Every few years, the Central Bank’s Financial Intelligence Unit assesses the threats to Sri Lanka’s financial system and how well the system can stop them. The latest report, released in 2026, the National Risk Assessment (NRA), is the third such since 2014, and the most comprehensive yet, drawing on nearly 200 expert interviews at 86 institutions. The report finds a system stronger than it has ever been — but cautions that the country faces more serious threats now.
The NRA examines Sri Lanka’s vulnerability to three categories of financial crime: money laundering, terrorism financing and, for the first time in this exercise, the financing of weapons proliferation. It rates exposure on a five-point scale, measuring both the severity of threats entering the system and the effectiveness of each sector’s defence against them. The scale runs from Low at the bottom, through Medium Low, Medium and Medium-High, to High at the top.
Why This Report Matters
Its release comes directly ahead of Sri Lanka’s third evaluation by the Financial Action Task Force (FATF), the global body that sets anti-money laundering standards. That evaluation will determine whether Sri Lanka gets placed on or avoids the FATF grey list, a designation that carries severe consequences for the nation that prevents international movement. The FATF doesn’t require members to take action against countries on the grey list. However, most nations treat states on the grey list as high risk and blacklist them.
The EU added the island to its own blacklist, the last time Sri Lanka was added to the FATF grey list. In one instance, Swedish bank Handelsbanken, suspended payments to the country for individuals and businesses, leaving several exporters unable to recover proceeds. “The bottom line is that we can’t afford to be grey listed again,” Subhani Keerthiratne, Director of the FIU at the Central Bank said.
Rigorous evaluation
Central Bank’s National Risk Assessment finds that inter-agency coordination has improved, dedicated anti-money laundering units have been established across key institutions, and the adoption of new technologies has strengthened intelligence sharing across agencies, since its last report in 2022. A new Tax Crimes Investigation Unit within the Inland Revenue Department initiated several investigations in 2024 and 2025. The banking sector now has the strongest controls, reporting suspicious transactions to the FIU.
Tighter oversight is showing results. Major law enforcement crackdowns on organised crime have produced significant arrests and seizures. New anti-corruption legislation since September 2023 has filed charges in high-profile cases through the country’s anti-corruption commission. Sri Lanka’s Corruption Perceptions Index score rose from 32 in 2024 to 35 in 2025, an improvement the FIU credits with reducing the money laundering threat from bribery and corruption.
But not every indicator has moved in the right direction.
Threats have kept pace
Money laundering risk ranks in the middle of the five-point scale. The assessment finds terrorism financing has slipped one place to the “MediumHigh”, the only major category where the ranking has slipped.
The NRA traces the rise in terrorism financing risk to three causes. The first is diaspora funding channelled to terror groups. The second is digital radicalisation, where individuals drawn towards extremist ideology through online platforms become more likely to direct funds towards those networks. The third is informal remittance systems such as hawala, where money moves through informal brokers, which the assessment says, “remain at an early stage of oversight.”
National-level non-profit organisations receiving foreign funding and operating in multiple locations also carry a terrorism financing risk that the assessment places at the midpoint of the scale. Prosecutions, the assessment concludes, remain limited despite active investigations and asset seizures.
Money Laundering: Meth, scams and dirty trade
The NRA’s second area of coverage is money laundering risks, where it ranks the country in the middle of the five-point scale, meaning the system’s defences match the threats faced.
But that aggregate picture masks a more serious exposure at its edges. Methamphetamine trafficking is the sole crime category to reach the “High” rating the assessment uses, indicating substantial illicit flows and organised criminal network involvement. The report explains, “Sri Lanka is a transit country,” meaning the drugs move through here to other countries, but the money to pay for these shipments flows through the local financial system.”
NRA rates two further money laundering threats at the second-highest band. The first are foreign-run ‘pig-butchering’ scam operations, named for the practice of building trust with victims over weeks on social media platforms before defrauding them. The assessment identifies these as a developing threat using local financial infrastructure to move the proceeds. The second is trade-based money laundering, where criminals manipulate the price or description of goods in international trade to disguise the movement of illicit funds across borders. Recently, customs imposed large penalties on these incidents, but the assessment notes, “It rarely refers these cases to investigators”, limiting how far prosecutions reach.
Sectors most exposed to financial crime
Within the financial system, the assessment rates sectors by combining two factors: the severity of threats and the strength of their own defences. The two don’t always move in tandem.
Banks illustrate this clearly. They have the strongest anti-money laundering defences of any sector, but rank at the second-highest NRA risk band of ‘Medium-High’ due to “the sheer volume and scale of dirty money flowing through them overwhelming those defences,” the report observes. Banking is linked to most known money laundering cases, the assessment finds, driven by financial asset concentration and large transaction values rather than by institutional failure.
Casinos, real estate agents, precious metals dealers and informal money transfer services are rated “Medium-High”, or a notch lower than the worst rating in the five-point scale, because of their cash-intensive nature, weaker controls and limited oversight. Finance companies (or non-bank financial institutions) also rank at the same level, due to cash-intensive products and customers who do not qualify for mainstream banking.
Two sectors worsened since the last assessment. Insurance moved up from the lower half of the scale to a “Medium” rating due to expanding products, higher cash exposure and low suspicious transaction reporting. Trust and Company Service Provider’s ranking also declined a notch, driven by growing gaps in how they are supervised.
Across lawyers, notaries, real estate agents and other businesses outside the financial sector, the assessment finds uneven compliance awareness and weak record keeping. More than 95% of legal persons assessed are private limited companies. The assessment identifies a key risk: regulators often cannot identify who actually owns or controls these companies.
Unlike banks or insurers, which face threats but have functioning controls, the cryptocurrency sector, also called the virtual assets sector, has none. The assessment is explicit: “the lack of formal registration, licensing, supervision, and enforceable AML/CFT obligations for VASPs [Virtual Asset Service Providers] constitutes a major vulnerability within the sector.” Vulnerability is made more urgent by growing interest in virtual. Digital platforms where users hold their own cryptocurrencies without an intermediary are ranked at the scale’s midpoint. The assessment rates custodial wallets and services that convert between cash and cryptocurrencies as lower risk, as they involve intermediaries who can be regulated. But with no framework in place to regulate any of them, the distinction offers limited reassurance.
Gaps remain
The assessment points to structural reasons why gaps persist. Lacking a centralised digital database for anti-money laundering data, agencies are left to work from incomplete and fragmented information. The assessment finds that “resource constraints impact ML [Money Laundering] investigations and prosecutions” across multiple agencies. Conviction rates remain low across most crime categories despite a high volume of investigations.