FATF Review: What It Means for Crypto in Sri Lanka

TL;DR

Sri Lanka is being tested on its anti-money-laundering rules. The Asia/Pacific Group on Money Laundering (APG) on-site visit is scheduled for 25 October to 6 November 2026. Its opening session was held on 26 October. FATF, the global standard setter, says crypto firms called VASPs must be licensed or registered, and that unlicensed ones must face sanctions. In 2026 Sri Lanka passed two laws that mention VASPs. It has not yet published a licensing law. None of this is a new rule for individuals today.

What is the FATF review of Sri Lanka?

FATF is the Financial Action Task Force. It sets global rules against money laundering and terrorist financing. It does not make Sri Lankan law.

The APG is the regional group that checks countries in Asia and the Pacific against those rules. The check is called a mutual evaluation. A team of assessors visits, meets banks, regulators and officials, and later writes a report.

Ada Derana reported on 28 October that the on-site visit is "scheduled from 25 October to 6 November 2026" (Ada Derana↗). It said the opening session was held on 26 October. I could not find an official statement on how the visit is going, and the outcome is not known.

What is a VASP?

VASP stands for Virtual Asset Service Provider. It is a business that handles crypto for other people.

Sri Lanka's Prevention of Money Laundering (Amendment) Act No. 16 of 2026 gives a definition (PMLA Amendment Act text↗). A VASP is a person who "conducts one or more of the following activities or operations for, or on behalf of, another person". The first item is "(a) exchange between virtual assets and fiat currencies". The Speaker certified the Act on 4 August 2026, and it was gazetted on 7 August 2026.

An exchange of crypto for rupees, done for someone else, is the first example on that list. That does not tell you who counts, as I explain below.

What does FATF Recommendation 15 require?

Recommendation 15 is the FATF rule about virtual assets. FATF's October 2021 guidance sets out its text (FATF guidance, hosted copy↗). It says VASPs must be "regulated for AML/CFT purposes, and licensed or registered and subject to effective systems for monitoring and ensuring compliance". AML/CFT means anti-money-laundering and counter-terrorist-financing.

The notes to the rule add a second duty. Countries must "identify natural or legal persons that carry out VASP activities without the requisite license or registration, and apply appropriate sanctions". So FATF expects a country to do two things: set up a licence or registration system, and act against people who work outside it.

FATF's own site blocked my access. I read the guidance from a copy hosted by Romania's anti-money-laundering office.

What laws has Sri Lanka passed so far?

Two laws from 2026 touch VASPs. Neither is a licensing law.

1. Financial Transactions Reporting (Amendment) Act, No. 17 of 2026. Parliament says the Speaker certified the bill on 4 August 2026. It adds VASPs to the definition of "financial business" under the Financial Transactions Reporting Act of 2006 (Parliament↗). I could not retrieve the Act's full text. So I cannot tell you what it now requires of VASPs, or when that starts.
2. Prevention of Money Laundering (Amendment) Act, No. 16 of 2026. It defines a VASP and a "virtual asset". The definition of virtual asset "does not include any digital representation of fiat currencies".

That last phrase leaves a gap. Does a dollar stablecoin like USDT count as a "digital representation of fiat currencies"? The Act does not say.

The FIU's own survey notice of March 2026 is narrower: it says virtual assets do not include "digital representations of fiat currencies issued by a Central Bank" (FIU notice↗). USDT is issued by Tether, a private company, so on the FIU's reading it would count as a virtual asset. That is the FIU's notice, not a court ruling or the Act.

If you want the basics on USDT first, read what USDT is.

Has Sri Lanka already asked crypto businesses for information?

Yes. On 1 March 2026 the Financial Intelligence Unit (FIU), part of CBSL, issued a mandatory survey notice (FIU notice↗). It says the FIU "is conducting this mandatory information survey for all VASPs operating in Sri Lanka". It covers anyone providing the listed services "as a business". The list begins with "exchange between virtual assets (such as cryptocurrency) and fiat currencies".

A survey is not a licence. It collects facts. The notice does not say that answering gives a business any permission.

What is still not decided?

This is the main point of the article. Much of the framework is a plan.

What officials said. A written answer was read into Hansard on 9 July 2026 (Hansard↗). In it, the FIU's phased plan set July to December 2026 for "Identification of a prudential regulator for Virtual Asset Service Providers". The same answer said a Cabinet memorandum sought to make the Securities and Exchange Commission (SEC) that regulator. Prudential regulator means the body that supervises these firms.

What has not happened. I found no published draft bill, no licensing rules and no list of licensed VASPs. The same answer said "Crypto assets are not regulated in Sri Lanka as an asset class or a financial instrument." I found no later official text that changes that.

What could it mean for P2P and local services?

The next part is my reading, not a fact.

FATF's second duty, acting against unlicensed VASP activity, is the rule that matters most for local services. A company that turns USDT into rupees for customers matches the activity in the PMLA definition and in the FIU survey. Once a licence system exists, that company would likely need to apply. Until then, no text I found says what it must do.

For individuals, I found no text that covers one person selling USDT to another. My view is that the early focus will be on businesses. FATF's rule speaks about persons carrying out VASP activity, and the survey asks about services "as a business". That is a reading, not a rule. A person who trades often, or for many others, could look more like a business. Nobody has set a line.

For P2P trading in particular, see how P2P trades and bank freezes work.

Why does the review matter to ordinary users?

The review result is a report card for the whole country. In my view, a weak grade on VASPs would push the government to act faster, and a good grade would ease the pressure. I cannot predict which one comes, and no source says what the assessors found.

What the review cannot do is change a Sri Lankan law by itself. Only Parliament does that. So watch for two things after the visit: a published report, and a draft VASP bill. Both should be made public. Until then, the rules for ordinary users stay as they are.

What should I do now?

1. Do not rush to change anything. I found no new published rule for individuals because of the visit.
2. Keep records of every crypto trade. Date, amount, rupees, who paid.
3. Use your own bank account only. Avoid payments from or to third parties.
4. Be careful with any local service. Ask it plainly if it has any regulatory status. If its answer is vague, treat it as unregulated.
5. Watch for the draft VASP law. It will show who needs a licence.

For the wider legal picture, see crypto regulation in Sri Lanka in 2026. For how neighbours handle this, see South Asia crypto in 2026.

Quick answers

What is the FATF review of Sri Lanka in 2026?

It is the APG's mutual evaluation of Sri Lanka's anti-money-laundering rules. The on-site visit is scheduled to run from 25 October to 6 November 2026. The APG's schedule lists Sri Lanka's report for its 2027 plenary (APG schedule↗), but I could not confirm an exact date.

What is a VASP in Sri Lanka?

It is a business that handles virtual assets for others. The 2026 money laundering amendment lists exchange between virtual assets and fiat currencies as the first example. A licensing law for VASPs has not been published.

Will crypto be banned because of the FATF review?

No source says so. FATF's Recommendation 15 asks for licensing or registration, and sanctions for unlicensed activity. That is regulation of businesses, not a ban on holding crypto.

Does the 2026 law say USDT is a virtual asset?

The Act does not say. It excludes "digital representation of fiat currencies" without saying whether USDT falls inside that phrase. The FIU's March 2026 survey notice excludes only those issued by a central bank, so on the FIU's reading privately issued USDT would count, but a notice is not the Act.

Has Sri Lanka licensed any crypto exchange?

I found no list of licensed VASPs and no licensing law. On 9 July 2026 the government told Parliament that crypto assets are not regulated as an asset class or a financial instrument.

What I could not verify

• The full text of the Financial Transactions Reporting (Amendment) Act No. 17 of 2026, including its duties and start date.
• Any official statement on the APG visit or its result. The visit dates rest on one news report.
• Whether USDT counts as a "virtual asset" under the 2026 Acts themselves. Only the FIU's survey notice points to an answer.
• Any published draft VASP bill, licence conditions or deadline.

Key Takeaways

• The APG on-site visit is scheduled to run from 25 October to 6 November 2026. The result is not out.
• FATF Recommendation 15 expects VASPs to be licensed or registered, and unlicensed activity to be sanctioned.
• Two 2026 laws mention VASPs. Neither is a licensing law.
• The 2026 Act does not say whether USDT is a virtual asset. The FIU's survey notice reads it as one, but a notice is not the Act.
• Individuals face no new published rule. Keep records and use your own bank account.
• Watch for the draft VASP bill. It will answer who needs a licence.

About the Author

I'm Uvin Vindula — a Web3 and AI engineer based between Sri Lanka and the UK, founder of uvin.lk↗, Sri Lanka's Bitcoin education platform, and author of The Rise of Bitcoin. I write plain-English guides so Sri Lankans can use crypto without getting burned. This is education, not financial advice. See my work at iamuvin.com or reach me at [email protected]↗.