Sri Lanka — Country Risk Report

Sri Lanka (Asia Pacific • South Asia). Risk report as of the 19 Jun 2026 FATF plenary.

High country risk, with AML/CFT effectiveness gaps. Sri Lanka's country risk score is 6.5/10, placing it in the high-risk band. The principal score driver is AML/CFT effectiveness, contributing 4.1 of 6.5 points. Separately, the treatment overlays show that Sri Lanka is not currently FATF grey- or black-listed, and that Sri Lanka is not subject to comprehensive country-wide sanctions and has no direct country-level programme identified. Firms should apply additional scrutiny where exposure involves state-linked entities, restricted sectors, sensitive technology, dual-use goods or politically exposed counterparties.

Recommended treatment

Enhanced due diligence where defined risk triggers are present, and documented justification for accepting the relationship.

At a glance

• FATF status: Not currently listed (one indicator only; it does not set the overall country risk rating by itself)
• No direct country-level sanctions programme identified; sanctions remain a legal treatment overlay and applicable lists must still be screened.
• Governance and institutions: 4.9/10
• Corruption (CPI 2025): 35/100, rank #107 of 182
• Enforcement data: not yet assessed (no RegActions coverage)

Country Risk Score: 6.5/10 (High)

Higher score means higher country risk (global average 5.5). Full information available. Composite score. Limited supporting evidence. Enforcement activity and CPI are context only; FATF listing and sanctions are regulatory overlays except the labelled FATF listing status used where no mutual evaluation exists.

All three underlying risk pillars are available. All three underlying risk pillars are available and weighted using the published formula. Weight sensitivity 6.3–6.7/10.

How this score was calculated

• AML/CFT effectiveness: 9.1/10 — 45% of this score
• Technical compliance: 3.5/10 — 20% of this score
• Governance and institutions: 4.9/10 — 35% of this score

Sanctions treatment: No direct programme identified. FATF treatment: none.

Principal risk drivers

• AML/CFT effectiveness: 9.1/10 × 45% = 4.1 points
• Governance and institutions: 4.9/10 × 35% = 1.7 points
• Technical compliance: 3.5/10 × 20% = 0.7 points

Mitigating factors

• Not currently on the FATF grey or black list.
• No comprehensive country-wide sanctions programme.
• Comparatively stronger political stability (4.0/10).
• Risk is concentrated in specific counterparties, sectors and transactions rather than applying uniformly.

Business impact

• Customer onboarding (Enhanced): Verify ultimate beneficial ownership and control from more than one source.
• Payments and transactions (Enhanced): Review transaction purpose, counterparties and the full payment routing.
• Trade and export activity (Enhanced): Screen goods, end users and potential dual-use exposure.
• Corporate clients (Enhanced): Assess state ownership, government links and political exposure.
• Ongoing monitoring (Enhanced): Alert on ownership changes, new designations and status changes.

Recommended controls

• Verify ultimate beneficial ownership using more than one reliable source.
• Identify state ownership, government influence and politically exposed persons.
• Screen entities, directors and beneficial owners against applicable sanctions lists.
• Apply enhanced review to technology, defence, telecommunications, financial services and dual-use activity.
• Document transaction purpose and source of funds where cross-border structures are complex.
• Escalate unresolved ownership opacity or adverse information to Compliance.

Enhanced due diligence triggers

• State ownership / control
• PEP involvement
• Sensitive / restricted sectors
• Opaque ownership
• Adverse media
• Dual-use goods & technology
• High-risk intermediary routing

FATF status: Not currently listed

Sri Lanka is not on the FATF grey or black list as of the 19 Jun 2026 plenary.

Source details

International sanctions by issuing body

• UN: No
• EU: No
• UK: No
• US: No

No means the complete UN, UK, EU and US review found no direct country-level programme. People or organisations may still appear on sanctions lists.

Government effectiveness and rule of law (World Bank 2024, percentile)

• Government Effectiveness: 46/100
• Regulatory Quality: 50/100
• Rule of Law: 53/100

Regulators and legal framework

FATF network

FATF network via APG.

• Asia/Pacific Group on Money Laundering

Last mutual evaluation: 2015 · report

National regulators

Regulator profiles not yet available on RegActions.

FIU: Egmont Group member (FIU Sri Lanka)

Framework signals

• FATF listing: Not currently listed
• International sanctions: no direct country programme identified (legal treatment overlay remains applicable)
• Corruption (CPI 2025): 35/100, rank #107 of 182
• Rule of law (WGI): 5.0/10 risk

Regulatory ecosystem and enforcement visibility

This evidence map is separate from Country Risk v3. It describes official mandates, publication access and RegActions coverage; it does not judge regulatory strength or add points to country risk.

Transparency Index: not scored · Evidence disposition: local-authority-evidence · Mapped official authorities: 4.

Evidence level: Level 3: Enforcement visible. The ladder uses the authority evidenceLevel schema directly and does not infer a level from a URL, site access or RegActions feed count.

1. 1. Identity confirmed — The authority and its mandate are evidenced by official directory provenance.
2. 2. Regulatory activity visible — A qualified authority-owned route has provisional dated activity in the first-page scan.
3. 3. Enforcement visible — A qualified authority-owned enforcement route has provisional dated activity in the first-page scan.
4. 4. Score eligible — Shown only when the authority evidence schema explicitly records score-eligible; no authority currently does.

Enforcement visibility: 2 authorities are classified enforcement-visible by the authority evidence schema, based on qualified authority-owned route evidence and provisional first-page month observations. This is not a validated engagement frequency.

Authorities and mandate evidence

• Central Bank of Sri Lanka — Level 1: Identity confirmed · Official site reachable

  Mandates: Central bank, Prudential supervision · Access status: Official site reachable · Research/publication snapshot checked: 2026-08-20

  Official authority site

  Provisional first-page scan signal

  Signal: unknown · Observed month count: 0 · Latest observed month: unknown.

  No qualified authority-owned dated route supports an activity signal. This is not evidence of inactivity; blocked, external-context, low-frequency and unvalidated sources remain unknown.

  Scan contract and precision

  automated-first-page-date-scan · 2024-01 to 2026-08 · as of 2026-08-20 · month precision · first-page-only-unvalidated. This is not a validated engagement frequency.

  Publication candidates and qualification

  • Unqualified publication candidate: Deposit Insurance and Resolution

    Research candidate only; it is not promoted to an official enforcement or regulatory-update route.

    Route type: enforcement_archive · Source scope: authority-owned · Qualification: manual-review-required · Provisional scan signal: no-dated-first-page-signal · Observed months: 0 · Latest observed month: unknown

  • Unqualified publication candidate: Notices

    Research candidate only; it is not promoted to an official enforcement or regulatory-update route.

    Route type: not classified · Source scope: not classified · Qualification: not classified · Provisional scan signal: not-observable · Observed months: 0 · Latest observed month: unknown

  • Unqualified publication candidate: Read more about Notice to General Public on Prohibited Pyramid Schemes

    Research candidate only; it is not promoted to an official enforcement or regulatory-update route.

    Route type: not classified · Source scope: not classified · Qualification: not classified · Provisional scan signal: not-observable · Observed months: 0 · Latest observed month: unknown

  • Unqualified publication candidate: Procurement for providing armed and unarmed security services for the Central Bank of Sri Lanka on outsourced basis

    Research candidate only; it is not promoted to an official enforcement or regulatory-update route.

    Route type: not classified · Source scope: not classified · Qualification: not classified · Provisional scan signal: not-observable · Observed months: 0 · Latest observed month: unknown

  • Unqualified publication candidate: Procurement of Minting and Supplying of Circulation Coins for the Central Bank of Sri Lanka (2026-2028)

    Research candidate only; it is not promoted to an official enforcement or regulatory-update route.

    Route type: not classified · Source scope: not classified · Qualification: not classified · Provisional scan signal: not-observable · Observed months: 0 · Latest observed month: unknown

  • Unqualified publication candidate: Procurement of CyberArk (IDIRA) ALERO (Remote Access) Licenses for CBSL

    Research candidate only; it is not promoted to an official enforcement or regulatory-update route.

    Route type: not classified · Source scope: not classified · Qualification: not classified · Provisional scan signal: not-observable · Observed months: 0 · Latest observed month: unknown

  • Unqualified publication candidate: Notice to the Insured Depositors of Nation Lanka Finance PLC

    Research candidate only; it is not promoted to an official enforcement or regulatory-update route.

    Route type: not classified · Source scope: not classified · Qualification: not classified · Provisional scan signal: not-observable · Observed months: 0 · Latest observed month: unknown

  • Unqualified publication candidate: Statements of Member Accounts Second Half of 2025

    Research candidate only; it is not promoted to an official enforcement or regulatory-update route.

    Route type: not classified · Source scope: not classified · Qualification: not classified · Provisional scan signal: not-observable · Observed months: 0 · Latest observed month: unknown

  • Unqualified publication candidate: Partitioning of 3rd Floor of the Central Point Building of Central Bank of Sri Lanka

    Research candidate only; it is not promoted to an official enforcement or regulatory-update route.

    Route type: not classified · Source scope: not classified · Qualification: not classified · Provisional scan signal: not-observable · Observed months: 0 · Latest observed month: unknown

  • Unqualified publication candidate: more

    Research candidate only; it is not promoted to an official enforcement or regulatory-update route.

    Route type: not classified · Source scope: not classified · Qualification: not classified · Provisional scan signal: not-observable · Observed months: 0 · Latest observed month: unknown

  • Unqualified publication candidate: Forms & Downloads

    Research candidate only; it is not promoted to an official enforcement or regulatory-update route.

    Route type: not classified · Source scope: not classified · Qualification: not classified · Provisional scan signal: not-observable · Observed months: 0 · Latest observed month: unknown

  • Unqualified publication candidate: Tender Notices

    Research candidate only; it is not promoted to an official enforcement or regulatory-update route.

    Route type: not classified · Source scope: not classified · Qualification: not classified · Provisional scan signal: not-observable · Observed months: 0 · Latest observed month: unknown

• Financial Intelligence Unit of Sri Lanka (Sri Lanka FIU) — Level 3: Enforcement visible · Official site reachable

  Mandates: Financial intelligence · Access status: Official site reachable · Research/publication snapshot checked: 2026-08-20

  Official authority site

  Provisional first-page scan signal

  Signal: low-frequency · Observed month count: 2 · Latest observed month: 2026-08.

  Provisional automated first-page date scan on an authority-owned qualified route. It is not a validated publication frequency or effectiveness measure.

  Scan contract and precision

  automated-first-page-date-scan · 2024-01 to 2026-08 · as of 2026-08-20 · month precision · first-page-only-unvalidated. This is not a validated engagement frequency.

  Publication candidates and qualification

  • Official authority-owned enforcement route: Sanctions on TF

    Authority-owned and approved for the human-reviewed route contract.

    Route type: sanctions_or_penalty_list · Source scope: authority-owned · Qualification: approved-for-human-contract · Provisional scan signal: low-frequency-first-page-signal · Observed months: 2 · Latest observed month: 2026-08

  • Unqualified publication candidate: Sanctions on Proliferation

    Research candidate only; it is not promoted to an official enforcement or regulatory-update route.

    Route type: not classified · Source scope: not classified · Qualification: not classified · Provisional scan signal: not-observable · Observed months: 0 · Latest observed month: unknown

  • Unqualified publication candidate: Iran sanctions reinstated under UNSCR 1737 – screen and freeze without delay

    Research candidate only; it is not promoted to an official enforcement or regulatory-update route.

    Route type: not classified · Source scope: not classified · Qualification: not classified · Provisional scan signal: not-observable · Observed months: 0 · Latest observed month: unknown

  • Unqualified publication candidate: See More

    Research candidate only; it is not promoted to an official enforcement or regulatory-update route.

    Route type: not classified · Source scope: not classified · Qualification: not classified · Provisional scan signal: not-observable · Observed months: 0 · Latest observed month: unknown

  • Unqualified publication candidate: See More

    Research candidate only; it is not promoted to an official enforcement or regulatory-update route.

    Route type: not classified · Source scope: not classified · Qualification: not classified · Provisional scan signal: not-observable · Observed months: 0 · Latest observed month: unknown

  • Unqualified publication candidate: Notices to the Public

    Research candidate only; it is not promoted to an official enforcement or regulatory-update route.

    Route type: not classified · Source scope: not classified · Qualification: not classified · Provisional scan signal: not-observable · Observed months: 0 · Latest observed month: unknown

• Insurance Regulatory Commission of Sri Lanka — Level 1: Identity confirmed · Official site could not be reached

  Mandates: Insurance · Access status: Official site could not be reached · Research/publication snapshot checked: 2026-08-20

  Official authority site

  Provisional first-page scan signal

  Signal: unknown · Observed month count: unknown · Latest observed month: unknown.

  Source access was limited during this research check, so activity remains unknown. This is not evidence of inactivity.

  Scan contract and precision

  automated-first-page-date-scan · 2024-01 to 2026-08 · as of 2026-08-20 · month precision · first-page-only-unvalidated. This is not a validated engagement frequency.

  No publication candidate is qualified. Regulatory activity and enforcement visibility remain unknown.

  Activity and enforcement visibility remain unknown; this access limitation does not establish that the authority has no enforcement activity.

• Securities and Exchange Commission of Sri Lanka — Level 3: Enforcement visible · Official site reachable

  Mandates: Securities · Access status: Official site reachable · Research/publication snapshot checked: 2026-08-20

  Official authority site

  Provisional first-page scan signal

  Signal: periodic · Observed month count: 9 · Latest observed month: 2026-07.

  Provisional automated first-page date scan on an authority-owned qualified route. It is not a validated publication frequency or effectiveness measure.

  Scan contract and precision

  automated-first-page-date-scan · 2024-01 to 2026-08 · as of 2026-08-20 · month precision · first-page-only-unvalidated. This is not a validated engagement frequency.

  Publication candidates and qualification

  • Unqualified publication candidate: Surveillance, Investigations and Enforcement Framework

    Research candidate only; it is not promoted to an official enforcement or regulatory-update route.

    Route type: not classified · Source scope: not classified · Qualification: not classified · Provisional scan signal: not-observable · Observed months: 0 · Latest observed month: unknown

  • Unqualified publication candidate: Investigations and Enforcement

    Research candidate only; it is not promoted to an official enforcement or regulatory-update route.

    Route type: not classified · Source scope: not classified · Qualification: not classified · Provisional scan signal: not-observable · Observed months: 0 · Latest observed month: unknown

  • Unqualified publication candidate: Enforcement Action

    Research candidate only; it is not promoted to an official enforcement or regulatory-update route.

    Route type: not classified · Source scope: not classified · Qualification: not classified · Provisional scan signal: not-observable · Observed months: 0 · Latest observed month: unknown

  • Unqualified publication candidate: Unserved Notices of Show Cause

    Research candidate only; it is not promoted to an official enforcement or regulatory-update route.

    Route type: not classified · Source scope: not classified · Qualification: not classified · Provisional scan signal: not-observable · Observed months: 0 · Latest observed month: unknown

  • Official authority-owned enforcement route: United Nations Sanctions

    Authority-owned and approved for the human-reviewed route contract.

    Route type: sanctions_or_penalty_list · Source scope: authority-owned · Qualification: approved-for-human-contract · Provisional scan signal: periodic-first-page-signal · Observed months: 9 · Latest observed month: 2026-07

  • Unqualified publication candidate: index.php/investigations-enforcement-actions/

    Research candidate only; it is not promoted to an official enforcement or regulatory-update route.

    Route type: not classified · Source scope: not classified · Qualification: not classified · Provisional scan signal: not-observable · Observed months: 0 · Latest observed month: unknown

  • Unqualified publication candidate: Offences

    Research candidate only; it is not promoted to an official enforcement or regulatory-update route.

    Route type: not classified · Source scope: not classified · Qualification: not classified · Provisional scan signal: not-observable · Observed months: 0 · Latest observed month: unknown

Download regulatory ecosystem PDF · CSV · JSON

Sector exposure

• Banking & payments (Low): No FATF overlay and governance pillar within normal range
• Trade & export controls (Low): No direct sanctions or FATF call-for-action overlay identified
• Crypto & virtual assets (Elevated): Effectiveness pillar risk is 9.1/10
• Real estate & luxury assets (High): BO subscore 8.7/10; CPI context 35/100
• State-linked & procurement (High): Effectiveness pillar risk is 9.1/10

Derived from sanctions tier, FATF listing, World Bank WGI governance and CPI; no per-sector dataset is asserted.

Sri Lanka: analysis

Sri Lanka's profile is determined solely by its governance indicators, with no FATF or sanctions overlay. Corruption (elevated) is the weakest domain, followed by voice and accountability (elevated), political stability (moderate) and rule of law and institutions (elevated). The CPI reading confirms material corruption concerns. Sri Lanka sits just below the global midpoint on the World Bank governance indicators.

Outlook

Sri Lanka's risk profile reflects governance weaknesses that have been compounded by the economic crisis in recent years. Anti-corruption and rule-of-law reforms will be key determinants of future movement. Any deterioration leading to FATF grey-listing would materially raise the risk profile. Conversely, successful economic stabilisation and institutional strengthening could support gradual governance improvement.

Key watchpoints

• Any change in FATF status, which would materially raise scrutiny of Sri Lanka-connected business.
• Anti-corruption reforms and enforcement capacity as the country navigates post-crisis recovery.
• Rule of law developments, including judicial independence and financial crime legislation.
• Availability of future enforcement data to assess the supervisory framework.

Assessment currency

• FATF status: Not listed (as of 19 Jun 2026)
• Sanctions exposure: None identified (as of Jul 2026)
• Governance (WGI): Latest dataset incorporated (as of 2024)
• Corruption (CPI): 35/100 (as of 2025)
• RegActions assessment: Reviewed (as of 19 Jun 2026)

Public evidence layer

FATF action: none. No FATF call-for-action or increased-monitoring status was identified at the latest plenary. This does not establish low risk.

Contextual signals (not scored)

• FATF network membership: FATF regional network: APG (present, as of 2026-07)
• EU non-cooperative tax jurisdictions: Not listed in Annex I (absent, as of 2026-02-17)
• Egmont Group FIU: FIU Sri Lanka (present, as of 2026-07-17)
• Beneficial-ownership register: No live register identified in the source (unavailable, as of 2026-08-23)
• Transparency International CPI: 35/100, rank 107 (present, as of 2025)

Evidence freshness

• FATF monitored-jurisdiction status: current; data 2026-06-19
• FATF mutual evaluation and follow-up ratings: current; data 2026-08-24; follow-up 2021-11; base assessment 2015-10
• World Bank governance indicators: current; data 2024
• UN, UK, EU and US sanctions regimes: current; data 2026-08-30

Contextual signals are public evidence only and do not change the current country-risk score.

Download evidence PDF · CSV · JSON

Contextual risk evidence (not scored)

These eight evidence families provide context only. They do not change the v3.1 headline score. Unavailable means no reviewed, country-comparable evidence is currently ingested; it does not mean the risk is absent.

• Organised crime: Not available. No reviewed country-level organised-crime dataset is currently checked in; no risk value is inferred. Candidate sources are research leads only; they have not been ingested as evidence.
• Fraud and cybercrime: Not available. No reviewed country-level fraud or cybercrime dataset is currently checked in; no risk value is inferred. Candidate sources are research leads only; they have not been ingested as evidence.
• Terrorism and proliferation financing: Not available. No reviewed country-comparable terrorism/proliferation threat dataset is currently checked in; FATF listing status remains a separate overlay. Candidate sources are research leads only; they have not been ingested as evidence.
• Trafficking: Not available. No reviewed country-level trafficking dataset is currently checked in; no risk value is inferred. Candidate sources are research leads only; they have not been ingested as evidence.
• Financial secrecy and offshore exposure: Not available. No reviewed, licence-clean financial-secrecy index is currently checked in; jurisdiction type alone is not used as a proxy. Candidate sources are research leads only; they have not been ingested as evidence.
• Tax cooperation: Not listed in EU Annex I. Annex I is a political/legal tax-cooperation list, not a general AML, corruption, or country-risk score. Source
• Political stability and conflict: 60/100 WGI percentile. WGI is an institutional perception indicator, not a conflict event feed or a prediction of future violence. Source
• Beneficial ownership: Not available. The Open Ownership map is a live-register snapshot and absence means no register was identified in that snapshot, not that no register exists. Candidate sources are research leads only; they have not been ingested as evidence.

Regional peer scores

• North Korea: 8.6/10 (Very high)
• Myanmar: 7.8/10 (Very high)
• Afghanistan: 7.7/10 (Very high)
• Laos: 7.3/10 (Very high)
• Pakistan: 7.1/10 (Very high)
• Tonga: 7.1/10 (Very high)

Source: FATF black & grey lists · World Bank WGI (CC BY 4.0 — World Bank WGI) · TI CPI (CC BY-ND 4.0 — Transparency International, display only)