The notice, issued July 1, 2026 under Section 83C of the Banking Act, No. 30 of 1988 (as amended), brings the consolidated July 2026 list of CBSL-designated prohibited schemes to more than 25 entities.

Penalties under the law apply to operators and promoters alike: up to three years in prison, a fine of up to Rs. 1,000,000, or both.

The Crypto-Washing Pattern

The most significant detail for digital asset investors is how many of the blacklisted entities wrapped fraudulent operations in blockchain terminology. OnmaxDT marketed itself as a crypto investment platform promising 300% returns over 15 months. More than 200,000 people joined the scheme, and investigators say it caused losses exceeding USD 100 million. The Financial Crimes Investigation Division (FCID) arrested its directors and, in a precedent-setting legal move, a Sri Lankan court ordered the freezing of eight Binance accounts held in the United States along with 57 local bank accounts.

That cross-border freeze is described by legal observers as the first time a Sri Lankan court successfully reached into a major crypto exchange in a crypto fraud case.

MTFE, which marketed itself as a "Metaverse Foreign Exchange" AI trading platform, collapsed in August 2023. Investigators estimate the global fraud at USD 2.7 billion across Sri Lanka and Bangladesh, with Sri Lankan losses alone approaching USD 1 billion. Sport Chain promoted a cryptocurrency that did not exist on any public chain, defrauding more than 8,000 Sri Lankans of an estimated Rs. 14 to 15 billion (approximately USD 46.6 million). Money laundering charges have been filed. SGO (sgomine.com) used crypto mining branding; Ledger Block exploited blockchain-adjacent terminology in a multi-level recruitment structure. Beecoin and its associated Sunbird Foundation offered a token with no verifiable on-chain presence. Windex Trading, the seventh entity in this group, presented itself as an AI-powered trading and investment platform, deploying AI trading branding to draw in investors.

The Regulatory Vacuum That Made This Possible

Sri Lanka has an estimated 420,000 crypto holders, yet as of July 2026, zero Virtual Asset Service Providers (VASPs) are licensed or regulated in the country. A VASP, as defined under FATF guidelines, is any business that exchanges, transfers, or custodies digital assets on behalf of customers.

The absence of a licensing framework means no regulatory baseline exists to distinguish legitimate crypto platforms from fraudulent ones. Every platform operates in the same legal gray zone, a condition scheme operators have systematically exploited.

The CBSL has been clear that holding crypto assets is not illegal. In public statements reported in 2026, the Governor indicated that the restriction applies to crypto being used as a medium of exchange, not to ownership itself.

But without licensed and supervised operators, investors have no reliable way to vet the platforms they use. The Securities and Exchange Commission and Ministry of Digital Economy are jointly developing a VASP registration framework aligned with FATF travel rule standards, but as of this writing no legislation has been gazetted.

Enforcement: Designation Is Not Prosecution

The CBSL notice functions primarily as a legal formalization and a public awareness mechanism.

Sri Lanka's first-ever conviction under Section 83C came in April 2025, when the Anuradhapura High Court handed down a suspended sentence and Rs. 1 million fine for a scheme that operated in 2005. The gap between offense and conviction was roughly 20 years.

Ceylon Today reported in May 2025 that legal analysts argue Section 83C of the Banking Act, the main provision used against pyramid schemes, is poorly enforced, with prosecutions being rare, penalties weak, and most cases collapsing due to a lack of evidence or procedural flaws.

For victims of the schemes already on the list, including MTFE and OnmaxDT, the July 2026 designation offers no meaningful path to recovery.

Regional Dimensions

The MTFE collapse illustrates a cross-border problem with no cross-border solution. The same platform extracted wealth from Sri Lanka and Bangladesh within the same operational period, with Bangladesh's losses estimated in the hundreds of millions of dollars. Both countries had large financially excluded populations and no real-time mechanism to share enforcement intelligence.

This pattern is not unique to South Asia. MTFE and QNet both operated in Nigeria, South Africa, and Kenya during overlapping periods, using identical mobile-first recruitment tactics and trading-platform branding. South Africa's Financial Sector Conduct Authority has prosecuted some of these entities more aggressively than regulators in Sri Lanka have managed to date.

QNet's history in the region illustrates how durable these operations can be. Sri Lanka banned QNet in 2005, at which point the scheme was estimated to have extracted approximately USD 15 million from Sri Lankan participants. The platform continued operating elsewhere for years. In 2023, India's Enforcement Directorate seized roughly 500 crore rupees (approximately USD 60 million) from QNet's parent structures, underscoring the persistent gap between national designation and effective transborder enforcement.

What Comes Next

Sri Lanka's 2022 economic crisis created the conditions for this wave of schemes, pushing people toward high-return promises at a time of genuine financial desperation. Victims spanned a wide demographic range. Professionals including doctors, teachers, and civil servants were among those affected, alongside young adults between 18 and 35. Scheme operators systematically weaponized social trust networks, including WhatsApp groups and religious community ties, to recruit participants.

The CBSL's periodic lists are now a recurring enforcement instrument rather than a one-off warning. The regulator has issued at least six rounds of designations since May 2023: eight entities named in May 2023, eight more in August 2023, eleven in October 2024, twenty-one in January 2025, twenty-two in November 2025, and twenty-four in February 2026, culminating in the current consolidated list.

The addition of Infinity Rover signals the pipeline of new entrants remains active. Until Sri Lanka enacts a functioning VASP licensing regime, analysts warn the prohibited list will keep growing, and the distinction between a regulated crypto platform and a fraud will remain invisible to the people most at risk.