Sri Lanka: technology regulation at a glance

Framework: No dedicated crypto legislation in force; framework under development by the AML/CFT National Coordinating Committee Sub-Committee on VASPs, the Financial Intelligence Unit (FIU Sri Lanka), and the Ministry of Digital Economy, driven by FATF Recommendation 15 compliance obligations ahead of the 2026 mutual evaluation

Sri Lanka operates in a regulatory grey zone for crypto and digital assets: holdings are not banned but no formal licensing, consumer-protection, or asset-classification regime exists, and the Central Bank of Sri Lanka (CBSL) has issued repeated public-risk warnings while prohibiting banks from processing crypto card payments. Regulatory momentum accelerated sharply in early 2026 with the establishment of a VASP Sub-Committee (January 2026) and the presentation of a Concept Paper proposing mandatory VASP registration and AML/CFT obligations (February 2026), though no legislation has yet been gazetted. The upcoming 2026 FATF mutual evaluation, and risk of grey-listing, is the primary catalyst for reform.

Framework: National AI Strategy 2028 (Ministry of Digital Economy / CFSAI) + Personal Data Protection Act No. 9 of 2022 (Data Protection Authority of Sri Lanka)

Sri Lanka has no dedicated AI legislation. The country's primary AI governance instrument is the National AI Strategy 2024-2028, developed by a multi-stakeholder Committee on Formulating a Strategy for AI (CFSAI) under the Ministry of Digital Economy with UNDP support, and opened for public consultation until March 2025. Personal data processed by AI systems falls under the Personal Data Protection Act No. 9 of 2022, which established a Data Protection Authority in 2023, but no binding AI-specific regulatory framework exists.

Framework: Personal Data Protection Act, No. 9 of 2022 (as amended by Act No. 22 of 2025); supervised by the Data Protection Authority of Sri Lanka (dpa.gov.lk)

Sri Lanka enacted a comprehensive data protection law in March 2022, the first in South Asia, modelled broadly on GDPR principles. Implementation has been phased: the Data Protection Authority (DPA) was established in mid-2023 and institutional provisions are active, but the core substantive obligations on data controllers and processors (Parts I-III and VII) were delayed from March 2025 by gazette and are now subject to ministerial commencement order following the Personal Data Protection (Amendment) Act No. 22 of 2025, with full enforcement expected in 2026.

Framework: Payment and Settlement Systems Act No. 28 of 2005 (PSS Act); administered by the Central Bank of Sri Lanka (CBSL) Payments and Settlements Department

Sri Lanka operates a mature, CBSL-administered licensing regime for digital payments and fintech under the PSS Act No. 28 of 2005, which prohibits any entity from operating a payment or money-services system without CBSL authorisation. The regime covers payment cards, mobile payment systems, e-money operators, and money/value transfer service providers through distinct licensing categories. A live national instant-payment infrastructure (CEFTS/JustPay), a national QR standard (LANKAQR), and an active fintech regulatory sandbox further underpin the framework.

Framework: Department of Immigration and Emigration (Sri Lanka), Digital Nomad Visa Category, launched February 2026 under the Immigration and Emigration Act; Ministry of Digital Economy coordination; Golden Paradise Residence Visa for investors administered by the same department

Sri Lanka formally launched a dedicated Digital Nomad Visa in February 2026, after Cabinet approval in 2023, allowing foreign remote workers earning at least USD 2,000/month from overseas sources to reside legally for 12 months, renewable annually. The fully online application is administered by the Department of Immigration and Emigration. A separate Golden Paradise Residence Visa (investor route, USD 100,000-200,000 minimum deposit) has also been operative since October 2025.

Framework: Online Safety Act, No. 9 of 2024; Online Safety Commission (presidentially appointed); Personal Data Protection Act No. 9 of 2022 (complementary)

Sri Lanka enacted the Online Safety Act (OSA) on 24 January 2024, establishing a presidentially appointed Online Safety Commission with broad powers to define prohibited statements, order content removal, and hold platforms liable for user-generated content. The law is in force but widely criticised for vague definitions and potential misuse against free expression; as of early 2025 the NPP government committed to amending rather than repealing it, appointing a Supreme Court-chaired multi-sectoral committee to draft reforms. No dedicated age-verification or algorithmic-transparency regime exists, placing the framework below the comprehensiveness of EU DSA or UK OSA standards.

Framework: Computer Crimes Act No. 24 of 2007 (primary operative cybercrime law); Personal Data Protection Act No. 9 of 2022 (breach notification); Sri Lanka CERT / National Cyber Security Operations Center (NCSOC) for operational response; Cyber Security Bill (pending enactment as of mid-2026)

Sri Lanka lacks a comprehensive cybersecurity act, despite drafting six successive bills since 2019, a dedicated Cyber Security Act remained unenacted as of mid-2026, with the latest draft reportedly in final pre-presidential-approval stages. The operative framework is fragmented across the Computer Crimes Act 2007 (cybercrime offences), the Personal Data Protection Act 2022 (72-hour breach notification to the Data Protection Authority), and the Online Safety Act, backed operationally by Sri Lanka CERT and the National Cyber Security Operations Center. Passage of the pending Cyber Security Bill would establish a dedicated regulatory authority and formally designate Critical Information Infrastructure protections.

Framework: Companies Act No. 7 of 2007, administered by the Department of the Registrar of Companies (DRC); foreign investment governed by the Board of Investment of Sri Lanka Act No. 4 of 1978 (as amended), overseen by BOI Sri Lanka

Foreign investors may incorporate a private limited company in Sri Lanka online via the eROC system under the Companies Act No. 7 of 2007, with no statutory minimum share capital and a typical timeline of 7-14 working days. Full (100%) foreign ownership is permitted in most sectors, but sectors such as export-quota goods, primary processing of plantation crops, and coastal fishing require BOI approval or are capped at 40% foreign shareholding unless the investor meets a USD 250,000 minimum investment threshold under BOI Section 16. The overall regime is accessible but requires navigating BOI rules for restricted sectors, making it moderate rather than straightforwardly easy for foreign entrants.