--- title: "Sri Lanka (LK) — Financial-Integrity Intelligence · Sentinel" canonical: https://sentinel.gi/jurisdictions/sri-lanka/ source_html: /jurisdictions/sri-lanka/index.html description: "Financial integrity intelligence for Sri Lanka (LK): sanctions, beneficial ownership, enabler jurisdictions, conflict finance, digital assets and compliance technology — with sourced findings." generated_at: 2026-11-08T04:46:02Z content_sha256: b04738e857fada7bdadbb797881d6423c8049eff20a4a8ec0719d3a8304d22e9 generator: "fe-fleet/md-twin@1.0" --- # Sri Lanka (LK) — Financial-Integrity Intelligence · Sentinel Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. Financial Integrity Monitor # Sri Lanka LK Domains covered 8 of 8 Sources 183 Role actions 8 Horizon <90d 1 Jurisdiction profile FATF status: Clean Tier: B Risk direction: Stable Enablement vs enforcement: Mixed Sri Lanka operates AML/CFT under the Prevention of Money Laundering Act, Financial Transactions Reporting Act and Convention on Suppression of Terrorist Financing Act, supervised by the CBSL-housed Financial Intelligence Unit (Egmont member). More Removed from the FATF grey list in 2019 and remains in APG enhanced follow-up. No dedicated virtual-asset/VASP regulatory regime exists, and beneficial-ownership transparency for trusts/legal persons remains weak, exploited by offshore professional facilitators. Key deficiencies - No centralized, publicly accessible beneficial-ownership register for legal persons and trusts - Historic FATF-flagged gaps in timely access to beneficial-ownership information and Trust Ordinance modernisation - Absence of a dedicated virtual-asset/VASP licensing and AML framework - Weak transaction-verification controls in sovereign payment/treasury systems (BEC fraud exposure) - Stalled elite-corruption prosecutions despite CIABOC's nominal mandate Recent developments (18m) - UK Global Human Rights sanctions regime designation of 4 individuals for civil-war era abuses (24 March 2025) - Central Bank/Finance Ministry $2.5m business-email-compromise fund diversion revealed (April 2026), investigation ongoing - UNODC-supported development of a national strategy to counter organized crime (2025-2026) - UNODC-Sri Lanka/Maldives joint project tracing drug-related illicit financial flows to terrorism financing (December 2025) - FATF/APG follow-up report technical-compliance update (latest update December 2025); Sri Lanka remains in enhanced follow-up - OHCHR report (February 2026) documenting Sri Lankan nationals trafficked into Southeast Asian scam-centre forced criminality Brief ## Lead signal #### Lead Signal Sri Lanka is in the final stretch of its third APG/FATF-style mutual evaluation, with an on-site visit by international assessors that began in mid-October 2026 and was scheduled to run into the first week of November. Central Bank of Sri Lanka Governor Weerasinghe has publicly expressed confidence that the country will avoid a third grey-listing, pointing to a run of 2026 legislative reforms: amendments to the Banking Act, beneficial-ownership provisions added to the Companies Act, and amendments to the Financial Transactions Reporting Act (FTRA), the Prevention of Money Laundering Act, and the Convention on the Suppression of Terrorist Financing Act. The reform programme is real and substantial, but it remains a credible attempt rather than a proven outcome, and the Financial Intelligence Unit of Sri Lanka has itself identified the gap that could still matter most: beneficial ownership is, by its own account, the only FATF recommendation on which the country is currently rated non-compliant. Read full brief #### Lead Signal Sri Lanka is in the final stretch of its third APG/FATF-style mutual evaluation, with an on-site visit by international assessors that began in mid-October 2026 and was scheduled to run into the first week of November. Central Bank of Sri Lanka Governor Weerasinghe has publicly expressed confidence that the country will avoid a third grey-listing, pointing to a run of 2026 legislative reforms: amendments to the Banking Act, beneficial-ownership provisions added to the Companies Act, and amendments to the Financial Transactions Reporting Act (FTRA), the Prevention of Money Laundering Act, and the Convention on the Suppression of Terrorist Financing Act. The reform programme is real and substantial, but it remains a credible attempt rather than a proven outcome, and the Financial Intelligence Unit of Sri Lanka has itself identified the gap that could still matter most: beneficial ownership is, by its own account, the only FATF recommendation on which the country is currently rated non-compliant. That combination, a demonstrable legislative push set against one acknowledged and specific shortfall, is the defining architecture of this cycle. The FTRA (Amendment) Act, No. 17 of 2026, certified 4 August 2026, is the clearest structural move: for the first time, it draws Virtual Asset Service Providers inside the FTRA's definition of a financial business, extending reporting-institution obligations, risk-based customer due diligence duties, and FIU-SL's own supervisory powers to that sector. The timing, legislated and certified ahead of the on-site assessment, signals an attempt to close a recognised gap before assessors conclude their work rather than after. #### Other Developments Beneficial ownership flagged as the sole outstanding gap. The Director General of FIU-SL stated publicly that beneficial-ownership transparency remains the only FATF recommendation on which Sri Lanka is rated non-compliant, and used that statement to urge private-sector entities to move ahead with implementing the beneficial-ownership regime newly inserted into the Companies Act, ahead of the mutual evaluation's conclusion. This is a self-identified weakness rather than an external finding, which gives it particular weight: the regulator responsible for the country's FATF standing is naming its own residual exposure in public, on the record, while assessors are still in the country. Virtual asset providers brought inside the AML perimeter. The FTRA Amendment Act's extension of the financial business definition to Virtual Asset Service Providers is a first-time structural change, not an incremental update. It sits alongside the Central Bank's standing position, reaffirmed in the same legislative context, that cryptocurrency is not legal tender in Sri Lanka and that no domestic exchange holds a licence. The combination is coherent: a jurisdiction that has not opened a licensing gateway for crypto exchanges is nonetheless bringing VASP activity within reporting, customer due diligence, and FIU-SL oversight, closing an AML gap for the sector without, on current evidence, opening a corresponding commercial pathway. On-site assessment nearing its procedural close. The evaluation visit that began in mid-October was scheduled to run two weeks, placing its conclusion in the first week of November 2026. What assessors found during the visit itself is not yet public; what is public is the Governor's confidence and the Finance Intelligence Unit's own framing of where the residual risk sits. A mutual evaluation report and the determination of grey-list status are not immediate outputs of the on-site visit; those follow a later plenary process, and no finding on that outcome exists yet. #### Cross-Monitor Connections The beneficial-ownership gap identified by FIU-SL has an obvious connection to corporate-transparency work tracked elsewhere: a jurisdiction rated non-compliant on beneficial ownership is, by definition, one where opaque corporate structures remain harder to pierce, a condition relevant to any monitor tracking state capture, conflict finance, or extractive-sector integrity through corporate vehicles. Sri Lanka's position does not currently carry a specific conflict-finance or extractive-industry finding this cycle, but the structural condition, an unresolved beneficial-ownership gap sitting inside an active mutual evaluation, is the kind of enabling condition those monitors would want on their own radar once country-specific findings exist. Similarly, the VASP classification change is a technology-and-architecture development with obvious relevance to any monitor tracking digital-asset infrastructure risk across South Asia: a jurisdiction imposing AML obligations on VASPs while declining to open a licensing or legal-tender pathway for them is choosing a particular enablement posture, worth watching for firms assessing counterparty risk through Sri Lankan channels. #### Outlook The near-term marker is procedural: the on-site visit concludes, assessors compile findings, and a mutual evaluation report is expected to be brought to the Asia/Pacific Group on Money Laundering's Annual General Meeting, provisionally expected around mid-2027, with wide uncertainty around that date. Whether Sri Lanka avoids a third grey-listing will turn heavily on how assessors weigh the beneficial-ownership gap against the volume of legislative reform completed in 2026, including the FTRA, PMLA, and CSTFA amendments and the new Companies Act provisions. The Governor's public confidence should be read as the government's own assessment of its position, not as a finding from the assessors themselves, and the two have not yet been reconciled in anything public. For firms with Sri Lankan exposure, the practical marker to watch is whether private-sector implementation of the Companies Act beneficial-ownership regime visibly accelerates in the period following the on-site visit, since FIU-SL has made clear that is the one lever it believes is still within the country's control before the evaluation outcome is fixed. Earlier periodic briefs (7) 3 Nov 2026 · fim-2026-11-01 #### Lead Signal Sri Lanka is in the final stretch of its third APG/FATF-style mutual evaluation, with an on-site visit by international assessors that began in mid-October 2026 and was scheduled to run into the first week of November. Central Bank of Sri Lanka Governor Weerasinghe has publicly expressed confidence that the country will avoid a third grey-listing, pointing to a run of 2026 legislative reforms: amendments to the Banking Act, beneficial-ownership provisions added to the Companies Act, and amendments to the Financial Transactions Reporting Act (FTRA), the Prevention of Money Laundering Act, and the Convention on the Suppression of Terrorist Financing Act. The reform programme is real and substantial, but it remains a credible attempt rather than a proven outcome, and the Financial Intelligence Unit of Sri Lanka has itself identified the gap that could still matter most: beneficial ownership is, by its own account, the only FATF recommendation on which the country is currently rated non-compliant. That combination, a demonstrable legislative push set against one acknowledged and specific shortfall, is the defining architecture of this cycle. The FTRA (Amendment) Act, No. 17 of 2026, certified 4 August 2026, is the clearest structural move: for the first time, it draws Virtual Asset Service Providers inside the FTRA's definition of a financial business, extending reporting-institution obligations, risk-based customer due diligence duties, and FIU-SL's own supervisory powers to that sector. The timing, legislated and certified ahead of the on-site assessment, signals an attempt to close a recognised gap before assessors conclude their work rather than after. #### Other Developments Beneficial ownership flagged as the sole outstanding gap. The Director General of FIU-SL stated publicly that beneficial-ownership transparency remains the only FATF recommendation on which Sri Lanka is rated non-compliant, and used that statement to urge private-sector entities to move ahead with implementing the beneficial-ownership regime newly inserted into the Companies Act, ahead of the mutual evaluation's conclusion. This is a self-identified weakness rather than an external finding, which gives it particular weight: the regulator responsible for the country's FATF standing is naming its own residual exposure in public, on the record, while assessors are still in the country. Virtual asset providers brought inside the AML perimeter. The FTRA Amendment Act's extension of the financial business definition to Virtual Asset Service Providers is a first-time structural change, not an incremental update. It sits alongside the Central Bank's standing position, reaffirmed in the same legislative context, that cryptocurrency is not legal tender in Sri Lanka and that no domestic exchange holds a licence. The combination is coherent: a jurisdiction that has not opened a licensing gateway for crypto exchanges is nonetheless bringing VASP activity within reporting, customer due diligence, and FIU-SL oversight, closing an AML gap for the sector without, on current evidence, opening a corresponding commercial pathway. On-site assessment nearing its procedural close. The evaluation visit that began in mid-October was scheduled to run two weeks, placing its conclusion in the first week of November 2026. What assessors found during the visit itself is not yet public; what is public is the Governor's confidence and the Finance Intelligence Unit's own framing of where the residual risk sits. A mutual evaluation report and the determination of grey-list status are not immediate outputs of the on-site visit; those follow a later plenary process, and no finding on that outcome exists yet. #### Cross-Monitor Connections The beneficial-ownership gap identified by FIU-SL has an obvious connection to corporate-transparency work tracked elsewhere: a jurisdiction rated non-compliant on beneficial ownership is, by definition, one where opaque corporate structures remain harder to pierce, a condition relevant to any monitor tracking state capture, conflict finance, or extractive-sector integrity through corporate vehicles. Sri Lanka's position does not currently carry a specific conflict-finance or extractive-industry finding, but the structural condition, an unresolved beneficial-ownership gap sitting inside an active mutual evaluation, is the kind of enabling condition those monitors would want on their own radar once country-specific findings exist. Similarly, the VASP classification change is a technology-and-architecture development with obvious relevance to any monitor tracking digital-asset infrastructure risk across South Asia: a jurisdiction imposing AML obligations on VASPs while declining to open a licensing or legal-tender pathway for them is choosing a particular enablement posture, worth watching for firms assessing counterparty risk through Sri Lankan channels. #### Outlook The near-term marker is procedural: the on-site visit concludes, assessors compile findings, and a mutual evaluation report is expected to be brought to the Asia/Pacific Group on Money Laundering's Annual General Meeting, provisionally expected around mid-2027, with wide uncertainty around that date. Whether Sri Lanka avoids a third grey-listing will turn heavily on how assessors weigh the beneficial-ownership gap against the volume of legislative reform completed in 2026, including the FTRA, PMLA, and CSTFA amendments and the new Companies Act provisions. The Governor's public confidence should be read as the government's own assessment of its position, not as a finding from the assessors themselves, and the two have not yet been reconciled in anything public. For firms with Sri Lankan exposure, the practical marker to watch is whether private-sector implementation of the Companies Act beneficial-ownership regime visibly accelerates in the period following the on-site visit, since FIU-SL has made clear that is the one lever it believes is still within the country's control before the evaluation outcome is fixed. 25 Oct 2026 · fim-2026-10-25 #### Lead Signal Sri Lanka enters its third Financial Action Task Force (FATF) mutual evaluation cycle with a live discrepancy between official and institutional accounts of timing. The Governor of the Central Bank of Sri Lanka has publicly stated that an on-site evaluation by international assessors commenced in mid-October 2026 and is scheduled to run approximately two weeks, framed around confidence that the country will avoid a third grey-listing. The FATF calendar itself, however, lists a possible on-site period beginning 1 November 2026 for the Asia/Pacific Group (APG) assessment of Sri Lanka, whose last evaluation dates to October 2015. The gap between a domestic officials press account and the international standard-setters own scheduling record could not be resolved, and the finding is treated as uncertain pending primary confirmation. The architectural significance is independent of the exact date: a mutual evaluation outcome, once published, becomes the reference point against which the countrys beneficial-ownership gaps, virtual-asset perimeter, and AML/CTF enforcement posture will be judged for the following several years, and the pre-evaluation positioning visible here, legislative amendment, public reassurance, sector briefings, is itself the structural story. #### Other Developments Virtual asset legislative drafting continues incrementally. A concept paper for a dedicated Virtual Asset Service Provider (VASP) framework was sent to the Legal Draftsmans Department on 24 September 2026, following the Cabinet of Ministers approval on 27 July 2026 of a policy framework naming the Securities and Exchange Commission as lead regulator, with the Central Bank, the Financial Intelligence Unit and the Inland Revenue Department holding joint oversight roles. No VASP-specific statute yet exists, and the matter remains probable rather than confirmed as a completed legislative step. The existing AML reporting perimeter has already absorbed virtual asset activity ahead of dedicated VASP legislation. The Financial Transactions Reporting (Amendment) Act, No. 17 of 2026, acting through the Central Banks Financial Intelligence Unit under powers in section 19(1) and 19(2) of the original 2006 Act, classifies virtual asset service providers as financial businesses, bringing them within AML reporting obligations as of 4 August 2026. This creates a structurally notable sequencing: reporting duties attach before a licensing regime exists, so VASPs operating in Sri Lanka are now obliged entities under the reporting Act while no dedicated authorisation pathway has yet been enacted. The full primary text of the amendment was not independently verified, and the finding rests on a Central Bank notice cross-referenced with a secondary summary, so it is carried as uncertain. Gambling-sector AML regulation remains stalled. First-phase gambling regulations, including AML requirements intended to be imposed via a section 19 ministerial order, have slipped past a June and then an October 2026 target with no confirmed issuance. Sector officials describe the domestic gambling market as substantially reliant on crypto and informal payment rails, which sharpens the AML stakes of continued delay, but the regulatory response has not yet materialised. #### Cross-Monitor Connections The virtual-asset regulatory sequencing in Sri Lanka, reporting obligations preceding a licensing perimeter, intersects directly with the crypto-asset and financial-innovation tracking the world-payments and crypto monitors maintain for emerging-market VASP regimes, where the same policy-before-statute pattern recurs. The gambling sectors described reliance on crypto and informal payment rails for a market still awaiting its first AML-specific regulation is a payments-architecture question as much as an AML one, and is relevant to any tracking of informal and crypto-adjacent payment rail exposure in South Asia. #### Outlook The immediate marker to watch is the resolution of the on-site evaluation timing question itself: if the plenary outcome of the third mutual evaluation is published as scheduled, Sri Lankas beneficial-ownership and virtual-asset gaps identified under Recommendation 24 and Recommendation 15 will be tested directly against the FATF standard, with grey-listing a live but unresolved question. The sequencing visible in the virtual asset space, reporting duties ahead of licensing, will likely need to be followed by the dedicated VASP statute reaching enactment before the perimeter is considered structurally complete; the concept paper remains with the Legal Draftsmans Department and has not yet become a Bill. These developments are illustrative of a jurisdiction building compliance architecture under external evaluation pressure rather than domestic enforcement pressure, a pattern worth tracking as the evaluation outcome approaches. 18 Oct 2026 · fim-2026-10-18 #### Lead Signal Sri Lanka's Central Bank Governor Dr Nandalal Weerasinghe has expressed confidence that the country will avoid a third placement on the FATF grey list, as the outcome of its APG-coordinated mutual evaluation nears. This public statement of optimism is set against a backdrop of structural legislative reform moving in parallel: a beneficial ownership regime in force since 30 March 2026, and a virtual-asset-service-provider regulatory framework progressing from Cabinet-level policy approval toward drafted legislation. The architecture being assembled, rather than any single enforcement action, is the signal worth foregrounding this cycle. #### Other Developments A virtual-asset regulatory perimeter is taking shape from a standing start. Cabinet approved a policy framework on 27 July 2026 designating the Securities and Exchange Commission of Sri Lanka as lead regulator for virtual assets and VASPs, working with the Central Bank's Financial Intelligence Unit and the Inland Revenue Department. The Ministry of Digital Economy's VASP concept paper progressed to the Legal Draftsman's Department on 24 September 2026, with the first phase of coverage limited to licensed exchanges and custodians. Reporting from 12 October 2026 confirms that VASPs are expected to face mandatory registration, know-your-customer and suspicious-transaction-reporting duties once the framework is enacted, explicitly timed ahead of the AML/CFT mutual evaluation outcome. The beneficial ownership regime continues unchanged. The Companies (Beneficial Ownership) Regulations No. 01 of 2026, made under the Companies (Amendment) Act No. 12 of 2025, have been in force since 30 March 2026, with no change identified this cycle. This regime forms part of the broader legislative base that underlies the Governor's expressed confidence regarding the mutual evaluation outcome. #### Cross-Monitor Connections The VASP framework's progression is a direct point of connection to the world-payments and crypto monitors, both of which are tracking the same Cabinet decision and drafting milestone from their own regulatory-perimeter and licensing-status perspectives respectively. The underlying evidentiary record, the SEC's designation and the September drafting milestone, is shared across all three monitors; what differs is the lens each applies to it. #### Outlook The period ahead of the APG-coordinated mutual evaluation outcome is the operative window to watch. The VASP legislation is expected to clear the Legal Draftsman's Department and reach Parliament around the first quarter of 2027, though this timing carries meaningful uncertainty given the drafting stage has not yet concluded. Whether the evaluation outcome itself validates the Governor's stated confidence, and whether the first-phase VASP framework, once enacted, extends registration and reporting duties beyond licensed exchanges and custodians, are the two developments most likely to move this jurisdiction's risk posture in the coming cycles. 11 Oct 2026 · fim-2026-10-11 #### Lead Signal Sri Lanka's anti-money-laundering architecture moved decisively this period. Parliament passed and the Speaker certified the Prevention of Money Laundering (Amendment) Act, No. 16 of 2026, alongside the companion Financial Transactions Reporting (Amendment) Act, No. 17 of 2026 and the Convention on the Suppression of Terrorist Financing (Amendment) Act, No. 18 of 2026, on 4 August 2026. The Act No. 16 package inserts a new section 12A permitting pre-judicial asset freezes of up to 14 working days, extendable to three years by court order, and adds beneficial-ownership and virtual-asset provisions into the Prevention of Money Laundering Act. This is the most significant AML/CFT legislative expansion in the standing regime, arriving ahead of Sri Lanka's delayed third FATF/APG mutual evaluation. The underlying Gazette text of the three Acts was not independently retrieved this period, so clause-level mechanics beyond section 12A rest on press commentary from Onlanka News and EconomyNext rather than primary legislative text, a gap worth noting before treating any downstream clause as settled. #### Other Developments Beneficial-ownership regime operationalised. The Companies (Beneficial Ownership) Regulations, No. 01 of 2026, implementing new Sections 130A to 130J of the Companies Act No. 7 of 2007, came into operation on 30 March 2026. A beneficial owner is defined as a natural person owning or controlling 10 percent or more of a company, directly, indirectly, or through effective control. Two independent legal-commentary sources corroborate the Gazette number, date and commencement date, though no Tier-1 Gazette text was independently retrieved this period. FIU enforcement disclosure. The Financial Intelligence Unit at the Central Bank of Sri Lanka disclosed Rs.14.6 million in administrative penalties against 11 institutions, 7 financial institutions and 4 DNFBPs, for Financial Transactions Reporting Act breaches spanning October 2025 to March 2026. The disclosure includes a Rs.2 million fine against Cargills Bank PLC for failing to report 18 electronic fund transfers, and a finding that one finance company maintained relationships with UN-designated entities, a sanctions-screening failure surfaced through routine enforcement reporting rather than a standalone sanctions-architecture development. E-money fit-and-proper declarations required. A Central Bank of Sri Lanka Payments and Settlements Department circular, Circular No. 03 of 2026, requires licensed operators of mobile-phone-based e-money systems to obtain declarations from their Board of Directors and Senior Management in terms of FATF Recommendation 26, covering fit-and-proper supervision. This circular was retrieved directly from CBSL's own circular index. Crypto remains outside the regulatory perimeter. Cryptocurrency continues to sit outside Sri Lanka's regulatory and AML framework entirely; the Central Bank maintains that the rupee is the only legal tender and that cryptocurrency is unregulated. This is a standing position rather than a new development, but it bears directly on the gambling-sector financial-flow risk surfaced elsewhere in reporting, where unlicensed operators are understood to settle funds in crypto to avoid the formal banking system. #### Cross-Monitor Connections The crypto-settlement pattern associated with unlicensed gambling operators connects directly to Advennt's gambling-regulatory tracking of enforcement against unlicensed offshore operators in Sri Lanka, where the absence of a crypto-AML perimeter is the mechanism that allows settlement to bypass the formal banking system entirely. The new beneficial-ownership register under the Companies (Amendment) Act No. 12 of 2025 and its implementing regulations also bears on World Payments Monitor coverage of non-bank payment-institution licensing, since the same Companies Act registration status now carries beneficial-ownership disclosure obligations for payment-sector entities incorporated in Sri Lanka. #### Outlook The clause-level mechanics of the PMLA/FTRA/CSTFA amendment package, including the precise scope of the new section 12A asset-freezing power and its interaction with existing judicial-authorisation safeguards, remain to be confirmed against the Gazette text itself. Civil-society commentary has already raised concerns about the FIU's expanded rule-making authority and the extension of police-issued freezing orders without judicial supervision, a tension that will likely surface again as the third FATF/APG mutual evaluation, expected in the fourth quarter of 2026, proceeds and tests the regime's practical implementation against the legislative expansion just certified. 4 Oct 2026 · fim-2026-10-04 #### Lead Signal Sri Lanka's Parliament passed the Second and Third Readings of the Prevention of Money Laundering (Amendment) Bill together with the companion Financial Transactions Reporting (Amendment) Bill by a special majority of 154 to 2 on 9 July 2026. The reforms add proliferation financing to the scope of the Financial Transactions Reporting Act, extend asset-freezing periods from an initial seven days to fourteen working days with court extension available up to three years, insert beneficial-ownership and virtual-asset provisions into the Prevention of Money Laundering Act, and mandate suspicious transaction reports within two working days. The legislative package is best read as a FATF-evaluation-driven reform: Sri Lanka's third FATF/APG mutual evaluation technical-compliance submission was due 31 March 2026, and the amendments land squarely on the gaps that kind of exercise tends to surface, particularly around reporting speed and the breadth of preventive measures applied to obliged entities. The architecture-over-incident reading is that this is a structural expansion of the AML/CTF perimeter rather than a single enforcement episode, and it arrives alongside a second, complementary signal: the Financial Intelligence Unit at the Central Bank of Sri Lanka disclosed Rs.14.6 million in administrative penalties against eleven institutions, seven financial institutions and four designated non-financial businesses and professions, for breaches of the Financial Transactions Reporting Act spanning October 2025 to March 2026. Cargills Bank PLC was fined Rs.2 million for failing to report eighteen electronic fund transfers, and one finance company was found to have maintained relationships with three UN-designated individuals, a screening failure that speaks directly to the sanctions-implementation weaknesses a mutual evaluation would be expected to test. #### Other Developments Virtual-asset framework continues to develop without statutory footing. Sri Lanka's government VASP Sub-Committee held its fifth meeting on 10 August 2026, receiving technical assistance from UK HM Treasury officials on FATF Recommendation 15 compliance. The Securities and Exchange Commission has been recommended as the lead VASP regulator, but no VASP Act has been enacted or gazetted. The persistence of this gap, now five committee meetings deep with external technical assistance but no legislative output, is itself a finding: the absence of enacted law in a jurisdiction actively engaging with FATF technical standards is a different risk posture than simple regulatory silence, and it is the kind of enablement-by-delay that a purely enforcement-volume view of AML/CTF risk would miss. Civil-society commentary flags overreach risk tied to grey-list anxiety. Reporting from Daily FT, dated 18 September 2026, raises concern that the scale and speed of the legislative response, including expanded executive asset-freezing and surveillance powers introduced without prior judicial authorisation, may reflect a defensive posture driven by fear of FATF grey-listing rather than calibrated policy design. This is a genuine three-pillar tension: provisions aimed at strengthening AML and CTF compliance can, if drafted under evaluation-driven time pressure, create due-process gaps that generate their own governance risk. #### Cross-Monitor Connections The virtual-asset regulatory gap identified in the Crypto, Digital Assets, and Financial Innovation domain connects directly to the crypto monitor's own tracking of Sri Lanka's unregulated-gap status: the absence of a VASP Act and the absence of any CBSL-authorised licensing category for exchange, custody or advisory activity are two sides of the same structural finding, one read through an AML/CFT lens and the other through a market-access lens. The beneficial-ownership provisions newly inserted into the Prevention of Money Laundering Act by the July 2026 amendments also intersect with the standing Beneficial Ownership (Companies) Amendment Act, No. 12 of 2025 framework, though that intersection is not itself a change this cycle. No world-payments or advennt-relevant developments were identified in this cycle's substrate for Sri Lanka. #### Outlook The outcome of Sri Lanka's third FATF/APG mutual evaluation remains unpublished as of this cycle, and the on-site assessment and plenary result are not confirmed in open sources. The legislative amendments passed in July 2026 and the enforcement disclosures made in that same month should be read as the government's visible remediation posture ahead of that outcome, not as its conclusion. Whether the VASP Sub-Committee process converts into an enacted statute, and whether the expanded executive powers draw further civil-society or judicial scrutiny, are the two threads most likely to carry forward as scheduled into subsequent cycles. 28 Sep 2026 · fim-2026-09-28 #### Lead Signal Sri Lanka certified a coordinated three-Act AML/CFT legislative package on 4 August 2026, comprising amendments to the Prevention of Money Laundering Act (No.16 of 2026), the Financial Transactions Reporting Act (No.17 of 2026), and the Convention on the Suppression of Terrorist Financing Act (No.18 of 2026). The package broadens predicate offences, permits non-conviction-based proceedings, extends transaction-suspension orders from seven to fourteen working days, creates a National Committee on AML/CFT, and, for the first time in Sri Lankan law, classifies virtual asset service providers as financial businesses subject to AML/CFT obligations. Officials have been explicit that the reform's central policy driver is avoidance of a repeat FATF grey-listing, following the country's 2017-2019 listing experience, ahead of a third APG/FATF Mutual Evaluation that commenced around March 2026 under FATF's revised effectiveness-weighted methodology, with the Mutual Evaluation Report expected for APG plenary adoption around July 2027. This places Sri Lanka's reform architecture squarely in the compliance-driven category: the package tests not just legal transposition but implementation effectiveness, and the country's own officials have said as much. #### Other Developments A beneficial-ownership register became operational on 30 March 2026. The Companies (Amendment) Act, No.12 of 2025 (ss.130A-130J) and its accompanying Companies (Beneficial Ownership) Regulations No.01 of 2026 define beneficial ownership at a 10% threshold, abolish bearer shares outright, and require a register accessible to the Attorney-General, the Financial Intelligence Unit, Customs, and the Inland Revenue Department. This closes a longstanding corporate-opacity gap that prior FATF and APG assessments had flagged, and the confidence in this development is high, corroborated by both the primary Act text and independent professional-services reporting. Virtual asset service providers entered the AML perimeter without a licensing regime to match. The Financial Transactions Reporting (Amendment) Act, No.17 of 2026 classifies VASPs as financial businesses subject to AML/CFT obligations, the first Sri Lankan statute to name VASPs at all. No prudential licensing or supervisory authorisation regime accompanies this classification. Separately, the Sri Lanka Cabinet approved drafting a dedicated VASP licensing law, with the Securities and Exchange Commission recommended as lead regulator working alongside the Central Bank, the Financial Intelligence Unit and the Inland Revenue Department. FATF Recommendation 15/Travel Rule technical assistance was delivered to Sri Lanka's VASP Sub-Committee in August 2026, signalling this is an active drafting priority rather than a dormant proposal, though the licensing law itself remains at the Cabinet-approval and drafting stage with no gazetted text yet available. #### Cross-Monitor Connections The VASP AML-recognition development is a direct nexus point with the crypto-focused monitor: the same Financial Transactions Reporting Act amendment that this brief treats as an AML architecture change is, from a digital-assets lens, the first-ever statutory touchpoint for virtual assets in Sri Lankan law, and the same Cabinet-approved licensing drafting process and Travel Rule technical assistance recur there as the central pending-framework story. The beneficial-ownership register development also intersects with payments-infrastructure monitoring to the extent that corporate transparency underpins counterparty due diligence for payment-services licensing, though no direct payments-infrastructure claim was surfaced this cycle to substantiate that link further. #### Outlook The determinative event to watch is the third APG/FATF Mutual Evaluation, with a report expected for APG plenary adoption around July 2027. Because the evaluation applies FATF's revised effectiveness-weighted methodology, the 2025-2026 legislative package's legal existence will not by itself avoid a grey-list outcome; implementation effectiveness, including whether the beneficial-ownership register is genuinely used and whether VASP AML obligations translate into supervised practice, will be tested directly. A second item to watch is whether the Cabinet-approved VASP licensing law is enacted before the Mutual Evaluation concludes, which would close the current gap between AML recognition and prudential supervision of virtual asset businesses. 14 Sep 2026 · fim-2026-08-21 #### Lead Signal The most consequential financial-integrity development in Sri Lanka this cycle is structural rather than punitive: the Companies (Amendment) Act No. 12 of 2025 and the Companies (Beneficial Ownership) Regulation No. 1 of 2026 came into force on 30 March 2026, introducing a 10% beneficial-ownership disclosure threshold and an effective-control test administered through a dedicated Registrar of Companies portal, covering Sri Lankan-registered companies including offshore and overseas-registered entities. This is a High-confidence, Tier-1-sourced change that materially narrows a corporate-opacity gap long flagged in prior FATF and APG evaluations, and it lands directly ahead of the third APG and FATF mutual evaluation of Sri Lanka, which formally commenced in March 2026 under the FATF revised effectiveness-focused methodology, with an on-site visit scheduled for October 2026 and mutual evaluation report adoption expected at the APG AGM in July 2027. Officials frame avoiding a third grey-listing as an existential compliance priority, and the timing of the beneficial-ownership regime commencement -- barely six months before the on-site visit -- reads as a deliberate architecture-first response ahead of assessment rather than an enforcement action responding to a specific incident. #### Other Developments A proposed virtual-asset framework moves toward the drafting stage. The Deputy Minister of Digital Economy presented the apex AML body of Sri Lanka with a first virtual-asset regulatory framework proposal in February 2026, intended to license and supervise virtual-asset service providers and introduce travel-rule-equivalent information-sharing requirements. Sri Lanka remains rated only partially compliant with FATF Recommendation 15 because no VASP is currently licensed or supervised, and this Assessed-confidence development represents a shift from a wholly unregulated posture toward a proposed governance structure, though no licensing regime is yet operative. A parallel Cabinet-approved measure from June 2026 would require public officials to declare cryptocurrency and blockchain holdings, an anti-corruption and transparency signal that sits alongside the VASP proposal. This measure also carries an anti-corruption dimension that cross-references to the WDM state-capture monitor remit, insofar as undisclosed digital-asset holdings by public officials raise a transparency question distinct from the AML/CFT licensing question proper. The 2024/25 National Risk Assessment reframes the threat profile of Sri Lanka. The NRA rates drug trafficking as High risk and fraud and trade-based money laundering as Medium-High, reflecting the continuing function of Sri Lanka as an Indian Ocean narcotics transshipment corridor linking Golden Crescent and Golden Triangle routes. These findings feed a new National AML/CFT/CPF Policy for 2026-2030. This is Assessed-confidence, secondary-sourced reporting of what is understood to be a primary NRA document not directly retrieved this cycle. The Colombo Port City Special Economic Zone is flagged, at Low confidence, as a possible enabler-jurisdiction risk vector. Displaced Philippine Offshore Gaming Operator networks are reportedly relocating toward Sri Lanka, including the Port City SEZ, whose distinct legal framework is raised by regional analysts as a potential structuring loophole for online-gambling-linked financial flows. This rests on a single Tier-3 source and has not yet been corroborated by a Tier-1 or Tier-2 source; it is a watch-list signal, not an established finding. #### Cross-Monitor Connections The Colombo Port City SEZ enabler-jurisdiction signal connects directly to the gambling-sector enforcement activity tracked by the advennt monitor this cycle, where Sri Lankan telecommunications authorities ordered large-scale blocking of unlicensed offshore gambling platforms; the financial-integrity reading of that same underlying development is the laundering-structuring risk posed by displaced operator networks relocating into a distinct-legal-framework SEZ, rather than the licensing-enforcement question itself. The proposed virtual-asset framework and the FATF Recommendation 15 partial-compliance rating also intersect with coverage by the world-payments monitor of the domestic payments infrastructure buildout in Sri Lanka, insofar as any future VASP licensing regime will need to interoperate with the Central Bank-supervised payment-systems perimeter. Architecture-over-incident framing is warranted here: the beneficial-ownership regime and the pending mutual evaluation are structural developments that outweigh any single enforcement action in analytical significance this cycle, and CTF and CPF signal remains comparatively under-represented against the AML-heavy corpus, consistent with the general observation that AML enforcement volume structurally crowds out CTF and CPF visibility. #### Outlook The immediate horizon item is the APG on-site visit scheduled for October 2026, with the mutual evaluation report expected for adoption at the APG AGM in July 2027; the durability of the beneficial-ownership regime and its practical enforcement, including phased transition deadlines and portal uptake, will be a central input to that assessment. The progression of the proposed virtual-asset framework from proposal to drafting stage is the second horizon item to watch, given the continuing partial-compliance rating of Sri Lanka under FATF Recommendation 15. The Colombo Port City SEZ signal remains the least-corroborated item in this cycle corpus and warrants a dedicated primary-source search before it can be upgraded from a Low-confidence watch item to an assessed finding. Domain intelligence (D1–D8) #### Sanctions Architecture and Evasion The baseline position of Sri Lanka on the international sanctions-architecture ledger is, on its face, unremarkable. The jurisdiction is not on the FATF grey or black list, having been removed from grey-list monitoring in October 2019, and it remains under Asia/Pacific Group enhanced follow-up, with the latest technical-compliance follow-up update dated December 2025, ahead of a full Mutual Evaluation expected around mid-2027. Sri Lanka is also absent from both the current EU high-risk third country delegated regulation and the UK Money Laundering Regulations high-risk third country advisory notice as of this baseline. These two lists move independently of one another rather than in lockstep, and the baseline treats each as requiring re-verification at every cycle rather than an assumption of continuity between them. Continue reading Set against that comparatively clean formal standing, the most architecturally significant development this cycle is the exercise by the UK of an entirely separate sanctions instrument, one that operates outside the FATF/APG technical-compliance track altogether. On 24 March 2025, OFSI, acting alongside the Foreign, Commonwealth and Development Office, designated four individuals under the UK Global Human Rights sanctions regime. The designees include former senior Sri Lankan military commanders and ex-LTTE/Karuna Group leader Vinayagamoorthy Muralitharan, sanctioned for extrajudicial killings, torture and sexual violence committed during the civil-war era. As of the baseline, no parallel US Treasury OFAC or EU asset-freeze designation of the same four individuals has been identified. This absence is assessed, not merely observed. The available evidence does not point to an evidentiary or capacity gap in Washington or Brussels; rather, it is read as a genuine divergence in cross-bloc human-rights-sanctions policy, and one assessed as sharper than the divergence typically observed on Russia-related designations, where the UK, US and EU tend to act in closer parallel through coordinated designation cycles. The architectural reading that follows is that unilateral, single-bloc human-rights sanctions regimes now function as an independent enforcement channel, operating without the coordination reflexes that have come to characterise the Russia sanctions ecosystem specifically. That is a structural feature of the current sanctions landscape with implications extending well beyond Sri Lanka: wherever a single jurisdiction human-rights sanctions authority moves unilaterally, the resulting designation gap becomes a standing feature of the compliance environment rather than a transitional anomaly awaiting harmonisation. For obliged entities operating across the UK, US and EU nexus, the practical consequence of this divergence is a fragmented designation landscape in which screening against any single sanctions list is insufficient to capture the full universe of human-rights-driven exposure. A customer or counterparty cleared against the OFAC Specially Designated Nationals list or an EU asset-freeze annex may nonetheless carry UK Global Human Rights sanctions exposure that a US-only or EU-only screening architecture would miss entirely, and the inverse holds equally should Washington or Brussels act unilaterally in a future cycle. This is properly read as a structural screening-architecture question rather than an isolated compliance failure attributable to any single institution control environment; it is the sanctions-architecture equivalent of a coverage gap built into the multilateral system by design rather than by oversight. The FATF/APG technical-compliance track, meanwhile, continues on a steady and largely uneventful trajectory. The December 2025 follow-up update confirms continued enhanced-follow-up status for Sri Lanka without escalation toward re-listing, and without the kind of adverse finding that would itself constitute a sanctions-architecture signal. The two tracks, FATF technical compliance and unilateral human-rights sanctions authority, are, on this baseline, moving on entirely independent timelines, evidencing that the formal AML/CFT standing of Sri Lanka and its human-rights-accountability exposure are assessed and acted upon through wholly separate institutional channels internationally. #### Outlook The clearest forward test for the sanctions-architecture posture of Sri Lanka is the next full FATF Mutual Evaluation, expected around mid-2027, which will apply the 2025-revised FATF methodology, including current-effectiveness and virtual-asset-effectiveness testing, for the first time since 2015. General industry expectation is that this current-methodology assessment will surface effectiveness gaps not visible through technical-compliance follow-up alone, a materially more searching exercise than the December 2025 update, which simply confirmed continued enhanced-follow-up status without probing underlying implementation effectiveness. Independent of that FATF trajectory, whether the divergence between UK unilateral human-rights sanctions action and the continued absence of matching OFAC or EU designations narrows or persists is itself worth tracking at each future cycle. No public statement from OFAC or EU authorities has been identified explaining that absence, leaving open whether it reflects a considered political choice or an undisclosed capacity constraint, a distinction with material consequences for how obliged entities should weight the durability of the current designation gap. The continued absence of Sri Lanka from both the EU and UK high-risk third country lists should also be re-verified rather than assumed stable, given that the two lists have moved independently of each other in the past and could diverge again with limited warning. #### Beneficial Ownership and Corporate Transparency Sri Lanka sits outside the European Union's AML architecture entirely, so the AML Regulation, the sixth AML Directive, and the Anti-Money Laundering Authority Regulation have no direct application to its regime. Globally, that EU package, the directly applicable AML Regulation, the Member-State-transposed sixth AML Directive, and the AMLA Regulation establishing a new EU-level authority with a direct and indirect supervision perimeter over higher-risk obliged entities, sets a structural direction that many non-EU regimes are measured against informally, but it is not the operative framework here. What is directly relevant to Sri Lanka's own regulatory perimeter is narrower and more immediate: the Financial Intelligence Unit has stated publicly that beneficial ownership is the single FATF recommendation on which the country remains rated non-compliant, and that statement arrives while international assessors are conducting the country's third mutual evaluation on-site visit. Continue reading The significance of FIU-SL naming its own gap, rather than having it surfaced externally, is that it reframes beneficial ownership from a background technical-compliance item into the one lever the authorities believe remains within domestic control before the evaluation's outcome is fixed. The unit has urged private-sector entities to move ahead with implementing the beneficial-ownership provisions recently inserted into the Companies Act, a signal that the legal architecture exists on paper but that operational uptake, obliged entities actually identifying and recording beneficial owners in practice, is the piece still outstanding. That distinction, between a regime that has legislated a beneficial-ownership requirement and one where that requirement is visibly and verifiably in use by banks and other reporting institutions, is exactly the kind of implementation gap that mutual evaluations are designed to test, and it is the gap Sri Lanka has chosen to disclose about itself rather than wait for assessors to find. This sits against a backdrop of otherwise active legislative reform: amendments to the Banking Act, the Financial Transactions Reporting Act, the Prevention of Money Laundering Act, and the Convention on the Suppression of Terrorist Financing Act were all cited by the Central Bank Governor as grounds for confidence that a third grey-listing can be avoided. Beneficial ownership is conspicuous in that list precisely because it is the one area where the official position is candidly short of full compliance rather than claiming resolution. For any institution assessing Sri Lankan counterparties or corporate structures, the near-term signal is not a finding of non-compliance in some abstract sense, since that rating already exists and is not new, but whether implementation visibly accelerates in the window following the on-site assessment, when the pressure to demonstrate progress before a mutual evaluation report is finalised is at its highest. #### Outlook The mutual evaluation process does not resolve beneficial-ownership status immediately. A report is expected to proceed to the Asia/Pacific Group on Money Laundering's Annual General Meeting, provisionally anticipated around mid-2027, and that date carries meaningful uncertainty rather than being fixed. Between the conclusion of the on-site visit and that eventual plenary outcome, the most observable marker for beneficial ownership specifically is whether reporting institutions in Sri Lanka begin visibly applying the new Companies Act provisions in practice, since that is the exact implementation step FIU-SL has identified as outstanding. Absent a change in the recommendation rating itself, which has not occurred, the matter remains a watch item rather than a resolved compliance question. #### Enabler Jurisdictions and Professional Facilitators The baseline enabler-jurisdiction exposure of Sri Lanka runs in two directions simultaneously: outward, through the professional-facilitator infrastructure that receives Sri Lankan elite capital flight, and inward, through the transnational trafficking networks that exploit the maritime and logistics position of Sri Lanka. Both patterns were established this cycle and are assessed as durable rather than episodic. Continue reading On the outward axis, politically exposed Sri Lankan officials and associates used offshore trusts and shell companies administered by corporate service providers based in Singapore and the United Arab Emirates, the 2021 Pandora Papers leak specifically identified Singapore-based Asiaciti Trust in this role, to acquire luxury real estate, artwork and cash across low-tax jurisdictions, obscuring beneficial ownership from Sri Lankan courts and creditors. This is the textbook enabler-jurisdiction pattern: the professional-facilitator infrastructure sits entirely outside the domestic regulatory perimeter of Sri Lanka, in jurisdictions with well-developed corporate-services sectors and comparatively permissive beneficial-ownership disclosure requirements for foreign-administered trust structures, meaning that closing the domestic beneficial-ownership register gap in Sri Lanka would only partially address the exposure, the facilitator infrastructure itself sits in Singapore and the UAE, beyond the regulatory reach of Colombo. The absence of a confirmed material prosecutorial outcome on the resulting CIABOC referral compounds this: even where the underlying assets and structures are documented via investigative journalism, the accountability pipeline from documentation to enforcement has not converted into an outcome within an eighteen-month baseline window. On the inward axis, the position of Sri Lanka on Indian Ocean shipping lanes and growing parcel-mail and air-cargo volumes are exploited by transnational networks moving synthetic drugs, hashish and cocaine, with the UN Office on Drugs and Crime explicitly framing the resulting illicit financial flows as divertible into terrorism financing, drug trafficking generating vast illicit profits that fuel organized crime and can be diverted to finance violent extremism. This is a three-level architecture in the classic sense: the scheme is narcotics movement through postal and air-cargo channels; the architecture is the informal and digital transfer infrastructure that launders the resulting proceeds; and the strategic consequence is the potential diversion of those proceeds into terrorism financing, a CTF-pillar finding that would otherwise be structurally under-weighted relative to the AML-pillar findings that dominate enforcement-volume reporting. Sri Lanka Customs interdicted 4.2 kilograms of synthetic drugs at the Colombo Central Postal Mail Exchange and 17.5 kilograms of hashish and cocaine at Bandaranaike International Airport, including the first slab-form cocaine interdiction for the jurisdiction, evidencing genuine capacity gains following UNODC Programme against Corruption and Crime training, a rare instance in this baseline where the enforcement axis, rather than the enablement axis, shows forward motion. Two further developments bear on the enabler-jurisdiction assessment without fitting neatly into either the outward or inward axis. The renewed Generalised Scheme of Preferences Regulation of the European Union, signed in June 2026 and applying from 1 January 2027 for a further ten years, continues twenty-seven-to-thirty-two-convention conditionality underpinning the status of Sri Lanka as the third-largest GSP+ beneficiary, a governance-leverage mechanism operating adjacent to, but structurally distinct from, the AML supervisory perimeter from which Sri Lanka is otherwise excluded as a non-EEA state. Separately, a four-pillar national strategy against organized crime in Sri Lanka, spanning prevention, pursuit of groups and proceeds, protection, and partnership, is expected to move toward defined implementing activities during 2026, following 2025 UNODC-supported workshops; sustained implementation could meaningfully strengthen the inter-agency architecture needed to address both the outward elite-capital-flight pattern and the inward trafficking-finance nexus described above. #### Outlook The enabler-jurisdiction picture for Sri Lanka is best read as asymmetric: genuine capacity-building progress on the inward, narcotics-interdiction axis, set against a largely unaddressed outward axis where the professional-facilitator infrastructure enabling elite asset flight sits beyond the jurisdiction of Colombo entirely and where the domestic accountability pipeline, the CIABOC referral, remains stalled. Whether the move to implementation during 2026 by the four-pillar national organized-crime strategy extends capacity gains beyond narcotics interdiction into the beneficial-ownership and asset-recovery space is the clearest near-term signal to track. The GSP+ conditionality of the EU, renewed for a further ten years from 2027, will continue to apply external governance pressure independent of that domestic track, but as a trade-conditionality lever rather than an AML-supervisory one, its capacity to compel closure of the professional-facilitator gap specifically is limited by design. #### Conflict Finance and Extractive-Industry Integrity The 2024/25 National Risk Assessment of Sri Lanka rates drug trafficking as High risk and fraud and trade-based money laundering as Medium-High, reflecting the continuing function of the country as an Indian Ocean narcotics transshipment corridor linking Golden Crescent and Golden Triangle trafficking routes. These findings feed directly into a new National AML/CFT/CPF Policy for 2026-2030. This is Assessed-confidence, Tier-3-sourced reporting of what is understood to be a primary National Risk Assessment document; the underlying FIU-hosted NRA PDF itself was not directly retrieved this cycle, which is logged as an evidence gap. Trade-based money laundering tied to transshipment trade flows is the closer analogue to a conflict-finance and extractive-industry-integrity reading within this domain, given the port-centric trade geography of Sri Lanka, though the NRA finding as reported does not itself identify a specific conflict-finance or extractive-sector nexus; the connection here is the structural transshipment-corridor profile rather than a named case. Given this transshipment-corridor geography, trade-based money laundering typologies connected to bulk shipping and free-trade-zone activity are the most plausible bridge between this domain conflict-finance framing and the Medium-High TBML rating in the NRA itself, and this bridge should be tested directly once the primary NRA text is available. No Sri Lanka-specific extractive-industry finding, in mining, gemstone, or hydrocarbon sectors, was located this cycle. Continue reading #### Outlook The priority action is retrieval of the primary FIU-hosted 2024/25 National Risk Assessment document, which would allow this finding to be assessed directly against its source rather than through secondary reporting, and would also clarify whether the new National AML/CFT/CPF Policy 2026-2030 contains any conflict-finance-specific or extractive-industry-specific recommendations among its stated fifteen key recommendations. #### Crypto / Digital Assets / Financial Innovation The defining development in Sri Lanka's own digital-asset regulatory environment this period is legislative rather than enforcement-driven. The Financial Transactions Reporting (Amendment) Act, No. 17 of 2026, certified on 4 August 2026, brings Virtual Asset Service Providers within the FTRA's definition of a financial business for the first time. That single definitional change carries substantial practical weight: VASPs operating in or serving Sri Lanka become reporting institutions subject to the same risk-based customer due diligence obligations, suspicious-transaction reporting duties, and supervisory oversight from the Financial Intelligence Unit that apply to banks and other traditional financial businesses. This is a structural widening of the AML perimeter, not an isolated enforcement action, and it is the kind of change that reshapes the operating environment for every VASP with Sri Lankan exposure going forward, regardless of whether any individual firm has yet been examined under it. Continue reading What makes the Sri Lankan posture distinctive is the pairing of this AML-perimeter expansion with an unchanged commercial posture on crypto itself. The Central Bank of Sri Lanka's standing position, reaffirmed in the same legislative context, is that cryptocurrency is not legal tender and that no domestic cryptocurrency exchange currently holds a licence to operate. In other words, Sri Lanka has extended the full weight of financial-crime compliance obligations to virtual asset activity without correspondingly opening any formal, licensed pathway for that activity to operate domestically. That is a deliberate and coherent regulatory choice: the absence of a licensing regime is not an oversight sitting alongside the AML expansion, it is the other half of the same posture, treating the sector as a source of AML exposure to be controlled before it is treated as a sector to be permitted and supervised commercially. For firms assessing exposure through Sri Lankan channels, the practical consequence is that any VASP activity touching the jurisdiction now sits inside a reporting-institution framework even though it has no corresponding licence to point to domestically. That combination is one a counterparty risk assessment should weigh directly: obligations exist and are enforceable in principle, but the absence of a licensed, supervised domestic exchange sector means there is no established Sri Lankan VASP of record to benchmark against yet. The amendment is dated 4 August 2026, ahead of the mutual evaluation's on-site assessment, which suggests the change was made with FATF Recommendation 15 compliance specifically in view, closing a sectoral gap that earlier evaluations would likely have flagged. #### Outlook The next visible marker for this domain is less about further legislative change, which has already landed, than about implementation: whether FIU-SL begins registering, examining, or reporting on VASPs under the new financial-business definition in a way that becomes publicly observable. The Central Bank's position on legal tender and exchange licensing has not shifted and nothing in the available record suggests it is expected to shift imminently, so the near-term picture for crypto in Sri Lanka remains one of AML obligation without a parallel licensing gateway. Firms should treat the compliance perimeter as already active from August 2026 even in the continued absence of any licensed domestic exchange. #### Compliance Technology and Active Defence The clearest compliance-technology finding in this baseline is a business-email-compromise scheme that diverted approximately 2.5 million US dollars from sovereign Treasury payment channels. Between December 2025 and March 2026, criminals intercepted email communications between the Sri Lankan Treasury and Australian export-finance counterparties, enabling the redirection of five successive loan-repayment instalments into criminal-controlled accounts. The scheme exploited weak email-authentication and payment-verification controls within sovereign financial infrastructure, the kind of control gap that, at institutional scale, active-defence tooling such as payment-verification callback protocols, domain-authentication standards, and anomaly-detection on payment-instruction changes is specifically designed to close. That the exploited counterparty was a Central Bank and Treasury payment channel, rather than a commercial banking relationship, raises the stakes: sovereign payment infrastructure sits at the top of the trust hierarchy that correspondent banking and export-finance arrangements depend upon, and a successful business-email-compromise intrusion at that level signals a control gap with potential systemic reach across every counterparty relying on the authenticity of that same payment channel. Continue reading The destination and further laundering path of the diverted funds has not been established by investigators as of this baseline, which limits the ability of the assessment to trace whether the proceeds moved through the same enabler-jurisdiction or crypto-laundering infrastructure documented elsewhere in this baseline, or through an entirely separate channel. This is a material evidentiary gap rather than a closed investigation, and the current absence of a confirmed destination should not be read as an indication that tracing efforts have concluded. The compliance-technology reading of this incident is twofold. First, it reflects a technology gap: the payment-verification controls that would ordinarily flag a change in payment instructions between long-standing counterparties evidently did not trigger, or were not in place, across the five successive fraudulent instalments, a repeated-exploitation pattern rather than a single lapse, suggesting the underlying control gap persisted across multiple payment cycles without detection or correction. Second, it reflects a governance and disclosure gap: the public visibility of the incident rests on investigative reporting rather than a proactive supervisory disclosure, raising a broader question about whether sovereign payment-infrastructure incidents of this kind are subject to the same disclosure expectations increasingly applied to regulated financial institutions. Both gaps are assessed as compounding rather than isolated failures, a technology control gap and a governance and transparency gap operating in the same incident, each reinforcing the conditions that allowed the other to persist undetected for months. The customer-typology profile of this scheme, corporate and correspondent-banking relationships rather than retail, situates it squarely within the trade-finance and correspondent-banking control environment that active-defence programmes at commercial banks have increasingly prioritised since 2020, yet its occurrence within sovereign Treasury infrastructure suggests that hardening at the level of individual correspondent banks does not automatically extend to state payment channels, which may sit outside the direct supervisory reach of banking-sector cyber-fraud controls entirely. For active-defence purposes, this incident functions as an architecture-level case study rather than an isolated fraud loss: it demonstrates concretely how sovereign-level payment infrastructure, often assumed to carry higher assurance than commercial banking rails, can in practice lack the basic payment-instruction verification controls that regulated commercial institutions are increasingly expected to deploy as standard active-defence measures against business-email-compromise typologies. #### Outlook Whether the Treasury and Central Bank of Sri Lanka strengthen payment-verification and email-authentication controls in response to this incident, and whether the destination and laundering path of the diverted 2.5 million US dollars is eventually established, are the two clearest forward markers for this domain. A future cycle establishing the laundering destination would allow this incident to be integrated with other financial-crime findings for the jurisdiction, particularly the enabler-jurisdiction and crypto-laundering patterns documented elsewhere in this baseline, rather than being assessed in isolation as it currently must be. Absent confirmed remediation, the underlying control gap should be assumed to persist, and the incident should be read as a standing illustration of active-defence control gaps in sovereign payment infrastructure more broadly, not merely a closed historical event. Whether any post-incident supervisory review of Treasury payment controls has since been initiated is not established in current evidence and constitutes a standing gap for future-cycle tracking. This incident sits within a domain that captures compliance technology and active defence broadly, and the trajectory assessed as worsening for Sri Lanka on this axis reflects that the exploited control gap is both recent and unremediated as of this baseline, distinguishing it from the comparatively stable trajectories assessed for the D1 sanctions-architecture and D3 enabler-jurisdiction postures of Sri Lanka this cycle. #### AML/CTF Regime Sri Lanka's AML/CTF regime is mid-assessment. An on-site evaluation by APG and international assessors, conducted as part of the country's third FATF-style mutual evaluation, commenced in mid-October 2026 and was scheduled to run two weeks, placing its conclusion in the first week of November 2026. Central Bank of Sri Lanka Governor Weerasinghe has publicly expressed confidence that the country will avoid a third grey-listing, grounding that confidence in a cluster of 2026 legislative reforms: amendments to the Banking Act, new beneficial-ownership provisions in the Companies Act, amendments to the Financial Transactions Reporting Act and the Prevention of Money Laundering Act, and amendments to the Convention on the Suppression of Terrorist Financing Act. Taken together, these represent a genuine and fairly comprehensive legislative push undertaken specifically ahead of this evaluation cycle, rather than a response to a prior adverse finding. Continue reading The regime's own acknowledged weak point sits alongside that reform push rather than being resolved by it. The Financial Intelligence Unit of Sri Lanka has stated that beneficial ownership remains the only FATF recommendation on which the country is currently rated non-compliant, a disclosure made publicly and ahead of the evaluation's conclusion, apparently intended to mobilise private-sector implementation of the beneficial-ownership regime before assessors finalise their findings. That a national FIU would name its own residual gap in public, while assessors are still in the country, says something about how close the assessment is seen to be, and about where the government believes the decisive swing factor to lie. The legislative programme itself has concrete, identifiable components beyond the beneficial-ownership question. The Financial Transactions Reporting (Amendment) Act, No. 17 of 2026, certified 4 August 2026, formalises risk-based customer due diligence procedures, expands obligations on reporting institutions generally, and strengthens FIU-SL's own establishment and statutory powers, in addition to its headline effect of bringing Virtual Asset Service Providers within AML scope for the first time. Each of these is a structural change to the regime's architecture rather than an episodic enforcement event, and collectively they form the evidentiary basis for the Governor's public confidence, whatever assessors ultimately conclude about their sufficiency. What has not yet happened, and what the record available does not resolve, is any outcome from the on-site visit itself. No mutual evaluation report has been published, no plenary determination has been made, and the Governor's statement of confidence is a government position rather than an assessor finding. The two are not the same thing, and nothing in the current record reconciles them. #### Outlook Procedurally, the on-site visit concluding in early November 2026 feeds into a mutual evaluation report, which is expected to be brought before the Asia/Pacific Group on Money Laundering's Annual General Meeting for adoption, provisionally anticipated around mid-2027 and subject to considerable uncertainty around that date. Until that report is adopted, Sri Lanka's grey-list status cannot be considered determined in either direction, and the Governor's confidence should be read as the government's own assessment rather than as a settled outcome. The single clearest swing factor identified by the country's own regulator is beneficial-ownership implementation; whether that visibly firms up in the coming months is the most direct indicator available of how the eventual evaluation finding is likely to land. No qualifying commercial event found this cycle. Regulatory horizon Consultation 2026-Q4 · ±half_year ### GRA first-phase gambling regulations (licensing, online gambling, AML) Would, for the first time, define authorised gambling activities and apply AML requirements to the sector under a single ministerial order. [Source](https://www.themorning.lk/articles/IHX7rbh4ZCTov1z0v4r5) Proposed 2027 · ±year ### Virtual Asset Regulatory Framework (proposed) Introduction of VASP registration/licensing and travel-rule-equivalent information-sharing requirements. [Ministry of Digital Economy / CBSL / FIU Source](https://www.themorning.lk/articles/Y3WRUrbgqxrcJdbgvHlF) Proposed 2027-Q1 · ±multi_year ### Dedicated VASP licensing and supervision Act Cabinet-approved drafting of a dedicated VASP law, with SEC proposed as lead regulator coordinating with CBSL, FIU and IRD. [Securities and Exchange Commission of Sri Lanka (proposed) Source](https://www.ft.lk/front-page/Cabinet-backs-legal-framework-to-regulate-virtual-asset-service-providers/44-795284) In Force Pending 2027-Q3 · ±half_year ### FATF/APG Third Mutual Evaluation of Sri Lanka On-site assessment completed around early November 2026; a mutual evaluation report is expected to be adopted at the APG Annual General Meeting, provisionally mid-2027, determining whether Sri Lanka faces a third grey-listing. [Source](https://www.fatf-gafi.org/en/calendars/assessments.html) 4 dated · 3 pending date · baseline financial-integrity-2026-07-05 Role action cards MLRO ### Sri Lanka third mutual evaluation on-site visit underway, with beneficial ownership named as the sole outstanding FATF gap. A customer base or correspondent exposure touching Sri Lanka sits inside a regime undergoing live assessment, where the regulator has itself identified beneficial-ownership verification as the weakest point. This has direct bearing on due-diligence depth for Sri Lankan corporate counterparties. 3 evidence refs Compliance ### Virtual Asset Service Providers now fall within Sri Lanka's financial-business definition under the FTRA amendment of 4 August 2026. Any policy or control framework covering Sri Lankan exposure needs to treat VASPs as reporting institutions from that date, even though no domestic exchange holds a licence and crypto is not legal tender there. The obligation and the commercial permission are not aligned. 2 evidence refs Legal ### No adverse FATF designation or grey-listing has occurred against Sri Lanka this cycle; the mutual evaluation outcome remains pending. Liability exposure tied to a formal grey-list designation has not crystallised and should not be assumed. The operative legal facts are the in-force FTRA, PMLA and CSTFA amendments and the Companies Act beneficial-ownership provisions, not any assessor finding, which has not been published. 3 evidence refs Board ### Sri Lanka is undergoing a FATF-style mutual evaluation whose outcome will determine whether a third grey-listing follows, with a decision not expected before mid-2027. Material reputational and market-access exposure tied to Sri Lankan operations will not be resolved in the near term. The government has expressed public confidence in the outcome, but that is a political statement, not an assessor finding, and the two should not be conflated at a governance level. 2 evidence refs CTO ### Sri Lanka has extended AML reporting-institution obligations to Virtual Asset Service Providers without opening a licensed domestic exchange pathway. Any platform architecture routing transactions through Sri Lankan VASP counterparties needs to account for a compliance obligation that exists without a corresponding licensing regime to benchmark against domestically. This is a structural, not incident-level, feature of the jurisdiction's current digital-asset posture. 2 evidence refs Risk ### Beneficial-ownership non-compliance is the single named gap in an otherwise active Sri Lankan legislative reform programme ahead of a pending mutual evaluation outcome. Exposure concentration tied to Sri Lankan corporate-structure opacity should be read against a regulator-acknowledged gap, not a hypothetical one. This is a self-disclosed weakness, which carries different evidentiary weight than an externally sourced finding. 1 evidence refs Operations ### Screening and onboarding workflows touching Sri Lankan Virtual Asset Service Providers now sit under formal reporting-institution obligations as of 4 August 2026. Transaction-monitoring and screening processes that treat Sri Lankan VASP counterparties as unregulated should be updated to reflect the FTRA amendment's reporting-institution status for that sector, notwithstanding the absence of a licensed domestic exchange. 2 evidence refs Audit ### Sri Lankan beneficial-ownership documentation practices are the specific area the national FIU has flagged as unproven ahead of the mutual evaluation outcome. Control-testing scope for Sri Lankan corporate counterparties should treat beneficial-ownership evidence as the area most likely to show a documented gap, since the regulator responsible for the country's FATF standing has named it as the one area of acknowledged non-compliance. 1 evidence refs Scenario sketches ### Illustrative: beneficial-ownership implementation gap persisting past evaluation close An illustrative pathway worth tracking: assessors could conclude their on-site review while private-sector beneficial-ownership reporting under the amended Companies Act provisions remains only partially operational among reporting institutions. In such an illustrative scenario, the written mutual evaluation report might still note the legislative provision as technically in force while flagging effectiveness concerns around actual use, a distinction between technical compliance and effectiveness that mutual evaluations are specifically designed to test. This is a sketch of a possible pathway, not a forecast of what assessors will find. Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact. Standing trackers (T1–T6) Tracker Status Note T1 · Sanctions Architecture / Russian Sanctions-Evasion Architecture no_change No material change found concerning LK this cycle. T2 · EU AML Package / AMLA no_change LK is non-EEA; AMLR/6AMLD/AMLA are not directly applicable. T3 · FATF Grey List watch LK's third mutual evaluation on-site visit is underway; outcome and plenary discussion pending. T4 · Beneficial-Ownership Register Status watch FIU-SL flagged beneficial ownership as LK's only non-compliant FATF recommendation. T5 · Crypto & Digital-Asset Integrity material_change FTRA Amendment Act No. 17 of 2026 brings VASPs within 'financial business' definition for the first time. T6 · Sanctions Regime Divergence no_change No change identified in LK's own designation list or cross-bloc divergence this cycle. Registers ### Enforcement actions - 24 Mar 2025 - 23 Apr 2026 - 30 Jul 2025 - 1 Dec 2025 - 4 Oct 2026 - The UK imposed asset-freeze and travel-ban sanctions on 4 individuals for serious human rights violations and abuses during the Sri Lankan civil war, including extrajudicial killings, torture and sexual violence. 24 Mar 2025 - Investigation launched into a business-email-compromise scheme that diverted approximately $2.5m in payments intended for Australian export-finance counterparties between December 2025 and March 2026. 23 Apr 2026 - Following UNODC anti-smuggling training, Customs officers seized 4.2kg of synthetic drugs (MDMA, crystal methamphetamine, synthetic cannabinoids) at the Colombo Central Postal Mail Exchange, and 17.5kg of hashish and cocaine at Bandaranaike International Airport, including the airport's first slab-form cocaine interdiction. 30 Jul 2025 - Continued enhanced follow-up monitoring and technical-compliance re-rating process for Sri Lanka under the FATF/APG mutual evaluation follow-up mechanism, with the latest published update dated December 2025. 1 Dec 2025 ### Sanctions changes - 24 Mar 2025 - 24 Mar 2025 - UK Global Human Rights sanctions regime listing of 4 individuals, including former senior Sri Lankan military commanders and former LTTE/Karuna Group leader Vinayagamoorthy Muralitharan, for civil-war era extrajudicial killings, torture and sexual violence. 24 Mar 2025 - No matching US Treasury OFAC or EU Global Human Rights Sanctions Regime asset-freeze designation against the Sri Lankan civil-war era figures sanctioned by the UK in March 2025 was identified; US and EU engagement on Sri Lanka accountability has instead run through UNHRC Core Group diplomacy and GSP+ trade conditionality rather than Treasury-style designations. 24 Mar 2025 ### Regulatory horizon (register) - Virtual Asset Regulatory Framework (proposed) - GRA secondary AML/licensing regulations for gambling sector - Virtual Asset Regulatory Framework (proposed) - Third APG/FATF Mutual Evaluation of Sri Lanka - Dedicated VASP licensing and supervision Act - GRA gambling-sector secondary AML/licensing regulations - Third FATF/APG mutual evaluation of Sri Lanka - GRA first-phase gambling regulations (licensing, online gambling, AML) - Virtual Asset Service Providers (VASP) regulatory framework and SEC Act amendment - FATF/APG Third Mutual Evaluation of Sri Lanka - FATF/APG Third Mutual Evaluation of Sri Lanka - FATF/APG next Mutual Evaluation onsite and plenary discussion for Sri Lanka - New EU GSP Regulation applies, continuing Sri Lanka's GSP+ conditionality - National strategy to counter organized crime moves to implementation phase ### Active schemes - PEP offshore structuring via Singapore/UAE corporate service providers - Migrant-worker trafficking into Southeast Asian scam-centre forced criminality - Indian Ocean maritime narcotics-transit financing organized crime/terror nexus - Central Bank/Treasury cyber-enabled payment diversion (BEC fraud) Sources - [FATF](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Mutualevaluationofsrilanka.html) - [Financial Intelligence Unit, Sri Lanka](https://fiusrilanka.gov.lk/unscr_sanctions_TF.html) - [Registrar of Companies, Sri Lanka](https://drc.gov.lk/en/?p=4596) - [Sunday Times (Sri Lanka)](https://www.sundaytimes.lk/251005/news/sri-lanka-to-undergo-third-money-laundering-terrorism-financing-evaluation-in-2026-615149.html) - [The Morning (Sri Lanka)](https://www.themorning.lk/articles/Y3WRUrbgqxrcJdbgvHlF) - [Lanka Newspapers](https://www.lankanewspapers.com/2026/06/10/sri-lanka-moves-to-regulate-digital-asset-declarations-as-cabinet-approves-parliamentary-submission) - [Lanka Newspapers](https://www.lankanewspapers.com/2026/08/09/sri-lanka-under-scrutiny-as-asian-criminal-syndicates-eye-island-as-online-gaming-haven) - [Financial Chronicle (Sri Lanka)](https://srilankachronicle.com/sri-lanka-s-primary-money-laundering-threat-drug-trafficking-unveiled/) - [Castellum.AI](https://www.castellum.ai/global-sanctions-guide/apac/sri-lanka-sanctions-guide) - [https://www.newswire.lk/2026/08/04/speaker-certifies-three-financial-reform-bills-strengthening-sri-lankas-anti%E2%80%91corruption-framework/](https://www.newswire.lk/2026/08/04/speaker-certifies-three-financial-reform-bills-strengthening-sri-lankas-anti%E2%80%91corruption-framework/) - [https://www.ibanet.org/Sri-Lanka-beneficial-ownership-regime-impact-on-M&A-transactions](https://www.ibanet.org/Sri-Lanka-beneficial-ownership-regime-impact-on-M&A-transactions) - [https://www.parliament.lk/uploads/acts/gbills/english/6389.pdf](https://www.parliament.lk/uploads/acts/gbills/english/6389.pdf) - [https://www.sundaytimes.lk/251005/news/sri-lanka-to-undergo-third-money-laundering-terrorism-financing-evaluation-in-2026-615149.html](https://www.sundaytimes.lk/251005/news/sri-lanka-to-undergo-third-money-laundering-terrorism-financing-evaluation-in-2026-615149.html) - [https://mode.gov.lk/blog/vasps](https://mode.gov.lk/blog/vasps) - [https://www.ft.lk/front-page/Cabinet-backs-legal-framework-to-regulate-virtual-asset-service-providers/44-795284](https://www.ft.lk/front-page/Cabinet-backs-legal-framework-to-regulate-virtual-asset-service-providers/44-795284) - [https://www.cpalanka.org/cpa-statement-on-the-prevention-of-money-laundering-amendment-bill-tabled-in-parliament-on-5-may-2026/](https://www.cpalanka.org/cpa-statement-on-the-prevention-of-money-laundering-amendment-bill-tabled-in-parliament-on-5-may-2026/) - [https://adaderana.lk/news/cmrdh0acn0001356qffeyx6ri](https://adaderana.lk/news/cmrdh0acn0001356qffeyx6ri) - [https://www.cpalanka.org/financial-transactions-reporting-amendment-bill-sc-sd-18-2026/](https://www.cpalanka.org/financial-transactions-reporting-amendment-bill-sc-sd-18-2026/) - [https://www.dailymirror.lk/breaking-news/FIU-fines-11-institutions-Rs-14-6mn-over-anti-money-laundering-failures/108-346151](https://www.dailymirror.lk/breaking-news/FIU-fines-11-institutions-Rs-14-6mn-over-anti-money-laundering-failures/108-346151) - [https://mode.gov.lk/blog/fatf](https://mode.gov.lk/blog/fatf) - [https://www.apgml.org/sites/default/files/2026-02/APG%20Global%20Fifth%20Round%20Mutual%20Evaluation%20Schedule.pdf](https://www.apgml.org/sites/default/files/2026-02/APG%20Global%20Fifth%20Round%20Mutual%20Evaluation%20Schedule.pdf) - [https://www.ft.lk/front-page/Grey-list-fear-driving-Sri-Lanka-s-AML-CFT-overreach/44-797390](https://www.ft.lk/front-page/Grey-list-fear-driving-Sri-Lanka-s-AML-CFT-overreach/44-797390) - [https://www.desaram.com/beneficial-ownership-companies-amendment-act-no-12-of-2025/](https://www.desaram.com/beneficial-ownership-companies-amendment-act-no-12-of-2025/) - [https://www.parliament.lk/uploads/acts/gbills/english/6378.pdf](https://www.parliament.lk/uploads/acts/gbills/english/6378.pdf) - [Onlanka News](https://www.onlanka.com/news/speaker-endorses-three-laws-to-strengthen-sri-lankas-fight-against-financial-crime.html) - [EconomyNext](https://economynext.com/sri-lanka-tightens-anti-money-laundering-financial-transactions-reporting-laws-278060/) - [Sentinel.gi](https://sentinel.gi/jurisdictions/sri-lanka/) - [International Center for Not-for-Profit Law (ICNL)](https://www.icnl.org/resources/civic-freedom-monitor/sri-lanka) - [Daily FT](https://www.ft.lk/columns/Companies-Amendment-Act-No-12-of-2025-Legal-reforms-and-comparative-insights/4-781222) - [deSaram (law firm)](https://www.desaram.com/beneficial-ownership-companies-amendment-act-no-12-of-2025/) - [Sri Lanka Chronicle (Financial Chronicle)](https://srilankachronicle.com/fatf-sri-lanka-is-not-on-the-grey-list-could-our-own-rules-put-us-back-there/) - [Central Bank of Sri Lanka](https://www.cbsl.gov.lk/en/laws/directions-circulars-guidelines-on-payments-and-settlements) - [International Bar Association](https://www.ibanet.org/Sri-Lanka-beneficial-ownership-regime-impact-on-M&A-transactions) - [https://www.lankanewspapers.com/2026/10/17/sri-lanka-on-track-to-escape-third-fatf-grey-listing-says-central-bank-chief](https://www.lankanewspapers.com/2026/10/17/sri-lanka-on-track-to-escape-third-fatf-grey-listing-says-central-bank-chief) - [https://www.lankanewspapers.com/2026/10/12/sri-lanka-moves-to-regulate-virtual-assets-before-critical-anti-money-laundering-review](https://www.lankanewspapers.com/2026/10/12/sri-lanka-moves-to-regulate-virtual-assets-before-critical-anti-money-laundering-review) - [https://www.ft.lk/front-page/Virtual-asset-rules-take-shape-as-Sri-Lanka-prepares-for-AML-evaluation/44-798542](https://www.ft.lk/front-page/Virtual-asset-rules-take-shape-as-Sri-Lanka-prepares-for-AML-evaluation/44-798542) - [https://island.lk/lanka-confident-of-avoiding-third-fatf-grey-listing-says-cbsl-governor/](https://island.lk/lanka-confident-of-avoiding-third-fatf-grey-listing-says-cbsl-governor/) - [https://www.fatf-gafi.org/en/calendars/assessments.html](https://www.fatf-gafi.org/en/calendars/assessments.html) - [https://www.cbsl.gov.lk/en/node/20613](https://www.cbsl.gov.lk/en/node/20613) - [The Island](https://island.lk/lanka-confident-of-avoiding-third-fatf-grey-listing-says-cbsl-governor/) - [Daily FT](https://www.ft.lk/top-story/FIU-appeals-for-support-ahead-of-crucial-AML-CFT-review/26-795774) - [FIU Sri Lanka](http://fiusrilanka.gov.lk/docs/ACTs/FTRA_Amendment_Act_No_17_of_2026/FTRA_Amendment_Act_No_17_of_2026_E.pdf) - [onlanka.com](https://www.onlanka.com/news/speaker-endorses-three-laws-to-strengthen-sri-lankas-fight-against-financial-crime.html) - [FATF](https://www.fatf-gafi.org/en/calendars/assessments.html) - [Sri Lanka](https://www.fatf-gafi.org/en/countries/detail/Sri-Lanka.html) - [Mutual Evaluation of Sri Lanka](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Mutualevaluationofsrilanka.html) - ["Black and grey" lists](https://www.fatf-gafi.org/en/countries/black-and-grey-lists.html) - [FATF changes its grey listing criteria to further focus on risk](https://www.fatf-gafi.org/en/publications/Fatfgeneral/FATF-grey-listing-criteria.html) - [Jurisdictions under Increased Monitoring - 13 February 2026](https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/increased-monitoring-february-2026.html) - [Asia/Pacific Group on Money Laundering (APG)](https://www.fatf-gafi.org/en/countries/global-network/asia-pacific-group-on-money-laundering--apg-.html) - [Sri Lanka's progress in strengthening measures to tackle money laundering and terrorist financing](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Fur-sri-lanka-2021.html) - [High-risk and other monitored jurisdictions](https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions.html) - [Follow-up report to Sri Lanka's assessment of anti-money laundering and counter-terrorist financing measures](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Fur-sri-lanka-2020.html) - [Jurisdictions under Increased Monitoring - 13 June 2025](https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/increased-monitoring-june-2025.html) - [Sri Lanka's measures to combat money laundering and terrorist financing](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Mer-sri-lanka-2015.html) - [First follow-up report to Sri Lanka's assessment of anti-money laundering and counter-terrorist financing measures](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Fur-sri-lanka-2016.html) - [Page 1 of 3 Statement by Hon. Minister of Justice of Sri Lanka](https://www.unodc.org/documents/congress//01_Statements_HLS/8Mar/Sri_Lanka.pdf) - [The FATF Recommendations](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html) - [The Egmont Group of Financial Intelligence Units | FinCEN.gov](https://www.fincen.gov/resources/international/egmont-group-financial-intelligence-units) - [Sri Lanka Central Bank Tricked Into Paying $2.5M to Cyber Criminals | OCCRP](https://www.occrp.org/en/news/sri-lanka-central-bank-tricked-into-paying-25m-to-cyber-criminals) - [South Asia: UNODC supports Maldives and Sri Lanka in tackling drug-related illicit financial flows to counter terrorism](https://www.unodc.org/southasia/en/frontpage/2025/December/south-asia_-unodc-supports-maldives-and-sri-lanka-in-tackling-drug-related-illicit-financial-flows-to-counter-terrorism.html) - [Sri Lanka Probes $2.5 Million Hack of Finance Ministry Funds - Bloomberg](https://www.bloomberg.com/news/articles/2026-04-23/sri-lanka-probes-2-5-million-hack-of-finance-ministry-funds) - [Enhancing Sri Lanka’s capacity to combat Synthetic Drug and Precursor Trafficking](https://www.unodc.org/unodc/en/pccp/Webstories/enhancing-sri-lankas-capacity-to-combat-synthetic-drug-and-precursor-trafficking.html) - [Sri Lanka: Regional Roundtable and Systems Analysis Exercises on Mapping Drug Trafficking Networks in the Eastern Indian Ocean Region](https://www.unodc.org/unodc/drug-trafficking/crimjust/news/sri-lanka_-regional-roundtable-and-systems-analysis-exercises-on-mapping-drug-trafficking-networks-in-the-eastern-indian-ocean-region.html) - [Sri Lanka: Advancing a comprehensive national strategy to counter organized crime](https://www.unodc.org/southasia/en/frontpage/2025/November/sri-lanka_-advancing-a-comprehensive-national-strategy-to-counter-organized-crime.html) - [Sri Lanka: Forging a unified national strategy against organised crime](https://www.unodc.org/southasia/en/frontpage/2025/April/sri-lanka_-forging-a-unified-national-strategy-against-organised-crime.html) - [Sri Lanka: Customs officers trained to counter evolving synthetic drug threats](https://www.unodc.org/southasia/en/frontpage/2025/July/sri-lanka_-customs-officers-trained-to-counter-evolving-synthetic-drug-threats.html) - [Sri Lanka: Strengthening national responses to human trafficking and smuggling of migrants](https://www.unodc.org/southasia//frontpage/2026/February/sri-lanka_-strengthening-national-responses-to-human-trafficking-and-smuggling-of-migrants.html) - [Global Crypto Policy Review Outlook 2025/26 Report | TRM Labs](https://www.trmlabs.com/reports-and-whitepapers/global-crypto-policy-review-outlook-2025-26) - [2025 Crypto Regulatory Round-Up](https://www.chainalysis.com/blog/2025-crypto-regulatory-round-up/) - [Global crypto regulation review 2025](https://www.elliptic.co/resources/global-crypto-regulation-review-2025) - [How crypto regulation changed in 2025: a global review](https://www.elliptic.co/blog/how-crypto-regulation-changed-in-2025) - [FSB thematic review 2025: Global crypto regulation remains fragmented despite market growth](https://www.elliptic.co/blog/fsb-thematic-review-2025) - [JULY 2025 The Road to Crypto Regulation](https://www.chainalysis.com/wp-content/uploads/2025/06/the-road-to-crypto-regulation-part-release.pdf?mkt_tok=NTAzLUZBUC0wNzQAAAGbcgpA7NF2y9pPQkh3cu8n25w53L74RgbObzSMnm9vS_sFU2z4gx11VsydgTyZi_tc4xRx0JvdvKNCU85rYC6n1XreeaMEYjJ5tX1FVq5lEEPh) - [How Cryptocurrency Is Helping Finance the Drone Revolution](https://www.chainalysis.com/blog/cryptocurrency-drones-research/) - [Digital Assets in Digital Finance Regulatory Standards and Law](https://uncitral.un.org/sites/uncitral.un.org/files/media-documents/uncitral/en/castellano_updated.pdf) - [Stablecoin compliance: what issuers and financial institutions need to know](https://www.elliptic.co/blog/stablecoin-compliance-what-issuers-and-financial-institutions-need-to-know) - [Crypto regulatory affairs: Singapore’s June 30 deadline for digital token service providers approaches](https://www.elliptic.co/blog/crypto-regulatory-affairs-singapores-june-30-deadline-for-digital-token-service-providers-approaches) - [Clamor for crackdown on hidden wealth jolts Sri Lanka elite following Pandora Papers revelations - ICIJ](https://www.icij.org/investigations/pandora-papers/clamor-for-crackdown-on-hidden-wealth-jolts-sri-lanka-elite-following-pandora-papers-revelations/) - [Sri Lankan power couple piled up luxury homes, artworks and cash offshore as ruling family rose and rose - ICIJ](https://www.icij.org/investigations/pandora-papers/sri-lanka-rajapaksa-family-offshore-wealth-power/) - [As Sri Lanka’s ruling Rajapaksas flee, Pandora Papers reveal ties to UAE properties - ICIJ](https://www.icij.org/investigations/pandora-papers/as-sri-lankas-ruling-rajapaksas-flee-pandora-papers-reveal-ties-to-uae-properties/) - [The Powerful Rajapaksa Dynasty Bankrupted Sri Lanka in Just 30 Months - Bloomberg](https://www.bloomberg.com/news/features/2022-04-27/the-powerful-rajapaksa-dynasty-bankrupted-sri-lanka-in-just-30-months) - [Governmental Experts List 22.05.2025 Country Family Name(s) First Name(s)](https://www.unodc.org/documents/treaties/UNCAC/IRG-Experts/English/SecondCycle/Sri_Lanka_E.pdf) - [Engulfed by economic collapse and mass protests, Sri Lanka’s Pandora Papers probe stalled - ICIJ](https://www.icij.org/investigations/pandora-papers/engulfed-by-economic-collapse-and-mass-protests-sri-lankas-pandora-papers-probe-stalled/) - [Overseas Business Risk: Sri Lanka - GOV.UK](https://www.gov.uk/government/publications/overseas-business-risk-sri-lanka/overseas-business-risk-sri-lanka) - [THEMATIC COMPILATION OF RELEVANT INFORMATION SUBMITTED BY SRI LANKA](https://www.unodc.org/documents/corruption/WG-Prevention/Art_5_Preventive_anti-corruption_policies_and_practices/Sri_Lanka.pdf) - [Page 1 of 141 Country Review Report of Sri Lanka](https://www.unodc.org/documents/treaties/UNCAC/CountryVisitFinalReports/2018_09_03_Sri_Lanka_Final_Country_Report.pdf) - [Follow-up report to Sri Lanka's assessment of anti-money laundering and counter-terrorist financing measures](https://www.fatf-gafi.org/en/publications/mutualevaluations/documents/fur-sri-lanka-2019.html) - [First follow-up report to Sri Lanka's assessment of anti-money laundering and counter-terrorist financing measures](https://www.fatf-gafi.org/en/publications/mutualevaluations/documents/fur-sri-lanka-2016.html) - [Guidance | FinCEN.gov](https://www.fincen.gov/resources/statutes-regulations/guidance) - [The Anti-Money Laundering Act of 2020 | FinCEN.gov](https://www.fincen.gov/anti-money-laundering-act-2020) - [EU trade relations with Sri Lanka](https://ec.europa.eu/trade/policy/countries-and-regions/countries/sri-lanka/) - [Generalised Scheme of Preferences - EU Trade](https://policy.trade.ec.europa.eu/development-and-sustainability/generalised-scheme-preferences_en) - [UK sanctions for human rights violations and abuses during the Sri Lankan civil war - GOV.UK](https://www.gov.uk/government/news/uk-sanctions-for-human-rights-violations-and-abuses-during-the-sri-lankan-civil-war) - [Europa](https://data.consilium.europa.eu/doc/document/WK-11501-2023-INIT/en/pdf) - [List of GSP beneficiary countries as of 01 January 2025 ...](https://taxation-customs.ec.europa.eu/document/download/7a667f90-7710-4baa-afb2-6b9aa7b75883_en) - [EU Global Human Rights Sanctions Regime: listings prolonged for a year - Consilium](https://www.consilium.europa.eu/en/press/press-releases/2025/12/04/eu-global-human-rights-sanctions-regime-listings-prolonged-for-a-year/) - [Sri Lanka: Declaration by the High Representative on behalf of the European Union on recent developments - Consilium](https://www.consilium.europa.eu/en/press/press-releases/2022/07/22/sri-lanka-declaration-by-the-high-representative-on-behalf-of-the-european-union-on-recent-developments/) - [Sanctions against human rights violations - consilium.europa.eu](https://www.consilium.europa.eu/en/policies/sanctions-human-rights-abuses/) - [Sri Lanka - International Partnerships - European Commission](https://international-partnerships.ec.europa.eu/countries/sri-lanka_en) - [Sri Lanka and the UK - GOV.UK](https://www.gov.uk/world/sri-lanka/news) - [The UK Sanctions List - GOV.UK](https://www.gov.uk/government/publications/the-uk-sanctions-list) - [UK sanctions - GOV.UK](https://www.gov.uk/government/collections/uk-sanctions) - [OFSI Consolidated List Search](https://sanctionssearchapp.ofsi.hmtreasury.gov.uk/) - [FCDO - UK Sanctions List Search - GOV.UK](https://search-uk-sanctions-list.service.gov.uk/) - [Moving to a single list for UK sanctions designations, 28 January 2026 - GOV.UK](https://www.gov.uk/guidance/moving-to-a-single-list-for-uk-sanctions-designations-28-january-2026) - [Format guide for the UK Sanctions List - GOV.UK](https://www.gov.uk/guidance/format-guide-for-the-uk-sanctions-list) - [Moving to a Single List for UK Sanctions Designations](https://assets.publishing.service.gov.uk/media/69480c531a2e540ccd8a543a/Moving_to_a_Single_List_for_UK_Sanctions_Designations_-_HMG_Webinar_17_December_2025.pdf) - [[Withdrawn] [Withdrawn] Who is subject to financial sanctions in the UK? - GOV.UK](https://www.gov.uk/government/publications/financial-sanctions-consolidated-list-of-targets) - [Counter-terrorism: list of designations and sanctions notices - GOV.UK](https://www.gov.uk/guidance/counter-terrorism-list-of-designations-and-sanctions-notices) - [Sri Lanka urged to conduct probe into 2019 attack | UN News](https://news.un.org/en/story/2023/09/1140602) - [Sri Lanka Terror Attacks Break From Past Patterns - Bloomberg](https://www.bloomberg.com/opinion/articles/2019-04-23/sri-lanka-terror-attacks-break-from-past-patterns) - [https://docs.un.org/en/A/HRC/52/NGO/76](https://docs.un.org/en/A/HRC/52/NGO/76) - [Security Council Press Statement on Series of Terrorist Attacks across Sri Lanka | UN Meetings Coverage and Press Releases](https://un.org/press/en/2019/sc13788.doc.htm) - [fatf REPORT THE ROLE OF HAWALA AND OTHER SIMILAR SERVICE PROVIDERS](https://www.fatf-gafi.org/content/dam/fatf-gafi/reports/Role-of-hawala-and-similar-in-ml-tf.pdf.coredownload.pdf) - [1 The Financial Crimes Enforcement Network (FinCEN)](https://www.fincen.gov/system/files/advisory/2025-04-01/FinCEN-Advisory-ISIS-508C.pdf) - [Sri Lanka Imposes Curfew After Easter Sunday Bombings Kill 207 - Bloomberg](https://www.bloomberg.com/news/articles/2019-04-21/police-say-multiple-explosions-in-sri-lanka-s-capital-colombo) - [Sri Lanka Muslims Had Warned Officials About Group Behind Attack - Bloomberg](https://www.bloomberg.com/news/articles/2019-04-22/sri-lanka-muslims-had-warned-officials-about-group-behind-attack) - [Sri Lanka statement -- International Terrorism](https://www.un.org/en/ga/sixth/70/pdfs/statements/int_terrorism/sri_lanka.pdf) - [Sri Lanka terror attacks: Foreign Secretary's House of Commons statement - GOV.UK](https://www.gov.uk/government/speeches/sri-lanka-terror-attacks-foreign-secretary-statement-to-the-house) - [Updated Price Cap Coalition Advisory for the Maritime Oil ...](https://ofac.treasury.gov/media/933506/download?inline=) - [1 Red ALERT Shadow Fleet Sanctions Evasion and Avoidance Network](https://www.nationalcrimeagency.gov.uk/who-we-are/publications/753-red-alert-shadow-fleet-sanctions-evasion-and-avoidance-network/file) - [Eyes On The Crew: The Russian Watchmen Aboard Moscow's Sanctioned ‘Shadow Fleet’ Tankers | OCCRP](https://www.occrp.org/en/investigation/eyes-on-the-crew-the-russian-watchmen-aboard-moscows-sanctioned-shadow-fleet-tankers) - [Russia's war of aggression against Ukraine: Council sanctions 41 vessels of the Russian shadow fleet - Consilium](https://www.consilium.europa.eu/en/press/press-releases/2025/12/18/russia-s-war-of-aggression-against-ukraine-council-sanctions-41-vessels-of-the-russian-shadow-fleet/) - [UK forces intercept Russian shadow fleet vessel for the first time in blow to Putin's war chest - GOV.UK](https://www.gov.uk/government/news/uk-forces-intercept-russian-shadow-fleet-vessel-for-the-first-time-in-blow-to-putins-war-chest) - [European Ships Keep Russia’s Shadow Fleet Afloat | OCCRP](https://www.occrp.org/en/investigation/european-ships-keep-russias-shadow-fleet-afloat) - [EU Greenlights New Sanctions Targeting Russia’s Shadow Fleet | OCCRP](https://www.occrp.org/en/news/eu-greenlights-new-sanctions-targeting-russias-shadow-fleet) - [Another Russian Shadow Fleet Oil Tanker Runs Into Difficulties - Bloomberg](https://www.bloomberg.com/news/articles/2026-01-23/another-russian-shadow-fleet-oil-tanker-runs-into-difficulties) - [Russia’s Shadow Fleet Defies Sanctions, Spurs Growth in its Oil & Gas Sectors | OCCRP](https://occrp.org/en/daily/18819-russia-s-shadow-fleet-defies-sanctions-spurns-growth-in-its-oil-gas-sectors) - [Daily News 18 / 12 / 2025](https://finance.ec.europa.eu/news/sanctions-member-states-designate-41-additional-vessels-russias-shadow-fleet-2025-12-18_en) - [Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Guidance-rba-virtual-assets-2021.html) - [Follow-up report to Sri Lanka's assessment of anti-money laundering and counter-terrorist financing measures](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Fur-sri-lanka-2019.html) - [Markets in Crypto-assets Regulation - Finance - European Commission](https://finance.ec.europa.eu/regulation-and-supervision/financial-services-legislation/implementing-and-delegated-acts/markets-crypto-assets-regulation_en) - [Overview of financial services legislation - Finance - European Commission](https://finance.ec.europa.eu/regulation-and-supervision/financial-services-legislation/overview-financial-services-legislation_en) - [Draft regulations: The Cryptoasset Service Providers (Due Diligence and Reporting Requirements) Regulations 2025 - GOV.UK](https://www.gov.uk/government/consultations/draft-regulations-the-cryptoasset-service-providers-due-diligence-and-reporting-requirements-regulations-2025) - [US Invests in Colombo Port Next to China’s Foothold Terminal](https://www.bloomberg.com/news/newsletters/2023-11-08/supply-chain-latest-us-invests-in-sri-lankan-port-project) - [British High Commission Colombo - GOV.UK](https://www.gov.uk/world/organisations/british-high-commission-colombo) - [FinCEN Advisory - Issue 14 | FinCEN.gov](https://www.fincen.gov/resources/advisories/fincen-advisory-issue-14) - [Corporate Governance: staying ahead of the risk of corruption - GOV.UK](https://www.gov.uk/government/news/corporate-governance-staying-ahead-of-the-risk-of-corruption) - [Sri Lanka: The IMF Should Drive a Hard Line on Colombo Port City White Elephant - Bloomberg](https://www.bloomberg.com/opinion/articles/2022-04-13/sri-lanka-the-imf-should-drive-a-hard-line-on-colombo-port-city-white-elephant) - [1 United States Department of the Treasury Financial Crimes Enforcement Network](https://www.fincen.gov/system/files/advisory/advis13.pdf) - [FinCEN Advisory - Issue 23 | FinCEN.gov](https://www.fincen.gov/resources/advisories/fincen-advisory-issue-23) - [Secrecy for Sale: Inside the Global Offshore Money Maze - ICIJ](https://www.icij.org/investigations/offshore/) - [About | ICIJ Offshore Leaks Database](https://offshoreleaks.icij.org/pages/about) - [The Panama Papers: Exposing the Rogue Offshore Finance Industry - ICIJ](https://www.icij.org/investigations/panama-papers/) - [Recommendations on addressing the links between trafficking in persons and](https://icat.un.org/sites/g/files/tmzbdl461/files/publications/trafficking_organized_crime_2025.pdf) - [UNODC Publications - Human Trafficking and Migrant Smuggling](https://www.unodc.org/unodc/en/human-trafficking/publications.html) - [Section 360C](https://www.unodc.org/cld/legislation/lka/penal_code/chapter_xvi/section_360c/section_360c.html?lng=en%3Flng%3Den) - [UN report exposes torture, rape in Southeast Asia’s multi-billion-dollar scam centres | UN News](https://news.un.org/en/story/2026/02/1167012) - [Sri Lanka: UNODC strengthens efforts against Migrant Smuggling and Human Trafficking with a focus on international cooperation, anti-corruption](https://www.unodc.org/southasia//frontpage/2023/July/sri-lanka_-unodc-strengthens-efforts-against-migrant-smuggling-and-human-trafficking-with-a-focus-on-international-cooperation--anti-corruption.html) - [1 UNITED NATIONS MIGRATION NETWORK IN SRI LANKA TERMS OF REFERENCE 1.](https://migrationnetwork.un.org/sites/g/files/tmzbdl416/files/docs/final_terms_of_reference_un_migration_network_in_sri_lanka_13_july_2020.pdf) - [Sri Lanka Strengthens Trafficking in Persons Data Collection Through EU-UNODC Workshop](https://www.unodc.org/unodc/en/human-trafficking/glo-act7/Countries/sri-lanka-strengthens-trafficking-in-persons-data-collection-through-eu-unodc-workshop.html) - [Tracking illicit financial flows linked to human trafficking and migrant smuggling](https://www.unodc.org/unodc/en/human-trafficking/Webstories2023/tracking-illicit-financial-flows-linked-to-human-trafficking-and-migrant-smuggling.html) - [Trapped in scam crime: UNODC’s new campaign exposes human cost behind fake job offers](https://www.unodc.org/roseap/en/2025/12/trapped-in-scam-crime/story.html) - [Sanctions Programs and Country Information | Office of Foreign Assets Control](https://ofac.treasury.gov/sanctions-programs-and-country-information) - [257 | Office of Foreign Assets Control](https://ofac.treasury.gov/faqs/257) - [Sanctions List Service | Office of Foreign Assets Control](https://ofac.treasury.gov/sanctions-list-service) - [Where is OFAC's Country List? What countries do I need to worry about in terms of U.S. sanctions? | Office of Foreign Assets Control](https://ofac.treasury.gov/sanctions-programs-and-country-information/where-is-ofacs-country-list-what-countries-do-i-need-to-worry-about-in-terms-of-us-sanctions) - [Counter Narcotics Designations; Russia-related Designations Removals; Publication of Report for Licensing Activities Undertaken Pursuant to the Trade Sanctions Reform and Export Enhancement Act (TSRA) | Office of Foreign Assets Control](https://ofac.treasury.gov/recent-actions/20260630) - [OFAC Consolidated Frequently Asked Questions | Office of Foreign Assets Control](https://ofac.treasury.gov/faqs/all-faqs) - [Counter Terrorism Designations and Designation Update; Balkans-related Designations | Office of Foreign Assets Control](https://ofac.treasury.gov/recent-actions/20230731) - [Home | Office of Foreign Assets Control](https://ofac.treasury.gov/) - [Program Tag Definitions for OFAC Sanctions Lists | Office of Foreign Assets Control](https://ofac.treasury.gov/specially-designated-nationals-list-sdn-list/program-tag-definitions-for-ofac-sanctions-lists) - [Additional Sanctions Lists | Office of Foreign Assets Control](https://ofac.treasury.gov/other-ofac-sanctions-lists) - [Annex I State Measures for Strengthening Business Integrity](https://businessintegrity.unodc.org/bip/uploads/documents/questionnaires/states_measures_for_business_integrity/Sri_Lanka.pdf) - [FINAL INDEPENDENT PROJECT EVALUATION SUPPORT TO SRI LANKA ON COUNTER](https://www.unodc.org/documents/evaluation/Independent_Project_Evaluations/2022/Final_Evaluation_Report_Support_to_Sri_Lanka_on_Counter_Terrorism.pdf) - [Documents - Financial Action Task Force (FATF)](http://www.fatf-gafi.org/publications/high-riskandnon-cooperativejurisdictions/documents/fatf-compliance-february-2018.html) - [UK Financial Intelligence Unit (UKFIU)](https://www.ukciu.gov.uk/(0bjnmzrzvyjwpwrqvvfzdg2u)/Information/Info.aspx) - [UK Financial Intelligence Unit - National Crime Agency](https://www.nationalcrimeagency.gov.uk/what-we-do/crime-threats/money-laundering-and-illicit-finance/ukfiu) - [DevTracker Country Sri Lanka Summary Page](https://devtracker.fcdo.gov.uk/countries/LK/) - [Sri Lanka - EGOVKB](https://publicadministration.un.org/egovkb/en-us/Data/Country-Information/id/161-Sri-Lanka) - [FATF](https://www.fatf-gafi.org/en/countries/detail/Sri-Lanka.html) - [FATF](https://www.fatf-gafi.org/en/countries/black-and-grey-lists.html) - [FATF / Asia/Pacific Group on Money Laundering](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Fur-sri-lanka-2021.html) - [Financial Intelligence Unit, Central Bank of Sri Lanka](http://fiusrilanka.gov.lk/rules_directions.html) - [UK Foreign, Commonwealth & Development Office](https://www.gov.uk/government/news/uk-sanctions-for-human-rights-violations-and-abuses-during-the-sri-lankan-civil-war) - [ICIJ](https://www.icij.org/investigations/pandora-papers/clamor-for-crackdown-on-hidden-wealth-jolts-sri-lanka-elite-following-pandora-papers-revelations/) - [OCCRP](https://www.occrp.org/en/news/sri-lanka-central-bank-tricked-into-paying-25m-to-cyber-criminals) - [Bloomberg](https://www.bloomberg.com/news/articles/2026-04-23/sri-lanka-probes-2-5-million-hack-of-finance-ministry-funds) - [UNODC](https://www.unodc.org/southasia/en/frontpage/2025/December/south-asia_-unodc-supports-maldives-and-sri-lanka-in-tackling-drug-related-illicit-financial-flows-to-counter-terrorism.html) - [UN News / OHCHR](https://news.un.org/en/story/2026/02/1167012) - [European Commission](https://ec.europa.eu/trade/policy/countries-and-regions/countries/sri-lanka/) - [European Commission](https://policy.trade.ec.europa.eu/development-and-sustainability/generalised-scheme-preferences_en) Coverage gaps fim-int-2026-07-05-G001: No current evidence establishing wh… fim-int-2026-07-05-G001: No current evidence establishing whether Trust Ordinance modernisation or a centralized beneficial-ownership register has advanced beyond historic FATF ICRG findings. [resolved] fim-int-2026-07-05-G002: No post-2015 FATF effectiveness ass… fim-int-2026-07-05-G002: No post-2015 FATF effectiveness assessment using the 2025-revised methodology exists for Sri Lanka; current characterizations rest on technical-compliance follow-up only. [resolved] fim-int-2026-07-05-G003: The destination and further launder… fim-int-2026-07-05-G003: The destination and further laundering path of the approximately 2.5 million US dollar Treasury BEC-fraud proceeds has not been established by investigators. [resolved] fim-int-2026-07-05-G004: No evidence of a Sri Lanka-specific… fim-int-2026-07-05-G004: No evidence of a Sri Lanka-specific VASP licensing or crypto-AML legislative proposal has been located to assess regulatory-arbitrage risk. [resolved] fim-int-2026-07-05-G005: No public statement from OFAC or EU… fim-int-2026-07-05-G005: No public statement from OFAC or EU authorities explains the absence of designations matching the UK's March 2025 Sri Lanka civil-war sanctions, leaving capacity-deficit versus political-choice undetermined. [resolved] fim-int-2026-08-20-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-08-20-G001 ({'scheme': 'financial_integrity', 'value': 'D4'}): Primary FIU-hosted National Risk Assessment PDF for the 2024/25 cycle was not directly retrieved this cycle; only secondary reporting of its findings is available. [resolved] fim-int-2026-08-20-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-08-20-G002 ({'scheme': 'financial_integrity', 'value': 'D6'}): No LK-specific RegTech/AI-supervisory development was located this cycle for D6. [resolved] fim-int-2026-08-20-G003: Tier-D watch jurisdictions LA/MX/CO… fim-int-2026-08-20-G003: Tier-D watch jurisdictions LA/MX/CO received no dedicated queries this cycle; coverage gap is provenance-flagged as awaiting_primary_source rather than a no-material-change finding. [resolved] fim-int-2026-09-28-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-09-28-G001 ({'scheme': 'financial_integrity', 'value': 'D7'}): No gazetted primary-source text located for the PMLA/FTRA/CSTFA amendment package this cycle; findings rest on a T3 domestic newswire report of official certification. [resolved] fim-int-2026-09-28-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-09-28-G002 ({'scheme': 'financial_integrity', 'value': 'D5'}): No enacted VASP licensing statute exists yet; the licensing regime remains at Cabinet-approval/drafting stage with no gazetted text to cite. [resolved] fim-int-2026-09-28-G003 ({'scheme': 'financial_integrity', '… fim-int-2026-09-28-G003 ({'scheme': 'financial_integrity', 'value': 'D3'}): D3 (Enabler Jurisdictions) and D4 (Conflict Finance) dimensions were thinly covered this cycle for Sri Lanka; no qualifying primary source located. [resolved] fim-int-2026-10-04-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-10-04-G001 ({'scheme': 'financial_integrity', 'value': 'D7'}): FATF/APG third mutual evaluation on-site assessment and plenary outcome not confirmed in open sources as of this cycle. [resolved] fim-int-2026-10-04-G002: Tier D jurisdiction searches (KH/LA… fim-int-2026-10-04-G002: Tier D jurisdiction searches (KH/LA/MX/CO) were not run this pass; pooled web-search budget was concentrated on LK per union dispatch. [resolved] fim-int-2026-10-04-G003 ({'scheme': 'financial_integrity', '… fim-int-2026-10-04-G003 ({'scheme': 'financial_integrity', 'value': 'D3'}): D3 enabler-jurisdiction and D4 conflict-finance coverage for LK remained thin this cycle; no sourced findings located. [resolved] fim-int-2026-10-11-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-10-11-G001 ({'scheme': 'financial_integrity', 'value': 'D7'}): The Gazette-published text of the PMLA/FTRA/CSTFA Amendment Acts No. 16-18 of 2026 was not independently retrieved this cycle; clause-level mechanics beyond s.12A rest on press commentary rather than primary legislative text. [resolved] fim-int-2026-10-11-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-10-11-G002 ({'scheme': 'financial_integrity', 'value': 'D2'}): No Tier-1 (Registrar of Companies / Gazette) source was directly retrieved for the Beneficial Ownership Regulations No. 01 of 2026 this cycle. [resolved] fim-int-2026-10-11-G003: No dedicated Tier D (Cambodia, Laos… fim-int-2026-10-11-G003: No dedicated Tier D (Cambodia, Laos, Mexico, Colombia) sweep was conducted this cycle given the LK-specific dispatch scope. [resolved] fim-int-2026-10-18-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-10-18-G001 ({'scheme': 'financial_integrity', 'value': 'D5'}): No T1 primary instrument (bill text, SEC Act amendment, Cabinet paper, FATF/APG plenary statement) was retrieved this cycle; all D5 and D7 findings rest on T2 press reporting. [resolved] fim-int-2026-10-18-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-10-18-G002 ({'scheme': 'financial_integrity', 'value': 'D1'}): No LK-specific sanctions designation or evasion-network activity identified this cycle; D1 coverage remains thin. [resolved] fim-int-2026-10-25-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-10-25-G001 ({'scheme': 'financial_integrity', 'value': 'D7'}): Exact on-site dates of Sri Lanka's third FATF/APG mutual evaluation could not be confirmed; T3 press report (mid-October) conflicts with FATF's own calendar listing (1 November). [resolved] fim-int-2026-10-25-G002: No dedicated Tier D (KH/LA/MX/CO) s… fim-int-2026-10-25-G002: No dedicated Tier D (KH/LA/MX/CO) sweep was performed this cycle; the pooled search budget was concentrated on Sri Lanka. [resolved] fim-int-2026-10-25-G003 ({'scheme': 'financial_integrity', '… fim-int-2026-10-25-G003 ({'scheme': 'financial_integrity', 'value': 'D2'}): D2 beneficial-ownership register status for Sri Lanka was not updated this cycle; standing gap under FATF Recommendation 24 persists without verification. [resolved] fim-int-2026-11-01-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-11-01-G001 ({'scheme': 'financial_integrity', 'value': 'D7'}): No T1 CBSL/FIU-SL on-site-visit notice was independently retrieved confirming the APG mutual evaluation visit occurred or its outcome; FATF/APG's own calendar corroborates only a possible onsite period. [open] fim-int-2026-11-01-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-11-01-G002 ({'scheme': 'financial_integrity', 'value': 'D3'}): D3 (Enabler Jurisdictions), D4 (Conflict Finance) and D6 (Compliance Technology) had thin or no coverage for LK this cycle within the available research budget. [open] fim-int-2026-11-01-G003: Tier-D watch jurisdictions (KH/LA/M… fim-int-2026-11-01-G003: Tier-D watch jurisdictions (KH/LA/MX/CO) were not collected this cycle; pooled web-search budget was concentrated on LK per the union dispatch. [open] FIM-GAP-001 (D2): The Pandora Papers investigation into offs… FIM-GAP-001 (D2): The Pandora Papers investigation into offshore trusts and shell companies linked to a former deputy minister of the ruling Rajapaksa family and her husband, referred to CIABOC in 2021, has shown no confirmed material prosecutorial progress within the 18-month baseline window. FIM-GAP-002 (D5): No dedicated virtual-asset/VASP licensing … FIM-GAP-002 (D5): No dedicated virtual-asset/VASP licensing or AML-specific regulatory framework for Sri Lanka was identified in this review, in contrast to regional peers advancing crypto-specific oversight in 2025-26 (e.g. Pakistan's technical committee, India's evolving posture). FIM-GAP-003 (D6): The Central Bank/Finance Ministry business… FIM-GAP-003 (D6): The Central Bank/Finance Ministry business-email-compromise incident (Dec 2025-March 2026) exposed weak email-authentication and payment-verification controls in sovereign treasury processes, compounded by delayed disclosure to Parliament that opposition figures characterized as concealment. FIM-GAP-004 (D1): Sri Lanka's FATF-related standing rests on… FIM-GAP-004 (D1): Sri Lanka's FATF-related standing rests on its 2015 Mutual Evaluation Report plus subsequent technical-compliance follow-up reports (latest update December 2025) rather than a current effectiveness assessment; no full re-evaluation incorporating the FATF's 2025-revised methodology (including virtual-asset effectiveness testing) has yet occurred. ## Evidence #### Confidence-tiered claims Passed Second and Third Readings by special majority (154-2) on 9 July 2026, adding proliferation financing to FTRA scope, extending asset-freezing periods, adding beneficial-ownership and virtual-asset provisions, and mandating two-working-day STR reporting. [[Source 1]](#sec-sources) Probable · 1 source Disclosed Rs.14.6 million in administrative penalties against 11 institutions (7 FIs, 4 DNFBPs) for FTRA breaches, covering October 2025-March 2026, disclosed 21 July 2026; Cargills Bank PLC fined Rs.2 million for failing to report 18 electronic fund transfers. [[Source 1]](#sec-sources) Probable · 1 source Standing regime rests on PMLA No. 5 of 2006, FTRA No. 6 of 2006, and the Convention on the Suppression of Terrorist Financing Act No. 25 of 2005 (all amended 2026); FIU (Central Bank of Sri Lanka) is designated supervisory authority; 3rd FATF/APG mutual evaluation underway, technical-compliance submission due 31 March 2026. [[Source 1]](#sec-sources) Probable · 1 source Requires disclosure of beneficial owners holding 10% or more to the Registrar of Companies. [[Source 1]](#sec-sources) Probable · 1 source Held 5th meeting on 10 August 2026 with FATF/HM Treasury technical assistance on virtual-asset AML standards (FATF Rec.15); SEC recommended as lead VASP regulator; no VASP Act enacted. [[Source 1]](#sec-sources) Probable · 1 source Parliament passed and the Speaker certified the PMLA Amendment Act (with companion FTRA Amendment Act No. 17 and CSTFA Amendment Act No. 18) on 4 August 2026, inserting a new s.12A permitting pre-judicial asset freezes of up to 14 working days, extendable to 3 years by court order, and beneficial-ownership and virtual-asset provisions into the PMLA. [[Source 1]](#sec-sources) Probable · 1 source Came into operation 30 March 2026, implementing new Sections 130A-130J of the Companies Act No. 7 of 2007; a beneficial owner is a natural person owning or controlling 10% or more of a company directly, indirectly, or via effective control. [[Source 1]](#sec-sources) Probable · 1 source Disclosed Rs.14.6 million in administrative penalties against 11 institutions (7 financial institutions, 4 DNFBPs) for FTRA breaches spanning October 2025 to March 2026, including a Rs.2 million fine against Cargills Bank PLC for failing to report 18 electronic fund transfers, and a finding that one finance company maintained relationships with UN-designated entities. [[Source 1]](#sec-sources) Probable · 1 source Requires licensed operators of mobile-phone-based e-Money systems to obtain declarations from their Board of Directors and Senior Management in terms of FATF Recommendation 26 (fit-and-proper supervision). [[Source 1]](#sec-sources) Probable · 1 source Remains outside Sri Lanka's regulatory perimeter; no crypto-specific licensing or AML framework exists. CBSL reaffirms the rupee is the only legal tender and cryptocurrency is unregulated. [[Source 1]](#sec-sources) Probable · 1 source CBSL Governor Dr Nandalal Weerasinghe stated confidence Sri Lanka will avoid a third FATF grey-listing, as its APG-coordinated mutual evaluation outcome nears. [[Source 1]](#sec-sources) Probable · 1 source Cabinet approved (27 July 2026) a policy framework naming SEC as lead VASP regulator, coordinating with CBSL's FIU and the Inland Revenue Department. [[Source 1]](#sec-sources) Probable · 1 source The VASP concept paper was sent to the Legal Draftsman's Department on 24 September 2026, with first phase limited to licensed exchanges and custodians. [[Source 1]](#sec-sources) Probable · 1 source VASPs are expected to face mandatory registration, KYC and suspicious-transaction-reporting duties under the new framework, timed ahead of the AML/CFT mutual evaluation. [[Source 1]](#sec-sources) Probable · 1 source The UBO regime under the Companies (Amendment) Act No. 12 of 2025 and the Companies (Beneficial Ownership) Regulations No. 01 of 2026 (Gazette No. 2480/48, 21 March 2026) remains in force since 30 March 2026, with no change this cycle. [[Source 1]](#sec-sources) Probable · 1 source CBSL Governor reported an on-site evaluation by international assessors commenced in Sri Lanka around mid-October 2026, scheduled to run about two weeks; this conflicts with FATF's own calendar listing a possible on-site period of 2026-11-01. [[Source 1]](#sec-sources) Uncertain · 1 source VASP concept paper sent to Legal Draftsman's Department on 24 September 2026, following Cabinet's 27 July 2026 approval of a policy framework naming the SEC as lead regulator with CBSL, FIU and Inland Revenue jointly involved. [[Source 1]](#sec-sources) Probable · 1 source VASPs are classified as 'financial businesses' under the FTRA, bringing them within AML reporting obligations as of 4 August 2026, even though no VASP-specific licence yet exists. [[Source 1]](#sec-sources) Uncertain · 1 source First-phase gambling regulations, including AML requirements under a s.19 ministerial order, remain pending after repeated slippage against a June then October 2026 target. [[Source 1]](#sec-sources) Uncertain · 1 source Risk direction assessed as stable; no confirmed FATF listing change this cycle, with officials publicly expressing confidence in avoiding a third grey-listing. [[Source 1]](#sec-sources) Uncertain · 1 source An on-site evaluation by APG/international assessors commenced in LK in mid-October 2026 and was scheduled to run two weeks, continuing into the first week of November. [[Source 1]](#sec-sources) Probable · 1 source Financial Transactions Reporting (Amendment) Act, No. 17 of 2026 certified 4 August 2026 brings VASPs within the FTRA's 'financial business' definition. [[Source 1]](#sec-sources) Probable · 1 source Beneficial ownership remains Sri Lanka's only non-compliant FATF recommendation ahead of the mutual evaluation. [[Source 1]](#sec-sources) Probable · 1 source Third APG/FATF-style mutual evaluation on-site visit commenced mid-October 2026, running into first week of November 2026 [[Source 1]](#sec-sources) Probable · 1 source VASPs brought within the FTRA's 'financial business' definition for AML purposes, certified 4 August 2026 [[Source 1]](#sec-sources) Probable · 1 source Beneficial ownership (R.24) remains Sri Lanka's only non-compliant FATF recommendation ahead of the third mutual evaluation [[Source 1]](#sec-sources) Probable · 1 source CBSL Governor Weerasinghe expressed confidence LK will avoid a third FATF grey-listing, citing 2026 legislative reforms [[Source 1]](#sec-sources) Probable · 1 source CBSL maintains cryptocurrency is not legal tender and no domestic exchange is licensed [[Source 1]](#sec-sources) Probable · 1 source