Is CeyFi Safe? KYC, Custody and VASP Status

TL;DR

Is CeyFi safe? I cannot tell you it is safe or unsafe for Sri Lankans. Here is what is known. CeyFi launched on 2 November 2026, and its app says Didit runs identity checks. It requires a passkey before the first payment. Its footer says its VASP status is "pending confirmation". The same app's Safety sheet calls a company a registered VASP with the FIU. I found no FIU register confirming that. CeyFi says it never holds your crypto, but I could not test that. CeyFi sells from your Binance, Bybit or KuCoin balance, so exchange risk stays with you.

Disclosure: CeyFi links in this article use my referral code. If you sign up through one, we both earn Pills, CeyFi's reward points. uvin.lk, my Bitcoin education site, uses CeyPay's merchant gateway.

How do I judge whether CeyFi is safe?

Safe is a big word. I split it into two lists. What can be checked, and what cannot.

CeyFi is an app from the CeyPay team for people in Sri Lanka who hold crypto. It sells USDT for rupees and pays bills. I explain what it does in CeyFi explained.

USDT is a digital dollar token. KYC means "know your customer". It is an identity check. VASP means virtual asset service provider. It is a business that handles crypto for other people.

I read CeyFi's public pages and its launch post. I did not create an account or start identity checks. Everything below comes from what CeyFi publishes, plus outside sources I name. I did not test the app with money.

What does CeyFi say about identity checks?

CeyFi uses Didit for KYC. Its setup page asks for a photo of your NIC or passport and a liveness selfie. The app says it takes about two minutes.

CeyFi's launch post is dated 2 November 2026. It says you need "an account, and a verified identity, to cash out USDT, add a bank account or receive money" (CeyPay↗). Paying a bill does not need an account.

CeyFi's Safety sheet adds that Didit runs identity checks. It says every account gets anti-money-laundering, counter-terrorist-financing and sanctions screening "in line with CBSL and FIU expectations" (CeyFi↗).

That is a claim. I cannot see the screening. CeyFi also says payouts go only to an account in your own name, which limits where your money can be sent.

What the checks cost you: you hand your ID and a selfie to a third-party verifier. Read what Didit and CeyFi say about storing them before you start.

Is a passkey safe to use?

CeyFi's sign-in options are passkey, Google, email and mobile number. The app says a passkey is needed before your first payment. It shows "Face ID / Touch ID".

A passkey is a login stored on your phone. It replaces a password. You open it with your face or fingerprint. There is no password to type or steal.

The launch post also lists Apple sign-in. I did not find an Apple option in the live app. I note it as a mismatch, not a danger.

Which company runs CeyFi?

Two companies appear.

• The footer says "Operated by Ceylon Cash (PVT) LTD | PV00263673". The launch post names the same company and number.
• The Safety sheet names "CeyPay (PVT) LTD · Reg. PV00370646".

I could not match PV00370646 to a company record. The pages do not say which company holds funds or signs the contract with you. No CeyFi-specific consumer terms page was found. The CeyPay terms I found are dated 20 May 2026 and focus on merchants.

For you, this means one thing. If something goes wrong, it is not clear from the pages which company you would deal with. Ask support, in writing, before you sell a large amount.

Is CeyFi a registered VASP? Two statements that disagree

This is the most important part of this article.

CeyFi's footer says:

"Regulatory Status: Virtual Asset Service Provider (VASP) regulatory status pending confirmation under Sri Lanka's evolving regulatory framework."

The launch post of 2 November 2026 says the same in other words:

"Our Virtual Asset Service Provider (VASP) regulatory status is pending confirmation under Sri Lanka's evolving regulatory framework."

CeyFi's Safety sheet says:

"CeyPay (PVT) LTD · Reg. PV00370646 is a registered Virtual Asset Service Provider (VASP) with the Financial Intelligence Unit (FIU) of the Central Bank of Sri Lanka."

These two cannot both be the full picture. One says pending. One says registered.

I found no FIU register, notice or document that confirms any VASP registration. The Sunday Times reported on 6 September 2026 that Sri Lanka did not yet have a comprehensive regulatory regime for virtual assets. It said mandatory registration was still planned (Sunday Times↗). That is a news report, not an FIU document.

So I treat the "registered" line as an unverified company claim. It may be right. It may be an old or wrong line. I cannot tell. Ask CeyFi which statement is correct, and ask for the FIU document.

CeyPay's risk warning, last updated 22 June 2026, says it aims to align with the expectations of CBSL and the FIU. It makes no registration claim (CeyPay↗).

What does "controlled pilot" mean?

CeyFi's footer says: "Pilot Environment: CeyPay is currently operating within a controlled pilot environment with limited participation and applicable compliance and risk management measures."

In plain words: it is early, and only a limited number of people take part. Limits per sale and per day depend on your verification level, and they are not published.

The app's code also holds two lines whose status is unclear. Its "Send money" text says "We're finishing the bank rails and the regulatory sign-off", and an Ombudsman line carries the placeholder "[confirm applicable scheme]". I cannot tell whether either line is still in use.

The footer also says digital assets "are not legal tender in Sri Lanka" and are "subject to significant price volatility". It adds that the Central Bank neither issues nor guarantees them.

Does CeyFi hold my crypto?

CeyFi says it does not. Its Safety sheet says: "We never hold your crypto. Payments flow directly from your exchange to the biller. Your wallet is self-custody — export your keys any time."

I could not test this. I did not use an account. The app's code also treats a "CeyPay wallet" source in a way I could not explain, so how that wallet works is unclear.

Here is the practical point. When you sell or pay a bill, you approve a payment in your exchange app, and your USDT goes to CeyFi. The app's message for a failed bill payment starts "We received your USDT." The Safety sheet does not explain how that fits with "We never hold your crypto". Until you approve, your USDT sits with the exchange, so custody before a sale is the exchange's job.

What is the exchange risk?

CeyFi sells from Binance Pay, Bybit Pay or KuCoin Pay balances. So your exchange is a risk even if CeyFi is fine.

Binance said on 29 October 2026 that about $6.3 billion had been stolen in a security incident. It suspended all deposits and withdrawals, and about $3 billion was frozen (Al Jazeera↗).

On 1 November 2026 Binance said "user funds remain safe" and that it would absorb the loss (Binance↗). On 2 November it published a proof of reserves showing 1:1 backing for ten tokens, including USDT (The Block↗).

A proof of reserves is a snapshot of what an exchange held at one moment. It cannot show the exchange will stay solvent or secure (Cryptopolitan↗). See what Sri Lankan users should do after the Binance hack.

Do this: keep on the exchange only what you plan to sell soon.

What data does CeyFi collect?

The CeyFi page loads PostHog analytics, including a session-recorder script, for signed-out visitors, based on its network requests. Whether recording is switched on is set by CeyFi's server, and I cannot see it.

That is common on websites. It is still worth knowing. To be fair, the app's analytics setup masks all inputs and on-screen text in session recordings.

The app's footer links to Safety, Fees & limits and Help, but not to a privacy policy. The sign-in sheet does link to ceypay.io/terms↗ and ceypay.io/privacy↗. Ask support what is recorded.

What track record and support does CeyFi have?

Very little track record exists. The app is days old.

• CeyPay's status page lists CeyFi at 100% uptime and no incidents for November 2026. That is CeyPay's own monitoring (status page↗).
• I found no news coverage of CeyFi between 2 and 12 November 2026. I found no complaints either. In a small market, that is weak evidence.
• CeyPay's public docs have no CeyFi entry. Its latest product update is dated 17 July 2026 (docs↗).
• Support runs through a Telegram group and a support email. Test both with a small question before you sell.

CeyPay's older merchant business is covered in CeyPay crypto payments explained.

What the law says

CBSL said on 29 March 2023 that it "has not authorized" cryptocurrency exchanges, or "deposit-taking or custody services related to cryptocurrency". It has licensed no crypto business (CBSL↗).

CeyFi's own footer says its status is pending.

The CBSL Governor spoke on 3 November 2026. He said: "Under the current legal framework in Sri Lanka, digital assets, also called virtual assets, cannot be used for payments between residents." (CBSL↗)

Read is it legal to sell USDT in Sri Lanka for the full quotes. I am not a lawyer.

What is the verdict?

What CeyFi's own pages say:

• Didit runs KYC, and a passkey is needed before your first payment.
• Payouts go to a bank account in your name.
• VASP status is pending, and CeyPay runs a controlled pilot.

What follows from how it works:

• Exchange risk applies to every sale.

Not known:

• Whether any FIU registration exists.
• Which company holds the contract and the funds.
• Whether the custody claims are true.
• What the fees and limits are, until you see a signed-in quote.
• How the app behaves over months, since it is new.

If you still want to try it, start small. Sell a small amount first. Check the rupees land in your bank. Keep screenshots of the quote and the confirmation.

Try CeyFi: sign up at finance.ceypay.io↗. This is my referral link. If you use it when you create your account, we both earn Pills, CeyFi's reward points. CeyFi has not published what a Pill is worth.

I would not use this link just for Pills. If the unknowns above worry you, wait. P2P and exchange sales have their own risks, which I explain in P2P crypto in Sri Lanka: avoid a frozen account.

Quick answers

Is CeyFi licensed by CBSL?

I found nothing that says so. CBSL said in 2023 it had authorised no crypto exchange or custody service. CeyFi's footer says its status is pending.

Is CeyFi a registered VASP?

CeyFi gives two answers. The footer says pending. The Safety sheet says a company is registered with the FIU. I found no FIU document that confirms registration.

Who holds my USDT when I sell?

CeyFi says it never holds your crypto. You approve the payment from your exchange. I could not test this claim.

Is my ID safe with Didit?

I do not know. Didit does the identity checks. Read CeyFi's and Didit's privacy terms before you upload your NIC.

Should I try CeyFi with a large amount?

No. Start with a small sale and check the result. Raise the amount only after it works.

What I could not verify

• Any FIU register entry for CeyPay (PVT) LTD or Ceylon Cash (PVT) LTD.
• Which company holds funds and contracts with users.
• The self-custody and key-export claims.
• Payout speed. CeyPay says payouts are usually instant.
• Whether analytics recording is switched on.
• A CeyFi-specific privacy policy or consumer terms page.

Key Takeaways

• Nobody can call CeyFi safe or unsafe yet. It launched on 2 November 2026.
• CeyFi's footer says VASP status is pending. Its Safety sheet says a company is FIU-registered. I found no register confirming it.
• Two companies appear, with two registration numbers. Ask which one you contract with.
• CeyFi claims it never holds your crypto. This could not be tested.
• Exchange risk stays with you. Binance's 29 October theft shows why.
• Start with a small sale and keep records.

About the Author

I'm Uvin Vindula — a Web3 and AI engineer based between Sri Lanka and the UK, founder of uvin.lk↗, Sri Lanka's Bitcoin education platform, and author of The Rise of Bitcoin. I write plain-English guides so Sri Lankans can use crypto without getting burned. This is education, not financial advice. See my work at iamuvin.com or reach me at [email protected]↗.