Background

Knowing who actually owns or controls a company might be a basic question, but until recently it has been surprisingly difficult to answer. Structures involving shell companies, trusts and multiple tiers of ownership became common for laundering money, moving terrorist funds, circumventing sanctions, etc. It is for this reason that the Finance Action Task Force (FATF) established a framework or frameworks to counter money laundering (AML), terrorism financing (CFT) and proliferation financing (CPF). The concept of Ultimate Beneficial Ownership (UBO) is central to the AML, CFT and CPF framework(s).

In Sri Lanka, the UBO requirements were introduced through amendments to the Companies Act No. 07 of 2007 (Companies Act), namely, the Companies (Amendment) Act, No. 12 of 2025 and the Companies (Beneficial Ownership) Regulations, No. 01 of 2026 (Gazette No. 2480/48, dated 21 March 2026) (the Amendment).

Definition and Scope

A “beneficial owner” is defined as a natural person who ultimately owns or controls 10% or more of a company, whether through direct or indirect ownership, control of shares, voting rights, other ownership interests, or by exercising “effective control,” as set out in the Companies Act and the Amendment, which came into operation on 30th March 2026.

“Effective control” includes situations where control is exercised indirectly through a chain of ownership, the ability to appoint or remove a director, or the capacity to make strategic decisions affecting the company’s operations or general direction.

The provisions apply to every company incorporated under the Companies Act, including offshore companies incorporated outside Sri Lanka and overseas companies registered under the Companies Act.

Disclosure Requirements

Information Required

Companies must notify the Registrar of Companies (ROC) of each beneficial owner’s full names and former names, dates and places of birth, nationalities, countries of residence, last known addresses (residential, business, email, postal), National Identity Card / Tax Identification Number / passport numbers (and countries of issuance), contact telephone numbers and email addresses, and a full statement describing the nature and extent of the beneficial ownership.

Who Must Disclose and When

Companies must notify the ROC at incorporation or registration using Form BO 1. Within 20 working days of any share issue or transfer, they must notify the ROC using Form BO 2 (issuances) or Form BO 3 (transfers). Beneficial ownership details must also accompany the annual return using Form BO 4. Any subsequent change to a beneficial owner’s details must be notified within 14 working days through the eROC system.

Shareholders must provide the specified details to the company within 10 working days of subscribing for or transferring shares.

Directors or Secretaries must disclose beneficial owner details to the ROC when they become aware of them.

Bearer Shares

Companies are now strictly prohibited from issuing bearer shares or share warrants to bearer. Existing holders must inform the company secretary of their name and address and convert these instruments into registered shares within 60 days of the Amendment’s operation date. Failure to comply nullifies all associated rights.

Transitional Provisions

Every company with existing beneficial owners must forward their details to the ROC within 6 months using Form BO 7.

Every depositary of a licensed stock exchange and every company must, within 30 days of the Amendment’s operation date, verify, report, record, and notify the ROC of shareholders holding 10% or more of a company’s issued shares, also using Form BO 7.

Register Maintenance and Record Keeping

Companies must maintain a register of beneficial owners at their registered office, with any change in location notified to the ROC using Form BO 6. The ROC must also maintain its own register.

Records must be kept for at least 10 years after the record was made. Administrators or liquidators of dissolved companies must retain records for at least 5 years post-dissolution.

Authorized Person

Companies must appoint a natural person residing in Sri Lanka as the authorized person responsible for safekeeping the register and making details available to authorities. This appointment must be notified using Form BO 5. Existing companies must disclose these details within 30 days of the Amendment’s operation date.

Information Sharing

With Authorities

Companies or the ROC must make beneficial owner details available upon request to the Attorney-General, Financial Intelligence Unit, Director-General of Customs, Commissioner-General of Inland Revenue, public authorities investigating criminal offences, public procurement authorities, or regulatory authorities.

With the Public

The ROC will make limited details publicly available, full names, nationalities, countries of residence, business addresses, and the nature and extent of beneficial ownership. Further information must be sought under the Right to Information Act, No. 12 of 2016.

Non-recognition of Undisclosed Ownership

A claim to beneficial ownership will not be recognized for any lawful purpose unless properly disclosed and registered under the Act.

Penalties

Companies and their directors/officers: A fine not exceeding LKR 1,000,000 (approx. USD 3,104) or imprisonment up to 10 years, or both. Directors and officers are deemed liable unless they prove the offence occurred without their knowledge or that they exercised all due diligence.

Shareholders, secretaries, or authorized persons: The same penalty, a fine up to LKR 1,000,000 or imprisonment up to 10 years, or both.

The ROC may also issue a directive requiring compliance within 7 working days where it has reasonable grounds to believe a company has failed to maintain its register or meet deadlines.