Centralized exchange in Sri Lanka

The Prevention of Money Laundering Act, No. 5 of 2006 (PMLA): This Act criminalizes money laundering and establishes the legal framework for its prevention.

The Financial Transactions Reporting Act, No. 6 of 2006 (FTRA): This Act mandates reporting institutions (which would include regulated VASPs) to report suspicious transactions and sets out customer due diligence (CDD) and record-keeping requirements. It also established the Financial Intelligence Unit (FIU).

Financial Intelligence Unit (FIU) of Sri Lanka:

Central Bank of Sri Lanka (CBSL):

Identification and Verification of Customers:

Beneficial Ownership: Identify and take reasonable measures to verify the identity of the beneficial owner(s) of the customer, including for legal persons, identifying natural persons who ultimately own or control the customer.

Enhanced Due Diligence (EDD): Must be applied in higher-risk situations, such as:

Reporting Threshold: Any transaction (regardless of amount) or attempted transaction where there are reasonable grounds to suspect that it may be linked to money laundering, terrorist financing, or other criminal activities.

"No Tipping-Off": VASPs and their employees are prohibited from disclosing to the customer or any third party that a STR or related information is being or has been submitted to the FIU.

Capital Requirements: No specific capital thresholds for VASP operations.

AML/KYC Requirements (Specific to VASPs): No specific AML/KYC regulations are tailored for VASPs under a licensing framework. However, any entity operating in Sri Lanka would still be subject to general anti-money laundering and combating the financing of terrorism (AML/CFT) laws, such as the Financial Transactions Reporting Act No. 6 of 2006 (FTRA), if their activities fall within the scope of "financial institutions" or "designated non-financial businesses and professions (DNFBPs)" and trigger reporting obligations for suspicious transactions. The applicability to purely virtual asset businesses without fiat gateways is a grey area in the absence of explicit VASP definitions in the FTRA.

Local Presence: While no specific VASP license mandates local presence, any company wishing to operate legally in Sri Lanka, regardless of its business type, would need to comply with the Companies Act No. 07 of 2007, which typically involves local incorporation or registration as an overseas company branch.

For domestic transfers between VASPs: Information must be collected and transmitted for transactions equal to or exceeding LKR 150,000 (approximately USD 470-500, depending on the current exchange rate).

For cross-border transfers between VASPs: Information must be collected and transmitted for all transactions, with no de minimis threshold.

For transfers to/from unhosted wallets (private wallets): VASPs must also conduct due diligence and risk assessments, regardless of the amount, and collect relevant information to the extent possible, especially for higher-risk transactions.

Originator Information: Name, Virtual Asset Account Number (or wallet address), physical address (or national identity number/passport number/customer identification number), and the specific virtual asset (e.g., Bitcoin, Ethereum) and amount.

Beneficiary Information: Name, Virtual Asset Account Number (or wallet address), and the specific virtual asset and amount.

Transmit this information to the beneficiary VASP (or to the originator VASP in the case of an incoming transaction) immediately and securely with the transaction.

Implement robust record-keeping systems to store transaction data and originator/beneficiary information for at least five years.

Monitor transactions for suspicious activity and report such activities to the FIU.

Fines: Significant monetary penalties for institutions and individuals.

Imprisonment: For individuals found guilty of serious offenses.

Suspension or Revocation of Licenses/Registrations: The FIU or other regulatory bodies may suspend or revoke the operating license or registration of a non-compliant VASP.

Reputational Damage: Public disclosure of non-compliance can severely damage a VASP's reputation.

FIU Directive No. 01 of 2023 on AML/CFT Obligations for Virtual Asset Service Providers (VASPs):

Regulator Name: Central Bank of Sri Lanka (CBSL), Financial Intelligence Unit (FIU)

Entity Targeted: The general public and financial institutions in Sri Lanka, as well as any individuals or entities considering or engaging in virtual asset services. Violation Type: Operating outside the regulated financial framework; promoting/engaging in high-risk, unregulated investments; dealing in non-legal tender. Penalty Amount: No specific monetary penalty associated with this advisory itself. The "penalty" is the declaration of illegality/unregulated status and the implied risk of legal action under existing financial or criminal laws if related to fraud or money laundering.

Date: 2021-07-28 (Issued a press release)

Outcome: Heightened public awareness of the CBSL's prohibitive stance. Discouragement of engagement with cryptocurrencies and virtual asset service providers (VASPs). Reiterated that VASPs are not licensed or regulated by CBSL.

Significance: This was a strong and clear warning, setting the tone for the country's approach to virtual assets. It emphasized that crypto falls outside the existing regulatory perimeter, making any related activities high-risk and potentially illegal under broader financial laws.

Date: 2022-04-12 (Issued a press release)

Outcome: Reiteration of the prohibitive stance. Further clarification that facilitating or promoting cryptocurrencies is a violation of current foreign exchange regulations (especially related to outward remittances for crypto purchases) and payment laws.

Significance: This further solidified the CBSL's position, clarifying that not only are cryptocurrencies unregulated, but engaging in transactions involving foreign exchange for crypto can violate the country's stringent foreign exchange laws. This acts as a stronger deterrent for financial institutions.