Sri Lanka LK

Sri Lanka's virtual-asset regulatory framework remains in a developmental holding pattern that is itself a finding. The government's VASP Sub-Committee held its fifth meeting on 10 August 2026, and that meeting carried substantive international engagement: technical assistance from UK HM Treasury officials specifically on compliance with FATF Recommendation 15, the standard governing virtual-asset service providers. The Securities and Exchange Commission has been put forward within that process as the prospective lead regulator for VASPs, a signal that institutional ownership of the eventual regime is being worked out even before the regime itself exists. What has not happened, after five committee meetings and sustained external technical input, is the enactment or gazetting of a VASP Act. There is no licence category, no registration gateway, and no supervisory perimeter in force for exchange, custody, or advisory activity involving virtual assets.

The AML/CTF significance of this gap is best read through the lens of the broader legislative activity this cycle. Parliament's passage of the Prevention of Money Laundering (Amendment) Bill inserted virtual-asset provisions into the principal Act, which means the primary AML statute now contemplates virtual assets even though the dedicated sectoral licensing and supervisory framework for VASPs does not yet exist as enacted law. That sequencing, a general AML statute reaching ahead of sector-specific VASP legislation, is a structural pattern worth naming explicitly rather than treating as incidental: it means obliged-entity obligations touching virtual assets may now have a statutory hook under the amended PMLA before the SEC or any other body has a settled supervisory mandate to enforce sector-specific controls. Enablement by absence of a completed framework, rather than enablement by permissive rule, is the operative risk category here. A jurisdiction that is visibly working the FATF Recommendation 15 problem, with technical assistance from a G7 treasury, but has not yet converted that work into force, sits in a different risk posture than a jurisdiction simply ignoring the standard. The ongoing mutual evaluation process gives this gap a live audience: assessors will be looking precisely at whether Sri Lanka's framework for virtual assets meets the FATF standard, and the current state, a sub-committee with a recommended lead regulator but no statute, is unlikely to score as complete irrespective of how much procedural engagement has occurred.

Three-pillar balance also matters here. The visible activity to date is almost entirely architectural and preventive-framework-building; there is no enforcement-volume signal for virtual-asset activity in Sri Lanka this cycle, which is unsurprising given that no licensing regime exists to breach. CTF and CPF considerations specific to virtual assets, proliferation-financing risk via crypto rails for instance, have not surfaced independently of the general proliferation-financing amendment made to the Financial Transactions Reporting Act, which is domain-general rather than virtual-asset-specific. The absence of VASP-specific CTF/CPF findings should not be read as absence of risk; it more likely reflects the absence of a supervisory mechanism capable of generating such findings in the first place.

Outlook

The central question carried forward is whether the VASP Sub-Committee process converts into an enacted statute before or after the FATF/APG mutual evaluation outcome becomes public. If the evaluation identifies virtual-asset supervision as a material technical-compliance gap, that finding could accelerate the legislative timeline; if the evaluation proceeds without the VASP Act in force, Sri Lanka's virtual-asset sector will continue to operate in the current unregulated-gap posture, with the amended PMLA's virtual-asset provisions as the only statutory anchor pending further movement. The role of the Securities and Exchange Commission as prospective lead regulator, and how that mandate is formalised relative to the Central Bank of Sri Lanka's existing payment-system interests, remains to be settled as scheduled through continuing sub-committee process.

Sri Lanka's AML/CTF regime underwent its most significant legislative expansion in this cycle since the standing framework was established. Parliament passed the Second and Third Readings of the Prevention of Money Laundering (Amendment) Bill and the companion Financial Transactions Reporting (Amendment) Bill by special majority, 154 votes to 2, on 9 July 2026. The reforms are substantial in scope rather than cosmetic: proliferation financing has been added to the Financial Transactions Reporting Act's coverage, closing a pillar gap that had left counter-proliferation-financing obligations less developed than the AML and CTF pillars either side of it. Asset-freezing periods have been extended, from an initial seven days to fourteen working days, with court-ordered extension now available for up to three years, a material lengthening of the state's administrative freezing power ahead of judicial process. Beneficial-ownership and virtual-asset provisions have been inserted directly into the Prevention of Money Laundering Act, and suspicious transaction reporting timelines have been tightened to two working days.

The standing architecture beneath this reform remains the Prevention of Money Laundering Act No. 5 of 2006, the Financial Transactions Reporting Act No. 6 of 2006, and the Convention on the Suppression of Terrorist Financing Act No. 25 of 2005, all now amended in 2026, with the Financial Intelligence Unit housed at the Central Bank of Sri Lanka as the designated supervisory authority. This legislative package should be read against the backdrop of Sri Lanka's third FATF/APG mutual evaluation, for which the technical-compliance submission was due 31 March 2026; the amendments target precisely the kind of gaps, reporting speed, proliferation-financing coverage, beneficial-ownership integration, that a technical-compliance assessment tends to surface, and their timing relative to the evaluation cycle is unlikely to be coincidental.

Enforcement visibility accompanied the legislative move. The Financial Intelligence Unit disclosed Rs.14.6 million in administrative penalties against eleven institutions, seven financial institutions and four designated non-financial businesses and professions, for Financial Transactions Reporting Act breaches covering October 2025 through March 2026, with the disclosure itself made on 21 July 2026, less than two weeks after the legislative amendments passed. Cargills Bank PLC was fined Rs.2 million for failing to report eighteen electronic fund transfers. Separately, one finance company was found to have maintained relationships with three UN-designated individuals, a sanctions-screening failure that sits squarely within the AML/CTF regime's preventive-measures pillar and underscores why FATF Recommendations 15 and 24, on new technologies and beneficial ownership respectively, remain live areas of technical-compliance concern for the jurisdiction.

The three-pillar balance in this cycle leans toward AML and CTF architecture-building, with CPF representation improving materially through the proliferation-financing amendment to the FTRA, correcting what had been a structurally under-weighted pillar. Enforcement volume, while present via the Rs.14.6 million in disclosed penalties, remains modest in absolute terms relative to the scale of the legislative change, which is consistent with a jurisdiction building architecture ahead of, rather than in response to, large-scale enforcement activity.

A counter-current to the remediation narrative has also surfaced. Civil-society commentary, reported by Daily FT on 18 September 2026, raises concern that the pace and scope of these reforms, including expanded executive asset-freezing and surveillance powers introduced without prior judicial authorisation, may reflect AML/CFT over-compliance driven by anxiety about FATF grey-listing rather than calibrated policy design. This is a legitimate governance tension: a jurisdiction under evaluation pressure has an incentive to over-deliver on paper, and provisions expanding executive power without corresponding judicial checks carry their own institutional risk independent of their AML/CTF utility.

Outlook

The outcome of the FATF/APG third mutual evaluation, including the on-site assessment and plenary result, has not been confirmed in open sources as of this cycle and represents the single most consequential unresolved variable for Sri Lanka's AML/CTF trajectory. The amendments passed in July 2026 and the enforcement disclosures that followed should be read as the visible component of a remediation effort whose ultimate grading is still pending. Whether the expanded executive powers draw further judicial or civil-society challenge, and whether continued FIU enforcement activity scales beyond the Rs.14.6 million disclosed this cycle, are the threads most likely to develop as scheduled in subsequent reporting.