Sri Lanka Compliance Report

Generated 2026-09-22

Comprehensive Framework

Regulatory Overview

Regulatory Status: Dedicated crypto/VA legislation, licensing regime, active enforcement
Key Regulator(s): Central Bank of Sri Lanka
Primary Legislation: The Prevention of Money Laundering Act, No. 5 of 2006 (PMLA): This Act criminali, The Financial Transactions Reporting Act, No. 6 of 2006 (FTRA): This Act mandate, The Convention on the Suppression of Terrorist Financing Act, No. 25 of 2005 (CS
Travel Rule: Adopted — Threshold: Implemented
Tax Reporting: Not Legal Tender: Virtual currencies (VCs) are not recognized as legal tender in Sri Lanka.. Unregulated: VCs are not regulated by the CBSL and operate without any regulatory oversight or safeguards.. Illegal for Payments: The CBSL has prohibited regulated financial institutions from facilitating transactions involving VCs. This means VCs cannot be used for payments within Sri Lanka and engaging in such transactions carries significant risks.. No Licensing: No entity or company is authorized or licensed to operate, offer, or sell VCs, or provide services related to VCs (e.g., exchanges, brokers, miners) in Sri Lanka.. Risks: The CBSL highlights risks such as high volatility, financial losses, illicit financing (money laundering and terrorism financing), and data security risks.

Key Facts

aml Capital Requirements: No specific capital thresholds for VASP operations. AML/KYC Requirements (Specific to VASPs): No specific AML/KYC regulations are tailored for VASPs under a licensing framework. However, any entity operating in Sri Lanka would still be subject to general anti-money laundering and combating the financing of terrorism (AML/CFT) laws, such as the Financial Transactions Reporting Act No. 6 of 2006 (FTRA), if their activities fall within the scope of "financial institutions" or "designated non-financial businesses and professions (DNFBPs)" and trigger reporting obligations for suspicious transactions. The applicability to purely virtual asset businesses without fiat gateways is a grey area in the absence of explicit VASP definitions in the FTRA. Reference: Financial Transactions Reporting Act No. 6 of 2006 (Note: This is a general AML/CFT law, not specific to VA licensing). Local Presence: While no specific VASP license mandates local presence, any company wishing to operate legally in Sri Lanka, regardless of its business type, would need to comply with the Companies Act No. 07 of 2007, which typically involves local incorporation or registration as an overseas company branch.
enforcement Regulator Name: Central Bank of Sri Lanka (CBSL), Financial Intelligence Unit (FIU) Entity Targeted: The general public and financial institutions in Sri Lanka, as well as any individuals or entities considering or engaging in virtual asset services. Violation Type: Operating outside the regulated financial framework; promoting/engaging in high-risk, unregulated investments; dealing in non-legal tender. Penalty Amount: No specific monetary penalty associated with this advisory itself. The "penalty" is the declaration of illegality/unregulated status and the implied risk of legal action under existing financial or criminal laws if related to fraud or money laundering. Date: 2021-07-28 (Issued a press release) Outcome: Heightened public awareness of the CBSL's prohibitive stance. Discouragement of engagement with cryptocurrencies and virtual asset service providers (VASPs). Reiterated that VASPs are not licensed or regulated by CBSL. Significance: This was a strong and clear warning, setting the tone for the country's approach to virtual assets. It emphasized that crypto falls outside the existing regulatory perimeter, making any related activities high-risk and potentially illegal under broader financial laws. Central Bank of Sri Lanka Press Release: https://www.cbsl.gov.lk/en/news/fiu-statement-on-the-use-of-virtual-currencies Violation Type: Continuing to engage with or facilitate virtual asset transactions, despite previous warnings, and engaging in activities outside the regulatory framework. Penalty Amount: No specific monetary penalty. The "penalty" remains the official declaration of their unregulated status and the potential application of broader financial or criminal laws for illicit activities. Date: 2022-04-12 (Issued a press release)
general No specific license exists for operating a cryptocurrency custody service. The CBSL has explicitly stated that it has not licensed or authorized any entity or company to operate such schemes or to engage in "mining" or "exchanges" of virtual currencies. Any entity offering such services would be operating outside a recognized regulatory framework and could be subject to enforcement actions under general financial laws if their activities are deemed to constitute unlicensed financial services. CBSL Public Notice on Virtual Currencies - 2021 Segregation of Client Assets Rules: No specific rules are in place for the segregation of client cryptocurrency assets by custodians, as the custody service itself is unregulated. In traditional financial services, segregation is a fundamental principle, but it does not apply to unregulated crypto activities in Sri Lanka. No specific insurance or bonding requirements exist for cryptocurrency custodians. This is a direct consequence of the lack of a regulatory framework for these services. No specific mandates exist regarding the use of cold storage for client assets. While cold storage is a widely recognized best practice for security in the cryptocurrency industry, it is not a regulatory requirement in Sri Lanka due to the absence of a regulatory framework for crypto custody. No definition of a "qualified custodian" specifically for digital assets exists in Sri Lankan law or regulation. The concept of a qualified custodian applies to regulated financial institutions, which currently does not extend to entities dealing with virtual assets in Sri Lanka. While there isn't specific pending custody legislation, the Sri Lankan government and the CBSL have indicated an ongoing review and exploration of broader regulatory frameworks for virtual assets (VAs).
licensing The Prevention of Money Laundering Act, No. 5 of 2006 (PMLA): This Act criminalizes money laundering and establishes the legal framework for its prevention. The Financial Transactions Reporting Act, No. 6 of 2006 (FTRA): This Act mandates reporting institutions (which would include regulated VASPs) to report suspicious transactions and sets out customer due diligence (CDD) and record-keeping requirements. It also established the Financial Intelligence Unit (FIU). The Convention on the Suppression of Terrorist Financing Act, No. 25 of 2005 (CSTFA): This Act criminalizes terrorist financing and implements the international convention. Role: The FIU acts as the central national agency for receiving, analyzing, and disseminating financial information concerning suspected proceeds of crime and terrorist financing. It is responsible for enforcing compliance with AML/CFT laws by reporting institutions. Role: The CBSL has been involved in discussions regarding the regulation of VASPs and is expected to develop the licensing framework and supervise VASPs for both financial stability and AML/CFT compliance. Individuals: Obtain and verify the customer's full name, permanent address, date of birth, nationality, and a unique identification number (e.g., National Identity Card (NIC) number, passport number). Verification must be done using reliable, independent source documents, data, or information. Legal Persons/Arrangements: Obtain and verify the legal name, legal form, proof of existence, powers that regulate and bind the legal person/arrangement, and the names of relevant persons holding senior management positions. Beneficial Ownership: Identify and take reasonable measures to verify the identity of the beneficial owner(s) of the customer, including for legal persons, identifying natural persons who ultimately own or control the customer.
sanctions Binding for Sri Lanka: As a member state of the United Nations, Sri Lanka is legally bound to implement UN Security Council Resolutions (UNSCRs). These resolutions often mandate asset freezes, travel bans, and arms embargoes against individuals, entities, and countries deemed a threat to international peace and security (e.g., related to terrorism, proliferation, specific regimes like North Korea, Iran). OFAC (U.S. Department of the Treasury's Office of Foreign Assets Control) Sanctions: Extraterritorial Reach: OFAC sanctions primarily apply to U.S. persons (citizens, residents, entities), but also have significant extraterritorial reach. This means that non-U.S. persons, including those in Sri Lanka, can be subject to OFAC sanctions if their activities involve: U.S. financial systems (e.g., using USD stablecoins, facilitating transactions cleared through U.S. banks). Facilitating transactions for Specially Designated Nationals (SDNs) or other sanctioned entities listed by OFAC. Engaging in activities that violate specific U.S. sanctions programs (e.g., those related to Iran, North Korea, Cuba, Syria, Russia, Venezuela). Compliance for VASPs: Any VASP aiming to operate internationally or interact with the U.S. financial system (even indirectly through stablecoins or cross-border crypto transfers) must screen against OFAC's SDN List and other relevant sanctions lists. Failure to do so can result in severe penalties, including being cut off from the U.S. financial system. Scope: EU sanctions apply to all persons and entities within the EU's jurisdiction, EU nationals wherever they are, and entities registered under the law of an EU Member State. Like OFAC, they can have an indirect impact globally.
securities The Securities and Exchange Commission (SEC) of Sri Lanka is the primary regulator overseeing the issuance and trading of securities, including digital assets. The SEC Act and associated regulations provide the legal framework for the licensing and supervision of market participants. source Entities seeking to engage in the issuance or trading of digital assets must obtain a license from the SEC. The licensing process involves submitting an application, demonstrating compliance with capital and operational requirements, and undergoing a thorough review by the commission. source Issuers and service providers of digital assets are required to implement robust Anti-Money Laundering (AML) and Know Your Customer (KYC) procedures. These measures are designed to prevent illicit financial activities and ensure the integrity of the securities market. source The SEC has the authority to take enforcement actions against entities that violate securities laws, including those related to digital assets. Such actions may include fines, suspension of licenses, and other punitive measures. source The tax treatment of digital assets in Sri Lanka is governed by the Income Tax Ordinance and related regulations. Income derived from the trading or investment in digital assets is subject to taxation, and issuers may be required to withhold tax on certain transactions. source Despite the regulatory framework, key gaps and risks remain, including the need for clearer guidance on the classification of certain digital assets as securities, the evolving technological landscape, and the potential for market manipulation. Continuous monitoring and adaptation of regulations are essential to address these challenges. source
stablecoin Not Classified as E-money/Payment Tokens: The CBSL has explicitly stated that virtual currencies (VCs), which include stablecoins, are not considered "e-money" under the Payment and Settlement Systems Act, No. 28 of 2005. Therefore, entities involved in stablecoin activities are not authorized or licensed by the CBSL to operate as payment service providers. Not Classified as Securities (Explicitly): While the Securities and Exchange Commission of Sri Lanka (SEC) is the regulator for securities, there has been no explicit classification of stablecoins as securities by the SEC. However, depending on their specific structure and how they are offered, certain stablecoin arrangements could potentially fall under the definition of a "security" if they represent an investment contract or other instrument defined in the Securities and Exchange Commission of Sri Lanka Act, No. 19 of 2021. This is a theoretical possibility rather than an explicit ruling. De Facto Classification: Unregulated/High-Risk Assets: In practice, stablecoins are viewed by Sri Lankan regulators as unregulated digital assets that pose high risks to users and the financial system. Reserve Requirements: No requirements are imposed on stablecoin issuers for holding reserves. Issuer Licensing: There is no licensing regime for stablecoin issuers in Sri Lanka. Any entity issuing stablecoins would be operating outside the formal regulatory perimeter. Redemption Rights: There are no legally mandated redemption rights for stablecoin holders enforceable in Sri Lanka, as the assets are not recognized or regulated. The CBSL has published consultation papers and discussions around a "Proposed Road Map for Sri Lanka's Digitalization Strategy" which includes exploring a digitalized Sri Lankan Rupee. The CBSL views a potential e-Rupee as a safe, sovereign-backed alternative to private digital currencies, aiming to leverage the benefits of digitalization while mitigating the risks associated with private cryptocurrencies like stablecoins.
status Cryptocurrency is not recognized as legal tender in Sri Lanka, and there is no specific licensing framework for crypto asset service providers as of 2025–2026. Department of Immigration and Emigration The primary regulatory authority for financial services and virtual assets is the Central Bank of Sri Lanka, though no dedicated crypto licensing regime has been established. Department of Immigration and Emigration No entities have been licensed to operate cryptocurrency exchanges or digital asset businesses in Sri Lanka. Immigrants and Emigrants Act and Amendments The practical reality is that virtual asset activity operates in a legal grey area, with immigration authorities focusing on entry/exit controls rather than digital asset regulation. Internal Immigration Control The Act was enacted to control the entry into Sri Lanka of persons other than citizens of Sri Lanka, regulate departure from Sri Lanka of citizens and non-citizens, remove undesirable non-citizens, and handle incidental matters. Department of Immigration and Emigration Regulations made under the Immigrants and Emigrants Act were published in Gazette no 10039 issued on October 28, 1949. History of Immigration & Emigration and Citizenship of Sri Lanka Sri Lanka's international standing regarding FATF/Moneyval status is not addressed in the available official immigration sources. Department of Immigration and Emigration The Citizenship Act No. 18 of 1948 and its subsequent amendments govern citizenship matters relevant to financial and legal status. Internal Immigration Control
tax Not Legal Tender: Virtual currencies (VCs) are not recognized as legal tender in Sri Lanka. Unregulated: VCs are not regulated by the CBSL and operate without any regulatory oversight or safeguards. Illegal for Payments: The CBSL has prohibited regulated financial institutions from facilitating transactions involving VCs. This means VCs cannot be used for payments within Sri Lanka and engaging in such transactions carries significant risks. No Licensing: No entity or company is authorized or licensed to operate, offer, or sell VCs, or provide services related to VCs (e.g., exchanges, brokers, miners) in Sri Lanka. Risks: The CBSL highlights risks such as high volatility, financial losses, illicit financing (money laundering and terrorism financing), and data security risks. CBSL Press Release - Warnings on Virtual Currencies (August 10, 2021): https://www.cbsl.gov.lk/en/node/3313 CBSL Press Release - Public Warning on the Use of Virtual Currencies (July 11, 2022): https://www.cbsl.gov.lk/en/node/3592 No Specific Framework: Sri Lanka's Inland Revenue Act No. 24 of 2017 outlines capital gains tax (CGT) primarily for the realization of "investment assets," which are defined to include land, buildings, and specified shares/securities.
travel rule For domestic transfers between VASPs: Information must be collected and transmitted for transactions equal to or exceeding LKR 150,000 (approximately USD 470-500, depending on the current exchange rate). For cross-border transfers between VASPs: Information must be collected and transmitted for all transactions, with no de minimis threshold. For transfers to/from unhosted wallets (private wallets): VASPs must also conduct due diligence and risk assessments, regardless of the amount, and collect relevant information to the extent possible, especially for higher-risk transactions. Exchange between virtual assets and fiat currencies. Exchange between one or more forms of virtual assets. Transfer of virtual assets. Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets. Participation in and provision of financial services related to an issuer’s offer and/or sale of a virtual asset.

Sources

This report is AI-generated from publicly available regulatory sources. Last updated: 2026-09-06. View full profile