FXSOFT
Skip to content

Regulatory Guide for Authorized Money Changers

What Sri Lanka's regulators require of a licensed money changer — and exactly where FXSOFT helps. Drawn from the official documents and current as of October 2026.

Who regulates a money changer

Two regulators, one set of daily duties

The Department of Foreign Exchange licenses and supervises your business. The Financial Intelligence Unit supervises how you prevent money laundering and terrorist financing. Your team answers to both, every day.

Department of Foreign Exchange (DFE)

Part of the Central Bank of Sri Lanka. Issues the money-changing permit under the Foreign Exchange Act, No. 12 of 2017, and sets the operating rules: currently Directions No. 01 of 2025 (10 March 2025) and the Operational Guide to Authorized Money Changers (updated 9 September 2026).

Financial Intelligence Unit (FIU)

Enforces the Financial Transactions Reporting Act, No. 6 of 2006 (as amended by Act No. 17 of 2026). The Act expressly covers “money and currency changing services”, so its customer due diligence, reporting, and record-keeping duties apply to you.

United Nations sanctions regime

Under the United Nations Act, No. 45 of 1968, regulations give effect to UN Security Council resolutions. Designated persons appear on the UN consolidated list and on Sri Lanka's own 1373 list, administered by the Competent Authority. You must not deal with them.

The DFE's own term for a permit holder is “Restricted Dealer”. Those permitted to buy, sell and exchange foreign currency notes are called Authorized Money Changers (AMCs), in four categories: A (companies exclusively in money changing), B (licensed finance companies and specialized banks), C (hotels graded four stars and above), and D (other entities such as retail chains).

Requirements and FXSOFT

What is required, and where FXSOFT fits

Each row below is taken from the official documents listed at the bottom of this page. The right-hand column says plainly what FXSOFT does about it.

  • Built in FXSOFT does this for you
  • Supports FXSOFT prepares or records it; your team completes the step
  • Your process Stays with your business
What the regulator requiresSourceIn FXSOFT
Running the business — Department of Foreign Exchange
Automate every transaction in software that produces periodic reports centrally. Directions No. 01 of 2025, para. 10.1; Operational Guide §3 and §7.C Built in

Every transaction is recorded in FXSOFT as it happens, and every report is generated from that single record.

Issue a system-generated, serial-numbered receipt for every transaction, showing the business address, printed in two copies, with receipts retrievable from the system. Directions para. 9.5; Operational Guide §7.B Built in

Serial-numbered receipts carry your permit number, business name, address and contact details, the customer's name and NIC or passport number, the source of foreign currency, and each currency line with its rate.

Print in two copies with the A4 dual-copy layout, or on A5 or 76 mm roll. Every receipt can be found and reprinted from the invoice list.

Maintain a Purchase Register recording each purchase: date, receipt number, customer, NIC/passport, source of foreign currency, amount, rate and rupees issued. Operational Guide §7.C, Specimen 4 Built in

The Purchase Register carries all of those columns, plus customer nationality and address, for any date range, on screen or as a PDF.

Produce daily, monthly or periodic Balance Statements by currency. Operational Guide §3 and §7.C, Specimen 6 Built in

The Daily Balance Statement shows each currency's opening balance, purchases, deposits to the Authorized Dealer and closing balance for any period.

Report daily purchases and deposits of foreign currency to the DFE through its web-based reporting system. Directions para. 10.3 Supports

FXSOFT generates the day's transactions as a Central Bank-format TXT file (header record, one line per transaction, checksum on every record) for any date or date range, ready to upload.

Send the DFE a monthly Statement of Deposits of foreign currency, confirmed by your Authorized Dealer, by the 7th working day of the following month. Directions para. 11.1; Operational Guide, Specimen 7 Supports

The Monthly Deposit Statement is prepared per bank and currency as a PDF or Excel file. Getting it confirmed and sending it on time remains with your team.

Deposit foreign currency with an Authorized Dealer within the permitted number of working days (three for money changers that do not sell; five for those that do). Directions paras. 9.4 and 18 Supports

Record every deposit by bank, currency and rate; the Balance Statement and bank statements show exactly what has been deposited.

Category A: meet the minimum annual foreign currency deposit requirement to be eligible for permit renewal. Operational Guide §4 (renewal) Built in

FXSOFT tracks the USD value of every deposit and shows your progress against your annual USD deposit target.

Be able to produce receipts, the registers and balance statements, whenever the DFE asks, including on-site inspection. Operational Guide §7.G Built in

Every register, statement and receipt is available on screen or as a PDF in seconds, for any date range.

Keep transaction records for at least six years, in a form that can reconstruct each transaction and be produced as evidence. CDD Rules, rules 89–90; FTRA s.4 (as amended 2026) Supports

Transactions, currencies, rates, customers and ID copies are stored in your own workspace and retrievable by date, customer or invoice. Retaining them for the full period is a duty of your business.

Knowing your customer — Financial Intelligence Unit
Carry out customer due diligence for money-changing transactions above Rs. 200,000 (or the foreign-currency equivalent), including linked transactions, and obtain copies of identification documents. CDD Rules, rules 26(b) and 47(a) Built in

A Customer Due Diligence form appears automatically when an invoice crosses the threshold (Rs. 200,000 by default), is stored with the invoice, and can be printed straight after saving.

Identify the customer and record full name as on the ID, photo-ID details (NIC, passport or driving licence), address, contact and nationality; keep a copy of the ID. CDD Rules, rule 27 and Schedule; FIU Circular 3/2024 Built in

A KYC profile holds each of those details, plus uploaded copies of the NIC, passport and driving licence. FXSOFT AI can read an NIC or passport photo and fill the form for you.

Identify a person acting on behalf of the customer, and the beneficial owner. CDD Rules, rules 29–30; FTRA s.2 (as amended) Built in

The CDD form records when a transaction is made on behalf of another person, and that person is screened against the sanction lists.

Determine whether a customer is a politically exposed person (PEP), and establish the source of funds. CDD Rules, rule 59 Supports

The CDD form captures PEP status, source of funds, occupation, and the purpose of the transaction. Senior-management approval and enhanced monitoring follow your own policy.

If due diligence cannot be completed, do not carry out the transaction, and consider a suspicious transaction report. FTRA s.3 (as amended 2026); CDD Rules, rule 35 Your process

The decision belongs to your staff and compliance officer; FXSOFT's records give them what they need to make it.

Sanctions and terrorist financing — FIU and the United Nations regulations
Check every prospective customer or beneficiary against the lists of designated persons before dealing with them. CDD Rules, rule 95 (as amended 2018); FIU Circular 01/2014, para. 4 Built in

Customers are screened when added, when edited, and when selected on an invoice, against the UN consolidated list and Sri Lanka's 1373 list. People acting on behalf of others are screened too.

Maintain a database of the designated names that is kept up to date and easily accessible to staff. FIU Circular 01/2014, paras. 2–3 Built in

The lists are loaded and refreshed automatically every morning, and the loaded list files can be viewed and downloaded inside FXSOFT.

Screen the whole customer database against the current lists on a regular cycle (at least quarterly), and keep records of the results and the actions taken. FIU Circular 02/2026 (22 May 2026) Built in

Every customer is re-screened automatically on the 1st of each month, and you can run a bulk scan whenever lists change. Every scan and result is logged by day and month, with a printable report.

On a match: do not deal with the person, tell the FIU within 24 hours, and notify the Competent Authority. FIU Circular 01/2014, para. 5 Supports

FXSOFT shows the match immediately, with the list, the field that matched and a score, and logs it with the time. The report to the FIU is made by your compliance officer.

Report suspicious transactions to the FIU as soon as practicable and within two working days of forming the suspicion. FTRA s.7 (as amended 2026) Your process

Your compliance officer files the report. The screening log, CDD forms and transaction records in FXSOFT provide the supporting evidence.

What software cannot do

Duties that stay with your business

No system replaces your people and your policies. The regulators hold directors, key management and compliance officers accountable, whichever software you use.

  • Appoint a qualified compliance officer (Operational Guide, Annex 3).
  • Adopt a board-approved AML/CFT policy and an internal AML/CFT risk assessment, and train your staff (CDD Rules, rules 4–17).
  • File suspicious transaction reports and sanction-match reports yourself.
  • Arrange an independent annual audit and send audited accounts within six months of year end (Directions paras. 13.1; Operational Guide §7.E).
  • Keep a current list of authorized staff with specimen signatures, and install and maintain CCTV with 60 days of recordings (Directions paras. 5.1 and 12).
  • Display daily rates, buy within the rate limits set by your Authorized Dealer, and keep two-person control over larger transactions (Directions paras. 9.3, 9.6 and 9.7).
  • If you are permitted to sell: sell only for foreign travel, up to USD 5,000 per person per trip, on Form I with the required documents and a passport endorsement (Directions paras. 14–17).

Why it matters now

The regulators are paying attention

Recent documents show where money changers have fallen short, and what is at stake.

What the FIU has found missing

In Circular 3/2024 (2 October 2024), addressed to the boards and CEOs of Restricted Dealers, the FIU said some had failed to comply and named these weak spots. FXSOFT helps with the first three.

  • Customer due diligence: not obtaining a copy of the customer's ID, and not applying enhanced due diligence to PEPs.
  • Targeted financial sanctions screening.
  • Record keeping.
  • Suspicious transaction reporting, AML/CFT policies, staff training, risk management and internal controls.

What is at stake

Under the Financial Transactions Reporting (Amendment) Act, No. 17 of 2026 (certified 4 August 2026), the FIU can impose a range of administrative sanctions after giving you a chance to respond:

  • A written warning, a remedial order, or a public statement.
  • A cease-and-desist order.
  • A monetary penalty of up to Rs. 100 million for a contravention, and up to Rs. 200 million for a repeat.
  • A recommendation to the supervisor to suspend or revoke your licence.

The Central Bank has also warned that errant money changers can have their permits suspended or revoked.

Key dates

The rules that shape your day-to-day

A short timeline of the documents above, oldest first.

  • 30 January 2014FIU Circular 01/2014 tells every Authorized Money Changer to keep a current database of designated persons, check customers before transacting, and report any match within 24 hours.
  • 27 January 2016Financial Institutions (CDD) Rules, No. 1 of 2016 set the Rs. 200,000 due diligence threshold for money changing and the six-year record-keeping rule. Amended on 8 October 2018 to widen sanctions screening to all UN targeted financial sanctions.
  • 2 October 2024FIU Circular 3/2024 warns Restricted Dealers about gaps in CDD, sanctions screening and record keeping.
  • 10 March 2025DFE Directions No. 01 of 2025 are issued to Authorized Money Changers, replacing Directions No. 11 of 2020 and No. 05 of 2022.
  • 22 May 2026FIU Circular 02/2026 asks for full-database sanctions screening, repeated at least quarterly, with records kept.
  • 4 August 2026FTRA (Amendment) Act, No. 17 of 2026 is certified. It sets out the risk-based approach, when due diligence is required, six-year record keeping, suspicious transaction reports within two working days, and graduated administrative sanctions.
  • 9 September 2026DFE Operational Guide to Authorized Money Changers last updated.

Official sources

Read the documents yourself

Please note. This page is a general guide based on the documents above as at October 2026. It is not legal advice, and FXSOFT does not guarantee that using the software makes a business compliant. Requirements change, and some documents (such as Circular 02/2026) are addressed to financial institutions generally, so confirm how they apply to your permit with the DFE or the FIU.

Related reading: How to get a money changing licence · Glossary of terms · FAQ

Ready to see FXSOFT in action?

Watching FXSOFT handle a real multi-currency invoice, an automatic sanction screen, and a Central Bank report in minutes says more than any brochure. Book a live demo and see exactly how much manual work you can hand off.