LK v13.3.0
content: ai_generated 129 sources retrieved model claude-sonnet-5 · 2026-07-04

Sri Lanka

LK schema world-payments-v1 trajectory: not yet assessed

Last updated · 14 modules · 67 sourced findings · 124 sources in the cumulative register

14Modulesbaseline.modules[]
67Findingsmodules[].findings[]
56Tier-1 sourcesrun_metadata.t1_source_count
Confidence mix (sums to 14 rendered modules; click to filter)
No modules moved this cycle.

Jurisdiction brief

Latest update · 18 October 2026

Lead Signal

Sri Lanka is building a digital-asset regulatory perimeter from zero, with the Securities and Exchange Commission designated lead regulator and the first phase of coverage limited to licensed exchanges and custodians. Cabinet approved the underlying policy framework on 27 July 2026, naming the SEC as lead regulator for virtual assets and VASPs, coordinating with the Central Bank's Financial Intelligence Unit and the Inland Revenue Department, and establishing that crypto will be treated as an investment asset and never as legal tender. The framework's development is explicitly timed to satisfy Sri Lanka's forthcoming AML/CFT mutual evaluation rather than to support domestic payment innovation.

14 of 14 modules
Signal
Density

Selections OR within a group, AND across groups. Press / to search.

#

CBSL is the sole payments regulator under the PSS Act No. 28 of 2005; card issuers/acquirers and mobile payment/e-money operators are licensed under the Payment Cards and Mobile Payment Systems Regulations No. 1 of 2013; money/value transfer service providers were brought under a dedicated CBSL regulation in 2024; a FinTech Regulatory Sandbox has operated since 2018/2020 for pre-licensing testing.

Standing sub-brief · as of 8 July 2026136 words · last cycle 2026-09-21

Licensing, Authorisation & Market Access

The Payment and Settlement Systems Act No. 28 of 2005 vests the Central Bank of Sri Lanka as the sole authority able to license or operate a payment system in the country; no other legal entity may commence or operate one without CBSL authorisation. Card issuers and acquirers, and mobile-payment operators, are licensed under a separate 2013 regulation, and in 2024 the Central Bank extended the licensing perimeter again: Regulations No.01 of 2024, dated 30 April 2024, brought money and value transfer service providers under a dedicated CBSL licensing and registration track distinct from card and mobile-payment licensing.

Periodic update · new data 2026-09-21

Licensing, Authorisation & Market Access

The Central Bank of Sri Lanka chairs the National Payments Council, the body responsible for making recommendations on the country's financial-infrastructure development, a role confirmed directly from CBSL's own published materials. This institutional structure sits at the centre of Sri Lanka's market-access framework for payments, coordinating the direction of infrastructure investments such as the RTGS upgrade and interbank settlement growth documented elsewhere this cycle. The bank-PSP layer is well established: 13 licensed acquirers were operational with 131,000 point-of-sale terminals as of 2024, reflecting a mature bank-led acquiring market rather than one dominated by non-bank payment institutions.

This licensing and market-access structure provides the institutional backdrop against which newer entrants, such as GovPay, have launched, since any new payment product operating in Sri Lanka's market ultimately answers to CBSL's payments-and-settlement oversight rather than a separate non-bank licensing track.

Outlook

The National Payments Council's recommendations, and how they feed into the 2025-2027 National Payment System Roadmap's scheduled 2026 legal reforms, are the key developments to watch for this module. Whether that reform package alters the current bank-led acquiring structure, for instance by opening a distinct non-bank payment-institution licensing track, would be a material shift from the currently observed bank-PSP-dominant market access model.

1 earlier distinct update(s)
Periodic update · new data 2026-09-14

Licensing, Authorisation & Market Access

Sri Lanka's Central Bank formalised a licensing regime for money or value transfer service providers this cycle. The Money or Value Transfer Service Providers Regulations No.01 of 2025 became effective on 13 January 2026, per the Central Bank of Sri Lanka's own circular index of directions, circulars and guidelines on payments and settlements. This is a confirmed, non-bank-specific licensing development: the regulations establish an MVTS registration and licensing pathway distinct from bank-authorisation routes, formalising the non-bank payment-services segment under a dedicated regulatory instrument for the first time.

The regulation's legal foundation traces to section 59 of the Central Bank of Sri Lanka Act No.16 of 2023, which empowers the Central Bank to establish and operate fund-transfer and settlement systems and to issue system rules to participating institutions, both bank and non-bank. This foundational statutory power underlies both this cycle's MVTS licensing formalisation and the separate JustPay scheme-rule change recorded under Scheme & Network Compliance, indicating the Central Bank is actively exercising its post-2023 Act powers across multiple fronts of the payments landscape simultaneously.

The bank-versus-non-bank distinction is material here: MVTS licensing applies specifically to non-bank payment-services providers, a segment that previously operated without a dedicated licensing framework of this kind. Providers now face a defined regulatory market-access gate that did not exist in this form prior to January 2026, a change with direct compliance implications for any non-bank entity offering money or value transfer services in or into Sri Lanka.

Outlook

The practical scope of the MVTS licensing regime, including specific application requirements, capital thresholds, and any exemptions, was not further detailed in sourced material this cycle beyond confirmation that the regime is now formalised and effective. Continued monitoring of CBSL's directions and circulars index is the appropriate channel for tracking implementation detail as it emerges.

Sources and findings (6)
  1. T1https://www.cbsl.gov.lk/sites/default/files/cbslweb_documents/laws/acts/en/Payment_setttlement_sys_act.pdfretrieved
  2. T1https://www.cbsl.gov.lk/en/financial-system/financial-infrastructure/payments-and-settlements-systemsretrieved
  3. T1https://www.cbsl.gov.lk/en/laws/directions-circulars-guidelines-on-payments-and-settlementsretrieved
  4. T3https://www.tamimi.com/law-update-articles/retail-payment-services-and-card-schemes-regulation/retrieved
  5. T3https://www.chamber.lk/wp-content/uploads/2024/05/Decoding-Sri-Lankas-FinTech-Regulatory-Sandbox.pdfretrieved
  6. T3https://conventuslaw.com/report/govpay-initiative-sri-lankas-first-integrated-digital-payment-platform/retrieved

#

Market-conduct supervision was formalised for the first time in Sri Lanka via the Financial Consumer Protection Regulations No. 01 of 2023, administered by CBSL's FCRD; retail-payment-service PSPs offering payment initiation/account-information services must hold professional indemnity insurance and undertake AML/CFT risk assessments; conduct rules apply uniformly across CBSL-regulated FSPs including PSPs and card schemes.

Standing sub-brief · as of 8 July 2026137 words · last cycle 2026-09-28

Conduct, Safeguarding & Financial Promotions

Market-conduct supervision in Sri Lanka was formalised for the first time via the Financial Consumer Protection Regulations No. 01 of 2023, administered by the Central Bank's Financial Consumer Relations Department, which holds full enforcement and referral powers over CBSL-regulated financial service providers. The conduct perimeter extends to non-bank payment service providers directly: firms offering payment-initiation and account-information services are required to hold professional indemnity insurance and to carry out an AML/CFT risk assessment, a conduct-adjacent obligation that sits alongside, rather than substitutes for, prudential licensing.

Periodic update · new data 2026-09-28

Conduct, Safeguarding & Financial Promotions

CBSL Circular No.03 of 2026, issued 13 March 2026, requires the Boards and Senior Management of licensed Mobile Phone based e-Money System operators to obtain formal declarations in terms of FATF Recommendation 26, which governs the adequacy of supervisory frameworks for financial institutions. This is a new AML-adjacent governance-conduct lever applied specifically to the non-bank payment-institution/e-money-institution (nonbank_pi_emi) category, distinct from the bank-based payment-system participants who are not the subject of this circular. The requirement places direct accountability on operator governance bodies rather than on operational compliance staff alone, elevating the seniority level at which FATF R.26 alignment must be affirmed.

This development should be read against the bank-PSP versus non-bank-PI/EMI distinction that structures Sri Lanka's payments conduct regime more broadly: mobile-phone-based e-money operators, as non-bank licensees, face a bespoke governance-declaration obligation that a licensed commercial bank offering equivalent e-money-like functionality would not face under this specific circular. No enforcement action or penalty arising from this declaration requirement has been reported this cycle; the development is confined to the imposition of the requirement itself.

Outlook

The declaration requirement's practical significance will depend on how CBSL uses the resulting Board/Senior-Management attestations in ongoing supervision, and whether it is extended to other non-bank payment-licensee categories beyond mobile-phone-based e-money operators specifically.

Sources and findings (5)
  1. T1https://www.cbsl.gov.lk/en/news/regulations-on-financial-consumer-protectionretrieved
  2. T3https://www.nithyapartners.com/journal/key-features-of-the-financial-consumer-protection-regulationsretrieved
  3. T3https://www.tamimi.com/law-update-articles/retail-payment-services-and-card-schemes-regulation/retrieved
  4. T1https://www.cbsl.gov.lk/en/fcrdretrieved
  5. T1https://www.cbsl.gov.lk/en/news/cbsl-launches-the-complaint-management-system-for-financial-consumersretrieved

#

Sri Lanka has no dedicated stablecoin/virtual-asset statute in force; crypto exists in a legal grey zone. The FIU is running a mandatory VASP survey and CBSL has proposed FTRA amendments to bring VASPs under AML/CFT registration, with a licensing bill still pending as of mid-2026; a narrow tourism-sector stablecoin-payment channel via licensed intermediaries was reportedly piloted in 2026 (unconfirmed by CBSL primary sources), and CBDC exploration was shelved in 2023 on IMF concerns.

Standing sub-brief · as of 8 July 2026186 words · last cycle 2026-10-18

Stablecoins & Digital Money

Sri Lanka has no dedicated stablecoin or virtual-asset statute in force, leaving crypto in a legal grey zone: holding is not banned, but banks have been barred since 2021 from processing crypto-linked card payments. Ahead of the country's third FATF/APG mutual evaluation, the Financial Intelligence Unit has launched a mandatory VASP survey and a registration roadmap aimed at bringing virtual asset service providers under FATF-aligned AML/CFT requirements. A separate report describes CBSL-linked payment service providers enabling stablecoin payments — reportedly USDT and USDC — for the tourism sector from April 2026; this claim rests on a single specialist crypto-news source and could not be corroborated against CBSL's own circulars or news pages during review, so it is carried here at Possible confidence only and should be treated as unverified pending official confirmation.

Periodic update · new data 2026-10-18

Stablecoins & Digital Money

Sri Lanka is constructing a digital-asset regulatory perimeter from a standing start, with the payments and digital-money implications of that construction centring on who will be allowed to operate what kind of service, and under whose supervision. Cabinet approved a policy framework on 27 July 2026 naming the Securities and Exchange Commission of Sri Lanka as the lead regulator for virtual assets and VASPs, coordinating with the Central Bank of Sri Lanka's Financial Intelligence Unit and the Inland Revenue Department. A specific and structurally significant element of this framework is that crypto will be treated as an investment asset, never as legal tender, a classification choice that positions the SEC rather than the Central Bank as the primary regulatory anchor for this sector going forward.

The drafting process advanced further on 24 September 2026, when the Ministry of Digital Economy's VASP concept paper was sent to the Legal Draftsman's Department, with the first phase of the regime limited to licensed exchanges and custodians. Reporting from 12 October 2026 adds the operational detail that virtual asset service providers will be required to register, comply with know-your-customer rules, and report suspicious transactions once the framework is enacted, with this timing explicitly linked to Sri Lanka's approaching AML/CFT mutual evaluation rather than to a payments-innovation agenda.

Against this forward-looking drafting activity, the existing baseline for digital-money and virtual-currency payment flows remains restrictive and unchanged. The Central Bank of Sri Lanka has not authorised any entity to operate a cryptocurrency exchange; virtual currency is not recognised as legal tender; and the Foreign Exchange Act explicitly bars resident cardholders from using debit or credit cards to make international payments for the purchase or trading of virtual currencies. This outbound card-payment restriction is a materially distinct constraint from the VASP licensing question, bank-and-nonbank payment-instrument providers alike face it today regardless of how the eventual VASP licensing regime is structured, since it operates under foreign-exchange control law rather than under the prospective VASP framework.

No CBSL primary gazette, Direction or Circular text was located this cycle confirming the VASP framework's operational details; the W2 findings rest on T2 press reporting of Cabinet and ministry statements rather than a published regulatory instrument. This is a structural sourcing gap for a reform of this materiality to Sri Lanka's digital-money and payments landscape.

Outlook

The VASP legislation is expected to reach Parliament around the first quarter of 2027, though the timing carries substantial uncertainty given the drafting process remains incomplete. For payments-sector participants, the structural choice to designate the SEC as lead regulator rather than the Central Bank is the detail most worth tracking: it signals an investment-asset framing for crypto under Sri Lankan law, distinct from the e-money or payment-instrument framing that governs other digital-money products, and this framing will likely shape how any future stablecoin-specific rules, were they to be proposed, would be supervised.

Sources and findings (5)
  1. T3https://dailynews.lk/2026/05/06/features/990472/sri-lankas-crypto-regulation-roadmap-what-the-2026-framework-actually-means/retrieved
  2. T4https://www.lightspark.com/knowledge/is-crypto-legal-in-sri-lankaretrieved
  3. T3http://www.adaderana.lk/news/112860/is-cryptocurrency-legal-in-sri-lanka-central-bank-governor-explainsretrieved
  4. T4https://www.coinreporter.io/2026/04/sri-lanka-central-bank-integrates-crypto-payments-for-tourism-sector/retrieved
  5. T4https://coinfomania.com/cryptocurrency-regulations-in-sri-lanka/retrieved

#

CBSL regulates technology/cyber risk via Banking Act Directions No. 16 of 2021 (amended Dec 2023) and a parallel Technology Risk & Resilience framework for licensed finance companies; licensed banks must report IT/cybersecurity incidents to CBSL; the RTGS backbone is reported to have been upgraded to ISO 20022 in 2024 (not confirmed by CBSL primary sources).

Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. Open this jurisdiction's page on Dataprotection.gi →

Standing sub-brief · as of 8 July 2026129 words · last cycle 2026-09-28

Operational Resilience & Critical Infrastructure

Licensed finance companies operate under a Technology Risk and Resilience Framework that mandates round-the-clock security operations centres, annual penetration testing and cloud-adoption risk assessment, with notification to CBSL required before critical systems move to cloud. A separate claim that the CBSL Real-Time Gross Settlement system completed an ISO 20022 upgrade in 2024 rests on a single vendor knowledge-base source; CBSL's own 2026 Policy Agenda references a Payment System Roadmap for 2025-2027 without confirming a completed migration, so this claim has been downgraded from Confirmed to Assessed pending primary-source verification.

Periodic update · new data 2026-09-28

Operational Resilience & Critical Infrastructure

CBSL Circular No.04 of 2026, issued 25 May 2026, discontinues the Liability Manager Mechanism and implements new risk-mitigation mechanisms for CEFTS (the Common Electronic Fund Transfer Switch) and the Common ATM Switch. This is a structural change to how settlement risk is managed across Sri Lanka's core interbank retail-payments infrastructure, applying to both bank and non-bank participants in those systems. The retirement of a named liability-allocation mechanism in favour of new, as-yet-unspecified-in-detail risk-mitigation arrangements represents the kind of foundational infrastructure change that determines how losses and settlement failures are absorbed across the payments ecosystem, rather than a routine parameter update.

This change sits within a broader pattern of active CBSL technical governance in 2026: alongside the CEFTS/Common ATM Switch risk-mitigation overhaul, the Central Bank also updated the national QR standard and tightened JustPay transaction parameters in the same period, suggesting a coordinated modernisation push across Sri Lanka's core payments rails rather than an isolated intervention. No incident or settlement failure prompting the change has been reported; the circular itself is the extent of the documented development this cycle.

Outlook

The key operational question is how the new CEFTS/Common ATM Switch risk-mitigation mechanisms perform under real transaction volume and, in particular, under any future settlement-stress scenario, since the prior Liability Manager Mechanism's discontinuation removes a previously known allocation-of-loss framework without yet having been tested by a live stress event.

1 earlier distinct update(s)
Periodic update · new data 2026-09-21

Operational Resilience & Critical Infrastructure

Sri Lanka's core payments infrastructure has undergone significant modernisation. The Central Bank of Sri Lanka's RTGS system was upgraded to ISO 20022 compliance in 2024, aligning the country's high-value settlement rail with the international messaging standard increasingly adopted across major payment corridors. This upgrade sits alongside a marked structural shift in interbank settlement behaviour: LankaPay's CEFTS now handles 67% of interbank transactions, a dramatic rise from just 8% six years prior, indicating that real-time interbank settlement has moved from a marginal channel to the dominant one over a relatively short period.

Both developments are Probable-confidence findings corroborated by CBSL's own payments-modernisation roadmap references, and both describe bank-and-scheme-level infrastructure resilience improvements rather than non-bank payment-institution-specific developments. The 2025-2027 National Payment System Roadmap schedules further legal reforms for 2026, indicating that this infrastructure modernisation is proceeding alongside, though so far ahead of, formal legal-framework updates.

Outlook

Whether the scheduled 2026 legal reforms under the National Payment System Roadmap keep pace with the infrastructure gains already achieved is the central question for this module going forward. The CEFTS growth trajectory, in particular, is worth monitoring for whether it continues at a comparable rate or begins to plateau as the interbank channel approaches saturation.

Sources and findings (4)
  1. T1https://www.cbsl.gov.lk/sites/default/files/cbslweb_documents/laws/consultation_paper_20210826_technology_risk_resilience_framework_lfc_e.pdfretrieved
  2. T1https://www.cbsl.gov.lk/sites/default/files/cbslweb_documents/laws/banks.pdfretrieved
  3. T1https://www.cbsl.gov.lk/en/node/18517retrieved
  4. T4https://www.lightspark.com/knowledge/instant-payments-sri-lankaretrieved

#

Card-scheme and network compliance rests on the Payment Cards and Mobile Payment Systems Regulations No. 1 of 2013 and the Credit Card Operational Guidelines No. 1 of 2010; CBSL's own national card scheme (LankaPay, with JCB International) operates as a lower-cost domestic alternative to international schemes; the Retail Payment Services and Card Schemes regulation extended licensing to Card Scheme operators themselves.

Standing sub-brief · as of 8 July 202697 words · last cycle 2026-09-28

Scheme & Network Compliance

CBSL's Payments Bulletin for the third quarter of 2025 records 14 Licensed Commercial Banks and 4 Licensed Finance Companies as authorised card issuers and acquirers. Card schemes themselves — not just issuing and acquiring banks — now require a CBSL licence under the Retail Payment Services and Card Schemes Regulation, with existing schemes given a one-year transition period to obtain one.

Periodic update · new data 2026-09-28

Scheme & Network Compliance

The LANKAQR National QR Code Standard, originally issued under CBSL Circular No.02 of 2026 on 13 March 2026, was updated via Addendum 1 on 17 June 2026, evidencing continued active technical maintenance of Sri Lanka's national QR-code payments scheme rather than a static, one-time standard-setting exercise. Separately, and with materially lower source confidence, a Cabinet-approved programme reported in March 2026 would introduce a fee-free tier for LankaQR transactions under LKR 5,000, intended to drive merchant and consumer adoption of the scheme. This fee-free element has not yet been corroborated by a Central Bank primary publication and rests on a single lower-tier news source; it should be treated as a reported initiative under development rather than a confirmed scheme rule.

Taken together, the confirmed Addendum 1 update and the reported fee-free tier suggest LankaQR is in a period of active commercial and technical evolution, with the Central Bank using both technical-standard amendment and, potentially, fee-structure policy to expand the scheme's reach.

Outlook

Whether the reported fee-free sub-LKR-5,000 tier is confirmed through a Central Bank primary publication is the most consequential open item for this scheme; if confirmed, it would represent a deliberate low-value-transaction adoption strategy layered on top of the technical standard maintained through Addendum 1.

1 earlier distinct update(s)
Periodic update · new data 2026-09-14

Scheme & Network Compliance

CBSL Circular No.1 of 2026, dated 20 January 2026, set new maximum per-transaction limits and fees for JustPay, Sri Lanka's domestic instant-payment scheme operating over the country's real-time settlement infrastructure. This is a confirmed scheme-rule change directly affecting transaction economics for participants in the JustPay network, arriving within a week of the Money or Value Transfer Service Providers Regulations No.01 of 2025 taking effect, a sequencing that suggests the Central Bank pursued a coordinated regulatory push covering both non-bank market entry and domestic scheme economics in the same short window in January 2026.

JustPay operates on a bank-oriented settlement basis, and this circular's new transaction-limit and fee ceilings apply within that bank-participant structure. The change is material for participating institutions' transaction pricing and limit-setting practices going forward, since the circular imposes binding maximums rather than merely guidance-level recommendations.

The circular is issued under the Central Bank's standing regulatory authority over payment systems established through directions, circulars and guidelines on payments and settlements, the same channel through which the MVTS licensing regulation was published. This shared publication channel underscores that both developments are part of the Central Bank's ordinary regulatory rule-making process rather than emergency or reactive interventions.

Outlook

The specific numeric values of the new JustPay per-transaction limits and fees were not detailed in sourced material this cycle beyond confirmation that the circular sets such maximums. Tracking the practical effect of these new limits on JustPay transaction volumes and participant behaviour over the coming cycles would clarify whether the rule change materially altered usage patterns.

Sources and findings (4)
  1. T1https://www.cbsl.gov.lk/sites/default/files/Payments_Bulletin_3Q2025_e.pdfretrieved
  2. T3https://www.tamimi.com/law-update-articles/retail-payment-services-and-card-schemes-regulation/retrieved
  3. T3https://www.lankapay.net/en/for-you/national-cardretrieved
  4. T3https://www.lankaclear.com/products-and-services/ncs/retrieved

#

Worker remittances are Sri Lanka's largest non-debt-creating FX inflow, roughly half originating from the Middle East and channelled through banks, exchange houses and the Lanka Remit app; a China-tourism corridor runs via LANKAQR-UnionPay integration; the India corridor remains restricted to formal banking channels.

Standing sub-brief · as of 8 July 2026111 words · last cycle 2026-07-08

Payment Corridor Dynamics

Worker remittances remain Sri Lanka's largest non-debt-creating foreign-exchange inflow, historically covering approximately 80 percent of the trade deficit; the Foreign Remittance Facilitation Department was established in November 2021 to streamline these flows. The Middle East corridor accounts for roughly half of total worker remittances and is home to an estimated 660,000 Sri Lankan migrant workers, leaving this single corridor exposed to regional conflict risk.

no periodic updates on record for this sub-brief

Sources and findings (4)
  1. T1https://www.cbsl.gov.lk/en/workers-remittancesretrieved
  2. T3https://www.ips.lk/talkingeconomics/2026/03/24/middle-east-conflict-the-impact-on-migration-and-remittances-in-sri-lanka/retrieved
  3. T1https://www.cbsl.gov.lk/en/workers-remittances/national-remittance-mobile-applicationretrieved
  4. T4https://www.lightspark.com/knowledge/instant-payments-sri-lankaretrieved

#

Sri Lanka's bank-dominated financial sector comprises 24 Licensed Commercial Banks, 6 Licensed Specialised Banks and ~34-37 Licensed Finance Companies, with state-owned banks holding roughly half of banking assets; a growing fintech layer coexists with banks; multilateral development finance (IFC) is actively recapitalising private commercial banks.

Standing sub-brief · as of 8 July 2026128 words · last cycle 2026-07-08

Industry Structure & Commercial Dynamics

Sri Lanka's financial sector remains bank-dominated: 24 Licensed Commercial Banks, 6 Licensed Specialised Banks and roughly 34 Licensed Finance Companies account for the great majority of financial-sector assets, with state-owned banks holding a substantial share of banking-sector assets. Against this backdrop, the International Finance Corporation announced a USD 166 million investment programme spanning loans, risk-sharing facilities and a trade-finance guarantee across three private commercial banks — Nations Trust Bank, Commercial Bank of Ceylon and National Development Bank — aimed at expanding SME and payments-adjacent lending.

no periodic updates on record for this sub-brief

Sources and findings (5)
  1. T3https://chambers.com/content/item/5577 Applies beyond this jurisdiction (World Bank)retrieved
  2. T1https://documents1.worldbank.org/curated/en/099040423094026887/pdf/P1808610591960010ab7d024d3bb621deb.pdfretrieved
  3. T3https://en.wikipedia.org/wiki/Fintech_Association_of_Sri_Lankaretrieved
  4. T1https://www.ifc.org/en/pressroom/2025/ifc-invests-166-million-to-support-sri-lankan-businesses-and-drive-economic-growthretrieved
  5. T4https://tracxn.com/d/explore/fintech-startups-in-sri-lanka/__giCu69LvGbU7cFiY4hLvCUuRM_npJ_3I2V8PI1G_1Vs/companiesretrieved

Recent enforcement centres on CBSL's expanded resolution and administrative-fine powers under the Banking (Special Provisions) Act No. 17 of 2023 and the Banking (Amendment) Act No. 24 of 2024: a finance-company licence cancellation (Nation Lanka Finance PLC, July 2025), unauthorised deposit-taking enforcement, and an internal-fraud disclosure at NDB (2026) are the most current live matters.

Standing sub-brief · as of 8 July 2026115 words · last cycle 2026-07-08

Legal & Litigation

Nation Lanka Finance PLC had its licence cancelled effective 4 July 2025 under the Central Bank's resolution powers, following continuous violations of the Finance Business Act; an Administrator was appointed to manage the wind-down. This action draws on an enforcement toolkit that has itself been strengthened: the Banking (Amendment) Act No. 24 of 2024 granted CBSL administrative fine powers that extend its supervisory reach beyond the older binary of licence suspension or cancellation.

no periodic updates on record for this sub-brief

Sources and findings (5)
  1. T1https://www.cbsl.gov.lk/retrieved
  2. T1https://www.cbsl.gov.lk/retrieved
  3. T1https://www.cbsl.gov.lk/en/node/20190retrieved
  4. T3https://dailynews.lk/2026/05/06/features/990472/sri-lankas-crypto-regulation-roadmap-what-the-2026-framework-actually-means/retrieved
  5. T1https://www.cbsl.gov.lk/sites/default/files/cbslweb_documents/laws/banks.pdfretrieved

#

Merchant acquiring is licensed under the Payment Cards and Mobile Payment Systems Regulations, with a blend of bank acquirers and fintech PSPs offering preferential LankaPay-linked fees; fraud risk is moderate but growing, with 3DS/velocity checks recommended; cross-border settlements carry withholding tax and VAT considerations.

Standing sub-brief · as of 8 July 202697 words · last cycle 2026-07-08

Merchant Acquiring & Risk

Merchant acquiring in Sri Lanka blends bank acquirers and fintech payment service providers, with LankaPay-linked fee incentives positioned as a lower-cost domestic alternative to international-scheme acquiring costs. Card-testing fraud is an active operational concern, with 3D Secure authentication and velocity checks recommended as standard controls, and cross-border merchant settlement carries a roughly 14 percent withholding tax and 8 percent VAT.

no periodic updates on record for this sub-brief

Sources and findings (4)
  1. T4https://payatlas.com/countries/sri-lanka-lkretrieved
  2. T4https://payatlas.com/countries/sri-lanka-lkretrieved
  3. T1https://www.cbsl.gov.lk/sites/default/files/Payments_Bulletin_3Q2025_e.pdfretrieved
  4. T3https://www.lankaclear.com/products-and-services/ncs/retrieved

#

Product innovation is anchored around CBSL/LankaClear infrastructure: CEFTS, LANKAQR, GovPay (launched Feb 2025), a national card scheme co-branded with JCB, and an active FinTech Regulatory Sandbox; CBDC work has been paused since 2023.

Standing sub-brief · as of 8 July 202691 words · last cycle 2026-09-28

Product Innovation & Market Development

The CEFTS instant-payment switch has provided 24/7 interbank fund transfers since 2015, with request-to-pay functionality and no cut-off times, forming the core real-time payments backbone. GovPay launched on 7 February 2025 as the first of a planned trio of unified government digital-payment platforms, built within the existing legal framework rather than requiring new primary legislation.

Periodic update · new data 2026-09-28

Product Innovation & Market Development

CBSL Circular No.01 of 2026, issued 20 January 2026, sets the maximum per-transaction limit and applicable fees for JustPay, the CEFTS-based account-to-account payments product available to both bank and non-bank participants. This represents a tightening of the commercial parameters governing an established instant-payments product rather than the launch of a new one, and it was the earliest of several CBSL payments-infrastructure interventions issued across the first half of 2026.

JustPay's positioning as a CEFTS-based product connects this parameter revision to the broader infrastructure changes made later in the year, including the CEFTS/Common ATM Switch risk-mitigation overhaul under Circular No.04 of 2026; a transaction-limit and fee revision at the start of the year appears, in retrospect, to be part of a wider annual programme of CEFTS-ecosystem adjustment rather than an isolated product change.

Outlook

Whether CBSL follows this transaction-limit and fee revision with further JustPay-specific product development, as opposed to further infrastructure-level CEFTS changes, will indicate whether 2026's payments modernisation push is primarily about product commercial terms or about underlying settlement-risk architecture.

2 earlier distinct update(s)
Periodic update · new data 2026-09-21

Product Innovation & Market Development

Two distinct product developments define this module for Sri Lanka this cycle. GovPay, a government payment channel, launched on 7 February 2025 under CBSL Payment and Settlement Systems Circular No. 01 of 2025, which caps applicable fees, and Circular No. 02 of 2025, which establishes the operational framework. This finding carries Uncertain confidence, sourced from a Tier-4 encyclopedia entry without corroboration against the primary circular text this cycle, though the launch date and the two-circular structure are specific enough to be treated as a short dated dashboard entry rather than a fully substantiated standing item.

Separately, and with stronger sourcing, LANKAQR has achieved broad national merchant coverage: the interoperable QR standard now serves over 400,000 merchants via 22 acquirers and more than 30 participating apps, at a merchant discount rate capped between 0.5% and 1%. This is a Probable-confidence finding demonstrating that Sri Lanka's interoperable QR payment layer has reached significant retail-market penetration under a controlled-cost structure, both through bank and non-bank participating channels.

Outlook

Corroborating GovPay's specific circular details against CBSL's own primary published text would be the clearest way to move that finding from Uncertain to a firmer confidence rating. LANKAQR's continued merchant-acquirer growth, and whether its capped MDR structure is revisited as adoption scales further, are the product-development threads most worth tracking into the next cycle.

Periodic update · new data 2026-09-14

Product Innovation & Market Development

GovPay, described as Sri Lanka's first integrated digital government-payment platform, launched in early February 2025 with 16 government institutions initially integrated. The platform is a LankaPay and ICTA initiative operating under the Central Bank's purview, aimed at digitising government revenue collection and consolidating what had previously been a fragmented set of individual agency payment channels into a single integrated platform.

This is a probable, product-launch-level finding sourced to legal/advisory commentary rather than a primary CBSL announcement, and it is treated here as a discrete commercial/product development within the government-payments space rather than a structural market or regulatory-access theme. The platform's operation under existing Central Bank purview, rather than under any new dedicated legal instrument, distinguishes it from the licensing and scheme-rule developments recorded elsewhere this cycle: GovPay represents incremental infrastructure build-out using the existing regulatory architecture rather than a new rule or licensing pathway in itself.

The non-bank/bank distinction is less central to this development than to the licensing and scheme-rule items, since GovPay functions as a government-facing payment aggregation layer operating over existing rails (including, presumably, LankaPay-connected settlement infrastructure) rather than introducing a new class of regulated payment institution.

Outlook

Further integration of additional government institutions onto the GovPay platform, and any expansion of its scope beyond the initial 16 institutions, would be the natural next markers to track for this product's development trajectory.

Sources and findings (5)
  1. T4https://www.lightspark.com/knowledge/instant-payments-sri-lankaretrieved
  2. T1https://www.cbsl.gov.lk/en/financial-system/financial-infrastructure/payments-and-settlements-systemsretrieved
  3. T3https://conventuslaw.com/report/govpay-initiative-sri-lankas-first-integrated-digital-payment-platform/retrieved
  4. T3https://www.chamber.lk/wp-content/uploads/2024/05/Decoding-Sri-Lankas-FinTech-Regulatory-Sandbox.pdfretrieved
  5. T4https://coinfomania.com/cryptocurrency-regulations-in-sri-lanka/retrieved

#

Consumer protection runs through the Financial Consumer Protection Regulations No. 01 of 2023 and the FCRD complaint-handling/CMS infrastructure; there is no statutory mandatory APP-fraud reimbursement scheme; CBSL instead relies on public-awareness warnings, mandatory SMS alerting, and 2024 circulars tightening customer identification for mobile-payment-linked accounts.

Standing sub-brief · as of 8 July 202694 words · last cycle 2026-07-08

Consumer Protection & APP Fraud

The Financial Consumer Relations Department operates a Complaint Management System accessible 24/7, assigning Complaint Reference Numbers and referring non-compliant conduct to competent authorities. Sri Lanka has no mandatory authorised-push-payment fraud reimbursement scheme comparable to the UK's Payment Systems Regulator model; instead, CBSL relies on public-awareness warnings, mandatory SMS alerting and circulars tightening customer identification for mobile-payment-linked accounts.

no periodic updates on record for this sub-brief

Sources and findings (4)
  1. T1https://www.cbsl.gov.lk/en/fcrdretrieved
  2. T1https://www.cbsl.gov.lk/en/laws/directions-circulars-guidelines-on-payments-and-settlementsretrieved
  3. T1https://www.cbsl.gov.lk/en/news/beware-of-online-financial-frauds-and-scamsretrieved
  4. T1https://www.cbsl.gov.lk/en/news/the-central-bank-of-sri-lanka-requests-the-general-public-to-be-attentive-to-financial-scams-phishing-emailsretrieved

#

Sri Lanka's AML/CFT regime rests on the PMLA (2006), FTRA (2006) and CSTFA (2005), supervised by the FIU within CBSL under a National AML/CFT Policy 2023-2028; the country was grey-listed twice and delisted twice, and is undergoing its third FATF/APG mutual evaluation in 2026 under a revised effectiveness-focused methodology, with virtual-asset supervision (R.15) a key focus.

Horizon · 2026 (±year)Sri Lanka's third FATF/APG AML/CFT mutual evaluationconsultation · TT3
Horizon · 2026 (±year)Sri Lanka's third FATF/APG AML/CFT mutual evaluationconsultation · TT3
Horizon · 2026 (±year)Sri Lanka third FATF/APG AML-CFT mutual evaluation · TT3
Standing sub-brief · as of 8 July 2026131 words · last cycle 2026-07-08

AML/CFT & Financial Crime

This module carries Sentinel.gi-fed intelligence as provenance only; the World Payments Monitor does not perform independent illicit-finance analysis and readers should consult the Sentinel.gi feed directly for underlying AML/CFT detail. Sri Lanka's AML/CFT legal framework rests on the Prevention of Money Laundering Act, the Financial Transactions Reporting Act and the Convention on the Suppression of Terrorist Financing Act. The country is undergoing its third FATF/APG mutual evaluation in 2026 under a revised, effectiveness-focused methodology, with virtual-asset supervision under Recommendation 15 identified as a key focus area.

no periodic updates on record for this sub-brief

Sources and findings (8)
  1. T3sentinel.https://www.sundaytimes.lk/260201/business-times/sri-lanka-faces-risks-of-being-grey-listed-by-fatf-affecting-banking-relationships-and-investment-629877.html
  2. T?FIM (sentinel.gi) per-JID baseline profile — Sri Lanka — Sri Lanka operates AML/CFT under the Prevention of Money Laundering Act, Financial Transactions Reporting Act and Convention on Suppression of Terrorist Financing Act, supervised by the CBSL-housed Financial Intelligence Unit (Egmont member). Removed from the FATF grey list in 2019 and remains in APG enhanced follow-up. No dedicated virtual-asset/VASP regulatory regime exists, and beneficial-ownership transparency for trusts/legal persons remains weak, exploited by offshore professional facilitators.
  3. T1FIM (sentinel.gi) regulatory_horizon_register (issue FIM-BASE-HRZ-002) — New EU GSP Regulation applies, continuing Sri Lanka's GSP+ conditionality
  4. T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-002) — Gap: legal-gap
  5. T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-004) — Gap: absent-field-provenance
  6. T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-003) — Gap: capacity-deficit
  7. T2FIM (sentinel.gi) enforcement_action_register (issue FIM-BASE-ENF-002) — Enforcement: Sri Lanka Treasury / law enforcement — Unidentified cybercriminals behind Finance Ministry email-compromise fraud
  8. T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-001) — Gap: enforcement-absence

#

Correspondent banking access remains bank-mediated and FATF-status-sensitive: only Citibank operates directly as a US bank, while domestic commercial banks rely on correspondent relationships abroad; FIU has flagged that continuation depends on staying off the FATF grey list ahead of the 2026 mutual evaluation. Domestic settlement runs through CBSL's RTGS system and the US Dollar Cheque Clearing System.

Standing sub-brief · as of 8 July 2026137 words · last cycle 2026-07-08

Correspondent Banking, Settlement & Access

Correspondent banking access in Sri Lanka remains bank-mediated and asymmetric: domestic commercial banks depend on correspondent relationships abroad, and Citibank is reported as the sole bank operating as a direct US correspondent for the country. That dependency is explicitly FATF-status-sensitive — the Financial Intelligence Unit has warned that continuity of correspondent banking access depends on Sri Lanka avoiding grey-listing at the 2026 mutual evaluation, since a grey-list outcome would be expected to trigger counter-measures from partner jurisdictions with knock-on effects for credit ratings and insurance risk premia.

no periodic updates on record for this sub-brief

Sources and findings (4)
  1. T3https://www.trade.gov/country-commercial-guides/sri-lanka-trade-financingretrieved
  2. T3https://www.boc.lk/international-banking/send-money-to-sri-lanka/inward-remittance/inward-remittancesretrieved
  3. T3https://www.sundaytimes.lk/251005/news/sri-lanka-to-undergo-third-money-laundering-terrorism-financing-evaluation-in-2026-615149.htmlretrieved
  4. T1https://www.cbsl.gov.lk/sites/default/files/Payments_Bulletin_3Q2025_e.pdfretrieved

#

Trailing-12-month commercial activity in Sri Lankan payments/fintech is dominated by multilateral development financing rather than private M&A: a large IFC bank-recapitalisation package, GovPay's public-sector platform launch, and a cross-border fintech-sandbox partnership are the standout events; disclosed private equity/VC funding remains thin.

Standing sub-brief · as of 8 July 2026157 words · last cycle 2026-07-08

Commercial Intelligence (M&A, Investment & Product)

Three discrete commercial events anchor this cycle. The International Finance Corporation announced a USD 166 million investment programme — a USD 50 million loan, USD 80 million in risk-sharing facilities and a USD 36 million trade-finance guarantee — across Nations Trust Bank, Commercial Bank of Ceylon and National Development Bank, targeting SME and payments-adjacent lending expansion. GovPay launched on 7 February 2025 as the first of a planned trio of unified government digital-payment platforms; the launch value was not publicly disclosed. Separately, the FinTech Association of Sri Lanka announced a strategic collaboration with Singapore's APIX Platform, supporting cross-border fintech-sandbox connectivity across South and Southeast Asia; deal terms were not publicly disclosed.

no periodic updates on record for this sub-brief

Sources and findings (4)
  1. T1https://www.ifc.org/en/pressroom/2025/ifc-invests-166-million-to-support-sri-lankan-businesses-and-drive-economic-growthretrieved
  2. T3https://conventuslaw.com/report/govpay-initiative-sri-lankas-first-integrated-digital-payment-platform/retrieved
  3. T3https://en.wikipedia.org/wiki/Fintech_Association_of_Sri_Lankaretrieved
  4. T4https://tracxn.com/d/geographies/sri-lanka/__ourc51Of6fG7rz7-6lIcnYzFxUJWfCndqoO-6bgTTdsretrieved
No modules match.

Filters combine as OR inside a group and AND across groups.

Editorial metadata

Provenance only. Nothing below gates publication or affects the render.

Editorial metadata for Sri Lanka
FieldValue
trust.lawyer_review.statusnever_reviewed
trust.lawyer_review.reviewerno reviewer on record
trust.content_sourceai_generated

Provenance and declared absence

Disclosure model: module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is.

Sentinel-fed modules receive no special rendering treatment. sentinel_feed is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page.

Family taxonomy is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score; per-module RAG traffic light; derived_scores = {}.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-10-21. A year-precision row is never promoted into a tighter band.

Orphan deltas: 1 cycle_delta row(s) target non-module objects and are listed in the rail rather than attached to a card.

Envelope: baseline resolved at jurisdiction_json.baseline; 14 module(s), 67 finding(s), 124 source(s) in the cumulative register.

Think something on this page is wrong? Report an error.