Crypto-funded debit card in Sri Lanka

Not Legal Tender: Virtual currencies (VCs) are not recognized as legal tender in Sri Lanka.

Unregulated: VCs are not regulated by the CBSL and operate without any regulatory oversight or safeguards.

Illegal for Payments: The CBSL has prohibited regulated financial institutions from facilitating transactions involving VCs. This means VCs cannot be used for payments within Sri Lanka and engaging in such transactions carries significant risks.

No Licensing: No entity or company is authorized or licensed to operate, offer, or sell VCs, or provide services related to VCs (e.g., exchanges, brokers, miners) in Sri Lanka.

Not Classified as E-money/Payment Tokens: The CBSL has explicitly stated that virtual currencies (VCs), which include stablecoins, are not considered "e-money" under the Payment and Settlement Systems Act, No. 28 of 2005. Therefore, entities involved in stablecoin activities are not authorized or licensed by the CBSL to operate as payment service providers.

De Facto Classification: Unregulated/High-Risk Assets: In practice, stablecoins are viewed by Sri Lankan regulators as unregulated digital assets that pose high risks to users and the financial system.

Content: Explicitly states VCs (including stablecoins) are not legal tender in Sri Lanka, are unregulated, and warns against associated risks (volatility, financial losses, illicit activities, cyberattacks). Advises the public not to use or invest in VCs.

AML/KYC Requirements (Specific to VASPs): No specific AML/KYC regulations are tailored for VASPs under a licensing framework. However, any entity operating in Sri Lanka would still be subject to general anti-money laundering and combating the financing of terrorism (AML/CFT) laws, such as the Financial Transactions Reporting Act No. 6 of 2006 (FTRA), if their activities fall within the scope of "financial institutions" or "designated non-financial businesses and professions (DNFBPs)" and trigger reporting obligations for suspicious transactions. The applicability to purely virtual asset businesses without fiat gateways is a grey area in the absence of explicit VASP definitions in the FTRA.

Reference: Financial Transactions Reporting Act No. 6 of 2006 (Note: This is a general AML/CFT law, not specific to VA licensing).

The Financial Transactions Reporting Act, No. 6 of 2006 (FTRA): This Act mandates reporting institutions (which would include regulated VASPs) to report suspicious transactions and sets out customer due diligence (CDD) and record-keeping requirements. It also established the Financial Intelligence Unit (FIU).

Identification and Verification of Customers:

Beneficial Ownership: Identify and take reasonable measures to verify the identity of the beneficial owner(s) of the customer, including for legal persons, identifying natural persons who ultimately own or control the customer.

Enhanced Due Diligence (EDD): Must be applied in higher-risk situations, such as:

Reporting Threshold: Any transaction (regardless of amount) or attempted transaction where there are reasonable grounds to suspect that it may be linked to money laundering, terrorist financing, or other criminal activities.

"No Tipping-Off": VASPs and their employees are prohibited from disclosing to the customer or any third party that a STR or related information is being or has been submitted to the FIU.

Entity Targeted: The general public and financial institutions in Sri Lanka, as well as any individuals or entities considering or engaging in virtual asset services. Violation Type: Operating outside the regulated financial framework; promoting/engaging in high-risk, unregulated investments; dealing in non-legal tender. Penalty Amount: No specific monetary penalty associated with this advisory itself. The "penalty" is the declaration of illegality/unregulated status and the implied risk of legal action under existing financial or criminal laws if related to fraud or money laundering.

Violation Type: Continuing to engage with or facilitate virtual asset transactions, despite previous warnings, and engaging in activities outside the regulatory framework. Penalty Amount: No specific monetary penalty. The "penalty" remains the official declaration of their unregulated status and the potential application of broader financial or criminal laws for illicit activities.

Significance: This further solidified the CBSL's position, clarifying that not only are cryptocurrencies unregulated, but engaging in transactions involving foreign exchange for crypto can violate the country's stringent foreign exchange laws. This acts as a stronger deterrent for financial institutions.