Regulatory overview
- Scope
- Sri Lanka
- Authorities
- Regulatory index
- Latest regulatory change
Sri LankaSri Lanka brought virtual asset services within its financial transaction reporting legislation through the August 2026 amendment. Inclusion establishes AML obligations without demonstrating a general commercial licence. The proposed specific framework and mandatory provider survey must be distinguished from existing permissions for securities, banking and payments.
A business developing a virtual asset service in Sri Lanka faces new financial reporting duties, but should not infer a general commercial licence from them. The August 2026 amendment includes these services in the AML framework while work on a specific regime continues.
For a tokenized investment, assessment also starts with the investor’s right. Shares, debt and fund interests engage securities rules; payments or international fund flows require resolving financial and foreign-exchange restrictions too. Answering an FIU survey does not replace those checks.
What the financial reporting amendment includes
The Financial Transactions Reporting (Amendment) Act 17 of 2026, certified on 4 August, includes virtual asset services within finance business, subject to other operative laws. It defines virtual assets and providers, covering exchange, transfer, custody and specified issuance-related services performed for others.
This inclusion develops the AML perimeter; it does not establish a general commercial authorisation. The July 2026 Cabinet decision approved further legislative work on a specific framework. These developments must be read together: legal obligations exist, while a complete VASP market entry route requires verification of additional rules and procedures.
Which authorities are involved and which framework is being prepared
The FIU, within the CBSL, administers financial transaction reporting and publishes the 2026 amendments. The central bank retains financial and foreign exchange responsibilities. The SEC supervises securities markets. Identifying the supervisor requires examining the instrument and activity; blockchain technology alone does not allocate an entire project to one authority.
The Cabinet-approved proposal envisages the SEC as principal regulator under a future virtual asset framework, involving the CBSL, FIU and tax administration. A decision to prepare legislation should not be presented as evidence that every provider can already apply for a VASP licence under that new arrangement.
Which procedures gather information and which authorise activity
The mandatory survey published in March 2026 requests information from businesses providing the categories of services identified by the FIU. It relies on information-gathering powers under financial reporting legislation. Completing the form authorises neither custody, exchange nor issuance and does not establish compliance with sectoral rules governing each activity.
Where securities are involved, the SEC Act 19 of 2021 establishes requirements for markets, depositories and intermediaries. Incorporating a company does not replace those permissions. Varners' Chambers analysis distinguishes incorporation, sectoral approvals and foreign investment, including specific Colombo Port City procedures. A business permission within that zone does not itself establish VASP authorisation.
How to assess an investment represented through tokens
The SEC Act's securities definition includes shares, debt instruments, collective investment scheme units and other instruments. Projects representing these rights through tokens must therefore examine offering, intermediation and registration requirements. A technological label neither removes the instrument's requirements nor automatically validates a proposed structure.
Sections 59 to 62 of the same Act govern securities accounts and central depository arrangements. They do not attribute those effects to every independent digital wallet. Project documentation should specify the acquired right, obligor and transfer mechanism. Recognising virtual assets for AML purposes also does not establish direct title to land or other represented property.
Which diligence and payment limits affect the service
The financial reporting amendment addresses customer and beneficial owner diligence, risk assessment, information retention and reporting. Failure to complete diligence requires the corresponding legal consequences to be applied. Providers must integrate these duties into operations even while specific commercial authorisation and supervision arrangements remain under development.
The CBSL's March 2023 notice states that cryptocurrencies are not legal tender and debit or credit cards cannot be used for these transactions under Directions 03 of 2021. This dated warning should be checked against foreign exchange and payment rules applicable to a specific flow; AML reform does not establish removal of those restrictions.
What to confirm before accepting funds or issuing
Prepare a description of the service, customer rights and fund flows. If securities are offered, identify the issuer, intermediary and applicable register; if virtual asset services are provided, incorporate AML duties without assuming that compliance grants operating permission.
Launch requires confirming an enabling basis, product permissions and permitted payment channels. Separate the certified amendment, information survey and Cabinet-announced legislative work in the timetable. That distinction avoids promising customers authorisation or property protection not established by the sources.
To understand how this framework applies to your project, discuss your case with our team.
Key takeaways
- The August 2026 amendment expressly includes virtual asset services within the AML perimeter.
- Responding to the FIU survey does not grant a licence.
- The government decision to develop a specific framework requires legislative implementation.
- Securities rights and intermediary permissions do not arise from a token’s technical record.
Regulatory milestones
CBSL public warning
The central bank recalls payment restrictions and the absence of approvals in its notice.
Mandatory provider survey
The FIU requests information on virtual asset services.
Act 17 of 2026 certified
The financial reporting amendment includes virtual asset services.
Frequently asked questions
Act 17 of 2026 brings virtual asset services within financial reporting legislation. Inclusion establishes AML duties but does not itself establish a general commercial authorisation procedure.
No. It is an information requirement. Permissions, payment restrictions and rules governing the product and service require separate verification.
The Cabinet decision approves preparation of the framework and envisages a leading SEC role. It does not itself establish an operational VASP licensing procedure.
Act 17 of 2026 sets consequences when diligence cannot be completed: do not open the account, start the relationship or execute the transaction, or terminate an existing relationship as applicable. Suspicious reporting must also be considered.
That effect is not established. The CBSL’s 2023 notice recalls the restriction under Directions 03 of 2021. Check the proposed flow against current payment and foreign-exchange rules.
