Repression by regulation: When FATF mutual evaluations become Government weapons

Central Bank Governor Dr.Nandalal Weerasinghe

Justice Minister Harshana Nanayakkara

Treasury Secretary Dr. Harshana Suriyapperuma

The AML/CFT Task Force Chairman Justice Buwaneka Aluwihare, PC

Practice eroding standards

Sri Lanka is currently undergoing mutual evaluation by the Financial Action Task Force (FATF), the global interGovernmental money laundering and terrorist financing watchdog. The Government’s participation in the evaluation is being led by the Financial Intelligence Unit (FIU).

 In the run-up to the site visit to Sri Lanka by the Asia Pacific Group of FATF in October 2026, the Government is implementing various initiatives, including legislative reform, which it believes are required to be rated ‘compliant’ with FATF standards. However, many Government actions related to Non-Profit Organisations (NPOs), i.e. non-Governmental organisations (NGOs)/civil society organisations (CSOs), contravene FATF Recommendation 8 on NPOs. 

 FATF requires measures to counter money laundering and financing terrorism to be “focused, proportionate and risk-based…without unduly disrupting or discouraging legitimate NPO activities”, rather than broad, arbitrary, blanket measures that impact all CSOs. Examples of misalignment of Government action with FATF standards include the attempt to enact a repressive law to restrict the activities of CSOs and require mandatory registration of all NGOs under a single law. The contravention of Recommendation 8 has been brought to the attention of the Government numerous times. Yet, it has not course corrected. 

 Being rated compliant by FATF is critical to Sri Lanka as it influences international trust in the integrity of national financial systems and will impact foreign investment. Hence, the question is, why has the FIU, which is assumed to have the expertise to understand FATF standards, adopted this misguided strategy which seems to be founded on prejudice and paranoia and makes Sri Lanka non-compliant with Recommendation 8? The probable answer is that Sri Lanka authorities, particularly the security agencies, have viewed NGOs/CSOs with deep suspicion for decades and are constantly seeking ways to control and limit their activities. 

 The proposed amendment increases the period the FIU can instruct financial institutions to suspend or not to proceed with carrying out a transaction, from seven to fourteen days. The existing law allows the FIU to make an ex-parte application to the High Court of Western Province and obtain an order to extend the  extension of the hold without specifying the maximum period of validity of such an order. This violates the due process rights of the account holder or person making the transaction as the person is not given an opportunity to challenge the hold

 Increasing risk: Government’s Risk Assessment of NPOs

 The Government’s risk assessment (RA) of NPOs, which was published in January 2026 concludes that the inherent risk of the non-profit sector is low to medium. Environmental, health and sanitation and entrepreneurial development CSOs are rated low risk ‘due to no evidence of terror financing abuse of these categories’. Additionally, the RA states ‘These NPOs are not proximity (sic) to active terrorist threats as per views of sector experts due to the fact that most of the projects done by them can be physically verified’.

 Relief and human rights NPOs are rated medium-low risk, yet, there is no evidence provided in the nine page report to substantiate the higher risk rating. To date, no relief or human rights NPO has been convicted of financing terrorism or money laundering. The report goes on to say, ‘The information collected transpired that the intelligence services are still monitoring several NPOs which carry out relief work in areas identified as high risk and NPOs formed for the purpose of safeguarding of human rights’. This shows all NPOs that work on human rights are viewed with suspicion. However, the objective criteria on which basis they were identified as higher risk is not specified. The RA asserts that unnamed and an unknown number of ‘Sector experts are of the view that these NPOs could be susceptible to be abused for TF activities’. Once again, there is no evidence provided to substantiate this claim. 

The report reveals the Terrorism Investigation Division (TID) is investigating several NPOs of which 13% are human rights organisations, 80% work on education and training and 7% provide relief. The elements the report deems are gaps in the legal and regulatory framework are revealing of the true intent of the state, i.e. to control and restrict the activities of NPOs. For example, one of the gaps identified is the lack of punitive measures against CSOs that do not register under the Voluntary Social Services (VSSO) Act as well as the absence of a legal requirement to re-register. Another gap is ‘no specific provisions to depoliticise INGOs and NGOs’; there is no explanation provided on what politicising means in this context nor how that is connected to preventing terrorism financing. 

Guidelines on Preventing Money Laundering and Terrorist Financing for NGOs in Sri Lanka

In February 2026, the NGO Secretariat issued Guidelines on Preventing Money Laundering and Terrorist Financing for NGOs in Sri Lanka.

The Guidelines identify NGOs receiving large donations and those operating in remote areas as risk factors. NGO platforms being used for ‘radicalisation or promotion of extremist ideologies’ is also listed as a concern. But the terms radicalisation or extremist ideologies are not defined and hence can be construed as broadly as the state wishes. For instance, advocating for rescinding the IMF agreement could be deemed ‘extremist’. 

The Guidelines require NGOs to issue annual certificates confirming compliance with AML/CFT as well as appoint a coordinator for AML-CFT, none of which are mandatory requirements stipulated by FATF to be applied to all NPOs. Foreign donors are automatically deemed suspicious, which the Guidelines state demands enhanced due diligence by CSOs. 

Being rated compliant by FATF is critical to Sri Lanka as it influences international trust in the integrity of national financial systems and will impact foreign investment

Law reform: The Convention on the Suppression of Terrorist Financing Act and the Financial Transactions Reporting Act 

The Government has proposed amendments to the Convention on the Suppression of Terrorist Financing Act and the Financial Transactions Reporting Act, which it claims are to comply with FATF standards. The amendments seek to strengthen provisions in the law that undermine human rights protections, such as due process rights. The Convention on the Suppression of Terrorist Financing Act for example defines terrorism broadly and categorises acts such as damage to property and disruption of an electronic system as terrorist acts, which does not align with internationally accepted parametres of what is deemed a terrorist act nor with the revised model definition of the UN Special Rapporteur on Protecting Human Rights and Countering Terrorism. 

 The amendment to the Convention on the Suppression of Terrorist Financing Act increases the period for which a police officer of the rank of Assistant Superintendent (ASP) and above is empowered to freeze assets from seven to fourteen days. Following the conclusion of fourteen days, the current law allows the police to make an ex parte application to extend the order. An ex parte application denies the affected person the opportunity to challenge the order and undermines their due process rights. The proposed amendment allows any person affected by the freeze order to petition the High Court against the order, which in practice will be difficult for a person whose assets are frozen. 

 The proposed amendment to the Financial Transactions Reporting Act requires all banks to report all transactions above a certain as yet unspecified amount. This type of reporting, which is not based on reasonable suspicion of ML/FT but is a blanket requirement applicable to all financial institutions, does not align with the risk-based, proportionate method set out by FATF. Moreover it is an administrative burden for banks. Such a requirement, coupled with the conclusions of the Risk Assessment of NPOs and the Guidelines will most certainly result in particular types of CSOs, such as human rights NGOs, being constantly flagged without a valid reason and investigated by the Terrorism Investigation Division (TID). It should be noted that the interpretive note on FATF Recommendation 10 on customer due diligence states that financial institutions do not need ‘to repeatedly identify and verify the identity of each customer every time that a customer conducts a transaction’. Such arbitrary, sweeping measures do not adhere to Recommendations 10 and 20.

The proposed amendments state the FIU is ‘operationally independent and autonomous’ but make no mention of the oversight authority; it only states FIU’s annual report is to be handed to the (relevant) Minister. 

Terrorism Investigation Division (TID) is investigating several NPOs of which 13% are human rights organisations, 80% work on education and training and 7% provide relief. The elements the report deems are gaps in the legal and regulatory framework are revealing of the true intent of the state, i.e. to control and restrict the activities of NPOs

 Amendments to both laws allow the FIU to share information with other entities, including international entities. Yet, neither the laws nor the proposed amendments set out protections related to data retention, the protection of privileged information or the deletion of personal information. Given the shortcomings in the Personal Data Protection Act and the general lackadaisical attitude to oversight of IT systems and cyber security, including at financial institutions as demonstrated by the recent Rs. 13.2 billion fraud at the National Development Bank, this raises grave concerns. 

 The proposed amendment increases the period the FIU can instruct financial institutions to suspend or not to proceed with carrying out a transaction, from seven to fourteen days. The existing law allows the FIU to make an ex-parte application to the High Court of Western Province and obtain an order to extend the  extension of the hold without specifying the maximum period of validity of such an order. This violates the due process rights of the account holder or person making the transaction as the person is not given an opportunity to challenge the hold. Furthermore, the amendment affirms the proceedings are to be in-camera, undermining the transparency of court proceedings. Given banks continue to prevent CSOs, especially those working in the North and East, from receiving foreign funds without a valid basis, this provision will only exacerbate arbitrary action by banks.

 The proposed amendment to the Financial Transactions Reporting Act requires all banks to report all transactions above a certain as yet unspecified amount. This type of reporting, which is not based on reasonable suspicion of ML/FT but is a blanket requirement applicable to all financial institutions, does not align with the risk-based, proportionate method set out by FATF. Moreover it is an administrative burden for banks

The establishment of a National Committee consisting of various state actors and chaired by the Governor of the CBCSL ‘to coordinate and oversee the implementation of the national policy of Sri Lanka on Anti-Money Laundering, Countering the Financing of Terrorism and Financing of Proliferation of Weapons of Mass Destruction and provide necessary guidance in the formulation of such national policy’ is introduced in the amendment. While appearing to be merely a coordinating body it is bestowed with power ‘to give either general or specific directions to any regulatory authority or stakeholder for the implementation of recommendations and decisions of the Committee’. If their directions are not implemented the Committee can refer the issue to the Cabinet of Ministers, which can direct the entity to comply. This provision disregards that different laws govern different entities and they are accountable to their respective oversight bodies, all of which seems to be superseded by the Committee. 

Section 29 A introduced in the amendment empowers the head of the FIU to make rules, which does not require the authorisation of any other entity. It should be noted the Supreme Court in its determination on the Colombo Port City Economic Commission Bill ruled it is unconstitutional to make rules without Parliamentary control. It is particularly applicable in this instance as the rules made by the head of the FIU can have severe adverse impacts on all aspects of a person’s life as it targets financial resources. 

 FATF recognises that blanket and arbitrary measures can drive financial flows underground, thereby undermining the entire purpose of the FATF standards and instead increase terror financing risks. The Government needs to heed this. 

 FATF recognises that blanket and arbitrary measures can drive financial flows underground, thereby undermining the entire purpose of the FATF standards and instead increase terror financing risks. The Government needs to heed this