New CDD rules are coming. Disconnected tools won't keep up.

Sri Lanka has just tightened its anti-money-laundering rules. In August 2026, Parliament passed the Financial Transactions Reporting (Amendment) Act, No. 17 of 2026, and on top of it the Financial Intelligence Unit is rolling out a stricter customer due diligence regime, expected from mid-September, ahead of the country's FATF evaluation in late October. The message from the regulator is clear: compliance is no longer a one-time check at onboarding. It runs through the whole life of the customer relationship.

The FIU is rolling out the practical CDD (customer due diligence) regime, expected mid-September 2026. The core requirements:

• Compliance is continuous, not a one-time onboarding check — ongoing transaction monitoring throughout the relationship.
• Event-driven reviews triggered by material changes — a change in ownership, control, directors, or business activity — separate from the scheduled reviews.
• Risk-based frequency: high-risk customers reviewed at least annually; lower-risk every three years; event-driven reviews in between.
• Identify and verify the customer and beneficial owners, and understand the purpose of the account/relationship.
• If CDD can't be completed, you can't onboard a new customer, and you must exit an existing one — and file an STR 
• Scope: banks and finance companies, insurance, and Virtual Asset Service Providers (VASPs).

For most institutions, the hard part is not understanding the rules. It is that their systems were never built to work this way.

The problem with tools that don't talk

Compliance software is usually bought one piece at a time. Onboarding sits in one tool, screening in another, transaction monitoring in a third, and device monitoring, if it exists at all, in a fourth. Each was sold separately, each holds its own data, and each keeps its own records.

That was manageable when compliance was a set of separate checks. Under the new rules, where onboarding, screening and monitoring are meant to feed each other, it becomes a real weakness. Here is why one platform matters.

You need the full customer in one view

Take the most basic check there is. At onboarding, a customer declares their income, their expenses, and how much they expect to move each month. Months later, their transactions look nothing like that. That gap is exactly what you are meant to catch.

But if the onboarding profile lives in one system and the transactions in another, catching the gap means building an integration between them and hoping the data lines up. It sounds simple; in practice it rarely is. When the KYC profile and the transactions sit in the same platform, the comparison is just there. The same logic applies to the new event-driven reviews: a change picked up during screening should trigger a look at the customer's transactions on its own. Across disconnected systems that hand-off is manual, and manual steps get missed.

Today's threats cross the lines your tools draw

Many monitoring systems only look at money laundering — structuring, pass-through transfers, mule accounts. Those matter. But account takeover, where a scammer gets into a real customer's account, shows up in transactions too. It is a fraud problem rather than a laundering one, and because the tools are sold separately, most institutions watch for one and not the other. To the customer who lost their money, the difference means nothing.

Device monitoring is the same story. Without it, you cannot see that one device is quietly running several accounts, or that a new device has just signed into an account it has never touched. You are left leaning on OTPs, which are easy to phish and were never meant to carry this much weight. When transaction signals and device signals sit in one place, these patterns are visible. Kept apart, they slip through.

One record makes everything after the alert easier

There is a quieter reason silos hurt, and it shows up after an alert fires. Someone has to decide what was done about it. When several alerts land on the same customer across different systems, an officer has to log into each one, pull the history, and piece the story together by hand. If a regulator later asks what happened and why, that story has to be rebuilt from several audit logs that were never designed to fit together.

When every action lives in one audit trail, the full history of a customer — every alert, every decision, every note — is in one place. That makes investigations faster and patterns easier to spot, which lifts detection rather than just satisfying the auditor. It is also what an examiner wants to see, and with fines now in the hundreds of millions, that matters.

What ties it together

This is the thinking Dossiers was built on: one platform for onboarding, screening, transaction monitoring and device monitoring, all sharing the same data. From that you get a single view of each customer, a single risk rating for each one — either a score out of 100 or a level such as high, medium or low, set by your own compliance team under your own policies — and one connected picture that can reveal networks of accounts a single-account tool would never join up.

There is a cost side to this too. Buying these systems one at a time is expensive and adds complexity, and for the NBFI sector in particular that has been a fair reason to hold off on some of them. When the whole set comes in a single platform, the calculation changes: you put the full range of controls in place in one go, at one cost, through one integration. For a smaller institution the same platform can also serve as the customer record it may not otherwise have. And with a single breach now reaching Rs. 100 million, having these controls in place is far easier to justify than it was.

The regulator has moved compliance to a continuous, connected model. Institutions still running four disconnected tools will feel the strain first. Bringing them together is now the practical way to keep up.