On-shore VASP in Sri Lanka
Locally-incorporated VASP that operates under full local jurisdiction, holding all required licenses and registrations.
On-shore VASP is not permitted in Sri Lanka.
Verdict Details
- Permitted
- no
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- FIU Directive No. 01 of 2023 imposes comprehensive AML/CFT obligations on VASPs including CDD, record-keeping (min. 5 years), suspicious transaction reporting (STR) to the FIU for any transaction with reasonable suspicion of ML/TF (no minimum threshold), and 'no tipping-off' prohibitions (FTRA No. 6 of 2006 and Directive).
- Travel Rule: For domestic transfers ≥ LKR 150,000, collect and transmit originator info (name, wallet address/NIC/passport, asset type & amount) and beneficiary info (name, wallet address, asset type & amount). For cross-border transfers, same obligation applies with no de minimis threshold.
- Unhosted wallet transfers: VASPs must conduct due diligence and risk assessments regardless of amount, collecting relevant info to the extent possible, especially for higher-risk transactions.
- Customer Due Diligence: Obtain and verify full name, permanent address, date of birth, nationality, unique ID (NIC/passport). For legal persons: legal name, form, proof of existence, senior management identities. Beneficial ownership identification required.
- Enhanced Due Diligence required for: PEPs and associates, high-risk jurisdictions, complex/unusually large transactions, new products/technologies, transactions where beneficial owner is hard to ascertain, and VASP-specific: source of funds/wealth in crypto assets.
- Ongoing monitoring of business relationships and transactions required; customer data must be kept up-to-date.
- FIU is the supervisory authority for AML/CFT compliance enforcement.
Key Restrictions
- CBSL has declared that virtual currencies are not legal tender and has prohibited regulated financial institutions from facilitating transactions involving VCs — this makes on-shore fiat on/off ramping through the formal banking system effectively impossible.
- CBSL has explicitly stated that no entity or company is authorized or licensed to operate, offer, or sell VCs, or provide VC-related services (exchanges, brokers, miners) in Sri Lanka.
- Engaging in transactions involving foreign exchange for crypto purchases may violate Sri Lanka's stringent foreign exchange laws (as clarified in the 2022 CBSL press release).
- There is no existing VASP licensing framework — the CBSL has discussed developing one but it has not been enacted.
- While the FIU Directive No. 01 of 2023 imposes AML/CFT obligations on VASPs, the underlying prohibition from CBSL creates a fundamental conflict that makes compliant operation impossible as a practical matter.
Key Risks
- Enforcement exposure: CBSL has issued multiple public warnings (2021, 2022) explicitly stating that VASP operations are unregulated, high-risk, and potentially illegal — operating in this environment carries direct enforcement risk including potential violation of foreign exchange regulations.
- Tax ambiguity: No tax framework exists for virtual assets; no capital gains tax treatment, no VAT treatment, and no reporting guidance from the Inland Revenue Department. Converting crypto profits to fiat could trigger AML/CFT reporting by banks, creating indirect exposure.
- No licensing path: Despite the FIU Directive imposing AML obligations, there is no licensing regime under which an on-shore VASP could obtain legal authorization to operate, creating a catch-22.
- Banking access: CBSL prohibits regulated financial institutions from facilitating VC transactions, meaning a locally-incorporated VASP would likely be unable to open or maintain bank accounts for operational purposes.
- Reputational and PR risk: Public disclosures of non-compliance by the FIU/CBSL could severely damage the operator's standing.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
The Prevention of Money Laundering Act, No. 5 of 2006 (PMLA): This Act criminalizes money laundering and establishes the legal framework for its prevention.
The Financial Transactions Reporting Act, No. 6 of 2006 (FTRA): This Act mandates reporting institutions (which would include regulated VASPs) to report suspicious transactions and sets out customer due diligence (CDD) and record-keeping requirements. It also established the Financial Intelligence Unit (FIU).
Financial Intelligence Unit (FIU) of Sri Lanka:
Central Bank of Sri Lanka (CBSL):
Identification and Verification of Customers:
Legal Persons/Arrangements: Obtain and verify the legal name, legal form, proof of existence, powers that regulate and bind the legal person/arrangement, and the names of relevant persons holding senior management positions.
Beneficial Ownership: Identify and take reasonable measures to verify the identity of the beneficial owner(s) of the customer, including for legal persons, identifying natural persons who ultimately own or control the customer.
Purpose and Intended Nature of the Business Relationship: Understand the nature of the customer's activities and the purpose for which they intend to use the VASP's services.
Simplified Due Diligence (SDD): May be applied where the risk of money laundering or terrorist financing is lower (e.g., small, low-value transactions), but the VASP must still be able to identify the customer and monitor transactions.
Enhanced Due Diligence (EDD): Must be applied in higher-risk situations, such as:
Politically Exposed Persons (PEPs) and their family members/close associates.
Reporting Threshold: Any transaction (regardless of amount) or attempted transaction where there are reasonable grounds to suspect that it may be linked to money laundering, terrorist financing, or other criminal activities.
"No Tipping-Off": VASPs and their employees are prohibited from disclosing to the customer or any third party that a STR or related information is being or has been submitted to the FIU.
Capital Requirements: No specific capital thresholds for VASP operations.
AML/KYC Requirements (Specific to VASPs): No specific AML/KYC regulations are tailored for VASPs under a licensing framework. However, any entity operating in Sri Lanka would still be subject to general anti-money laundering and combating the financing of terrorism (AML/CFT) laws, such as the Financial Transactions Reporting Act No. 6 of 2006 (FTRA), if their activities fall within the scope of "financial institutions" or "designated non-financial businesses and professions (DNFBPs)" and trigger reporting obligations for suspicious transactions. The applicability to purely virtual asset businesses without fiat gateways is a grey area in the absence of explicit VASP definitions in the FTRA.
FIU Directive No. 01 of 2023 on AML/CFT Obligations for Virtual Asset Service Providers (VASPs):
For domestic transfers between VASPs: Information must be collected and transmitted for transactions equal to or exceeding LKR 150,000 (approximately USD 470-500, depending on the current exchange rate).
For cross-border transfers between VASPs: Information must be collected and transmitted for all transactions, with no de minimis threshold.
For transfers to/from unhosted wallets (private wallets): VASPs must also conduct due diligence and risk assessments, regardless of the amount, and collect relevant information to the extent possible, especially for higher-risk transactions.
Originator Information: Name, Virtual Asset Account Number (or wallet address), physical address (or national identity number/passport number/customer identification number), and the specific virtual asset (e.g., Bitcoin, Ethereum) and amount.
Beneficiary Information: Name, Virtual Asset Account Number (or wallet address), and the specific virtual asset and amount.
Transmit this information to the beneficiary VASP (or to the originator VASP in the case of an incoming transaction) immediately and securely with the transaction.
Implement robust record-keeping systems to store transaction data and originator/beneficiary information for at least five years.
Not Legal Tender: Virtual currencies (VCs) are not recognized as legal tender in Sri Lanka.
Illegal for Payments: The CBSL has prohibited regulated financial institutions from facilitating transactions involving VCs. This means VCs cannot be used for payments within Sri Lanka and engaging in such transactions carries significant risks.
No Licensing: No entity or company is authorized or licensed to operate, offer, or sell VCs, or provide services related to VCs (e.g., exchanges, brokers, miners) in Sri Lanka.
CBSL Press Release - Warnings on Virtual Currencies (August 10, 2021): https://www.cbsl.gov.lk/en/node/3313
CBSL Press Release - Public Warning on the Use of Virtual Currencies (July 11, 2022): https://www.cbsl.gov.lk/en/node/3592
No Specific Framework: Sri Lanka's Inland Revenue Act No. 24 of 2017 outlines capital gains tax (CGT) primarily for the realization of "investment assets," which are defined to include land, buildings, and specified shares/securities.
Regulator Name: Central Bank of Sri Lanka (CBSL), Financial Intelligence Unit (FIU)
Date: 2021-07-28 (Issued a press release)
Date: 2022-04-12 (Issued a press release)
Outcome: Heightened public awareness of the CBSL's prohibitive stance. Discouragement of engagement with cryptocurrencies and virtual asset service providers (VASPs). Reiterated that VASPs are not licensed or regulated by CBSL.
Outcome: Reiteration of the prohibitive stance. Further clarification that facilitating or promoting cryptocurrencies is a violation of current foreign exchange regulations (especially related to outward remittances for crypto purchases) and payment laws.
Significance: This was a strong and clear warning, setting the tone for the country's approach to virtual assets. It emphasized that crypto falls outside the existing regulatory perimeter, making any related activities high-risk and potentially illegal under broader financial laws.
Significance: This further solidified the CBSL's position, clarifying that not only are cryptocurrencies unregulated, but engaging in transactions involving foreign exchange for crypto can violate the country's stringent foreign exchange laws. This acts as a stronger deterrent for financial institutions.
Violation Type: Continuing to engage with or facilitate virtual asset transactions, despite previous warnings, and engaging in activities outside the regulatory framework. Penalty Amount: No specific monetary penalty. The "penalty" remains the official declaration of their unregulated status and the potential application of broader financial or criminal laws for illicit activities.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Not permitted — the CBSL has explicitly stated that no entity is authorized to operate VASP services in Sri Lanka, and while the FIU Directive No. 01 of 2023 imposes AML/CFT obligations on VASPs, there is no licensing framework, regulated financial institutions are prohibited from facilitating VC transactions, and operating would carry direct legal and enforcement risk.
Questions this verdict aims to answer
- What license(s) are required to operate locally?
- What capital, governance, and reporting obligations apply?
- What is the application process and timeline?