Digital Banking in Sri Lanka: Are We Making Banking More Secure, or More Complicated?
Why the future of banking must balance cybersecurity, regulatory compliance and customer convenience
By Dr. Dharshana Weerakoon, DBA (USA)
Global Tourism & Hospitality Strategist | Entrepreneur | Chairman – Global Cooperation Private Limited | Managing Director – International Hospitality Ventures (Private) Limited
Digital banking has transformed the way businesses and individuals manage their money. Today, customers expect to transfer funds, manage accounts, authorise payments and monitor financial activities without visiting a bank branch.
However, an important question deserves greater attention:
Are we designing digital banking systems around the practical needs of customers, or are customers increasingly being expected to adapt to the technical limitations of banking systems?
This is not an argument against stronger security. On the contrary, cybersecurity, regulatory compliance and fraud prevention are essential to the stability of the financial system.
My concern is how these requirements are translated into the everyday customer experience.
1. The growing importance of digital banking
Sri Lanka’s banking industry is undergoing a significant digital transformation.
According to the Central Bank of Sri Lanka’s fourth-quarter 2024 Payments Bulletin:
- CEFTS processed approximately 57 million transactions, valued at LKR 4.61 trillion.
- SLIPS processed approximately 17.66 million transactions, valued at LKR 1.01 trillion.
- Debit card transactions exceeded 71 million, valued at approximately LKR 249.9 billion.
- Intrabank online transactions exceeded 41.7 million, valued at approximately LKR 2.77 trillion.
These figures demonstrate the scale of the country’s dependence on electronic financial services.
Consequently, digital banking in Sri Lanka is no longer simply an additional customer facility. It is essential business infrastructure.
2. Security versus customer convenience
Financial institutions have legitimate reasons to strengthen authentication.
Multi-factor authentication, soft tokens, one-time passwords (OTPs), biometric verification and transaction monitoring can significantly strengthen account protection.
Furthermore, regulatory expectations concerning technology risk management, cybersecurity and operational resilience require banks to continuously improve their systems.
However, security implementation must consider the customer.
For example, a business owner or finance professional may be an authorised signatory across several companies, maintaining personal and corporate banking relationships.
Should that individual need multiple devices, separate authentication arrangements or several sets of security questions to manage legitimate banking responsibilities?
Could technology provide a more integrated solution without weakening security?
These are practical questions worth considering.
3. Seven practical case studies: What banking technology should learn
The following are illustrative business scenarios, rather than allegations about any particular financial institution.
Case Study 1 – The Multi-Company Director
A director manages banking facilities for five companies. Each relationship has different authorised users and transaction limits.
A well-designed system should allow access through one secure device, while maintaining separate company profiles, permissions and audit trails.
Lesson: One device does not have to mean one level of access.
Case Study 2 – The OTP Failure
A business owner successfully enters the username and password, but the system repeatedly rejects the authentication code.
If the underlying problem is a technical synchronisation or system issue, removing an important security feature should not become the default solution.
Lesson: Diagnose the technical problem before compromising security arrangements.
Case Study 3 – The Finance Manager
A finance manager handles payroll, supplier payments and statutory obligations. A temporary digital banking interruption can delay business operations.
Lesson: Banks should provide clear escalation channels and practical alternative transaction arrangements.
Case Study 4 – The SME Entrepreneur
A small business owner depends on online banking to receive customer payments and settle suppliers. Even a short interruption can affect cash flow and business confidence.
Lesson: Operational resilience is also an SME development issue.
Case Study 5 – The International Business Executive
An entrepreneur operates across several countries and time zones. Banking authentication must work reliably while travelling, subject to appropriate security controls.
Lesson: Modern banking should recognise the international mobility of legitimate business customers.
Case Study 6 – The Elderly Customer
An older customer may find complicated authentication procedures difficult to understand and operate.
Lesson: Strong cybersecurity must be supported by accessible instructions, assistance and inclusive design.
Case Study 7 – The Bank’s IT Department
Technology teams must introduce security improvements while maintaining system compatibility, availability and customer access.
Lesson: Successful digital transformation requires coordination between IT, cybersecurity, compliance, operations and customer service.
4. Regulatory compliance: An obligation and an opportunity
The Central Bank of Sri Lanka has an important responsibility to maintain financial stability and strengthen the resilience of the banking industry.
Its regulatory framework includes Banking Act Direction No. 16 of 2021 on technology risk management and resilience, subsequent amendments and the 2025 circular on reporting IT and cybersecurity incidents.
These developments reflect the increasing importance of digital operational resilience.
Nevertheless, regulatory compliance should not be viewed merely as a checklist of technical requirements.
It should be an opportunity to improve customer confidence, system reliability and service quality.
Banks must translate regulatory expectations into practical, secure and user-friendly services.
Importantly, regulatory compliance and customer convenience should reinforce each other.
5. The international perspective
The World Bank’s Global Findex 2021 reported that 76% of adults worldwide had an account with a financial institution or mobile money provider.
Meanwhile, IBM’s 2025 Cost of a Data Breach Report estimated the global average cost of a data breach at USD 4.44 million.
These figures illustrate two realities: financial services are becoming increasingly digital, while the consequences of security failures remain substantial.
Therefore, the future of digital banking requires a combination of prevention, intelligent authentication, continuous monitoring and reliable recovery arrangements.
6. Seven recommendations for the future of digital banking in Sri Lanka
I believe the following measures deserve consideration by financial institutions:
- Single-device, multiple-profile management: Enable authorised customers to manage several personal and corporate banking relationships securely through one device, where technically and regulatorily appropriate.
- Intelligent authentication: Introduce risk-based authentication that considers device identity, transaction behaviour, location and transaction risk, with stronger verification when necessary.
- OTP reliability: Regularly test authentication infrastructure, synchronisation, delivery mechanisms and system capacity.
- Dedicated technical escalation: Establish direct escalation channels for customers facing authentication failures and critical access problems.
- Business continuity: Provide secure alternative arrangements when digital banking services become temporarily unavailable.
- Customer-centred implementation: Consult business owners, finance professionals, directors and corporate customers before introducing major changes.
- Transparent communication: Inform customers about planned maintenance, service interruptions, expected restoration times and alternative facilities.
7. My central argument: Technology must serve people
Having worked in business management, finance and hospitality across several countries, I have learned that successful systems are not measured solely by their technical sophistication.
They are measured by how effectively they serve people.
The same principle applies to banking.
A sophisticated authentication system has limited practical value if legitimate customers cannot reliably access their banking facilities.
Similarly, a convenient system cannot be considered successful if it exposes customers to unacceptable security risks.
The real objective must be to achieve both.
Sri Lanka has an opportunity to build a digital banking environment that is secure, reliable, inclusive and internationally competitive.
This requires collaboration between regulators, banking leadership, technology professionals, cybersecurity specialists and the business community.
I would encourage financial institutions to look beyond the introduction of new security technologies and focus equally on the quality of the customer experience.
My question to banking leaders, IT professionals and business owners is simple:
Can we build a banking system where stronger security means greater customer confidence, rather than greater customer inconvenience?
I believe we can, provided that technology is designed around both security and the realities of business.
About the author
Dr. Dharshana Weerakoon, DBA (USA) is a Global Tourism & Hospitality Strategist, entrepreneur and business leader with over three decades of international professional experience across multiple countries.
He is Chairman of Global Cooperation Private Limited and Managing Director of International Hospitality Ventures Private Limited.
His professional interests include business strategy, financial management, digital transformation, international tourism, hospitality development and sustainable business partnerships.
Disclaimer
This article has been independently authored and published in good faith by Dr. Dharshana Weerakoon, DBA (USA), based on publicly available information from national and international institutions, including the Central Bank of Sri Lanka, the World Bank and IBM, together with professional experience and general industry observations.
The illustrative case studies are hypothetical business scenarios intended for educational and discussion purposes. They do not describe or allege misconduct by any identified bank or financial institution.
The views expressed are entirely personal and analytical. This article does not constitute legal, financial, investment or cybersecurity advice, nor does it make allegations against any regulator, bank or third party.
The article is intended to encourage constructive dialogue on digital banking, cybersecurity, regulatory compliance and customer experience, consistent with applicable Sri Lankan laws, regulatory requirements, data protection principles and ethical standards.
Copyright
© Dr. Dharshana Weerakoon, DBA (USA). All rights reserved.
Further Reading: https://www.linkedin.com/newsletters/outside-of-education-7046073343568977920/
Further Reading: https://dharshanaweerakoon.com/customer-service-in-sri-lanka/
