Sri Lanka LK

The baseline position of Sri Lanka on the international sanctions-architecture ledger is, on its face, unremarkable. The jurisdiction is not on the FATF grey or black list, having been removed from grey-list monitoring in October 2019, and it remains under Asia/Pacific Group enhanced follow-up, with the latest technical-compliance follow-up update dated December 2025, ahead of a full Mutual Evaluation expected around mid-2027. Sri Lanka is also absent from both the current EU high-risk third country delegated regulation and the UK Money Laundering Regulations high-risk third country advisory notice as of this baseline. These two lists move independently of one another rather than in lockstep, and the baseline treats each as requiring re-verification at every cycle rather than an assumption of continuity between them.

Set against that comparatively clean formal standing, the most architecturally significant development this cycle is the exercise by the UK of an entirely separate sanctions instrument, one that operates outside the FATF/APG technical-compliance track altogether. On 24 March 2025, OFSI, acting alongside the Foreign, Commonwealth and Development Office, designated four individuals under the UK Global Human Rights sanctions regime. The designees include former senior Sri Lankan military commanders and ex-LTTE/Karuna Group leader Vinayagamoorthy Muralitharan, sanctioned for extrajudicial killings, torture and sexual violence committed during the civil-war era. As of the baseline, no parallel US Treasury OFAC or EU asset-freeze designation of the same four individuals has been identified.

This absence is assessed, not merely observed. The available evidence does not point to an evidentiary or capacity gap in Washington or Brussels; rather, it is read as a genuine divergence in cross-bloc human-rights-sanctions policy, and one assessed as sharper than the divergence typically observed on Russia-related designations, where the UK, US and EU tend to act in closer parallel through coordinated designation cycles. The architectural reading that follows is that unilateral, single-bloc human-rights sanctions regimes now function as an independent enforcement channel, operating without the coordination reflexes that have come to characterise the Russia sanctions ecosystem specifically. That is a structural feature of the current sanctions landscape with implications extending well beyond Sri Lanka: wherever a single jurisdiction human-rights sanctions authority moves unilaterally, the resulting designation gap becomes a standing feature of the compliance environment rather than a transitional anomaly awaiting harmonisation.

For obliged entities operating across the UK, US and EU nexus, the practical consequence of this divergence is a fragmented designation landscape in which screening against any single sanctions list is insufficient to capture the full universe of human-rights-driven exposure. A customer or counterparty cleared against the OFAC Specially Designated Nationals list or an EU asset-freeze annex may nonetheless carry UK Global Human Rights sanctions exposure that a US-only or EU-only screening architecture would miss entirely, and the inverse holds equally should Washington or Brussels act unilaterally in a future cycle. This is properly read as a structural screening-architecture question rather than an isolated compliance failure attributable to any single institution control environment; it is the sanctions-architecture equivalent of a coverage gap built into the multilateral system by design rather than by oversight.

The FATF/APG technical-compliance track, meanwhile, continues on a steady and largely uneventful trajectory. The December 2025 follow-up update confirms continued enhanced-follow-up status for Sri Lanka without escalation toward re-listing, and without the kind of adverse finding that would itself constitute a sanctions-architecture signal. The two tracks, FATF technical compliance and unilateral human-rights sanctions authority, are, on this baseline, moving on entirely independent timelines, evidencing that the formal AML/CFT standing of Sri Lanka and its human-rights-accountability exposure are assessed and acted upon through wholly separate institutional channels internationally.

Outlook

The clearest forward test for the sanctions-architecture posture of Sri Lanka is the next full FATF Mutual Evaluation, expected around mid-2027, which will apply the 2025-revised FATF methodology, including current-effectiveness and virtual-asset-effectiveness testing, for the first time since 2015. General industry expectation is that this current-methodology assessment will surface effectiveness gaps not visible through technical-compliance follow-up alone, a materially more searching exercise than the December 2025 update, which simply confirmed continued enhanced-follow-up status without probing underlying implementation effectiveness.

Independent of that FATF trajectory, whether the divergence between UK unilateral human-rights sanctions action and the continued absence of matching OFAC or EU designations narrows or persists is itself worth tracking at each future cycle. No public statement from OFAC or EU authorities has been identified explaining that absence, leaving open whether it reflects a considered political choice or an undisclosed capacity constraint, a distinction with material consequences for how obliged entities should weight the durability of the current designation gap. The continued absence of Sri Lanka from both the EU and UK high-risk third country lists should also be re-verified rather than assumed stable, given that the two lists have moved independently of each other in the past and could diverge again with limited warning.

Sri Lanka sits outside the evolving beneficial-ownership and anti-money-laundering supervisory architecture of the European Union entirely: as a non-EU, non-EEA third country, it falls outside the directly-applicable scope of the AML Regulation, outside the Sixth AML Directive Member State transposition requirement, and outside the direct and indirect supervisory perimeter of the Anti-Money Laundering Authority. No 6AMLD transposition question therefore applies to Sri Lanka, and the principal EU-linked exposure for the jurisdiction runs instead through two adjacent, non-AML-specific levers: the EU high-risk third country delegated regulation, on which Sri Lanka is not currently listed, and GSP+ trade conditionality, addressed further below. The directly relevant beneficial-ownership developments for Sri Lanka this cycle are domestic rather than EU-derived, and it is to those that the assessment turns first.

Sri Lanka has no centralized, publicly accessible beneficial-ownership register for legal persons or trusts. This structural absence is the backdrop against which a durable elite-protection pattern has played out: politically exposed Sri Lankan officials and associates used offshore trusts and shell companies administered by corporate service providers based in Singapore and the United Arab Emirates, the 2021 Pandora Papers leak specifically identified Singapore-based Asiaciti Trust in this role, to acquire luxury real estate, artwork and cash across low-tax jurisdictions, obscuring beneficial ownership from Sri Lankan courts and the domestic financial intelligence unit. The resulting referral to the Commission to Investigate Allegations of Bribery or Corruption, concerning Rajapaksa-family offshore trusts, shows no confirmed material prosecutorial outcome within an eighteen-month baseline window.

Read together, the absence of a centralized BO register and the stalled CIABOC referral are assessed, at Assessed confidence, as indicating elite-protection dynamics consistent with partial state capture of the enforcement pipeline, rather than a pure capacity deficit. That distinction matters analytically: a capacity deficit implies the gap narrows with technical assistance and time; a state-capture dynamic implies the gap persists until the underlying political-economy incentives shift, regardless of technical-assistance investment in registry infrastructure. Historic FATF ICRG findings have separately flagged gaps in timely competent-authority access to beneficial-ownership information and called for modernisation of the Trust Ordinance, though current evidence does not establish whether that modernisation, or registry development more broadly, has advanced beyond those historic findings. The obligation gap is documented under FATF Recommendations 24 and 25, covering customer due diligence and governance and transparency obligations respectively, with the control-gap signal assessed as partial rather than absent, obliged entities operating in or with exposure to Sri Lanka retain functioning CDD frameworks but lack the registry infrastructure that would allow verification of ultimate beneficial ownership independent of customer self-disclosure.

Standing beneath any single jurisdiction beneficial-ownership posture is the structural fact of the AML Package of the European Union, which continues to reshape the baseline against which beneficial-ownership regimes worldwide are increasingly measured, even where, as with Sri Lanka, a jurisdiction sits outside its direct perimeter. The EU AML Package comprises three distinct instruments: the AML Regulation, or AMLR, Regulation (EU) 2024/1624, which is directly applicable across EU Member States without national transposition; the Sixth AML Directive, or 6AMLD, which each Member State transposes into domestic law; and the AMLA Regulation, Regulation (EU) 2024/1620, which establishes the Anti-Money Laundering Authority and its direct and indirect supervisory perimeter over designated obliged entities. Together these instruments shift EU supervision from a purely national-authority model toward a hybrid EU-level regime, with AMLA assuming direct supervisory responsibility for a defined set of higher-risk cross-border obliged entities while indirect supervision and 6AMLD transposition remain distributed across national supervisors. This architecture is a durable structural backdrop against which the beneficial-ownership signal for Sri Lanka this cycle should be read: it illustrates the direction of travel toward centralised, harmonised BO transparency regimes internationally, even as it confirms, by contrast, that the registry gap in Sri Lanka sits wholly outside that harmonising pressure and must instead be closed through domestic reform or FATF Mutual Evaluation leverage.

Outlook

The nearest forward-looking test of the beneficial-ownership posture of Sri Lanka will arrive via the FATF Mutual Evaluation expected around mid-2027, which will apply current-effectiveness testing to beneficial-ownership access and use for the first time since 2015 and is likely to test directly whether the registry gap and the stalled CIABOC referral have been addressed in the interim. Absent a confirmed prosecutorial outcome or registry development before that assessment, the current baseline, no centralized BO register, an unresolved elite-asset-flight referral, and a jurisdiction structurally outside the harmonising perimeter of the EU AML Package, should be treated as the durable status quo rather than a transitional state. Any future cycle showing either a confirmed CIABOC outcome or concrete registry-development legislation would represent a genuine structural shift warranting a reassessment of the current partial-capture judgment; absent such movement, this pattern is expected to persist unchanged.

The baseline enabler-jurisdiction exposure of Sri Lanka runs in two directions simultaneously: outward, through the professional-facilitator infrastructure that receives Sri Lankan elite capital flight, and inward, through the transnational trafficking networks that exploit the maritime and logistics position of Sri Lanka. Both patterns were established this cycle and are assessed as durable rather than episodic.

On the outward axis, politically exposed Sri Lankan officials and associates used offshore trusts and shell companies administered by corporate service providers based in Singapore and the United Arab Emirates, the 2021 Pandora Papers leak specifically identified Singapore-based Asiaciti Trust in this role, to acquire luxury real estate, artwork and cash across low-tax jurisdictions, obscuring beneficial ownership from Sri Lankan courts and creditors. This is the textbook enabler-jurisdiction pattern: the professional-facilitator infrastructure sits entirely outside the domestic regulatory perimeter of Sri Lanka, in jurisdictions with well-developed corporate-services sectors and comparatively permissive beneficial-ownership disclosure requirements for foreign-administered trust structures, meaning that closing the domestic beneficial-ownership register gap in Sri Lanka would only partially address the exposure, the facilitator infrastructure itself sits in Singapore and the UAE, beyond the regulatory reach of Colombo. The absence of a confirmed material prosecutorial outcome on the resulting CIABOC referral compounds this: even where the underlying assets and structures are documented via investigative journalism, the accountability pipeline from documentation to enforcement has not converted into an outcome within an eighteen-month baseline window.

On the inward axis, the position of Sri Lanka on Indian Ocean shipping lanes and growing parcel-mail and air-cargo volumes are exploited by transnational networks moving synthetic drugs, hashish and cocaine, with the UN Office on Drugs and Crime explicitly framing the resulting illicit financial flows as divertible into terrorism financing, drug trafficking generating vast illicit profits that fuel organized crime and can be diverted to finance violent extremism. This is a three-level architecture in the classic sense: the scheme is narcotics movement through postal and air-cargo channels; the architecture is the informal and digital transfer infrastructure that launders the resulting proceeds; and the strategic consequence is the potential diversion of those proceeds into terrorism financing, a CTF-pillar finding that would otherwise be structurally under-weighted relative to the AML-pillar findings that dominate enforcement-volume reporting. Sri Lanka Customs interdicted 4.2 kilograms of synthetic drugs at the Colombo Central Postal Mail Exchange and 17.5 kilograms of hashish and cocaine at Bandaranaike International Airport, including the first slab-form cocaine interdiction for the jurisdiction, evidencing genuine capacity gains following UNODC Programme against Corruption and Crime training, a rare instance in this baseline where the enforcement axis, rather than the enablement axis, shows forward motion.

Two further developments bear on the enabler-jurisdiction assessment without fitting neatly into either the outward or inward axis. The renewed Generalised Scheme of Preferences Regulation of the European Union, signed in June 2026 and applying from 1 January 2027 for a further ten years, continues twenty-seven-to-thirty-two-convention conditionality underpinning the status of Sri Lanka as the third-largest GSP+ beneficiary, a governance-leverage mechanism operating adjacent to, but structurally distinct from, the AML supervisory perimeter from which Sri Lanka is otherwise excluded as a non-EEA state. Separately, a four-pillar national strategy against organized crime in Sri Lanka, spanning prevention, pursuit of groups and proceeds, protection, and partnership, is expected to move toward defined implementing activities during 2026, following 2025 UNODC-supported workshops; sustained implementation could meaningfully strengthen the inter-agency architecture needed to address both the outward elite-capital-flight pattern and the inward trafficking-finance nexus described above.

Outlook

The enabler-jurisdiction picture for Sri Lanka is best read as asymmetric: genuine capacity-building progress on the inward, narcotics-interdiction axis, set against a largely unaddressed outward axis where the professional-facilitator infrastructure enabling elite asset flight sits beyond the jurisdiction of Colombo entirely and where the domestic accountability pipeline, the CIABOC referral, remains stalled. Whether the move to implementation during 2026 by the four-pillar national organized-crime strategy extends capacity gains beyond narcotics interdiction into the beneficial-ownership and asset-recovery space is the clearest near-term signal to track. The GSP+ conditionality of the EU, renewed for a further ten years from 2027, will continue to apply external governance pressure independent of that domestic track, but as a trade-conditionality lever rather than an AML-supervisory one, its capacity to compel closure of the professional-facilitator gap specifically is limited by design.

The own digital-asset regulatory perimeter of Sri Lanka is, at baseline, undeveloped: no dedicated virtual-asset service provider licensing regime or crypto-specific anti-money-laundering framework has been identified for the jurisdiction, in contrast to regional peers that have advanced crypto-specific oversight during 2025 and 2026. This is the directly relevant starting point for assessing the digital-asset exposure of Sri Lanka, not the Markets in Crypto-Assets framework of the EU or the global virtual-asset standards of FATF, which function as contextual backdrop rather than the primary determinant of the regulatory posture of the jurisdiction itself.

That domestic regulatory vacuum sits alongside a confirmed and troubling exposure pattern. Per a February 2026 OHCHR report, Sri Lankan nationals are confirmed as trafficking victims within a regional scam-crypto laundering ecosystem estimated at tens of billions of dollars annually. Jobseekers recruited via fraudulent job advertisements are trafficked into guarded compounds in Myanmar, Cambodia and Laos and forced to run online romance and crypto scams; one survivor recounted being subjected to hours of water-prison style punishment after missing monthly scam targets. Scam proceeds are laundered on-chain and through informal remittance channels within this regional ecosystem. The role of Sri Lanka in this pattern is functionally distinct from that of the hosting jurisdictions where the scam compounds physically operate, or the jurisdictions building enforcement capacity against the resulting laundering infrastructure: Sri Lanka functions primarily as a source-of-labour exposure point, supplying trafficked personnel into a criminal enterprise whose financial architecture sits substantially outside Sri Lankan territory or regulatory reach.

The combination of these two findings, a confirmed source-country trafficking exposure into a crypto-enabled laundering ecosystem, and the complete absence of any domestic VASP licensing or crypto-AML framework, is assessed, at Possible confidence, as constituting an emerging structural gap rather than an episodic incident. The Possible-tier confidence reflects that the causal link between the regulatory vacuum specifically and the trafficking exposure specifically has not been established with the same evidentiary weight as either finding independently; what is established is that both conditions exist simultaneously and are, on their face, mutually reinforcing. A jurisdiction lacking any crypto-specific licensing or AML oversight has correspondingly limited domestic tooling to trace, freeze or investigate on-chain proceeds connected to its own trafficked nationals, even where the underlying labour-sourcing pattern is documented by international bodies. The firm types most directly exposed to this pattern are crypto-asset operators and payment companies handling retail and VASP-counterparty relationships linked to the affected corridor, reflecting both the payment-remittance leg used to move scam proceeds and the on-chain leg through which laundering ultimately occurs.

Set against this domestic picture, the global regulatory direction of travel, the virtual-asset standards of FATF, the MiCA framework of the EU, and the 2025-revised FATF Mutual Evaluation methodology incorporation of virtual-asset effectiveness testing, represents a structural backdrop against which the own regulatory vacuum of Sri Lanka will eventually be measured, most concretely at the next full Mutual Evaluation expected around mid-2027, the first assessment of Sri Lanka to apply virtual-asset effectiveness criteria. Until that assessment, the digital-asset framework of Sri Lanka remains, on current evidence, unbuilt rather than merely under-enforced.

Outlook

The clearest forward marker for the digital-asset posture of Sri Lanka is the mid-2027 FATF Mutual Evaluation, which will test virtual-asset effectiveness for the first time and is likely to surface the absence of any VASP licensing or crypto-AML regime as a material finding rather than a footnote. Absent a legislative proposal specific to virtual-asset regulation before that assessment, and none has been identified in the current research cycle, the worsening trajectory assigned to this domain, driven by the combination of a widening regional scam-crypto ecosystem and an unchanging domestic regulatory vacuum, is expected to persist. Any future cycle in which Sri Lanka introduces VASP-specific licensing, or in which the destination and laundering path of Sri Lankan-linked scam proceeds becomes traceable through domestic tooling, would represent the first concrete structural improvement against this baseline.

The clearest compliance-technology finding in this baseline is a business-email-compromise scheme that diverted approximately 2.5 million US dollars from sovereign Treasury payment channels. Between December 2025 and March 2026, criminals intercepted email communications between the Sri Lankan Treasury and Australian export-finance counterparties, enabling the redirection of five successive loan-repayment instalments into criminal-controlled accounts. The scheme exploited weak email-authentication and payment-verification controls within sovereign financial infrastructure, the kind of control gap that, at institutional scale, active-defence tooling such as payment-verification callback protocols, domain-authentication standards, and anomaly-detection on payment-instruction changes is specifically designed to close. That the exploited counterparty was a Central Bank and Treasury payment channel, rather than a commercial banking relationship, raises the stakes: sovereign payment infrastructure sits at the top of the trust hierarchy that correspondent banking and export-finance arrangements depend upon, and a successful business-email-compromise intrusion at that level signals a control gap with potential systemic reach across every counterparty relying on the authenticity of that same payment channel.

The destination and further laundering path of the diverted funds has not been established by investigators as of this baseline, which limits the ability of the assessment to trace whether the proceeds moved through the same enabler-jurisdiction or crypto-laundering infrastructure documented elsewhere in this baseline, or through an entirely separate channel. This is a material evidentiary gap rather than a closed investigation, and the current absence of a confirmed destination should not be read as an indication that tracing efforts have concluded.

The compliance-technology reading of this incident is twofold. First, it reflects a technology gap: the payment-verification controls that would ordinarily flag a change in payment instructions between long-standing counterparties evidently did not trigger, or were not in place, across the five successive fraudulent instalments, a repeated-exploitation pattern rather than a single lapse, suggesting the underlying control gap persisted across multiple payment cycles without detection or correction. Second, it reflects a governance and disclosure gap: the public visibility of the incident rests on investigative reporting rather than a proactive supervisory disclosure, raising a broader question about whether sovereign payment-infrastructure incidents of this kind are subject to the same disclosure expectations increasingly applied to regulated financial institutions. Both gaps are assessed as compounding rather than isolated failures, a technology control gap and a governance and transparency gap operating in the same incident, each reinforcing the conditions that allowed the other to persist undetected for months.

The customer-typology profile of this scheme, corporate and correspondent-banking relationships rather than retail, situates it squarely within the trade-finance and correspondent-banking control environment that active-defence programmes at commercial banks have increasingly prioritised since 2020, yet its occurrence within sovereign Treasury infrastructure suggests that hardening at the level of individual correspondent banks does not automatically extend to state payment channels, which may sit outside the direct supervisory reach of banking-sector cyber-fraud controls entirely.

For active-defence purposes, this incident functions as an architecture-level case study rather than an isolated fraud loss: it demonstrates concretely how sovereign-level payment infrastructure, often assumed to carry higher assurance than commercial banking rails, can in practice lack the basic payment-instruction verification controls that regulated commercial institutions are increasingly expected to deploy as standard active-defence measures against business-email-compromise typologies.

Outlook

Whether the Treasury and Central Bank of Sri Lanka strengthen payment-verification and email-authentication controls in response to this incident, and whether the destination and laundering path of the diverted 2.5 million US dollars is eventually established, are the two clearest forward markers for this domain. A future cycle establishing the laundering destination would allow this incident to be integrated with other financial-crime findings for the jurisdiction, particularly the enabler-jurisdiction and crypto-laundering patterns documented elsewhere in this baseline, rather than being assessed in isolation as it currently must be. Absent confirmed remediation, the underlying control gap should be assumed to persist, and the incident should be read as a standing illustration of active-defence control gaps in sovereign payment infrastructure more broadly, not merely a closed historical event. Whether any post-incident supervisory review of Treasury payment controls has since been initiated is not established in current evidence and constitutes a standing gap for future-cycle tracking. This incident sits within a domain that captures compliance technology and active defence broadly, and the trajectory assessed as worsening for Sri Lanka on this axis reflects that the exploited control gap is both recent and unremediated as of this baseline, distinguishing it from the comparatively stable trajectories assessed for the D1 sanctions-architecture and D3 enabler-jurisdiction postures of Sri Lanka this cycle.