Straight answers, including the unflattering ones.
What people ask before they integrate. Several of these answers say what we cannot do — that is deliberate, because finding out later is worse.
Is electronic KYC legal in Sri Lanka?
Yes. Remote customer onboarding is permitted, and the Personal Data Protection Act No. 9 of 2022 governs how the resulting personal data is collected, held and disposed of. Financial institutions remain subject to their own regulator's customer due diligence rules on top of that; the checks are evidence you gather, not a substitute for your own obligations.
Can you verify a Sri Lankan NIC against a government database?
No, and neither can anyone else — Sri Lanka has no national NIC registry API. What an NIC check does is validate the number's format and structure and derive date of birth and gender from it. Identity is then evidenced by independent signals: mobile OTP, bank account ownership and a live face match.
What actually proves someone is who they claim to be?
A stack of independent signals rather than any single one. The phone OTP proves they hold the SIM. The bank account link proves they control an account a bank has already done its own KYC on. The liveness check proves a real person is present, and the 1:1 match ties that face to the identity photo.
How does the liveness check tell a real person from a photo?
It flashes a sequence of colours at the face and reads how they reflect, which a photo, a screen or a mask cannot reproduce. It runs on AWS Rekognition's certified Face Liveness session, and the video streams from the browser straight to AWS — it never reaches our servers. We read only the verdict.
Which sanctions lists do you screen against?
OFAC, EU, UN, UK OFSI and Sri Lanka designated persons, with politically exposed person handling and adverse media. Screening is not only at onboarding: the customer register is re-screened when a list changes, so a name that becomes sanctioned later still surfaces.
What does PDPA No. 9 of 2022 require for KYC data?
A lawful basis for collecting each piece of personal data, the customer's knowledge of it, and disposal once the purpose is served. Our local checks are consent-first — the customer verifies themselves on their own device rather than a merchant submitting documents on their behalf. Encryption, retention and sub-processor detail is published on our security page.
Do you hold card details?
No. There is no card acceptance at all. Payments settle from a customer's bank account through HNB JustPay, authorised by the bank, so no card data enters the platform to be held or leaked.
Do you hold customer balances or issue e-money?
No. AnyBanQ holds no customer balances and issues no e-money. Loyalty points and gift vouchers settle in LKR and carry no stored value.
Can I test before going live?
Yes. A sandbox key is issued with the account at signup, before any review, and nothing is metered in sandbox. Sandbox outcomes are deterministic — the last four digits of an identifier choose the result, so you can exercise the not-found, malformed and timeout paths on every machine, every time.
How long does it take to get a live key?
A sandbox key is immediate. Live keys follow approval: a platform officer reviews every application and either approves it, returns it for changes, or declines with a reason. Onboarding needs a business registration number and certificate, at least one director with an NIC, and a settlement bank account.
Do I need to write code to take a payment?
No. A merchant can create a payment link in the dashboard and send it, or paste a single script tag carrying a signed product code on their own site. The price lives inside the signed code on our side, so there is no API key on the page and editing the page cannot change what is charged.
Can an AI assistant drive the platform?
Yes. An MCP server wraps bills, payment links, verifications and the account's own price list as tools for Claude or any other MCP client. It is not published to a package registry yet, so ask us for it.
Next step
Still have a question?
Send it to hello@clobe.lk and a person who knows the answer will reply. If it is a security questionnaire or a data processing agreement, we will complete it against the controls on the security page.