DeFi protocol frontend in Sri Lanka

The Prevention of Money Laundering Act, No. 5 of 2006 (PMLA): This Act criminalizes money laundering and establishes the legal framework for its prevention.

The Financial Transactions Reporting Act, No. 6 of 2006 (FTRA): This Act mandates reporting institutions (which would include regulated VASPs) to report suspicious transactions and sets out customer due diligence (CDD) and record-keeping requirements. It also established the Financial Intelligence Unit (FIU).

The Convention on the Suppression of Terrorist Financing Act, No. 25 of 2005 (CSTFA): This Act criminalizes terrorist financing and implements the international convention.

Financial Intelligence Unit (FIU) of Sri Lanka:

Central Bank of Sri Lanka (CBSL):

Identification and Verification of Customers:

Beneficial Ownership: Identify and take reasonable measures to verify the identity of the beneficial owner(s) of the customer, including for legal persons, identifying natural persons who ultimately own or control the customer.

Enhanced Due Diligence (EDD): Must be applied in higher-risk situations, such as:

Ongoing Due Diligence:

Reporting Threshold: Any transaction (regardless of amount) or attempted transaction where there are reasonable grounds to suspect that it may be linked to money laundering, terrorist financing, or other criminal activities.

"No Tipping-Off": VASPs and their employees are prohibited from disclosing to the customer or any third party that a STR or related information is being or has been submitted to the FIU.

AML/KYC Requirements (Specific to VASPs): No specific AML/KYC regulations are tailored for VASPs under a licensing framework. However, any entity operating in Sri Lanka would still be subject to general anti-money laundering and combating the financing of terrorism (AML/CFT) laws, such as the Financial Transactions Reporting Act No. 6 of 2006 (FTRA), if their activities fall within the scope of "financial institutions" or "designated non-financial businesses and professions (DNFBPs)" and trigger reporting obligations for suspicious transactions. The applicability to purely virtual asset businesses without fiat gateways is a grey area in the absence of explicit VASP definitions in the FTRA.

Reference: Financial Transactions Reporting Act No. 6 of 2006 (Note: This is a general AML/CFT law, not specific to VA licensing).

Regulator Name: Central Bank of Sri Lanka (CBSL), Financial Intelligence Unit (FIU)

Date: 2021-07-28 (Issued a press release)

Outcome: Heightened public awareness of the CBSL's prohibitive stance. Discouragement of engagement with cryptocurrencies and virtual asset service providers (VASPs). Reiterated that VASPs are not licensed or regulated by CBSL.

Significance: This was a strong and clear warning, setting the tone for the country's approach to virtual assets. It emphasized that crypto falls outside the existing regulatory perimeter, making any related activities high-risk and potentially illegal under broader financial laws.

Date: 2022-04-12 (Issued a press release)

Outcome: Reiteration of the prohibitive stance. Further clarification that facilitating or promoting cryptocurrencies is a violation of current foreign exchange regulations (especially related to outward remittances for crypto purchases) and payment laws.

Significance: This further solidified the CBSL's position, clarifying that not only are cryptocurrencies unregulated, but engaging in transactions involving foreign exchange for crypto can violate the country's stringent foreign exchange laws. This acts as a stronger deterrent for financial institutions.