“Cards on the table”: What new gambling Bill means for Sri Lanka’s casino future

Broad powers of inspection, vague data handling rules, and undefined public interest clauses could deter foreign investors unless the Bill is supported by clear timelines on data retention periods, transparency on confidentiality protocols, and safeguards against arbitrary action. To attract foreign operators, Sri Lanka should consider embedding stronger procedural protections, and licensees may seek negotiated terms such as non-disturbance clauses, dispute resolution, land security rights, arbitration options and indemnities into their license agreement to hedge against regulatory overreach

Gambling in Sri Lanka has long been governed by a patchwork of laws and casinos have operated for decades under various licensing regimes. So why is the Gambling Regulatory Authority Bill creating such a buzz? Is it the potential for stronger governance and investor confidence? Or is it excitement driven by the big names behind the scenes, like Melco Resorts & Entertainment, a global casino giant now entering the Sri Lankan market? Or perhaps is it the rumours of Bollywood superstar Shah Rukh Khan attending the grand opening of the Cinnamon Life casino that’s capturing the imagination of the public. 

With this new development, what is clear is that Sri Lanka’s casino industry is poised for transformation and this Bill, with all its promises and pitfalls, is at the centre of it. The Bill marks a significant transition from a previously fragmented regulatory environment to a centralised authority vested with both administrative and enforcement powers. Several issues merit further scrutiny to ensure the framework is implemented with transparency and regulatory certainty, especially where large foreign investors are entering and operating in Sri Lanka. 

Suspension, search and seizure

Investors need confidence that their licence will not be revoked, cancelled or suspended arbitrarily. The Director-General (DG) has broad administrative and supervisory powers over the entire gambling licensing process and enforcement. The Authority has broad investigatory powers to enter, inspect, seize documents, and access computer systems based on “reasonable grounds,” which is not clearly defined. The DG has broad authority to reject, suspend, or cancel licences, with relatively vague language like “charged for the commission of an offence,” which raises serious concerns for foreign investors. The absence of a requirement for conviction means that even preliminary, unproven allegations, regardless of merit, could result in immediate operational disruption. 

No judicial warrant is explicitly required before such inspections, which could raise due process concerns. The ability to access, reproduce, share extensively and remove data from computer systems may raise cybersecurity and confidentiality issues, particularly for global operators with sensitive customer data. In jurisdictions with weak institutional checks and balances, such open-ended powers are vulnerable to abuse and potentially used for political leverage, especially in high-stakes industries like gambling. 

The Bill demands recording of every single transaction, no matter how small (e.g., Rs. 500 chips or a loyalty point redemption), for thousands of guests per day that may create a massive compliance overhead. Requiring operators to keep full transactional and personal data of all patrons without time limits or data minimisation will be problematic for global investors who are subject to multi-jurisdictional data privacy laws. 

To attract global investors, the GRA Bill should move toward a contractual, transparent, and legally mature model similar to Macau and Nevada. Macau and Nevada have licensing decisions that are governed by public tender frameworks or a licensing commission with published rules, whereas the Bill gives excessive discretionary power to the DG and Minister, with no published criteria or safeguards and no mention of rights being enforceable through contractual mechanisms. 

Gatekeepers of compliance: Who watches them?

The DG also has broad and subjective powers to assess the “fitness and propriety” of directors, shareholders, key management personnel, and beneficial owners. If any shareholder or director is deemed unfit, the DG can impose a condition requiring their removal before granting the license. This creates complications for companies with international shareholding structures and layers of beneficial ownership, which may require restructuring even before operations begin. Comparatively, Singapore and UK require fitness tests, with a clear suitability criterion which support investor confidence. 

Nowhere in the Bill does it state that existing licence holders will continue under the new regime without further scrutiny or reapplication. Unless Sri Lanka adopts a similar framework, it risks discouraging serious FDI in its gaming sector. In fact, after obtaining a gambling licence under the Bill, which itself requires extensive scrutiny of company structure, directors, and shareholders, there are provisions in the Bill that adds a second, independent registration process for the physical premises. This duplication increases bureaucracy and delays for foreign investors, for example an operator could receive a licence, invest in construction, and then be denied the premises registration due to a later change in political sentiment or informal objections by the DG. Jurisdictions like Singapore, UK and Philippines operate where there one unified, predictable approval process.

Blurred lines

The Bill does not define what qualifies as digital gambling. This lack of clarity creates uncertainty for global operators who operate across digital and physical verticals. Furthermore, requiring a separate licence for digital gambling creates an unnecessary barrier, especially if the company is already heavily regulated under the main licence.

The minimum capital threshold is not fixed in the Bill and may be changed at any time by Gazette notification by the Minister. Foreign investors prefer predictable capital requirements at the time of entry and these variable thresholds create barriers to entry as they could face sudden increases in required capital, unfair treatment relative to competitors or regulatory manipulation. Comparatively, the Macau Gaming Law impose stringent requirements on concessionaires, including a minimum share capital of MOP 5 billion for casino concessionaires.

Furthermore, the term “gambling software” or “casino” is not defined in the Bill. The provision requires separate licensing for every entity that develops, distributes, or operates gambling software. Many foreign operators use third party vendors who may not be willing or able to obtain Sri Lankan licences, especially for non-revenue-generating software modules. The law does not differentiate between B2C gambling platforms (e.g. operator’s front-end) and B2B middleware/back-end solutions (e.g. AI analytics, fraud detection). Without a clear scope, foreign operators could unintentionally fall into non-compliance for using or customising softwares.

“Adverse impact on the public” – Should that cost you your casino license?

The criteria for denying renewal of licenses are still broad such as “any adverse impact on the public” or due to “public complaints”. The language used is vague and leaves room to deny renewal arbitrarily, if misused. It may be prudent to clarify or define what constitutes such an impact (e.g., public health data, security incidents, etc.). While appeals are covered in the Bill, which provides some procedural protection, it must be noted that the first appeal is administrative (i.e., to the Secretary) and not judicial, which may still raise concerns about impartiality for investors. Investors may worry about lack of perceived neutrality or bureaucratic delay where appeals are made to the Minister and not to an independent tribunal, which means that the DG’s decisions are rarely subject to impartial judicial oversight.

Even minor, technical breaches of complex laws like the Inland Revenue Act or Foreign Exchange Act could result in suspension. There is no requirement for a conviction or even formal charges, just a “contravention.” While linking licences to compliance with financial crime laws (AML/CFT) and tax laws is standard in global gambling regulation, a tiered approach such as warnings, fines, temporary restrictions before full suspension, may work better to limit suspension to serious breaches. 

Regulatory roulette: Minister’s discretion to raise investor concern? 

The Bill grants the DG power to evaluate evidence, decide on fines, issue certificates to courts, trigger magistrate action and even reject defences. This lack of separation between investigator and judge can raise red flags in international investment contexts. The Singapore Casino Control Act and UK Gambling Commission both include rights to appeal enforcement actions before an independent tribunal and clearly defined administrative penalties and procedural rules. The Bill grants the minister broad discretionary powers to issue general directions to the Gambling Regulatory Authority regarding its powers and functions, which poses a regulatory risk where sudden changes or enforcement might occur without due process. Where discretion is wide, transparency is limited and enforcement becomes politicised and accordingly the Bill should ensure a clear separation between political direction and regulatory implementation.

Non-payment of a regulatory fine is treated as a criminal offence in the Bill and enforced through Magistrate’s Court, with sentencing provisions governed by the Code of Criminal Procedure, effectively criminalising regulatory breaches. This blurs the line between civil regulation and criminal liability, which is a red flag for global companies and may be seen as harsh and investor unfriendly.

In Singapore enforcement of regulatory fines falls under civil recovery only and there is no automatic criminal escalation. Additionally, in the UK, appeal rights are allowed on facts, law, and discretion whereas the current Bill only allows appeals to the Court of Appeal on a question of law (not on facts, evidence, or procedural issues). Australia has broader appeal rights and fines are enforceable through administrative tribunals, where judicial review is available. 

The Bill allows the Government of Sri Lanka to acquire land “for the Authority” under the Land Acquisition Act, which is treated as a “public purpose.” This may also be a cause for concern to global operators as there is no mention of protections for foreign-owned leasehold interests. 

Low fines, high stakes

The Bill imposes a maximum penalty for providing false or misleading information (Rs. 100,000) which is insignificant relative to the billion-dollar investments of the Cinnamon Life Casino. This can appear to undermine the seriousness of regulatory compliance. The real risk is not the fine, it is the criminal conviction and imprisonment where directors, managers, or even the licensees could face up to two years of imprisonment. For a publicly listed company, even a minor violation resulting in conviction or imprisonment of personnel could cause major reputational damage and regulatory fallout in other jurisdictions. 

Where high rollers meet high compliance

While a main cash desk operated by the licensee to receive currency i.e., cash or via debit or credit card, creates a single point of record for all financial inflows and outflows, and aims to increase investor trust it also prohibit direct digital/mobile transactions. Accordingly, this may limit cashless innovation and limit use of modern payment solutions which may restrict VIP/private play, and reduce customer convenience for those high rollers who prefer pre-settled credit arrangements or non-cash digital methods. Ambiguity around whether electronic payments or credit gaming pathways are permitted could limit flexibility for junket and premium mass operations which global operators rely on.

Pushing junkets off the table

The definition of ‘junket operator’ in the bill is wide and over inclusive where it could unintentionally cover wide range of otherwise benign actors into regulated junket operators like travel agents organising casino resort packages and concierge services at luxury hotels. The Bill also requires that junket operators shall satisfy the DG of their financial stability, integrity, and competence. 

Many small or offshore junkets will not have the infrastructure to comply with the requirements in the Bill to maintain “accurate and complete” records of all transactions and patron details. The Bill imposes conditions on the casino to ensure each junket-sourced patron meets legal requirements and report any suspicious activity by the junket operator which discourages junkets entirely. Junkets licensed in other countries (e.g., under Macau or Philippine jurisdictions) are not recognised or fast-tracked under the Bill.

State-backed lotteries exempt

Lotteries conducted by the Development Lotteries Board and National Lotteries Board are exempt from the provisions of this Act. This means they are not subject to the same licensing, compliance, AML/CFT, or advertising restrictions. The exemption protects two state-owned entities that dominate the lottery market, even as private sector operators face tight controls which means if foreign investors intend to diversify they cannot enter the lottery space independently or under GRA licensing, so this door is closed to them. 

Marketing under scrutiny

The Bill requires that every gambling licensee must be physically displayed in a conspicuous place on the premises, and while this may be well-intended it might be impractical. Physically displaying all documents at each entrance or room is operationally unfeasible and is an outdated approach as global operators use digital displays, mobile apps and QR codes. The Bill criminalises certain types of gambling advertising, particularly those that contain false, deceptive, or misleading information about the nature of gambling, risks involved, or chances of winning. While this is important to balance national interests it also uses subjective language like “improve social status,” “deceptive” or “misleading” without defining them. Without clear guidance, marketing campaigns could unintentionally breach the law and may be important to introduce compliance guidelines or pre-approvals for example in the UK all broadcast gambling ads must be pre-cleared by Clearcast before airing in accordance with the UK ASA code. 

Macau has a concession contract model with the government, which works transparently, with defined durations (10 years) and conditions clearly set with performance reviews mandated every three years. These concession contracts require operators to promote their resorts both locally and internationally, albeit in coordination with the Macau SAR Government’s foreign promotion strategy and in compliance with applicable advertising restrictions.

Enhancing legal certainty and investor safeguards

Broad powers of inspection, vague data handling rules, and undefined public interest clauses could deter foreign investors unless the Bill is supported by clear timelines on data retention periods, transparency on confidentiality protocols, and safeguards against arbitrary action. To attract foreign operators, Sri Lanka should consider embedding stronger procedural protections, and licensees may seek negotiated terms such as non-disturbance clauses, dispute resolution, land security rights, arbitration options and indemnities into their license agreement to hedge against regulatory overreach.

The Bill also raises concerns about foreign licensees that may be held accountable for acts beyond their control, without due process. To mitigate this, the legislation should introduce safe harbour provisions for owners or executives who acted in good faith and exercised due diligence, for example by inserting grace periods and compliance notices prior to prosecution, especially for administrative oversights. Vague terms like “knowingly or having reason to believe” should be clarified to avoid unintended criminal liability for directors or staff without demonstrable intent. If these changes were made, it would foster a more transparent and stable regulatory environment, conducive to long-term foreign investment in this sector.

Risks of regulatory overreach

In assessing Sri Lanka’s Gambling Regulatory Authority Bill, one cannot ignore the broader legislative and regulatory context in which it is being introduced. A particularly telling parallel lies in the proposed amendments to the Companies Act, No. 7 of 2007, which seek to introduce beneficial ownership registers to be maintained both by companies themselves and the Registrar of Companies.

This move, though perhaps well-intentioned from a transparency standpoint, mirrors a broader trend of regulatory overreach that may be viewed as onerous for investors. Investors may rightly question why a developing economy is adopting stricter-than-OECD standards. The GRA Bill, when read in conjunction with the Companies Act amendments (which are still only under consideration), reinforces a message that discretion, privacy, and commercial confidentiality, all critical for high-profile investors, may be at risk. Adding public beneficial ownership disclosures compounds the risk to foreign investors, especially in a sector already prone to public and media scrutiny. Transparency is essential, but overregulation, without balancing commercial realities, risks undermining the very investor confidence which Sri Lanka intends to build.

(The writer is a barrister-at-law.)