# Sri Lanka

> Sri Lanka (Central Bank of Sri Lanka · Financial Intelligence Unit): Unregulated rather than prohibited. Region: Asia-Pacific. Regime still forming: No settled rule on confidentiality yet; the framework is in draft or newly in force.

Part of the Soda Labs Privacy Hub regulation map, which reads the instruments
themselves rather than summarising the summaries: https://www.sodalabs.xyz/privacy-hub/regulation

## Key facts

- Entry type: Jurisdiction
- Region: Asia-Pacific
- Subject: Unregulated rather than prohibited
- Authority: Central Bank of Sri Lanka · Financial Intelligence Unit
- Stance on on-chain confidentiality: Regime still forming. No settled rule on confidentiality yet; the framework is in draft or newly in force.
- Tags: no licences issued, warning not ban, regulatory vacuum, PDPA 2022
- Canonical page: https://www.sodalabs.xyz/privacy-hub/regulation/jur-sri-lanka

## What it actually says

Sri Lanka occupies the position a lot of countries were in five years ago and few still are: crypto is neither licensed nor forbidden. The central bank has said it has authorised nobody to operate schemes involving virtual currencies and approved no token offering, and has warned about the risks, but it has not prohibited holding or trading. That leaves no privacy position to describe, because there is no regime to have one. It also leaves users without the protections a licensing regime brings. Movement toward registration of providers with the financial intelligence unit has been proposed rather than enacted, so the vacuum is the current state rather than a settled policy.

## The instruments that matter

- **CBSL public notice, 16 April 2018**: virtual currencies are not central bank issued currency, and the central bank has not licensed or authorised any entity to operate schemes involving them, nor authorised any initial coin offering
- **A warning, not a ban**: the notice sets out volatility, consumer protection and money laundering risks but stops short of prohibition, which distinguishes Sri Lanka from Bangladesh
- **Personal Data Protection Act No. 9 of 2022**: commenced in parts, with Part V from 17 July 2023 and further parts from 1 December 2023

## Sources

- [CBSL public awareness notice on virtual currencies](https://www.cbsl.gov.lk/en/news/public-awareness-on-virtual-currencies-in-sri-lanka)

## Related entries

- [Taiwan](https://www.sodalabs.xyz/privacy-hub/regulation/jur-taiwan): The travel rule that has never come into force
- [Australia](https://www.sodalabs.xyz/privacy-hub/regulation/jur-australia): Travel rule without a threshold, no coin ban
- [Bangladesh](https://www.sodalabs.xyz/privacy-hub/regulation/jur-bangladesh): Barred through exchange control, not a crypto law
- [China](https://www.sodalabs.xyz/privacy-hub/regulation/jur-china): Crypto banned, and a state currency designed for anonymity
- [Hong Kong SAR](https://www.sodalabs.xyz/privacy-hub/regulation/jur-hong-kong): Retail exclusion by liquidity gate, not by anonymity rule
- [India](https://www.sodalabs.xyz/privacy-hub/regulation/jur-india): No crypto statute, regulated through AML and tax