Check deadlines. Data-breach notification, consumer complaints, lender and payment obligations, and insurer notice periods.

6. Post a short holding statement. Say what you know, what you are doing, and when the next update will come.

What Counts as a Crisis for a Bangladesh Startup

A startup crisis is any sudden event that threatens people's safety, your ability to serve customers, your legal standing, or your cash within days rather than months. In Bangladesh, the usual triggers are cash crunches, operational shutdowns, security incidents, reputation storms, people crises, and regulatory shocks.

Treat these as diagnostic prompts, not neat boxes. A data breach starts as a security incident but can quickly become a legal, operational, and reputational crisis as well.

Rate the severity first

A severity level tells everyone how fast to move and who needs to be involved.

Triage order when several things break at once

1. People's safety

2. Containing ongoing harm to customers, data, or money

3. Legal and regulatory deadlines

4. Cash and core operations

5. Reputation and longer-term fixes

Reputation comes last in the order of action, not in importance: handling the first four well is usually what protects it.

The First 72 Hours: A Startup Crisis Management Playbook

The first three days often shape how well a problem is contained and how much trust survives. The work runs on three tracks at once: containing and repairing, establishing facts, and communicating. The time blocks below show when each track usually needs attention, not a sequence where one waits for another.

Hour 0 to 6: Contain, assign, acknowledge

Stop ongoing harm first. Pause the campaign, take the broken checkout offline, revoke the leaked credentials, or halt dispatch from the affected hub. Some containment steps are hard to reverse, so record what you did, why, and when, and reassess as facts come in.

Name a crisis owner, usually a founder, and a deputy. The owner coordinates decisions and approves public updates, but incident responders keep the authority to act on safety and technical containment without waiting. Decide who handles urgent contact with customers, regulators, law enforcement, and emergency services.

Set up an incident channel on WhatsApp or Slack, plus a backup that does not depend on mobile data: a phone tree and SMS list kept offline. If customers can already see the problem, post a brief holding statement now. Say that you know about it, that you are working on it, and when the next update will come.

Hour 6 to 24: Establish facts, check deadlines, protect cash

Keep a timestamped incident log of what you know, what you do not know, and what you are assuming. Preserve evidence as you go: logs, transaction records, complaint screenshots, and copies of key messages. This record becomes your memory when you deal with customers, investors, lawyers, insurers, or regulators.

List every deadline that now applies: breach notification, consumer complaints, lender covenants, insurer notice periods, and partner contract clauses. Then check cash: how many weeks can you meet payroll, statutory payments, and critical vendors if revenue stops today?

Hour 24 to 72: Update, repair, and plan recovery

Replace the holding statement with verified facts as soon as you have them, and keep to the update times you promised. Repair and root-cause investigation continue alongside communication, not after it.

By the end of the third day, aim to know the scope of the damage, the likely cause, the remaining risks, and an owner and deadline for each fix.

How to Communicate When Things Go Wrong

Communicate according to urgency, legal duty, and risk to customers. A reasonable default is to brief your team first so they do not learn about it from Facebook, then contact affected customers, partners, investors, and finally the wider public if the issue is visible. When people face real harm, such as exposed passwords or an unsafe product, tell them straight away, even while the investigation continues.

Keep the core facts identical for every audience, then tailor the detail:

Write customer messages in Bangla and English where your customers use both, and cover the same five points each time: what happened, who is affected, what you have done, what they should do, and when the next update will come.

Three habits tend to make crises worse. Deleting critical Facebook comments usually gets screenshotted and reposted. Blaming a courier or vendor in public reads as dodging, even when it is true. Offering a discount before fixing the problem can look like buying silence.

Transparent, effective recovery can help preserve customer trust, which is why crisis response belongs inside your customer retention strategy, not outside it.

Handling the Most Common Crisis Types

The laws below will not apply to every startup in the same way. Which ones matter depends on your business, your workforce, the data you process, and whether you handle payments or sell online.

A sudden cash crunch

Start with a 13-week cash forecast in three versions: expected, delayed, and worst case. List every committed outflow with its due date, including payroll, taxes and VAT, customer refunds, loan repayments, rent, and critical vendors.

Pause discretionary spending, such as campaigns that are not bringing in revenue and non-essential hires. Keep spending that protects customers, maintains critical services, or generates viable revenue. Before deciding which creditors to pay or defer, talk to your accountant and lawyer, because some obligations carry statutory or contractual consequences that a simple ranking misses.

Contact your bank relationship manager, landlord, and largest suppliers before you miss a payment. Early contact may keep options open, though how flexible a creditor can be depends on the contract and circumstances. Our guide to startup financial planning explains how to calculate runway and why it recommends a 12 to 18 month buffer in the current funding climate.

If you collect customer money, reconcile it now: orders taken, cash collected, amounts held by couriers or gateways, refunds due, and money actually received. Holding advance payments for goods you cannot ship can also create legal exposure, covered under undelivered orders below.

A data breach or hack

Isolate affected systems, revoke compromised credentials and sessions, and enforce multi-factor authentication on admin accounts. Where feasible, preserve logs and forensic copies before making destructive changes, then rebuild from clean, verified backups. If you lack the skills in-house, bring in a qualified incident responder, and remember that stopping the attack comes before keeping a perfect record.

You can ask BGD e-GOV CIRT, the government's computer incident response team, for help through its incident reporting form. At the time of review, the form accepts reports from organisations and lets you attach logs as a .zip, .7z, or .rar archive. Reporting to CIRT is a request for technical assistance. It is not the same as a legal notification duty.

That legal duty comes from the Personal Data Protection Act, 2026 (Act No. 63 of 2026), which replaced the 2025 ordinance. It is deemed effective from 6 November 2025, except section 23 and sections 31 to 35, which start on a date the government sets by gazette notice, no earlier than 18 months after the Act was issued. Under section 20 of the Act, a data fiduciary must notify the Authority of a breach likely to cause significant harm to the people whose data was affected, in the form, manner, and timeframe set by regulations. Ask a lawyer what the current regulations require rather than assuming a fixed deadline.

Tell affected customers what was exposed and what to do, such as changing passwords or watching for fraud calls that use their details. Afterwards, review access across every system, monitor for repeat activity, and run a post-incident review.

Layoffs and team cuts

If the crisis forces job cuts, first check who the Bangladesh Labour Act, 2006 covers. Its retrenchment protections apply to people who qualify as a "worker" under the Act, and many managerial and administrative roles are treated differently.

For qualifying workers, the Labour Act's retrenchment section (section 20) allows retrenchment on grounds of redundancy. For a worker with at least one year of continuous service, it generally requires one month's written notice or wages in lieu, a copy of the notice to the Chief Inspector and to the collective bargaining agent if one exists, and compensation of 30 days' wages per completed year of service or gratuity, whichever is higher. Within a category, the last person hired generally goes first, unless the employer and worker have agreed otherwise.

Retrenchment is only one way employment ends. Lay-off, termination with notice, and dismissal fall under different sections with different conditions. The Act has since been amended by the Labour (Amendment) Act, 2026, dated 10 April 2026, which replaced the 2025 amendment ordinance, so confirm current terms with a Bangladesh labour lawyer before acting.

Handle the human side with care. Tell people in person, pay final dues within the legal deadline (30 working days under section 30 of the Act), and offer references. The Dhaka startup scene is small, and how you treat departing staff shapes who will join when you hire again.

Co-founder conflict

Stress can expose disagreements that calm periods hide, so a co-founder dispute in the middle of a crisis is a risk worth planning for. Make sure access to bank accounts, domains, code repositories, and social pages never depends on one person alone.

When a dispute starts, fall back on what you agreed in writing. Founders with a signed co-founder agreement have a reference point for equity, roles, and exits; founders without one negotiate everything under pressure.

Undelivered orders and angry customers

If you have taken money and cannot deliver, the issue is legal as well as reputational. Section 45 of the Consumer Rights Protection Act penalises failing to properly sell or supply promised goods or services in exchange for the price.

A complaint under that Act must be filed within 30 days of the cause arising, under its section 60. That deadline covers complaints under this Act only; customers may have other contractual, civil, or regulatory routes. Online sellers should also follow the Ministry of Commerce's Digital Commerce Operation Guidelines, which set rules on delivery timelines and advance payments.

Track every unresolved order with an owner, a revised date, and the outcome the customer chose, whether delivery or refund. Communicate each revised date, and confirm in writing when the issue is closed.

Physical emergencies

A warehouse fire, building damage, or a threat to staff comes before everything else. Call 999, evacuate, and account for every person on site before thinking about stock, customers, or cash.

Once people are safe, document the damage and notify your insurer within the policy's notice period. Before any crisis, it is worth checking what your property, cyber, or business-interruption cover includes, and what notice clauses sit in your vendor contracts and service agreements.

What Bangladesh Has Already Taught Founders

The country's own recent history offers useful crisis case studies, because the conditions are ones local founders still face.

In 2021, trust collapsed around Evaly and several other e-commerce platforms that had collected large advance payments. After a Bangladesh Bank report on their finances, several banks suspended card transactions with a group of platforms. The Ministry of Commerce issued the Digital Commerce Operation Guidelines in July 2021, and payment gateways were directed to hold advance payments until delivery was confirmed. A sector-wide trust problem like this can reach well-run businesses too, so watch your sector and be ready to explain how you handle customer money.

When the pandemic reached Bangladesh in March 2020, demand for online groceries surged. Chaldal saw website traffic four to five times what it could serve and, as The Daily Star reported, limited orders to what it could deliver each day while moving to hire 200 more delivery staff. The bottleneck was delivery capacity, a reminder that a demand spike becomes a crisis if you promise more than you can fulfil.

In July 2024, Bangladesh went through a nationwide internet shutdown. Mobile internet was cut from 17 July until 28 July, and broadband from 18 July until it returned in stages around 23 and 24 July. The e-Commerce Association of Bangladesh estimated losses of Tk 1,400 crore in the first 10 days alone, according to The Business Standard.

App-based services such as Pathao depend on mobile data, which was unavailable for more than ten days. The planning lesson is to keep a phone line, SMS updates, and tested alternative payment options ready, so that one channel going dark does not stop the whole business.

Build Your Crisis Plan Before You Need It

A startup crisis plan does not need to be a binder. A few pages are a reasonable starting point, as long as they are current and everyone knows where to find them.

1. List your top five risks. Be specific: "gateway settlement delayed more than three days" is useful; "financial risk" is not.

2. Set severity levels and decision rights. Write down who can pause orders, disable a system, approve refunds, authorise emergency spending, and contact regulators, with a deputy for each.

3. Keep an emergency contact sheet offline. Lawyer, accountant, bank relationship manager, gateway account manager, courier operations lead, hosting provider, insurer, and key investors, printed and saved on phones, not only in email.

4. Build a backup communication path. A phone tree and SMS list that work without mobile data or company systems.

5. Prepare holding statements in Bangla and English. Short templates for an outage, a delay, a security incident, and a service change.

6. Track runway. Review it at least monthly, and weekly once it falls below 12 months, so you always know how much of a shock you can absorb.

7. Secure recovery, not just access. At least two appropriately authorised people should be able to recover each critical system, using separate accounts, multi-factor authentication, least-privilege access, and securely stored emergency credentials. Test restoring from backup.

8. Review insurance and contracts. Know what your policies cover and which notice clauses sit in vendor contracts and service agreements.

9. Rehearse. A one-hour tabletop exercise, perhaps twice a year, is a lightweight way to find gaps before a real incident does.

Write the result up as one of your standard operating procedures so it survives staff changes and does not live only in the founder's head.

Copy-ready templates

Incident log (one row per event or decision)

Holding statement

We are aware of [the problem] affecting [who is affected] since [time]. Our team is working on it now. [What customers should do, if anything.] We will share the next update by [time] on [channel].

13-week cash forecast (one row per week; repeat the sheet for a worst case)

After the crisis: run a review

Within two weeks of closing the incident, write a short review covering the timeline, root cause, customer impact, cost, the controls that failed, and each corrective action with an owner and a deadline. Then update the plan.

Preparation Turns Panic Into Procedure

Many startups in Bangladesh will face at least one week that feels like it could end the company. A gateway freezes, a platform goes dark, a post goes viral, or a co-founder leaves. Money helps in those weeks, but a clear plan helps you use whatever resources you have well: protect people, contain the harm, meet legal deadlines, stabilise cash, and keep telling people the truth.

The local environment makes preparation more valuable. Internet shutdowns, sector-wide trust shocks, and laws that changed as recently as April 2026 are part of operating here. Founders who have already written down their risks, contacts, decision rights, and holding statements can act while others are still working out who should speak.

Start this week. Write your top five risks on one page, name an owner and a deputy for each, and keep your emergency contacts somewhere you can reach without the internet. That page will not prevent a crisis, but it can make the first 72 hours far more orderly.