Cryptoassets Regulatory Intelligence cryptoassets.gi
LK v13.3.0
content: ai_generated legal review: never_reviewed (informational) publication gate: 1 failing5 sources retrieved model claude-sonnet-5 · 2026-08-05

Sri Lanka

LK schema crypto-v2.0.0 trajectory: not yet assessedunregulated gapoverlaps: FIM

Last updated · 8 categories · 14 sourced findings · 18 sources in the cumulative register

8Categoriesbaseline.
14Findings.claims[]
5Tier-1 sourcesrun_metadata.t1_source_count
Confidence mix (sums to 8 rendered categories; click to filter)
No categories moved this cycle.

Jurisdiction lead brief

Latest update · 18 October 2026

Lead Signal

Sri Lanka's crypto regulatory perimeter is moving from a no-regime baseline toward a first licensing framework, driven by the approach of an AML/CFT mutual evaluation rather than by domestic payments-innovation policy. Cabinet approved a policy framework on 27 July 2026 naming the Securities and Exchange Commission of Sri Lanka as the prospective lead regulator for virtual assets and VASPs, working alongside the Central Bank of Sri Lanka's Financial Intelligence Unit and the Inland Revenue Department. Implementing legislation has been in drafting since 24 September 2026, with the first phase of coverage limited to licensed exchanges and custodians.

8 of 8 categories
Signal
Density

Selections OR within a group, AND across groups. Press / to search.

#

Sri Lanka has no in-force crypto-asset licensing regime. A regulatory perimeter is under active construction: Cabinet approved a policy framework (27 July 2026) designating the SEC as lead VASP regulator, and the Ministry of Digital Economy's concept paper was sent to the Legal Draftsman's Department on 24 September 2026.

Standing sub-brief · as of 25 August 2026202 words · last cycle 2026-10-18

Crypto Licensing

No virtual-asset service provider is currently licensed, registered or supervised in Sri Lanka. The Central Bank of Sri Lanka has issued repeated public warnings against cryptocurrency investment, and this negative finding is carried at High confidence from a Tier-3 source. Against this binding absence, the Ministry of Digital Economy is developing a virtual-asset regulatory framework intended to license and supervise VASPs and to introduce travel-rule-equivalent requirements; the proposal was presented to the country's apex AML body in February 2026, also at High confidence from a Tier-2 source, though it remains pre-legislative -- distinct from the separately progressing Cyber Security Bill, which the Deputy Minister of Digital Economy has clarified addresses network and technical security rather than data-protection or virtual-asset financial-compliance questions. Sri Lanka's crypto-licensing status is therefore best characterised as an emerging but not yet operative regime: a clear negative baseline paired with a credible but undrafted forward signal.

Periodic update · new data 2026-10-18

Crypto Licensing

Sri Lanka's crypto licensing position is in a state of transition from an explicit no-regime baseline toward a first VASP framework. The Central Bank of Sri Lanka has not authorised any entity to operate a cryptocurrency exchange, mining operation or advisory service in Sri Lanka, and no licence class currently exists for any crypto-related activity. This remains the operative legal position today: there is no mechanism by which an exchange, custodian or advisory service could become licensed in Sri Lanka as matters stand.

Movement toward a first licensing regime began with Cabinet's approval, on 27 July 2026, of a policy framework naming the Securities and Exchange Commission of Sri Lanka as the prospective lead regulator for virtual assets and VASPs. The framework envisages the SEC coordinating with the Central Bank's Financial Intelligence Unit and the Inland Revenue Department, reflecting a multi-agency design rather than a single-regulator model. Implementing legislation progressed to a further milestone on 24 September 2026, when the Ministry of Digital Economy's VASP concept paper was sent to the Legal Draftsman's Department, with the first phase of the prospective regime limited in scope to licensed exchanges and custodians, rather than extending to the full range of possible VASP activities at the outset.

The timing of this drafting effort is explicitly tied to Sri Lanka's forthcoming AML/CFT mutual evaluation: officials have framed the VASP framework's development as occurring before a critical anti-money-laundering review, rather than as a response to domestic demand for crypto-payments infrastructure. This sequencing matters for how the eventual regime should be read, it is being built to satisfy an external evaluative process first, with any domestic market-development function being, at most, a secondary effect of that process.

No primary regulator-issued instrument, whether CBSL notice text, an SEC Act amendment, or the draft bill itself, was directly retrievable this cycle; the finding rests on corroborated T2 press reporting of the Cabinet decision and the drafting milestone rather than on a gazetted or published text. This is a structural gap, not a one-off retrieval failure, and the licensing regime's final shape, including any licence categories, capital requirements, or fit-and-proper tests, remains unknown until the drafted legislation is made public.

Outlook

The VASP legislation is expected to clear the Legal Draftsman's Department and reach Parliament around the first quarter of 2027, a timeframe reported with substantial uncertainty given that the drafting stage itself has not yet concluded. Until legislation is enacted and brought into force, the current baseline position, no authorisation exists for any crypto business in Sri Lanka, continues to govern. The first-phase limitation to licensed exchanges and custodians suggests that other categories of VASP activity, such as token issuance or broader on-chain service provision, may fall outside the initial scope of whatever regime is eventually enacted, a distinction worth tracking as the draft bill's text becomes available.

1 further periodic run re-emitted the standing brief unchanged and is not shown.

Sources and findings (3)
  1. T1 · Central Bank of Sri LankaCentral Bank of Sri Lanka — CBSL has not given any licence or authorization to any entity or company to operate cryptocurrency exchanges, ICOs, mining operations, deposit-taking or custody services related to cryptocurrency.retrieved M5bindingin force
  2. T1 · Central Bank of Sri LankaCentral Bank of Sri Lanka — Electronic Fund Transfer Cards (EFTCs) such as debit cards and credit cards are not permitted to be used for payments related to cryptocurrency transactions, under Directions No. 03 of 2021 issued pursuant to the Foreign Exchange Act, No. 12 of 2017.retrieved M4bindingin force
  3. T1 · Central Bank of Sri LankaCentral Bank of Sri Lanka — No comprehensive crypto-asset licensing statute exists in Sri Lanka; a broader payments-and-settlements legislative modernisation has been discussed without yet producing a crypto-specific licensing framework.retrieved M5non-bindingour coverage gap, expected to resolve on a re-run

#

CBSL uses the umbrella terms 'virtual currencies' and 'cryptocurrency' without a statutory sub-classification distinguishing security tokens, e-money tokens, asset-referenced tokens, utility tokens, stablecoins or NFTs. There is no securities-law or banking-law taxonomy applied to crypto-assets in Sri Lanka.

Absence reason not determinableNo sub-brief exists and the JID records no gap or review marker explaining why. The renderer will not invent a reason.

no periodic updates on record for this sub-brief

Sources and findings (1)
  1. T1 · Central Bank of Sri LankaCentral Bank of Sri Lanka — CBSL refers to cryptocurrencies broadly as 'virtual currencies' that are unregulated investment instruments not recognized as an asset-class in Sri Lanka, without differentiating token types.retrieved M4non-binding

#

CBSL notices reference mining and ICO activity only to state that no such operations have been authorised; there is no specific regulatory treatment for staking, DeFi lending, DEX activity, node operation, validator activity, or tokenization in Sri Lanka.

Absence reason not determinableNo sub-brief exists and the JID records no gap or review marker explaining why. The renderer will not invent a reason.

no periodic updates on record for this sub-brief

Sources and findings (2)
  1. T1 · Central Bank of Sri LankaCentral Bank of Sri Lanka — CBSL has not authorized any Initial Coin Offerings (ICOs) or mining operations involving virtual currencies in Sri Lanka.retrieved M3bindingin force
  2. T1 · Central Bank of Sri LankaCentral Bank of Sri Lanka — No CBSL or statutory framework addresses staking, DeFi lending, DEX operation, node operation, validator activity, or tokenization in Sri Lanka.retrieved M3non-bindinga fact about the regime

#

No stablecoin-specific legal framework exists in Sri Lanka. There is no issuance authorisation regime, reserve requirement, redemption-right guarantee, disclosure regime, or systemic-designation mechanism for stablecoins under CBSL or any other Sri Lankan authority.

Absence reason not determinableNo sub-brief exists and the JID records no gap or review marker explaining why. The renderer will not invent a reason.

no periodic updates on record for this sub-brief

Sources and findings (1)
  1. T1 · Central Bank of Sri LankaCentral Bank of Sri Lanka — No stablecoin issuance authorisation, reserve requirement, redemption right, disclosure, or systemic designation regime exists in Sri Lanka.retrieved M4non-bindinga fact about the regime

#

CBSL has issued repeated public warnings (2018, 2021, 2022, 2023, 2024) disclosing financial, operational, legal and security risks of crypto investment, and urging promoters of crypto investment schemes to refrain from such activity. There is no statutory custody-segregation, complaint-handling, or suitability/appropriateness regime specific to crypto-assets; the warnings function as risk-disclosure/marketing-caution advisories rather than binding consumer-protection rules.

Standing sub-brief · as of 25 August 2026164 words · last cycle 2026-10-04

Consumer Protection

The Central Bank of Sri Lanka has issued multiple public warnings about cryptocurrency investment risk and has not authorised any crypto-related businesses, leaving investors without regulatory safeguards; both facts are carried at High confidence. Concretely illustrating the resulting exposure, a Sri Lankan crypto Ponzi scheme defrauded thousands of victims of over Rs. 500 million over roughly two years, with victims staging protests demanding justice, also at High confidence from a named Tier-2 source. Together these findings describe a consumer-protection environment with no crypto-specific protective instrument at all: the only protective measure evidenced this cycle is the Central Bank's repeated warning-issuance practice, which is advisory rather than a binding safeguard, and provides no restitution mechanism for victims of schemes such as the one documented here.

No new data since the standing brief. 1 periodic run re-emitted it unchanged.

Sources and findings (3)
  1. T1 · Central Bank of Sri LankaCentral Bank of Sri Lanka — CBSL has highlighted, through press releases issued in 2018, 2021, 2022, 2023 and 2024, the significant financial, operational, legal and security-related risks and customer protection concerns posed to users of cryptocurrency.retrieved M4non-binding
  2. T1 · Central Bank of Sri LankaCentral Bank of Sri Lanka — CBSL urges those engaged in promoting and facilitating the promotion of investing and trading in cryptocurrency to refrain from such activities considering the wide range of risks to the public.retrieved M3non-binding
  3. T1 · Financial Intelligence Unit, Central Bank of Sri LankaFinancial Intelligence Unit, Central Bank of Sri Lanka — No statutory custody-segregation, complaint-handling, or suitability/appropriateness regime exists specific to crypto-asset service providers in Sri Lanka.retrieved M3non-bindinga fact about the regime

#

No crypto-specific tax guidance from Sri Lanka's Inland Revenue Department (IRD) was identified. General Inland Revenue Act provisions may in principle apply to crypto-related income or gains, but no confirmed primary-source ruling, circular, or IRD guidance specific to cryptocurrency taxation (capital gains, income tax, VAT/GST, withholding, or reporting obligations) could be located.

Absence reason not determinableNo sub-brief exists and the JID records no gap or review marker explaining why. The renderer will not invent a reason.

no periodic updates on record for this sub-brief

Sources and findings (1)
  1. T1 · Central Bank of Sri LankaCentral Bank of Sri Lanka — No IRD-issued guidance specific to the income-tax or capital-gains treatment of cryptocurrency transactions in Sri Lanka has been identified.retrieved M4non-bindinga fact about the jurisdiction

#

Cross-border crypto flows are constrained indirectly through Foreign Exchange Act mechanisms rather than a crypto-specific cross-border regime. Purchasing virtual currencies from abroad is treated by CBSL as a violation of Foreign Exchange Regulations because VCs are not a permitted investment category, and card-based foreign-currency payments for VC transactions are barred. No dedicated crypto travel-rule, sanctions-nexus, or reporting-threshold regime exists.

Standing sub-brief · as of 25 August 2026153 words · last cycle 2026-10-04

Cross-Border Transfer

The Foreign Exchange Act prohibits the use of debit and credit cards for cryptocurrency transactions, and financial institutions are barred from processing crypto-related payments. This is a High-confidence, binding, in-force restriction under a primary statute, though this cycle's evidence base still awaits a primary Central Bank citation specifically implementing the restriction at the administrative level. The practical effect is that card-rail access for crypto purchases and cross-border crypto-linked payments is closed off through the regulated banking and card system, pushing any crypto-related cross-border activity toward channels outside the formally supervised payments perimeter.

Periodic update · new data 2026-10-04

Cross-Border Transfer

Sri Lanka's cross-border transfer regime for virtual assets consists of a single, narrowly scoped restriction operating within an otherwise unregulated field. The Foreign Exchange Act is used to prohibit the use of debit and credit cards for cryptocurrency transactions. This provision was not purpose-built as a crypto-specific cross-border control; rather, it functions as a repurposed application of general foreign-exchange restrictions to crypto-related card payments, and it operates in the absence of any dedicated crypto cross-border enforcement-penalty schedule. The practical effect for market participants is that card-based fiat-to-crypto conversion is restricted, while other channels for cross-border crypto value transfer are not addressed by any specific statutory instrument.

Outside of this card-based restriction, Sri Lanka has no travel-rule equivalent and no crypto-specific cross-border reporting-threshold regime. This finding, drawn from Ministry of Digital Economy material, is confirmed rather than merely inferred, and it sits in contrast to the active policy development occurring elsewhere in the virtual-asset space: the VASP Sub-Committee process has been underway with technical assistance from UK HM Treasury on FATF Recommendation 15 compliance, yet the cross-border information-sharing dimension typically associated with Recommendation 16's travel-rule standard does not appear to have reached the same stage of active development, at least not within the material available this cycle. The Securities and Exchange Commission has been recommended as lead VASP regulator, which may in time extend to cross-border transfer oversight, but no such mandate has been formalised in enacted law.

The traffic-light assessment for this module reflects a mixed picture: an amber rather than red rating is appropriate because a genuine restriction does exist and is in force, even though its scope is narrow and its origin lies in general foreign-exchange law rather than dedicated crypto legislation. This distinguishes cross-border transfer from modules such as crypto licensing or token classification, where the finding is a more complete absence of any applicable instrument. The amber characterization also reflects that the restriction, while real, does not constitute a comprehensive cross-border transfer regime; it addresses one payment rail (card-based conversion) without touching other potential channels for cross-border virtual-asset movement, such as peer-to-peer transfers, exchange-to-exchange flows, or wallet-to-wallet transactions crossing jurisdictional lines.

The absence of a travel-rule framework is particularly salient given Sri Lanka's position within the FATF/APG mutual evaluation cycle. Recommendation 16, which underpins travel-rule expectations for virtual-asset transfers, is a standard assessors are likely to test, and a jurisdiction without any implementing mechanism is likely to register a gap on that specific point regardless of progress made on Recommendation 15 licensing-related work. The current structure, Recommendation 15 institutional work (VASP Sub-Committee, lead-regulator recommendation) proceeding ahead of Recommendation 16 cross-border information-sharing work, suggests the latter remains at an earlier stage of policy attention.

Outlook

The trajectory for this module is most likely to be determined by whatever legislative vehicle eventually enacts Sri Lanka's VASP framework. If that framework, when and if enacted, incorporates travel-rule obligations for VASPs operating in or serving Sri Lanka, the current gap would close in a single legislative step rather than through incremental rulemaking. Until such a vehicle is enacted, the Foreign Exchange Act's card-based restriction is expected to remain the sole operative cross-border control, and market participants relying on other transfer channels should not assume any equivalent restriction or reporting obligation applies to those channels as a matter of current Sri Lankan law.

1 further periodic run re-emitted the standing brief unchanged and is not shown.

Sources and findings (3)
  1. T1 · Central Bank of Sri LankaCentral Bank of Sri Lanka — Purchasing virtual currencies from abroad would lead to a violation of Foreign Exchange Regulations, as VCs are not identified as a permitted investment category under the Foreign Exchange Act No. 12 of 2017.retrieved M4bindingin force
  2. T1 · Central Bank of Sri LankaCentral Bank of Sri Lanka — Electronic Fund Transfer Cards (debit/credit cards) are not permitted to be used for payments in foreign currency related to virtual currency transactions, under Foreign Exchange Regulations in Sri Lanka.retrieved M4bindingin force
  3. T1 · Central Bank of Sri LankaCentral Bank of Sri Lanka — No crypto-specific cross-border travel-rule or sanctions-screening obligation for virtual-asset transfers has been enacted in Sri Lanka.retrieved M3non-bindinga fact about the regime

#

AML/CFT content for crypto is subscribed from the FIM aml_ctf module per fleet doctrine and is not duplicated here. For disambiguation context only: CBSL's Financial Intelligence Unit has issued crypto-scam public-awareness material, and CBSL's 2026 Policy Agenda notes ongoing amendments to core AML/CFT/CPF laws ahead of Sri Lanka's third FATF Mutual Evaluation. No crypto-specific VASP AML obligations (travel rule, sanctions screening) have been identified as enacted.

Absence reason not determinableNo sub-brief exists and the JID records no gap or review marker explaining why. The renderer will not invent a reason.

no periodic updates on record for this sub-brief

No categories match.

Filters combine as OR inside a group and AND across groups.

Publication gate

Blocking. 1 failing check(s).

schema_validpass
min_quoted_text_presentwaived — floor 0%
egress_verifiedpass
every_practical_object_has_source_idFAIL
source_tier_integrity_okpass
jurisdiction_source_floor_metpass
tier_a_b_national_primary_pct100.0
aggregator_only_jurisdiction_count0
manual_override

Editorial metadata

Provenance only. Nothing below gates publication or affects the render.

Editorial metadata for Sri Lanka
FieldValue
trust.lawyer_review.statusnever_reviewed
trust.lawyer_review.reviewerno reviewer on record
trust.content_sourceai_generated

Provenance and declared absence

Disclosure model: module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is.

Sentinel-fed modules receive no special rendering treatment. sentinel_feed is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page.

Family taxonomy is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score; per-module RAG traffic light; derived_scores = {}.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-10-20. A year-precision row is never promoted into a tighter band.

Orphan deltas: 0 cycle_delta row(s) target non-module objects and are listed in the rail rather than attached to a card.

Envelope: baseline resolved at jurisdiction_json.baseline; 8 module(s), 14 finding(s), 18 source(s) in the cumulative register.

Think something on this page is wrong? Report an error.