Sri Lanka LK

The beneficial-ownership regime of Sri Lanka itself, not the EU regime, is the primary subject of this cycle D2 signal. The Companies (Amendment) Act No. 12 of 2025 and the Companies (Beneficial Ownership) Regulation No. 1 of 2026 came into force on 30 March 2026, requiring all Sri Lankan companies, including offshore and overseas-registered entities, to disclose natural persons holding 10% or more ownership, or exercising effective control, to the Registrar of Companies through a dedicated beneficial-ownership portal. This is a High-confidence, Tier-1-sourced structural change, and it lands directly ahead of the third APG and FATF mutual evaluation of Sri Lanka, whose on-site visit is scheduled for October 2026, with mutual evaluation report adoption expected at the APG AGM in July 2027. The 10% threshold and effective-control test map onto FATF Recommendation 24, and the timing, commencement six months before the on-site visit, is consistent with an evaluation-preparation posture: closing a long-standing corporate-opacity gap that prior FATF and APG evaluations have flagged, ahead of assessment rather than in response to a specific enforcement incident.

Globally, the EU AML Package sets the structural direction for beneficial-ownership and corporate-transparency architecture, but Sri Lanka sits entirely outside its direct perimeter. The Package comprises three distinct instruments: the directly applicable AML Regulation, AMLR, Regulation (EU) 2024/1624; the sixth AML Directive, 6AMLD, transposed individually by each EU member state; and the AMLA Regulation, Regulation (EU) 2024/1620, which establishes the Anti-Money Laundering Authority and shifts supervision of certain cross-border obliged entities from purely national authorities toward a hybrid EU-level regime combining direct and indirect AMLA supervision. This is standing structural backdrop rather than a Sri Lanka-specific development this cycle -- no AMLA horizon anchor touching Sri Lanka was carried by the interpreter this cycle -- and it is included here as durable context against which the beneficial-ownership reform of Sri Lanka, a non-EEA jurisdiction, should be read: Sri Lanka is building a comparable transparency architecture unilaterally and on its own timeline, driven by APG and FATF mutual-evaluation pressure rather than EU-style supranational supervision.

Outlook

The central item to watch is how the beneficial-ownership portal performs in practice ahead of the October 2026 on-site visit: uptake among existing companies, treatment of offshore and overseas-registered entities, and whether phased transition deadlines are met will likely feature directly in the APG assessment. A second-order question is whether the effective-control test, as applied by the Registrar of Companies, proves robust enough in practice to withstand APG scrutiny under the revised effectiveness-focused mutual-evaluation methodology, or whether gaps emerge that could weigh against the grey-listing risk profile of Sri Lanka.

A single, Low-confidence signal this cycle concerns the Colombo Port City Special Economic Zone. Displaced Philippine Offshore Gaming Operator networks are reportedly relocating toward Sri Lanka, including the Port City SEZ, whose distinct legal framework is flagged by regional commentary as a potential structuring loophole for online-gambling-linked financial flows. This rests on a single Tier-3 source and has not been corroborated by a Tier-1 or Tier-2 source; it is carried at Low confidence and should be read as a watch item rather than an established enabler-jurisdiction finding. The underlying dynamic, a special economic zone operating under a legal framework distinct from the general company and gambling law of Sri Lanka, receiving inbound relocation of operators displaced by a neighbouring jurisdiction crackdown, is a structurally interesting pattern even at Low confidence, because SEZ-style carve-outs are a recurring enabler-jurisdiction typology globally: a legally distinct enclave can create a de facto lighter-touch perimeter even where the enclave law does not itself intend to weaken AML controls. Financial-integrity analysts should also track whether the FIU of Sri Lanka issues any public guidance specific to SEZ-registered entities in response to this relocation pattern, which would be the clearest primary-source indicator that authorities view the SEZ as a distinct risk perimeter requiring its own compliance guidance.

Outlook

This signal requires primary-source corroboration before it can be upgraded from Low to Assessed confidence. The specific question to resolve is whether the legal and financial-services framework of the Colombo Port City SEZ contains any AML/CFT carve-out or supervisory gap relative to the general jurisdiction of the FIU, or whether the risk is purely one of physical relocation into a jurisdiction with an otherwise-standard AML perimeter. Absent that clarification, this remains a directional watch item rather than a structural finding.

The 2024/25 National Risk Assessment of Sri Lanka rates drug trafficking as High risk and fraud and trade-based money laundering as Medium-High, reflecting the continuing function of the country as an Indian Ocean narcotics transshipment corridor linking Golden Crescent and Golden Triangle trafficking routes. These findings feed directly into a new National AML/CFT/CPF Policy for 2026-2030. This is Assessed-confidence, Tier-3-sourced reporting of what is understood to be a primary National Risk Assessment document; the underlying FIU-hosted NRA PDF itself was not directly retrieved this cycle, which is logged as an evidence gap. Trade-based money laundering tied to transshipment trade flows is the closer analogue to a conflict-finance and extractive-industry-integrity reading within this domain, given the port-centric trade geography of Sri Lanka, though the NRA finding as reported does not itself identify a specific conflict-finance or extractive-sector nexus; the connection here is the structural transshipment-corridor profile rather than a named case. Given this transshipment-corridor geography, trade-based money laundering typologies connected to bulk shipping and free-trade-zone activity are the most plausible bridge between this domain conflict-finance framing and the Medium-High TBML rating in the NRA itself, and this bridge should be tested directly once the primary NRA text is available. No Sri Lanka-specific extractive-industry finding, in mining, gemstone, or hydrocarbon sectors, was located this cycle.

Outlook

The priority action is retrieval of the primary FIU-hosted 2024/25 National Risk Assessment document, which would allow this finding to be assessed directly against its source rather than through secondary reporting, and would also clarify whether the new National AML/CFT/CPF Policy 2026-2030 contains any conflict-finance-specific or extractive-industry-specific recommendations among its stated fifteen key recommendations.

The virtual-asset regulatory trajectory taking shape within Sri Lanka itself, rather than any global framework, is this cycle D5 story. The Deputy Minister of Digital Economy presented the apex AML body of Sri Lanka with a first virtual-asset regulatory framework proposal in February 2026, intended to license and supervise virtual-asset service providers and to introduce travel-rule-equivalent information-sharing requirements. This is an Assessed-confidence development, corroborated across three independent Tier-3 sources, though no Tier-1 legislative text has yet been published. Sri Lanka remains rated only partially compliant with FATF Recommendation 15, because no VASP is currently licensed or supervised anywhere in the country; the proposal marks a policy-level shift away from a wholly unregulated posture, but it has not yet translated into an operative licensing regime. A parallel, Cabinet-approved measure from June 2026 would require public officials to declare cryptocurrency and blockchain holdings; this is an anti-corruption and transparency control distinct from VASP licensing proper, and it cross-references to state-capture-monitoring concerns insofar as undisclosed digital-asset holdings by public officials raise a transparency question that sits adjacent to, but separate from, the AML/CFT licensing gap.

Globally, frameworks such as MiCA and the FATF virtual-asset standards set structural reference points, and officials in Sri Lanka have reportedly used the Singapore framework as a model in a related gambling-sector regulatory context; but for Sri Lanka specifically, the operative fact this cycle is domestic and pre-legislative: a proposal presented to the apex AML body, not a licensing regime in force.

Outlook

The critical open question, flagged directly in this cycle gaps register, is which authority, the Central Bank, a securities regulator, or a new dedicated body, will hold VASP licensing power once the proposed framework is drafted into law; this allocation decision will determine both supervisory capacity and the practical timeline to Recommendation 15 compliance. The implementation and enforcement mechanism of the public-official crypto-declaration measure is a second item to watch, given it was only Cabinet-approved in June 2026 and has not yet been observed in operation.

The standing AML/CFT regime of Sri Lanka rests on the Prevention of Money Laundering Act No. 5 of 2006 and the Financial Transactions Reporting Act No. 6 of 2006, supervised by the Central Bank and the Financial Intelligence Unit, under a National AML/CFT/CPF Policy now updated for the 2026-2030 period. The most consequential near-term event for the regime is the third APG and FATF mutual evaluation of Sri Lanka, which formally commenced in March 2026 under the FATF revised effectiveness-focused methodology; the on-site visit is scheduled for October 2026, with the final mutual evaluation report expected for adoption at the APG AGM in July 2027. This is Assessed-confidence, Tier-3-sourced reporting, and officials are reported to frame avoiding a third grey-listing as an existential compliance priority, a framing that contextualises this cycle other developments, including the new beneficial-ownership disclosure regime and the proposed virtual-asset framework, as evaluation-preparation moves within the same standing regime rather than as isolated reforms. The three-pillar balance is worth noting here: this cycle D7 signal, like the broader corpus, is overwhelmingly AML-weighted. No Sri Lanka-specific CTF or CPF development was located this cycle beyond the general framing of the National AML/CFT/CPF Policy 2026-2030 title; the absence of a distinct CTF or CPF finding is itself worth surfacing rather than silently omitting, consistent with the three-pillar balance principle that CTF and CPF signal is structurally under-represented against AML enforcement volume.

Outlook

The October 2026 on-site visit is the central near-term event against which every other development in the financial-integrity posture of Sri Lanka this cycle should be read. Whether the fifteen key recommendations of the National AML/CFT/CPF Policy 2026-2030 translate into implemented reforms before the on-site visit, and whether the beneficial-ownership regime and proposed virtual-asset framework are far enough along to be credited by APG assessors, will together determine whether Sri Lanka avoids a third grey-listing outcome when the mutual evaluation report is adopted in July 2027.