If your company was on the register before 30 March 2026, you have roughly seven weeks left to tell the Registrar of Companies who really owns it. Miss that, and the exposure is not a late fee. It is a fine of up to LKR 1 million, up to ten years' imprisonment, or both, and it lands on directors personally.
That is the short version. Here is what the rules actually say, what you have to file, and what usually goes wrong.
What changed
Sri Lanka has spent the last few years tightening its anti-money-laundering framework to line up with FATF standards, and beneficial ownership was the obvious gap. Anyone could sit behind a nominee shareholder, a holding company in another jurisdiction, or a couple of layers of both, and the public register would show nothing useful.
Two instruments closed that gap:
The Companies (Amendment) Act No. 12 of 2025, which amended the Companies Act No. 07 of 2007
The Companies (Beneficial Ownership) Regulations No. 1 of 2026, published in Gazette No. 2480/48 dated 21 March 2026
Both came into operation on 30 March 2026. So these are not proposals sitting in a committee somewhere. They are live law, and the transitional clock has been running for four and a half months.
Who counts as a beneficial owner
A beneficial owner is a natural person who ultimately owns or controls 10% or more of a company. That threshold can be met through:
Direct shareholding
Indirect shareholding through a chain of companies or trusts
Control of voting rights
Any other ownership interest
"Effective control" over the company
The last one is where most people trip up. Effective control is not a percentage test. It captures anyone who can appoint or remove a director, or who has the capacity to make strategic decisions affecting the company's operations or general direction, even if their name appears nowhere on the share register.
Two things follow from that definition. First, a corporate shareholder is never a beneficial owner. You keep tracing up the chain until you reach a human being. Second, a person holding 3% of shares but who controls board appointments under a shareholders' agreement is a beneficial owner, and a person holding 15% with no other influence is also one. Both go in the register.
The rules apply to every company incorporated or registered under the Companies Act, including offshore companies incorporated outside Sri Lanka and overseas companies registered here. There is no small-company carve-out. A two-director private limited with LKR 100,000 in stated capital is in scope exactly as much as a listed group.
The forms, and when each one is due
The Department of the Registrar of Companies runs beneficial ownership filings through a dedicated portal at bo.drc.gov.lk, separate from eROC. You log in with your existing eROC credentials and select "Company User".
Form | What it covers | When it is due |
|---|---|---|
BO 1 | Declaration of beneficial ownership | At incorporation or registration |
BO 2 | Change in beneficial ownership following a share issue | Within 20 working days of the issue |
BO 3 | Change in beneficial ownership following a share transfer | Within 20 working days of the transfer |
BO 4 | Beneficial ownership details filed with the annual return | With the annual return |
BO 5 | Details of the Authorised Person | Within 30 days of 30 March 2026 for existing companies; at incorporation for new ones |
BO 6 | Change to the location of the beneficial ownership register | On any change of location |
BO 7 | Transitional filing by existing companies, and verification of 10%+ shareholders | Within 6 months of 30 March 2026 |
Any subsequent change to a beneficial owner's details must be notified through the system within 14 working days.
Shareholders carry their own obligation: they must give the company the specified details within 10 working days of subscribing for or transferring shares. Directors and secretaries must disclose beneficial owner details to the ROC as soon as they become aware of them.
The 30 September 2026 deadline
For companies incorporated before 30 March 2026, the transitional provisions require full beneficial ownership details to reach the ROC on Form BO 7 within six months, which puts the deadline at 30 September 2026.
Two other transitional dates have already passed, and if you missed them you should be fixing that now rather than waiting:
Within 30 days of the operative date, every company and every depositary of a licensed stock exchange had to verify, record and notify the ROC of shareholders holding 10% or more.
Within 30 days, existing companies had to disclose their Authorised Person on Form BO 5.
Bearer shares are gone
Companies can no longer issue bearer shares or share warrants to bearer. Anyone holding existing instruments had to give the company secretary their name and address and convert them into registered shares within 60 days of 30 March 2026. Failure to convert nullifies every right attached to those shares. Not suspended. Nullified.
You need a resident Authorised Person
Every company must appoint a natural person resident in Sri Lanka as the Authorised Person. This individual keeps the beneficial ownership register safe and makes the details available to authorities on request. The appointment is notified on Form BO 5.
For foreign-owned subsidiaries this is the requirement that causes the most scrambling. If your board sits in Singapore or Dubai and your only local presence is an outsourced secretary, you need to sort out who the Authorised Person is and confirm they are willing to take on a role that carries personal criminal liability.
Keeping the register
The register of beneficial owners lives at the registered office. The ROC maintains its own parallel register. Records must be kept for at least 10 years after the record was made, and administrators or liquidators of dissolved companies must retain them for at least 5 years after dissolution.
The information you have to capture per beneficial owner is genuinely detailed:
Full name and any former names
Date and place of birth
Nationality and countries of residence
Last known residential, business, email and postal addresses
NIC, TIN or passport number, with country of issuance
Telephone number and email address
A full statement describing the nature and extent of the beneficial ownership
That last line matters more than it looks. "50% shareholder" is not a statement of nature and extent. You need to describe the mechanism, including where control runs through an agreement rather than a shareholding.
Who gets to see it
The regime is two-tier.
Public, on request to the Registrar: full name, nationality or citizenship, countries of residence, business address, and the nature and extent of beneficial ownership.
Authorities only: everything else, including identification numbers, tax numbers, date of birth and residential address. The Attorney-General, the Financial Intelligence Unit, the Director-General of Customs, the Commissioner-General of Inland Revenue, public authorities investigating criminal offences, public procurement authorities and regulatory authorities can all request the full file.
Members of the public who want more than the basic tier can apply under the Right to Information Act No. 12 of 2016.
Penalties, and why directors should care personally
Failure | Consequence |
|---|---|
Failing to maintain the register, or missing filing deadlines | Fine up to LKR 1,000,000 and/or up to 10 years' imprisonment |
Shareholder, secretary or Authorised Person failing to comply | Fine up to LKR 1,000,000 and/or up to 10 years' imprisonment |
Missing the transitional BO 7 filing | Fine up to LKR 50,000 and/or 6 months' imprisonment |
Failing to produce documents to the ROC | Company LKR 500,000; officer LKR 200,000 |
Liquidator failing to retain records | Fine up to LKR 500,000 |
Failing to convert bearer shares | All associated rights nullified |
Directors and officers in post at the time of the offence are deemed liable unless they can prove the offence happened without their knowledge or that they exercised all due diligence. The burden sits with them, not the prosecution.
Where the ROC has reasonable grounds to believe a company has failed to maintain its register or meet a deadline, it can issue a directive requiring compliance within 7 working days.
And there is a quieter provision that will bite in transactions: a claim to beneficial ownership will not be recognised for any lawful purpose unless it has been properly disclosed and registered. If you are relying on an undocumented beneficial interest, it is now unenforceable. Expect this to surface in M&A due diligence, bank onboarding and disputes between founders long before it surfaces in a prosecution.
What to do in the next seven weeks
Map the ownership chain to natural persons. Every corporate shareholder gets traced upward until a human appears. Trusts, nominee arrangements and foreign holdcos all need unwinding on paper.
Test for effective control separately. Read the shareholders' agreement, articles, and any side letters. Look for board appointment rights, veto rights, and anyone who signs off strategy without holding shares.
Collect the documents. NIC or passport copies, TINs, proof of address. Chasing a beneficial owner in another time zone for a certified passport copy takes longer than you think.
Confirm your Authorised Person. Resident in Sri Lanka, natural person, aware of what they are signing up for.
Reconcile against your share register and last annual return. Filings that contradict each other draw ROC queries.
File BO 7 on bo.drc.gov.lk. Then diarise the ongoing triggers: 20 working days for share issues and transfers, 14 working days for changes to owner details, and BO 4 with every annual return.
Fix the internal register. It must exist physically at the registered office, not only in the portal.
Where this fits with your other filings
Beneficial ownership is not a one-off exercise. It is now a permanent layer on top of the ROC calendar you already run: Form 15 or 15A annual returns, Form 20 for director changes, Form 13 for the registered office, Form 6 for share issues. The awkward part is that BO filings are triggered by the same corporate events as those forms but run on different clocks and through a different portal. Issue shares and you now have a Form 6 and a BO 2, with a 20 working day window on the BO side.
Companies that treat BO as an annual chore will miss the event-driven filings. The ones that stay clean are the ones that attach a BO check to every share movement, director change and shareholder agreement amendment as it happens.
FAQ
Are these rules still just proposed? No. The Companies (Amendment) Act No. 12 of 2025 and the Companies (Beneficial Ownership) Regulations No. 1 of 2026 both came into operation on 30 March 2026.
My company has one shareholder who owns 100%. Do I still have to file? Yes. There is no exemption for small or single-shareholder companies. Your filing is simply short.
What if no one reaches 10%? You still have to assess effective control and disclose anyone who exercises it. If you conclude there is genuinely no beneficial owner under either limb, document how you reached that conclusion. The ROC can ask.
Does a foreign parent company go on the register? Not as the beneficial owner. You trace through the parent to the natural persons who ultimately own or control it, and disclose them.
How much of my personal information becomes public? Name, nationality, countries of residence, business address, and the nature and extent of your ownership. Date of birth, residential address, NIC, TIN and passport numbers are restricted to authorities.
What happens if I miss 30 September 2026? The transitional offence carries a fine up to LKR 50,000 and/or six months' imprisonment, and ongoing failure to maintain the register exposes the company and its directors to the LKR 1 million and 10-year penalties. The ROC can also issue a 7 working day compliance directive.
Need this handled?
Corp360 manages ROC compliance for Sri Lankan companies, including beneficial ownership filings, annual returns, and the director, secretary and share register changes that trigger them. If you are not certain your ownership chain has been mapped correctly, or you are looking at the 30 September deadline with an offshore parent and no Authorised Person appointed, we can take it from here.
Talk to us or email [email protected].
This article is general information current as at 11 August 2026 and is not legal advice. Requirements and deadlines should be confirmed against the Gazette and the Department of the Registrar of Companies before acting.