--- title: "Sri Lanka Crypto Regulation Monitor | cryptoassets.gi" canonical: https://cryptoassets.gi/jurisdictions/sri-lanka/ source_html: /jurisdictions/sri-lanka/index.html description: "Sri Lanka crypto asset regulation: 8 categories, 38 sourced findings, updated 2026-11-04. Licensing, token classification, stablecoins, tax treatment." generated_at: 2026-11-07T14:19:44Z content_sha256: 9c765af46351fb8a7a7ec27173a459a0aef66d9d48473d4126cc9952060ef834 generator: "fe-fleet/md-twin@1.0" --- # Sri Lanka Crypto & Digital Asset Regulation schema crypto-v2.0.0 trajectory: not yet assessed unregulated gap overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/sri-lanka/) Last updated 2026-11-04 · 8 categories · 38 sourced findings · 25 sources in the cumulative register Download report (PDF) Expand all Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=SRI-LANKA)[Build Report](/reports/?j=SRI-LANKA)[Compare](/compare/?j=SRI-LANKA) Framework posture Unregulated gap 8 of 9 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Central Bank of Sri Lanka Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) 2027-Q1 Sri Lanka VASP legislation expected to clear Legal Draftsman's Department and reach Parliament Module coverage & confidence 8 / 9 modules assessed 0 Confirmed · 8 Probable · 0 Uncertain · 1 Not yet assessed 8 Categories 0 Moved this cycle 0 Key judgments 3 Open gaps 38 Findings 5 Tier-1 sources Confidence mix 8 unpopulated (sums to 8 rendered categories; click to filter) No categories moved this cycle. ## Jurisdiction lead brief ###### Latest update · 4 November 2026 #### Lead Signal Sri Lanka's crypto regime continues to show a widening gap between a tightening anti-money-laundering perimeter and the near-total absence of any licensing or prudential framework. The Financial Transactions Reporting (Amendment) Act, No. 17 of 2026 pulls Virtual Asset Service Providers into the existing Financial Transactions Reporting Act's definition of financial business, which means these providers now carry reporting-institution obligations of the kind banks and money-service businesses already hold. What this amendment does not do is create any route to authorisation: there remains no statute under which an exchange, trading platform, mining operation or other crypto service provider can be licensed to operate domestically, and the Central Bank of Sri Lanka has not authorised a single such entity. The practical effect is that a provider can now be caught for AML purposes while still having no lawful basis to exist as a regulated financial business in the first place. #### Other Developments Tax authorities are treating crypto gains as ordinary income despite the asset class carrying no legal-tender status. The Inland Revenue Department, through the Deputy Minister of Finance's statement to Parliament, has confirmed that cryptocurrency profits fall under general income tax as 'other income' rather than under any bespoke crypto tax category. Separately, an 18 percent value-added tax on digital services took effect on 1 April 2026, and commentary circulating since then suggests this VAT extends registration and reporting duties to crypto exchanges and service providers. That extension has not been confirmed against the tax authority's own gazette or circular text, so it should be treated as a plausible but not yet independently verified reading of the VAT's reach into the sector. On cross-border movement of value, the restriction on using international foreign-exchange card payments to buy or trade virtual currencies remains in place for resident cardholders, with banks directed not to facilitate such trades. This sits on top of the Central Bank's long-standing position that the rupee is the only legally recognised currency on the island, that cryptocurrency cannot be used to settle payments of any kind, and that any payment in foreign currency needs prior approval under the Foreign Exchange Act. Together these form a consistent official posture: crypto may be held and apparently taxed, but it may not be used to pay for anything, and it may not be bought using outbound card rails. #### Cross-Monitor Connections The amendment bringing Virtual Asset Service Providers inside the financial-business definition is, at its core, an anti-money-laundering measure, and its substance belongs to the broader reporting and financial-crime architecture that sits outside this brief's scope. Readers tracking that architecture should expect the VASP registration detail to surface there rather than here. #### Outlook The near-term question is whether the Financial Intelligence Unit will publish the registration gateway and compliance timeline for Virtual Asset Service Providers now brought within reporting-institution scope, since the amendment act's text on this point was not fully extractable. On the tax side, confirmation directly from the Inland Revenue Department of how the digital-services VAT applies to crypto exchanges would resolve the current reliance on secondary commentary. Absent a dedicated licensing statute, the structural picture is likely to persist: an expanding compliance perimeter around existing providers, with no corresponding path to lawful domestic operation. 2 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Sri Lanka's crypto regulatory posture this cycle is defined by a binding negative baseline paired with an emerging, pre-legislative policy shift. No virtual-asset service provider is currently licensed, registered or supervised anywhere in the country, and the Central Bank of Sri Lanka has issued repeated public warnings against cryptocurrency investment; at the same time, the Ministry of Digital Economy is developing a virtual-asset regulatory framework intended to license and supervise VASPs, which was presented to the country's apex AML body in February 2026. This combination -- an in-force absence of licensing alongside an announced-but-undrafted future framework -- is the defining structural fact for any operator or investor assessing Sri Lanka's crypto market this cycle. #### Other Developments A documented large-scale fraud case underlines the consumer-protection gap. A Sri Lankan crypto Ponzi scheme defrauded thousands of victims of over Rs. 500 million over roughly two years, with victims staging protests demanding justice. This sits alongside the Central Bank's repeated public warnings about cryptocurrency investment risk and its confirmation that it has not authorised any crypto-related businesses, leaving investors without regulatory safeguards; the fraud case is a concrete illustration of the exposure that absence of licensing and supervision creates in practice. The case also illustrates a recurring typology in unregulated crypto markets globally: absent licensing creates an information vacuum that fraudulent schemes exploit precisely because there is no supervised venue for legitimate crypto investment activity to channel demand toward instead. The Foreign Exchange Act's card-based restriction remains the binding cross-border control. The Foreign Exchange Act prohibits the use of debit and credit cards for cryptocurrency transactions, and financial institutions are barred from processing crypto-related payments. This is a binding, in-force restriction under a primary statute, though a primary Central Bank citation for the specific administrative direction implementing it is still awaited in this cycle's evidence base. #### Cross-Monitor Connections Sri Lanka's crypto AML/CFT exposure is tracked as a subscribed slot supplied by the financial-integrity monitor (its D7 and D5 typology domains); this consumer performs no first-party AML/CFT analysis on crypto activity and instead renders that content as supplied. The proposed virtual-asset regulatory framework referenced above is the same underlying development the financial-integrity monitor reads through its D5 lens; readers seeking the AML/CFT-specific analysis of Sri Lanka's proposed VASP framework should consult that monitor's D5 sub-brief rather than expecting it here. #### Outlook The framework's progression from a February 2026 proposal to an actual drafting stage is the single most consequential item to watch, and the open allocation question -- which authority will hold VASP licensing power -- will determine much of what follows. Given the documented Rs. 500 million-plus fraud case, consumer-protection developments are the second item to track. The Foreign Exchange Act's card-based restriction is unlikely to change materially absent a broader liberalisation of the cross-border crypto-payments regime, which has not been signalled this cycle. Read full brief · 1044 words Key regulatory facts for Sri Lanka Regulatory Dimension Sri Lanka Standing Position Jurisdiction Sri Lanka (LK) Regulatory Scope Crypto & Digital Asset Regulation (8 modules, 38 sourced findings) Crypto Licensing No licensing or registration regime for VASPs currently exists in Sri Lanka. Token Classification CBSL uses the umbrella terms 'virtual currencies' and 'cryptocurrency' without a statutory sub-classification distinguishing security tokens, e-money tokens, asset-referenced tokens, utility tokens, stablecoins or NFTs. On-Chain Activity Regime CBSL notices reference mining and ICO activity only to state that no such operations have been authorised; there is no specific regulatory treatment for staking, DeFi lending, DEX activity, node operation, validator... Stablecoin Regime No stablecoin-specific legal framework exists in Sri Lanka. Primary Instruments Cited Central Bank of Sri Lanka, Central Bank of Sri Lanka, Financial Transactions Reporting (Amendment) Act, No. 17 of 2026, Ministry of Digital Economy, Central Bank of Sri Lanka Last Confirmed / Updated 2026-11-04 (25 sources in cumulative register) 8 of 8 categories Signal Moved Judgment Gap Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Sri Lanka: C1 Crypto LicensingRedEnacted in forceModule confidence: Probable▾ No licensing or registration regime for VASPs currently exists in Sri Lanka. A Cabinet-approved policy framework (27 July 2026) names the SEC as prospective lead regulator with CBSL/FIU/IRD joint oversight; concept paper reached the Legal Draftsman's Department 24 September 2026, still in drafting as of 12 October 2026 committee briefing. The FTRA Amendment Act No.17 of 2026 separately classifies VASPs as financial businesses for AML purposes without creating a licensing gateway. Open gap — crypto-int-1 Pinpoint VASP-definition section number within FTRA Amendment Act No. 17 of 2026 was not independently located due to garbled PDF extraction; exact FIU registration gateway for VASPs not confirmed. no under-indexing note recorded Horizon · 2027 (± a year) Virtual Asset Regulatory Framework expected to move to drafting stage Proposed · Tier 2 source Horizon · 2027-Q1 (± six months) Sri Lanka VASP legislation expected to clear Legal Draftsman's Department and reach Parliament Consultation · Tier 2 source Horizon · 2027-Q2 (± more than a year) VASP regulatory framework and SEC Act amendment expected to reach drafted bill stage Proposed · Tier 2 source #### Crypto Licensing No virtual-asset service provider is currently licensed, registered or supervised in Sri Lanka. The Central Bank of Sri Lanka has issued repeated public warnings against cryptocurrency investment, and this negative finding is carried at High confidence from a Tier-3 source. Against this binding absence, the Ministry of Digital Economy is developing a virtual-asset regulatory framework intended to license and supervise VASPs and to introduce travel-rule-equivalent requirements; the proposal was presented to the country's apex AML body in February 2026, also at High confidence from a Tier-2 source, though it remains pre-legislative -- distinct from the separately progressing Cyber Security Bill, which the Deputy Minister of Digital Economy has clarified addresses network and technical security rather than data-protection or virtual-asset financial-compliance questions. Sri Lanka's crypto-licensing status is therefore best characterised as an emerging but not yet operative regime: a clear negative baseline paired with a credible but undrafted forward signal. #### Outlook The critical open question is which authority -- the Central Bank, a securities regulator, or a new dedicated body -- will hold VASP licensing power once the proposed framework moves to drafting; this allocation decision is not yet established in this cycle's evidence and materially affects the practical licensing timeline. Read full sub-brief · 202 words Periodic update · new data 2026-10-26 #### Crypto Licensing Sri Lanka's crypto licensing position is in a state of transition from an explicit no-regime baseline toward a first VASP framework. The Central Bank of Sri Lanka has not authorised any entity to operate a cryptocurrency exchange, mining operation or advisory service in Sri Lanka, and no licence class currently exists for any crypto-related activity. This remains the operative legal position today: there is no mechanism by which an exchange, custodian or advisory service could become licensed in Sri Lanka as matters stand. Movement toward a first licensing regime began with Cabinet's approval, on 27 July 2026, of a policy framework naming the Securities and Exchange Commission of Sri Lanka as the prospective lead regulator for virtual assets and VASPs. The framework envisages the SEC coordinating with the Central Bank's Financial Intelligence Unit and the Inland Revenue Department, reflecting a multi-agency design rather than a single-regulator model. Implementing legislation progressed to a further milestone on 24 September 2026, when the Ministry of Digital Economy's VASP concept paper was sent to the Legal Draftsman's Department, with the first phase of the prospective regime limited in scope to licensed exchanges and custodians, rather than extending to the full range of possible VASP activities at the outset. The timing of this drafting effort is explicitly tied to Sri Lanka's forthcoming AML/CFT mutual evaluation: officials have framed the VASP framework's development as occurring before a critical anti-money-laundering review, rather than as a response to domestic demand for crypto-payments infrastructure. This sequencing matters for how the eventual regime should be read, it is being built to satisfy an external evaluative process first, with any domestic market-development function being, at most, a secondary effect of that process. No primary regulator-issued instrument, whether CBSL notice text, an SEC Act amendment, or the draft bill itself, was directly retrievable; the finding rests on corroborated T2 press reporting of the Cabinet decision and the drafting milestone rather than on a gazetted or published text. This is a structural gap, not a one-off retrieval failure, and the licensing regime's final shape, including any licence categories, capital requirements, or fit-and-proper tests, remains unknown until the drafted legislation is made public. #### Outlook The VASP legislation is expected to clear the Legal Draftsman's Department and reach Parliament around the first quarter of 2027, a timeframe reported with substantial uncertainty given that the drafting stage itself has not yet concluded. Until legislation is enacted and brought into force, the current baseline position, no authorisation exists for any crypto business in Sri Lanka, continues to govern. The first-phase limitation to licensed exchanges and custodians suggests that other categories of VASP activity, such as token issuance or broader on-chain service provision, may fall outside the initial scope of whatever regime is eventually enacted, a distinction worth tracking as the draft bill's text becomes available. 1 earlier distinct update(s) Periodic update · new data 2026-10-18 #### Crypto Licensing Sri Lanka's crypto licensing position is in a state of transition from an explicit no-regime baseline toward a first VASP framework. The Central Bank of Sri Lanka has not authorised any entity to operate a cryptocurrency exchange, mining operation or advisory service in Sri Lanka, and no licence class currently exists for any crypto-related activity. This remains the operative legal position today: there is no mechanism by which an exchange, custodian or advisory service could become licensed in Sri Lanka as matters stand. Movement toward a first licensing regime began with Cabinet's approval, on 27 July 2026, of a policy framework naming the Securities and Exchange Commission of Sri Lanka as the prospective lead regulator for virtual assets and VASPs. The framework envisages the SEC coordinating with the Central Bank's Financial Intelligence Unit and the Inland Revenue Department, reflecting a multi-agency design rather than a single-regulator model. Implementing legislation progressed to a further milestone on 24 September 2026, when the Ministry of Digital Economy's VASP concept paper was sent to the Legal Draftsman's Department, with the first phase of the prospective regime limited in scope to licensed exchanges and custodians, rather than extending to the full range of possible VASP activities at the outset. The timing of this drafting effort is explicitly tied to Sri Lanka's forthcoming AML/CFT mutual evaluation: officials have framed the VASP framework's development as occurring before a critical anti-money-laundering review, rather than as a response to domestic demand for crypto-payments infrastructure. This sequencing matters for how the eventual regime should be read, it is being built to satisfy an external evaluative process first, with any domestic market-development function being, at most, a secondary effect of that process. No primary regulator-issued instrument, whether CBSL notice text, an SEC Act amendment, or the draft bill itself, was directly retrievable this cycle; the finding rests on corroborated T2 press reporting of the Cabinet decision and the drafting milestone rather than on a gazetted or published text. This is a structural gap, not a one-off retrieval failure, and the licensing regime's final shape, including any licence categories, capital requirements, or fit-and-proper tests, remains unknown until the drafted legislation is made public. #### Outlook The VASP legislation is expected to clear the Legal Draftsman's Department and reach Parliament around the first quarter of 2027, a timeframe reported with substantial uncertainty given that the drafting stage itself has not yet concluded. Until legislation is enacted and brought into force, the current baseline position, no authorisation exists for any crypto business in Sri Lanka, continues to govern. The first-phase limitation to licensed exchanges and custodians suggests that other categories of VASP activity, such as token issuance or broader on-chain service provision, may fall outside the initial scope of whatever regime is eventually enacted, a distinction worth tracking as the draft bill's text becomes available. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and findings (9) - T1[Central Bank of Sri Lanka](https://www.cbsl.gov.lk/en/news/risks-of-using-and-investing-in-cryptocurrency-20230329) — CBSL has not given any licence or authorization to any entity or company to operate cryptocurrency exchanges, ICOs, mining operations, deposit-taking or custody services related to cryptocurrency. - T1[Central Bank of Sri Lanka](https://www.cbsl.gov.lk/en/news/risks-of-using-and-investing-in-cryptocurrency-20230329) — Electronic Fund Transfer Cards (EFTCs) such as debit cards and credit cards are not permitted to be used for payments related to cryptocurrency transactions, under Directions No. 03 of 2021 issued pursuant to the Foreign Exchange Act, No. 12 of 2017. - T1[Financial Transactions Reporting (Amendment) Act, No. 17 of 2026](http://fiusrilanka.gov.lk/docs/ACTs/FTRA_Amendment_Act_No_17_of_2026/FTRA_Amendment_Act_No_17_of_2026_E.pdf) — Brings Virtual Asset Service Providers within the FTRA's 'financial business' definition, imposing AML reporting-institution obligations; does not create a prudential licensing regime. - T2[Ministry of Digital Economy](https://www.themorning.lk/articles/Y3WRUrbgqxrcJdbgvHlF) — A virtual-asset regulatory framework to license and supervise virtual-asset service providers, presented to the country's apex AML body in February 2026 - T3[Central Bank of Sri Lanka](https://www.lightspark.com/knowledge/is-crypto-legal-in-sri-lanka) — No virtual-asset service provider is currently licensed, registered or supervised in Sri Lanka; CBSL has issued repeated public warnings against crypto investment - T4[Central Bank of Sri Lanka](https://www.lightspark.com/knowledge/is-crypto-legal-in-sri-lanka) — CBSL has not licensed or authorised any cryptocurrency exchange, trading platform, mining operation or related service provider; no entity may lawfully operate a domestic crypto exchange under current law. - T2[Cabinet of Ministers of Sri Lanka](https://www.ft.lk/front-page/Virtual-asset-rules-take-shape-as-Sri-Lanka-prepares-for-AML-evaluation/44-798542) — Policy framework naming SEC as lead regulator for virtual assets and VASPs, with joint oversight by CBSL, FIU and Inland Revenue; no statute yet exists. - T4[Financial Transactions Reporting (Amendment) Act, No. 17 of 2026](https://www.datawallet.com/crypto/best-crypto-exchanges-sri-lanka) — Virtual asset service providers classified as financial businesses, bringing them within FTRA AML reporting obligations, even though no VASP-specific licence yet exists. ### Sri Lanka: C2 Token ClassificationRedEnacted in forceModule confidence: Probable▾ CBSL uses the umbrella terms 'virtual currencies' and 'cryptocurrency' without a statutory sub-classification distinguishing security tokens, e-money tokens, asset-referenced tokens, utility tokens, stablecoins or NFTs. There is no securities-law or banking-law taxonomy applied to crypto-assets in Sri Lanka. C2 · Token Classification — Full Module Record 0 sub-modules · 180 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Sri Lanka: C3 On-Chain Activity RegimeRedEnacted in forceModule confidence: Probable▾ CBSL notices reference mining and ICO activity only to state that no such operations have been authorised; there is no specific regulatory treatment for staking, DeFi lending, DEX activity, node operation, validator activity, or tokenization in Sri Lanka. C3 · On-Chain Activity — Full Module Record 0 sub-modules · 180 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Sri Lanka: C4 Stablecoin RegimeRedEnacted in forceModule confidence: Probable▾ No stablecoin-specific legal framework exists in Sri Lanka. There is no issuance authorisation regime, reserve requirement, redemption-right guarantee, disclosure regime, or systemic-designation mechanism for stablecoins under CBSL or any other Sri Lankan authority. C4 · Stablecoins & EMTs — Full Module Record 0 sub-modules · 180 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Sri Lanka: C5 Consumer ProtectionRedEnacted in forceModule confidence: Probable▾ CBSL has issued repeated public warnings (2018, 2021, 2022, 2023, 2024) disclosing financial, operational, legal and security risks of crypto investment, and urging promoters of crypto investment schemes to refrain from such activity. There is no statutory custody-segregation, complaint-handling, or suitability/appropriateness regime specific to crypto-assets; the warnings function as risk-disclosure/marketing-caution advisories rather than binding consumer-protection rules. #### Consumer Protection The Central Bank of Sri Lanka has issued multiple public warnings about cryptocurrency investment risk and has not authorised any crypto-related businesses, leaving investors without regulatory safeguards; both facts are carried at High confidence. Concretely illustrating the resulting exposure, a Sri Lankan crypto Ponzi scheme defrauded thousands of victims of over Rs. 500 million over roughly two years, with victims staging protests demanding justice, also at High confidence from a named Tier-2 source. Together these findings describe a consumer-protection environment with no crypto-specific protective instrument at all: the only protective measure evidenced this cycle is the Central Bank's repeated warning-issuance practice, which is advisory rather than a binding safeguard, and provides no restitution mechanism for victims of schemes such as the one documented here. #### Outlook Whether any consumer-protection provision is incorporated into the proposed virtual-asset regulatory framework as it moves toward drafting is the key item to watch; absent that, victims of crypto-related fraud in Sri Lanka have no crypto-specific regulatory recourse. Read full sub-brief · 164 words No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and findings (6) - T1[Central Bank of Sri Lanka](https://www.cbsl.gov.lk/en/news/risks-of-using-and-investing-in-cryptocurrency-20230329) — CBSL has highlighted, through press releases issued in 2018, 2021, 2022, 2023 and 2024, the significant financial, operational, legal and security-related risks and customer protection concerns posed to users of cryptocurrency. - T1[Central Bank of Sri Lanka](https://www.cbsl.gov.lk/en/news/risks-of-using-and-investing-in-cryptocurrency-20230329) — CBSL urges those engaged in promoting and facilitating the promotion of investing and trading in cryptocurrency to refrain from such activities considering the wide range of risks to the public. - T3[Central Bank of Sri Lanka](https://www.lightspark.com/knowledge/is-crypto-legal-in-sri-lanka) — Multiple public warnings about cryptocurrency investment risk; has not authorised any crypto-related businesses, leaving investors without regulatory safeguards - T2[Sri Lankan crypto Ponzi scheme](https://dailynews.lk/2026/05/06/features/990472/sri-lankas-crypto-regulation-roadmap-what-the-2026-framework-actually-means/) — Thousands of Sri Lankans of over Rs.500 million over roughly two years, with victims staging protests demanding justice - T2[Sri Lanka crypto-asset service providers](https://www.ft.lk/front-page/Virtual-asset-rules-take-shape-as-Sri-Lanka-prepares-for-AML-evaluation/44-798542) — No custody or client-asset-segregation regime for crypto-asset service providers exists; listed among the gaps the forthcoming SEC-led framework is intended to address. ### Sri Lanka: C6 Tax TreatmentRedEnacted in forceModule confidence: Probable▾ No crypto-specific tax guidance from Sri Lanka's Inland Revenue Department (IRD) was identified. General Inland Revenue Act provisions may in principle apply to crypto-related income or gains, but no confirmed primary-source ruling, circular, or IRD guidance specific to cryptocurrency taxation (capital gains, income tax, VAT/GST, withholding, or reporting obligations) could be located. C6 · Tax Treatment — Full Module Record 0 sub-modules · 180 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Sri Lanka: C7 Cross-Border TransferAmberEnacted in forceModule confidence: Probable▾ Cross-border crypto flows are constrained indirectly through Foreign Exchange Act mechanisms rather than a crypto-specific cross-border regime. Purchasing virtual currencies from abroad is treated by CBSL as a violation of Foreign Exchange Regulations because VCs are not a permitted investment category, and card-based foreign-currency payments for VC transactions are barred. No dedicated crypto travel-rule, sanctions-nexus, or reporting-threshold regime exists. Periodic update · new data 2026-10-04 #### Cross-Border Transfer Sri Lanka's cross-border transfer regime for virtual assets consists of a single, narrowly scoped restriction operating within an otherwise unregulated field. The Foreign Exchange Act is used to prohibit the use of debit and credit cards for cryptocurrency transactions. This provision was not purpose-built as a crypto-specific cross-border control; rather, it functions as a repurposed application of general foreign-exchange restrictions to crypto-related card payments, and it operates in the absence of any dedicated crypto cross-border enforcement-penalty schedule. The practical effect for market participants is that card-based fiat-to-crypto conversion is restricted, while other channels for cross-border crypto value transfer are not addressed by any specific statutory instrument. Outside of this card-based restriction, Sri Lanka has no travel-rule equivalent and no crypto-specific cross-border reporting-threshold regime. This finding, drawn from Ministry of Digital Economy material, is confirmed rather than merely inferred, and it sits in contrast to the active policy development occurring elsewhere in the virtual-asset space: the VASP Sub-Committee process has been underway with technical assistance from UK HM Treasury on FATF Recommendation 15 compliance, yet the cross-border information-sharing dimension typically associated with Recommendation 16's travel-rule standard does not appear to have reached the same stage of active development, at least not within the material available this cycle. The Securities and Exchange Commission has been recommended as lead VASP regulator, which may in time extend to cross-border transfer oversight, but no such mandate has been formalised in enacted law. The traffic-light assessment for this module reflects a mixed picture: an amber rather than red rating is appropriate because a genuine restriction does exist and is in force, even though its scope is narrow and its origin lies in general foreign-exchange law rather than dedicated crypto legislation. This distinguishes cross-border transfer from modules such as crypto licensing or token classification, where the finding is a more complete absence of any applicable instrument. The amber characterization also reflects that the restriction, while real, does not constitute a comprehensive cross-border transfer regime; it addresses one payment rail (card-based conversion) without touching other potential channels for cross-border virtual-asset movement, such as peer-to-peer transfers, exchange-to-exchange flows, or wallet-to-wallet transactions crossing jurisdictional lines. The absence of a travel-rule framework is particularly salient given Sri Lanka's position within the FATF/APG mutual evaluation cycle. Recommendation 16, which underpins travel-rule expectations for virtual-asset transfers, is a standard assessors are likely to test, and a jurisdiction without any implementing mechanism is likely to register a gap on that specific point regardless of progress made on Recommendation 15 licensing-related work. The current structure, Recommendation 15 institutional work (VASP Sub-Committee, lead-regulator recommendation) proceeding ahead of Recommendation 16 cross-border information-sharing work, suggests the latter remains at an earlier stage of policy attention. #### Outlook The trajectory for this module is most likely to be determined by whatever legislative vehicle eventually enacts Sri Lanka's VASP framework. If that framework, when and if enacted, incorporates travel-rule obligations for VASPs operating in or serving Sri Lanka, the current gap would close in a single legislative step rather than through incremental rulemaking. Until such a vehicle is enacted, the Foreign Exchange Act's card-based restriction is expected to remain the sole operative cross-border control, and market participants relying on other transfer channels should not assume any equivalent restriction or reporting obligation applies to those channels as a matter of current Sri Lankan law. C7 · Cross-Border & Travel Rule — Full Module Record 0 sub-modules · 180 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Sri Lanka: C8 AML/CFT RegimeAmberEnacted in forceModule confidence: Probable▾ AML/CFT content for crypto is subscribed from the FIM aml_ctf module per fleet doctrine and is not duplicated here. For disambiguation context only: CBSL's Financial Intelligence Unit has issued crypto-scam public-awareness material, and CBSL's 2026 Policy Agenda notes ongoing amendments to core AML/CFT/CPF laws ahead of Sri Lanka's third FATF Mutual Evaluation. No crypto-specific VASP AML obligations (travel rule, sanctions screening) have been identified as enacted. C8 · AML/CFT Regime — Full Module Record 0 sub-modules · 180 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)