CB rolls out trust-first regulatory push to safeguard digital economy

• Move is part of a broader risk-based regulatory philosophy designed to balance innovation with ironclad security
• Trust-centric framework is seen as a critical enabler for government’s ambitious US $ 15bn digital economy goal for 2030

By Nishel Fernando

The Central Bank is championing a robust regulatory strategy focused on building public trust to underpin the nation’s rapid digital economic expansion, the officials announced at Sri Lanka Fintech Summit 2025, in Colombo.
A cornerstone of this approach is a new directive, which came into effect this year, mandating that all financial institutions promptly report technology-related risks and cyber incidents to the regulator.
This move is part of a broader “risk-based” regulatory philosophy designed to balance innovation with ironclad security, ensuring the stability and integrity of the financial system as it digitises.
Speaking on a key panel, Central Bank Governor Dr. P. Nandalal Weerasinghe emphasised that without trust, adoption of digital financial services would falter. 
“Our primary role is to identify the risks associated with financial services and provide the regulatory guidelines to mitigate them,” he stated. 
“Otherwise, there is no trust in the system.”
The Central Bank’s regulatory approach is built upon three key pillars. Firstly, it has established minimum standards for payment applications, providing guidelines to ensure the fundamental safety and security of the mobile payment apps used by millions of Sri Lankans. 
Secondly, a comprehensive Technology Risk Management Framework has been implemented, setting minimum requirements for technology risk management and resilience for the licensed banks. 
Lastly, a new directive, effective from 2025, mandates incident reporting. This requires institutions to promptly report significant technology failures and cybersecurity breaches, enabling the Central Bank to gain real-time insights into systemic threats, share anonymised intelligence and coordinate a more effective, industry-wide defence against cyber threats.
This trust-centric framework is seen as a critical enabler for the government’s ambitious US $ 15 billion digital economy goal for 2030. While digital transactions are already projected to exceed Rs.50 trillion this year, extending this growth beyond urban centres requires a foundation of unwavering public confidence.
The banking industry has welcomed the clear guidance. 
HNB CEO Damith Pallewatte, representing the banking sector on the panel, noted that the banks are the ultimate “end point where we touch the customer”. 
He affirmed that the industry’s role is to translate the government’s blueprints and the Central Bank’s regulatory frameworks into a secure and seamless consumer experience. 
“We play a critical role in building trust in the consumer,” Pallewatte said. 
“Whatever the frameworks we put in place, they build trust at the end point where the customers start the payments.”