Self-custodial wallet / non-custodial software in Sri Lanka
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in Sri Lanka without local incorporation, subject to AML obligations and low licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- Low
- Last updated
- 2026-07-13
AML Obligations
- No specific AML/KYC regulations tailored for VASPs exist under a licensing framework in Sri Lanka (lk.aml.amlkyc-requirements-specific-to-vasps).
- General AML/CFT obligations under the Financial Transactions Reporting Act No. 6 of 2006 (FTRA) apply — suspicious transaction reporting (STR), CDD, and record-keeping — but only if the entity qualifies as a 'reporting institution' (lk.licensing.the-financial-transactions-reporting-act, lk.aml.reference-financial-transactions-reporting-act).
- As a non-custodial software publisher that never holds funds, the operator is unlikely to be classified as a reporting institution under FTRA, so direct AML obligations are unlikely to attach.
- If the CBSL/FIU were to classify the wallet software as facilitating VA services, general FTRA obligations could apply in theory, but no enforcement precedent targets non-custodial software publishers (lk.enforcement.entity-targeted-the-general-public, lk.enforcement.significance-this-was-a-strong).
Key Restrictions
- CBSL has issued multiple public warnings stating that virtual currencies and VASPs are not licensed or regulated — engaging with or facilitating crypto transactions is declared high-risk and potentially in violation of foreign exchange regulations (lk.enforcement.date-2021-07-28-issued-a-press, lk.enforcement.date-2022-04-12-issued-a-press).
- Foreign exchange laws may be violated if the software facilitates outward remittances for crypto purchases (lk.enforcement.outcome-reiteration-of-the-prohibitive).
- No specific VASP licensing framework exists yet — the CBSL is expected to develop one but has not done so (lk.licensing.central-bank-of-sri-lanka).
- Publishing self-custodial wallet software to Sri Lankan residents carries legal uncertainty because the CBSL has publicly discouraged any crypto-related activity.
Key Risks
- Regulatory ambiguity: The CBSL has taken a prohibitive public stance against crypto, but has not specifically addressed non-custodial wallet software — risk of broad enforcement if the FIU reinterprets 'facilitation' broadly.
- Enforcement precedent: CBSL's 2021 and 2022 press releases warned the public and financial institutions against engaging with crypto — a software publisher could be targeted if deemed to be 'facilitating' virtual asset transactions (lk.enforcement.entity-targeted-the-general-public).
- Foreign exchange law exposure: If the wallet software enables crypto purchases funded via cross-border payments, it may violate Sri Lanka's foreign exchange regulations (lk.enforcement.outcome-reiteration-of-the-prohibitive).
- No safe harbor: No licensing framework provides a compliance pathway, leaving the operator exposed to regulatory discretion and potential public censure.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
The Prevention of Money Laundering Act, No. 5 of 2006 (PMLA): This Act criminalizes money laundering and establishes the legal framework for its prevention.
The Financial Transactions Reporting Act, No. 6 of 2006 (FTRA): This Act mandates reporting institutions (which would include regulated VASPs) to report suspicious transactions and sets out customer due diligence (CDD) and record-keeping requirements. It also established the Financial Intelligence Unit (FIU).
Central Bank of Sri Lanka (CBSL):
Financial Intelligence Unit (FIU) of Sri Lanka:
AML/KYC Requirements (Specific to VASPs): No specific AML/KYC regulations are tailored for VASPs under a licensing framework. However, any entity operating in Sri Lanka would still be subject to general anti-money laundering and combating the financing of terrorism (AML/CFT) laws, such as the Financial Transactions Reporting Act No. 6 of 2006 (FTRA), if their activities fall within the scope of "financial institutions" or "designated non-financial businesses and professions (DNFBPs)" and trigger reporting obligations for suspicious transactions. The applicability to purely virtual asset businesses without fiat gateways is a grey area in the absence of explicit VASP definitions in the FTRA.
Reference: Financial Transactions Reporting Act No. 6 of 2006 (Note: This is a general AML/CFT law, not specific to VA licensing).
Local Presence: While no specific VASP license mandates local presence, any company wishing to operate legally in Sri Lanka, regardless of its business type, would need to comply with the Companies Act No. 07 of 2007, which typically involves local incorporation or registration as an overseas company branch.
Entity Targeted: The general public and financial institutions in Sri Lanka, as well as any individuals or entities considering or engaging in virtual asset services. Violation Type: Operating outside the regulated financial framework; promoting/engaging in high-risk, unregulated investments; dealing in non-legal tender. Penalty Amount: No specific monetary penalty associated with this advisory itself. The "penalty" is the declaration of illegality/unregulated status and the implied risk of legal action under existing financial or criminal laws if related to fraud or money laundering.
Date: 2021-07-28 (Issued a press release)
Date: 2022-04-12 (Issued a press release)
Outcome: Reiteration of the prohibitive stance. Further clarification that facilitating or promoting cryptocurrencies is a violation of current foreign exchange regulations (especially related to outward remittances for crypto purchases) and payment laws.
Significance: This was a strong and clear warning, setting the tone for the country's approach to virtual assets. It emphasized that crypto falls outside the existing regulatory perimeter, making any related activities high-risk and potentially illegal under broader financial laws.
Significance: This further solidified the CBSL's position, clarifying that not only are cryptocurrencies unregulated, but engaging in transactions involving foreign exchange for crypto can violate the country's stringent foreign exchange laws. This acts as a stronger deterrent for financial institutions.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- low
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — publishing self-custodial wallet software (non-custodial) to Sri Lanka may be operationally possible because the publisher never holds user funds and is unlikely to trigger VASP/reporting-institution classification under current law, but CBSL's prohibitive public stance against crypto creates material legal uncertainty, foreign-exchange-law exposure, and enforcement risk in the absence of any developed licensing framework.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?