information security staff or external experts.
(v) Vulnerabilities identified shall be remediated within a time period approved by
the ISC.
5.8.3 Penetration tests by independent external experts
(i) Objective
 Licensed banks sh all conduct penetration tests by independent external experts
to determine: the ability of tested information systems to withstand real -world


21
 style attacks; the required level of sophistication and persistence an attacker
should possess to successfully compromise the tested information systems;
ability of the bank’s information security, operational , and leadership teams to
detect and appropriately respond to such attacks; and any enhancements
required to mitigate such threats in future.
(ii) Scope and frequency
(a) Critical information systems , information systems exposed to customer
data,  and repositories of customer data with the licensed bank, agents,
and third -party service providers  shall be subjected to penetration te sts
by independent external penetration testing expe rts.
(b) Critical information systems shall be subjected to penetration tests at
least annually while all other qualifying information systems and
repositories of customer data as per 5.8.3(ii) (a) shall be s ubjected to
penetration tests at least once in every two years.
(c) The Board of Directors of a licensed bank may require the qualifying
agents and third -party service providers of the licensed bank to conduct
penetration tests for applicable information syste ms and customer data
with them in accordance with these requirements and report to the bank,
instead of being included in the scope of the penetration tests
commissioned by the bank. The Board of Directors shall make such a
request only after determining t hat the relevant agent or third -party
service provider is capable of conducting a penetration test in
accordance with the requirements stipulated in this framework and after
ensuring adequate oversight is available to ensure objective of
penetration testin g is achieved.
(d) Penetration tests shall be controlled exercises to simulate real -world
attacks on real systems and data  using tools and techniques similar to
those used by actual attackers , to identify  vulnerabilities that can be
successfully exploited, e ither individually or together with other


successfully exploited, e ither individually or together with other
vulnerabilities , within the same information system or across multiple
information systems, to compromise the security of tested information
system.


22
 (e) Penetration tests shall be conducted on live/production systems under
normal business conditions, subject to 5.8.3(ii)(f ) and 5.8.3(viii)(c).
(f) Licensed banks subject to the timelines stipulated under transitional
arrangements in Section 10, may initially conduct penetration tests on
non-production systems that resemble production systems to the best
possible extent instead of production systems in order to gain sufficient
maturity to conduct penetration tests on production systems. All other
requirements on penetration testing shall be fulfilled even when
penetration tests are conducted on such non -production systems, except
when deviations are allowed or necessary .
(g) Penetration testing shall be conducted without changing any of the
information security measures that are normally in place, in order to
determine the true level of sophistication and persistence required by an
attacker to penetrate tested information systems or data. However,
licensed banks may conduct such exercises with reduced information
security as separate or supplementary exercises at the discretion of the
Board of Directors.
(h) Penetration testing shall cove r both external and internal threats and
vulnerabilities.
(i) Penetration test s shall attempt to exploit  vulnerabilities in the
technology layer including software/application vulnerabilities as well
as vulnerabilities in processing, networking, and storage in frastructure
of information systems.
(j) Both black box penetration testing and gr ay box penetration testing
using bank provided login credentials for different user categories
including customers, managerial and operational level business users,
and third -party users shall be conducted . However, gray box penetration
testing using privileged user credentials are not necessary.
(k) Penetration tests need not attempt to exploit vulnerabilities that may
exist in human or physical layers of security.


exist in human or physical layers of security.
(l) Scope of each pe netration testing exercise shall be defined and
documented in  a Penetration Test Scope Specification (PTSS).


23
 (iii) Leadership team, p roject manage r, and designated point of contact
(a) The Board of Directors of the licensed bank shall appoint a leadership
team for the effective conduct of each annual penetration testing
exercise.
(b) The leadership team shall have full authority and responsibility  for the
overall conduct of the penetration testing exercise .
(c) The leadership team shall ensure that the penetration testing is
conducted in a manner that will best achieve the objective in 5.8.3(i) ,
while ensuring risks are appropriately managed.
(d) The leadership team shall possess sufficient business, operational,
technical , and risk management  related knowledge and experience.
(e) The leadership team shall mainly comprise of management team
members, preferably drawn from the members and observers of ISC,
with adequate authority to make  critical decisions during the test. The
highest decision makers in the licensed bank’s incident escalation chain,
who are responsible for informing actual security breaches to  external
parties including law enforcement  authorities and regulators, shall al so
be members of the leadership team.
(f) The leadership team shall be chaired by the licensed bank’s CEO or a
management  team  member who is directly reporting to the CEO,
preferably C hief Operating Officer (COO)/Head of Operations ,
CIO/Head of Information Te chnology , or CISO.
(g) The leadership team shall designate one of its members as  the project
manager, for the day-to-day project management of the penetration
testing exercise.
(h) There shall be designated deputies for both chairperson and project
manager due t o the critical nature of both the roles.
(i) A senior member of the penetration testing service provider with full
decision making authority shall be appointed as the designated point of
contact for the leadership team. Leadership team may invite such
designat ed point of contact to attend its meetings.


24
 (iv) Risk management
(a) The leadership team shall establish a risk management plan, for each
annual penetration testing exercise, incorporating appropriate controls,
processes, and procedures to ensure associated ris ks are identified,
assessed , and treated in accordance with the licensed bank’s risk
appetite.
(b) The risk management plan shall include a comprehensive risk
assessment and a risk treatment plan detailing risk mitigation strategies
for various risk scenarios including but not limited to denial -of-service
incidents, unexpected system crashes, damage to critical live production
systems, and the loss, modification or disclosure of data.
(c) The leadership team shall also implement processes to continuously
monitor in cident escalation procedures to decide  the triggering of
actions that would be mandatory in the case of a real incident  but may
not be  necessary when the incident  is due to penetration testing
exercises.
(d) The leadership team may order a temporary or comple te cessation of the
penetration testing exercise, when there is any incident that in the
opinion of the leadership team requires such cessation.
(e) Licensed banks  shall ensure that the number of persons with prior
knowledge on penetration testing exercise is  kept to a minimum, in order
to gain the maximum possible learning experience. Accordingly, the
leadership team shall decide who, among the licensed bank’s employees
and relevant external parties, will know about  the penetration testing
exercise until its completion.
(f) Licensed banks shall employ a scheme of code names to identify
information systems and data being tested throughout the penetration
testing exercise.
(g) Licensed banks shall ensure that only penetration testing service
providers possessing sufficient compete ncies, qualifications, and
experience to conduct penetration tests on banking information systems
are engaged.


25
 (h) Penetration testing service provider shall be required to maintain
comprehensive logs of the entire penetration testing exercise  to enable
recreation of any step executed during the penetration test ing.
(i) Licensed banks shall ensure the availability of non -disclosure agreement
with the penetration testing service provider.  Licensed banks shall
require the  penetration testing service p rovider  to ensure that all
person nel deployed by the  penetration testing service provider for the
penetration testing exercise abide by such  non-disclosure agreement.
(v) Selection of penetration testing service provider
(a) Licensed banks shall employ a transpar ent procurement process with
adequate due -diligence measures to select the penetration testing service
provider.  Such process shall include :
i. Obtaining multiple recent references from previous customers of the
service provider who are acceptable to the lic ensed bank ; and
ii. Conducting enhanced background checks for all team members
assigned by the service provider to the penetration testing exercise
or requiring the service provider to use a mutually acceptable party
to conduct such enhanced background checks  and submit to the
licensed bank.
(b) The penetration testing service providers  selected to conduct tests on
production systems  shall have their processes and procedures externally
assured and preferably be accredited or certified to provide penetration
testin g service s by a recognized body acceptable to the licensed bank.
(c) The selection of the external penetration testing service provider shall
be approved by the Board of Directors.
(d) Licensed banks shall change the penetration testing service provider to
a diffe rent service provider on a frequency decided by the B oard of
Directors .
(vi) Threat intelligence and designing of threat scenarios
(a) Penetration tests shall be threat intelligence -based  exercises.


(a) Penetration tests shall be threat intelligence -based  exercises.
(b) The licensed bank and the penetration testing service provider shall
mutually agree on the  sources of threat intelligence and threat
intelligence provider(s).


26
 (c) Penetration tests shall be based on pre-designed and realistic threat
scenarios against the licensed bank . Threat scenarios shall include
probable real -life attacks conceptualised from an attacker’s point of
view .
(d) Threat scenarios  of D -SIBs shall normally be designed based on both
targeted (bank specific) threat intelligence and generic threat
intelligence applicable to banking industry. T he Board of Directors of a
D-SIB may allow the designing of threat scenarios based only on generic
threat intelligence applicable to banking industry if obtaining targeted
threat intelligence on the bank is not feasible.
(e) Threat scenarios  of no n D-SIBs can  be designed based only on generic
threat intelligence applicable to banking industry , instead of targeted
threat intelligence  at the discretion of the Board of Directors .
(f) There shall be clearly defined targets to be achieved by the penetration
testing ser vice provider , to demonstrate a successful compromise,  for
each threat scenario.
(vii) Penetration Test Scope Specification (PTSS)
(a) Every annual penetration testing exercise shall be conducted based on a
PTSS.
(b) PTSS shall clearly identify the information systems a nd data subjected
to test, threat scenarios to be used, targets to be achieved , and time
period of the test.
(c) Penetration testing service provider shall develop the PTSS based on
input from the licensed bank and threat intelligence obtained , and submit
it to the approval of the licensed bank.
(d) Licensed bank shall have final authority over the PTSS.
(e) Approving authority for PTSS shall be the Board of Directors of the
licensed bank.
(f) Licensed banks shall ensure that p enetration testing service provider is
contra ctually bound to conduct the penetration testing exercise within
the limits specified in PTSS.
(viii) Approval for penetration tests
(a) Commencement of annual penetration tests and finalised PTSS shall be


(a) Commencement of annual penetration tests and finalised PTSS shall be
approved by the Board of Directors of the licensed bank, upon


27
 determining that the information systems to be tested should be able to
reasonably withstand the vigor of proposed  tests.
(b) The Board of Directors of a licensed bank may exclude any information
system from being tested in  a given annual penetration testing cycle, if
the Board of Directors determines that such information system is not
adequately secured to withstand a penetration test as required by this
framework. The Board of Directors shall immediately initiate
remediat ion measures as per 5.8.3(xi) for all such information systems.
(c) The Board of Directors may direct the leadership team to conduct a
mock penetration test on a non -live environment for any of the
information systems selected for penetration testing, prior to the conduct
of penetration test on the live environment. If such mock penetration test
successfully compromises an information system, the Board of
Directors may remove such information system from being tested in the
live environment and directly  initiate remediation measures as per 5.8.3
(xi).
(ix) Execution  of penetration tests
(a) Execution of penetration tests on live systems and data shall commence
only after PTSS is approved and communicated in writing to the
penetration testing service provider by the chairperson of the leadership
team.
(b) Sufficient time, as mutually agreed between the licensed bank and the
penetration testing service provider, shall be allocated to the execution
of penetration tests on live systems to allow a realistic and
comprehens ive test in which all scenarios are executed and all targets
are attempted to be achieved. Penetration testing service provider shall
ensure that the penetration tests are executed only during such mutually
agreed time period.
(c) Licensed banks shall ensure t hat penetration testing service provider is
contractually bound to fulfill their obligations as per 5.8.3(ix)(a) and (b).
(x) Reports of annual penetration testing exercise


(x) Reports of annual penetration testing exercise
(a) Licensed banks shall require the penetration testing service provider to
submit a detai led report on the entire penetration testing exercise
including how requirements of PTSS were achieved. Such report shall


28
 also mention whether a compromise was made, what systems and data
were compromised, and how the compromise was achieved, on each
infor mation system and threat scenario included in the PTSS.
(b) Leadership team upon the completion of testing period shall require the
licensed bank’s information security and incident response teams to
provide reports on their observations on the incidents detec ted and
responsive measures carried out during the testing period.
(c) Leadership team shall prepare a final report on the penetration testing
exercise based on the above reports and submit to the Board of Directors
through ISC and BIRMC. Such report shall s ummarise the scope and
outcome of the penetration testing exercise, leadership team’s
assessment on bank’s information security and incident response
preparedness, and proposed remediation measures in consultation with
CIO/Head of I nformation Technology  and CISO.
(xi) Remediation
(a) Information systems  and repositories of data  that were compromised
during penetration tests or excluded from the penetration testing scope
shall be remediated immediately.
(b) The Board of Directors of the licensed bank shall actively consider
replacing or shutting down any information system or repository of data
that was excluded from penetration testing or compromised due to any
form of external penetration testing, if it cannot be adequat ely
remediated to withstand the penetration tests during next penetration
testing exercise. Enhanced and sufficient monitoring and control
measures approved by the Board of Director s shall be implemented
immediately, until such a system is improved, replac ed, or shut down.
(c) The Board of Directors shall either implement measures as per
5.8.3(xi)(b) or  immediately implement additional control measures to
eliminate the risks identified, when the compromise was due to internal
penetration testing.
(xii) Internal audit


penetration testing.
(xii) Internal audit
Annual penetration testing process shall be reviewed by the BAC as soon as it
is completed.


29
 (xiii) Reporting to Director of Bank Supervision
(a) Licensed banks shall submit an executive summary on the penetration
testing exercise, approved by the Boar d of Directors of the licensed
bank , to the Director of Bank Supervision within 60 days from receiving
the penetration testing report  from penetration testing service provider .
(b) Such executive summary  shall indicate number of  systems subjected to
tests, number of  systems excluded, number of systems compromised,
whether adequate remediation measures have already been implemented
or timeline for the implementation of remediation measures, internal
audit assurance  on the compliance of penetration testing exerci se with
the requirements in this r egulatory framework,  and a brief profile of the
penetration testing service provider.
5.8.4 Red team exercises by independent external experts
(i) Scope and frequency
(a) Licensed banks shall conduct red team exercises that simulate real world
adversary scenarios to gain a holistic understanding of the bank’s
information security capabilities.
(b) All critical information systems and information systems identified by
the licensed bank’s Board of Directors as per 5.8.4(i)(c) shall  be covered
under  red team exercises.
(c) The Board of Directors of the licensed bank shall evaluate all non-
critical information systems and data repositories to identify any non -
critical information systems and repositories of data that could cause
substanti al adverse impact  to the licensed bank due to an information
security breach and include those within the scope of red team exercises.
(d) Red team exercises shall be maximum -effort attempts to compromise
information systems and data by breaching all layers of  information
security including human, physical, and technology layers.
(e) Licensed banks shall conduct red team exercises as an extension of
penetration tests as per 5.8.3 to human and physical layers of


penetration tests as per 5.8.3 to human and physical layers of
information security.


30
 (f) Red team exercises shall be conducted together with penetration testing
exercises as per 5.8.3 during the cycles the licensed banks will be
required to conduct red team exercises.
(g) D-SIBs shall conduct red team exercises at least once in every 2 years
and licensed banks that are not D -SIBs shall conduct red team exercises
at least once in every 3 years.
(ii) Red Teaming Scope Statement (RTSS)
(a) Red teaming exercises shall be conducted based on a RTSS.
(b) RTSS shall clearly identify the information systems and data subjected
to test, staff membe rs of the bank and relevant third -party service
providers and agents that will be assessed under red teaming,
business/operational units and locations that will be assessed under red
teaming, techniques and methodologies allowed to be used for red
teaming assessments,  threat scenarios to be used, targets to be achieved,
and time period of the test.
(c) RTSS shall clearly define the limits applicable to red teaming service
provider when attempting to breach human and physical layers of
security. Service provide r shall be allowed to conduct only the tasks
explicitly permitted in RTSS.
(d) Approving authority for RTSS shall be the Board of Directors of the
licensed bank.
(e) Licensed banks shall ensure that every red teaming service provider is
contractually bound to cond uct the penetration testing exercise within
the limits specified in RTSS.
(iii) Approval  and procedure for the conduct of red team exercises
(a) The scope  including RTSS , service provider (s), commencement,  and
time period  for the conduct of red team exercises shall be approved by
the Board of Directors of the licensed bank.
(b) The Board of Directors shall ensure that the licensed bank has achieved
a sufficient level of information security maturity with respect to all 3
layer s of security to be tested through red team exercises, prior to the


layer s of security to be tested through red team exercises, prior to the
commencement of red team exercises.  If the Board of Directors
determine the level of information security maturity is inadequate, the


31
 Board shall initiate appropriate remediation measures and defer red team
exercises by a maximum period of 12 months.
(c) Licensed banks shall adopt a board approved procedure to conduct red
team exercises that is based on the procedural requirements specified in
5.8.3 with suitable deviations/changes approved by the Board of
Directors of the licensed bank.
(iv) Remediation
The Board of Directors of the licensed bank shall implement an action plan to
address the weakness identified during red team exercises with regard to human
and physical layers of information security in consultation with suitable experts
in addition to re mediation measures as per 5.8.3(xi)  with regard to weaknesses
in the technology layer .

6. Information system availability and disaster recovery

6.1 Scope
Requirements specified in 6.2 to 6. 6 shall be  applicable to critical information systems.

6.2 High availability
6.2.1 Licensed banks shall ensure that critical information systems achieve a high level of
system availability.
6.2.2 The Board of Directors  on the recommendation of BIRMC  shall establish the system
availability targets for each critical information sys tem.
6.2.3 BIRMC  shall ensure that achievement of system availability targets of critical
information systems are monitored and reported to the Board  of Directors .

6.3 Disaster recovery arrangements
6.3.1 Licensed banks shall ensure Disaster Recovery (DR) arrangements for critical
information systems comply with Recovery Time Objectives (RTO) and Recovery
Point Objectives (RPO) determined by the Board of Directors on the recommendation
of BIRMC confirming to following minimum requirements:
(i) RTO of less than 4 hours for critical information systems of licensed banks that
are D -SIBs and RTO of less than 6 hours for critical information systems of
licensed banks that are not D -SIBs; and
(ii) RPO  of zero (i.e. , no data loss during a disaster) or near zero .


32
 6.3.2 Licensed banks shall ensure that RTO and RPO targets determined under 6.3.1 for any
information system are in compliance  with any stringent RTO or RPO targets imposed
on such information systems by any other law or regulation.

6.4 Disaster recovery activat ion
6.4.1 The Board of Directors of licensed banks shall establish disaster recovery activation
triggers for each critical information system based on recommendations of the BIRMC
and ISC.
6.4.2 Such activation triggers shall ensure that the licensed ba nk is having adequ ate time to
activate the DR arrangement in compliance with the RTO target specified in 6.3.

6.5 Disaster recovery testing
6.5.1 Disaster recovery arrangements shall be tested by operating all critical information
systems using DR infrastructure for a continuous period of 7 days or more at least once
a year.
6.5.2 An annual cycle of DR simulations , in addition to testing of DR infrastruct ure as per
6.5.1, shall also be implemented to enable the Board of Directors to determine the
ability of the licensed bank to achieve the required RTO and RPO targets under different
disaster  scenarios and take necessary corrective measures where required .

6.6 Backup and recovery policies
Licensed banks shall ensure backup and recovery policies and procedures applicable to
critical information systems are properly documented  and approved by the Board of
Directors. Such policies shall be in line  with industry b est practices applicable to critical
information systems  and shall provide for off -line and off -site backups or suitable
alternative mechanisms that will achieve the objectives of maintaining such backups .

7. Staff Competency Requirements
Licensed banks shal l ensure at least a minimum number of staff with eligible
qualifications are employed in information security, technology risk management, and
internal audit functions as required by 7.1 to 7.5.

7.1 Recognized qualifications


internal audit functions as required by 7.1 to 7.5.

7.1 Recognized qualifications
Academic and professional qualifications as per tables 1 and 2 below from institutes
specified in 7.1.1 and 7.1.2 are recognized as eligible qualifications.


33
 7.1.1 Academic qualifications
Masters and Bachelors level degree programs awarded by a university or degr ee
awarding institute recognised by the University Grants Commission of Sri Lanka, or
Masters and Bachelors level degree programs accredited by an accreditation body
supported by the Institute of Electrical and Electronics Engineers (IEEE).
7.1.2 Recogni sed enti ties for professional qualifications
Professional qualifications from following professional bodies:
(i) ISACA;
(ii) (ISC)2; and
(iii) Global Information Assurance Certification (GIAC).
7.1.3 In the event of discontinuation of any of the recogni sed professional qualifications,  any
succeeding or alternative professional qualification by the same or succeeding
professional body shall be considered as an eligible qualificatio n.
7.1.4 Licensed banks incorporated outside Sri Lanka and having information security
operations handled outside  Sri Lanka may designate similar international qualifications
as determined by the Head of Human Resources of the head office as alternative
qualifications for staff located outside Sri Lanka.

7.2 Competency requirements for CISO
CISO of a licensed bank that is required to set up a SOC shall possess at least one
qualification from eligible qualifications listed in 7.4.

7.3 Minimum number of qualified staff
Licensed banks shall employ staff members possessing at least one eligible
qualification for both analyst/executive and managerial levels of information security
operations, risk management, and internal audit functions. Minimum number of staff
required fo r each function and eligible qualifications shall be as per 7.4. In case of
outsourced services, third party service provider’s staff members allocated to the bank
with eligible qualifications shall count towards this requirement.


34
 7.4 Eligible qualifications and minimum number of qualified staff
7.4.1 CISO and managerial level
Table 1: Eligible qualifications and minimum number of qualified staff for CISO
and managerial level
No. Qualification/
Bank Category  CISO  Information
Security
Operations
(including
SOC)  Risk
Management  Internal
Audit
1. Eligible qualifications:
1.1 (ISC)2 Certified
Information Systems
Security Professional
(CISSP)  X X X X
1.2 GIAC Strategic
Planning, Policy, and
Leadership (GSTRT)  X
1.3 GIAC Informati on
Security Professional
(GISP)  X X X X
1.4 ISACA Certified
Information Systems
Auditor (CISA)  X   X
1.5 ISACA Certified
Information Security
Manager (CISM)  X  X
1.6 ISACA Certified in
Risk and Information
Systems Control
(CRISC)  X  X
1.7 Masters Degree in
Information Security
or Masters Degree in
Computer
Science/Information
Technology
specialising in
Information Security  X X X X
2. Minimum number of staff with an eligible qualification:
2.1 D-SIBs 1 2 1 2
2.2 Non D -SIBs required
to setup a SOC  1 1 - 1
2.3 Non D -SIBs not
required to setup a
SOC  -* - - -
* No mandatory qualification requirement for CISOs of banks not required to
setup a SOC.


35
 7.4.2 Analyst/executive level
Table 2: Eligible qualifications and minimum number of qualified staff for
analyst/executive level
No. Qualification/
Bank Category  Information
Security
Operations
(including
SOC)  Risk
Management  Internal
Audit
1. Eligible qualifications:
1.1 (ISC)2 Systems Security
Certified Practitioner (SSCP)  X X X
1.2 ISACA CSX Practitioner
Certificate (CSXP)  X X X
1.3 GIAC Security Essentials
(GSEC)  X X X
1.4 Bachelors Degree in
Information Security or
Bachelors  Degree in Computer
Science/Information
Technology specialising in
Information Security  X X X
1.5 Relevant managerial level
qualification  X X X
2. Minimum number of staff with an eligible qualification:
2.1 D-SIBs  5 1 3
2.2 Non D -SIBs required to setup
a SOC  2 1 2
2.3 Non D -SIBs not required to
setup a SOC  1 - 1

7.5 Continuous Professional Development (CPD) requirement
7.5.1 Staff possessing eligible professional qualifications
Staff members possessing an eligible professional qualification must complete CPD
requirements of the professional qualification or 20 CPD hours annually, whichever is
higher. Staff members possessing eligible academic qualifications shall complete at
least 20 CPD hours by completing CPD qualifying programs offered by relevant
eligible professional qualifications listed above.
7.5.2 Other staff
All other staff employed in information security operations, technology/information
security risk management, and infor mation security audit shall complete at least 20
CPD hours annually by completing CPD programs approved by the BIRMC on the
recommendation of ISC.


36
 7.5.3 Staff members possessing eligible qualifications but failing to fulfill CPD requirements
shall not be consi dered when determining the number of staff with eligible
qualifications.

8. Compliance with International Standards
8.1 The licensed bank shall implement following standards by International Organization
for Standardization (ISO) and obtain certification or assu rance as outlined below:
Table 3: Mandatory ISO standards
No. Standard  Scope  Certification/Assurance

8.1.1 Latest edition
of ISO/IEC
27001,
Information
security
management
systems  ISO/IEC 27001 scope shall
include business/operational
units, locations, and
technology infrastructure
associated with critical
information systems and
information systems exposed
to customer  data and
confidential non -customer
data.

All applicable requirements
imposed by this regulatory
framework  and other CBSL
Regulations  shall be followed
during the implementation of
the standard.
 D-SIBs:
Certification from an
accredited certification
body.

Non D -SIBs:
Certification from an
accredited certification
body; or assurance from
an external auditor
approved by the CBSL, if
the Board of Directors
resolve that the licensed
bank’s information
security risk is minimal
and does not require
accredited certification .

Assurances shall be
revie wed at least once
every two years.
8.1.2 Latest edition
of ISO/IEC
27035,
Information ISO/IEC 27035 scope shall
include business/operational
units, locations, and
technology infrastructure Assurance from the
internal audit function of
the licensed bank through
BAC  or external


37
 No. Standard  Scope  Certification/Assurance

security
incident
management
 associated with critical
information systems and
information systems exposed
to customer  data and
confidential non -customer
data.

All applicable require ments
imposed by this regulatory
framework and other CBSL
regulations shall be followed
during the implementation of
the standard.  certification/assurance
from a suitable party
approved by the Board of
Directors of the licensed
bank.

Assurances shall be
reviewed at least once
every two years.
8.1.3 Latest edition
of ISO/IEC
22301,
Business
continuity
management
systems
  ISO/IEC 22301 scope shall
include business/operational
units, processes, and
infrastructure required for the
availability of critical
information systems.

All applicable requirements
imposed by this regulatory
framework  and other CBSL
regulations  shall be  followed
during the implementation of
the standard.  Assurance from the
internal audit function of
the licensed bank through
BAC  or external
certification/assurance
from a suitable party
approved by the Board of
Directors of the licensed
bank .

Assurances shall be
reviewed at least once
every two years.
8.1.4 Latest edition
of ISO/IEC
20000,  Service
management
  ISO/IEC 20000 scope shall
include information
technology and information
security related service
delivery functions associated
with critical information Assurance from the
internal audit function of
the licensed bank through
BAC  or external
certification/assurance
from a suitable party


38
 No. Standard  Scope  Certification/Assurance

systems and information
systems exposed to customer
data and confidential non -
customer data.

All appl icable requirements
imposed by this regulatory
framework  and other CBSL
regulations  shall be followed
during the implementation of
the standard.  approved by the Board of
Directors of the licensed
bank .

Assurances shall be
reviewed at least once
every two years.

8.2 In the event of discontinuation of any of the above standards by  the International
Organization for Standardization , the Board of Directors of the licensed bank shall
implement relevant succeeding standard  or identify and implement an alternative
standard if there is no succeeding standard .

9. Requirements based on informati on system infrastructure ownership,
management, and location

9.1 Determination of information system infrastructure  ownership, management, and
location
9.1.1 Determinants
The ownership and/or management of information system infrastructure shall be
determined by th e party having ownership and/or responsibility for management of
processing, storage, networking , and other fundamental computing resources of an
information system. Location will be determined by the place in which all the above
components are located.
9.1.2 Criterion to determine ownership
Information system infrastructure shall be considered as ‘bank ow ned’ only if the
licensed bank  holds ownership of all the components referred in 9.1.1  pertaining to an
information system. All other ownership arrangements shall be considered as ‘third -
party service provider owned’.


39
 9.1.3 Criterion to determine management
Information system infrastructure shall be considered as ‘bank managed’ only if the
licensed bank’s employees are managing all the components referred in 9.1.1  pertaining
to an information system. All other management arrangements shall be considered as
‘third -party service provider  managed’.
9.1.4 Criterion to determine location
Information system infrastructure shall be considered as ‘located in Sri Lanka’ only if
all the components referred in 9.1.1  pertaining to an information system are in Sri
Lanka. All other a rrangements shall be considered as ‘ located outside Sri Lanka ’.
9.1.5 Accordingly, following  models will be considered within this regulatory framework
and requirements in 9.2 to 9.9 shall  be applicable based on the model used:
(i) Bank owned and managed, located in Sri Lanka;
(ii) Bank owned and managed, located outside Sri Lanka;
(iii) Bank owned, third -party service provider  managed, and located in Sri Lanka;
(iv) Bank owned, third -party service provider  managed, and located outside Sri
Lanka;
(v) Third-party service provider  owned and located in Sri Lanka; and
(vi) Third-party service provider  owned and located outside Sri Lanka.

9.2 Bank owned and managed, located in Sri Lanka
No additional requirements are  applicable to this model.

9.3 Bank owned and managed, located outside Sri Lanka
9.3.1 Use of this model is  normally  allowed for licensed banks incorporated outside Sri Lanka
when utilising information system infrastructure owned and managed by the head
office.
9.3.2 Locally incorporated licensed banks shall not utilise this model , except to facilitate
operations of any branc h or business unit located outside Sri Lanka where use of
information system infrastructure located outside Sri Lanka is essential .
9.3.3 Licensed banks incorporated outside Sri Lanka utilising this model shall ensure the


9.3.3 Licensed banks incorporated outside Sri Lanka utilising this model shall ensure the
availability of multiple , fully independ ent telecommunications links, individually
capable of serving full workload, with both primary and DR sites from Sri Lanka and
between the primary and DR sites.


40
 9.3.4 Licensed banks incorporated outside Sri Lanka that are D -SIBs shall ensure that a fully
tested DR arrangement complying with the requirements specified in Section  6 of this
regulatory framework is available in Sri Lanka, when this model is utilized for critical
information systems.

9.4 Bank owned, third -party service provider  managed, and  located in Sri Lanka
Licensed banks may utilise this model subject to compliance with  requirements
specified in 9.8 and 9.9.

9.5 Bank owned, third -party service provider  managed, and located outside Sri Lanka
9.5.1 Licensed banks incorporated outside Sri Lanka may  utilise this model subject to
compliance with requirements in 9.3, 9.8 and 9.9, if this is the model mandated  by the
head office of such licensed bank .
9.5.2 Locally incorporated licensed banks shall not utilise this model , except to facilitate
operations of a ny branch or business unit located outside Sri Lanka where use of
information system infrastructure located outside Sri Lanka is essential .

9.6 Third-party service provider  owned and located in Sri Lanka
9.6.1 Licensed banks may utilise this model subject to compliance with requirements in  9.8
and 9.9.
9.6.2 Licensed banks implementing this model for critical information systems shall also
comply with the following:
(i) Third -party service provider  owned information syste m infrastructure shall
possess a certification for the latest edition of ISO 22301 - Business continuity
management systems, from an accredited certification body; and
(ii) Availability of a fully tested DR arrangement, complying with the requirements
specified  in Section 6 of this  regulatory framework, either with the licensed
bank  or with a different third -party service provider. Such DR arrangement shall
be available prior to the commencement of live operations using this model.
(iii) Licensed banks may exclude any  non-essential component/service utilizing


(iii) Licensed banks may exclude any  non-essential component/service utilizing
third -party service provider owned infrastructure and used by a critical
information system from DR requirements as per 9.6.2(ii), if non -availability of
such component/service either on standalone basis or togeth er with other such
components/services will not adversely impact the functioning of the country's
financial system or the functioning of the licensed bank.


41

9.7 Third-party service provider  owned and located outside Sri Lanka
9.7.1 Licensed banks may utilise this model subject to compliance with requirements
specified in 9.6.
9.7.2 Licensed banks implementing this model for critical information systems shall also
comply with the following, in addition to requirements specified in 9.6.2 :
(i) Licensed banks that are locally incorporated and licensed banks incorporated
outside Sri Lanka that are designated as D-SIBs shall ensure DR arrangement
as per Section 9.6.2(ii) is located in Sri Lanka;  and
(ii) Availability of multiple fully independent telecommunications links,
individually capable of serving full workload, with both primary and DR sites
from Sri Lanka and between the primary and DR sites.

9.8 Requirements for using information system infrastructure managed or owned by
third -party service provider s for any information system
9.8.1 Approval of the Board of Directors of the licensed bank based on a recommendation
from the BIRMC of the bank.
9.8.2 Information system infrastructure managed or owned by third -party service providers
located outsid e Sri Lanka shall only be in locations approved by the licensed bank’s
Board of Directors, having satisfied themselves over the adequacy and effectiveness of
legal and regulatory environment in such locations to protect the interests of the
licensed bank, its customers, the CBSL, and Sri Lankan judiciary .

9.9 Requirements for using information system infrastructure managed or owned by
third -party service provider s for critical information systems and for information
systems exposed to customer data or confidential non -customer data
9.9.1 Information system infrastructure managed or owned by third -party  service providers
shall possess a certification for the latest edition of ISO 27001 - Information security
management systems, from an accredited certification  body.


management systems, from an accredited certification  body.
9.9.2 In the event the third -party service obtained is cloud computing, the cloud computing
service provider shall possess a  certification for the latest edition of ISO 27017 –
Security controls for cloud services, from an accredited certification body.


42
 9.9.3 Customer consent
(i) Explicit customer consent shall be obtained, for exposing customer data to third -
party service providers, prior to entering into a new business relationship with
either new or existing customer, when a licensed bank is utilising information
system infrastructure managed or owned by third -party service providers for
information systems exposed to customer data. If information system
infrastructure is located outside Sri Lanka, customer’s consent shall also be
obtained for  their data to be located outside of Sri Lanka.
(ii) If any information system exposed to customer data is already utilising
information system infrastructure managed or owned by third -party service
providers , licensed bank shall inform of such arrangement to a ll customers
whose data are stored or processed in such information systems . Licensed banks
shall seek the explicit consent of the customers whose data are stored or
processed in an information system  utilizing information system infrastructure
owned and m anaged by the bank, whenever such an information system is
migrated to information system infrastructure managed or owned by third -party
service providers .
(iii) Any customer who fails to respond when consent is requested as per 9.9.3(ii)
shall be given at least  3 reminders, at monthly or longer intervals through the
preferred communication method registered with the bank.
(iv) Licensed banks may migrate data of existing or past  customers who have failed
to respond even after 3 reminders as per 9.9.3 (iii), to informat ion system
infrastructure  managed or owned  by third -party service providers .
(v) Information about the third -party  service provider’s  involvement together with
associated risks and benefits shall be communicated to customers in languages
preferred by them when  requesting customer consent.
9.9.4 Licensed banks shall ensure the following through contractual agreements with the


9.9.4 Licensed banks shall ensure the following through contractual agreements with the
third -party service provider:
(i) The rights of the CBSL to examine the third -party service provider and its staff
associated with the services prov ided to the licensed bank, as if it is a licensed
bank’s internal function;
(ii) Third -party service provider to make available any information or data
requested by the Director of Bank Supervision concerning the services provided
to the licensed bank;


43

(iii) The rig hts of the Sri Lankan judiciary to request and obtain any information or
data relating to the services provided to the licensed bank either directly or
through the licensed bank;
(iv) Third -party service provider to facilitate smooth transfer of data and system s at
the end of the contract or whenever demanded by the licensed bank;
(v) All customer data and confidential non -customer data available with the third -
party service provider are permanently deleted within a pre-agreed  time period
at the end of the contract; and
(vi) Third -party service providers to facilitate internal auditing requirements and
information security testing requirements including red team exercises as
requirements in this regulatory framework.

10. Implementation and transitional arrangements
10.1 Licensed banks shall ensure  all new initiatives comply with the requirements in Section
9 from the date of issue of this regulatory framework.
10.2 Licensed banks shall ensure compliance with all other requirements i n this regulatory
framework as per table 4 below.
10.3 Licensed banks that are D -SIBs shall ensure compliance with the requirements
specifically applicable to D -SIBs within 12 months from the date of notification of
being designated as a D -SIB or as per 10.1 and 10.2, whichever falls later.
10.4 The Board  of Directors of licensed banks shall monitor the progress made by the
licensed bank  in achieving the timelines  for compliance on quarterly basis from the date
of issue of this regulatory framework and take necessary  measures to ensure compliance
with the given timeline.
Table 4: Timelines for compliance

No. Ref. Requirement  Date for
Compliance
1. General deadline
(All requirements without extended deadlines)  31.12.2022
2. Extended deadlines
2.1 4.2.1  Appointment of a chief information security officer
(CISO)  01.01.2024
2.2 4.2.1 &


2.1 4.2.1  Appointment of a chief information security officer
(CISO)  01.01.2024
2.2 4.2.1 &
4.2.4  Appointment of a dedicated CISO for D -SIBs  01.01.202 6


44
 No. Ref. Requirement  Date for
Compliance
2.3 4.2.7 &
7.2 Qualifications for CISO  31.12.2024
2.4 5.1 Information security training and certification  31.12.2023
2.5 5.2.2  User access and identity management system  31.12.2024
2.6 5.3 Computer security and user activity log management  31.12.2024
2.7 5.5.1  Customer Data encryption
2.7.1 5.5.1 (ii)
(a)   Data -at-rest encryption  31.12.2025
2.7.2 5.5.1(ii)
(b)   Data -in-transit encryption  31.12.2024
2.7.3 5.5.1(ii)
(c)   Full disk encryption for removable media  31.12.2023
2.7.4 5.5.1(ii)
(c)   Full disk encryption for endpoint devices  31.12.2026
2.8 5.5.2  Confidential non -customer data encryption  31.12.2025
2.9 5.6 Security Operations Center (SOC)  31.12.2024
2.10 5.8.1  Pre-implementation information security testing  31.12.202 3
2.11 5.8.3  Penetration tests by independent external experts – on
non-production systems  31.12.2023
2.12 5.8.3  Penetration tests by independent external experts – on
production systems  31.12.2025
2.13 5.8.4  Red team exercises by independent external experts  31.12.2026
2.14 6 Information System Availability and Disaster
Recovery  31.12.2024
2.15 7 Staff competency requirements  31.12.2024
2.16 8 Compliance with international standards
2.16.1 8.1.1 ISO/IEC 27001, Information security management
systems  31.12.2024
2.16.2 8.1.2 ISO/IEC 27035, Information security incident
management  31.12.2025
2.16.3 8.1.3 ISO/IEC 22301, Business continuity management
systems  31.12.2024
2.16.4 8.1.4 ISO/IEC 20000, Service management  31.12.2025
2.17 9 Requirements based on information system
infrastructure ownership, management, and location -
Compliance for existing arrangements  31.12.2024


MONETARY BOARDCENTRAL BANK OF SRI LANKA19 January 2021 BANKING ACT DIRECTIONS No. 01 of 2021RESTRICTIONS ON DISCRETIONARY PAYMENTS OF LICENSED BANKSThe Monetary Board of the Central Bank of Sri Lanka, having considered the possible adverse impact on liquidity and other key performance indicators of licensed commercial banks and licensed specialised banks (hereinafter referred to as licensed banks) due to the COVID-19 outbreak and the importance of maintaining appropriate levels of liquidity and capital buffers in the licensed banks, hereby issues these Directions on restrictions on discretionary payments of licensed banks.1. Empowerment1.1 In terms of Sections 46(1) and 76J(1) of the Banking Act No. 30 of 1988, as amended, in order to ensure the soundness of the banking system, the Monetary Board is empowered to issue Directions to all or any licensed bank, regarding the manner in which any aspect of the business of such bank or banks is to be conducted.2. Scope ofApplication2.1 These Directions shall be applicable to every licensed bank incorporated or established in Sri Lanka and every licensed bank, which is a branch of a bank incorporated or established outside Sri Lanka, on a standalone basis.3. Restrictions on Discretionary Payments3.1 Every licensed bank incorporated or established in Sri Lanka shall defer payment of cash dividends until the financial statements for the year 2020 are finalised and audited by its External Auditor.3.2 Every licensed commercial bank incorporated outside Sri Lanka shall defer repatriation of profits not already declared for financial years 2019 and 2020 until the financial statements for the year 2020 are finalised and audited by its External Auditor.1


MONETARY BOARD CENTRAL BANK OF SRI LANKA19 January 2021 BANKING ACT DIRECTIONS No. 01 of 20213.3 Licensed banks shall give due consideration to the requirements of the Banking Act Directions No. 01 of 2016 on Capital Requirements under Basel III for Licensed Banks, expected assets growth, business expansion and the impact of COVID-19 pandemic when deciding on payments of cash dividends and profit repatriation.3.4 Licensed banks, shall until 30 June 2021;(a) refrain from buying-back of its own shares;(b) refrain from increasing management allowances and payments to Board of Directors;(c) exercise prudence and refrain to the extent possible from incurring non-essential expenditure such as advertising, business promotions, gift schemes, entertainment, sponsorships, travelling and training etc.; and(d) exercise extreme due diligence and prudence when incurring capital expenditure, if any.Chairman of the Monetary Board andGovernor of the Central Bank of Sri Lanka
2


MONETARY BOARDCENTRAL BANK OF SRI LANKA25 January 2021BANKING ACT DIRECTIONSNo. 02 of 2021FORWARD SALES AND PURCHASES OF FOREIGN EXCHANGE BY LICENSED COMMERCIAL BANKSIssued in terms of the powers conferred by Section 46(1) of the Banking Act No. 30 of 1988, as amended.In view of the need to avoid excess volatility in the foreign exchange market and the impact on banks’ risk management, licensed commercial banks are hereby informed to refrain from entering into forward contracts of foreign exchange for a period of three months with immediate effect.•ProfW D LakshmanChairman of the Monetary Board and Governor of the Central Bank of Sri Lanka


ffi
MONETARY BOARI)
CENTRAL BANK OF SRI LANKA
J{ January 20zt nlNxtNG lct DutnCtIOttS No.03 of 2021
AMENDMENTS TO DIRECTIONS ON CAPITAL REQUIREMENTS UNDER BASEL
III FOR LICENSED COMMERCIAL BANKS AND LICENSED SPECIALISED BANKS
Banking Act Directions No. 1 of 2016 on Capital Requirements under Basel III for licensed
commercial banks and licensed specialised banks are hereby amended bi replacing the following
Directions.
SCHEDULE I
Appendix IV
PART III(A) _ COMPUTATTON OF RISK WEIGHTED AMOUNT FOR CREDIT RISK
Web Based
Return CodeAssets Risk
Weight
(o/"l
20.3.r.1.r.2 Foreign Claims on Central Government
All foreign claims on Government of Sri Lanka
(The revised risk weight is applicable for the year 2021 only)10
20.3.1.9.0.0 Claims Secured by Residential Property
The amount must agree with the sum of the claims secured by
residential property that qualify for regulatory capital purposes
and claims secured by residential property that do not qualify for
regulatory capital purposes.
(WBRC 20.3.1.9. 1.0 to 20.3.1.9.2.0)
The exposures secured by mortgages on commercial real estates
shall be excluded from here.
20.3.1.9.1.0 Claims that Qualiff for Regulatory Capital Purposes
a) Subjdct to conditions below, residential housing loans fully
secured by a primary mortgage over such residential property
that is or will be occupied by the borrower, or rented.
b) The claims should strictly meet the following qualiffing
criteria to be able to use the preferential risk weight:
o A margin of at least 25oh onthe forced sale value of the
property based on the latest valuation report;35


89 January202lMONETARY BOARD
CENTRAL BANK OF SRI LANKA
BANKING ACT DIRECTIONS No.03 of202l
o Valuation of properfy: valuation of property is carried
out by an external independent valuer or current intemal
assessment of the value of the properties subject to the
conditions stated in the Directions on Classtfication of
Loans and Advances, Income Recognition and
Provisioning issued under Banking Act.
c) Mortgages other than primary mortgages will qualifi, for the
same risk weight, subject to the above conditions, if:
. The mortgage is with the same bank
o The purpose of the loan is for residential purposes.
20.3.1.9.2.0 Claims that do not Qualiff for Regulatory Capital Purposes
Performing claims that do not meet the criteria given above.100
f. W D Lakshman
Chairman of the Monetary Board and
Governor of the Central Bank of Sri Lanka
l


MONETARY BOARDCENTRAL BANK OF SRI LANKA April23 2021 BANKING ACT DIRECTIONS No. 06 of 2021INVESTMENTS IN SRI LANKA INTERNATIONAL SOVEREIGN BONDS BY LICENSED COMMERCIAL BANKS AND NATIONAL SAVINGS BANKIssued in terms of the powers conferred by Sections 46(1) and 76(J)(1) of the Banking Act No. 30 of 1988, as amended.The Central Bank of Sri Lanka with a view to easing pressure on the exchange rate and considering the substantial amount of possible/potential outflow of foreign exchange by banks and its impact on banks’ risk management, requires the licensed commercial banks and National Savings Bank to suspend the purchase of Sri Lanka International Sovereign Bonds until further notice.Prof. W D LakshmanChairman of the Monetary Board and Governor of the Central Bank of Sri Lanka
1


Name of Bank :
.
in FC
value in Rupee
EquivalentCapital Interest Counter-party Amount, in
FC valueExchange
rate, first
leg (Sold
at) Exchange
rate,
second leg
(Buy at)
Total 0 0 0 0Othe
Char
gesRepayment Risk Mitigation, SWAP arrangementsRating of
Counterpa
rty
(Lender)/I
nstrumentAmount
Borrowed, in FC
valueOutstanding Amount
Purpose of borrowingWhether
included
for Tier
II capital
(Yes/No)Date of
BorrowingDate of
MaturityMonthly Statement of Foreign Borrowings
Period:
Amount in '000
Name of Counterparty   (Lender) CountryBusine
ss Unit
(DBU/
OBU)Nature of Transactions (Product/Instrument) (/1)Currency
Type (/2)Rate of
Interest,
%


MONETARY BOARD
CENTRAL BANK OF SRI LANKA
16 June  2021                              BANKING ACT DIRECTIONS             No. 09 of 2021
1

RECOVERY PLANS
 FOR LICENSED COMMERCIAL BANKS  AND LICENSED SPECIALISED BANKS

In terms of the powers conferred by Sections 46(1) and 76(J)(1) of the Banking Act No. 30 of
1988, as amended, the Monetary Board hereby issues these Direc tions on the requirement of
maintain ing Recovery Plans (RCP)  for licensed commercial banks and licens ed specialised
banks (hereinafter referred to as licensed banks) .

1. Empowerment   1.1

 In terms of Section s 46(1)  and 76J(1 ) of the Banking Act , the
Monetary Board is empowered to issue Directions to all
licensed bank s, regarding the manner in which any aspect of
the business of such bank or banks is to be conducted .
2. Scope of
Application
 2.1

2.2

 RCP shall identify the full range of recovery options available
to a licensed bank  to deal with shocks to capital, liquidity and
all other aspects that may arise from institution -specific
stresses, market -wide stresses, or a combination of both.
Each licensed bank shall have an RCP in place and the RCP
shall include the following:
(a) Scope of RCP formulated considering the natur e, scale,
complexity,  and interconnectedness of the licensed bank.
(b) Entities of the banking g roup covered under the recovery
framework.

3. Critical Functions
and Critical Shared
Services
 3.1

3.2 Critical functions and critical shared services shall be clearly
identified and defined in RCP.
Critical functions and critical shared services shall be
organised in a way that ensures the continuous availability of
shared services to the entire bank under the possible recovery
and reso lution options.


MONETARY BOARD
CENTRAL BANK OF SRI LANKA
16 June  2021                              BANKING ACT DIRECTIONS             No. 09 of 2021
2

4. Recovery Triggers
and Indicators

5. Recovery Options

 4.1

5.1

5.2

 Each li censed bank shall identify recovery indicators, recovery
triggers, recovery actions and conditions for activation of
resolution measures.
(a) The recovery plan shall include appropriate indicators,
triggers,  and procedures to ensure the timely
implementation of recovery actions .
(b) Identified indicators and triggers shall comprise a range of
quantitative and qualitative triggers.
(c) Quantitative indicators and triggers should be set at levels
above  the associated supervisory requirements , wherever
applicable.
(d) In addition to such trig gers, early warning indicators shall
be used to identify negative trends for monitoring.

An RCP shall identify the full range of credible and flexible
recovery options available to a bank to deal with shocks to
capital, liquidity and all other aspects that may arise from
institution -specific stresses, market -wide stresses , or a
combination of both, and shall include the following as a
minimum:
(a) The anticipated impact or result of the opt ion in terms of
capital, l iquidity  and/or any other area, if any .
(b) Time and resources required to implement the option.
(c) Potential impediments  to implement ation of  the option.
(d) Actions being taken to remedy the impediments.
(e) Details on costs of implementation.
(f) Details on option‑specific communication planning.
Recovery options of a bank shall be capable of being executed
within a reasonable timeframe and sustainabili ty and viability
of the options must be evaluated intensely.


MONETARY BOARD
CENTRAL BANK OF SRI LANKA
16 June  2021                              BANKING ACT DIRECTIONS             No. 09 of 2021
3

6. Board of Directors
and Management

 5.3

5.4

6.1

6.2

6.3

6.4

6.5

 RCP shall take into account any legal, reputational , and
operational impediments on recovery and  formulate  processes
to ensure timely implementation of recovery options.
Each l icensed bank  shall appropriately include Business
Continuity Planning (BCP) arrangements when  formulating
RCPs.

Each licensed bank shall appoint a member of the senior
management to oversee its RCP process and shall put in place
a robust governance structure and sufficient resources to
support RCP process. The roles and responsibilities of each
person involved in RCP process should be clearly assigned
within the bank and  specified in RCP.
RCP shall be approved or endorsed by the Board of Directors
for a locally incorporated  licensed bank and the regional/
global head office for a licensed bank incorporated outside Sri
Lanka.
RCP shall be a dynamic process and be updated at least
annually and must be integrated with the existing risk
management framework and processes.
Clear responsibilities of key management personnel,
respective departments / divisions,  and other relevant off icers
for formulating, maintaining/regularly reviewing, executing,
and activating the RCP shall be assigned  and documented.
Licensed banks incorporated outside Sri Lanka shall inter alia
include the following in their RCP:
(a) The manner in which the local ope rations are integrated to
the recovery and resolution framework of the parent bank .
(b) Brief description of the submissions made to the home
regulator on RCP, if any .


MONETARY BOARD
CENTRAL BANK OF SRI LANKA
16 June  2021                              BANKING ACT DIRECTIONS             No. 09 of 2021
4

7. Management
Information and
Communication
Planning

8. Regulatory
Submissions

7.1

7.2

7.3

8.1

8.2

 (c) A copy of the written undertaking supported by a
resolution of the Board of Directors of the  head office or
parent body, under section 3 (2) (c) (i) of the Banking Act
No. 30 of 1988 as amended , stating that such bank as the
case may be, shall on demand by the Central Bank, provide
funds as may be necessary to meet all obligations incurred
in or in connection with its business in Sri Lanka.

Each licensed bank shall maintain information within the
prevailing management information systems that are capable
of producing information necessary for recovery process of the
bank.
Each licensed bank shall  maintain up to date information  on
following arears, but not limited to :
(a) List of depositors including, account number, deposit type,
deposit balance, contact details and any other relevant
details.
(b) Information on all contracts of the licensed bank.
(c) Information on intra -group transactions.
A communication plan shall be in place to ensure timely
communication with internal and external stakeholders on
RCP.

Commencing 2022, licensed banks with assets above Rs. 1
Trillion shall formulate and submit RCPs  to Director of Bank
Supervision (DBS) annually, by 30 June of each year or
whenever the recovery plan is significantly amended.
Commencing 2022, licensed banks with assets below Rs. 1
Trillion shall maintain RCPs from 30 June 2022 and such


MONETARY BOARD
CENTRAL BANK OF SRI LANKA
16 June  2021                              BANKING ACT DIRECTIONS             No. 09 of 2021
5

9. Interpretations

8.3

8.4

9.1

9.2

9.3

 RCPs will be su bject ed to review during the statutory
examination of the respective bank.
Licensed banks shall immediately inform the Director of Bank
Supervision when a bank reaches a trigger point activating
RCP actions or when a licensed bank is experiencing  a high
level of stress.
A model format providing a broad template for licensed banks
to draft RCPs is attached in  Schedule I.  However, a fair d egree
of variation in the depth  and presentation of RCPs is expected,
based on the size, banking business model, complexity,
interconnectedness, risk profile and systemic importance of
each bank.

Critical functions shall mean activities performed for third
parties where failure would lead to disruption of services vital
for the functioning of the real economy and for financial
stability due to size or market share, external and internal
interconnectedness, and complexity or cross -border activities
of the banking group.
Critical s hared services shall mean activities performed within
the firm  or outsourced to third parties, where failure would lead
to the inability to perform critical functions and, therefore, to
disruption of services vital for the functioning of the real
economy o r for financial stability.
Third parties shall include all entities or individuals that have
entered into a business relationship with the licensed  bank.

 Chairman of the Monetary Board and
                 Governor of the Central Bank of Sri Lanka


6

Banking Act Directions No. 09 of 2021
Recovery Plans for Licensed Commercial Banks and Licensed Specialised
Banks

SCHEDULE I


7
 Template for  Recovery Plans of Licensed Banks

1. Executive Summary
(a) Summary of key elements in the Recovery Plan (RCP) .

2. Introduction
(a) Objectives of the RCP  and to provi de a broad outline of the RCP.
(b) Linkages between the sections of RCP.

3. Scope of the RCP
(a) The Scope of RCP to be defined co nsidering the banking business model, risk profile ,
scale, complexity,  and interconnectedness of the licensed bank.
(b) The entities of the Group covered under the recovery framework including an
organisational structure.
(c) Description of the licensed bank and other entities  covered  by RCP .

4. Material Changes
(a) List of all material changes since the last recovery plan submission  / major update to be
summarised and presented under this section (Not applicable in the first submission) .

5. Critical Functions and Critical Shared Services
(a) Identification of  the core business lines  critical functions and critical shared services of
the licensed bank.
(b) Description of  how c ritical functions and shared services are to be organised  in a way
that ensures the continuous availability of shared services .
(c) Description of the impact on critical shared services of implementing the option and
assessment of how the continuity of operations can be maintained if the recovery option
is implement ed.
(d) Description of any measures necessary to maintain continuous access to relevant
financial market infrastructures to preserve the continuous functioning of the bank's
operational processes (including infrastructure and IT services)


8
 6. Governance Framework
(a) Describe bank ’s/group’s governance arrangements and governance structure  in relation
to RCP .
(b) RCP shall be approved or endorsed by the Board of Directors for a locally  incorporated
licensed bank and the regional/global head office for a licensed bank incorporated
outside Sri Lanka.
(c) The roles and responsibilities of each person involved in the Governance process of the
RCP should be clearly assigned under this section.
(d) Clear responsibilities of key management personnel, business units an d executives for
formulating, maintaining/regularly reviewing, executing,  and activating the RCP shall
be assigned and documented.
(e) Licensed Banks incorporated outside Sri Lanka shall  include their arrangements with
the parent bank  including the following:
− The manner in which the local operations are integrated to the recovery and
resolution framework of the parent bank;
− Brief description of the submissions made to the home regulator on RCP, if any;
− A copy of the written undertaking supported by a resolutio n of the Board of
Directors of the head office or parent body.

7. Recovery Triggers1 and Strategy/ Options  2
(a) List and describe all identified recovery triggers and possible recovery options3.
(b) The risks associated with each of the recovery options and the anticipated impact or
result of the option in terms of capital and/or liquidity.
(c)  Description of the expected impact of implementing the option on the capacity of the
bank to perform critical functions as well as on its core business lines, franchise
value/reputation and business model.
(d) Time and resources required to implement the option.

1 Recovery triggers shall cover a range of customised qualitative and quantitative factors, such as, c apital and
liquidity ratios , reductions  in revenue and profitability , withdrawal of deposits and other funding, rise in public


debt, adverse GDP forecasts, changes in market interest rates, requests from counterparties for early redemption
of liabilities, difficulties in raising funds  at current market rates, adverse court  decisions  etc.

2 Recovery options are defined as the measures that a bank can take in order to restore its  financial position in a
crisis / high stress situation .

3 When identifying recovery options , a bank should consider a range of severe  macroeconomic and financial stress
scenarios relevant to the bank specific conditions in line with the nature of its business,  size and
interconnectedness to the financial system .


9
 (e) Details on costs of implementation.
(f) An analysis of any material im pediments to the effective and efficient  execution of the
RCP and respective strategies to overcome them.
(g) Details on option‑specific communication planning.
(h) Description of the main assumptions relating to the feasibilit y of the option and its
impact including the  impact of the option on external stakeholders .

8. Recovery Indicators
(a) In this section licensed  bank may list and explain the recovery plan indicators (both
qualitative and quantitative recovery plan indicators  to be considered ).
(b) Early warning indicators can be used by banks  to identify potential stress situations and
for monitoring.
(c) Procedures to ensure the timely implementation of recovery actions  to be included in
this section.
(d) Licensed banks s hould e xplain how recovery indicators are monitored .

9. Implementation Strategy
(a) Details of any preparatory measures the licensed bank  has taken or plans to take, to
implement the RCP. The RCP is expected to be carried out promptly  and effectively in
situations of financial stress  to avoid  to the maximum extent possible, any si gnificant
adverse effects.
(b) How Business Continuity Planning ( BCP) arrangements are linked to the
implementation of RCP .
(c) Overview of preparatory measures that could be taken for the successful
implementation of the option, including specific follow -up actions.

10. Additional Material Information
(a) Include any other  inform ation that may be m aterial to the licensed bank when carrying
out the RCP.
11. Undertaking of the Board of Directors and Management
(a) The signatures of the Board of Directors claiming the overall responsibility of RCP and
for reviewing RCP.
(b) The signatures of respective Key Management  Personnel on the role played and the
accountability towards the RCP.


18 June 2021MONETARY BOARD CENTRAL BANK OF SRI LANKABANKING ACT ORDERNo. 01 of 2021BANKING (OFF-SHORE BANKING BUSINESS SCHEME) ORDER DESIGNATED FOREIGN CURRENCIESOrder made by the Monetary Board of the Central Bank of Sri Lanka with the approval of the Minister, under Sections 23, 25 and 26 of the Banking Act, No. 30 of 1988, as amended.1. Designated Foreign Currencies1.1 The foreign currencies set out in the Schedule below in this Order aredetermined as the Designated Foreign Currencies under the Banking (Off-Shore Banking Business Scheme) Order.1.2 The Schedule in this Order, replaces the Schedule in the Banking (Off-Shore Banking Business Scheme) Order No. 01 of 2011, dated27.10.2011.Chairman of the Monetary Board andGovernor of the Central Bank of Sri LankaScheduleDesignated Foreign Currencies1. Australian Dollar9. Norwegian Kroner2. Canadian Dollar10. Pound Sterling3. Chinese Renminbi11. Singapore Dollar4. Danish Kroner12. Swedish Kroner5. Euro13. Swiss Franc6. Hongkong Dollar14. Thai Baht7. Japanese Yen15. United States Dollar8. New Zealand Dollar


MONETARY BOARDCENTRAL BANK OF SRI LANKA24 August 2021MONETARY LAW ACT ORDERNo. 02 of 2021MAXIMUM INTEREST RATES ON FOREIGN CURRENCY DEPOSITSOF LICENSED COMMERCIAL BANKS AND THE NATIONAL SAVINGS BANKIssued under Section 104(l)(a) of the Monetary Law Act, No. 58 of 1949, as amended.Considering the anomalies in the interest rates offered and paid by licensed commercial banks on the rupee and foreign currency deposits, the Monetary Board hereby issues an Order on maximum interest rates to be paid in respect of foreign currency deposit products of licensed commercial banks and the National Savings Bank.1. Empowerment under the Monetary Law Act1.1 In terms of Section 104(1 )(a) of the Monetary Law Act, the Monetary Board may from time to time fix the maximum rates of interest which licensed commercial banks and licensed specialised banks may pay upon various classes of deposits.2. Maximum interest rates on FCY deposits2.1 The maximum interest rates that may be offered or paid by a licensed commercial bank and the National Savings Bank on all foreign currency (FCY) deposits shall not exceed an Annual Effective Rate (AER) of up to 5 per cent.2.2 In the case of Special Deposit Accounts in FCY, the additional interest rate that can be offered or paid shall be over and above the interest rate applicable in 2.1 above.3. Regulatory Reporting and Disclosure3.1 Every licensed commercial bank and the National Savings Bank shall;(i) submit details of the interest rates offered on FCY deposit products in accordance with the weekly return on ‘Rates of Interest’, and(ii) make arrangements to inform and display the interest rates offered to customers on FCY deposit products.4. Implementation4.1 These Orders shall be effective from the date of the Order and shall be applicable for new FCY deposits, existing FCY savings deposits and at the renewal of FCY term deposits.Prof. W D LakshmanChairman of the Monetary Board and Governor of the Central Bank of Sri Lanka


13 September 2021 CIRCULAR No. 10 of 2021MONETARY BOARD CENTRAL BANK OF SRI LANKAEXTENSION OF DEBT MORATORIUM FOR COVID-19 AFFECTED BUSINESSES AND INDIVIDUALS IN THE TOURISM INDUSTRYWith a view to meeting the challenges faced by businesses and individuals engaged in tourism sector due to the ongoing COVID-19 pandemic, the Central Bank of Sri Lanka (CBSL) requests licensed commercial banks and licensed specialised banks, (hereinafter referred to as licensed banks), to extend the debt moratorium granted for tourism sector under Circular No. 08 of 2020 dated 26 August 2020 (hereinafter referred to as the Scheme) for another nine months commencing 1 October 2021 as specified below. However, licensed banks may offer any additional options to borrowers, on the request of the borrower, in a way that the overall benefits to borrowers are not less than the benefits offered under this Circular. Accordingly, this Circular is issued to give effect to the Scheme in a consistent manner across all licensed banks.A. The following provisions of the Circular No. 08 of 2020 have been amended and other provisions of the Circular No. 08 of 2020 will remain unchanged:1. General Terms and Conditions1 (i) (b) Employees of eligible businesses and members of eligible associations who are affected by COVID-19. In the case of such employees and members, the registration of the business or the association with the relevant institutions referred in (a) above shall be considered sufficient.1 (iii) Debt moratorium refers to moratorium for both capital and interest for a further period of nine months commencing 1 October 2021 to 30 June 2022.1 (iv) Eligible borrowers who wish to avail the moratorium shall make a request seeking such moratorium to the relevant licensed bank on or before 15 October 2021. Licensed banks are requested to accept any request submitted after 15 October 2021, if the reasons for delay in making such request are acceptable. Any eligible borrower who has the capacity to


for delay in making such request are acceptable. Any eligible borrower who has the capacity to service the loan repayment is expected to service such loan repayments instead of requesting for this extension.1


13 September 2021 CIRCULAR No. 10 of 2021MONETARY BOARD CENTRAL BANK OF SRI LANKA2. Structuring the debt moratorium2 (i) Licensed banks shall convert the capital and interest falling due during the moratorium period commencing from 1 October 2021 to 30 June 2022 into a term loan. Licensed banks shall amalgamate the capital and interest falling due during the previous moratorium granted with the capital and interest falling due during 1 October 2021 to 30 June 2022.2 (ii) Licensed banks may commence recovery of such converted loan once the extended moratorium period is over.2(v) Licensed banks shall waive off the accrued and unpaid penal interest as at 1 October 2021, if any, on performing loans considered under this Circular. Penal interest shall not be accrued and charged during the moratorium period.3. Reporting RequirementLicensed banks shall continue to report the details of moratorium availed by borrowers to the Director of Bank Supervision as at 30th of each month, within 15 working days as per the reporting format prescribed under Circular No. 08 of 2020.B. The following new provisions are included in this Circular:I. Alternatively, licensed banks may restructure the existing credit facilities over a longerperiod, considering the repayment capacity of the borrower and an acceptable revival plan. In this case, the licensed bank and the borrower shall agree on terms and conditions including a concessionary interest rate, considering the prevailing low interest rates.2. In the case where an eligible borrower has expressed his/her willingness to settle the existing credit facilities or amounts fallen due during the moratorium period, instead of opting for moratorium under this Circular, licensed banks are encouraged to provide interest rebates. Further, licensed banks shall waive-off early settlement fees and other fees and charges including recovery of future interest of lease facilities, if any.3. Licensed banks shall suspend all types of recovery actions


interest of lease facilities, if any.3. Licensed banks shall suspend all types of recovery actions against non-performing facilities until 30 June 2022, provided that such facilities have been classified as non-performing on or after 01 April 2020. Further, licensed banks shall take all the2


13 September 2021 CIRCULAR No. 10 of 2021MONETARY BOARD CENTRAL BANK OF SRI LANKAprecautions not to excessively contact/force the borrower or visit the borrower as part of the routine collection procedure with regard to the above borrowers. In instances where there are on-going litigations in Courts relating to recovery, borrowers shall enter into an agreement in the Courts to obtain this concession.4. Licensed banks shall account for the concession granted under this scheme as per guidelines issued by CBSL to licensed banks on adoption of Sri Lanka Accounting Standards - SLFRS 9: Financial Instruments. Licensed banks shall identify tourism sector as a risk elevated sector and provide accordingly. Licensed banks may seek advice from the Institute of Chartered Accountants of Sri Lanka (CASL) and Auditors for additional guidance/clarification in this regard.5. Licensed banks are required to seek necessary guidelines from the relevant agencies with regard to providing concessions for credit facilities granted under various refinance or interest subsidy schemes.6. Licensed banks shall ensure that the borrowers are made aware of the structure of the deferment or restructuring of credit facilities prior to approval. In the case of a rejection of the application, licensed banks shall inform the applicant, preferably within 14 days, in writing/ through electronic medium, the reasons for such rejection, and that there is an opportunity for the borrower to appeal against such rejection to the Director, Financial Consumer Relations Department (FCRD), CBSL requesting for a review. The licensed bank shall advise the applicant by and through the same letter of rejection that the applicant is entitled to duly avail himself of the review facility, if the borrower so wishes.7. Licensed banks shall circulate this Circular to all branches within 3 days and provide necessary internal guidelines/circulars within 7 days.Chairman of the Monetary Board and Governor of the Central Bank of


within 7 days.Chairman of the Monetary Board and Governor of the Central Bank of Sri Lanka3


CENTRAL BANK OF SRI LANKA BANK SUPERVISION DEPARTMENT30 September 2021 CIRCULAR No. 11 of 2021SUPPLEMENTARY CIRCULAR TO BANKING ACT DIRECTIONS ON CLASSIFICATION, RECOGNITION AND MEASUREMENT OF CREDIT FACILITIES AND OTHER FINANCIAL ASSETS IN LICENSED BANKSThe Central Bank of Sri Lanka, subsequent to the issuance of new Banking Act Directions No. 13 and 14 of 2021 on Classification, Recognition and Measurement of Credit Facilities and Classification, Recognition and Measurement of Financial Assets Other than Credit Facilities in Licensed Banks, respectively, hereby issues this Circular to licensed banks, to be effective from 01 January 2022, with a view to establishing consistent practices on the adoption of Sri Lanka Accounting Standards - SLFRS 9: Financial Instruments by licensed banks amidst COVID-19 outbreak.(1) Licensed banks, with the approval of the Board of Directors, shall include clear guidelines on staging of loans and advances for impairment purposes in the related policies, amidst the extraordinary circumstances caused by the COVID-19 outbreak.(2) In the case where direct temporary restrictions on economic activities are/were in place due to COVID-19 outbreak, licensed banks may continue to exercise prudent judgment, on case-by-case basis, to determine whether to classify credit facilities as Stage 3 facilities or not:(a) considering the borrower’s inability to revive the business and generate sufficient cash flows to repay the exposure once the restrictions on economic activities are removed; and(b) if a facility has been restructured more than twice due to adverse economic consequences of the COVID-19 outbreak and/or the Easter Sunday Attack.(3) Licensed banks may consult CA Sri Lanka and Auditors in order to obtain further guidance in respect of computing Probability of Default for exposures denominated in foreign currencies issued by the sovereigns.(4) These instructions shall also be applicable to all credit facilities considered under concessions


These instructions shall also be applicable to all credit facilities considered under concessions provided as per the Circulars issued by the Central Bank of Sri Lanka from time to time for COVID-19 affected Businesses and Individuals, including the Tourism sector.1


(5) Circular No. 09 of2020 issued on 28 October 2020 as Amendments to Circular No. 04 of 2018 on Guidelines to Licensed Banks on the Adoption of Sri Lanka Accounting Standards - SLFRS 9: Financial Instruments will be revoked from 01 January 2022.Director of Bank Supervision
2


MONETARY BOARDCENTRAL BANK OF SRI LANKA05 October 2021CIRCULARNo. 12 of 2021CONCESSIONS FOR LEASE FACILITIES OBTAINED BYBUSINESSES AND INDIVIDUALS IN PASSENGER TRANSPORTATION SECTORThe Central Bank of Sri Lanka (CBSL), with a view to meeting the challenges faced by businesses and individuals providing public and private passenger transportation service including tourism sector, amidst COVID-19 pandemic, requests licensed commercial banks and licensed specialised banks, (hereinafter referred to as licensed banks) to extend the concessions granted under Circular No. 03 of 2021 dated 10 March 2021 on concessions for lease facilities obtained by businesses and individuals in passenger transportation sector as follows:(i) accommodate the lease facilities obtained by COVID-19 affected businesses and individuals providing passenger transportation services to tourism sector, under Circular No. 10 of 2021 dated 13 September 2021, and(ii) accommodate the lease facilities obtained by other COVID-19 affected businesses and individuals engaged in passenger transportation services under Circular No. 08 of 2021 dated 01 September 2021.Licensed banks shall make necessary arrangements to implement (i) and (ii) above, expeditiously.Nivard Ajith Leslie CabraalChairman of the Monetary Board and Governor of the Central Bank of Sri Lanka


MONETARY BOARDCENTRAL BANK OF SRI LANKA3-1 December 2021 CIRCULAR No. 13 of 2021DEFERMENT OF RECOVERY ACTIONS AGAINST BORROWERS AFFECTED BY COVID-19 PANDEMICThe Central Bank of Sri Lanka, with a view to meeting the challenges faced by businesses and individuals due to the ongoing COVID-19 pandemic, requests licensed commercial banks and licensed specialised banks, (herein referred to as licensed banks) to suspend all types of recovery actions, including parate execution and forced repossession of leased assets as follows:1. Licensed banks shall extend the suspension of all recovery actions stipulated in the Circular No.8 of 2021 dated 01 September 2021 on Concessions for COVID-19 Affected Businesses and Individuals up to 31.03.2022.2. The requirement to suspend all recovery actions stipulated in the Circular No. 10 of 2021 dated 13 September 2021 on Extensions of Debt Moratorium for COVID-19 Affected Businesses and Individuals in the Tourism Industry up to 30.06.2022 shall remain unchanged.
Nivard Ajith Leslie CabraalChairman of the Monetary Board and Governor of the Central Bank of Sri Lanka


wMONETARY BOARD CENTRAL BANK OF SRI LANKA13 January 2021 CIRCULAR No. 01 of 2021SUSPENSION OF RECOVERY ACTIONS AGAINST SMALL AND MEDIUM ENTERPRISE (SME) PADDY MILLERSConsidering the Government initiatives to support the SME Paddy Millers amidst COVID 19 pandemic for the upcoming harvesting seasons, licensed commercial banks and licensed specialised banks (hereinafter referred to as licensed banks), are required to suspend recovery actions against SME Paddy Millers for a period of six months commencing from 1 January 2021 as specified below.(1) In the case where a licensed bank has commenced or given notice of recovery action under the provisions of the Recovery of Loans by Banks (Special Provisions) Act, No. 4 of 1990 or Mortgage Act No. 06 of 1949 as amended or Finance Leasing Act No. 56 of 2000 or any other relevant Act in this regard, such recovery actions shall be suspended on condition that the concerned licensed bank and the borrower reach a debt re-payment agreement.(2) Licensed banks shall defer passing new resolutions under the above Acts, for recovery of loans and advances. In instances where resolutions for recovery have already been passed, auctioning of assets will be suspended until 30.06.2021.(3) In instances where there are on-going litigations in courts relating to recovery, borrowers will be permitted to enter into an agreement by submission of affidavit to Courts agreeing to comply with the requirements set out in (1) above.(4) Licensed banks shall suspend any other legal or recovery action until 30.06.2021.Chairman of the Monetary Board and Governor of the Central Bank of Sri Lanka


CENTRAL BANK OF SRI LANKA BANK SUPERVISION DEPARTMENT25 January 2021 CIRCULAR No. 02 of 2021Amendments to Circular No. 04 of 2018 on Guidelines to Licensed Banks on the Adoption of Sri Lanka Accounting Standard - SLFRS 9: Financial InstrumentsThe Central Bank of Sri Lanka, having considered the current exceptional circumstances, latest Budget proposal on International Sovereign Bonds and with a view to establishing consistent practices on the adoption of Sri Lanka Accounting Standard - SLFRS 9: Financial Instruments by licensed banks, hereby issues the amendment to the Annex I of the Circular No. 04 of 2018 on Guidelines to Licensed Banks on the Adoption of Sri Lanka Accounting Standard - SLFRS 9: Financial Instruments.Guideline 2.5 (c) shall be inserted immediately after Guideline 2.5 (b) as follows:2.5 (c) However, it is permitted to apply a minimum LGD of 10 per cent when computing expected losses for the year 2021.Director of Bank Supervision


10 March 2021 CIRCULAR No. 03 of 2021MONETARY BOARD CENTRAL BANK OF SRI LANKACONCESSIONS FOR LEASE FACILITIES OBTAINED BYBUSINESSES AND INDIVIDUALS IN PASSENGER TRANSPORTATION SECTORWith a view to meeting the challenges faced by businesses and individuals engaged in passenger transportation sector due to the ongoing COVID-19 pandemic, the Central Bank of Sri Lanka (CBSL) requests licensed commercial banks and licensed specialised banks, (hereinafter referred to as licensed banks), to provide concession for lease facilities obtained by COVID-19 affected businesses and individuals engaged in passenger transportation services (hereinafter referred to as the Scheme) for six months commencing from 1 April 2021 as specified below.Accordingly, this Circular is issued to give effect to the Scheme in a consistent manner across all licensed banks.1 . Period of deferment of lease installments1.1 Licensed banks shall defer the lease installments for a period not exceeding 6 months commencing from 1 April 2021 or a shorter period as applicable, considering the financial difficulties faced by the eligible borrowers.1.2 The lease installment (both capital and interest) shall be deferred on the request made by affected borrowers.2 . Deadline for submission of the application2.1 Eligible borrowers may request on or before 19 April 2021, for deferring the lease instalments in writing or through electronic means. Licensed banks shall expeditiously communicate the concessions, deadline and application format for submission to all eligible borrowers via printed and/or electronic means including email and SMS.2.2 Licensed banks shall accept any request submitted after 19 April 2021, if the reasons for delay in making such request is acceptable.1


10 March 2021 CIRCULAR No. 03 of 2021MONETARY BOARD CENTRAL BANK OF SRI LANKA3 Eligible borrowers3.1 Businesses and individuals engaged in providing public passenger transportation, private passenger transportation such as school transport service, office transport service, taxis including three wheelers, etc. and providing passenger transportation services to tourism sector.3.2 Licensed banks may request the eligible borrower to submit necessary documentation to ensure that the vehicle is used to provide passenger transportation to the sectors referred in 3.1 above.4 Eligible credit facilitiesPerforming lease facilities including lease facilities under moratorium as at 31 March 2021 obtained by eligible borrowers referred to under paragraph 3 above.5 Structuring of the concession5.1 Extending the existing tenure of lease facilities(a) Licensed banks shall extend the existing tenure of lease facilities eligible for deferment by the respective period of deferment.(b) Licensed banks may charge an interest rate for the deferred period only on the lease instalments falling due during the deferred period, not exceeding the latest auction rate for 364-days Treasury Bills, available as at 01 April 2021, plus 1 per cent per annum.(c) Such interest shall be recovered from April 2023 along with the existing lease installment falling due during this period. In the case where, the remaining tenure of the lease facility ends before April 2023, financial institutions may commence recovery of such interest at the completion of the remaining tenure of the lease facility.(d) Once the remaining tenure of the existing lease facility is over, borrowers shall commence repayment of the deferred installments referred to in paragraph 5.1(a) above.2


10 March 2021 CIRCULAR No. 03 of 2021MONETARY BOARD CENTRAL BANK OF SRI LANKA5.2 Recovery of amounts due on the moratorium(a) Considering that the use of public and private transportation is gradually returning to normalcy due to reopening of schools (monthly payments being collected uninterruptedly by many transport providers), offices, airport, etc., potential impact of the extended debt moratoriums on the licensed banks, and the ongoing vaccination program, licensed banks shall commence recovery of installments falling due in relation to the moratorium granted during 01 April 2019 to 31 March 2020, 01 April 2020 to 30 September 2020 and 01 October 2020 to 31 March 2021 (hereinafter referred to as moratoriums), as applicable, during the deferred period of the existing lease facility referred to in paragraph 5.1(a) above.(b) Once the deferred period of the existing lease facility (referred to in paragraph 5.1(a) above) is over, the repayment of the installments due on the moratoriums shall be deferred until the remaining tenure including the deferred period of the existing lease facility is over.(c) For such deferred period of the installments due on the moratoriums, interest shall accrue at a rate not exceeding the latest auction rate for 364-days Treasury Bills, available as at 01 April 2021, plus 1 per cent per annum.(d) Such interest shall be recovered immediately after completing the payment of interest referred to in 5.1(b) and (c) above along with the installments on the existing lease facility and deferred installments relating to moratoriums, as applicable.(e) Once the remaining tenure including the deferred period of the existing lease facility is over, borrowers shall commence repayment of the deferred installments relating to the moratoriums referred to in paragraph 5.2(b) above.5.3 If the borrower submits a written request to settle the lease instalments falling due during the deferred period including the dues of moratoriums and interest for the


falling due during the deferred period including the dues of moratoriums and interest for the deferred period, early, licensed banks shall facilitate such requests. In such case, licensed bank and the borrower shall agree on the structure, interest rate and the tenure. The interest rate shall be in line with the current market rate.3


10 March 2021 CIRCULAR No. 03 of 2021MONETARY BOARD CENTRAL BANK OF SRI LANKA5.4 Licensed banks may offer any additional options to borrowers, on the request of the borrower, in a way that the overall benefits to borrowers are not less than the benefits offered under this Circular. In such case, licensed banks shall clearly explain the interest computation under all options including the structure proposed in this Circular to the borrower, prior to approving such concession.5.5 Licensed banks shall waive off the penal interest accrued and unpaid as at 01 April 2021, if any. Penal interest shall not be accrued and charged during the period of deferment.5.6 Licensed banks shall not levy excessive fees or charges in relation to granting of the concessions.5.7 In the case of declined requests, licensed banks shall clearly mention the reason for such decline.6 Accounting considerations on the deferment of lease installmentsLicensed banks shall account for the deferment of lease installments as per Sri Lanka Accounting Standards and any additional guidance provided by CA Sri Lanka (CASL) on Financial Reporting implications due to the outbreak of COVID-19. Licensed banks may seek advice from CASL and Auditors for additional guidance/clarification in this regard.7 Reporting requirementLicensed banks shall report the details of deferment of lease installments availed by their borrowers to the Bank Supervision Department as at the 30th of each month, within 15 working days, commencing 01 May 2021, as per the attached format.Prof. V D LakshmanChairman of the Monetary Board andGovernor of the Central Bank of Sri Lanka4


CIRCULAR NO. 03 OF 2021 ON CONCESSIONS FOR LEASE FACILITIES OBTAINED BY BUSINESSES AND INDIVIDUALS IN PASSENGER TRANSPORTATION SECTOR Report on Eligible Borrowers Availing Concessions under the above CircularName of the bank:As at:Total No. of Requests received: All Amounts in Rs. 000
Serial No.Name of the Eligible Business/ Individual who has requested for deferment of lease InstallmentsRequest considered for deferment of lease installmentsReasons for declining the request for deferment of lease installmentsType of passenger transportation (Please select the appropriate type from the given drop/down list)Amount of capital outstanding as at 01.04.2021Approved Period of deferment (in Months)Amount of lease installments falling due during the deferred period commencing 01.04.2021Interest to be accrued for the period of deferment at 364-days T-bill + 1% (Existing facility)Interest to be accrued for the period of deferment at 364- days T-bill +1% (Moratorium)*Commencement of repayment of the existing lease installments and dues moratorium*YesNOPendingApplicable interest rateAmount of interest to be accruedApplicableInterest rateAmount of interest to be accruedAgreed date of the commencement of repayment of the existing loanActual date of the commencement of repayment of the existing loanAgreed date of the commencement of repayment of dues of Moratorium*Actual date of the commencement of repayment of dues of Moratorium* 1234S67B91011121314151617IB
Total* - Moratorium granted during 01 April 2019 to 31 March 2020, 01 April 2020 to 30 September 2020 and 01 October 2020 to 31 March 2021Please email the position as at as at the 30th of each month, within 15 working days, commencing 01 May 2021 to bsddb@cbsl.lk with a copy todbsd@cbsl.lk


MONETARY BOARDCENTRAL BANK OF SRI LANKA19 March 2021CIRCULARNo. 04 of 2021EXTENSION OF DEBT MORATORIUM FOR COVID-19 AFFECTED BUSINESSES AND INDIVIDUALS IN THE TOURISM INDUSTRYWith a view to meeting the challenges faced by businesses and individuals engaged in tourism sector due to the ongoing COVID-19 pandemic, the Central Bank of Sri Lanka (CBSL) requests licensed commercial banks and licensed specialised banks, (hereinafter referred to as licensed banks), to extend the debt moratorium granted for tourism sector under Circular No. 08 of 2020 dated 26 August 2020 for another six months commencing 1 April 2021 as specified below. However, licensed banks may offer any additional options to borrowers, on the request of the borrower, in a way that the overall benefits to borrowers are not less than the benefits offered under this Circular. The aforementioned extension is granted in order to provide adequate time for borrowers to come up with proposals for a long-term arrangement. Therefore, borrowers shall submit acceptable plans to licensed banks for restructuring of credit facilities over a long period of time, prior to the expiry of the extended moratorium period. Such plans shall be assessed on case-by-case basis by licensed banks. Accordingly, this Circular is issued to give effect to the Scheme in a consistent manner across all licensed banks.The following provisions of the Circular No. 08 of 2020 have been amended and other provisions of the cited Circular will remain unchanged:1. General Terms and Conditions1 (iii) Debt moratorium refers to moratorium for both capital and interest for a further period of six months commencing 1 April 2021 to 30 September 2021.1 (iv) Eligible borrowers who wish to avail the moratorium shall make a request seeking such moratorium to the relevant licensed bank on or before 19 April 2021. Licensed banks are requested to accept any request submitted after 19 April 2021, if the reasons for delay in making such request is acceptable.


submitted after 19 April 2021, if the reasons for delay in making such request is acceptable. Any eligible borrower who has the capacity to service the loan repayment is expected to service such loan repayments instead of requesting for this extension.1


MONETARY BOARD CENTRAL BANK OF SRI LANKA19 March 2021 CIRCULAR No. 04 of 20212. Structuring the debt moratorium2 (i) Licensed banks shall convert the capital and interest falling due during the moratorium period commencing from 1 April 2021 to 30 September 2021 into a term loan. Licensed banks may amalgamate the capital and interest falling due during the previous moratorium granted with the capital and interest falling due during 1 April 2021 to 30 September 2021, except for EMI loans for which the interest rate for the moratorium period is capped at 7 per cent per annum.2 (ii) Licensed banks may commence recovery of such converted loan once the extended moratorium period is over.2(v) Licensed banks shall waive off the accrued and unpaid penal interest as at 1 April 2021, if any, on credit facilities considered under this Circular. Penal interest shall not be accrued and charged during the moratorium period.Chairman of the Monetary Board and Governor of the Central Bank of Sri Lanka
2