Blood in Port City: How Sri Lanka's Special Economic Zone Became a Structural Gateway for Transnational Cyber-Fraud

A Zone Built for Investment — and Its Blind Spots

The Colombo Port City Economic Commission Act No. 11 of 2021 created a Special Economic Zone with its own licensing authority, tax holidays of up to 25–40 years, unrestricted foreign-exchange transactions in sixteen currencies, and 100 percent foreign ownership. The Commission registers businesses separately from the national Registrar-General of Companies. Critics warned from the outset that this bespoke architecture — insulated from ordinary company-law oversight — could shelter illicit actors. As early as 2021, then-U.S. Ambassador Alaina Teplitz publicly cautioned that the legislation risked creating 'a haven for money laundering and other sorts of nefarious actors.'

The Visa-Abuse Scandal: A Port City Company With No Physical Presence

The Port City dimension of Sri Lanka's cyber-fraud crisis crystallised in May 2026 when lawyers representing 37 Chinese nationals before the Kaduwela Magistrate's Court disclosed their clients had obtained visas through a company registered under the CPCEC Act — a company with no verified physical presence inside Port City. The revelation triggered a joint investigation by Port City authorities, the Ministry of Finance, the Department of Immigration and Emigration, and Sri Lanka Police, as well as an internal inquiry by the Economic Commission itself. No named company or individual had been publicly charged with money laundering through Port City entities as of late July 2026.

Arrests Surge; Convictions Do Not Follow

Over 1,000 foreign nationals — predominantly Chinese, but also Indian and Nepali — were detained for cyber-fraud in the first five months of 2026 alone, exceeding all of 2025. Raids uncovered SIM-box devices, forged documents, communications equipment, and cryptocurrency channels. A July 2026 murder inside Port City deepened suspicions of Chinese organised-crime networks; police alleged the victim was linked to computer fraud and that those involved had no lawful employment. Yet the Council of Europe's Octopus Cybercrime Community has documented a structural gap: Sri Lanka has no specialised cybercrime prosecution unit within the Attorney General's Department, constraining the conversion of mass arrests into convictions.

AML Failures: A System Rated Effective on Zero Indicators

Sri Lanka's broader AML/CFT system has remained in APG enhanced follow-up since its 2021 mutual evaluation, rated 'Highly Effective' for zero of the FATF effectiveness indicators. Documented systemic gaps include delays in customer screening, failure to verify against UN sanctions lists promptly, and inadequate senior management oversight — deficiencies the Financial Intelligence Unit acknowledged through enforcement penalties issued between October 2025 and March 2026. The FIU launched its first formal identification survey of Virtual Asset Service Providers only in late 2025; no final VASP legislation had been enacted by mid-2026. Analysts warn this regulatory vacuum is precisely the finding that could return Sri Lanka to the FATF grey list.

What Remains Unproven — and Why That Matters

No regulatory audit findings, transaction data, or corroborated whistleblower testimony has emerged publicly linking Port City's *licensed* financial-services operators — offshore banks, payment processors, or digital-asset firms — to scam-centre proceeds. Documented illicit flows have instead been traced to informal hawala and undiyal networks and stablecoin-layered platforms outside the Port City perimeter. The absence of evidence should not be read as exoneration: investigators, civil society, and the Lowy Institute have all noted that Sri Lanka's fragmented inter-agency information-sharing means illicit flows through any channel, including regulated ones, may not yet have been detected or disclosed.

Timeline

1. 2021
   Colombo Port City Economic Commission Act No. 11 of 2021 enacted; U.S. Ambassador Alaina Teplitz publicly warns the legislation risks creating 'a haven for money laundering.'
2. 2021
   APG completes Sri Lanka's third-round mutual evaluation; country placed in enhanced follow-up, rated 'Highly Effective' on zero FATF effectiveness indicators.
3. 2024-10-13
   Sri Lanka Police detain 198 Chinese nationals at four locations in a major cybercrime raid; police note they sought assistance from the Chinese Embassy to question suspects due to language barriers and absence of a formal extradition treaty.
4. 2025
   Sri Lanka's Financial Intelligence Unit launches its first mandatory survey of Virtual Asset Service Providers; no VASP legislation enacted by mid-2026.
5. 2025-03
   APG commences Sri Lanka's fourth-round mutual evaluation, with an onsite visit in the latter half of 2025; Mutual Evaluation Report adopted July 2026, specifically assessing beneficial-ownership disclosure standards.
6. 2026-04-04
   Sri Lanka arrests 152 foreigners over a hotel-based cyber-scam ring; over 1,000 foreign nationals detained in the first five months of 2026 alone.
7. 2026-05
   Lawyers for 37 Chinese nationals before Kaduwela Magistrate's Court reveal their clients obtained visas through a CPCEC-registered company with no physical presence inside Port City; joint investigation launched by Port City authorities, Ministry of Finance, Immigration, and Police.
8. 2026-07
   A murder and abduction of Chinese nationals inside the Port City precinct exposes alleged links to Chinese organised-crime and cyber-fraud syndicates; police allege the victim was connected to computer fraud; no lawful employment established for those involved.

Key claims & status

Sources

1. [S1]Parliament of the Democratic Socialist Republic of Sri Lanka: Colombo Port City Economic Commission Act, No. 11 of 2021 — Full Text (Parliament of Sri Lanka)
2. [S2]Colombo Port City Economic Commission (official): Port City Colombo — Investor-Friendly Regulatory Framework
3. [S3]Colombo Port City Economic Commission (official): Port City Colombo — About Us
4. [S4]Wikipedia: Port City Colombo (Wikipedia — incentives and IMF fiscal reform)
5. [S5]Sri Lanka Guardian: Port City Colombo: China's Crime Zones?
6. [S6]Eurasia Review: The Triad Connection: China's Criminal Footprint In Sri Lanka — OpEd
7. [S7]Lanka Newspapers: Blood in Port City: Colombo Murder Lifts Lid on Chinese Cyber-Fraud Networks Operating in Sri Lanka
8. [S8]The Sunday Times (Sri Lanka): Major crackdown on scam centres amid fears Lanka becoming cybercrime hub
9. [S9]Malay Mail / AFP: Sri Lanka arrests 152 foreigners over hotel-based cyberscam ring
10. [S10]AsiaNews: Hundreds of foreigners arrested for operating scam centres near Colombo
11. [S11]Asia/Pacific Group on Money Laundering (APG): APG High-level Delegation Visits Sri Lanka (4th Round Mutual Evaluation preparation)
12. [S12]EU AML/CFT Global Facility: Sri Lanka AML/CFT Activities
13. [S13]EconomyNext: Sri Lanka seeks US maritime cooperation — AML/CFT enforcement and systemic gaps
14. [S14]Sri Lanka Mirror: Suspicion that Port City visas are being used to commit cyber crimes
15. [S15]News 1st (MTV Channel / MBC Networks): Chinese Triads Angle Emerges in Sri Lanka's Port City Killing
16. [S16]News4Hackers: Colombo Port City Murder Unveils Rising Chinese Cyber-Fraud Network in Sri Lanka
17. [S17]Malay Mail: Sri Lanka busts Chinese cybercrime racket
18. [S18]FATF-GAFI (Financial Action Task Force): FATF releases new paper on cyber-enabled fraud
19. [S19]LawStreet: 173 Indians Among 198 Foreigners Arrested in Sri Lanka's Expanding Cybercrime Crackdown
20. [S20]Council of Europe – Octopus Cybercrime Community: Sri Lanka – Octopus Cybercrime Community (Country Profile)
21. [S21]Financial Intelligence Unit of Sri Lanka (official): Financial Intelligence Unit of Sri Lanka – International Cooperation
22. [S22]Council of Europe – Cybercrime Programme: Sri Lanka – Cybercrime (GLACY+ Country Page)
23. [S23]Sri Lanka Mirror: 198 Foreign Cybercrime Suspects Arrested
24. [S24]News 1st (Sri Lanka): Chinese Triads Angle Emerges in Sri Lanka's Port City Killing
25. [S25]Business Standard: Sri Lanka emerging as new base for Asia's billion-dollar scam networks
26. [S26]E-International Relations: Sri Lanka's Brief Window to Stop Displaced Cyber-Scam Networks
27. [S27]Lowy Institute – The Interpreter: Asia's scam centre problem is moving on, not shutting down
28. [S28]Daily News (Sri Lanka): Sri Lanka's crypto regulation roadmap: what the 2026 framework actually means
29. [S29]The Island (Sri Lanka): The Digital Underground