Sri Lanka e-commerce laws and regulations for online sellers cover everything from how you register your business to how you handle customer data, and getting them right from the start protects you from fines, disputes, and disrupted operations. This guide breaks each requirement into a clear checkpoint so you can trade online with confidence.
Why E-Commerce Compliance Matters for Sri Lankan Online Sellers
Compliance is not about paperwork for its own sake. It is about building a business that customers trust and authorities respect. Sri Lanka’s regulatory environment for online commerce has matured significantly, with dedicated legislation covering digital transactions, consumer rights, and data protection now firmly in place.
Ignoring these rules carries real consequences: orders frozen by customs, payment accounts suspended by banks, fines from the Consumer Affairs Authority (CAA), or worse, reputational damage on social media. The good news is that most requirements are straightforward once you know what they are. Think of this guide as your compliance checklist, not a legal minefield.
Step 1: Business Registration Requirements in Sri Lanka
Before you accept your first payment, you need a legal business entity. In Sri Lanka, sole traders register under the Business Registration Act with the Divisional Secretariat in their area, paying a modest fee (around LKR 2,000 for a sole proprietorship). Private limited companies register through the Registrar of Companies under the Companies Act No. 7.
Operating under a business name without registration is technically illegal and will prevent you from opening a business bank account or signing merchant agreements with payment processors. If you are just starting out, our guide on how to start an online business in Sri Lanka walks through entity selection in detail.
Practical takeaway: Register before you go live. A sole proprietorship takes less than a week and is the simplest entry point for most first-time sellers.
Step 2: The Electronic Transactions Act and Your Legal Obligations
The Electronic Transactions Act No. 19, administered by the Information and Communication Technology Agency (ICTA), is the foundation of Sri Lanka’s digital commerce law. It gives legal validity to electronic contracts, digital signatures, and online records, meaning your order confirmation email is a binding contract under Sri Lankan law.
What this means practically: your website’s terms and conditions, return policy, and order confirmation must be clear, accessible, and retained. You cannot claim a customer never agreed to your terms if you can prove they ticked a checkbox at checkout. Conversely, vague or hidden terms may be unenforceable. Make your policies explicit and easy to find.
Practical takeaway: Publish clear Terms and Conditions and a Return Policy on your website. Store order records electronically for at least five years.
Step 3: Consumer Protection Laws Applicable to Online Sales
The Consumer Affairs Authority Act No. 9 applies fully to online transactions. As an online seller, you must not mislead buyers about product descriptions, pricing, or availability. False advertising, whether on your website or in a Facebook post, is a violation that the CAA can act on.
Sri Lankan consumer law requires that goods match their described condition, are fit for purpose, and are safe. If you sell physical products, you are responsible for ensuring they comply with Sri Lanka Standards Institution (SLSI) standards where applicable. For sellers on marketplaces, check our guide to selling on Daraz Sri Lanka for platform-specific consumer protection requirements.
Practical takeaway: Never overstate product quality. Honour returns where products are defective or materially different from their listing. A simple, fair refund policy reduces CAA complaints dramatically.
Step 4: Payment Gateway Regulations and CBSL Guidelines
The Central Bank of Sri Lanka (CBSL) regulates all payment systems under the Payment and Settlement Systems Act No. 28. As a seller, you are not a payment processor, but you must use only CBSL-licensed payment service providers. Using unlicensed aggregators exposes you to transaction freezes.
CBSL-approved local gateways include PayHere, Mintpay, and iPay. If you accept card payments on your own site, your gateway must be PCI DSS compliant (a payment card industry security standard). CBSL also requires that foreign currency receipts from overseas customers be reported to an authorised dealer bank; you cannot simply hold USD in a personal rupee account and ignore exchange regulations.
Practical takeaway: Use a licensed local payment gateway and open a business bank account. If you sell internationally, speak to your bank about a foreign currency account under CBSL guidelines.
Step 5: Data Privacy and the Personal Data Protection Act
Sri Lanka’s Personal Data Protection Act No. 9 (PDPA) is the most significant new compliance obligation for online sellers. It governs how you collect, store, use, and share customer information, including names, email addresses, phone numbers, and payment data. The PDPA is enforced by the Data Protection Authority of Sri Lanka.
You must obtain informed consent before collecting personal data, explain why you are collecting it, and give customers the right to access or delete their information. You also cannot sell customer data to third parties without explicit consent. A privacy policy on your website is not optional; it is a legal requirement under the Act. For a broader look at Sri Lanka e-commerce laws and regulations for online sellers in the digital context, the PDPA overview on Wikipedia provides useful background.
Practical takeaway: Add a privacy policy to your website today. Review what customer data your platform or CRM collects and ensure you have consent mechanisms in place.
Step 6: Import, Export, and Customs Rules for E-Commerce Goods
If you source products from overseas or ship to international customers, Sri Lanka Customs (under the Customs Ordinance) and the Sri Lanka Export Development Board (EDB) become relevant. Importing goods for resale requires correct HS codes, accurate customs declarations, and payment of applicable import duties and Value Added Tax (VAT) at the border.
Undervaluing goods to reduce customs duty is a serious offence with penalties including seizure and prosecution. For exporters, the EDB offers facilitation services and some duty exemptions for qualifying SMEs. If you are exploring popular online business ideas to start in Sri Lanka that involve cross-border trade, factor customs compliance into your pricing model from day one.
Practical takeaway: Work with a licensed customs broker if you import regularly. For exports, register with the EDB to access incentives and guidance.
Step 7: Tax Obligations: VAT, Income Tax, and Online Sellers
Online sales are taxable income. Full stop. The Inland Revenue Department (IRD) treats e-commerce revenue identically to physical retail under the Inland Revenue Act No. 24. You must declare all income from online sales in your annual tax return.
VAT applies once your annual turnover exceeds LKR 60 million (the current threshold as of the latest IRD guidelines). If you cross that threshold, you must register for VAT, charge 18% on applicable sales, and file returns quarterly. Below that threshold, VAT registration is optional but tracking your turnover carefully is not. Smaller sellers are still liable for income tax on profits above the personal relief threshold.
Practical takeaway: Keep monthly sales records from day one. Use accounting software and consult an IRD-registered tax agent as your business grows.
Common Compliance Mistakes Sri Lankan Online Sellers Make
The most frequent mistake is operating informally for too long, accepting payments into a personal account, skipping registration, and hoping no one notices. This creates problems the moment you try to scale, apply for a business loan, or attract a wholesale supplier who asks for your business registration number.
Other common pitfalls include publishing no privacy policy, using imported product images without permission (which triggers copyright issues under the Intellectual Property Act No. 36 ), and failing to issue receipts. Sri Lanka’s Electronic Transactions Act requires that customers receive a record of their transaction. A simple automated order confirmation email satisfies this.
Sellers on social media often assume they are exempt from these rules. They are not. Facebook or Instagram sales are subject to the same consumer protection, tax, and data laws as any other channel.
How to Stay Compliant as Your Online Business Scales
Compliance is an ongoing commitment, not a one-time task. As your turnover grows, new obligations kick in: VAT registration, employer obligations if you hire staff, and potentially sector-specific licensing if you move into food, pharmaceuticals, or financial products.
Build a simple compliance calendar: annual business registration renewal, quarterly VAT returns (once applicable), annual tax filing, and a yearly review of your privacy policy and website terms. Choosing the right platform also reduces your compliance burden. Our guide to the best e-commerce platforms for small businesses in Sri Lanka highlights options with built-in compliance features like PDPA-friendly data handling and CBSL-compatible payment integrations.
If you are serious about scaling, a digital marketing and business consultancy with local regulatory knowledge can help you build systems that grow with you, not against you. The investment in proper setup now saves costly corrections later.
FAQ
Do I need to register my business to sell online in Sri Lanka?
Yes. Selling online does not exempt you from business registration. Sole traders register under the Business Registration Act at the local Divisional Secretariat. Companies register under the Companies Act No. 7. Operating without registration is illegal and limits your ability to open business bank accounts or use licensed payment gateways.
Is there a VAT threshold that applies to Sri Lankan online sellers?
Yes. VAT registration becomes compulsory once your annual turnover exceeds LKR 60 million. Below that threshold, VAT registration is optional, but all income from online sales remains subject to income tax. Track your monthly revenue carefully so you know when you are approaching the threshold.
What does Sri Lanka’s Personal Data Protection Act mean for my e-commerce store?
The PDPA requires you to collect customer data only with informed consent, explain how you use it, and give customers the right to access or delete their information. You must publish a privacy policy on your website and cannot share or sell customer data without explicit permission. Non-compliance can result in enforcement action by the Data Protection Authority.
Are there restrictions on accepting foreign currency payments from overseas customers?
Yes. Under CBSL regulations, foreign currency earnings must be received through an authorised dealer bank and properly declared. You cannot hold foreign currency receipts in a personal rupee account indefinitely. Speak to your bank about opening a Foreign Currency Banking Unit (FCBU) account if you sell internationally.
What consumer rights must I comply with when selling products online in Sri Lanka?
Under the Consumer Affairs Authority Act, products must match their described condition, be fit for purpose, and be safe. You must not use misleading descriptions or pricing. Customers are entitled to remedies including refunds or replacements for defective goods. Your return and refund policy must be clearly visible on your website before the customer completes a purchase.
