Skip to main content
Central Bank of Sri Lanka

CBSL authentication and app-security requirements.

How financial institutions in Sri Lanka meet them with Fortanixor — banks, exchange houses, payment providers, microfinance and fintechs supervised by the Central Bank of Sri Lanka.

Regulation refs: Guidelines on Minimum Compliance Standard for Payment Related Mobile Applications (Guideline No. 01/2020); Payment and Settlement Systems Circulars No. 01 of 2024 and No. 2 of 2024; Banking Act Directions No. 16 of 2021 on Technology Risk Management and Resilience, as amended by Directions No. 05 of 2023; Financial Consumer Protection Regulations No. 01 of 2023; Banking Act Directions No. 01 of 2026 on Outsourcing of Business Operations of Licensed Banks; Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025

In Sri Lanka the authentication rules sit in CBSL's mobile app standard, not its cyber framework. Guideline No. 01/2020 applies to every bank, finance company and e-money operator that provides payment services through a mobile app. Clause 5.4 requires a login authentication and a separate financial value-based transaction authentication for each user account. Clause 6.4 requires multi-factor authentication built from the mobile number, a device identifier, a password or PIN, and an identifier specific to the app. Accounts may be used only on devices registered with the provider (5.3), never from several devices at once (5.5), and clause 6.1 keeps authentication at the backend except for methods based on biometrics or chips. SMS has not gone away. Payment and Settlement Systems Circular No. 01 of 2024 requires the issuer's OTP, sent to the registered mobile, on every JustPay transaction of Rs. 10,000 or more.

Banking Act Directions No. 16 of 2021 sets the technology-risk ground rules for licensed banks, and it decides where a deployment can run. User activity logs must establish accountability without repudiation (Schedule I, 5.3.5). Customer data held by third parties must be encrypted (5.5.1). Section 9 sorts infrastructure by who owns it, who manages it and where it sits. Bank-owned, bank-managed infrastructure in Sri Lanka carries no additional requirements (9.2). Third-party infrastructure needs ISO certification and explicit customer consent, including consent to data held outside Sri Lanka (9.9). The contact centre is covered by the Financial Consumer Protection Regulations: callers must say who they are, which institution they represent and why they are calling (Regulation 23.3), and call recordings and a call register must be kept (23.4). We found no CBSL rule on AI in customer service.

What Central Bank of Sri Lanka requires

01 / 06

Login and transaction authentication on registered devices

Every payment-related mobile app must register user accounts and devices with the provider using the mobile number and a unique device identifier, and allow each account to be used only on registered devices, never on several at once. Each account needs both a login authentication and a financial value-based transaction authentication. MFA must combine the mobile number, device identifier, password or PIN, and an app-specific identifier. Authentication is processed at the backend, except for biometric or chip-based methods.

Guideline No. 01/2020, clauses 5.1, 5.3, 5.4, 5.5, 6.1 and 6.4

02 / 06

Secondary devices, lost phones and anomaly alerts

A secondary device must be authenticated by the primary device, by a call centre person, or by another method that CBSL has approved in advance. Providers must be able to centrally disable access from a device reported lost or stolen, detect simultaneous login attempts and tell the user, lock accounts after repeated failed logins, and log and monitor authentication attempts and transactions in real time, notifying the user of any anomaly.

Guideline No. 01/2020, clauses 5.2, 6.5, 6.6, 8.5 and 8.6

03 / 06

Issuer OTP on larger JustPay payments and verified app users

Since 1 April 2024, any app initiating a JustPay transaction of Rs. 10,000 or more must request an OTP from the issuer of the linked account, sent to the mobile number registered with that issuer. Since 31 March 2025, payment app providers must identify new users from a national identity card, passport or driving licence, verify that identity before the user can transact, and confirm that the app user owns the linked account by matching the device's mobile number to the one on the account.

Payment and Settlement Systems Circular No. 01 of 2024, paragraph 2; Circular No. 2 of 2024, paragraph 2(i) to (iii)

04 / 06

Non-repudiable logs, encryption and where systems may run

Licensed banks must keep user activity logs that establish accountability without repudiation for any access to or change of customer data. Customer data must be encrypted at rest and in transit, including when held by agents and third-party service providers. Infrastructure that is bank owned, bank managed and located in Sri Lanka carries no additional requirements. Locally incorporated banks may not run bank-owned infrastructure outside Sri Lanka except for overseas operations. Third-party owned or managed infrastructure needs Board approval, ISO 27001 (and ISO 27017 for cloud), and explicit customer consent, including consent to data held outside Sri Lanka.

Banking Act Directions No. 16 of 2021, Schedule I, clauses 5.3.5, 5.5.1, 9.2, 9.3.2, 9.8 and 9.9, as amended by Directions No. 05 of 2023

05 / 06

Phone contact rules, call recordings and third-party conduct

Anyone phoning a customer on a provider's behalf must introduce themselves, name the institution and state the purpose of the call. Providers must keep call recordings and a call register for their call centres. They are legally liable for the acts and omissions of their agents and third parties, must monitor them continuously, and must bind them by non-disclosure agreements. Debt-recovery calls may not be made between 9.00 pm and 6.00 am. From 2027, outsourced marketing and recovery functions must also be run in line with financial consumer protection rules.

Financial Consumer Protection Regulations No. 01 of 2023, Regulations 23.3, 23.4, 27.2, 27.4, 27.5 and 28.3(xi); Banking Act Directions No. 01 of 2026, Schedule I, 8.1

06 / 06

Fraud liability, data protection and accessible security

A provider is liable for a customer's loss from fraud or misuse of their assets unless it proves the loss came from the customer's own negligence or fraud. Personal information must be protected, kept for at least six years after the contract ends, and not shared with a third party without consent or legal basis. Mobile apps must offer every security, protection or safety feature in both text and audio. From 1 January 2027 the Personal Data Protection Act requires controllers to protect personal data with technical and organisational measures and to bind processors by contract.

Financial Consumer Protection Regulations No. 01 of 2023, Regulations 17.3(v), 48(i), 49.3, 50 and 52; Personal Data Protection Act, No. 9 of 2022, sections 10, 21 and 22

Control mapping

How Fortanixor maps to CBSL requirements.
RequirementFramework referenceHow Fortanixor addresses itProduct
MFA from the device identifier, a PIN and an app-specific identifier, with accounts used only on registered devicesGuideline No. 01/2020, clauses 5.1, 5.3, 5.5, 6.1 and 6.4A FortAuth passkey is created in the secure element of the registered phone for that app's domain, so it is both the device identifier and the app-specific identifier, and it cannot be copied to another phone. The biometric or PIN that unlocks it happens on the device, which is the exception clause 6.1 allows, and the signature is verified at the bank's backend. The bank keeps the mobile number registration that clause 5.1 requires; the passkey adds to it rather than replacing it.FortAuth
A login authentication and a separate financial value-based transaction authentication for each accountGuideline No. 01/2020, clause 5.4FortAuth runs one passkey ceremony at login and a second for each payment. With Secure Payment Confirmation, the amount and payee are shown on the device and bound into the signed data, so the transaction authentication covers the value approved, not only the session. When a customer speaks a payment through FortVoice, the transcribed command is shown on the phone and goes through that same transaction authentication before it executes.FortAuthFortVoice
Secondary devices approved from the primary device, central disabling of lost devices, and anomaly alertsGuideline No. 01/2020, clauses 5.2, 6.6, 8.5 and 8.6A new phone can be enrolled only after the customer approves it with the passkey on their primary device, the first route clause 5.2 names. Each device holds its own credential, so the bank can revoke a lost or stolen phone's passkey centrally without touching the others. Every ceremony is logged with device, time and outcome, and these events feed the real-time monitoring and customer notifications that clauses 6.6 and 8.5 require. The clause's call-centre route means a human officer; FortAgent is not offered as a substitute for that person.FortAuth
User activity logs adequate to establish accountability without repudiationBanking Act Directions No. 16 of 2021, Schedule I, clause 5.3.5A passkey assertion is a signature from a key that only the customer's device holds, so each logged login or payment approval is tied to that device and that moment. A shared code would only show that someone entered it. FortAgent adds a transcript, QA score and audit trail for every call, and FortVoice records the command the customer confirmed, so access to and changes of customer data through voice channels can be traced as well.FortAuthFortAgentFortVoice
Infrastructure ownership, management and location, and customer consent for third-party or offshore hostingBanking Act Directions No. 16 of 2021, Schedule I, clauses 9.2, 9.3.2 and 9.9.3All three products can be installed on the bank's own infrastructure in Sri Lanka and run by its own staff. That is the bank owned and managed, located in Sri Lanka model, for which clause 9.2 sets no additional requirements, and it keeps customer data out of the third-party infrastructure that triggers the consent step in 9.9.3. FortVoice processes speech inside that estate rather than at a global endpoint. If the bank chooses third-party cloud instead, the certification, Board-approval and consent conditions in 9.8 and 9.9 apply to that arrangement.FortAuthFortVoiceFortAgent
Introducing the caller, the institution and the purpose on outbound calls, and keeping call recordings and a call registerFinancial Consumer Protection Regulations No. 01 of 2023, Regulations 23.3 and 23.4Every FortAgent call opens by telling the customer they are speaking to an AI agent, naming the bank and stating why it is calling, which goes further than Regulation 23.3 asks of a human caller. Each inbound and outbound call is recorded, transcribed and listed with its time, number and outcome, giving the bank the recordings and call register that 23.4 requires. The bank sets how long they are kept.FortAgent
Liability for, and monitoring of, agents and third parties dealing with customers, including outsourced recovery callsFinancial Consumer Protection Regulations No. 01 of 2023, Regulations 27.2, 27.4 and 28.3(xi); Banking Act Directions No. 01 of 2026, Schedule I, 8.1Because the bank is liable for what is said on its behalf, FortAgent QA-scores every call against the bank's own script and consumer-protection rules, so monitoring covers every call rather than a sample. The bank sets the calling windows for outbound campaigns, so collections calls can be kept out of the 9.00 pm to 6.00 am period that Regulation 28.3(xi) bars. Direction 8.1 speaks of training the provider's staff; the transcripts and scores are the evidence the bank can show for an automated agent instead.FortAgent
Liability for customer losses from fraud unless the provider proves the customer's negligenceFinancial Consumer Protection Regulations No. 01 of 2023, Regulations 22.1 and 48(i)A passkey is bound to the bank's genuine domain, so it will not sign in to a phishing site, and there is no code a fraudster can talk the customer into reading out. That removes the most common route to the losses Regulation 48(i) puts on the provider. Where a payment is disputed, the signed record shows which registered device approved which amount and payee, which is the evidence the bank needs to establish what happened.FortAuth
Security, protection and safety features in mobile apps offered in both text and audioFinancial Consumer Protection Regulations No. 01 of 2023, Regulations 13.2(ii) and 17.3(v)FortVoice gives the app a spoken route to banking actions, with each command confirmed before it executes, alongside the on-screen route. FortAuth replaces typed codes with the phone's own fingerprint or face prompt, which works with the device's screen reader. Together they let a customer with low vision complete a secured transaction without reading an SMS code.FortVoiceFortAuth
Controller and processor safeguards for personal data, including call recordings and transcripts, from 1 January 2027Personal Data Protection Act, No. 9 of 2022, sections 10, 21(1) and 22(1); section 26 as replaced by Act No. 22 of 2025; commencement under Gazette Extraordinary No. 2498/16Recordings, transcripts and voice commands are personal data the bank controls. Where we host them, we act as processor on the bank's written instructions, under confidentiality obligations, open to the bank's audits, and erase or return the data when the service ends, as section 22(1) sets out. In an on-premise deployment the data never leaves the bank, so no cross-border flow under section 26 arises. FortAuth stores only public keys, and biometric data stays on the customer's device.FortAgentFortVoiceFortAuth
What this mapping does not claim

Where a requirement belongs to the bank’s own operations, or where the regulator has published no rule to map to, we say so rather than stretch a row to cover it. This is the boundary of the table above, not a gap in it.

  • The issuer OTP on JustPay transactions of Rs. 10,000 or morePayment and Settlement Systems Circular No. 01 of 2024, paragraph 2, requires the app to request an OTP from the issuer, sent to the mobile number registered with the issuer. This is a CBSL mandate, not a bank choice. Passkeys run alongside it for JustPay payments at or above the threshold rather than replacing it, until CBSL says otherwise.
  • Customer identification at app registration, and CDD and KYC generallyPayment and Settlement Systems Circular No. 2 of 2024, paragraph 2(i), requires identity documents to be collected and verified, and the app user matched to the account owner. Banking Act Directions No. 01 of 2026, Schedule I, 5.1(iv), bars banks from outsourcing CDD and KYC. Identity proofing stays with the bank or provider; FortAuth binds a passkey once that is done.
  • Compliance reports and information security audits for payment appsGuideline No. 01/2020, clauses 25.1, 25.2 and 25.4, require a Board-approved compliance report to CBSL before each app's commercial launch, an IS and information security audit of the whole app ecosystem, and an annual report by 31 January. These are the provider's filings. We supply the architecture and control documentation they draw on.
  • Reporting IT and cybersecurity incidents to CBSL within two hoursBank Supervision Department Circular No. 02 of 2025 requires an immediate report within 2 hours of detection, a detailed report within 14 days and a quarterly report, covering phishing, social engineering and online scams affecting customers among other incidents. Reporting is the bank's obligation. Our ceremony logs and call transcripts help establish the facts quickly, but they are not the reporting process.
  • ISO certifications, governance and complaint handlingBanking Act Directions No. 16 of 2021, Schedule I, 8.1, requires licensed banks to implement ISO/IEC 27001, 27035, 22301 and 20000, and clauses 9.9.1 and 9.9.2 require ISO 27001 and ISO 27017 of third-party infrastructure and cloud providers. Section 4 sets up the Information Security Committee and CISO. Financial Consumer Protection Regulation 46.1 requires complaints to be resolved within 21 calendar days. These are the bank's own obligations, and we make no certification claim here.
  • AI-specific rules, including disclosure of AI to callersNot established. We found no CBSL direction, circular or guideline on artificial intelligence in customer service. Direction No. 16 of 2021 mentions AI once, at Schedule I 5.6.5(iii), allowing AI in place of most Security Operations Center roles. FortAgent discloses itself to every caller anyway, which supports Regulation 23.3, but we do not claim CBSL requires it.
  • Data subject rights under the Personal Data Protection Act, including review of automated decisionsNot yet in operation. The Order in Gazette Extraordinary No. 2498/16 brings Sections 2 and 3, Part I and Part III of the Act into operation on 1 January 2027. It does not name Part II, which holds the data subject rights, including the section 18 right to review decisions based solely on automated processing. We make no claim about when Part II applies.
Sources

Every clause cited on this page was read in the document below, on the regulator’s own site.

This mapping is provided for guidance and must be validated by the bank's compliance function against the current version of each framework.

Deployment options in Sri Lanka

Served from our UAE and Pakistan offices with in-region deployment: on-premise, in-region cloud, or hybrid.

Deployment shapes

On-premiseIn-region cloudHybrid

Runs on

Amazon Web ServicesMicrosoft AzureGoogle Cloud

Deployed into your own account and your own region on any of the three, or on-premise where the data must not leave your estate at all.

CBSL questions, answered.

They fit the shape of them. Guideline No. 01/2020 asks for accounts bound to registered devices (clauses 5.1 and 5.3), no concurrent use across devices (5.5), separate login and transaction authentication (5.4), and MFA combining the mobile number, a device identifier, a PIN or password, and an app-specific identifier (6.4). A FortAuth passkey is a device-bound, app-specific credential unlocked by the phone's biometric or PIN. Clause 6.1 explicitly allows biometric methods to run on the device rather than the backend. The bank still registers the mobile number, and Circular No. 01 of 2024 still requires the issuer OTP on JustPay payments of Rs. 10,000 or more. Validate against the current text before filing the clause 25.1 compliance report.

Yes, and for a locally incorporated bank, Direction No. 16 of 2021 makes that the simplest route. Section 9 of its Schedule sets no additional requirements for infrastructure that is bank owned, bank managed and located in Sri Lanka (9.2). It bars local banks from running bank-owned systems abroad except for overseas operations (9.3.2). It requires explicit customer consent before customer data goes on third-party infrastructure, and separate consent if that infrastructure is outside Sri Lanka (9.9.3). All three products run on-premise, so authentication data, speech and call records can stay inside the bank. From 1 January 2027 the Personal Data Protection Act also sets conditions on cross-border flows under section 26, as replaced in 2025.

No, not in Sri Lanka today. CBSL has added OTPs, not removed them: Circular No. 01 of 2024 requires the issuer's OTP, sent to the registered mobile, on every JustPay transaction of Rs. 10,000 or more. Guideline No. 01/2020 also lets SMS carry nothing except OTPs (clause 12.6). What passkeys replace is the SMS code as the login and in-app transaction step. Banks here typically enrol passkeys for login and their own payments, keep the issuer OTP where the circular requires it, and so reduce the SMS codes a fraudster can talk a customer into reading out.

It cites CBSL's own clause numbers and links to the CBSL-hosted documents, and it keeps what the product does separate from what stays with the bank. The Sri Lanka mapping covers Guideline No. 01/2020 clauses 5.1 to 5.5, 6.1, 6.4, 6.6, 8.5 and 8.6. It also covers Direction No. 16 of 2021 clauses 5.3.5, 9.2, 9.3.2 and 9.9.3, Financial Consumer Protection Regulations 17.3(v), 23.3, 23.4, 27, 28.3(xi) and 48(i), Direction No. 01 of 2026 item 8.1, and PDPA sections 10, 21, 22 and 26. It names what is outside our scope: the JustPay OTP, identity proofing, the clause 25 compliance filings, two-hour incident reporting and ISO certification. It also says plainly that CBSL has issued no AI rule.

Get the CBSL control mapping

The full control-by-control mapping for FortAuth, FortVoice and FortAgent, as a document your compliance function can review.

Other markets