Sri Lanka -- Sanctions Compliance Regulatory Overview

While Sri Lanka has not yet established a comprehensive regulatory framework specifically for virtual assets (VAs) or Virtual Asset Service Providers (VASPs), this does not exempt entities operating with VAs from existing Anti-Money Laundering (AML), Counter-Financing of Terrorism (CFT), and international sanctions obligations.

In fact, the Central Bank of Sri Lanka (CBSL) has repeatedly warned the public about the risks associated with cryptocurrencies, stating they are "unregulated digital currencies" and do not have legal tender status in Sri Lanka. Despite this, international sanctions, and Sri Lanka's existing AML/CFT framework, still apply.

Here's a breakdown of the applicable sanctions and restrictions:

1. General Sanctions Compliance Requirements for VASPs (OFAC/EU/UN)

Even in the absence of specific VASP regulations, any entity or individual in Sri Lanka dealing with cryptocurrencies would be subject to these global sanctions frameworks, particularly if they engage in international transactions, deal with foreign entities, or touch traditional financial systems.

• UN Sanctions:
  • Binding for Sri Lanka: As a member state of the United Nations, Sri Lanka is legally bound to implement UN Security Council Resolutions (UNSCRs). These resolutions often mandate asset freezes, travel bans, and arms embargoes against individuals, entities, and countries deemed a threat to international peace and security (e.g., related to terrorism, proliferation, specific regimes like North Korea, Iran).
  • Compliance for VASPs: Any VASP or individual facilitating crypto transactions in Sri Lanka must ensure they are not dealing with entities or individuals on the UN Consolidated Sanctions List. This is a direct legal obligation under Sri Lankan law.
• OFAC (U.S. Department of the Treasury's Office of Foreign Assets Control) Sanctions:
  • Extraterritorial Reach: OFAC sanctions primarily apply to U.S. persons (citizens, residents, entities), but also have significant extraterritorial reach. This means that non-U.S. persons, including those in Sri Lanka, can be subject to OFAC sanctions if their activities involve:
    • U.S. financial systems (e.g., using USD stablecoins, facilitating transactions cleared through U.S. banks).
    • U.S.-origin technology or services.
    • Facilitating transactions for Specially Designated Nationals (SDNs) or other sanctioned entities listed by OFAC.
    • Engaging in activities that violate specific U.S. sanctions programs (e.g., those related to Iran, North Korea, Cuba, Syria, Russia, Venezuela).
  • Compliance for VASPs: Any VASP aiming to operate internationally or interact with the U.S. financial system (even indirectly through stablecoins or cross-border crypto transfers) must screen against OFAC's SDN List and other relevant sanctions lists. Failure to do so can result in severe penalties, including being cut off from the U.S. financial system.
• EU Sanctions:
  • Scope: EU sanctions apply to all persons and entities within the EU's jurisdiction, EU nationals wherever they are, and entities registered under the law of an EU Member State. Like OFAC, they can have an indirect impact globally.
  • Compliance for VASPs: If a VASP in Sri Lanka processes transactions for EU persons, or partners with EU-regulated entities, they would be indirectly subject to EU sanctions compliance requirements, including screening against the EU Consolidated List.

2. Sanctioned Entity Screening Obligations

For any entity facilitating financial transactions, including those involving virtual assets, the obligation to screen against sanctions lists stems from:

• UN Sanctions Implementation: Sri Lankan law requires compliance with UN sanctions. Therefore, screening against the UN Consolidated Sanctions List is mandatory.
• AML/CFT Laws: Sri Lanka's Prevention of Money Laundering Act (PMLA) and Financial Transactions Reporting Act (FTRA) broadly apply to financial institutions and other entities involved in financial transactions. These laws require Customer Due Diligence (CDD) and Know Your Customer (KYC), which implicitly include screening against sanctions lists to identify politically exposed persons (PEPs) and sanctioned individuals/entities.
• Risk Mitigation: Even without specific crypto regulations, it is a best practice and crucial for risk mitigation for any entity dealing with VAs to screen all parties involved in a transaction against major international sanctions lists (UN, OFAC, EU) to avoid inadvertently facilitating illicit finance and facing severe legal or reputational consequences.

3. Geographic Restrictions

Geographic restrictions arise from specific country-based sanctions programs:

• UN Sanctions: Transactions involving certain sanctioned countries (e.g., North Korea, Iran, specific regions/entities in others) are prohibited under UN resolutions, which Sri Lanka is obliged to implement.
• OFAC Sanctions: U.S. sanctions impose comprehensive embargoes or targeted restrictions on transactions with certain countries or regions (e.g., Cuba, Iran, North Korea, Syria, specific entities in Russia, Venezuela). Facilitating crypto transactions directly or indirectly with these jurisdictions can violate OFAC regulations.
• EU Sanctions: Similarly, the EU maintains sanctions regimes against specific countries and regions.

Entities dealing with virtual assets must have robust systems to identify the origin and destination of funds and the geographical location of transacting parties to ensure compliance with these restrictions.

4. Penalties for Violations

Violations of sanctions and AML/CFT laws in Sri Lanka carry severe penalties, primarily under the following Acts:

• Prevention of Money Laundering Act No. 5 of 2006 (PMLA):
  • Section 3: Defines the offence of money laundering.
  • Section 4: Prescribes penalties for money laundering, which include imprisonment for a period not less than five years and not exceeding ten years and/or a fine of not less than one million rupees and not exceeding the value of the property involved in the offence.
• Financial Transactions Reporting Act No. 6 of 2006 (FTRA):
  • Section 8: Requires financial institutions to report suspicious transactions (STRs) and other reports to the Financial Intelligence Unit (FIU).
  • Section 19: Prescribes penalties for non-compliance with reporting obligations, including fines and/or imprisonment.
• United Nations Act No. 45 of 1968:
  • This Act enables the Sri Lankan government to implement UN Security Council Resolutions.
  • Section 3: States that any person contravening regulations made under this Act (i.e., regulations implementing UNSCRs, including asset freezes) shall be guilty of an offence and liable to imprisonment for a term not exceeding two years or to a fine not exceeding ten thousand rupees, or to both.
  • More specific regulations issued under this Act (e.g., for terrorism financing) might carry higher penalties. For instance, the United Nations (Financial and Other Measures) Regulations No. 1 of 2012 (implementing UNSCR 1373 on terrorism financing) outlines specific prohibitions and penalties.

Note: While the PMLA and FTRA don't specifically mention "virtual assets," facilitating financial transactions that constitute money laundering or terrorist financing through VAs would likely fall under their broad definitions of "financial transactions" and "proceeds of unlawful activity."

5. Country-Specific Sanctions Lists Applicable to Crypto

Sri Lanka does not maintain a specific country-level sanctions list related to cryptocurrency, nor does it have an independent comprehensive sanctions regime outside of implementing UN resolutions.

However, the Financial Intelligence Unit (FIU) of Sri Lanka, under the Central Bank, maintains and updates lists derived from UN Security Council Resolutions, especially concerning terrorism financing and proliferation. These are the primary "country-specific" lists Sri Lankan entities must comply with.

• UN Consolidated Sanctions List: This is the de facto list implemented by Sri Lanka. It includes individuals and entities designated under various UN sanctions regimes (e.g., ISIL (Da'esh) & Al-Qaida, Taliban, DPRK, Iran, Libya, Somalia, Sudan, Yemen, DRC, Central African Republic, South Sudan).
  • The FIU of Sri Lanka issues circulars and maintains a public section on its website regarding these lists.
  • FIU of Sri Lanka (Circulars & Notifications): https://www.fiusrilanka.gov.lk/circulars.php (Check for specific regulations or gazettes implementing UN sanctions lists).

Important Note on Sri Lanka's Stance on Crypto:

The Central Bank of Sri Lanka has consistently issued warnings regarding virtual currencies:

• Press Release (2021): The CBSL reiterated that "Virtual Currencies are not regulated in Sri Lanka, and therefore there is no regulatory oversight or safeguards relating to the usage, holding or trading of VCs in Sri Lanka." It advises against dealing in them, citing high risks for users.
  • Central Bank of Sri Lanka Press Release (22 November 2021): "Public is warned against the use of Virtual Currencies" https://www.cbsl.gov.lk/en/news/public-is-warned-against-the-use-of-virtual-currencies
• Earlier Press Release (2018): "Further, the public is informed that any person or entity using/operating/trading VCs in Sri Lanka would be doing so at their own risk."
  • Central Bank of Sri Lanka Press Release (29 January 2018): "Public Warning regarding the Use of Virtual Currencies" https://www.cbsl.gov.lk/en/news/public-warning-regarding-the-use-of-virtual-currencies

This implies that while specific crypto regulations are absent, the general legal framework for financial crime, including money laundering, terrorist financing, and UN sanctions compliance, would still apply to any activity involving virtual assets in Sri Lanka. Entities engaging with crypto are effectively operating in a high-risk, unregulated environment but are still liable under broader national and international legal obligations.

Legal References with URLs:

• Prevention of Money Laundering Act, No. 5 of 2006: https://www.fiusrilanka.gov.lk/docs/Laws-and-Regulations/PMLA%20No%205%20of%202006.pdf
• Financial Transactions Reporting Act, No. 6 of 2006: https://www.fiusrilanka.gov.lk/docs/Laws-and-Regulations/FTRA%20No%206%20of%202006.pdf
• United Nations Act, No. 45 of 1968: (Not readily available as a direct public URL from official Sri Lankan government sites, but is the enabling legislation for UN resolutions. It can typically be found in legal databases or requested from the Ministry of Justice.)
• United Nations (Financial and Other Measures) Regulations No. 1 of 2012 (under UN Act): (This gazette implements UNSCR 1373, an example of how the UN Act is used. Check the National Gazettes for precise link.)
• FIU Sri Lanka - Laws and Regulations: https://www.fiusrilanka.gov.lk/laws.php
• FIU Sri Lanka - Circulars & Notifications (for UN Sanctions Lists): https://www.fiusrilanka.gov.lk/circulars.php
• Central Bank of Sri Lanka - Public Warning on Virtual Currencies (2021): https://www.cbsl.gov.lk/en/news/public-is-warned-against-the-use-of-virtual-currencies
• UN Consolidated Sanctions List: https://www.un.org/sc/suborg/en/sanctions/un-sc-consolidated-list
• OFAC Specially Designated Nationals (SDN) List: https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists
• EU Consolidated Sanctions List: https://www.sanctionsmap.eu/