Sri Lanka AML Obligations for Accountants: The Financial Transactions Reporting Act and FIU Rules

Sri Lanka's anti-money laundering (AML) rules for accountants sit in the Financial Transactions Reporting Act, No. 6 of 2006 (the FTRA), and in customer due diligence rules issued by the country's Financial Intelligence Unit (FIU). The FTRA was substantially amended in 2026. This guide sets out what the primary texts say, flags where the old and new texts need reconciling, and lists what we could not confirm. It is general information, not legal advice.

When accountants are covered

The Designated Non-Finance Business (Customer Due Diligence) Rules, No. 1 of 2018, published by the FIU in Gazette No. 2053/20 on 10 January 2018 under section 2 of the FTRA, apply to lawyers, notaries, other independent legal professionals and accountants when they prepare for or carry out specified activities for clients. Those activities include property transactions, managing client money, managing bank or securities accounts, and creating or managing companies or legal persons.

The Financial Transactions Reporting (Amendment) Act, No. 17 of 2026, which the FIU's site shows as certified on 4 August 2026 and published in the Gazette on 7 August 2026, replaces the definition of designated non-finance businesses or professions in section 33 of the principal Act. Accountants remain covered under the same kind of activity-based test. A practice that only prepares tax returns or audits may therefore fall outside the definition for that work, but check your service list carefully, because many firms also hold client money or set up companies.

Customer due diligence

The 2018 rules require a risk assessment that is documented and kept current. They then require businesses to identify and verify customers and their representatives, identify and verify beneficial owners, and understand the purpose of the relationship. For companies, the rules treat directors and holders of more than 10% of equity, and anyone who controls the entity by other means, as within scope. For trusts, they require the settlor, trustees, beneficiaries and anyone with ultimate control to be identified. Enhanced due diligence applies to higher-risk customers, politically exposed persons, customers from high-risk countries and non-face-to-face relationships.

The 2026 Act restates the duties in the principal Act. Section 2 of the principal Act, as amended, sets out when due diligence applies, the identification and verification of beneficial owners, and enhanced and simplified measures. It also says that if due diligence cannot be completed, the institution must not open the account or proceed, or must end the relationship. Our guides on KYC and customer due diligence for accountancy practices and on ultimate beneficial ownership cover the general method.

Reporting suspicious transactions and tipping off

Under the 2026 Act, section 7 of the FTRA (as replaced) requires a suspicious transaction report as soon as practicable and no later than two working days after the suspicion is formed. Reports may be made in writing, electronically or by phone, with a written follow-up within 24 hours. The 2018 rules say that if carrying out due diligence might tip off the customer, the business may stop and must immediately file a report.

Section 9, as amended, prohibits disclosing, directly or indirectly, that a report has been made or a suspicion formed, and extends to information from which that could reasonably be inferred. For the practical side, see our guide to suspicious activity reports and tipping off, which is UK-focused but explains the sequence of spotting, escalating and reporting.

Record keeping

The 2026 Act sets six years for transaction records and reports, running from completion, correspondence or furnishing of the report. Due diligence records are kept for six years from account closure, end of the relationship or the occasional transaction, and the Head of the FIU may direct a longer period. The 2018 rules, by contrast, say records must be kept for "more than six years". We have not seen how the FIU reconciles the two, so our suggestion is to follow the longer wording until it confirms.

Supervision, sanctions and penalties

The replaced section 23 requires the supervisory or regulatory authority to carry out risk-based examinations and report non-compliance to the FIU, and says that where no supervisory authority exists the FIU carries out the examinations. We did not identify a separate supervisor for accountants.

The 2026 Act provides for administrative sanctions imposed by the Head of the FIU after an opportunity to show cause. The maximum monetary penalty is Rs 100 million per contravention, and Rs 200 million for subsequent contraventions. Most criminal offences under section 28 carry a fine of up to Rs 10 million, imprisonment of up to one year, or both, and opening an account in a false name or giving false information carries up to two years. Under section 28A, directors, partners and similar officers of a body that commits an offence are deemed to have committed it unless they prove lack of knowledge or due diligence.

What we could not confirm

• The commencement date of each provision of the 2026 Act. The text we could read did not show a separate commencement clause.
• Whether the FIU has issued updated rules for accountants since the amendments. Existing FIU rules and guidelines are deemed issued by the Head of the FIU under section 29C, so the 2018 rules appear to continue.
• Whether the Institute of Chartered Accountants of Sri Lanka issues its own AML guidance for members.
• The penalty attached specifically to a breach of the tipping-off provision in section 9.

Suggested next steps

These are our suggestions, not requirements. List the services you provide and mark which fall within the activity test. Read the 2018 rules and the 2026 Act side by side. Keep records for the longer retention wording until the FIU confirms the position. Decide who in senior management owns compliance: the 2018 rules make appointing a compliance officer optional, but the role still has to be covered. For team training, see our CPD courses.

Frequently asked questions

Which law governs AML duties for accountants in Sri Lanka?

The Financial Transactions Reporting Act, No. 6 of 2006, as amended in 2026, together with the FIU's 2018 customer due diligence rules for designated non-finance businesses.

How quickly must a suspicion be reported?

As soon as practicable and no later than two working days after the suspicion is formed, under section 7 as replaced by the 2026 Act.

How long must records be kept?

Six years under the 2026 Act, and "more than six years" under the 2018 rules. Check with the FIU which applies to you.