Sri Lanka has successfully concluded its National Risk Assessment (NRA) for 2024/25, focusing on Money Laundering (ML), Terrorist Financing (TF), and Proliferation Financing (PF). This comprehensive assessment was conducted in collaboration with 86 governmental organizations, regulatory bodies, and private sector institutions, involving approximately 200 experts. As the country’s third NRA, this evaluation sought to identify potential ML/TF/PF risks, highlighting the significant threats, vulnerabilities, and overall risk exposure faced by Sri Lanka.

The Financial Intelligence Unit (FIU) of the Central Bank of Sri Lanka (CBSL) coordinated the assessment under the guidance of the National Coordinating Committee (NCC) on Anti Money Laundering/Countering the Financing of Terrorism (AML/CFT). The assessment encompassed 15 core areas, including ML threat, ML vulnerability, vulnerabilities within the banking, securities, and insurance sectors, and risks associated with Designated Non-Financial Businesses and Professions (DNFBPs). Additional areas of assessment included TF risk, financial inclusion product risk, environmental and natural resource crimes, non-profit organizations, legal entities, virtual assets, tax crimes, and PF risk.

This third NRA is notable for several key features:

• The country’s inaugural national risk assessment of PF, conducted alongside ML and TF risk assessments.
• Strong participation from a diverse range of experts in both public and private sectors.
• An expanded scope covering 15 modules, introducing tax crimes risk and PF risk as new assessment areas.
• Consideration of global and regional ML/TF/PF risk contexts.
• Application of a clear and standardized rating framework, with defined interpretations for risk, threat, and vulnerability levels.

The national ML risk assessment involved evaluating the national ML threat and vulnerability. Sri Lanka’s overall national ML threat level was classified as medium, primarily due to major unlawful activities generating proceeds. The country’s overall ML vulnerability was also rated as medium, reflecting both the national capacity to combat these issues and sector-specific vulnerabilities. Consequently, Sri Lanka’s overall national ML risk was rated as medium, consistent with previous assessments.

Within the ML threat assessment, drug trafficking emerged as the most critical predicate offense, with its threat level rising to high from the previous medium-high rating. Fraud and customs-related offenses, including Trade-Based Money Laundering (TBML), were assessed as medium-high threats. The threat level for bribery and corruption decreased to medium, as indicated by an improved Corruption Perceptions Index (CPI) score, which rose from 32 in 2024 to 35 in 2025. Additionally, robbery, environmental and natural resource crimes, illegal, unreported, and unregulated (IUU) fishing, human trafficking, and tax offenses were identified as posing medium ML threats. Violations under the Excise Ordinance were assessed for the first time and rated as medium-low. Currency counterfeiting continued to reflect a low ML threat level, consistent with previous assessments.

The ML vulnerability assessment considered national combating ability by evaluating variables such as the effectiveness of ML crime definitions, comprehensiveness of asset forfeiture laws, quality of FIU intelligence, capacity and resources for financial crime investigations and prosecutions, integrity and independence of financial crime investigators and prosecutors, effectiveness of domestic and international cooperation, and availability of beneficial ownership information. The ML vulnerability of financial and non-financial sectors was also assessed.

Similar assessments were conducted for Sri Lanka’s TF risk, threat, and vulnerability. The national TF risk was assessed as medium-high, an increase from the previous medium level, due to evolving threats from extremist and separatist networks, diaspora funding, digital radicalization, regional spillover risks, and the use of informal and emerging financial channels. The TF vulnerability remained unchanged at a medium level.

The NRA also evaluated ML/TF risks related to legal persons (ML risk: Medium-High, TF risk: Medium) and arrangements (Medium), virtual asset service providers (Low to Medium), financial inclusion products/services (Low to Medium), and non-profit organizations at risk of TF abuse (Low to Medium).

This assessment marked Sri Lanka’s first national risk assessment of PF, which was rated as medium, reflecting a combination of significant global threat environments and identified domestic vulnerabilities.

Based on the NRA findings, 15 key recommendations have been made, leading to an update of Sri Lanka’s National Policy on AML, CFT, and Countering Proliferation Financing (CPF) for the 2026–2030 period.

The Executive Summary of the NRA 2024/25 is available on the FIU website (Sri_Lanka_NRA_on_ML_2024_25_Executive_Summary.pdf).

This assessment is a vital resource for both public and private sector stakeholders to understand the country’s current ML/TF/PF risk profile better and to enhance institutional risk mitigation strategies. By allocating resources to address higher-risk areas, stakeholders can safeguard the integrity and stability of Sri Lanka’s financial system. Institutions covered under Section 33 of the Financial Transactions Reporting Act, No. 6 of 2006, are advised to incorporate the NRA’s findings into their institutional risk assessments.

The FIU extends its sincere appreciation to all public and private sector institutions that contributed to this national endeavor.