title: Sri Lanka Payments Regulation Monitor | World Payments Monitor canonical: https://payments.gi/jurisdictions/sri-lanka/ date_modified: 2026-10-21 publisher: Asymmetric Intelligence # Sri Lanka LK schema world-payments-v1 trajectory: not yet assessed Last updated 2026-10-21 · 14 modules · 67 sourced findings · 124 sources in the cumulative register 14 Modules baseline.modules[] 67 Findings modules[].findings[] 56 Tier-1 sources run_metadata.t1_source_count Confidence mix (sums to 14 rendered modules; click to filter) No modules moved this cycle. ## Jurisdiction brief ###### Latest update · 18 October 2026 #### Lead Signal Sri Lanka is building a digital-asset regulatory perimeter from zero, with the Securities and Exchange Commission designated lead regulator and the first phase of coverage limited to licensed exchanges and custodians. Cabinet approved the underlying policy framework on 27 July 2026, naming the SEC as lead regulator for virtual assets and VASPs, coordinating with the Central Bank's Financial Intelligence Unit and the Inland Revenue Department, and establishing that crypto will be treated as an investment asset and never as legal tender. The framework's development is explicitly timed to satisfy Sri Lanka's forthcoming AML/CFT mutual evaluation rather than to support domestic payment innovation. #### Other Developments **A registration, KYC and STR regime is now planned for virtual asset service providers.** Reporting from 12 October 2026 confirms that VASPs will face mandatory registration, know-your-customer and suspicious-transaction-reporting duties under the forthcoming framework. This obligation does not yet exist in force; the relevant legislation remains in drafting, having progressed to the Legal Draftsman's Department on 24 September 2026, with no legal effective date yet set and no provision reference confirmed against a primary instrument. **The existing negative baseline continues to apply.** The Central Bank of Sri Lanka has not authorised any entity to operate a cryptocurrency exchange; cryptocurrency is not legal tender in Sri Lanka, and the Foreign Exchange Act bars debit and credit card payments for virtual-currency transactions. This remains the operative legal position for payment-instrument purposes even as the VASP policy framework and drafting legislation progress. #### Cross-Monitor Connections The VASP framework's Cabinet approval and drafting progression are the same underlying facts tracked by the financial-integrity monitor under its crypto/digital-assets domain and by the crypto monitor's licensing track; here the lens is payments and digital-money infrastructure specifically, with the SEC's designation as lead regulator and the planned KYC/STR regime read as determinants of how virtual-asset-linked payment flows will be gated once the framework takes effect. #### Outlook The VASP legislation is expected to reach Parliament around the first quarter of 2027, a timeframe that carries meaningful uncertainty given the drafting process remains incomplete. Until a bill is enacted, the current baseline, no authorised cryptocurrency exchange, no legal-tender status for virtual currency, and a Foreign Exchange Act bar on card payments for virtual-currency transactions, continues to govern how virtual-asset-linked payment flows may lawfully operate in Sri Lanka. The SEC's designation as lead regulator, rather than the Central Bank, is a structural choice worth tracking as the licensing detail emerges, since it signals an investment-asset framing for crypto rather than a payments-instrument framing. _3 earlier updates not shown here._ ###### Standing brief · as of 8 July 2026 _Written before the update above. Where they differ, the update is the more recent position._ #### Lead Signal Sri Lanka enters the World Payments Monitor's coverage this cycle with its first full baseline, and the standout finding is the 2023 formalisation of market-conduct supervision. The Central Bank of Sri Lanka's Financial Consumer Protection Regulations No. 01 of 2023 establish the country's first comprehensive market-conduct supervision regime, extending across all CBSL-regulated payment service providers rather than banks alone. The shift is structural rather than incremental: conduct oversight had previously sat as an adjunct to prudential supervision, whereas the 2023 Regulations create a standalone regime administered through the Financial Consumer Relations Department, with dedicated enforcement and referral powers reaching non-compliant conduct to competent authorities. That conduct build-out sits alongside a parallel expansion of the licensing perimeter: a dedicated regulation for money and value transfer service providers, Regulations No.01 of 2024 of 30 April 2024, brought MVTS providers under a CBSL licensing track separate from card and mobile-payment licensing, and payment-initiation and account-information PSPs are now required to hold professional indemnity insurance and to undertake AML/CFT risk assessments. Read together, these three instruments represent the most significant tightening of the non-bank payments perimeter since the Payment and Settlement Systems Act No. 28 of 2005 first vested the Central Bank of Sri Lanka as the sole authority able to license or operate a payment system in the country. #### Other Developments Beneath the conduct and licensing headline, the baseline surfaces a cluster of secondary developments. On card and scheme compliance, CBSL's Payments Bulletin for the third quarter of 2025 records 14 Licensed Commercial Banks and 4 Licensed Finance Companies as authorised card issuers and acquirers, while a separate Retail Payment Services and Card Schemes Regulation now brings card scheme operators themselves — not just issuers and acquirers — within CBSL's licensing perimeter, with a one-year transition window for incumbent schemes. Enforcement activity has been active: Nation Lanka Finance PLC had its licence cancelled effective 4 July 2025 under CBSL's resolution powers, following continuous Finance Business Act violations, and the Banking (Amendment) Act No. 24 of 2024 has meanwhile handed CBSL administrative fine powers that extend its enforcement toolkit beyond simple licence suspension or cancellation. On digital assets, Sri Lanka continues to operate without a dedicated stablecoin or virtual-asset statute, leaving crypto in a legal grey zone in which holding is not banned but banks have been barred since 2021 from processing crypto-linked card payments. The Financial Intelligence Unit has launched a mandatory VASP survey and a registration roadmap ahead of the 2026 mutual evaluation, aiming at FATF-aligned AML/CFT requirements for virtual asset service providers. A separate claim that CBSL-linked payment service providers enabled stablecoin payments for the tourism sector in April 2026 could not be corroborated against CBSL's own circulars or news pages during review and has been downgraded to Possible confidence pending official confirmation; it should be treated as unverified. Operational resilience rests on a Technology Risk and Resilience Framework that mandates round-the-clock security operations centres, annual penetration testing and cloud-risk notification for licensed finance companies. A claim that the CBSL Real-Time Gross Settlement system completed an ISO 20022 upgrade in 2024 rests on a single vendor source and was downgraded from Confirmed to Assessed on review, since CBSL's own 2026 Policy Agenda references a Payment System Roadmap for 2025-2027 without confirming a completed migration. On corridors, worker remittances remain Sri Lanka's dominant non-debt-creating foreign-exchange inflow, historically covering approximately 80 percent of the trade deficit, with the Middle East corridor — home to roughly 660,000 migrant workers — accounting for around half of total inflows and correspondingly exposed to regional conflict risk. In industry structure, the banking sector (24 Licensed Commercial Banks, 6 Licensed Specialised Banks and roughly 34 Licensed Finance Companies) continues to dominate financial-sector assets, and the International Finance Corporation has announced a USD 166 million investment programme across three private commercial banks — Nations Trust Bank, Commercial Bank of Ceylon and National Development Bank — combining loans, risk-sharing facilities and trade-finance guarantees aimed at SME and payments-adjacent lending. On product development, GovPay launched in February 2025 as the first of a planned trio of unified government digital-payment platforms, building on the CEFTS instant-payment switch that has provided 24/7 interbank transfers since 2015. On consumer protection, Sri Lanka has no mandatory authorised-push-payment fraud reimbursement scheme comparable to the UK's Payment Systems Regulator model, relying instead on FCRD complaint handling, public-awareness warnings and CBSL circulars tightening customer identification. #### Cross-Monitor Connections Sri Lanka's third FATF/APG mutual evaluation, due in 2026 under a revised effectiveness-focused methodology with virtual-asset supervision a specific point of focus, is the connective thread across this baseline. The AML/CFT legal framework itself — resting on the Prevention of Money Laundering Act, the Financial Transactions Reporting Act and the Convention on the Suppression of Terrorist Financing Act — is carried in this brief via the Sentinel.gi feed as provenance only; the World Payments Monitor does not perform independent illicit-finance analysis of that framework. What is squarely within scope here is the payments-market consequence: the Financial Intelligence Unit itself has warned that continuity of correspondent banking access depends on Sri Lanka avoiding grey-listing at the 2026 evaluation, a dependency made sharper by the fact that Citibank is reported as the sole direct US correspondent bank serving the country, with all other domestic banks reliant on correspondent relationships abroad. A grey-list outcome would be expected to trigger counter-measures from partner jurisdictions with knock-on effects for credit ratings and insurance risk premia. This correspondent-banking exposure, together with the still-unresolved stablecoin/VASP legislative gap, has been flagged to the Financial Intelligence Monitor as carrying illicit-finance and sanctions-evasion significance beyond the World Payments Monitor's market-access and conduct remit. #### Outlook The next several review cycles should watch three things in particular: whether the FIU's VASP registration roadmap converts into an enacted FTRA amendment ahead of the 2026 mutual evaluation, since no confirmed parliamentary timeline currently exists; whether CBSL issues any primary-source confirmation, or retraction, of the April 2026 tourism-sector stablecoin claim; and how the mutual evaluation outcome itself feeds through to correspondent banking continuity and the broader tightening trajectory already visible across the 2023-2024 conduct and licensing build-out. Commercial and investment activity in the interim looks set to remain dominated by multilateral development finance rather than private M&A or venture capital, reflecting a comparatively thin private capital market relative to regional fintech peers. trust tier: ai_unverified ###### Latest update · 18 October 2026 #### Regulatory Status Sri Lanka's payments-relevant regulatory position this cycle is defined by progress on a virtual-asset-service-provider framework rather than by any change to conventional payment licensing, corridors, or merchant-acquiring rules. Cabinet approved a policy framework on 27 July 2026 naming the Securities and Exchange Commission as lead regulator for virtual assets and VASPs, coordinating with the Central Bank's Financial Intelligence Unit and the Inland Revenue Department, with crypto to be treated as an investment asset rather than legal tender. The Ministry of Digital Economy's VASP concept paper reached the Legal Draftsman's Department on 24 September 2026, and reporting from 12 October 2026 confirms planned mandatory registration, KYC and suspicious-transaction-reporting duties for VASPs once the framework is enacted, timed ahead of Sri Lanka's AML/CFT mutual evaluation. Against this forward motion, the existing restrictive baseline continues unchanged: the Central Bank has not authorised any cryptocurrency exchange, virtual currency is not legal tender, and the Foreign Exchange Act bars card payments for virtual-currency purchases. No CBSL primary gazette or Direction confirming the VASP framework's detail was located this cycle; findings rest on T2 press reporting. #### Outlook The VASP legislation is expected to reach Parliament around the first quarter of 2027. The designation of the SEC, rather than the Central Bank, as lead regulator is the structural detail most worth tracking as licensing specifics emerge. _2 earlier updates not shown here._ ###### Standing brief · as of 8 July 2026 _Written before the update above. Where they differ, the update is the more recent position._ #### Regulatory Status Sri Lanka enters this baseline with a payments regulatory architecture centred on the Central Bank of Sri Lanka, sole authority under the Payment and Settlement Systems Act No. 28 of 2005 to license or operate a payment system in the country. Since 2023-2024 that architecture has tightened materially across licensing and conduct: the Financial Consumer Protection Regulations No. 01 of 2023 established the country's first comprehensive market-conduct regime, and a dedicated 2024 regulation brought money and value transfer service providers under CBSL licensing separate from card and mobile-payment licensing. Card scheme operators themselves have also been brought within the licensing perimeter under the Retail Payment Services and Card Schemes Regulation. Enforcement capacity has grown in parallel: the Banking (Amendment) Act No. 24 of 2024 gave CBSL administrative fine powers, applied most visibly in the July 2025 cancellation of Nation Lanka Finance PLC's licence. Digital-asset regulation remains the clearest gap: Sri Lanka has no dedicated stablecoin or virtual-asset statute, though the Financial Intelligence Unit has launched a mandatory VASP survey and registration roadmap ahead of the country's third FATF/APG mutual evaluation in 2026. Correspondent banking access remains bank-mediated, with Citibank the sole reported direct US correspondent, and the FIU has explicitly linked continuity of that access to avoiding grey-listing at the 2026 evaluation. Worker remittances, historically covering approximately 80 percent of the trade deficit and roughly half sourced from the Middle East, remain the jurisdiction's most systemically important payments corridor. #### Outlook The 2026 FATF/APG mutual evaluation is the single largest near-term determinant of Sri Lanka's payments-regulatory trajectory, with knock-on consequences for correspondent banking continuity and for whether the VASP registration roadmap converts into enacted legislation. Absent a grey-listing outcome, the conduct and licensing tightening already visible since 2023 looks set to continue, with commercial and investment activity in the interim remaining dominated by multilateral development finance rather than private M&A or venture capital. 14 of 14 modules Signal Density Selections OR within a group, AND across groups. Press / to search. ### W1a Licensing, Authorisation & Market Access Confirmed confirmed 2026-07-04 CBSL is the sole payments regulator under the PSS Act No. 28 of 2005; card issuers/acquirers and mobile payment/e-money operators are licensed under the Payment Cards and Mobile Payment Systems Regulations No. 1 of 2013; money/value transfer service providers were brought under a dedicated CBSL regulation in 2024; a FinTech Regulatory Sandbox has operated since 2018/2020 for pre-licensing testing. Standing sub-brief · as of 8 July 2026 136 words · last cycle 2026-09-21 #### Licensing, Authorisation & Market Access The Payment and Settlement Systems Act No. 28 of 2005 vests the Central Bank of Sri Lanka as the sole authority able to license or operate a payment system in the country; no other legal entity may commence or operate one without CBSL authorisation. Card issuers and acquirers, and mobile-payment operators, are licensed under a separate 2013 regulation, and in 2024 the Central Bank extended the licensing perimeter again: Regulations No.01 of 2024, dated 30 April 2024, brought money and value transfer service providers under a dedicated CBSL licensing and registration track distinct from card and mobile-payment licensing. #### Outlook Watch for further extension of the licensing perimeter as MVTS and card-scheme licensing beds in, and for how the FinTech Regulatory Sandbox interacts with new entrant testing under this expanding authorisation framework. Periodic update · new data 2026-09-21 #### Licensing, Authorisation & Market Access The Central Bank of Sri Lanka chairs the National Payments Council, the body responsible for making recommendations on the country's financial-infrastructure development, a role confirmed directly from CBSL's own published materials. This institutional structure sits at the centre of Sri Lanka's market-access framework for payments, coordinating the direction of infrastructure investments such as the RTGS upgrade and interbank settlement growth documented elsewhere this cycle. The bank-PSP layer is well established: 13 licensed acquirers were operational with 131,000 point-of-sale terminals as of 2024, reflecting a mature bank-led acquiring market rather than one dominated by non-bank payment institutions. This licensing and market-access structure provides the institutional backdrop against which newer entrants, such as GovPay, have launched, since any new payment product operating in Sri Lanka's market ultimately answers to CBSL's payments-and-settlement oversight rather than a separate non-bank licensing track. #### Outlook The National Payments Council's recommendations, and how they feed into the 2025-2027 National Payment System Roadmap's scheduled 2026 legal reforms, are the key developments to watch for this module. Whether that reform package alters the current bank-led acquiring structure, for instance by opening a distinct non-bank payment-institution licensing track, would be a material shift from the currently observed bank-PSP-dominant market access model. **1 earlier distinct update(s)** Periodic update · new data 2026-09-14 #### Licensing, Authorisation & Market Access Sri Lanka's Central Bank formalised a licensing regime for money or value transfer service providers this cycle. The Money or Value Transfer Service Providers Regulations No.01 of 2025 became effective on 13 January 2026, per the Central Bank of Sri Lanka's own circular index of directions, circulars and guidelines on payments and settlements. This is a confirmed, non-bank-specific licensing development: the regulations establish an MVTS registration and licensing pathway distinct from bank-authorisation routes, formalising the non-bank payment-services segment under a dedicated regulatory instrument for the first time. The regulation's legal foundation traces to section 59 of the Central Bank of Sri Lanka Act No.16 of 2023, which empowers the Central Bank to establish and operate fund-transfer and settlement systems and to issue system rules to participating institutions, both bank and non-bank. This foundational statutory power underlies both this cycle's MVTS licensing formalisation and the separate JustPay scheme-rule change recorded under Scheme & Network Compliance, indicating the Central Bank is actively exercising its post-2023 Act powers across multiple fronts of the payments landscape simultaneously. The bank-versus-non-bank distinction is material here: MVTS licensing applies specifically to non-bank payment-services providers, a segment that previously operated without a dedicated licensing framework of this kind. Providers now face a defined regulatory market-access gate that did not exist in this form prior to January 2026, a change with direct compliance implications for any non-bank entity offering money or value transfer services in or into Sri Lanka. #### Outlook The practical scope of the MVTS licensing regime, including specific application requirements, capital thresholds, and any exemptions, was not further detailed in sourced material this cycle beyond confirmation that the regime is now formalised and effective. Continued monitoring of CBSL's directions and circulars index is the appropriate channel for tracking implementation detail as it emerges. **Sources and findings (6)** 1. T1 [https://www.cbsl.gov.lk/sites/default/files/cbslweb_documents/laws/acts/en/Payment_setttlement_sys_act.pdf](https://www.cbsl.gov.lk/sites/default/files/cbslweb_documents/laws/acts/en/Payment_setttlement_sys_act.pdf) retrieved 2026-07-04 2. T1 [https://www.cbsl.gov.lk/en/financial-system/financial-infrastructure/payments-and-settlements-systems](https://www.cbsl.gov.lk/en/financial-system/financial-infrastructure/payments-and-settlements-systems) retrieved 2026-07-04 3. T1 [https://www.cbsl.gov.lk/en/laws/directions-circulars-guidelines-on-payments-and-settlements](https://www.cbsl.gov.lk/en/laws/directions-circulars-guidelines-on-payments-and-settlements) retrieved 2026-07-04 4. T3 [https://www.tamimi.com/law-update-articles/retail-payment-services-and-card-schemes-regulation/](https://www.tamimi.com/law-update-articles/retail-payment-services-and-card-schemes-regulation/) retrieved 2026-07-04 5. T3 [https://www.chamber.lk/wp-content/uploads/2024/05/Decoding-Sri-Lankas-FinTech-Regulatory-Sandbox.pdf](https://www.chamber.lk/wp-content/uploads/2024/05/Decoding-Sri-Lankas-FinTech-Regulatory-Sandbox.pdf) retrieved 2026-07-04 6. T3 [https://conventuslaw.com/report/govpay-initiative-sri-lankas-first-integrated-digital-payment-platform/](https://conventuslaw.com/report/govpay-initiative-sri-lankas-first-integrated-digital-payment-platform/) retrieved 2026-07-04 ### W1b Conduct, Safeguarding & Promotions Confirmed confirmed 2026-07-04 Market-conduct supervision was formalised for the first time in Sri Lanka via the Financial Consumer Protection Regulations No. 01 of 2023, administered by CBSL's FCRD; retail-payment-service PSPs offering payment initiation/account-information services must hold professional indemnity insurance and undertake AML/CFT risk assessments; conduct rules apply uniformly across CBSL-regulated FSPs including PSPs and card schemes. Standing sub-brief · as of 8 July 2026 137 words · last cycle 2026-09-28 #### Conduct, Safeguarding & Financial Promotions Market-conduct supervision in Sri Lanka was formalised for the first time via the Financial Consumer Protection Regulations No. 01 of 2023, administered by the Central Bank's Financial Consumer Relations Department, which holds full enforcement and referral powers over CBSL-regulated financial service providers. The conduct perimeter extends to non-bank payment service providers directly: firms offering payment-initiation and account-information services are required to hold professional indemnity insurance and to carry out an AML/CFT risk assessment, a conduct-adjacent obligation that sits alongside, rather than substitutes for, prudential licensing. #### Outlook Expect the Financial Consumer Relations Department's enforcement caseload to grow as the 2023 conduct regime beds in across both bank and non-bank PSPs; the professional-indemnity-insurance requirement for payment-initiation and account-information providers remains capped at Assessed confidence pending a T1 CBSL confirmation of the specific insurance quantum. Periodic update · new data 2026-09-28 #### Conduct, Safeguarding & Financial Promotions CBSL Circular No.03 of 2026, issued 13 March 2026, requires the Boards and Senior Management of licensed Mobile Phone based e-Money System operators to obtain formal declarations in terms of FATF Recommendation 26, which governs the adequacy of supervisory frameworks for financial institutions. This is a new AML-adjacent governance-conduct lever applied specifically to the non-bank payment-institution/e-money-institution (nonbank_pi_emi) category, distinct from the bank-based payment-system participants who are not the subject of this circular. The requirement places direct accountability on operator governance bodies rather than on operational compliance staff alone, elevating the seniority level at which FATF R.26 alignment must be affirmed. This development should be read against the bank-PSP versus non-bank-PI/EMI distinction that structures Sri Lanka's payments conduct regime more broadly: mobile-phone-based e-money operators, as non-bank licensees, face a bespoke governance-declaration obligation that a licensed commercial bank offering equivalent e-money-like functionality would not face under this specific circular. No enforcement action or penalty arising from this declaration requirement has been reported this cycle; the development is confined to the imposition of the requirement itself. #### Outlook The declaration requirement's practical significance will depend on how CBSL uses the resulting Board/Senior-Management attestations in ongoing supervision, and whether it is extended to other non-bank payment-licensee categories beyond mobile-phone-based e-money operators specifically. **Sources and findings (5)** 1. T1 [https://www.cbsl.gov.lk/en/news/regulations-on-financial-consumer-protection](https://www.cbsl.gov.lk/en/news/regulations-on-financial-consumer-protection) retrieved 2026-07-04 2. T3 [https://www.nithyapartners.com/journal/key-features-of-the-financial-consumer-protection-regulations](https://www.nithyapartners.com/journal/key-features-of-the-financial-consumer-protection-regulations) retrieved 2026-07-04 3. T3 [https://www.tamimi.com/law-update-articles/retail-payment-services-and-card-schemes-regulation/](https://www.tamimi.com/law-update-articles/retail-payment-services-and-card-schemes-regulation/) retrieved 2026-07-04 4. T1 [https://www.cbsl.gov.lk/en/fcrd](https://www.cbsl.gov.lk/en/fcrd) retrieved 2026-07-04 5. T1 [https://www.cbsl.gov.lk/en/news/cbsl-launches-the-complaint-management-system-for-financial-consumers](https://www.cbsl.gov.lk/en/news/cbsl-launches-the-complaint-management-system-for-financial-consumers) retrieved 2026-07-04 ### W2 Stablecoins & Digital Money Probable confirmed 2026-07-04 Sri Lanka has no dedicated stablecoin/virtual-asset statute in force; crypto exists in a legal grey zone. The FIU is running a mandatory VASP survey and CBSL has proposed FTRA amendments to bring VASPs under AML/CFT registration, with a licensing bill still pending as of mid-2026; a narrow tourism-sector stablecoin-payment channel via licensed intermediaries was reportedly piloted in 2026 (unconfirmed by CBSL primary sources), and CBDC exploration was shelved in 2023 on IMF concerns. Standing sub-brief · as of 8 July 2026 186 words · last cycle 2026-10-18 #### Stablecoins & Digital Money Sri Lanka has no dedicated stablecoin or virtual-asset statute in force, leaving crypto in a legal grey zone: holding is not banned, but banks have been barred since 2021 from processing crypto-linked card payments. Ahead of the country's third FATF/APG mutual evaluation, the Financial Intelligence Unit has launched a mandatory VASP survey and a registration roadmap aimed at bringing virtual asset service providers under FATF-aligned AML/CFT requirements. A separate report describes CBSL-linked payment service providers enabling stablecoin payments — reportedly USDT and USDC — for the tourism sector from April 2026; this claim rests on a single specialist crypto-news source and could not be corroborated against CBSL's own circulars or news pages during review, so it is carried here at Possible confidence only and should be treated as unverified pending official confirmation. #### Outlook The decisive variable is whether the FIU's VASP roadmap converts into an enacted FTRA amendment before the 2026 mutual evaluation; no confirmed parliamentary timeline for such a bill currently exists, and the unverified tourism stablecoin claim should either be corroborated by a CBSL primary source or retracted next cycle. Periodic update · new data 2026-10-18 #### Stablecoins & Digital Money Sri Lanka is constructing a digital-asset regulatory perimeter from a standing start, with the payments and digital-money implications of that construction centring on who will be allowed to operate what kind of service, and under whose supervision. Cabinet approved a policy framework on 27 July 2026 naming the Securities and Exchange Commission of Sri Lanka as the lead regulator for virtual assets and VASPs, coordinating with the Central Bank of Sri Lanka's Financial Intelligence Unit and the Inland Revenue Department. A specific and structurally significant element of this framework is that crypto will be treated as an investment asset, never as legal tender, a classification choice that positions the SEC rather than the Central Bank as the primary regulatory anchor for this sector going forward. The drafting process advanced further on 24 September 2026, when the Ministry of Digital Economy's VASP concept paper was sent to the Legal Draftsman's Department, with the first phase of the regime limited to licensed exchanges and custodians. Reporting from 12 October 2026 adds the operational detail that virtual asset service providers will be required to register, comply with know-your-customer rules, and report suspicious transactions once the framework is enacted, with this timing explicitly linked to Sri Lanka's approaching AML/CFT mutual evaluation rather than to a payments-innovation agenda. Against this forward-looking drafting activity, the existing baseline for digital-money and virtual-currency payment flows remains restrictive and unchanged. The Central Bank of Sri Lanka has not authorised any entity to operate a cryptocurrency exchange; virtual currency is not recognised as legal tender; and the Foreign Exchange Act explicitly bars resident cardholders from using debit or credit cards to make international payments for the purchase or trading of virtual currencies. This outbound card-payment restriction is a materially distinct constraint from the VASP licensing question, bank-and-nonbank payment-instrument providers alike face it today regardless of how the eventual VASP licensing regime is structured, since it operates under foreign-exchange control law rather than under the prospective VASP framework. No CBSL primary gazette, Direction or Circular text was located this cycle confirming the VASP framework's operational details; the W2 findings rest on T2 press reporting of Cabinet and ministry statements rather than a published regulatory instrument. This is a structural sourcing gap for a reform of this materiality to Sri Lanka's digital-money and payments landscape. #### Outlook The VASP legislation is expected to reach Parliament around the first quarter of 2027, though the timing carries substantial uncertainty given the drafting process remains incomplete. For payments-sector participants, the structural choice to designate the SEC as lead regulator rather than the Central Bank is the detail most worth tracking: it signals an investment-asset framing for crypto under Sri Lankan law, distinct from the e-money or payment-instrument framing that governs other digital-money products, and this framing will likely shape how any future stablecoin-specific rules, were they to be proposed, would be supervised. **Sources and findings (5)** 1. T3 [https://dailynews.lk/2026/05/06/features/990472/sri-lankas-crypto-regulation-roadmap-what-the-2026-framework-actually-means/](https://dailynews.lk/2026/05/06/features/990472/sri-lankas-crypto-regulation-roadmap-what-the-2026-framework-actually-means/) retrieved 2026-07-04 2. T4 [https://www.lightspark.com/knowledge/is-crypto-legal-in-sri-lanka](https://www.lightspark.com/knowledge/is-crypto-legal-in-sri-lanka) retrieved 2026-07-04 3. T3 [http://www.adaderana.lk/news/112860/is-cryptocurrency-legal-in-sri-lanka-central-bank-governor-explains](http://www.adaderana.lk/news/112860/is-cryptocurrency-legal-in-sri-lanka-central-bank-governor-explains) retrieved 2026-07-04 4. T4 [https://www.coinreporter.io/2026/04/sri-lanka-central-bank-integrates-crypto-payments-for-tourism-sector/](https://www.coinreporter.io/2026/04/sri-lanka-central-bank-integrates-crypto-payments-for-tourism-sector/) retrieved 2026-07-04 5. T4 [https://coinfomania.com/cryptocurrency-regulations-in-sri-lanka/](https://coinfomania.com/cryptocurrency-regulations-in-sri-lanka/) retrieved 2026-07-04 ### W3 Operational Resilience & Critical Infrastructure Confirmed confirmed 2026-07-04 CBSL regulates technology/cyber risk via Banking Act Directions No. 16 of 2021 (amended Dec 2023) and a parallel Technology Risk & Resilience framework for licensed finance companies; licensed banks must report IT/cybersecurity incidents to CBSL; the RTGS backbone is reported to have been upgraded to ISO 20022 in 2024 (not confirmed by CBSL primary sources). Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/sri-lanka/) Standing sub-brief · as of 8 July 2026 129 words · last cycle 2026-09-28 #### Operational Resilience & Critical Infrastructure Licensed finance companies operate under a Technology Risk and Resilience Framework that mandates round-the-clock security operations centres, annual penetration testing and cloud-adoption risk assessment, with notification to CBSL required before critical systems move to cloud. A separate claim that the CBSL Real-Time Gross Settlement system completed an ISO 20022 upgrade in 2024 rests on a single vendor knowledge-base source; CBSL's own 2026 Policy Agenda references a Payment System Roadmap for 2025-2027 without confirming a completed migration, so this claim has been downgraded from Confirmed to Assessed pending primary-source verification. #### Outlook The resilience framework itself is well established, but the RTGS ISO 20022 migration status should be treated as unconfirmed until CBSL publishes primary documentation; watch the 2025-2027 Payment System Roadmap for a definitive statement. Periodic update · new data 2026-09-28 #### Operational Resilience & Critical Infrastructure CBSL Circular No.04 of 2026, issued 25 May 2026, discontinues the Liability Manager Mechanism and implements new risk-mitigation mechanisms for CEFTS (the Common Electronic Fund Transfer Switch) and the Common ATM Switch. This is a structural change to how settlement risk is managed across Sri Lanka's core interbank retail-payments infrastructure, applying to both bank and non-bank participants in those systems. The retirement of a named liability-allocation mechanism in favour of new, as-yet-unspecified-in-detail risk-mitigation arrangements represents the kind of foundational infrastructure change that determines how losses and settlement failures are absorbed across the payments ecosystem, rather than a routine parameter update. This change sits within a broader pattern of active CBSL technical governance in 2026: alongside the CEFTS/Common ATM Switch risk-mitigation overhaul, the Central Bank also updated the national QR standard and tightened JustPay transaction parameters in the same period, suggesting a coordinated modernisation push across Sri Lanka's core payments rails rather than an isolated intervention. No incident or settlement failure prompting the change has been reported; the circular itself is the extent of the documented development this cycle. #### Outlook The key operational question is how the new CEFTS/Common ATM Switch risk-mitigation mechanisms perform under real transaction volume and, in particular, under any future settlement-stress scenario, since the prior Liability Manager Mechanism's discontinuation removes a previously known allocation-of-loss framework without yet having been tested by a live stress event. **1 earlier distinct update(s)** Periodic update · new data 2026-09-21 #### Operational Resilience & Critical Infrastructure Sri Lanka's core payments infrastructure has undergone significant modernisation. The Central Bank of Sri Lanka's RTGS system was upgraded to ISO 20022 compliance in 2024, aligning the country's high-value settlement rail with the international messaging standard increasingly adopted across major payment corridors. This upgrade sits alongside a marked structural shift in interbank settlement behaviour: LankaPay's CEFTS now handles 67% of interbank transactions, a dramatic rise from just 8% six years prior, indicating that real-time interbank settlement has moved from a marginal channel to the dominant one over a relatively short period. Both developments are Probable-confidence findings corroborated by CBSL's own payments-modernisation roadmap references, and both describe bank-and-scheme-level infrastructure resilience improvements rather than non-bank payment-institution-specific developments. The 2025-2027 National Payment System Roadmap schedules further legal reforms for 2026, indicating that this infrastructure modernisation is proceeding alongside, though so far ahead of, formal legal-framework updates. #### Outlook Whether the scheduled 2026 legal reforms under the National Payment System Roadmap keep pace with the infrastructure gains already achieved is the central question for this module going forward. The CEFTS growth trajectory, in particular, is worth monitoring for whether it continues at a comparable rate or begins to plateau as the interbank channel approaches saturation. **Sources and findings (4)** 1. T1 [https://www.cbsl.gov.lk/sites/default/files/cbslweb_documents/laws/consultation_paper_20210826_technology_risk_resilience_framework_lfc_e.pdf](https://www.cbsl.gov.lk/sites/default/files/cbslweb_documents/laws/consultation_paper_20210826_technology_risk_resilience_framework_lfc_e.pdf) retrieved 2026-07-04 2. T1 [https://www.cbsl.gov.lk/sites/default/files/cbslweb_documents/laws/banks.pdf](https://www.cbsl.gov.lk/sites/default/files/cbslweb_documents/laws/banks.pdf) retrieved 2026-07-04 3. T1 [https://www.cbsl.gov.lk/en/node/18517](https://www.cbsl.gov.lk/en/node/18517) retrieved 2026-07-04 4. T4 [https://www.lightspark.com/knowledge/instant-payments-sri-lanka](https://www.lightspark.com/knowledge/instant-payments-sri-lanka) retrieved 2026-07-04 ### W4 Scheme & Network Compliance Probable confirmed 2026-07-04 Card-scheme and network compliance rests on the Payment Cards and Mobile Payment Systems Regulations No. 1 of 2013 and the Credit Card Operational Guidelines No. 1 of 2010; CBSL's own national card scheme (LankaPay, with JCB International) operates as a lower-cost domestic alternative to international schemes; the Retail Payment Services and Card Schemes regulation extended licensing to Card Scheme operators themselves. Standing sub-brief · as of 8 July 2026 97 words · last cycle 2026-09-28 #### Scheme & Network Compliance CBSL's Payments Bulletin for the third quarter of 2025 records 14 Licensed Commercial Banks and 4 Licensed Finance Companies as authorised card issuers and acquirers. Card schemes themselves — not just issuing and acquiring banks — now require a CBSL licence under the Retail Payment Services and Card Schemes Regulation, with existing schemes given a one-year transition period to obtain one. #### Outlook Watch for the transition period's expiry to confirm which incumbent card schemes have secured licences, and for any interchange-fee guidance, an area where no cap regulation currently exists in Sri Lanka. Periodic update · new data 2026-09-28 #### Scheme & Network Compliance The LANKAQR National QR Code Standard, originally issued under CBSL Circular No.02 of 2026 on 13 March 2026, was updated via Addendum 1 on 17 June 2026, evidencing continued active technical maintenance of Sri Lanka's national QR-code payments scheme rather than a static, one-time standard-setting exercise. Separately, and with materially lower source confidence, a Cabinet-approved programme reported in March 2026 would introduce a fee-free tier for LankaQR transactions under LKR 5,000, intended to drive merchant and consumer adoption of the scheme. This fee-free element has not yet been corroborated by a Central Bank primary publication and rests on a single lower-tier news source; it should be treated as a reported initiative under development rather than a confirmed scheme rule. Taken together, the confirmed Addendum 1 update and the reported fee-free tier suggest LankaQR is in a period of active commercial and technical evolution, with the Central Bank using both technical-standard amendment and, potentially, fee-structure policy to expand the scheme's reach. #### Outlook Whether the reported fee-free sub-LKR-5,000 tier is confirmed through a Central Bank primary publication is the most consequential open item for this scheme; if confirmed, it would represent a deliberate low-value-transaction adoption strategy layered on top of the technical standard maintained through Addendum 1. **1 earlier distinct update(s)** Periodic update · new data 2026-09-14 #### Scheme & Network Compliance CBSL Circular No.1 of 2026, dated 20 January 2026, set new maximum per-transaction limits and fees for JustPay, Sri Lanka's domestic instant-payment scheme operating over the country's real-time settlement infrastructure. This is a confirmed scheme-rule change directly affecting transaction economics for participants in the JustPay network, arriving within a week of the Money or Value Transfer Service Providers Regulations No.01 of 2025 taking effect, a sequencing that suggests the Central Bank pursued a coordinated regulatory push covering both non-bank market entry and domestic scheme economics in the same short window in January 2026. JustPay operates on a bank-oriented settlement basis, and this circular's new transaction-limit and fee ceilings apply within that bank-participant structure. The change is material for participating institutions' transaction pricing and limit-setting practices going forward, since the circular imposes binding maximums rather than merely guidance-level recommendations. The circular is issued under the Central Bank's standing regulatory authority over payment systems established through directions, circulars and guidelines on payments and settlements, the same channel through which the MVTS licensing regulation was published. This shared publication channel underscores that both developments are part of the Central Bank's ordinary regulatory rule-making process rather than emergency or reactive interventions. #### Outlook The specific numeric values of the new JustPay per-transaction limits and fees were not detailed in sourced material this cycle beyond confirmation that the circular sets such maximums. Tracking the practical effect of these new limits on JustPay transaction volumes and participant behaviour over the coming cycles would clarify whether the rule change materially altered usage patterns. **Sources and findings (4)** 1. T1 [https://www.cbsl.gov.lk/sites/default/files/Payments_Bulletin_3Q2025_e.pdf](https://www.cbsl.gov.lk/sites/default/files/Payments_Bulletin_3Q2025_e.pdf) retrieved 2026-07-04 2. T3 [https://www.tamimi.com/law-update-articles/retail-payment-services-and-card-schemes-regulation/](https://www.tamimi.com/law-update-articles/retail-payment-services-and-card-schemes-regulation/) retrieved 2026-07-04 3. T3 [https://www.lankapay.net/en/for-you/national-card](https://www.lankapay.net/en/for-you/national-card) retrieved 2026-07-04 4. T3 [https://www.lankaclear.com/products-and-services/ncs/](https://www.lankaclear.com/products-and-services/ncs/) retrieved 2026-07-04 ### W5 Payment Corridor Dynamics Probable confirmed 2026-07-04 Worker remittances are Sri Lanka's largest non-debt-creating FX inflow, roughly half originating from the Middle East and channelled through banks, exchange houses and the Lanka Remit app; a China-tourism corridor runs via LANKAQR-UnionPay integration; the India corridor remains restricted to formal banking channels. Standing sub-brief · as of 8 July 2026 111 words · last cycle 2026-07-08 #### Payment Corridor Dynamics Worker remittances remain Sri Lanka's largest non-debt-creating foreign-exchange inflow, historically covering approximately 80 percent of the trade deficit; the Foreign Remittance Facilitation Department was established in November 2021 to streamline these flows. The Middle East corridor accounts for roughly half of total worker remittances and is home to an estimated 660,000 Sri Lankan migrant workers, leaving this single corridor exposed to regional conflict risk. #### Outlook The Middle East corridor's weight in total remittance inflows makes it the single largest corridor-level vulnerability in the payments system; any escalation of regional conflict risk would be expected to show up quickly in remittance-flow data and FX-inflow coverage of the trade deficit. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T1 [https://www.cbsl.gov.lk/en/workers-remittances](https://www.cbsl.gov.lk/en/workers-remittances) retrieved 2026-07-04 2. T3 [https://www.ips.lk/talkingeconomics/2026/03/24/middle-east-conflict-the-impact-on-migration-and-remittances-in-sri-lanka/](https://www.ips.lk/talkingeconomics/2026/03/24/middle-east-conflict-the-impact-on-migration-and-remittances-in-sri-lanka/) retrieved 2026-07-04 3. T1 [https://www.cbsl.gov.lk/en/workers-remittances/national-remittance-mobile-application](https://www.cbsl.gov.lk/en/workers-remittances/national-remittance-mobile-application) retrieved 2026-07-04 4. T4 [https://www.lightspark.com/knowledge/instant-payments-sri-lanka](https://www.lightspark.com/knowledge/instant-payments-sri-lanka) retrieved 2026-07-04 ### W6 Industry Structure & Commercial Probable confirmed 2026-07-04 Sri Lanka's bank-dominated financial sector comprises 24 Licensed Commercial Banks, 6 Licensed Specialised Banks and ~34-37 Licensed Finance Companies, with state-owned banks holding roughly half of banking assets; a growing fintech layer coexists with banks; multilateral development finance (IFC) is actively recapitalising private commercial banks. Standing sub-brief · as of 8 July 2026 128 words · last cycle 2026-07-08 #### Industry Structure & Commercial Dynamics Sri Lanka's financial sector remains bank-dominated: 24 Licensed Commercial Banks, 6 Licensed Specialised Banks and roughly 34 Licensed Finance Companies account for the great majority of financial-sector assets, with state-owned banks holding a substantial share of banking-sector assets. Against this backdrop, the International Finance Corporation announced a USD 166 million investment programme spanning loans, risk-sharing facilities and a trade-finance guarantee across three private commercial banks — Nations Trust Bank, Commercial Bank of Ceylon and National Development Bank — aimed at expanding SME and payments-adjacent lending. #### Outlook The IFC programme is currently the dominant commercial-structure signal in Sri Lankan banking; watch for whether other DFIs follow with comparable recapitalisation programmes, and for any resulting shift in the balance between state-owned and private commercial banks. no periodic updates on record for this sub-brief ** Sources and findings (5)** 1. T3 [https://chambers.com/content/item/5577](https://chambers.com/content/item/5577) Applies beyond this jurisdiction (World Bank) retrieved 2026-07-04 2. T1 [https://documents1.worldbank.org/curated/en/099040423094026887/pdf/P1808610591960010ab7d024d3bb621deb.pdf](https://documents1.worldbank.org/curated/en/099040423094026887/pdf/P1808610591960010ab7d024d3bb621deb.pdf) retrieved 2026-07-04 3. T3 [https://en.wikipedia.org/wiki/Fintech_Association_of_Sri_Lanka](https://en.wikipedia.org/wiki/Fintech_Association_of_Sri_Lanka) retrieved 2026-07-04 4. T1 [https://www.ifc.org/en/pressroom/2025/ifc-invests-166-million-to-support-sri-lankan-businesses-and-drive-economic-growth](https://www.ifc.org/en/pressroom/2025/ifc-invests-166-million-to-support-sri-lankan-businesses-and-drive-economic-growth) retrieved 2026-07-04 5. T4 [https://tracxn.com/d/explore/fintech-startups-in-sri-lanka/giCu69LvGbU7cFiY4hLvCUuRM_npJ_3I2V8PI1G_1Vs/companies](https://tracxn.com/d/explore/fintech-startups-in-sri-lanka/giCu69LvGbU7cFiY4hLvCUuRM_npJ_3I2V8PI1G_1Vs/companies) retrieved 2026-07-04 ### W7 Legal & Litigation Probable confirmed 2026-07-04 Recent enforcement centres on CBSL's expanded resolution and administrative-fine powers under the Banking (Special Provisions) Act No. 17 of 2023 and the Banking (Amendment) Act No. 24 of 2024: a finance-company licence cancellation (Nation Lanka Finance PLC, July 2025), unauthorised deposit-taking enforcement, and an internal-fraud disclosure at NDB (2026) are the most current live matters. Standing sub-brief · as of 8 July 2026 115 words · last cycle 2026-07-08 #### Legal & Litigation Nation Lanka Finance PLC had its licence cancelled effective 4 July 2025 under the Central Bank's resolution powers, following continuous violations of the Finance Business Act; an Administrator was appointed to manage the wind-down. This action draws on an enforcement toolkit that has itself been strengthened: the Banking (Amendment) Act No. 24 of 2024 granted CBSL administrative fine powers that extend its supervisory reach beyond the older binary of licence suspension or cancellation. #### Outlook Expect further resolution or enforcement actions to be tested against this newly expanded toolkit; the Nation Lanka Finance PLC wind-down remains the clearest live test case of CBSL's resolution powers under the 2023 Banking (Special Provisions) Act framework. no periodic updates on record for this sub-brief ** Sources and findings (5)** 1. T1 [https://www.cbsl.gov.lk/](https://www.cbsl.gov.lk/) retrieved 2026-07-04 2. T1 [https://www.cbsl.gov.lk/](https://www.cbsl.gov.lk/) retrieved 2026-07-04 3. T1 [https://www.cbsl.gov.lk/en/node/20190](https://www.cbsl.gov.lk/en/node/20190) retrieved 2026-07-04 4. T3 [https://dailynews.lk/2026/05/06/features/990472/sri-lankas-crypto-regulation-roadmap-what-the-2026-framework-actually-means/](https://dailynews.lk/2026/05/06/features/990472/sri-lankas-crypto-regulation-roadmap-what-the-2026-framework-actually-means/) retrieved 2026-07-04 5. T1 [https://www.cbsl.gov.lk/sites/default/files/cbslweb_documents/laws/banks.pdf](https://www.cbsl.gov.lk/sites/default/files/cbslweb_documents/laws/banks.pdf) retrieved 2026-07-04 ### W8 Merchant Acquiring & Risk Probable confirmed 2026-07-04 Merchant acquiring is licensed under the Payment Cards and Mobile Payment Systems Regulations, with a blend of bank acquirers and fintech PSPs offering preferential LankaPay-linked fees; fraud risk is moderate but growing, with 3DS/velocity checks recommended; cross-border settlements carry withholding tax and VAT considerations. Standing sub-brief · as of 8 July 2026 97 words · last cycle 2026-07-08 #### Merchant Acquiring & Risk Merchant acquiring in Sri Lanka blends bank acquirers and fintech payment service providers, with LankaPay-linked fee incentives positioned as a lower-cost domestic alternative to international-scheme acquiring costs. Card-testing fraud is an active operational concern, with 3D Secure authentication and velocity checks recommended as standard controls, and cross-border merchant settlement carries a roughly 14 percent withholding tax and 8 percent VAT. #### Outlook Watch for further formalisation of acquiring-side fraud controls as card-not-present volumes grow, and for how the LankaPay fee-incentive structure evolves relative to the international card schemes now themselves subject to CBSL licensing. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T4 [https://payatlas.com/countries/sri-lanka-lk](https://payatlas.com/countries/sri-lanka-lk) retrieved 2026-07-04 2. T4 [https://payatlas.com/countries/sri-lanka-lk](https://payatlas.com/countries/sri-lanka-lk) retrieved 2026-07-04 3. T1 [https://www.cbsl.gov.lk/sites/default/files/Payments_Bulletin_3Q2025_e.pdf](https://www.cbsl.gov.lk/sites/default/files/Payments_Bulletin_3Q2025_e.pdf) retrieved 2026-07-04 4. T3 [https://www.lankaclear.com/products-and-services/ncs/](https://www.lankaclear.com/products-and-services/ncs/) retrieved 2026-07-04 ### W9 Product Innovation & Market Development Probable confirmed 2026-07-04 Product innovation is anchored around CBSL/LankaClear infrastructure: CEFTS, LANKAQR, GovPay (launched Feb 2025), a national card scheme co-branded with JCB, and an active FinTech Regulatory Sandbox; CBDC work has been paused since 2023. Standing sub-brief · as of 8 July 2026 91 words · last cycle 2026-09-28 #### Product Innovation & Market Development The CEFTS instant-payment switch has provided 24/7 interbank fund transfers since 2015, with request-to-pay functionality and no cut-off times, forming the core real-time payments backbone. GovPay launched on 7 February 2025 as the first of a planned trio of unified government digital-payment platforms, built within the existing legal framework rather than requiring new primary legislation. #### Outlook Watch for the second and third instalments of the government's digital-payment platform trio to follow GovPay, and for whether CEFTS-linked infrastructure is extended further into cross-border or corridor-specific use cases. Periodic update · new data 2026-09-28 #### Product Innovation & Market Development CBSL Circular No.01 of 2026, issued 20 January 2026, sets the maximum per-transaction limit and applicable fees for JustPay, the CEFTS-based account-to-account payments product available to both bank and non-bank participants. This represents a tightening of the commercial parameters governing an established instant-payments product rather than the launch of a new one, and it was the earliest of several CBSL payments-infrastructure interventions issued across the first half of 2026. JustPay's positioning as a CEFTS-based product connects this parameter revision to the broader infrastructure changes made later in the year, including the CEFTS/Common ATM Switch risk-mitigation overhaul under Circular No.04 of 2026; a transaction-limit and fee revision at the start of the year appears, in retrospect, to be part of a wider annual programme of CEFTS-ecosystem adjustment rather than an isolated product change. #### Outlook Whether CBSL follows this transaction-limit and fee revision with further JustPay-specific product development, as opposed to further infrastructure-level CEFTS changes, will indicate whether 2026's payments modernisation push is primarily about product commercial terms or about underlying settlement-risk architecture. **2 earlier distinct update(s)** Periodic update · new data 2026-09-21 #### Product Innovation & Market Development Two distinct product developments define this module for Sri Lanka this cycle. GovPay, a government payment channel, launched on 7 February 2025 under CBSL Payment and Settlement Systems Circular No. 01 of 2025, which caps applicable fees, and Circular No. 02 of 2025, which establishes the operational framework. This finding carries Uncertain confidence, sourced from a Tier-4 encyclopedia entry without corroboration against the primary circular text this cycle, though the launch date and the two-circular structure are specific enough to be treated as a short dated dashboard entry rather than a fully substantiated standing item. Separately, and with stronger sourcing, LANKAQR has achieved broad national merchant coverage: the interoperable QR standard now serves over 400,000 merchants via 22 acquirers and more than 30 participating apps, at a merchant discount rate capped between 0.5% and 1%. This is a Probable-confidence finding demonstrating that Sri Lanka's interoperable QR payment layer has reached significant retail-market penetration under a controlled-cost structure, both through bank and non-bank participating channels. #### Outlook Corroborating GovPay's specific circular details against CBSL's own primary published text would be the clearest way to move that finding from Uncertain to a firmer confidence rating. LANKAQR's continued merchant-acquirer growth, and whether its capped MDR structure is revisited as adoption scales further, are the product-development threads most worth tracking into the next cycle. Periodic update · new data 2026-09-14 #### Product Innovation & Market Development GovPay, described as Sri Lanka's first integrated digital government-payment platform, launched in early February 2025 with 16 government institutions initially integrated. The platform is a LankaPay and ICTA initiative operating under the Central Bank's purview, aimed at digitising government revenue collection and consolidating what had previously been a fragmented set of individual agency payment channels into a single integrated platform. This is a probable, product-launch-level finding sourced to legal/advisory commentary rather than a primary CBSL announcement, and it is treated here as a discrete commercial/product development within the government-payments space rather than a structural market or regulatory-access theme. The platform's operation under existing Central Bank purview, rather than under any new dedicated legal instrument, distinguishes it from the licensing and scheme-rule developments recorded elsewhere this cycle: GovPay represents incremental infrastructure build-out using the existing regulatory architecture rather than a new rule or licensing pathway in itself. The non-bank/bank distinction is less central to this development than to the licensing and scheme-rule items, since GovPay functions as a government-facing payment aggregation layer operating over existing rails (including, presumably, LankaPay-connected settlement infrastructure) rather than introducing a new class of regulated payment institution. #### Outlook Further integration of additional government institutions onto the GovPay platform, and any expansion of its scope beyond the initial 16 institutions, would be the natural next markers to track for this product's development trajectory. **Sources and findings (5)** 1. T4 [https://www.lightspark.com/knowledge/instant-payments-sri-lanka](https://www.lightspark.com/knowledge/instant-payments-sri-lanka) retrieved 2026-07-04 2. T1 [https://www.cbsl.gov.lk/en/financial-system/financial-infrastructure/payments-and-settlements-systems](https://www.cbsl.gov.lk/en/financial-system/financial-infrastructure/payments-and-settlements-systems) retrieved 2026-07-04 3. T3 [https://conventuslaw.com/report/govpay-initiative-sri-lankas-first-integrated-digital-payment-platform/](https://conventuslaw.com/report/govpay-initiative-sri-lankas-first-integrated-digital-payment-platform/) retrieved 2026-07-04 4. T3 [https://www.chamber.lk/wp-content/uploads/2024/05/Decoding-Sri-Lankas-FinTech-Regulatory-Sandbox.pdf](https://www.chamber.lk/wp-content/uploads/2024/05/Decoding-Sri-Lankas-FinTech-Regulatory-Sandbox.pdf) retrieved 2026-07-04 5. T4 [https://coinfomania.com/cryptocurrency-regulations-in-sri-lanka/](https://coinfomania.com/cryptocurrency-regulations-in-sri-lanka/) retrieved 2026-07-04 ### W10 Consumer Protection & APP Fraud Probable confirmed 2026-07-04 Consumer protection runs through the Financial Consumer Protection Regulations No. 01 of 2023 and the FCRD complaint-handling/CMS infrastructure; there is no statutory mandatory APP-fraud reimbursement scheme; CBSL instead relies on public-awareness warnings, mandatory SMS alerting, and 2024 circulars tightening customer identification for mobile-payment-linked accounts. Standing sub-brief · as of 8 July 2026 94 words · last cycle 2026-07-08 #### Consumer Protection & APP Fraud The Financial Consumer Relations Department operates a Complaint Management System accessible 24/7, assigning Complaint Reference Numbers and referring non-compliant conduct to competent authorities. Sri Lanka has no mandatory authorised-push-payment fraud reimbursement scheme comparable to the UK's Payment Systems Regulator model; instead, CBSL relies on public-awareness warnings, mandatory SMS alerting and circulars tightening customer identification for mobile-payment-linked accounts. #### Outlook The absence of a mandatory APP-fraud reimbursement scheme remains a structural gap relative to reimbursement-model jurisdictions; watch for whether the FCRD's complaint-handling data eventually builds a case for a mandatory scheme. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T1 [https://www.cbsl.gov.lk/en/fcrd](https://www.cbsl.gov.lk/en/fcrd) retrieved 2026-07-04 2. T1 [https://www.cbsl.gov.lk/en/laws/directions-circulars-guidelines-on-payments-and-settlements](https://www.cbsl.gov.lk/en/laws/directions-circulars-guidelines-on-payments-and-settlements) retrieved 2026-07-04 3. T1 [https://www.cbsl.gov.lk/en/news/beware-of-online-financial-frauds-and-scams](https://www.cbsl.gov.lk/en/news/beware-of-online-financial-frauds-and-scams) retrieved 2026-07-04 4. T1 [https://www.cbsl.gov.lk/en/news/the-central-bank-of-sri-lanka-requests-the-general-public-to-be-attentive-to-financial-scams-phishing-emails](https://www.cbsl.gov.lk/en/news/the-central-bank-of-sri-lanka-requests-the-general-public-to-be-attentive-to-financial-scams-phishing-emails) retrieved 2026-07-04 ### W11 AML/CFT & Financial Crime (Sentinel.gi-fed) [Sourced from Sentinel.gi ↗](https://sentinel.gi/jurisdictions/sri-lanka/#sec-dom-D7) Probable confirmed 2026-07-04 Sri Lanka's AML/CFT regime rests on the PMLA (2006), FTRA (2006) and CSTFA (2005), supervised by the FIU within CBSL under a National AML/CFT Policy 2023-2028; the country was grey-listed twice and delisted twice, and is undergoing its third FATF/APG mutual evaluation in 2026 under a revised effectiveness-focused methodology, with virtual-asset supervision (R.15) a key focus. Horizon · 2026 (±year) Sri Lanka's third FATF/APG AML/CFT mutual evaluation_consultation · TT3_ Horizon · 2026 (±year) Sri Lanka's third FATF/APG AML/CFT mutual evaluation_consultation · TT3_ Horizon · 2026 (±year) Sri Lanka third FATF/APG AML-CFT mutual evaluation_ · TT3_ Standing sub-brief · as of 8 July 2026 131 words · last cycle 2026-07-08 #### AML/CFT & Financial Crime This module carries Sentinel.gi-fed intelligence as provenance only; the World Payments Monitor does not perform independent illicit-finance analysis and readers should consult the Sentinel.gi feed directly for underlying AML/CFT detail. Sri Lanka's AML/CFT legal framework rests on the Prevention of Money Laundering Act, the Financial Transactions Reporting Act and the Convention on the Suppression of Terrorist Financing Act. The country is undergoing its third FATF/APG mutual evaluation in 2026 under a revised, effectiveness-focused methodology, with virtual-asset supervision under Recommendation 15 identified as a key focus area. #### Outlook The 2026 mutual evaluation outcome is the single largest AML/CFT-adjacent variable for Sri Lanka's payments sector this cycle; see the Sentinel.gi feed for ongoing illicit-finance analysis and the Financial Intelligence Monitor for the cross-monitor read-through on correspondent-banking and sanctions exposure. no periodic updates on record for this sub-brief ** Sources and findings (8)** 1. T3 sentinel.https://www.sundaytimes.lk/260201/business-times/sri-lanka-faces-risks-of-being-grey-listed-by-fatf-affecting-banking-relationships-and-investment-629877.html 2. T? FIM (sentinel.gi) per-JID baseline profile — Sri Lanka — Sri Lanka operates AML/CFT under the Prevention of Money Laundering Act, Financial Transactions Reporting Act and Convention on Suppression of Terrorist Financing Act, supervised by the CBSL-housed Financial Intelligence Unit (Egmont member). Removed from the FATF grey list in 2019 and remains in APG enhanced follow-up. No dedicated virtual-asset/VASP regulatory regime exists, and beneficial-ownership transparency for trusts/legal persons remains weak, exploited by offshore professional facilitators. 3. T1 FIM (sentinel.gi) regulatory_horizon_register (issue FIM-BASE-HRZ-002) — New EU GSP Regulation applies, continuing Sri Lanka's GSP+ conditionality 4. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-002) — Gap: legal-gap 5. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-004) — Gap: absent-field-provenance 6. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-003) — Gap: capacity-deficit 7. T2 FIM (sentinel.gi) enforcement_action_register (issue FIM-BASE-ENF-002) — Enforcement: Sri Lanka Treasury / law enforcement — Unidentified cybercriminals behind Finance Ministry email-compromise fraud 8. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-001) — Gap: enforcement-absence ### W12 Correspondent Banking, Settlement & Access Probable confirmed 2026-07-04 Correspondent banking access remains bank-mediated and FATF-status-sensitive: only Citibank operates directly as a US bank, while domestic commercial banks rely on correspondent relationships abroad; FIU has flagged that continuation depends on staying off the FATF grey list ahead of the 2026 mutual evaluation. Domestic settlement runs through CBSL's RTGS system and the US Dollar Cheque Clearing System. Standing sub-brief · as of 8 July 2026 137 words · last cycle 2026-07-08 #### Correspondent Banking, Settlement & Access Correspondent banking access in Sri Lanka remains bank-mediated and asymmetric: domestic commercial banks depend on correspondent relationships abroad, and Citibank is reported as the sole bank operating as a direct US correspondent for the country. That dependency is explicitly FATF-status-sensitive — the Financial Intelligence Unit has warned that continuity of correspondent banking access depends on Sri Lanka avoiding grey-listing at the 2026 mutual evaluation, since a grey-list outcome would be expected to trigger counter-measures from partner jurisdictions with knock-on effects for credit ratings and insurance risk premia. #### Outlook Correspondent banking continuity is the single clearest transmission channel between Sri Lanka's AML/CFT evaluation outcome and its payments-market access; the bank-mediated, single-correspondent structure means that any adverse 2026 mutual evaluation finding would be expected to propagate quickly into cross-border settlement capacity for domestic banks. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T3 [https://www.trade.gov/country-commercial-guides/sri-lanka-trade-financing](https://www.trade.gov/country-commercial-guides/sri-lanka-trade-financing) retrieved 2026-07-04 2. T3 [https://www.boc.lk/international-banking/send-money-to-sri-lanka/inward-remittance/inward-remittances](https://www.boc.lk/international-banking/send-money-to-sri-lanka/inward-remittance/inward-remittances) retrieved 2026-07-04 3. T3 [https://www.sundaytimes.lk/251005/news/sri-lanka-to-undergo-third-money-laundering-terrorism-financing-evaluation-in-2026-615149.html](https://www.sundaytimes.lk/251005/news/sri-lanka-to-undergo-third-money-laundering-terrorism-financing-evaluation-in-2026-615149.html) retrieved 2026-07-04 4. T1 [https://www.cbsl.gov.lk/sites/default/files/Payments_Bulletin_3Q2025_e.pdf](https://www.cbsl.gov.lk/sites/default/files/Payments_Bulletin_3Q2025_e.pdf) retrieved 2026-07-04 ### W13 Commercial Intelligence (M&A, Investment & Product) Probable confirmed 2026-07-04 Trailing-12-month commercial activity in Sri Lankan payments/fintech is dominated by multilateral development financing rather than private M&A: a large IFC bank-recapitalisation package, GovPay's public-sector platform launch, and a cross-border fintech-sandbox partnership are the standout events; disclosed private equity/VC funding remains thin. Standing sub-brief · as of 8 July 2026 157 words · last cycle 2026-07-08 #### Commercial Intelligence (M&A, Investment & Product) Three discrete commercial events anchor this cycle. The International Finance Corporation announced a USD 166 million investment programme — a USD 50 million loan, USD 80 million in risk-sharing facilities and a USD 36 million trade-finance guarantee — across Nations Trust Bank, Commercial Bank of Ceylon and National Development Bank, targeting SME and payments-adjacent lending expansion. GovPay launched on 7 February 2025 as the first of a planned trio of unified government digital-payment platforms; the launch value was not publicly disclosed. Separately, the FinTech Association of Sri Lanka announced a strategic collaboration with Singapore's APIX Platform, supporting cross-border fintech-sandbox connectivity across South and Southeast Asia; deal terms were not publicly disclosed. #### Outlook Commercial activity in Sri Lankan payments remains dominated by multilateral development finance rather than private M&A or venture capital; disclosed private-capital signal remains thin, and the next test will be whether the FASL-APIX collaboration produces any disclosed sandbox deal-flow. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T1 [https://www.ifc.org/en/pressroom/2025/ifc-invests-166-million-to-support-sri-lankan-businesses-and-drive-economic-growth](https://www.ifc.org/en/pressroom/2025/ifc-invests-166-million-to-support-sri-lankan-businesses-and-drive-economic-growth) retrieved 2026-07-04 2. T3 [https://conventuslaw.com/report/govpay-initiative-sri-lankas-first-integrated-digital-payment-platform/](https://conventuslaw.com/report/govpay-initiative-sri-lankas-first-integrated-digital-payment-platform/) retrieved 2026-07-04 3. T3 [https://en.wikipedia.org/wiki/Fintech_Association_of_Sri_Lanka](https://en.wikipedia.org/wiki/Fintech_Association_of_Sri_Lanka) retrieved 2026-07-04 4. T4 [https://tracxn.com/d/geographies/sri-lanka/ourc51Of6fG7rz7-6lIcnYzFxUJWfCndqoO-6bgTTds](https://tracxn.com/d/geographies/sri-lanka/ourc51Of6fG7rz7-6lIcnYzFxUJWfCndqoO-6bgTTds) retrieved 2026-07-04 ** No modules match.** Filters combine as OR inside a group and AND across groups. ## Editorial metadata Provenance only. Nothing below gates publication or affects the render. Editorial metadata for Sri Lanka| Field | Value | |---|---| | `trust.lawyer_review.status` | never_reviewed | | `trust.lawyer_review.reviewer` | no reviewer on record | | ` trust.content_source` | ai_generated | ## Provenance and declared absence **Disclosure model:** module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is. **Sentinel-fed modules** receive no special rendering treatment. `sentinel_feed` is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page. **Family taxonomy** is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning. **Suppressed by doctrine:** derived risk score; per-module RAG traffic light; `derived_scores` = `{}`. **Band honesty:** uncertainty bands are computed against a frozen build clock of 2026-10-21. A year-precision row is never promoted into a tighter band. **Orphan deltas:** 1 cycle_delta row(s) target non-module objects and are listed in the rail rather than attached to a card. **Envelope:** baseline resolved at `jurisdiction_json.baseline`; 14 module(s), 67 finding(s), 124 source(s) in the cumulative register. Think something on this page is wrong? [Report an error](https://payments.gi/legal/#contact).