Accepting Crypto Payments in Sri Lanka: Merchant Guide

TL;DR

A Sri Lankan merchant can be paid in rupees out of a customer's crypto. A Sri Lankan merchant cannot be paid in crypto by a resident for a domestic transaction. That distinction is the whole guide. The Central Bank of Sri Lanka's published position is that cryptocurrencies are "not considered as legal tender in Sri Lanka", are not a recognised asset class, and that debit and credit cards "are not permitted to be used for payments related to cryptocurrency transactions". The 2026 legislative changes did not touch that. Parliament passed three anti-money-laundering amendment acts on 10 July 2026, and the Financial Transactions Reporting (Amendment) Act No. 17 of 2026 was gazetted on 7 August 2026. Cabinet named the Securities and Exchange Commission as regulator for virtual assets and virtual asset service providers on 28 July 2026 — a decision, not a law. No licensing rules exist, so there is no licence to hold. All of it is timed against Sri Lanka's third mutual evaluation, whose onsite phase is scheduled to start around October 2026. Your real competitor is not another crypto gateway. It is LankaQR at a 0% merchant discount rate up to Rs 5,000.

Accepting Crypto Payments in Sri Lanka: What Is Actually Permitted

Start with the primary document, not the headlines.

The Central Bank of Sri Lanka's public notice on cryptocurrency risk↗ of 29 March 2023 states that "cryptocurrencies are unregulated investment instruments which are not recognized as an asset-class in Sri Lanka" and that they "are not considered as legal tender in Sri Lanka". It states that "Electronic Fund Transfer Cards (EFTCs) such as debit cards and credit cards are not permitted to be used for payments related to cryptocurrency transactions", resting on Directions No. 03 of 2021 issued under the Foreign Exchange Act No. 12 of 2017. CBSL has never authorised initial coin offerings, mining, exchanges, custody or crypto investment advisory, and issued escalating warnings in 2018, 2021, 2022 and 2023 plus a January 2024 scam notice.

Governor Nandalal Weerasinghe drew the operative line in remarks reported in September 2025. Holding is unregulated because no law addresses it: "investing in cryptocurrency or virtual currency has no legal impediment due to the non-existence of laws or regulations." Paying with it inside the country is different: "cryptocurrency cannot be used for transactions within the country." Only the rupee is accepted domestically, and even US dollars need specific CBSL authorisation. A secondary source, medium confidence, but consistent with every primary document.

So what does the product on the market actually do? It keeps the crypto leg outside Sri Lanka. The customer pays from a balance at an offshore exchange, that transfer happens inside the exchange's own ledger, and the only leg touching Sri Lanka is a rupee credit to a local bank account over the national interbank switch. I trace that path call by call in how CeyPay actually works. Constraint-driven design, and the reason the model is viable at all.

Two consequences. You never hold crypto, which removes the price risk and the offramp problem. And you are not "accepting Bitcoin" in any meaningful sense: you are accepting a rupee settlement from a payment company whose customer funded it with stablecoin. Say that accurately to your accountant and your customers.

What Changed in 2026: Reporting, Not Permission

Coverage of the July 2026 legislative cluster reads as "Sri Lanka legalises crypto". It did close to the opposite.

Parliament passed the three amendment bills on 10 July 2026. The Financial Transactions Reporting amendment passed with amendments and without a division, and the Convention on the Suppression of Terrorist Financing amendment passed without amendments and without a division. The Prevention of Money Laundering amendment needed a special majority in respect of Clause 14, following the Supreme Court's determination on that clause. The Financial Intelligence Unit's acts page lists the resulting statutes as the Financial Transactions Reporting (Amendment) Act, No. 17 of 2026↗, the Prevention of Money Laundering (Amendment) Act No. 16 of 2026, and the Convention on the Suppression of Terrorist Financing (Amendment) Act No. 18 of 2026. The FTRA amendment's cover states it was "Published as a Supplement to Part II of the Gazette of August 07, 2026".

What I could confirm in the text of that Act:

• The long title is extended to cover financing of the proliferation of weapons of mass destruction.
• Section 2 is replaced with a statutory risk-based approach and a customer due diligence regime.
• Records must be retained for six years from completion of the transaction or closure of the relationship.
• A new PART IIA establishes the Financial Intelligence Unit within CBSL as "operationally independent and autonomous", deeming the unit designated by Gazette Extraordinary 1437/24 of 23 March 2006 to be established under the new section.
• Compliance officer duties are expanded, including screening of all employees and agents and an internal audit function.

What the Act itself says about virtual assets: section 39 replaces section 33 of the principal enactment, and the replacement adds "providing virtual assets services, subject to the provisions of any written law for the time being in force" as paragraph (v) of the definition of "finance business". The same section defines a "virtual asset" as "a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes, but does not include any digital representation of fiat currencies, securities and other financial assets", and defines a "virtual assets service provider" as any person who, for or on behalf of another person, exchanges between virtual assets and fiat currencies, exchanges between one or more forms of virtual assets, transfers virtual assets, safekeeps or administers virtual assets or the instruments enabling control over them, or participates in and provides financial services related to an issuer's offer or sale of a virtual asset. "Institution" is defined as any person carrying on a finance business. A VASP is therefore an Institution under the Act, owing the same customer due diligence, record keeping and suspicious transaction reporting duties as a bank. That is in the gazetted text, not only in the press coverage.

The PMLA amendment adds a section 12A: where a police officer, on documents delivered under section 12(1), has reasonable grounds to believe other property is connected to frozen property or was derived from unlawful activity, the officer shall issue a Freezing Order over that connected property under section 7. A separate amendment to section 7 extends the freezing window from seven days to fourteen working days, without immediate judicial approval. Opposition MP Shanakiyan Rajaputhiran Rasamanickam raised concerns during the debate, warning that assets could be frozen on police suspicion alone without prior judicial approval.

The SEC Designation, and the October 2026 Deadline Behind It

On 28 July 2026, Cabinet named the Securities and Exchange Commission of Sri Lanka as the regulatory authority for virtual assets and VASPs↗, on a submission by President Anura Kumara Dissanayake in his capacity as Minister of Digital Economy. The model is joint supervision: the SEC plus CBSL's Financial Intelligence Unit plus the Inland Revenue Department. Cabinet spokesman Nalinda Jayatissa announced it. Mandatory registration, reporting standards and taxation are planned.

Read carefully, that is a decision about who will regulate, not a regulation. No legal instrument was located. The framework was still a draft concept paper at the second VASP sub-committee meeting in March 2026, worked by a sub-committee under Deputy Minister of Digital Economy Eranga Weeraratne that first convened on 20 January 2026 at CBSL and presented its proposal to the CBSL/FIU committee on 12 February 2026. A check of the SEC's own 2026 media releases turns up watchlist company auditors, listings advisors, an investor forum in Saudi Arabia, a Dubai roadshow, an alliance with SLAASMB on financial reporting and a children's financial literacy storybook — nothing on virtual assets, though the SEC did co-host an awareness forum on virtual assets with the Ministry of Digital Economy on 15 June 2026. The Daily FT headline of 11 July 2026 put it accurately: the government signalled a regulated path for virtual assets, but crypto remains out.

The practical consequence: nobody in Sri Lanka can be a licensed crypto payment provider right now, because the licence does not exist. If a provider says it is "licensed", ask which authority and which number. The honest answer today is structural, not licensed — the provider settles you in rupees and keeps the crypto leg offshore.

Why did all this happen in one six-month window? The Financial Intelligence Unit's own site↗ gives the answer. The FIU held the inaugural meeting of the National Committee on AML/CFT/CPF on 25 August 2026. The timetable behind it is public: FIU Director General Dr Subhani Keerthiratne told the Daily FT on 10 August 2026 that the assessment team is scheduled to visit Sri Lanka in the last week of October and the first week of November 2026. UK HM Treasury delivered a second in-person technical assistance programme from 10 to 14 August 2026 on AML/CFT supervision and preventive measures. Sri Lanka has been on the FATF grey list twice before.

If you are building anything touching virtual assets here, the evaluation calendar matters more than the press release. I cover the earlier regulatory history in cryptocurrency regulation in Sri Lanka.

Your Four Realistic Options, Priced

The LankaQR rates come from the CBSL Payments Bulletin for Q1 2026↗, published 17 August 2026, section 4.7(c): maximum merchant discount rate 0% up to Rs 5,000 and 1% above for domestic mobile apps, 1.8% via apps linked to international payment service providers, transaction limits Rs 1 to Rs 500,000. The same section records that from 31 March 2026 the specification added merchant-presented QR codes and peer-to-peer transfers. Off-us LankaQR settles through CEFTS — the same switch a crypto gateway's rupee payout rides.

The crypto gateway figures come from CeyPay, the only provider I found that settles LKR, with an important caveat: they are illustrative values in API sample payloads at docs.ceypay.io, not a rate card. The two-part structure is real — an exchange fee plus a provider fee — and the docs' two worked examples compute to 1.50% on a 149.99 USDT payment (1.0% exchange plus 0.5% provider) and 3.50% on a Rs 30,000 payment (2.5% plus 1.0%, or Rs 1,050), against a published headline of "up to 2% max". I work both through in how CeyPay actually works. The contracted rate per merchant is not disclosed. Get it in writing.

I found no competitor offering crypto acceptance with Sri Lankan bank settlement. In a market this small and this poorly indexed, that is not proof one does not exist.

The Free Rail You Are Competing With, Measured

One number should decide most of these conversations, and it cuts both ways.

The CBSL Payments Bulletin for Q1 2026 reports 473,214 registered LankaQR merchants at the end of the quarter, up 9.9% year on year from 430,681 at the end of Q1 2025 and up 2.7% on the 460,990 registered at the end of Q4 2025. Over the same quarter, LankaQR recorded 257,520 transactions worth Rs 1,097 million. That is volume down 17.3% year on year and value down 4.6%, in a quarter when the rails it competes with grew. On-us volume collapsed 39.5% year on year.

Divide those two numbers: roughly 0.54 LankaQR transactions per registered merchant per quarter. The Central Bank's own key-indicator series shows per-capita LankaQR value went backwards in 2025, from Rs 241.6 to Rs 220.5.

Compare that with the rails that are working:

• POS card terminals: 144,046 in service, 132 million transactions in Q1 2026, up 37.5% year on year, worth Rs 615 billion.
• CEFTS: 75.88 million transactions in Q1 2026, up 27.7%, worth Rs 6,782 billion, up 39.6%, across 51 member institutions.
• Cards in issue: 20,866,421 debit and 2,232,339 credit at end Q1 2026.
• The one QR bright spot: LankaQR through apps linked to international payment service providers grew 421.5% year on year to 25,792 transactions, worth Rs 443 million. Fast growth, still tiny against 132 million POS transactions.

Governor Weerasinghe's framing in April 2026, when the merchant discount rate was removed for transactions up to Rs 5,000, was roughly 90,000 QR transactions a month against 300,000 credit card transactions a day, with a target of one million a month within six months. His reason: "Small shops operate on a very small profit. Unlike supermarkets that get discounts on card payments, small vendors find commissions higher than their profit."

Two conclusions. Against a 0% rail under Rs 5,000, no gateway charging 2% or more has a domestic small-ticket case. And registering for a rail is not the same as being paid through it — that applies as hard to a crypto QR code as to LankaQR.

What Onboarding Actually Takes

For the LKR-settling crypto gateway route, CeyPay's documented flow is: apply in under five minutes, pass KYC verification "within 24-48 hours", then receive a QR code or a POS device. A changelog entry at docs.ceypay.io dated 18 February 2026 added early access — a merchant can reach the dashboard immediately and begin accepting payments before full approval, capped at LKR 5,000 in total transactions during that phase. Full verification removes the cap. Platform localisation for Sinhala and Tamil shipped on 9 July 2026.

The LKR 15 million merchant subsidy announced on 10 February 2026 sets the eligibility bar more concretely than the FAQ: Sri Lankan business registration, a minimum LKR 200,000 monthly transaction volume, a commitment to promoting crypto payments, and either physical retail or an established digital presence. Terms were a free one-year subscription, the 2% commission waived for the first 100 merchants during year one, 50 complimentary Sunmi Android POS devices, and "$10/month standard subscription thereafter". Deployment was quoted at four to six weeks after selection.

I could not retrieve the merchant portal's signup form or its document checklist; the flow sits behind authentication. The KYC timing above comes from published FAQ and programme terms, not the form. Budget for business registration documents, bank details and a beneficial-ownership declaration regardless — that is what the FTRA regime expects of a reporting institution's customers. For LankaQR, registration runs through your acquiring bank; I did not source a current onboarding timeline and will not estimate one.

Limits That Will Bite

• LankaQR transaction limits are Rs 1 to Rs 500,000 per transaction.
• JustPay caps a transaction at Rs 150,000, across 25 JustPay-enabled mobile apps, and its volume was almost flat in Q1 2026 at 7,386 thousand transactions, up 3.1% year on year.
• Crypto gateway settlement is a merchant-initiated pull, with only one active withdrawal request allowed per merchant per day, a minimum net amount below which the request is rejected, and manual admin review above an undisclosed auto-approval ceiling.
• Pre-approval, the same gateway caps you at LKR 5,000 in total transactions.
• Outward capital movement is tightly bounded. A Section 22 Order in Gazette Extraordinary 2493/38 of 18 June 2026 limits outward remittances on capital transactions to USD 500,000 through a Business Foreign Currency Account and USD 25,000 through a Personal Foreign Currency Account. An unlisted Sri Lankan company investing abroad is limited to USD 200,000 or 20% of net assets per the last audited accounts, whichever is lower.
• Since 20 June 2026, under the Foreign Exchange (Overseas Investments Made by Persons Resident in Sri Lanka) Regulations No. 1 of 2026, Gazette 2493/36, a resident individual may make overseas investments "only in overseas Employee Share Ownership Plans or Employees Share Option Schemes". Nothing else. If your plan involves a personal offshore holding structure, read that regulation before you incorporate.

What to Check in Any Provider Contract

Take this list to the meeting. Every item comes from something stated ambiguously, or not at all, in published material.

1. Both fee components, named. The exchange fee and the provider fee, separately, per provider rail. A single blended percentage cannot describe a fee whose exchange component varies.
2. The FX benchmark. Which reference rate the rupee conversion is priced against, and the spread. Rates are published in API responses with no benchmark, so the spread is not observable from the outside.
3. The settlement thresholds as numbers. The minimum withdrawal amount and the ceiling above which a human reviews your request. Both decide your cash-flow timing and neither is published.
4. Which legal entity holds your money. Between payment confirmation and rupee settlement, someone is holding your funds. The contracting entity and the entity named as approving settlements are not always the same name in published documents. Get it identified.
5. Refund mechanics per rail. Native refunds may exist on one exchange rail and not on the others, in which case a refund becomes a separate bank transfer you arrange and reconcile by hand.
6. What customer data you must transmit, and who controls it. A crypto payment can require more customer personal data than a card payment — name, email, phone and address as mandatory fields. Under a reporting-institution regime that is a data protection obligation as well as an AML one.
7. The risk disclosures, in the contract rather than a web page. One provider's risk warning already concedes it relies "on third parties for custody, conversion and settlement", that "the failure, insolvency or default of a blockchain network, stablecoin issuer or settlement partner could affect access to, or the value of, funds", that "settlement is not always instant", and that digital assets are not bank deposits and carry no deposit protection. Right disclosures. Make sure they sit in your agreement.
8. Liability cap and termination. One published Terms document caps liability at total fees paid in the preceding six months. Know what that number is for you, and what happens to an unsettled balance on termination.

If You Are a Developer Taking Foreign Payment, Not a Shop

Different problem, and the binding rule is not the crypto one.

Under the Repatriation of Export Proceeds into Sri Lanka Rules No. 01 of 2024↗, Gazette Extraordinary 2391/02 of 1 July 2024, Rule 14 defines export proceeds to include "payments received in foreign exchange by a person resident in Sri Lanka for the services provided including professional, vocational, occupational or business services provided to a person resident outside Sri Lanka". That is every freelancer and every services exporter, by name. Rule 3 requires those proceeds to be received in Sri Lanka within 180 days of provisioning the services, with documentary evidence submitted on every receipt. Rule 5 provides that non-compliance may attract regulatory action and forces immediate conversion.

The half that is almost universally misstated: Rule 4, the mandatory conversion of residual proceeds into rupees, is expressly limited to "Every exporter of goods". That limitation survived the rewrite — Rules No. 2 of 2026 repealed Rule 4 on 10 June 2026 and the replacement opens with the same words, changing only the conversion deadline to the tenth day of the following month. A services exporter must repatriate but may hold the foreign currency. That distinction is worth real money.

One caveat. Rules No. 1 of 2026, Gazette 2473/30 of 30 January 2026, is a scanned PDF whose text I could not read — verify the 180-day period against that gazette before relying on it. Rules No. 2 of 2026, Gazette 2492/10 of 9 June 2026, took effect on parliamentary approval on 10 June 2026 and repealed and replaced Rules 4 and 6 of the 2024 Rules; both substitutions shortened the conversion deadline to the tenth day of the following month and neither disturbed the goods-only limitation.

On tax: individuals earning foreign currency from service exports have paid 15% income tax on those earnings since 1 April 2025, with income up to Rs 1.8 million remaining exempt, and companies exporting services taxed on profit after expenses instead. That reporting came from a post-budget seminar and I hold it at medium confidence. The tax bites on funds remitted through a bank, which is the same trigger as the repatriation rule. Parking a balance in a foreign wallet indefinitely does not avoid either obligation; it breaches one of them.

If you want customers holding their own keys rather than routing through an exchange, the wallet side is covered in passkey wallets that work on mainnet and account abstraction measured on-chain. Neither changes the Sri Lankan settlement question, which is the hard part.

Who Should Not Do This

This is where most guides go soft.

• Small-ticket domestic retail. A kade, a bakery, a Rs 400 lunch. LankaQR costs nothing under Rs 5,000. Nothing beats free.
• Any business whose customers are residents paying for domestic goods in crypto. The Governor's line is explicit that crypto cannot be used for transactions within the country. Compliant products keep the crypto leg offshore and the rupee leg domestic; a shop taking a wallet-to-wallet transfer from a local customer is doing something else.
• High-return-rate merchants. If refunds on your main rail are a manual bank transfer, your operations cost scales with your return rate.
• Anyone who cannot carry customer due diligence obligations. If VASP reporting duties land as reported, the provider's obligations flow into your onboarding and record keeping. FATF's framework permits reliance on third parties but leaves ultimate responsibility with the reporting institution.
• Anyone who cannot get a straight answer on which entity holds their money. Not a crypto question. The first question in any payments contract.

Who should: tourist-facing merchants at larger tickets, event operators running short cash-free deployments, and payment service providers wanting a rupee offramp as infrastructure. Wider context is in my Sri Lanka tech scene overview and complete guide to Bitcoin in Sri Lanka.

What I Could Not Verify

• Any timetable or commencement date for the SEC licensing and registration regime for virtual asset service providers. The FTRA amendment already makes VASPs reporting institutions, but the registration, reporting and taxation regime Cabinet approved on 28 July 2026 has no published rules.
• CBSL's stance in September 2026 specifically. The most recent CBSL-attributed statements I verified are the Governor's September 2025 remarks and the March 2023 notice, though Finance and Planning Deputy Minister Dr Anil Jayantha Fernando restated the same position in Parliament on 11 July 2026. Treat "unchanged" as an inference from the absence of a contrary primary source.
• Any card acquiring merchant discount rate. I did not source a current published figure, so the table above leaves it out rather than estimating.
• The current merchant onboarding form and document list for the LKR-settling gateway, which sits behind authentication.
• Any merchant count or transaction volume for crypto acceptance in Sri Lanka. None is published.

Key Takeaways

• The 2026 changes are AML plumbing, not permission. Three amendment acts passed 10 July 2026; the FTRA amendment was gazetted 7 August 2026 as Act No. 17 of 2026.
• The SEC designation is a Cabinet decision dated 28 July 2026. No legal instrument, no licensing rules, and nothing on virtual assets in the SEC's own 2026 media releases. There is no licence to hold.
• The deadline explains the timing. The assessment team for Sri Lanka's third mutual evaluation is scheduled onsite in the last week of October and the first week of November 2026, per the FIU Director General in August 2026.
• LankaQR is free under Rs 5,000 and lightly used. 473,214 registered merchants produced 257,520 transactions in Q1 2026, down 17.3% year on year — about 0.54 transactions per merchant per quarter.
• CEFTS and cards are where the volume is. 75.88 million CEFTS transactions worth Rs 6,782 billion, and 132 million POS card transactions worth Rs 615 billion, in Q1 2026.
• A crypto gateway's real cost is two fees plus a spread. Documented examples compute to 1.50% and 3.50%; those are sample payload values, not a rate card, so get the contracted split in writing.
• Developers taking foreign payment are bound by the 180-day rule. Rule 14 of the 2024 Repatriation Rules names professional and business services explicitly, and mandatory rupee conversion under Rule 4 — as replaced on 10 June 2026 — still applies only to exporters of goods.

About the Author

I'm Uvin Vindula — a Web3 and AI engineer based between Sri Lanka and the UK. I build payment and Web3 systems for clients in both markets and read the gazette before the press release. You can see my work at iamuvin.com or reach out about a project at hello@iamuvin.com↗.

If you are weighing a crypto rail against the rails you already have, let's talk about your project.