AntiMoney Laundering (Amendment) (No.2) Regulations, 2020

1. Introduction

The AntiMoney Laundering (Amendment) (No.2) Regulations, 2020 (hereafter the 2020 Amendment) represent a significant update to the original AntiMoney Laundering (AML) framework. They were introduced to bring Sri Lankas AML regime in line with the latest international standards set by the Financial Action Task Force (FATF) and to address emerging risks related to virtual assets, nontraditional financial services, and evolving terrorist financing tactics.

This page provides a concise but comprehensive overview of the key changes, their purpose, and the practical implications for businesses, financial institutions, and professionals who must comply with the amended regulations.

2. Why the Amendment Was Needed

• Global Alignment: FATFs 2020 Recommendations expanded the scope of AML/CTF obligations, especially concerning virtual assets and convertible virtual currencies (CVCs).
• Risk Evolution: Rapid growth in fintech, digital payments, and cryptoassets created new channels for illicit finance.
• Regulatory Gaps: The original regulations did not adequately address nonbank financial institutions (NBFIs), money services businesses (MSBs), and realestate agents.
• Enforcement Strengthening: Enhancing powers of the Financial Intelligence Unit Sri Lanka (FIUSL) to obtain information, enforce sanctions, and share data internationally.

3. Scope and Coverage

The amendment broadens the definition of designated nonfinancial business and profession (DNFBP) to include:

• Realestate agents and developers
• Accountants, auditors and tax consultants
• Lawyers and notaries dealing with large monetary transactions
• Gaming and gambling operators
• Virtual asset service providers (VASPs)

These entities must now implement AML/CTF programmes that satisfy the same standards as banks and other financial institutions.

4. Key Provisions

4.1. Customer Due Diligence (CDD) and Enhanced CDD

The amendment clarifies the circumstances requiring enhanced CDD, including:

• Transactions involving Politically Exposed Persons (PEPs) and their close associates.
• Highrisk jurisdictions identified by FATF.
• Transactions linked to virtual assets or CVCs.

Institutions must now retain CDD records for at least ten years (up from five) and must verify the identity of beneficial owners for corporate clients holding >25% ownership.

4.2. RiskBased Approach (RBA)

All covered entities are required to conduct a documented risk assessment at least annually. The assessment must consider:

• Customer type and geography
• Products and services offered
• Transaction volumes and patterns
• Delivery channels (e.g., online, mobile, facetoface)

Based on the assessment, entities must allocate resources proportionately and apply appropriate AML controls.

4.3. Reporting Obligations

Four distinct reporting duties are now codified:

1. Suspicious Transaction Reports (STRs) must be filed within 30 days of suspicion.
2. Cash Transaction Reports (CTRs) for cash transactions USD15,000 (or equivalent).
3. Threshold Transaction Reports (TTRs) for noncash transactions exceeding USD50,000.
4. Annual AML Compliance Reports a summary of AML measures, risk assessments and training activities submitted to FIUSL.

4.4. Virtual Asset Service Providers (VASPs)

VASPs are now explicitly subject to AML obligations. They must:

• Implement robust KYC procedures for all users.
• Maintain a register of wallet addresses linked to verified identities.
• Monitor blockchain transactions using analytics tools.
• Report any suspicious activity related to cryptotransactions.

4.5. RecordKeeping and Data Retention

Records of customer identification, transaction data, and internal AML reports must be kept for a minimum of ten years and be readily accessible to the FIUSL upon request.

4.6. Training and Awareness

All employees of covered entities must receive AML training at least annually. Training programmes must be documented and tailored to the employees role, with a special focus on highrisk functions such as compliance, transaction monitoring, and senior management.

5. Enforcement and Penalties

The 2020 Amendment strengthens enforcement powers:

• FIUSL can issue binding enforcement notices requiring immediate remedial action.
• Failure to file an STR within the stipulated period may result in fines up toRs10million or imprisonment for up to two years, or both.
• Repeated noncompliance can lead to revocation of licences or bans from operating in the financial sector.

Importantly, the amendment introduces a proportionate liability regime, meaning senior executives and board members can be held personally accountable for systemic AML failures.

6. Practical Steps for Compliance

1. Map your obligations: Identify whether your organisation falls under the expanded DNFBP definition.
2. Conduct a risk assessment: Use a structured template to evaluate client, product, and geographical risks.
3. Update policies and procedures: Incorporate the new CDD, enhanced CDD, and reporting thresholds.
4. Invest in technology: Deploy transaction monitoring systems capable of handling both fiat and cryptotransactions.
5. Train staff: Develop rolebased training modules and maintain attendance records.
6. Engage with FIUSL: Register as a reporting entity, submit annual AML compliance reports, and cooperate promptly with any information requests.

7. Frequently Asked Questions

Q1: Do small businesses offering occasional cryptoexchange services need to comply?

Yes. If the business provides a platform for exchanging crypto for fiat, it is classified as a VASP and must meet the full AML obligations, regardless of size.

Q2: How does the amendment affect realestate transactions?

Realestate agents must verify the identity of purchasers and beneficial owners when the transaction value exceeds USD100,000, and file a CTR or STR where appropriate.

Q3: What are the new thresholds for cash reporting?

The cash transaction reporting threshold has been set at USD15,000 (or equivalent in Sri Lankan rupees). Any cash deposit or withdrawal equal to or exceeding this amount must trigger a CTR.

Q4: Is there a grace period for existing AML programmes?

Covered entities were given a sixmonth transition period from the date of Gazette notification to align their AML programmes with the amendment.

Q5: Can an entity be exempted from any of these obligations?

Exemptions are rare and must be granted by the Central Bank or FIUSL on a casebycase basis, typically for entities that have no interaction with highrisk customers or services.

8. Resources and Further Reading

• Financial Intelligence Unit Sri Lanka (FIUSL) Official Website
• Ministry of Finance AML Legislation
• FATF Recommendations and Guidance
• Central Bank of Sri Lanka Regulatory Notices