APG Mutual Evaluation Sri Lanka 2026.
Sri Lanka’s APG readiness clock.
The window is finite.
For Sri Lankan banks, APG readiness is not a documentation exercise. It is an operating-model test across customer due diligence, sanctions, wire transfers, correspondent banking, suspicious activity reporting, transaction monitoring, and board oversight.
Sri Lanka can improve technical compliance and still underperform on effectiveness. That is the structural risk banks must address before the APG assessment moves from policy review to evidence review.
On 4 April 2025, the Central Bank of Sri Lanka confirmed that a high-level Asia/Pacific Group on Money Laundering delegation had visited the country to support preparation for Sri Lanka’s upcoming AML/CFT Mutual Evaluation, scheduled to commence in March 2026.
Public reporting also confirmed that Sri Lanka is required to demonstrate technical compliance with the FATF 40 Recommendations and effective implementation through the 11 Immediate Outcomes. For licensed commercial banks, that distinction matters. A policy can be technically correct while the control environment remains operationally weak.
APG Mutual Evaluation Sri Lanka readiness is the process of proving that AML/CFT controls work in practice — through evidence, outcomes, governance, reporting quality, and institution-level implementation.
Why this matters for Sri Lanka.
Sri Lanka has previously experienced FATF grey-listing pressure. The economic cost is not theoretical. An IMF working paper found that capital inflows decline on average by 7.6 percent of GDP when a country is grey-listed.
For Sri Lanka’s post-stabilisation recovery, a weak evaluation outcome would not remain inside compliance departments. The effects would move through correspondent banking, trade finance, inward investment, sovereign risk, corporate borrowing, and ultimately household confidence.
The APG Mutual Evaluation is therefore not only a regulatory matter. It is a national financial-system credibility test — and licensed commercial banks sit at the centre of that test.
The regulatory landscape: five facts banks should not ignore.
1. The 2015 Mutual Evaluation still matters.
Sri Lanka’s 2015 Mutual Evaluation Report identified weaknesses across several technical areas, including customer due diligence, politically exposed persons, correspondent banking, wire transfers, reliance on third parties, and higher-risk countries. The 2026–2027 cycle will test whether subsequent reforms are implemented consistently at institution level.
2. APG preparation has already moved into public record.
The Central Bank’s APG preparation briefing and Newswire’s coverage of the high-level AML/CFT task force both confirm the national priority attached to the evaluation. Banks should treat this as a live operating deadline, not a future policy event.
3. The 11 Immediate Outcomes are the effectiveness test.
The FATF methodology evaluates whether AML/CFT measures produce results. For banks, that means evidence of risk understanding, customer due diligence, sanctions screening, suspicious transaction reporting, financial intelligence quality, and cooperation with supervisory and law-enforcement bodies.
4. SAR quality is now an effectiveness signal.
A transaction-monitoring system that produces large alert volumes but weak SAR conversion may look active internally while underperforming under an effectiveness lens. APG assessors are likely to ask whether alerts, investigations, and SAR outcomes align with actual Sri Lankan risk typologies.
5. Board oversight must be demonstrable.
APG readiness cannot sit only with the compliance department. Boards and audit committees must be able to show that AML/CFT risk is understood, escalated, challenged, resourced, and tracked through documented decisions.
A de Risk engagement: APG readiness for a licensed Sri Lankan bank.
In Q4 2025, de Risk Partners — with delivery from its Colombo Centre of Excellence operated with Ascent Business Solutions — was engaged by a Sri Lankan licensed commercial bank to build an APG readiness programme covering the seven months between November 2025 and the expected on-site assessment window.
The diagnostic phase identified three structural exposures. First, customer-due-diligence procedures were technically compliant but operationally inconsistent, particularly for enhanced due diligence on foreign politically exposed persons. Second, the correspondent-banking programme had been refreshed at policy level, but the operational risk-assessment cycle had not been re-run against the latest national risk context. Third, the transaction-monitoring rules generated normal alert volumes, but alert-to-SAR conversion was below regional benchmark levels.
The engagement was structured as an 11-Immediate-Outcomes evidence-stack build, with parallel remediation of the identified gaps. By the end of Q1 2026, the bank had produced a 240-page effectiveness evidence dossier mapped to the Immediate Outcomes, supported by system-generated artefacts, sample SARs, sample EDD files, correspondent-banking reviews, and board-level reporting.
The transaction-monitoring rule set was re-tuned against Sri Lankan trade-finance and cross-border remittance typologies. The alert-to-SAR conversion rate moved from 4.2 percent to 11.8 percent over six months, creating a stronger effectiveness narrative under IO.4 and IO.6.
The de Risk APG readiness operating model.
Risk understanding and coordination.
Map institutional ML/TF risk to the National Risk Assessment, sectoral risk indicators, board reporting, risk appetite, and evidence of management action.
CDD, EDD, PEPs and sanctions.
Test whether customer due diligence, enhanced due diligence, wire-transfer controls, sanctions screening, and PEP handling are applied consistently across branches and channels.
Monitoring, SARs and financial intelligence.
Assess transaction-monitoring rules, alert handling, SAR quality, typology alignment, escalation logic, and the connection between reporting and financial intelligence use.
FIU, law enforcement and supervision.
Document response processes for FIU requests, freezing orders, supervisory reviews, correspondent banking queries, and proliferation-financing sanctions.
The 11 Immediate Outcomes: what banks must evidence.
| Immediate Outcome | What APG assesses | Bank-level evidence |
|---|---|---|
| IO.1 Risk Understanding | Whether risks are understood and coordinated. | Risk assessments, board minutes, risk appetite, action plans, and updated control testing. |
| IO.3 Supervision | Whether supervisors apply risk-based oversight. | Regulator correspondence, exam responses, remediation logs, and audit-committee reporting. |
| IO.4 Preventive Measures | Whether financial institutions apply AML/CFT controls effectively. | CDD samples, EDD files, PEP approvals, wire-transfer testing, sanctions alerts, and branch sampling. |
| IO.6 Financial Intelligence | Whether financial intelligence is used by competent authorities. | SAR quality analytics, FIU requests, typology mapping, investigation support, and reporting outcomes. |
| IO.10 / IO.11 Sanctions | Whether targeted financial sanctions and proliferation-financing measures are implemented. | Sanctions screening logs, escalation records, false-positive handling, freezing procedures, and PF risk review. |
Implementation steps for licensed commercial banks.
- Run an 11-IO diagnostic against current AML/CFT governance, transaction monitoring, SAR reporting, sanctions, CDD, EDD, and board reporting.
- Re-baseline CDD and EDD through sampling across branches, digital channels, foreign PEPs, high-risk customers, and correspondent relationships.
- Refresh correspondent-banking risk assessments against current Sri Lankan risk indicators and cross-border exposure.
- Re-tune transaction-monitoring rules against trade-finance, remittance, informal value transfer, cash, and cross-border typologies relevant to Sri Lanka.
- Build a SAR analytics layer connecting alerts, investigations, SAR submissions, typologies, FIU feedback, and escalation outcomes.
- Create a 240-to-300-page effectiveness evidence dossier mapped to the 11 Immediate Outcomes and supported by artefacts, samples, reports, and system logs.
- Run mock APG assessor interviews with the MLRO, BSA/AML team, operations, audit, legal, technology, and senior management.
- Brief the audit committee quarterly on IO-level readiness, open gaps, owners, deadlines, and residual risk.
What banks should avoid before the on-site window.
Banks should avoid treating APG readiness as a policy-refresh exercise. Updated manuals are necessary but insufficient. The assessor question is not only, “Does the bank have a policy?” It is, “Can the bank prove the policy works?”
If the evidence is not mapped to an Immediate Outcome, it may be useful internally — but it may not help during an APG assessor review.
How this connects to de Risk services.
APG readiness often exposes deeper operating-model needs. Banks that discover gaps in board reporting, transaction monitoring, SAR quality, or control evidence may require Regulatory Remediation, Compliance Managed Services, or Compliance Reinvented.
For banks and fintechs expanding across markets, APG readiness also connects to US Market Entry and Enterprise AI, especially where AI-driven monitoring, onboarding, or customer-risk scoring must be auditable.
Recommended related reads: Compliance Is Not Effectiveness, Three Markets. One Sequence., and The $100K FINMA Myth.
Why Sri Lanka readiness is now a public conversation.
From national preparation to private-sector execution.
Sri Lanka’s AML/CFT preparation has already appeared in Central Bank updates, FIU communications, and public news coverage. Newswire reported the formation of a high-level team for the anti-money-laundering review, reinforcing that the evaluation is not a narrow banking matter.
de Risk Partners’ work with Ascent Business Solutions also strengthens the local execution layer required for APG readiness, compliance operations, fintech controls, and AML/CFT evidence building.
A Sri Lanka delivery model with global compliance standards.
de Risk Partners combines senior regulatory expertise with Colombo-based execution capacity, helping institutions move from compliance design to measurable effectiveness.
For banks, the immediate priority is clear: map every meaningful AML/CFT control to an Immediate Outcome and prove the control works.
Questions Sri Lankan banks should answer now.
When will the APG on-site visit to Sri Lanka take place?
Public statements indicate that Sri Lanka’s third Mutual Evaluation commenced in March 2026, with the final Mutual Evaluation Report expected to be adopted at the APG Annual General Meeting in July 2027. Banks should plan for assessor-readiness before the on-site engagement window.
What is the most common failure pattern in APG Mutual Evaluations?
The common pattern is strong technical compliance but weak effectiveness evidence. Institutions may have policies aligned to the FATF Recommendations but fail to show consistent implementation, detection outcomes, SAR quality, investigation support, and board oversight.
What is the cost of grey-listing for Sri Lanka?
An IMF working paper found that grey-listing reduces capital inflows by an average of 7.6 percent of GDP. For Sri Lanka, the wider effects could include correspondent-banking scrutiny, trade-finance friction, investor caution, and higher compliance costs.
What should banks prepare first?
Banks should begin with an 11 Immediate Outcomes diagnostic, then build an evidence dossier covering CDD, EDD, PEPs, sanctions, wire transfers, correspondent banking, SAR quality, transaction monitoring, FIU cooperation, and board reporting.
How does de Risk Partners support APG readiness?
de Risk Partners supports APG readiness through diagnostics, evidence mapping, technical compliance remediation, transaction-monitoring tuning, SAR analytics, correspondent-banking review, mock assessor interviews, and board-level readiness reporting.
Need an APG readiness assessment before assessors ask?
Send de Risk Partners your current 11-Immediate-Outcomes position. We will return a gap analysis against the assessor’s framework within 10 business days.