Short answer: Sri Lanka now has a law to license moneylenders, but most of it is not yet in force. The Microfinance and Credit Regulatory Authority Act, No. 9 of 2026, was passed by Parliament on March 4, 2026 and certified by the Speaker on March 20, 2026. It replaces the Microfinance Act of 2016 and requires anyone who lends money as a business, including through mobile apps, to hold a licence from a new authority. Interest recovered may never exceed the amount lent, and unlicensed lending is punishable by up to Rs. 5 million in fines, five years in prison, or both. However, its main provisions start only on a date the Minister sets by Gazette order, and as of October 2026 that order had not been issued. Until then, the Central Bank of Sri Lanka keeps supervising licensed microfinance companies.
LKML1312Below: who will need a licence, what the Act promises borrowers, the transition timetable, and how to check a lender and complain today.
Who will need a licence
Once the Act commences, anyone carrying on a moneylending or microfinance business must be licensed by the Microfinance and Credit Regulatory Authority. That includes private moneylenders, microfinance companies and digital lenders: section 37(1)(r) lets the Authority regulate lending "carried out using any digital or electronic means", so loan apps are covered. Institutions already regulated elsewhere are exempt:
- licensed banks and licensed finance companies;
- registered leasing establishments and co-operative societies;
- Samurdhi community-based banks and banking societies;
- insurers, stockbrokers registered with the SEC, and multilateral lenders such as the World Bank and ADB;
- companies lending only to related companies or their own employees.
What the Act promises borrowers
| Protection | What the Act says |
|---|---|
| Interest ceiling | Lenders may not charge more than the maximum rates set by the Authority's directives |
| Interest never above the principal | Section 49(c): total interest recovered can never exceed the amount lent |
| Written agreement | In Sinhala, Tamil or English as the borrower prefers, stating the nominal rate and the annual effective rate, explained before signing |
| No blank documents | Collecting signatures on blank, incomplete or altered papers is illegal |
| Fair collection | No violent, threatening, harassing or humiliating collection against borrowers or their families; social security benefits may not be offset |
| Penalties | Unlicensed lending: fine up to Rs. 5 million, prison up to 5 years, or both; administrative charges up to Rs. 2 million |
| Unenforceable loans | Agreements made in breach of the Act or its directives are void and cannot be enforced in court |
When it starts
Only section 1 took effect on March 20, 2026. Sections 2 to 82 come into force on a date the Minister appoints by order in the Gazette. The Finance Ministry, with technical assistance from the Asian Development Bank, was still building the Authority and its supervisory framework in October 2026. After the appointed date, existing moneylenders get 24 months to apply for a licence, and microfinance companies licensed under the 2016 Act are treated as licensed or get up to 12 months to adjust. In practice, the new protections will reach most borrowers gradually.
How to check a lender today
- Use regulated lenders: the CBSL publishes lists of licensed commercial banks, licensed finance companies and licensed microfinance companies; borrowing from them already gives you CBSL oversight. See our list of licensed commercial banks in Sri Lanka.
- Be wary of loan apps: the CBSL has warned about unauthorised digital lenders; do not install apps from links in messages or give access to your contacts.
- Read the agreement: ask for the annual effective rate and never sign a blank or incomplete document, a practice the new Act explicitly bans.
Where to complain
Complain to the lender first. If you get no satisfactory answer within 14 days, escalate to the CBSL's Financial Consumer Relations Department through its online complaint management system, or use the Financial Ombudsman of Sri Lanka. For harassment, threats or data theft by an unregulated lender or app, report to your nearest police station or the Police Computer Crime Investigation Division, and report online incidents to Sri Lanka CERT. If you are comparing formal loan offers, start with our guide to applying for a loan online in Sri Lanka.
In short
The 2026 Act will bring moneylenders and loan apps under licensing, cap total interest at the amount lent and outlaw abusive collection, but its main provisions await a Gazette order. Until then, borrow from CBSL-regulated institutions, insist on a written agreement with the annual effective rate, and report harassment to the CBSL, the Ombudsman or the police.