Sri Lanka’s push towards artificial intelligence-powered financial supervision presents an opportunity to modernise banking, strengthen anti-money laundering enforcement and improve climate-risk assessment. Yet beneath this technological promise lies a more uncomfortable question: is the country prepared for the systemic dangers created when financial decisions increasingly depend on algorithms, interconnected digital infrastructure and a handful of global technology providers?
The warning delivered by International Monetary Fund (IMF) technology chief Shirin Hamid at the Central Bank of Sri Lanka’s 76th Anniversary Oration in Colombo places this dilemma at the centre of financial policy.
Hamid called for an “intelligent central bank”, arguing that technological progress must ultimately preserve public trust. Her message is particularly relevant to Sri Lanka, where the transition towards AI-based banking is uneven and institutional safeguards remain limited.
Central Bank figures show that 31% of licensed banks have introduced AI into live operations, while 38% are conducting pilot projects. Another 31% have not adopted AI at all. Only 8% have dedicated board-level committees overseeing AI.
This divide creates a difficult regulatory challenge. Institutions deploying sophisticated systems face new operational and cyber risks, while those lagging behind may lack the technological capacity to identify threats generated by increasingly automated financial networks.
When algorithms become interconnected risks
Artificial intelligence can improve fraud detection, customer verification and regulatory reporting. However, its growing sophistication also creates opportunities for criminals to exploit vulnerabilities at unprecedented speed.
Deepfake financial fraud and voice-cloning technologies can undermine identity verification, while self-learning cyber threats may adapt to conventional security measures. Human-supervised systems remain essential because automated decisions can produce serious consequences when underlying data, assumptions or models are defective.
The danger becomes more complex when similar AI models or technological services are used across multiple banks.
A flawed model, compromised software update or disruption affecting a major technology provider could potentially create simultaneous problems across several institutions. Financial organisations that appear individually secure may therefore remain collectively vulnerable.
This is why the IMF is pressing regulators to strengthen macro-financial surveillance and conduct cyber stress tests capable of examining coordinated, market-wide failures caused by algorithmic contagion.
Sri Lanka’s supervisory approach must consequently extend beyond checking whether individual banks have installed appropriate security software. It must examine how failures could spread through the wider financial system.
Dependence on global technology giants
Another vulnerability is the concentration of cloud computing services among a small cluster of hyperscale providers. Although these companies supply advanced infrastructure that individual banks may struggle to develop independently, excessive dependence can create common points of failure.
For a smaller economy such as Sri Lanka, building technological resilience without incurring unsustainable costs will require careful planning. Regulators must assess whether banks have credible alternatives, adequate backup arrangements and the ability to maintain essential services during major disruptions.
International coordination is equally important. The IMF has advocated synchronised regulatory standards involving major technology-producing economies, including the United States, China and India.
Without compatible supervisory approaches, criminals may exploit differences between jurisdictions, while financial institutions operating across borders face inconsistent requirements.
Climate intelligence brings another challenge
Governor Nandalal Weerasinghe is promoting machine learning to analyse corporate disclosures, environmental, social and governance invoices, and satellite imagery to identify climate hotspots and incorporate physical environmental risks into domestic credit pricing.
Such innovation could help banks identify borrowers exposed to floods, droughts and other climate-related threats. But unreliable information or poorly validated models could also distort lending decisions, penalise viable businesses or misprice credit risks.
The CBSL’s planned supervisory framework must therefore impose lifecycle validation, clear board-level accountability and human oversight of consequential automated decisions.
Sri Lanka should not measure success simply by counting banks adopting AI or celebrating faster processing. The real test is whether the technology improves financial integrity without creating new channels for systemic failure.
The policy priority must be controlled innovation, not technological adoption at any cost. Otherwise, the intelligent central bank could inherit risks that conventional supervision was never designed to detect.
