Know Your Payee & KYC for Sri Lanka
Know who you're paying, here or abroad.
Verifia confirms a bank account before money moves: at home with the customer's own bank, abroad with the destination bank. Then the KYC around it: NIC, phone, face and sanctions, and one desk to investigate whatever doesn't add up.
Sandbox keys the moment you register · connected to Sri Lanka's bank network
Exclusive iPiD partnerfor Sri Lanka & the Maldives
6,500+
banks reachable abroad
4B+
accounts verifiable
300+
official sanctions & PEP sources
PDPA
No. 9 of 2022 aligned
What Verifia does
Four questions, answered before you commit.
Every business that handles somebody else's money asks the same four things. Verifia answers them in one place, so the answer to one informs the next.
Know where the money is going
“Is this account real, and is it theirs?”
Here, the customer's own bank confirms the account exists and is held under their NIC, with their consent. Abroad, the destination bank confirms it is live and the name on it matches.
Know who someone is
“Is this person real, and are they who they say they are?”
Their NIC validated, their phone proven by a code, and a live face matched against the ID document they uploaded. Independent signals, not one.
Know what you are dealing with
“Is there anything on record about them?”
Screened against sanctions, politically exposed persons, Sri Lanka's own designations and what the press has published, then re-screened as those lists change.
Know what to do about it
“Something looks wrong. Now what?”
Every alert about one person lands as one investigation, with an owner and a deadline. Upload their bank statement and it is read for you, with the transactions behind every finding.
Know Your Payee
Two accounts. Two different questions.
An account in Colombo and a supplier's account in Frankfurt are not the same problem, and they are not answered by the same rail. Both run through the same workflow builder, the same review queue and the same API.
Sri Lanka
Confirm the account before you debit it
Whether you are about to pay a customer or take money from them, find out first that the account is real and is theirs.
- The account existsChecked with the customer's own bank, not inferred from a format or a checksum.
- Held under their NICThe bank confirms the account belongs to the national ID the customer gave you: ownership proven by the bank, not asserted by us.
- With their consentThe customer approves the check with a code their own bank sends them. You get the answer; you never see the code.
- Then pay or be paidBills, pay links and subscriptions settle straight from the verified account. No cards, no gateway to stitch together.
- banks & finance companies
- 24
- banks & finance companies
- payments a quarter
- 7.4M
- payments a quarter
Institutions on the connected network
- Commercial banks12
- Specialised banks4
- Finance companies8
Savings and current accounts at institutions on the connected network. Participant count and payment volume as published by the Central Bank of Sri Lanka (Payments Bulletin, Q1 2026).
Cross-border
Verify any account abroad: name, status and risk
Exclusive iPiD partner · Sri Lanka & Maldives
Before moving funds internationally, confirm the beneficiary account is active, the owner's name matches, and the recipient is clear of sanctions, PEP and fraud risk, answered by the destination bank through iPiD's global payee-verification network.
- Account & name matchA match score and the reason behind it (not a bare yes or no), so a close-match typo or a misdirected transfer is caught first.
- Live account statusKnow the account is open before you pay, not after a closed or dormant one sends the transfer back with fees.
- Sanctions & PEPThe account holder screened against global watchlists, keeping you inside international AML rules.
- Fraud risk scoredA likely mule or scam account is stopped before funds leave, not chased after they are gone.
- financial institutions
- 6,500+
- financial institutions
- accounts reachable
- 4B+
- accounts reachable
Banked population covered
- Europe99%
- Americas91%
- Asia & Oceania90%
- Africa65%
Network and banked-population coverage as published by iPiD (ipid.tech), ISO/IEC 27001 certified and a Pay.UK-certified CoP aggregator.
See it run · Sri Lanka
You get the answer. Never the code.
The customer approves with a code their own bank sends them. No credentials or codes ever reach you.
- Account exists
- Held under the NIC
- Consent recorded
See it run · Cross-border
Know before it leaves
Account status, owner name, PEP status and fraud risk, verified in seconds before a transfer starts.
- Match score
- Account status
- PEP & sanctions
- Fraud risk score
The checks themselves
One request. Every check.
Each check answers the same way (passed, failed, or needs a person to look), so you can run one on its own or chain them into a journey. You are charged per check, not per seat.
Bank account
Exists, and held under the customer's NIC, confirmed by their own bank.
National ID
The number validated, and the date of birth and gender it encodes checked against what the customer told you.
Phone ownership
A one-time code proves the number is theirs, as one step of the check.
Face & liveness
Certified liveness and a 1:1 match against the ID document.
Sanctions, PEP & adverse media
300+ official sources, Sri Lanka's own list, and the public record.
Ongoing monitoring
Re-screened as the lists change; a new hit reopens the case.
Verified payout
Pay out only to accounts that passed, on local rails.
- 01
Send us a customer
From your dashboard, a link you text or email them, a widget in your own app, or your system calling ours. No integration needed to start.
- 02
We check, and tell you plainly
Pass, fail, or send it to a person, with the reason, the evidence and what was not checked. Chain the checks into a journey yourself; no code, no deploy.
- 03
Then act on it
Pay the account you just verified, keep watching the customer as the lists change, and investigate anything that does not look right.
Workflow builder
Build your own journey. No code.
Chain any of these checks in any order, branch on what each returns, and decide what happens next: approve, send to a human, or ask the customer for more. Change it in the dashboard and the next run uses it.
- Chain
- Run the cheap checks first and stop early when one fails.
- Branch
- Route on any field a check returns. A high-risk hit takes a different path from a clean pass.
- Decide
- End on approved, declined or a review queue. Every run records each step, so a decision can be explained later.
See it run
Describe the checks, get the workflow
Say it in plain language (verify the bank account and NIC, run AML, text them when approved) and Verifia drafts it.
Compliance
Screen against the lists. Then against everything else.
A sanctions list tells you who a government has designated. It cannot tell you what the public record says, and someone prosecuted here but never designated abroad appears on no list in the world.
Sanctions & PEP
Global sanctions and PEP data from 300+ official sources, checked live on every screen, plus OFAC, the UN, the EU and UK OFSI pulled from source every night.
Sri Lanka's own list
The UNSCR 1373 designations, synced from the Financial Intelligence Unit's published lists so nobody transcribes a gazette by hand.
Your private watchlist
Names your compliance team decides on, screened alongside the rest and shared with nobody. Every entry carries the reason it was listed.
Adverse media
AIReads the public record for the name and its aliases, attributes each finding to whoever made it, and links the source.
Every clean result says what it checked and what it did not. Every adverse-media finding carries the source you can open and the person who alleged it. Nothing is decided quietly: a hit goes to a human, never to a silent pass.
Payments
Then get paid from the account you verified.
Issue a bill, send a pay link, and let the payer settle straight from their bank account, verified once, then one tap every time after. No cards, no gateways to stitch together, no account numbers stored.
- Link a bank account once, confirmed by the bank's own code.
- Debit a saved account with a durable bank token, and pay in a tap.
- Schedule an auto-pay, or settle a whole inbox of bills at once.
- Every call reconciled and logged. Timeouts never double-charge.
Buy now, pay later
Split a purchase into monthly instalments at checkout. A licensed lender decides the credit and pays you in full; the customer repays them by standing debit from the account they already verified. The money never passes through us.
Features
Everything after the check.
Checking someone is the beginning, not the job. The same login runs the review desk, the investigations, the fraud blocklist and the billing, on one customer record, so nobody re-types anything into a second system.
Operate
Run the desk without a spreadsheet.
Review queue
Every referred check lands with the documents the customer actually uploaded.
Customer register
One record per customer (owners, verifications and risk), with PEPs escalated to enhanced due diligence.
Analytics
Volume and approval rate, broken down by module and by outcome.
Team & custom roles
Give each role exactly the permissions it needs, nothing more.
Protect
Catch it before it costs you.
Fraud console
Block known-bad identities, devices and accounts across every flow you run.
Transaction monitoring
Build a rule without a developer and backtest it, or start from mule patterns and a Sri Lanka pack for hundi and round-tripping.
Ongoing monitoring
Customers re-screened as the lists change; a new hit reopens the case.
Document signing
Envelopes from the dashboard or your system; each signer gets a hosted link and a sealed audit trail.
Investigate
One queue, and the evidence to decide.
Case desk
Referrals, screening hits and transaction alerts grouped by the person they are about, with an owner and a clock.
Statement analysis
A bank statement read line by line and checked for structuring, pass-through funds and cash-heavy income.
Linked subjects
Shared devices, phones and accounts draw the connections between customers.
Core banking feed
Each account judged against its own history and the income its holder declared.
Grow
Keep customers coming back.
Subscriptions
Publish one plan link; every subscriber is billed on schedule from their own bank account.
Loyalty points
Set your earn rate and reward customers on every payment.
Gift vouchers
Sell vouchers for your shop through AnybanQPay; they settle to you like a bill.
Events & ticketing
Publish an event with free or paid tiers and check guests in at the door.
Integrate
Five ways in. Pick what fits today.
Start in the dashboard with no engineering at all, then move to the API when you're ready. Nothing has to be rebuilt in between.
- DashboardRun checks by hand and work the review queue. No integration needed to start.
- Hosted linkText or email a Verifia link. The customer verifies on their phone; you get the result.
- Embedded widgetDrop the same flow into your own product with the Web SDK.
- Workflow builderChain checks and branch on the result: approve, review or ask for more.
- REST API & webhooksServer-to-server with API keys, and HMAC-signed webhooks retried until they land.
Developer documentation for customers
The API reference, SDKs, sandbox rules and webhook guide are in the console. Create an account and you get a sandbox key the same day.
Create an accountTrust
Handled the way regulators expect.
We hold citizens' identity data. That's a responsibility, not a feature, so the controls come first, not after launch.
Consent first
No lookup runs without the individual's recorded consent, captured in-session or by a one-time link, and withdrawable.
Encrypted at rest
NIC numbers and payer details are encrypted with AES-256-GCM under rotating keys; bank account numbers are never stored.
Encrypted to the far bank
Cross-border checks are OpenPGP-encrypted to the destination institution's own key inside TLS.
No card data, ever
Payment is authorised by the customer to their own bank, so PCI scope never arises.
A record of every signature
Method, time and the document's SHA-256 hash, behind a verification token.
Bank-grade access
Two-factor sign-in, least-privilege roles, rate limiting and a hash-chained audit log.
PDPA aligned
Built around the Personal Data Protection Act No. 9 of 2022: consent, export, erasure and retention.
Reviewed by banks
We complete your security questionnaire and data processing agreement.
Control-by-control detail for security reviewers: encryption, sub-processors and retention.
Verify the first account today.
We onboard banks, lenders, fintechs and merchants. Register for sandbox keys straight away, or tell us what you need to verify and we will set you up.