AI cyber risks in Sri Lanka deserve attention for a reason that extends well beyond the familiar problem of online scams and stolen banking passwords. As banks, payment networks and financial services become increasingly dependent on interconnected digital systems, a serious cyber incident may no longer remain a problem for one institution. Under the wrong circumstances, it could interrupt services used by several institutions simultaneously, affecting businesses, households and confidence in the wider financial system.
That is the concern raised by the International Monetary Fund during its AI & Cyber Risks discussion at the 2026 IMF-World Bank Annual Meetings in Bangkok on 16 October. IMF Deputy Managing Director Bo Li highlighted how artificial intelligence is changing cybersecurity for both attackers and defenders. AI can improve fraud detection, identify suspicious activity and strengthen incident response. At the same time, it can accelerate the discovery and possible exploitation of security weaknesses.
The IMF’s concern is not simply that hackers may become more sophisticated. It is that increasingly interconnected financial systems could allow disruption at one important technology provider or shared platform to spread much further than the original point of attack.
For Sri Lanka, this raises an important policy question. The country is working to expand digital payments, modernise public services and encourage wider participation in the digital economy. Those ambitions are valuable, but how prepared is the financial system to keep functioning if a critical digital service becomes unavailable or compromised?
The answer matters because financial stability is no longer determined only by the strength of bank balance sheets. It also depends on the technology that allows money to move safely between institutions and their customers.
The IMF’s AI Warning Is Really About the Speed and Scale of Cyberattacks
The IMF’s October discussion builds on concerns examined in its June 2026 note, Artificial Intelligence and Cybersecurity in the Financial Sector.
The central argument is that artificial intelligence can change the speed, frequency and scale of cyber threats, even when the underlying methods of attack are not entirely new.
Traditionally, attackers might spend considerable time looking for software weaknesses, identifying vulnerable systems and developing ways to exploit them. More capable AI tools can assist with parts of this work, potentially making it possible to examine more systems in less time. They can also help attackers generate convincing fraudulent communications and automate elements of malicious activity.
However, the same technology offers defenders considerable opportunities. AI can analyse large volumes of security data, identify unusual network activity, support fraud monitoring and help cybersecurity teams investigate incidents more efficiently.
The difficulty is that these capabilities are developing on both sides. An institution may adopt AI to improve its ability to detect threats, while attackers use similar advances to increase the number and sophistication of potential attacks.
The IMF therefore identifies a problem that goes beyond the capabilities of any individual bank. If an important weakness exists in technology used by numerous financial institutions, faster vulnerability discovery and exploitation could increase the number of organisations exposed before effective defensive measures are introduced.
The challenge is not necessarily an entirely new form of cyberattack. It is the possibility that familiar security weaknesses could be exploited much faster and across a much larger number of targets.
How Can a Cyberattack Become a Financial Stability Problem?
It is useful to distinguish between a cyber incident affecting a bank and one threatening the wider financial system.
If criminals gain access to a customer’s online banking credentials, the consequences can be serious for that individual. But such an incident does not automatically threaten the stability of the banking sector.
The wider concern arises when an attack compromises infrastructure on which multiple institutions depend.
Imagine, for example, that a critical service supporting transactions between several banks becomes unavailable because of a cyber incident. Customers may find that transfers are delayed, businesses may struggle to complete payments, and institutions may need to temporarily restrict certain services while the problem is investigated.
A business waiting for payment from a customer may be unable to settle an obligation to its supplier. Another company may experience difficulty processing payroll. A household may be unable to complete an urgent transfer.
If the disruption is brief and properly contained, the consequences may remain manageable. But if it affects several institutions, continues for an extended period or creates uncertainty about whether transactions have been processed correctly, the economic implications become more serious.
The problem can then move beyond technology into business continuity, liquidity management and public confidence.
This is how an operational incident could develop into a financial stability concern. It does not necessarily mean that banks have become insolvent or that customer deposits have disappeared. Rather, the financial system may temporarily struggle to perform some of the functions people depend on it to provide.
The distinction is important. A cyberattack does not automatically become a financial crisis, but a sufficiently serious disruption could affect economic activity and confidence even when the underlying institutions remain financially sound.
Sri Lanka’s Digital Payment Infrastructure Makes This Relevant
Sri Lanka’s financial system already relies on several interconnected payment and settlement mechanisms.
The Central Bank of Sri Lanka operates the Real Time Gross Settlement system, or RTGS, which supports the settlement of significant financial obligations between participating institutions. Meanwhile, retail payment infrastructure includes systems such as the Common Electronic Fund Transfer Switch (CEFTS), which enables customers to transfer money between participating financial institutions through digital channels.
As the Central Bank explains in its overview of payment and settlement systems, CEFTS allows customers to initiate interbank fund transfers around the clock, including outside normal banking hours.
Digital payment services provide substantial benefits. Businesses can receive funds more quickly, households can avoid unnecessary visits to bank branches, and electronic transactions can help make everyday financial activity more convenient and efficient.
The expansion of digital services can also support financial inclusion, particularly where mobile technologies make financial transactions more accessible.
But greater connectivity creates a corresponding need to manage operational dependencies.
A customer using a mobile banking application may see only the bank’s interface. Behind that interface, however, a transaction can depend on several different systems, including the bank’s own technology, communication networks, payment-processing infrastructure and settlement arrangements.
Not all of these systems have the same operators or risk profiles, and their actual resilience cannot be assessed simply from their existence. Nevertheless, the broader principle is clear: the reliability of a digital financial service depends on more than the security of the application visible to the customer.
For Sri Lanka, the relevant question is therefore not whether its payment systems have been compromised. The IMF’s statement provides no evidence of such an incident. It is whether the institutions responsible for these systems understand their operational dependencies and have sufficiently tested arrangements to contain and recover from serious disruptions.
Cyber Fraud and Systemic AI Cyber Risks Are Two Different Problems
Sri Lanka already has considerable experience with the more visible side of cybercrime.
In a press release issued on 1 January 2026, Sri Lanka CERT reported receiving more than 12,650 complaints relating to social media misuse and cybersecurity incidents during 2025.
The organisation identified fake accounts, compromised accounts and financial scams involving social media platforms among the important problems reported to it.
These complaints highlight a genuine public-protection challenge. People may lose money after responding to fraudulent messages, sharing confidential information or trusting individuals who impersonate legitimate financial institutions.
AI could make some of these forms of deception more convincing. Fraudsters can potentially use AI-assisted content to produce realistic communications, imitate familiar writing styles or create fabricated audio and visual material.
However, it is important not to confuse the available evidence. Sri Lanka CERT’s complaint total does not establish how many incidents involved artificial intelligence, and it should not be presented as evidence that AI-driven attacks on Sri Lankan banks are increasing.
The IMF’s systemic warning concerns another dimension of cyber risk: attacks or failures affecting technology infrastructure and the continuity of critical financial services.
These two problems require different but complementary responses.
Public education, customer authentication, fraud monitoring and rapid reporting mechanisms can help reduce individual financial losses. Infrastructure resilience, effective technical controls, contingency arrangements and institutional coordination are needed to address the possibility of wider financial disruption.
Sri Lanka needs both. Protecting customers against fraud is essential, but preventing individual scams alone cannot guarantee the resilience of the national financial system.
Sri Lanka Already Has Cybersecurity Rules, but Implementation Is the Real Test
It would be inaccurate to suggest that Sri Lanka has no regulatory framework for financial-sector cybersecurity.
The Central Bank introduced its Regulatory Framework on Technology Risk Management and Resilience for Licensed Banks through Banking Act Direction No. 16 of 2021. That framework establishes technology-risk requirements for licensed banks and extends to operations involving agents and third-party service providers.
Subsequently, CBSL issued a circular on reporting IT and cybersecurity incidents in May 2025. In March 2026, it also issued new directions covering the outsourcing of business operations by licensed banks.
These measures establish an existing supervisory foundation for managing technology and operational risks.
At the national level, Sri Lanka also adopted its National Cyber Security Strategy for 2025–2029. The strategy was approved by the Cabinet in July 2025, with the Government subsequently launching it alongside the National Cyber Security Operations Centre in September.
According to the Government’s official announcement, the initiative is intended to strengthen preparedness, incident response and the protection of digital services.
These are positive institutional developments. They demonstrate that cybersecurity is already recognised as a matter extending beyond individual organisations.
The more difficult question is whether these requirements and capabilities are being implemented consistently and tested against the rapidly evolving threats described by the IMF.
A bank may comply with important cybersecurity requirements and still face serious difficulty if a service on which it depends becomes unavailable. A third-party provider may meet contractual security obligations while remaining a common operational dependency across several institutions.
This does not prove that Sri Lanka’s existing arrangements are inadequate. It shows why regulations and policies should be judged partly by how effectively they operate during realistic disruptions.
The next stage of cybersecurity governance should therefore examine not only whether institutions have security policies and recovery plans, but also whether critical services can actually be restored when those plans are put under pressure.
Preventing Every Attack Is Not a Realistic Financial Stability Strategy
One of the most important messages from the IMF’s analysis is the need to move beyond a narrow focus on prevention.
Cybersecurity has traditionally placed considerable emphasis on stopping unauthorised access. That remains essential. Strong authentication, timely software updates, network security and careful management of sensitive information all reduce the opportunities available to attackers.
Yet no complex digital system can reasonably be assumed to be completely immune from every possible attack or technical failure.
Financial institutions therefore need to consider what happens after something goes wrong.
Can an affected system be isolated before the disruption spreads? Can essential payment functions continue through alternative arrangements? Are backup systems sufficiently independent of the original point of failure? Can information be restored accurately, without creating uncertainty about which transactions were completed?
These questions concern operational resilience rather than prevention alone.
There is also an important difference between restoring a website and restoring a financial service. A banking application may become accessible again while institutions still need to verify balances, transaction records and settlement information.
For this reason, recovery must protect the integrity of financial data as well as the availability of digital services.
The IMF’s emphasis on limiting the wider consequences of an incident is especially relevant where several institutions depend on common technology providers.
A financial system should be designed so that one compromised component does not automatically compromise everything connected to it.
That may require stronger separation between systems, independent recovery arrangements, carefully controlled access privileges and better coordination among banks, payment-system operators and technology providers.
The objective is not to guarantee that no cyber incident will ever occur. It is to prevent an incident from causing more damage than the financial system can reasonably absorb.
The Global Response Offers Sri Lanka a Practical Lesson
The IMF’s warning is already contributing to discussions about how financial authorities should prepare for AI-enabled cyber threats.
On 16 October, Reuters reported that G7 finance leaders had agreed to undertake tabletop exercises examining responses to potential AI-driven cyberattacks.
These exercises are intended to simulate serious incidents, assess the adequacy of existing response arrangements and identify improvements to emergency procedures.
The significance is that authorities are moving beyond discussing hypothetical threats towards testing how institutions and governments might respond to them.
Sri Lanka could draw a useful lesson from that approach.
A national financial-sector cyber-resilience exercise could bring together CBSL, commercial banks, relevant payment-system operators, Sri Lanka CERT and critical technology service providers.
Rather than examining only whether an individual bank can restore its computer systems, such an exercise could test a scenario in which several institutions experience disruption at the same time.
It could examine how quickly an incident is detected, who is responsible for coordinating the response, how information is shared and what happens if normal payment-processing arrangements cannot immediately be restored.
Communication with the public should also be tested. During a major digital disruption, uncertainty about the safety of accounts or the status of transactions can create confusion beyond the original technical problem.
Clear and coordinated information can therefore become part of maintaining financial confidence.
Such an exercise would not require Sri Lanka to assume that a systemic cyberattack is imminent. It would simply recognise that testing emergency procedures is considerably more useful before a major incident than trying to establish responsibilities after one has begun.
AI Can Also Strengthen Sri Lanka’s Financial Defences
The IMF’s warning should not lead to the conclusion that artificial intelligence itself is something the financial sector must avoid.
AI can be a valuable defensive technology when its use is properly governed.
For example, a bank processing a large number of transactions may use advanced analytical tools to detect unusual patterns that are difficult for human teams to identify quickly. Security systems can examine technical activity across networks, identify possible breaches and help staff prioritise the incidents requiring immediate attention.
AI can also support fraud investigations, vulnerability management and the analysis of large volumes of security information.
For institutions with limited cybersecurity personnel, these capabilities may offer opportunities to improve the effectiveness of existing teams.
However, the benefits depend on how the technology is deployed.
An automated security system that incorrectly blocks legitimate activity could itself interrupt essential services. AI-generated findings may be incomplete or inaccurate, while poorly controlled access to sensitive data can introduce additional operational and privacy risks.
Financial institutions therefore need clear arrangements for oversight, testing, accountability and human intervention when AI systems are used in critical operations.
They must also understand the risks introduced by external AI providers, particularly where sensitive financial data or important operational decisions depend on third-party technology.
AI should help financial institutions detect and respond to threats more effectively. It should not introduce new dependencies that institutions are unable to understand, monitor or control.
This is especially important for Sri Lanka, where investment in digital technologies should be accompanied by investment in the people, governance arrangements and technical expertise needed to manage them securely.
The Real Test Is Whether Sri Lanka’s Financial Services Can Keep Working
Sri Lanka’s economic recovery has brought renewed attention to familiar indicators of financial stability, including bank capital, liquidity, profitability, public debt and external reserves.
Those indicators remain essential. A financial system cannot be considered stable if its institutions are unable to absorb losses or meet their obligations.
But the IMF’s latest cybersecurity discussion adds another dimension to that assessment.
A bank can be well capitalised and still experience a severe technology failure. A payment network can be financially sound yet temporarily unable to process transactions. An institution can maintain adequate liquidity while its customers experience uncertainty because essential digital services are unavailable.
This means operational resilience must increasingly be treated as part of financial stability itself.
For Sri Lankan policymakers, that requires continued attention to technology-risk supervision, third-party dependencies, incident reporting and coordinated recovery arrangements. For banks and payment providers, it means testing whether systems can withstand disruption rather than relying solely on the existence of security controls.
For the wider public, the lesson is also straightforward. Trust in digital finance depends on more than the convenience of transferring money through a mobile phone. It depends on knowing that financial institutions can protect information, respond effectively to incidents and restore essential services when something fails.
Sri Lanka has already taken important steps through Central Bank regulations, national cybersecurity planning and investment in institutional capacity. The next challenge is to ensure that those efforts translate into measurable resilience as the digital economy grows.
The IMF is not forecasting a cyber-induced financial crisis in Sri Lanka, nor does its October statement identify a specific vulnerability in the country’s banking or payment infrastructure. Its warning is broader: as AI increases the speed and potential reach of cyber threats, interconnected financial systems must be prepared for disruptions that may spread beyond a single institution.
Sri Lanka’s next financial-stability challenge may not originate in a bank’s loan portfolio, an exchange-rate shock or a deterioration in government finances. It could begin with a failure in the digital infrastructure through which money moves every day.
The strength of the response will depend not simply on whether that failure can be prevented, but on whether the financial system can contain it, recover quickly and maintain public confidence.
That is why cybersecurity should no longer be treated only as a technical responsibility belonging to IT departments. In an increasingly digital economy, it is part of the infrastructure of financial stability itself.
Editor’s Note: This Ceylon Public Affairs analysis draws on the IMF’s public statement following its AI & Cyber Risks discussion on 16 October 2026, the IMF’s June 2026 research on artificial intelligence and cybersecurity in the financial sector, official Central Bank of Sri Lanka material, Sri Lanka CERT publications and reporting on international policy responses. The Sri Lankan risks and policy proposals discussed here are analytical assessments, not claims that the IMF identified a specific cyber vulnerability or ongoing systemic incident in Sri Lanka.
