Board Briefing
Sri Lanka's regulatory baseline shifted materially with the Gambling Regulatory Authority Act, No. 17 of 2025, which entered into force on 1 December 2025 and repealed the Horse Racing Betting Ordinance, Gambling Ordinance, and Casino Ordinance in a single consolidating statute. The Gambling Regulatory Authority (GRA) created by that Act is, however, not yet operational: it missed its 30 June 2026 statutory deadline, and recruitment of the Director General and other senior roles remained incomplete as of August 2026.
This produces a distinctive sui generis disposition -- a durable primary-legislation framework paired with an absent licensing authority -- and it is against this backdrop that Sri Lanka's telecommunications regulator has taken on an interim enforcement role, blocking unlicensed offshore operators at scale in August 2026 while the GRA's own licensing and secondary-regulation apparatus remains under construction.
Summary
A newly-opened but capital-intensive and small market; viable only via local registration and a GRA licence, with secondary rules still pending.
Market Opportunity
Sri Lanka's gambling market has been reframed as a foreign direct investment and revenue instrument in the context of the post-2022 economic crisis and IMF programme, with the GRA Act 2025 formalising online gambling and integrated-resort licensing as the primary vehicles for that strategy. The flagship market signal is the City of Dreams Sri Lanka integrated resort, for which a 20-year casino licence was granted to Bluehaven Services on 27 March 2024 — a confirmed, durable grant evidencing institutional commitment to the integrated-resort model.
The land-based competitive set includes Bally's, Bellagio, Casino Marina, and Stardust, all previously operating under provisional registrations since 2013 and now required to transition into GRA licensing. Quantitative market size estimates and growth trajectory data are not available in the current evidence base, preventing a precise sizing of the online opportunity. The structural demand signal is the existence of an active unlicensed offshore market — the GRA Act's payment-blocking and platform-access controls are explicitly designed to redirect that demand toward licensed operators. The market opportunity is real but its scale is uncertain at this stage of the regulatory cycle.
Licensing & Regulation
The Gambling Regulatory Authority Act, No. 17 of 2025 is durable primary legislation, in force since 1 December 2025, that repealed and consolidated the Horse Racing Betting Ordinance, Gambling Ordinance, and Casino Ordinance into a single licensing framework administered by the newly created Gambling Regulatory Authority. In practice, the licensing side of that framework is not yet operative: the GRA missed its 30 June 2026 statutory deadline to become operational, and as of August 2026 the Director General post and other senior roles remain unfilled, leaving the Act without an issuing authority able to process applications, set conditions, or administer suspensions and revocations. Secondary regulations covering licensing procedures, operating conditions and penalties are in development, targeted for around October 2026, with Sri Lankan authorities reportedly referencing Singapore's framework and engaging international consultants. Until that secondary layer and the GRA's own staffing are in place, the statute exists as a durable legal shell without a functioning licensing gateway.
Market entry now requires a GRA licence held by a company incorporated or registered under the Companies Act No. 7 of 2007, with minimum capital set by Ministerial order. Foreign investors must enter via locally-registered subsidiaries, branches or joint ventures. Land-based casino entry remains anchored to large integrated-resort projects; the digital gambling and software licence routes are newly available but await detailed GRA procedures and fee schedules.
Regulated Activity Classes
All 20 canonical activity classes are shown for every jurisdiction so the grid is directly comparable. 13 carry an assessed status here. Where a class has no statutory activity-class assessment of its own, the status shown is the product-coverage position for that jurisdiction and is marked via product coverage — it describes whether the product can lawfully be offered, not that the regulator operates a separate licence class for it. Not yet assessed describes the state of our coverage and is not a statement that the activity is unregulated.
Player products
Supply roles
Settlement rails
Entry Pathways
The Gambling Regulatory Authority Act No. 17 of 2025 establishes a unified licensing system administered by the Gambling Regulatory Authority, covering casinos, betting houses, online platforms, junket operators, and gambling software providers. This is a confirmed, durable statutory framework replacing the prior fragmented ordinance-based regime.
Foreign companies may enter via locally-registered subsidiaries or branches — a confirmed pathway grounded in primary legislation. The two licence forms most relevant to international digital operators are the Digital Gambling Licence, which covers online B2C operations, and the section 33 gambling software licence, which covers B2B platform and studio suppliers. Both are confirmed and durable. Applicants must be incorporated or registered under the Companies Act No. 7 of 2007.
Minimum capital requirements are set by the Minister under the Act but have not yet been published, creating an uncertain quantum for capital planning. GRA fee schedules for digital gambling and software licences are also pending. The entry pathway is legally open; the operational detail required to complete an application is not yet fully available.
Player Protection
The Gambling Regulatory Authority Act No. 17 of 2025 establishes player-protection obligations at the primary-legislation level, most notably the prohibition on advertisements implying that gambling solves financial problems — a confirmed, durable restriction. The Act also prohibits false, deceptive, or misleading advertising more broadly. However, the detailed player-protection operational requirements — self-exclusion mechanisms, deposit limits, reality checks, and age verification standards — are not yet published in secondary regulations. This is a confirmed gap in the current regulatory picture.
The practical player-protection burden for operators is therefore partially indeterminate: the statutory prohibition on harmful advertising is clear and enforceable, but the operational compliance framework that will govern self-exclusion, limit-setting, and age verification awaits secondary regulation. Operators should design their player-protection infrastructure to meet standards comparable to established common-law jurisdictions, in anticipation of GRA secondary regulations that are likely to draw on international best practice.
Advertising of gambling carried on in contravention of the GRA Act is an offence, as is publishing false, deceptive or misleading gambling advertisements or those implying gambling solves financial problems or improves social status. Licensed operators may advertise within GRA rules; unlicensed offshore promotion is prohibited and the GRA may penalise both operators and promoters and block access. Detailed GRA advertising standards remain to be published.
Distribution & Platform Rules
Telecom-level website blocking has emerged this cycle as the Gambling Regulatory Authority's primary distribution-control lever against unlicensed online gambling platforms, exercised through the Telecommunications Regulatory Commission of Sri Lanka (TRCSL) under sections 15, 16 and 18 of the GRA Act.
On 5 August 2026, TRCSL ordered the blocking of 24 unlicensed sites, including major international operators such as Stake, bet365 and Betway; on 6 August 2026 that order was extended to a further 146 sites, and cumulative reporting as of 13 August 2026 places the total at 122 platforms blocked. This represents a confirmed, large-scale tightening of distribution control this cycle, applied ahead of the GRA itself becoming operational, and it establishes DNS/hosting-level blocking as the interim enforcement mechanism of choice while the secondary licensing regulations remain in development.
Enforcement
Enforcement is the defining development of this cycle. The Telecommunications Regulatory Commission of Sri Lanka, acting at the Gambling Regulatory Authority's request, ordered telecom providers on 5 August 2026 to block 24 unlicensed gambling sites -- including Stake, bet365, Betway, 1xBet, Betfair, Unibet, Dafabet, 22Bet, Melbet, BC.Game, Parimatch, Mostbet, 1Win and BetWinner -- under sections 15, 16 and 18 of the GRA Act, with the underlying offence sitting in section 44, which functions as an accessory-liability basis enabling telecom-level blocking of unlicensed operation or promotion.
The order was extended the following day, 6 August 2026, to a further 146 unlicensed websites, and cumulative reporting as of 13 August 2026 places the total at 122 gaming platforms blocked to date. This is a durable statutory power exercised at scale for the first time since the Act's commencement, confirmed across multiple independent reports.
It sits alongside a probable, not yet confirmed, risk vector: POGO-displaced criminal networks reportedly relocating toward Sri Lanka, including the Colombo Port City Special Economic Zone, following the Philippine crackdown on offshore gaming operators.
The Gambling Regulatory Authority Act No. 17 of 2025 grants the GRA confirmed, durable enforcement powers: to regulate, monitor, and investigate unlawful gambling, and to block access to unlicensed platforms. The GRA coordinates with police in exercising these functions — a confirmed operational arrangement. The maximum penalty for unlicensed gambling is a fine of up to LKR 10,000,000 (approximately USD 33,227) and/or two years imprisonment, confirmed and grounded in primary legislation.
This dual-track sanction — financial penalty plus criminal imprisonment — represents a materially more serious enforcement posture than jurisdictions relying solely on administrative fines. The advertising prohibition in the GRA Act creates an additional enforcement vector: operators and promoters advertising gambling carried on in contravention of the Act face direct GRA action, including platform blocking and penalties. For B2B software providers, the section 33 licence requirement means that supplying an unlicensed operator creates accessory liability exposure.
The unregulated sector enforcement theory centres on the licence-breach model: operating without a GRA licence constitutes an offence under the primary statute, with the GRA empowered to block platform access and refer matters to police for criminal prosecution. No documented enforcement events under the new GRA Act have been identified in the current evidence base, as the Act only came into force on 1 December 2025. Enforcement intensity and blocking effectiveness are therefore not yet evidenced — a probable gap in the current picture.
Extraterritorial Reach
A cross-jurisdictional spillover risk emerged this cycle: networks displaced from the Philippines' Philippine Offshore Gaming Operator (POGO) sector are reportedly relocating toward Sri Lanka, including the Colombo Port City Special Economic Zone, following the Philippine government's crackdown on offshore gaming operators.
The Port City SEZ operates under a distinct legal framework, and its integration with the Gambling Regulatory Authority's licensing perimeter is not yet clearly established. This is assessed at Probable confidence rather than confirmed -- a single-source signal at this stage -- but it indicates a deteriorating trajectory for extraterritorial risk exposure: displaced offshore operator networks gravitating toward a jurisdiction whose own licensing and enforcement infrastructure is still under construction compounds the uncertainty facing any operator assessing cross-border exposure in this market.
AML / CFT
Sri Lanka is not a FATF member. The primary AML legislation is the Prevention of Money Laundering Act No. 5 of 2006 (as amended), a durable statute. Gambling operators are designated reporting entities under this framework — a probable characterisation supported by the available evidence. The Financial Intelligence Unit is the designated supervisory body for AML compliance.
The designation of gambling operators as reporting entities means that licensed operators will be subject to customer due diligence, suspicious transaction reporting, and record-keeping obligations under the PMLA framework. However, the specific STR and CTR reporting thresholds applicable to gambling operators, and the tipping-off and confidentiality provisions that govern internal escalation, are not detailed in the current evidence base — this is a confirmed gap (adv-int-20260607-LK-G004).
The practical AML compliance burden for a new digital entrant is therefore partially indeterminate at this stage: the statutory designation exists and is durable, but the operational thresholds and procedural requirements that determine actual compliance lift have not been published in the available sources. Operators should engage directly with the Financial Intelligence Unit to clarify applicable thresholds and reporting procedures.
Cross-Monitor AML/CTF Signals
Cross-border AML/CTF signals are not covered for this jurisdiction in this report.
Data Protection
Data protection obligations are not covered in this report. They are not specific to gambling licensing: the controller and processor duties that apply to a licensee are the same ones that apply to any business handling personal data in this jurisdiction, so this report links to the specialist source rather than restating it. Gambling-specific privacy duties -- player data retention, age and identity verification, marketing consent -- are covered in the player protection and operational obligations sections above.
Technical Compliance
The GRA Act regulates gambling software (s.33), requiring self-imposed limit tools, addiction warnings with support links, self-exclusion enforcement, and compliance with the Personal Data Protection Act No. 9 of 2022 and cybersecurity measures. Detailed technical standards, RNG/certification specifications and data-localisation rules have not yet been published by the GRA. TRCSL web-blocking has historically been applied to gambling sites; VPN use is widespread; DPI infrastructure is limited.
Operational Obligations
The Gambling Regulatory Authority Act No. 17 of 2025 mandates licensing for all gambling operators and establishes the GRA as the supervisory body with powers to regulate, monitor, and investigate. However, the detailed operational obligations that will govern day-to-day compliance — reporting obligations, technical certification requirements, and responsible gambling operational requirements — are not yet published in secondary regulations.
This is an uncertain gap confirmed by the Interpreter. The advertising obligations are set at the primary-legislation level: operators must not publish false, deceptive, or misleading advertisements, and must not imply that gambling solves financial problems. Payment obligations are also primary-legislation level: transactions must be in Sri Lankan rupees or via GRA-approved payment gateways, with cryptocurrency excluded. Beyond these confirmed primary-legislation obligations, the operational compliance picture awaits secondary regulation publication. Operators should prepare internal frameworks for reporting, technical certification, and responsible gambling in anticipation of those requirements.
Cost to Operate
The confirmed cost signal this cycle is the Betting and Gaming Levy (Amendment) Act, No. 25 of 2025, which raised the gross collection levy from 15% to 18% and doubled the citizen casino entrance levy from USD 50 to USD 100, both effective for periods commencing 1 January 2026. The amendment was certified 17 December 2025 and gazetted 26 December 2025, making it durable primary legislation rather than administrative guidance. It applies to the existing licensed land-based sector independent of the still-undeveloped online licensing regime.
For an operator assessing cost to operate in Sri Lanka, the direction this cycle is unambiguously upward: a higher gross-revenue levy and higher entrance charges, layered atop a compliance framework whose substantive AML and licensing content remains pending the secondary regulations expected around October 2026.
Gross gambling revenue tax was increased from 15% to 18% under the 2025 budget, with the GRA monitoring compliance. The casino entrance levy under the Betting and Gaming Levy Act No. 40 of 1983 was raised to USD 100 for resident entrants. Lottery proceeds (NLB/DLB) are taxed under separate state arrangements. Digital gambling licensees must pay applicable taxes under the new regime.
Under the prior (now-repealed) Casino Business Licensing Regulation 2022, a new or renewed casino licence cost LKR 500,000,000 for a five-year term, payable upfront, with multi-period options up to 20 years. The GRA Act 2025 sets minimum capital by Ministerial order and contemplates separate licence fees for digital gambling and software licences, which are not yet published. A casino entrance levy applies (USD 100 for residents under the 2025 budget).
Payments & Money Flow
The Gambling Regulatory Authority Act No. 17 of 2025 requires that gambling transactions be conducted in Sri Lankan rupees or via GRA-approved payment gateways — a confirmed, durable restriction grounded in primary legislation. Cryptocurrency is explicitly excluded from permitted funding methods, a confirmed and durable prohibition. The Central Bank of Sri Lanka historically instructed banks to block gambling transactions and applied restrictive MCC 7995 treatment to gambling-related card payments — a probable characterisation of historical practice carried on a fragile instrument.
Post-2022 foreign exchange controls have progressively eased, improving the practical payment-flow environment for licensed operators. Capital outflow via offshore betting platforms is cited as a foreign exchange concern, which provides the policy rationale for the GRA's payment-gateway approval requirement. The GRA now holds centralised blocking power over unlicensed platforms, replacing the prior arrangement where the Telecommunications Regulatory Commission of Sri Lanka lacked clear legal authority. Operators relying on cryptocurrency payment rails have no compliant pathway under the current framework.
The GRA Act requires all gambling transactions to be made in Sri Lankan rupees or through approved payment gateways, with crypto-based betting excluded. CBSL historically directed banks to restrict gambling-related card transactions and MCC 7995 treatment was restrictive; post-2022 FX controls have progressively eased. Offshore betting platforms are cited as a channel for capital outflow and FX loss, a key policy concern.
Competitive Landscape
The land-based casino market in Sri Lanka comprises five confirmed operators: Bally's, Bellagio, Casino Marina, Stardust, and City of Dreams Sri Lanka. The first four previously operated under provisional registrations since 2013 and must now transition into GRA licensing under the new framework. City of Dreams Sri Lanka — the John Keells Holdings and Melco flagship integrated resort — holds a confirmed 20-year casino licence granted to Bluehaven Services on 27 March 2024, representing the most significant recent competitive development.
Licensed operator counts under the new GRA register have not yet been published, preventing a precise assessment of market concentration. The online segment is newly formalised: the Digital Gambling Licence pathway did not exist under the prior framework, meaning the licensed online competitive set is effectively at zero at the start of the GRA era. The unlicensed offshore market has been the de facto online channel for Sri Lankan players, and the GRA's platform-blocking powers are designed to redirect that demand toward licensed operators. The competitive landscape for a new digital entrant is therefore relatively open at this early stage of the licensing cycle.
Reform Horizon
The Gambling Regulatory Authority's secondary regulations -- covering licensing procedures, operating conditions and penalties -- are in development and are expected around October 2026, with Sri Lankan authorities reportedly using Singapore as a reference model and engaging international consultants. This is a probable, not yet confirmed, timeline, and it follows the GRA's missed 30 June 2026 statutory deadline to become operational.
Until this secondary layer is published, the reform horizon for Sri Lanka's gambling sector remains defined by a durable primary statute without an operative licensing or AML content layer beneath it. The October 2026 target is the single most consequential forward milestone for market-entry planning, since it is expected to determine licence classes, application requirements and compliance obligations that do not currently exist.
Sri Lanka's regulatory direction is liberalising/formalising following GRA Act commencement on 1 December 2025, framed by the government as central to post-crisis recovery, tourism and FDI. Key watchpoints are GRA secondary regulations and technical standards (digital gambling and software), revenue-tracking weaknesses flagged by critics, questions over regulator autonomy, and online provisions described as still underdeveloped. Regional competition from UAE and Thailand adds urgency.
Lateral & spillover risks
2 providers visible in the commercial data for this jurisdiction.
Trust & verification
1 contributor named on this record.