Custodial wallet / SaaS in Sri Lanka

The Prevention of Money Laundering Act, No. 5 of 2006 (PMLA): This Act criminalizes money laundering and establishes the legal framework for its prevention.

The Financial Transactions Reporting Act, No. 6 of 2006 (FTRA): This Act mandates reporting institutions (which would include regulated VASPs) to report suspicious transactions and sets out customer due diligence (CDD) and record-keeping requirements. It also established the Financial Intelligence Unit (FIU).

Financial Intelligence Unit (FIU) of Sri Lanka:

Central Bank of Sri Lanka (CBSL):

Identification and Verification of Customers:

Beneficial Ownership: Identify and take reasonable measures to verify the identity of the beneficial owner(s) of the customer, including for legal persons, identifying natural persons who ultimately own or control the customer.

Purpose and Intended Nature of the Business Relationship: Understand the nature of the customer's activities and the purpose for which they intend to use the VASP's services.

Simplified Due Diligence (SDD): May be applied where the risk of money laundering or terrorist financing is lower (e.g., small, low-value transactions), but the VASP must still be able to identify the customer and monitor transactions.

Enhanced Due Diligence (EDD): Must be applied in higher-risk situations, such as:

Customers from high-risk jurisdictions.

Politically Exposed Persons (PEPs) and their family members/close associates.

Complex, unusually large transactions, or unusual patterns of transactions.

Transactions involving new products or business practices, and new technologies.

Ongoing Due Diligence:

Reporting Threshold: Any transaction (regardless of amount) or attempted transaction where there are reasonable grounds to suspect that it may be linked to money laundering, terrorist financing, or other criminal activities.

"No Tipping-Off": VASPs and their employees are prohibited from disclosing to the customer or any third party that a STR or related information is being or has been submitted to the FIU.

Capital Requirements: No specific capital thresholds for VASP operations.

AML/KYC Requirements (Specific to VASPs): No specific AML/KYC regulations are tailored for VASPs under a licensing framework. However, any entity operating in Sri Lanka would still be subject to general anti-money laundering and combating the financing of terrorism (AML/CFT) laws, such as the Financial Transactions Reporting Act No. 6 of 2006 (FTRA), if their activities fall within the scope of "financial institutions" or "designated non-financial businesses and professions (DNFBPs)" and trigger reporting obligations for suspicious transactions. The applicability to purely virtual asset businesses without fiat gateways is a grey area in the absence of explicit VASP definitions in the FTRA.

Reference: Financial Transactions Reporting Act No. 6 of 2006 (Note: This is a general AML/CFT law, not specific to VA licensing).

Local Presence: While no specific VASP license mandates local presence, any company wishing to operate legally in Sri Lanka, regardless of its business type, would need to comply with the Companies Act No. 07 of 2007, which typically involves local incorporation or registration as an overseas company branch.

Regulator Name: Central Bank of Sri Lanka (CBSL), Financial Intelligence Unit (FIU)

Entity Targeted: The general public and financial institutions in Sri Lanka, as well as any individuals or entities considering or engaging in virtual asset services. Violation Type: Operating outside the regulated financial framework; promoting/engaging in high-risk, unregulated investments; dealing in non-legal tender. Penalty Amount: No specific monetary penalty associated with this advisory itself. The "penalty" is the declaration of illegality/unregulated status and the implied risk of legal action under existing financial or criminal laws if related to fraud or money laundering.

Date: 2021-07-28 (Issued a press release)

Outcome: Heightened public awareness of the CBSL's prohibitive stance. Discouragement of engagement with cryptocurrencies and virtual asset service providers (VASPs). Reiterated that VASPs are not licensed or regulated by CBSL.

Significance: This was a strong and clear warning, setting the tone for the country's approach to virtual assets. It emphasized that crypto falls outside the existing regulatory perimeter, making any related activities high-risk and potentially illegal under broader financial laws.

Central Bank of Sri Lanka Press Release: https://www.cbsl.gov.lk/en/news/fiu-statement-on-the-use-of-virtual-currencies

Violation Type: Continuing to engage with or facilitate virtual asset transactions, despite previous warnings, and engaging in activities outside the regulatory framework. Penalty Amount: No specific monetary penalty. The "penalty" remains the official declaration of their unregulated status and the potential application of broader financial or criminal laws for illicit activities.

Date: 2022-04-12 (Issued a press release)

Outcome: Reiteration of the prohibitive stance. Further clarification that facilitating or promoting cryptocurrencies is a violation of current foreign exchange regulations (especially related to outward remittances for crypto purchases) and payment laws.

Significance: This further solidified the CBSL's position, clarifying that not only are cryptocurrencies unregulated, but engaging in transactions involving foreign exchange for crypto can violate the country's stringent foreign exchange laws. This acts as a stronger deterrent for financial institutions.