Sri Lanka's Gambling Regulatory Authority Act, explained
In 2025, Sri Lanka moved gambling from a patchwork of older laws into a single, modern framework with one dedicated regulator. Here is what changed, in plain terms.
For years, gambling in Sri Lanka sat under a mix of older statutes and ad hoc arrangements. Casinos operated under provisional registrations, oversight was spread thinly, and there was no single body responsible for the sector. The Gambling Regulatory Authority Act, No. 17 of 2025 changed that. It established a dedicated Gambling Regulatory Authority and gave the country, for the first time, a unified structure for licensing and supervising gambling.
What the Act sets out to do
At its core, the law does three things. First, it creates a single authority with a clear mandate to license, supervise and enforce. Second, it defines who may offer gambling and under what conditions, replacing informal arrangements with formal licences. Third, it builds in the expectations that modern regulators everywhere now treat as standard: know-your-customer checks, anti-money-laundering controls, responsible-gambling protections, and record keeping that stands up to inspection.
In other words, the goal is not simply to permit gambling. It is to regularise it, so that a legitimate operator can run a compliant business and the public has protections that were previously inconsistent.
Digital and software provisions
The Act looks forward as well as back. Alongside land-based gambling, it contemplates digital gambling and the software that powers it. That matters, because the fastest-growing part of the sector worldwide is online, and a framework that ignored digital would be out of date on the day it passed. The Act anticipates a licensing route for the technology behind gambling products, not only for the operators who offer them.
The practical takeaway: in the new framework, the platform an operator runs is not an afterthought. It is part of what the regulator will expect to be sound, documented and auditable.
Where things stand now
A law passing is the beginning, not the end. The Authority is being established, and the detailed licensing requirements, including the specifics for digital gambling and gambling software, are still being finalised. Existing casino operators continue under provisional registrations that are expected to transition into the new regime. This is a normal sequence. The primary legislation sets the direction, and the detailed rules follow.
For anyone in or around the sector, the sensible posture during this period is readiness. The direction of travel is clear even where the fine print is not yet published, and the controls a serious regulator will ask for are well understood from comparable jurisdictions.
Why this is good news for serious operators
Regulation is often framed as a burden. For a serious operator it is closer to the opposite. A clear framework raises the floor, rewards operators who invest in doing things properly, and gives customers, banks and partners a reason to trust the product. It also opens the door to new, regulated offerings that would have been hard to justify under the old uncertainty.
The operators best placed to benefit are the ones who treat compliance as a design goal rather than a box to tick later.
What it means if you build for the sector
For a technology company, the message in the 2025 Act is straightforward. Software for regulated gambling now has to be built to a standard: data handled correctly, money accounted for exactly, activity logged in a way that cannot be quietly altered, and reports available in the form a regulator or bank will ask for. Building that in from the start is far cheaper and more credible than retrofitting it under pressure later.
That is the thread running through everything we write here. The law sets a bar. Meeting it well is an engineering problem as much as a legal one.