Sri Lanka

**The Prevention of Money Laundering Act, No. 5 of 2006 (PMLA):** This Act criminalizes money laundering and establishes the legal framework for its prevention.

**The Financial Transactions Reporting Act, No. 6 of 2006 (FTRA):** This Act mandates reporting institutions (which would include regulated VASPs) to report suspicious transactions and sets out customer due diligence (CDD) and record-keeping requirements. It also established the Financial Intelligence Unit (FIU).

**The Convention on the Suppression of Terrorist Financing Act, No. 25 of 2005 (CSTFA):** This Act criminalizes terrorist financing and implements the international convention.

**Financial Intelligence Unit (FIU) of Sri Lanka:**

**Role:** The FIU acts as the central national agency for receiving, analyzing, and disseminating financial information concerning suspected proceeds of crime and terrorist financing. It is responsible for enforcing compliance with AML/CFT laws by reporting institutions.

**Central Bank of Sri Lanka (CBSL):**

**Role:** The CBSL has been involved in discussions regarding the regulation of VASPs and is expected to develop the licensing framework and supervise VASPs for both financial stability and AML/CFT compliance.

**Identification and Verification of Customers:**

**Individuals:** Obtain and verify the customer's full name, permanent address, date of birth, nationality, and a unique identification number (e.g., National Identity Card (NIC) number, passport number). Verification must be done using reliable, independent source documents, data, or information.

**Legal Persons/Arrangements:** Obtain and verify the legal name, legal form, proof of existence, powers that regulate and bind the legal person/arrangement, and the names of relevant persons holding senior management positions.

**Beneficial Ownership:** Identify and take reasonable measures to verify the identity of the beneficial owner(s) of the customer, including for legal persons, identifying natural persons who ultimately own or control the customer.

**Purpose and Intended Nature of the Business Relationship:** Understand the nature of the customer's activities and the purpose for which they intend to use the VASP's services.

**Simplified Due Diligence (SDD):** May be applied where the risk of money laundering or terrorist financing is lower (e.g., small, low-value transactions), but the VASP must still be able to identify the customer and monitor transactions.

**Enhanced Due Diligence (EDD):** Must be applied in higher-risk situations, such as:

Politically Exposed Persons (PEPs) and their family members/close associates.

Complex, unusually large transactions, or unusual patterns of transactions.

Transactions involving new products or business practices, and new technologies.

Transactions where the identity of the beneficial owner is difficult to ascertain.

For VASPs, this would also involve understanding the source of funds/wealth in crypto assets, the nature of associated wallets, and the purpose of large or frequent transfers.

Conduct ongoing monitoring of the business relationship and transactions undertaken by the customer to ensure consistency with the VASP's knowledge of the customer, their business, and risk profile.

Keep customer identification data up-to-date, especially for high-risk customers.

**Reporting Threshold:** Any transaction (regardless of amount) or attempted transaction where there are reasonable grounds to suspect that it may be linked to money laundering, terrorist financing, or other criminal activities.

**"No Tipping-Off":** VASPs and their employees are prohibited from disclosing to the customer or any third party that a STR or related information is being or has been submitted to the FIU.

**Internal Process:** VASPs must establish internal procedures for identifying, assessing, and reporting suspicious transactions, including the appointment of a designated AML/Compliance Officer.

**Duration:** All records, including customer identification data, account files, business correspondence, and records of transactions, must be maintained for a period of **at least six (6) years** after the business relationship is terminated or after the transaction is completed.

**Accessibility:** Records must be maintained in a manner that allows for rapid retrieval by the FIU or other competent authorities upon request.

**Types of Records:** This includes records of all fiat and virtual asset transactions, including sender and recipient information, amounts, dates, and relevant wallet addresses, as well as the underlying CDD documentation.

**Internal Controls and Procedures:** Develop and implement internal policies, procedures, and controls to prevent and detect ML/TF.

**Appointment of an AML/Compliance Officer:** Designate a senior officer responsible for the VASP's AML/CFT program and for liaising with the FIU.

**Employee Training:** Provide ongoing AML/CFT training to all relevant employees, ensuring they are aware of their obligations and can recognize suspicious activities.

**Independent Audit:** Establish an independent audit function to test the VASP's AML/CFT system and policies.

**Sanctions Screening:** Implement systems to screen customers and transactions against national and international sanctions lists (e.g., UN Security Council Resolutions).

**Travel Rule:** As per FATF guidance, regulated VASPs will likely be required to implement the "Travel Rule" for virtual asset transfers, meaning they must obtain and transmit originator and beneficiary information for transactions above a certain threshold.

**Capital Requirements:** No specific capital thresholds for VASP operations.

**AML/KYC Requirements (Specific to VASPs):** No specific AML/KYC regulations are tailored for VASPs under a licensing framework. However, any entity operating in Sri Lanka would still be subject to general anti-money laundering and combating the financing of terrorism (AML/CFT) laws, such as the **Financial Transactions Reporting Act No. 6 of 2006 (FTRA)**, if their activities fall within the scope of "financial institutions" or "designated non-financial businesses and professions (DNFBPs)" and trigger reporting obligations for suspicious transactions. The applicability to purely virtual asset businesses without fiat gateways is a grey area in the absence of explicit VASP definitions in the FTRA.

**Reference:** Financial Transactions Reporting Act No. 6 of 2006 (Note: This is a general AML/CFT law, not specific to VA licensing).

**Local Presence:** While no specific VASP license mandates local presence, any company wishing to operate legally in Sri Lanka, regardless of its business type, would need to comply with the Companies Act No. 07 of 2007, which typically involves local incorporation or registration as an overseas company branch.

**UN Consolidated Sanctions List:** This is the de facto list implemented by Sri Lanka. It includes individuals and entities designated under various UN sanctions regimes (e.g., ISIL (Da'esh) & Al-Qaida, Taliban, DPRK, Iran, Libya, Somalia, Sudan, Yemen, DRC, Central African Republic, South Sudan).

The FIU of Sri Lanka issues circulars and maintains a public section on its website regarding these lists.

**FIU of Sri Lanka (Circulars & Notifications):** https://www.fiusrilanka.gov.lk/circulars.php (Check for specific regulations or gazettes implementing UN sanctions lists).

**Press Release (2021):** The CBSL reiterated that "Virtual Currencies are not regulated in Sri Lanka, and therefore there is no regulatory oversight or safeguards relating to the usage, holding or trading of VCs in Sri Lanka." It advises against dealing in them, citing high risks for users.

**Central Bank of Sri Lanka Press Release (22 November 2021):** "Public is warned against the use of Virtual Currencies" https://www.cbsl.gov.lk/en/news/public-is-warned-against-the-use-of-virtual-currencies

**Earlier Press Release (2018):** "Further, the public is informed that any person or entity using/operating/trading VCs in Sri Lanka would be doing so at their own risk."

**Central Bank of Sri Lanka Press Release (29 January 2018):** "Public Warning regarding the Use of Virtual Currencies" https://www.cbsl.gov.lk/en/news/public-warning-regarding-the-use-of-virtual-currencies

**Prevention of Money Laundering Act, No. 5 of 2006:** https://www.fiusrilanka.gov.lk/docs/Laws-and-Regulations/PMLA%20No%205%20of%202006.pdf

**Financial Transactions Reporting Act, No. 6 of 2006:** https://www.fiusrilanka.gov.lk/docs/Laws-and-Regulations/FTRA%20No%206%20of%202006.pdf

**United Nations Act, No. 45 of 1968:** (Not readily available as a direct public URL from official Sri Lankan government sites, but is the enabling legislation for UN resolutions. It can typically be found in legal databases or requested from the Ministry of Justice.)

**United Nations (Financial and Other Measures) Regulations No. 1 of 2012 (under UN Act):** (This gazette implements UNSCR 1373, an example of how the UN Act is used. Check the National Gazettes for precise link.)

**FIU Sri Lanka - Laws and Regulations:** https://www.fiusrilanka.gov.lk/laws.php

**FIU Sri Lanka - Circulars & Notifications (for UN Sanctions Lists):** https://www.fiusrilanka.gov.lk/circulars.php

**Central Bank of Sri Lanka - Public Warning on Virtual Currencies (2021):** https://www.cbsl.gov.lk/en/news/public-is-warned-against-the-use-of-virtual-currencies

**UN Consolidated Sanctions List:** https://www.un.org/sc/suborg/en/sanctions/un-sc-consolidated-list

**OFAC Specially Designated Nationals (SDN) List:** https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists

**EU Consolidated Sanctions List:** https://www.sanctionsmap.eu/

**Regulator Name:** Central Bank of Sri Lanka (CBSL), Financial Intelligence Unit (FIU)

**Entity Targeted:** The general public and financial institutions in Sri Lanka, as well as any individuals or entities considering or engaging in virtual asset services.

**Violation Type:** Operating outside the regulated financial framework; promoting/engaging in high-risk, unregulated investments; dealing in non-legal tender.

**Penalty Amount:** No specific monetary penalty associated with this advisory itself. The "penalty" is the declaration of illegality/unregulated status and the implied risk of legal action under existing financial or criminal laws if related to fraud or money laundering.

**Date:** 2021-07-28 (Issued a press release)

**Outcome:** Heightened public awareness of the CBSL's prohibitive stance. Discouragement of engagement with cryptocurrencies and virtual asset service providers (VASPs). Reiterated that VASPs are not licensed or regulated by CBSL.

**Significance:** This was a strong and clear warning, setting the tone for the country's approach to virtual assets. It emphasized that crypto falls outside the existing regulatory perimeter, making any related activities high-risk and potentially illegal under broader financial laws.

Central Bank of Sri Lanka Press Release: https://www.cbsl.gov.lk/en/news/fiu-statement-on-the-use-of-virtual-currencies

**Violation Type:** Continuing to engage with or facilitate virtual asset transactions, despite previous warnings, and engaging in activities outside the regulatory framework.

**Penalty Amount:** No specific monetary penalty. The "penalty" remains the official declaration of their unregulated status and the potential application of broader financial or criminal laws for illicit activities.

**Date:** 2022-04-12 (Issued a press release)

**Outcome:** Reiteration of the prohibitive stance. Further clarification that facilitating or promoting cryptocurrencies is a violation of current foreign exchange regulations (especially related to outward remittances for crypto purchases) and payment laws.

**Significance:** This further solidified the CBSL's position, clarifying that not only are cryptocurrencies unregulated, but engaging in transactions involving foreign exchange for crypto can violate the country's stringent foreign exchange laws. This acts as a stronger deterrent for financial institutions.