How CeyPay Actually Works: Crypto Payments in Sri Lanka

TL;DR

CeyPay is a checkout layer over Bybit Pay, Binance Pay and KuCoin Pay with a Sri Lankan rupee bank payout on the other side. Its Payments API accepts one asset — USDT — and a provider enum of BYBIT or BINANCE; the response documentation states that currency is "always USDT for processing" (docs.ceypay.io, retrieved 14 September 2026). The customer pays from a balance already held at one of those exchanges, and the create-payment call returns a bybit:// deep link plus a checkout page hosted at checkout.bybit.com. The crypto leg is an internal exchange book transfer, not an on-chain transaction. That follows from a constraint, not a shortcut: CeyPay's own legal log of 13 February 2026 records the Central Bank's clarification that resident-to-resident transactions inside Sri Lanka must be conducted in rupees, and states that all merchant settlements are conducted in LKR. On fees, the docs split the charge into an exchange percentage plus a CeyPay percentage. The USDT example works out at 1.50%, the LKR example at 3.50%. The published headline is "Up to 2% Max". An unquantified FX spread sits on top of both.

What CeyPay Actually Is: One Asset, Two Providers, an LKR Rail

Every write-up of CeyPay I can find repeats the press-kit line about 50 or more cryptocurrencies including Bitcoin and Ethereum. Nobody opened the API reference.

The Payments API↗ is explicit. POST /v1/payment takes a currency of USDT or LKR, and an LKR amount is auto-converted to USDT at creation time. It takes a provider of BYBIT or BINANCE. The response schema notes that the processing currency is always USDT. A third provider, KUCOIN_PAY, is absent from the Payments API provider enum entirely. It survives only as a filter value on the Direct Debit scenario-code and contract-list endpoints — even though the 22 January 2026 changelog says KuCoin is "Available in both WordPress plugin and API", and the WooCommerce configuration page offers customers "Pay with crypto using Bybit, Binance Pay, or KuCoin". The changelog dates the provider rollout: Bybit Pay on 11 December 2025, Binance Pay on 10 January 2026, KuCoin on 22 January 2026.

So where do the 50 assets come from? They happen inside the payer's exchange wallet, before CeyPay is involved. Hold SOL on Bybit, pay a Bybit Pay invoice denominated in USDT, and Bybit converts it for you. CeyPay only ever sees USDT. That is a reasonable architecture. It is not the architecture the marketing describes, and the difference decides what your customers must already have set up.

The documented surface is wider than the consumer pitch suggests. The llms.txt file lists nine APIs: Payments, Payment Links, Direct Debit (recurring, with Binance wallet binding added 26 March 2026), Branch (multi-branch and franchise, added 3 February 2026), Withdrawals, Offramp (restricted to an AGGREGATOR role), Webhooks, Errors and Rate Limits. Rate limits run from 10 to 300 requests per minute by endpoint. Offramp amounts range from 0.00000001 to 1,000,000 USDT, idempotent on externalRef. Outside the API sit a hosted checkout link, a deep link, a merchant static QR (added 9 February 2026), a Sunmi Android POS device, and a WooCommerce plugin — which the FAQ confirms is the only supported online-store integration. Three of the nine are the whole product for most merchants: create a payment, take a webhook, pull a withdrawal.

Tracing One CeyPay Payment End to End

The full path, with the documented artefact at each step.

1. Your server calls POST /v1/payment with an amount in USDT or LKR, a provider, and a customerBilling object. That object is required, and inside it firstName, lastName, email, phone and address are all required; city, postalCode and country are optional.
2. CeyPay returns a payment record containing qrContent and checkoutLink. The documented examples are bybit://pay?id=abc123... and https://checkout.bybit.com/pay/abc123.
3. The customer opens that link or scans the QR. The page is hosted by the exchange, not by CeyPay. They must already have an account and a funded balance at Bybit, Binance or KuCoin.
4. The exchange moves USDT from the customer's account to the merchant-side account associated with CeyPay — a book transfer inside the exchange's ledger.
5. CeyPay marks the payment PAID and fires a webhook. Webhooks retry five times over roughly fifteen minutes with a ten-second timeout, and the docs tell you to deduplicate on paymentId.
6. Your USDT sits in a CeyPay balance until you call POST /v1/withdrawal, which bundles unsettled PAID payments and pays out in rupees to a Sri Lankan bank account over CEFTS.

Step 4 is the one nobody writes about. The documented fields, using values from the reference:

{
  "currency": "USDT",
  "paymentProvider": "BYBIT",
  "qrContent": "bybit://pay?id=abc123...",
  "checkoutLink": "https://checkout.bybit.com/pay/abc123",
  "feeBreakdown": {
    "grossAmountUSDT": 149.99,
    "exchangeFeePercentage": 1.0,
    "ceypayFeePercentage": 0.5,
    "totalFeesUSDT": 2.25,
    "netAmountUSDT": 147.74
  }
}

No on-chain address appears anywhere in that flow. No WalletConnect path, no EIP-1193 provider, no self-custody option. A customer holding USDT in a wallet they control cannot pay a CeyPay invoice without first depositing to Bybit, Binance or KuCoin — the exchanges CeyPay's checkout supports.

Why the Crypto Leg Is an Exchange Transfer, Not an On-Chain Payment

This is the most important technical fact about the product, and it bears on the claim repeated most often.

CeyPay's documentation pitches irreversibility: "Cryptocurrency transactions are irreversible. Once payment is confirmed, it's final." The FAQ phrases it as "Once a payment is completed on-chain, it cannot be reversed or double-spent." The docs also claim "Over 99.9% finality rate" and "No chargeback fraud."

The payment never goes on-chain. Finality rests on the exchange's terms of service, not on block confirmations. Bybit, Binance and KuCoin each operate a ledger they control and can adjust. The practical effect is probably similar for the overwhelming majority of transactions — exchanges do not routinely claw back completed internal transfers — but the mechanism is different, and the mechanism decides your recourse when something goes wrong.

Be fair about this. An internal exchange transfer is faster than an on-chain payment, costs the customer nothing in gas, and cannot fail with a stuck nonce or a wrong-chain deposit. Real advantages at a point of sale. The honest description is "instant settlement inside a custodial exchange", and that is a good product — just a different one from a blockchain payment. Evaluating counterparty risk here means evaluating the exchange, not the chain.

If you want a design where the customer actually holds keys, that lives elsewhere in the stack — I cover it in Account Abstraction in 2026, Measured On-Chain and Passkey Wallets That Work on Mainnet. Neither is what CeyPay is building, for reasons the regulatory section below makes clear.

The Fee Picture: A 2% Headline and a 3.5% Worked Example

The homepage says "Up to 2% Max". The docs FAQ says "2% processing fee" and "Exchange settlement costs fully included in the 2% fee. No hidden charges."

The API's feeBreakdown object tells a two-part story. It splits into exchangeFeePercentage and ceypayFeePercentage. Run the arithmetic on the published examples:

I recomputed each rather than trusting the totals. On LKR 30,000: 750 plus 300 is 1,050, which is 3.50%. On the withdrawal example: 15,000 ÷ 465,000 = 3.226%. Two of the three exceed the 2% headline; one is well under it.

The caveat is not a small one: these are illustrative values inside sample payloads in an API reference, not a published rate card. The contracted rate for any given merchant is not disclosed anywhere I could find, and the examples may not reflect live pricing. What the arithmetic proves is narrower than "CeyPay charges 3.5%". It proves the fee is structurally two-part, that the exchange component is variable and outside CeyPay's control, and that one "2%" cannot describe both a 1.0% exchange fee and a 2.5% one. Ask for the contracted split in writing before you sign.

The same FAQ page contradicts itself on the recurring charge. The "Why Choose CeyPay?" card block states "2% processing fee. $10/month platform fee, charged only if you receive payments", and separately quotes "1.5% base rate for partners" for payment service providers and banks, who "can add their own markup on top". Four hundred words further down the same page, the accordion answer to "What fees do merchants pay?" includes "No monthly fees". The homepage structured-data FAQ answer is vaguer still: "zero setup fees and a simple, low fee per transaction."

Three answers to the same question, published simultaneously. The LKR 15 million subsidy programme announced on 10 February 2026 sidesteps it for early merchants by waiving both the subscription and the 2% commission for the first 100 merchants during year one.

The FX Spread That Sits on Top of the Percentage

Percentage fees you can see. The conversion rate you cannot.

LKR-denominated payments return an exchangeRateSnapshot — the documented example value is 295.50 LKR per USDT. The Offramp API↗ returns a rateUsdtLkr locked for 60 seconds behind an fxLockId. Neither is published against a reference or mid-market benchmark, so the spread is not observable from the API response. You get a rate; you cannot tell what it cost you.

The docs' own withdrawal example implies exactly 300.00 LKR per USDT — its gross and fee pairs both divide cleanly, and only the net figure of LKR 450,000.50 against 1,500 USDT does not — while the payment example uses 295.50 — different documents, probably different dates, so not evidence of a spread, only that you cannot reconstruct the rate from the documentation.

CeyPay's risk-warning page↗ is where the honest version of the product lives, and it concedes the exposure. It says "The time to settle and the final amount received can be affected by network conditions, conversion rates, fees and the availability of our partners", and names "conversion spreads" among the costs. Pricing this against a card acquirer means comparing your all-in landed rupee amount against the card MDR, not one stated percentage against another.

Settlement Is a Merchant-Initiated Pull With a Daily Cap

The homepage advertises 24/7 near-instant settlement. The Withdrawals API↗ documents something more constrained, and the constraints are the operationally important part.

• Settlement is a pull, not a push. You call POST /v1/withdrawal, which bundles unsettled PAID payments into one request.
• "Only one active (PENDING or APPROVED) withdrawal request is allowed per merchant per day."
• "The total net amount must meet the platform's configured minimum withdrawal threshold, or the request is rejected with 400." The threshold value is not published.
• Below an auto-approval threshold the request clears immediately. "Otherwise, the request stays PENDING until reviewed by CeyLabs admins." That ceiling is also not published.
• Automatic withdrawal at a merchant-set threshold only shipped on 17 July 2026, seven months after the merchant platform went live on 10 December 2025.

Elsewhere the docs say settlement lands "within 24 hours or next business day". The risk-warning page says plainly: "Settlement is not always instant."

None of that is unusual for a payment processor — card acquirers batch, hold and review too. The gap between the three published descriptions of the same behaviour is. Get the minimum withdrawal threshold and the auto-approval ceiling into your contract as numbers. They decide whether your money moves today or waits for a human.

The LKR Rail Is the Real Moat, Not the Crypto

Strip out the crypto. The hard thing to build here is the rupee payout.

GET /v1/bank/list "returns all active Sri Lankan banks and their CEFTS codes", with documented examples of Commercial Bank PLC (7056), Bank of Ceylon (7083) and People's Bank (7010). CEFTS is the Common Electronic Fund Transfer Switch, the national interbank switch operated by LankaPay — the same rail that carries account-to-account transfers for the whole banking system.

The offramp is a clean state machine: fetch the bank list, upsert an end-user, register a bank account to get a userBankId, lock an FX rate to get a 60-second fxLockId, then POST /v1/aggregator/offramp. The request moves to PROCESSING, then COMPLETED with a bankRef. The offramp webhook events are named payment.completed and payment.failed — the same strings the payment webhooks use, so an aggregator running both flows has to disambiguate on the payload rather than the event name. No SLA is published for the bank leg. It is restricted to an AGGREGATOR role, which tells you the commercial shape: CeyPay wants to be infrastructure for other payment companies, not only a merchant gateway. The 1.5% partner base rate points the same way.

One design decision there deserves flagging. POST /v1/aggregator/user takes only an externalUserId, and the documentation states: "CeyPay only stores the externalUserId you provide. No personal or identifying information about your end-users is collected or retained on our end." Bank account registration collects bankCode, accountNumber, accountName and optional mobile and email — no national identity number, no passport, no address. Customer due diligence is delegated entirely to the aggregator.

That sits awkwardly beside the Payments API, where customerBilling is mandatory and requires name, email, phone and address on every crypto payment, and beside the WooCommerce plugin's privacy documentation, which states that "No personal customer information (names, emails, addresses) ... are transmitted to CeyPay servers." Both are published in the same documentation set. A merchant reading only the plugin page would conclude the opposite of what the API requires. A CeyPay payment carries more customer personal data than a card payment does, which is the reverse of the usual crypto pitch.

Refunds Have No Native Path Except on Binance Pay

The refund policy↗ is short and unusually direct. CeyPay does not return crypto to the customer. "A refund is therefore a new, separate transaction that has to be arranged and sent back." Binance Pay is the only supported provider with native refund functionality. Where the originating platform offers no native refund function — which, among CeyPay's three providers, leaves Bybit and KuCoin — the policy tells the merchant to settle up off-platform: bank transfer, store credit or vouchers. And once funds reach you, "those settled transactions are considered final."

This is where the "no chargeback fraud" claim resolves: there is no chargeback fraud because there is no chargeback. Good for a merchant with a high dispute rate, bad for a customer who receives the wrong item. A card refund is a reversal on the same rail with a defined timeline. A CeyPay refund on Bybit is you making a bank transfer and reconciling it by hand. If you sell anything with a returns policy, write that workflow before you take the first payment.

The Regulatory Backdrop That Explains the Whole Design

Once you understand the Central Bank position, every architectural choice above stops looking arbitrary.

The Central Bank of Sri Lanka's published notice↗ of 29 March 2023 states that "cryptocurrencies are unregulated investment instruments which are not recognized as an asset-class in Sri Lanka" and "are not considered as legal tender in Sri Lanka". It adds that "Electronic Fund Transfer Cards (EFTCs) such as debit cards and credit cards are not permitted to be used for payments related to cryptocurrency transactions", resting on Directions No. 03 of 2021 under the Foreign Exchange Act No. 12 of 2017. CBSL issued escalating warnings in 2018, 2021, 2022 and 2023 plus a scam notice in January 2024, and says it has never licensed or authorised any business to operate schemes involving cryptocurrency.

Governor Nandalal Weerasinghe drew the operative line in remarks reported in September 2025: holding crypto is unregulated because no law addresses it, but "cryptocurrency cannot be used for transactions within the country". A secondary source, medium confidence, but consistent with every primary document.

Now read CeyPay's own legal-updates entry of 13 February 2026, maintained by its Legal and Compliance Team. It records that "The Central Bank of Sri Lanka has clarified that transactions between residents within Sri Lanka must be conducted in Sri Lankan Rupees (LKR), unless specifically authorized", and states the model in three lines: all merchant settlements are conducted in LKR; CeyPay does not facilitate resident-to-resident foreign currency transactions; and it does not convert LKR into foreign currency to credit local foreign currency accounts.

That is the design brief. Push the crypto leg offshore into an exchange the customer already uses, keep the only leg that touches Sri Lanka denominated in rupees, and settle over the national switch. Constraint-driven architecture, competently done.

Two tensions remain unresolved. The Withdrawals API reports both totalNetAmountLkr and totalNetAmountUsdt on every request, which is only an accounting convenience, but CeylonCash's own subsidy announcement of 10 February 2026 tells merchants they can choose whether to settle in crypto or fiat, and Bybit's launch release of 5 November 2025 offered "the flexibility to settle in crypto or fiat depending on their preferences". Neither squares cleanly with "all merchant settlements are conducted in LKR". And Bybit's launch release of 5 November 2025 offered "the flexibility to settle in crypto or fiat depending on their preferences". Those may reconcile through the aggregator role or non-resident arrangements; I could not determine which.

CeyPay's compliance claim is worth reading precisely: "Licensed & Compliant — Receive LKR through licensed exchange partners", hedged by a second card reading "CBSL Compatible — Designed to work with Central Bank payment and settlement frameworks." No jurisdiction, licence number or licensing authority is named for those exchange partners anywhere I could find. That is not an accusation of unlicensed operation: there is no VASP licence to hold in Sri Lanka, because no licensing regime exists yet. As of 11 July 2026 the designation of the Securities and Exchange Commission as prudential regulator for virtual asset service providers was still only a Cabinet memorandum, and the Central Bank had authorised no cryptocurrency exchange to operate in the country; Cabinet directed the drafting of the legislation itself in early September 2026. The posture is structural, not licensed. I go through what the 2026 legislative changes did and did not do in the Sri Lankan merchant guide to accepting crypto and in my earlier piece on cryptocurrency regulation in Sri Lanka.

The contracting entity in the Terms is Ceylon Cash (Private) Limited, under Sri Lankan law, with liability capped at total fees paid in the preceding six months. The Withdrawals API refers to approvals by "CeyLabs admins" — a different name. Which legal entity holds merchant funds between PAID and settlement is not stated in any document I read. That is the question I would put in writing first.

What CeyPay Solves, and Who It Should Suit

I have been specific about the gaps, so be equally specific about what works.

CeyPay solves a real problem: a visitor holding USDT on Bybit can pay a Colombo merchant, and that merchant receives rupees in a local bank account, without either party touching a P2P trade, an unregulated broker or a card rail that is not permitted for crypto anyway. A merchant who accepts Bybit Pay or Binance Pay directly ends up holding crypto and facing the offramp alone. CeyPay's product is the offramp.

The documented deployments fit that shape. Ahead of the Kankalu Colombo concert at Lotus Tower on 27 March 2026, CeylonCash announced that attendees would pay by QR code and payment link at designated merchant points rather than at POS terminals; the announcement names Kankalu Colombo as the partner, and no post-event account of how it actually ran has been published. Nisal Chandrasekara, Community Lead of CeylonCash, called it "a practical, responsible step toward normalising crypto payments in the country". The earlier Deep Jungle Festival at Sigiriya, 13 to 15 February 2026, was announced as running on Binance Pay with CeylonCash settlement rather than under the CeyPay brand. No vendor count or volume was published for either.

Who it suits, on what the documents support:

• Tourist-facing merchants at larger ticket sizes — hotels, dive schools, tour operators, high-value retail — where a 2% to 3.5% all-in cost is comparable to card acquiring and the customer prefers USDT.
• Event operators needing a cash-free, card-free point of sale for a few days who can live with manual refunds.
• Payment service providers and aggregators who want the LKR offramp as infrastructure. That is what the AGGREGATOR role and the 1.5% partner rate are for.

Who it does not suit: domestic small-ticket retail. CBSL's Payment and Settlement Systems Circular No. 02 of 2019 and its addenda cap the LankaQR merchant discount rate at 1% for domestic mobile payment applications, raised from 0.5% on 1 January 2025; financial institutions then removed the charge entirely on transactions up to Rs 5,000, effective 6 April 2026. Against a free rail running on the same CEFTS infrastructure, a gateway charging 2% or more has no domestic small-ticket case. Its market is cross-border and tourist spend at larger tickets, which is defensible.

What I Could Not Verify

• No merchant count, transaction volume or GMV is published. The figures in circulation are the November 2025 launch target of 100 merchants (50 Android POS devices and 50 digital activations) and the subsidy programme's "first 100 merchants" — both plans, not results. Bybit's launch release committed to "publicly announce all 100 selected merchants in a directory for users"; I found no such directory. The leaderboard the docs point to returned an HTTP 525 error on 14 September 2026.
• The WooCommerce plugin record on WordPress.org is independently queryable: slug ceypay-payment-gateway, version 1.3.3, added 25 August 2026, 118 downloads, 0 active installs, one five-star rating. Weak evidence on its own — the plugin was three weeks old when I queried it, WordPress.org rounds active installs so 0 means fewer than ten reporting, and merchants installing a zip supplied directly by CeyPay never appear in that count. Not proof of low adoption.
• The fee percentages above are illustrative values in API sample payloads, not a rate card. The contracted rate per merchant is unknown.
• The position held through 2026. Deputy Finance Minister Dr Anil Jayantha Fernando told Parliament on 11 July 2026 that cryptocurrencies are "not accepted as a means of payment", that Direction No. 3 of 2021 still prohibits card use for virtual currency transactions, and that "the Central Bank has not authorised any cryptocurrency exchanges, trading platforms, mining operations or related service providers to operate in Sri Lanka" (Daily FT, 11 July 2026↗). I found no CBSL statement dated September 2026 itself.
• An article dated 16 April 2026 on a crypto news site claims CBSL "integrated crypto payments into its payment ecosystem" for tourism. It cites no CBSL announcement and contradicts every primary CBSL document I read. Unverified, and I would not repeat it.
• No competitor offering crypto acceptance with LKR bank settlement surfaced in my research. In a market this small and this poorly indexed, absence of evidence is not evidence of absence.

If you are weighing a crypto rail against the rails that already exist here, the wider comparison is in my complete guide to Bitcoin in Sri Lanka, and the mechanics of the asset CeyPay moves are in how stablecoins work.

Key Takeaways

• The API takes one asset, not fifty. POST /v1/payment accepts USDT or LKR, with LKR auto-converted at creation, and a provider of BYBIT or BINANCE; KuCoin is absent from that enum despite the changelog and the WooCommerce page presenting it as a live provider.
• The crypto leg is an internal exchange transfer. The response returns a bybit:// deep link and a checkout.bybit.com page. Finality rests on the exchange's terms, not on block confirmations.
• The fee is two-part and the docs' own examples span 1.50% to 3.50%. Recomputed: LKR 30,000 at 2.5% exchange plus 1.0% CeyPay is LKR 1,050, or 3.50%. Sample values, not a rate card.
• An unquantified FX spread sits on top. exchangeRateSnapshot and rateUsdtLkr carry no mid-market benchmark; the risk-warning page names "conversion spreads" as a cost.
• Settlement is a pull with a daily cap. One active withdrawal request per merchant per day, a minimum threshold that returns HTTP 400, and manual review above an undisclosed auto-approval ceiling.
• Refunds are native only on Binance Pay. On Bybit and KuCoin a refund is a separate off-platform transaction you arrange yourself.
• The rupee rail is the moat. CEFTS bank codes, a 60-second FX lock and an AGGREGATOR-only offramp are the hard part; crypto acceptance is a thin layer over exchange checkout.

About the Author

I'm Uvin Vindula — a Web3 and AI engineer based between Sri Lanka and the UK. I ship production smart contracts and payment integrations, and I read API references before press releases, which is how this piece came about. You can see my work at iamuvin.com or reach out about a project at hello@iamuvin.com↗.

If you are deciding whether a crypto rail belongs in your checkout, let's talk about your project.