Lead Signal
Sri Lanka enters the World Payments Monitor's coverage this cycle with its first full baseline, and the standout finding is the 2023 formalisation of market-conduct supervision. The Central Bank of Sri Lanka's Financial Consumer Protection Regulations No. 01 of 2023 establish the country's first comprehensive market-conduct supervision regime, extending across all CBSL-regulated payment service providers rather than banks alone. The shift is structural rather than incremental: conduct oversight had previously sat as an adjunct to prudential supervision, whereas the 2023 Regulations create a standalone regime administered through the Financial Consumer Relations Department, with dedicated enforcement and referral powers reaching non-compliant conduct to competent authorities. That conduct build-out sits alongside a parallel expansion of the licensing perimeter: a dedicated regulation for money and value transfer service providers, Regulations No.01 of 2024 of 30 April 2024, brought MVTS providers under a CBSL licensing track separate from card and mobile-payment licensing, and payment-initiation and account-information PSPs are now required to hold professional indemnity insurance and to undertake AML/CFT risk assessments. Read together, these three instruments represent the most significant tightening of the non-bank payments perimeter since the Payment and Settlement Systems Act No. 28 of 2005 first vested the Central Bank of Sri Lanka as the sole authority able to license or operate a payment system in the country.
Other Developments
Beneath the conduct and licensing headline, the baseline surfaces a cluster of secondary developments. On card and scheme compliance, CBSL's Payments Bulletin for the third quarter of 2025 records 14 Licensed Commercial Banks and 4 Licensed Finance Companies as authorised card issuers and acquirers, while a separate Retail Payment Services and Card Schemes Regulation now brings card scheme operators themselves — not just issuers and acquirers — within CBSL's licensing perimeter, with a one-year transition window for incumbent schemes. Enforcement activity has been active: Nation Lanka Finance PLC had its licence cancelled effective 4 July 2025 under CBSL's resolution powers, following continuous Finance Business Act violations, and the Banking (Amendment) Act No. 24 of 2024 has meanwhile handed CBSL administrative fine powers that extend its enforcement toolkit beyond simple licence suspension or cancellation.
On digital assets, Sri Lanka continues to operate without a dedicated stablecoin or virtual-asset statute, leaving crypto in a legal grey zone in which holding is not banned but banks have been barred since 2021 from processing crypto-linked card payments. The Financial Intelligence Unit has launched a mandatory VASP survey and a registration roadmap ahead of the 2026 mutual evaluation, aiming at FATF-aligned AML/CFT requirements for virtual asset service providers. A separate claim that CBSL-linked payment service providers enabled stablecoin payments for the tourism sector in April 2026 could not be corroborated against CBSL's own circulars or news pages during review and has been downgraded to Possible confidence pending official confirmation; it should be treated as unverified.
Operational resilience rests on a Technology Risk and Resilience Framework that mandates round-the-clock security operations centres, annual penetration testing and cloud-risk notification for licensed finance companies. A claim that the CBSL Real-Time Gross Settlement system completed an ISO 20022 upgrade in 2024 rests on a single vendor source and was downgraded from Confirmed to Assessed on review, since CBSL's own 2026 Policy Agenda references a Payment System Roadmap for 2025-2027 without confirming a completed migration.
On corridors, worker remittances remain Sri Lanka's dominant non-debt-creating foreign-exchange inflow, historically covering approximately 80 percent of the trade deficit, with the Middle East corridor — home to roughly 660,000 migrant workers — accounting for around half of total inflows and correspondingly exposed to regional conflict risk. In industry structure, the banking sector (24 Licensed Commercial Banks, 6 Licensed Specialised Banks and roughly 34 Licensed Finance Companies) continues to dominate financial-sector assets, and the International Finance Corporation has announced a USD 166 million investment programme across three private commercial banks — Nations Trust Bank, Commercial Bank of Ceylon and National Development Bank — combining loans, risk-sharing facilities and trade-finance guarantees aimed at SME and payments-adjacent lending. On product development, GovPay launched in February 2025 as the first of a planned trio of unified government digital-payment platforms, building on the CEFTS instant-payment switch that has provided 24/7 interbank transfers since 2015. On consumer protection, Sri Lanka has no mandatory authorised-push-payment fraud reimbursement scheme comparable to the UK's Payment Systems Regulator model, relying instead on FCRD complaint handling, public-awareness warnings and CBSL circulars tightening customer identification.
Cross-Monitor Connections
Sri Lanka's third FATF/APG mutual evaluation, due in 2026 under a revised effectiveness-focused methodology with virtual-asset supervision a specific point of focus, is the connective thread across this baseline. The AML/CFT legal framework itself — resting on the Prevention of Money Laundering Act, the Financial Transactions Reporting Act and the Convention on the Suppression of Terrorist Financing Act — is carried in this brief via the Sentinel.gi feed as provenance only; the World Payments Monitor does not perform independent illicit-finance analysis of that framework. What is squarely within scope here is the payments-market consequence: the Financial Intelligence Unit itself has warned that continuity of correspondent banking access depends on Sri Lanka avoiding grey-listing at the 2026 evaluation, a dependency made sharper by the fact that Citibank is reported as the sole direct US correspondent bank serving the country, with all other domestic banks reliant on correspondent relationships abroad. A grey-list outcome would be expected to trigger counter-measures from partner jurisdictions with knock-on effects for credit ratings and insurance risk premia. This correspondent-banking exposure, together with the still-unresolved stablecoin/VASP legislative gap, has been flagged to the Financial Intelligence Monitor as carrying illicit-finance and sanctions-evasion significance beyond the World Payments Monitor's market-access and conduct remit.
Outlook
The next several review cycles should watch three things in particular: whether the FIU's VASP registration roadmap converts into an enacted FTRA amendment ahead of the 2026 mutual evaluation, since no confirmed parliamentary timeline currently exists; whether CBSL issues any primary-source confirmation, or retraction, of the April 2026 tourism-sector stablecoin claim; and how the mutual evaluation outcome itself feeds through to correspondent banking continuity and the broader tightening trajectory already visible across the 2023-2024 conduct and licensing build-out. Commercial and investment activity in the interim looks set to remain dominated by multilateral development finance rather than private M&A or venture capital, reflecting a comparatively thin private capital market relative to regional fintech peers.