Regulatory Guide · Updated 2026

Are Online Loans Legal in Sri Lanka? CBSL vs ROC — Complete 2026 Guide

Sri Lanka's digital lending landscape involves two separate regulatory frameworks that are frequently confused. Understanding the difference between a CBSL-licensed finance company and an ROC-registered digital lender is essential before borrowing — or dismissing a lender as unregulated.

Priyantha Jayasuriya
Priyantha Jayasuriya Financial Analyst

Lead Financial Analyst & Banking Specialist

MBA (Finance) - University of Colombo
Independently Audited & Verified
Published: 2026-08-20·Updated: 2026-08-25

Key Takeaways & Quick Summary

  • Digital micro-lenders in Sri Lanka operate legally under the Companies Act, not the Finance Business Act.
  • CBSL licences are required for deposit-taking institutions only — not all lending entities.
  • Verify any lender by searching their PV number at the Registrar General of Companies.
  • DALA membership signals voluntary ethical compliance — it is not a government licence.

The Two Regulatory Frameworks in Sri Lanka's Lending Market

Framework 1: CBSL Licence

The Central Bank of Sri Lanka (CBSL) licences institutions under the Finance Business Act No. 42 of 2011. These are deposit-taking finance companies — institutions that accept deposits from the public (like savings accounts or fixed deposits) and lend that money.

Commercial Banks (CBSL-regulated)
Licensed Finance Companies (LFCs)
Specialised Leasing Companies (SLCs)

Examples: Sampath Bank, Commercial Bank, People's Leasing

Framework 2: ROC Registration

The Registrar General of Companies (ROC) registers all private limited companies under the Companies Act No. 7 of 2007. Digital micro-lenders that lend their own proprietary capital (no public deposits accepted) operate under this framework — legally, without requiring CBSL licencing.

Digital micro-lenders (CashX, LoanPlus, CashLoan)
Registered as Private Limited (PV) companies
Do NOT accept public deposits

Examples: CashX (PV00211145), LoanPlus (PV00215063), CashLoan (PV00329585)

Why Digital Lenders Don't Need (and Cannot Get) a CBSL Finance Licence

A CBSL finance company licence is designed for institutions that take deposits from the public. Digital micro-lenders like CashX and LoanPlus are private companies that lend their own invested capital — they do not solicit public deposits. Therefore, the Finance Business Act does not apply to them, and they are not eligible for (or required to hold) a CBSL finance company licence.

The absence of a CBSL licence does not make these lenders illegal or unregulated. They are fully incorporated legal entities under the Companies Act with verifiable PV registration numbers, subject to the same corporate governance laws as any other Sri Lankan private limited company.

How to Verify a Sri Lankan Digital Lender is Legal

1
Check the PV Registration Number
Every legitimate digital lender will display its Private Limited (PV) company registration number on its website, usually in the footer. Search this number at the Registrar General of Companies, Colombo to confirm it matches the stated entity name.
2
Verify the Registered Company Name
Ensure the company name on the loan agreement and website matches the ROC registration. For example, LoanPlus is operated by "AIS IT Consulting Services (Private) Limited" — not some anonymous entity.
3
Check for DALA Membership (Optional but Recommended)
DALA-accredited lenders have committed to transparent fees, ethical debt collection, and no intrusive mobile permissions. Currently, LoanPlus is the only DALA member among listed providers.
4
Never Transfer an Upfront "Processing Fee"
Legal lenders deduct any processing fees from the disbursed loan amount — they never ask you to transfer a fee to a personal bank account before receiving the loan. This is the #1 indicator of a loan scam.

Illegal vs Legal Lenders — Quick Reference

Signs of an Illegal Lender

  • No PV registration number displayed
  • Demands upfront fee before disbursement
  • Requests READ_CONTACTS or camera access
  • Anonymous owners with no legal entity
  • Threatens to contact your relatives

Signs of a Legal Lender

  • Displays PV number + registered entity name
  • Published loan agreement with fee schedule
  • No upfront payments required
  • Secure HTTPS browser application (no sideloaded APK)
  • Clear complaint/contact channels

Online Loans & Sri Lanka Law — FAQs

Not necessarily. Only deposit-taking institutions (banks and registered finance companies accepting public deposits) require a CBSL licence under the Finance Business Act. Non-deposit-taking digital micro-lenders that lend their own capital are not required to hold a CBSL finance company licence — they operate legally under the Companies Act No. 7 of 2007.