Get In Touch

How Sri Lankan Businesses Can Accept Payments Online: LankaQR, Cards and Payment Gateways

accept payments online in Sri Lanka

Last updated 16 October 2026

To accept payments online in Sri Lanka, most businesses combine three methods: a card payment gateway for debit and credit cards, JustPay for direct payments from a customer’s bank account, and LankaQR for scan-and-pay. Businesses with overseas customers add international card acceptance and plan for foreign currency rules. The right mix depends on who your customers are, what you sell, and where they pay from.

This guide explains each option using official data from the Central Bank of Sri Lanka (CBSL) and LankaPay. It also covers the security standards and rules you need to know, and the questions to ask before you choose a payment provider.

Online payments in Sri Lanka: the numbers

Sri Lankans are paying online in growing numbers. The Central Bank’s Payments Bulletin for the first quarter of 2026, published in August 2026, reports:

Measure Figure
E-commerce payments made with cards, full year 2025 152 million transactions, worth Rs. 461 billion
E-commerce card payments, Q1 2026 44 million transactions, worth Rs. 132 billion (up 29.4% in volume on Q1 2025)
Debit cards in use, end of Q1 2026 20.9 million
Credit cards in use, end of Q1 2026 2.2 million
JustPay payments, Q1 2026 7.4 million transactions, worth Rs. 39 billion
Businesses registered for LankaQR, end of Q1 2026 473,214 (up 9.9% in a year)

Two things stand out. First, debit cards account for most online card payments: 36 million of the 44 million in Q1 2026. Your checkout must work smoothly for everyday debit cardholders, not just credit card users. Second, digital payments are now a national priority. In October 2026, Digital Economy Deputy Minister Eranga Weeraratne named cashless payments one of five focus areas, and set a goal of making LankaQR the first choice for consumers and merchants (Daily FT).

The main ways to accept payments online in Sri Lanka

Method How the customer pays Best for
Card payment gateway Enters a debit or credit card on a secure payment page Online stores, bookings, subscriptions, overseas customers
JustPay Pays straight from a linked bank account, confirmed by a one-time password Local customers who prefer not to use cards
LankaQR Scans your QR code with a banking or payment app In-person payments: shops, restaurants, hotels, delivery collections
Bank transfer Transfers money and sends you a receipt Large B2B orders and invoices
Cash on delivery Pays the courier when the order arrives Customers who aren’t yet comfortable paying online

1. Card payments through a payment gateway

A payment gateway connects your website to the card networks so customers can pay by debit or credit card. In Sri Lanka, card acceptance is handled by financial acquirers licensed by the Central Bank under the Payment Cards and Mobile Payment Systems Regulations No. 1 of 2013. CBSL reports 13 licensed financial acquirers as at the end of Q1 2026. Whichever gateway you choose, ask which licensed acquirer processes and settles your payments.

There are two common ways to add card payments to a website:

  • Hosted payment page: the customer is sent to the provider’s secure page to enter card details, then returned to your site. Card data never touches your server, which keeps your security burden low. This suits most small and medium businesses.
  • Integrated checkout: the payment form appears inside your website for a smoother experience. It needs more development work and a closer look at security responsibilities.

Expect your provider to review your business and your website before approving you. Have these ready: your business registration, a business bank account, and a live website with clear product or service details, prices, contact information, terms and conditions, a refund and cancellation policy, and a privacy notice.

2. JustPay: payments straight from a bank account

JustPay is LankaPay’s account-to-account payment service. A customer links their bank account to a JustPay-enabled website or app, confirms with a one-time password from their bank, and can then pay directly from that account. LankaPay sets a limit of Rs. 150,000 per transaction for JustPay payments.

JustPay suits customers who don’t have a card or don’t want to use one online. It’s offered through participating banks and payment providers, so ask your gateway whether it supports JustPay alongside cards.

3. LankaQR: scan-and-pay

LankaQR is Sri Lanka’s national QR payment standard. Customers scan your code with a supported banking or payment app, and LankaPay says the money is credited to your account immediately. You apply for a LankaQR code through your bank or finance company, not LankaPay directly. LankaPay states that a maximum charge of 1% applies, set by your bank or finance company.

LankaQR is designed mainly for in-person payments: at a counter, a hotel reception, a restaurant table, or when a courier collects payment. It complements your website checkout rather than replacing it.

It also matters for tourism. India’s UPI payments went live in Sri Lanka through LankaQR on 12 February 2024 (Ada Derana), and the Central Bank’s bulletin lists UPI, Alipay+ and WeChat Pay as linked to LankaQR. LankaQR payments made through these internationally linked apps rose by 421.5% in Q1 2026 compared with a year earlier. India was Sri Lanka’s largest source of tourists in 2025, with 531,511 arrivals according to the Sri Lanka Tourism Development Authority.

For context, though, CBSL counted about 258,000 LankaQR transactions in Q1 2026, fewer than in the same quarter of 2025, despite more than 473,000 registered merchants. Customer habits are still catching up, which is why the government is now pushing adoption. For most businesses, LankaQR works best as one option alongside cards and bank payments.

4. Bank transfers and cash on delivery

Bank transfers remain common for larger and business-to-business payments. Make them easier by showing your bank details clearly on invoices and in order confirmations, and by matching payments to orders promptly.

Cash on delivery still helps first-time customers who aren’t ready to pay online. It carries costs you should plan for, including refused deliveries and cash handling, so many businesses offer it alongside online payment rather than as the only option.

Accepting payments from overseas customers

If you sell to customers abroad, such as tourists, export buyers or international clients, check that your gateway accepts international cards and can show prices in the currencies your customers expect.

Also plan for Sri Lanka’s foreign exchange rules, which sit under the Foreign Exchange Act No. 12 of 2017. A June 2026 analysis by Deloitte Sri Lanka in the Daily FT summarises the position:

  • Export proceeds for both goods and services must be brought into Sri Lanka within 180 days.
  • Service exporters have no mandatory requirement to convert proceeds into rupees, following Gazette No. 2292/50 of 12 August 2022.
  • Goods exporters must convert remaining proceeds by the 10th day of the following month, under Gazette No. 2492/10 of 9 June 2026.

These rules change from time to time, and how they apply to online sales depends on what you sell. Confirm the current position with your bank before you start accepting foreign payments.

Payment security: what every business must get right

  • Never store card details yourself. Let your payment provider handle card data. The PCI Security Standards Council says PCI DSS applies to any business that stores, processes or transmits cardholder data, whatever its size. Using a hosted payment page usually makes your obligations much simpler; your acquirer will tell you what you need to validate.
  • Use 3-D Secure. EMV 3-D Secure checks that the person paying online is the genuine cardholder. Many payments pass without extra steps, and higher-risk ones ask for a one-time passcode or similar check. Ask your provider to confirm it’s switched on.
  • Secure the whole website, not just the checkout. Use HTTPS everywhere, keep your CMS and plugins updated, use strong admin passwords with two-factor authentication, and remove plugins you don’t use. A hacked website can redirect customers to fake payment pages.
  • Protect customer data. Names, addresses, phone numbers and order histories are personal data. From 1 January 2027, the core duties of Sri Lanka’s Personal Data Protection Act apply to how you collect, store and share them (see our PDPA website checklist).

How to choose a payment provider: 10 questions to ask

  1. Which payment methods do you support: local debit and credit cards, international cards, JustPay, LankaQR?
  2. Which CBSL-licensed financial acquirer processes and settles my payments?
  3. How quickly is money settled into my account, and in which currencies?
  4. Do you offer a hosted payment page, and is 3-D Secure enabled?
  5. Does it integrate with my website platform, such as WooCommerce, or my booking engine?
  6. Can customers pay on mobile without leaving the checkout flow or hitting errors?
  7. What is your full fee schedule, in writing, including setup, transaction, refund and chargeback fees?
  8. How are refunds, disputes and chargebacks handled, and how long do they take?
  9. What reports and reconciliation tools do I get?
  10. What documents do you need from me, and how long does approval take?

Checkout tips that increase completed payments

  • Show accepted payment methods early, on product pages and in the cart, not only at the final step.
  • Show the full price, including taxes, service charges and delivery, before the customer reaches the payment page.
  • Offer guest checkout. Forcing people to create an account loses sales.
  • Test the full checkout on a phone with mobile data, using real debit cards from different banks.
  • Send an instant confirmation by email, SMS or WhatsApp with the order details and a contact number.
  • Make your refund and cancellation policy easy to find. It builds trust and is usually required by payment providers.

What this looks like in different industries

  • Hotels and villas: take deposits by card through your booking engine, accept international cards from overseas guests, and offer LankaQR at reception for visitors paying with linked apps such as UPI. Read more in our guide to getting more direct bookings.
  • Schools and education providers: let parents pay fees online by card or JustPay, with automatic receipts.
  • Insurance and finance: collect premiums and instalments online through secure, hosted payment pages.
  • Field services: let customers pay on completion with LankaQR, or online from a link in the invoice.

Accepting payments online in Sri Lanka: frequently asked questions

What do I need to accept card payments on my website?

Usually a registered business, a business bank account, and a live website with clear products or services, prices, contact details, terms, a refund policy and a privacy notice. Your payment provider will confirm its exact requirements during approval.

Can I use LankaQR on my website?

LankaPay describes LankaQR as a scan-and-pay tool where customers scan a business’s QR code. It’s mainly used for in-person payments. For website checkouts, card payments and JustPay are the usual options. Ask your bank or payment provider what they support.

How much does LankaQR cost a business?

LankaPay states that a maximum charge of 1% applies, set by the business’s bank or finance company. Customers don’t pay a fee. Check your bank’s current rate before you sign up.

Can tourists pay my business with LankaQR?

Yes, at LankaQR merchants. India’s UPI launched in Sri Lanka through LankaQR in February 2024, and the Central Bank lists UPI, Alipay+ and WeChat Pay as linked to LankaQR. Visitors can pay with those apps where your bank supports it.

Do I have to convert foreign currency payments into rupees?

It depends on whether you export goods or services. Service exporters currently have no mandatory conversion requirement, while goods exporters do, and both must bring proceeds into Sri Lanka within 180 days. Confirm the current rules with your bank, as they change from time to time.

Is it safe to store customers’ card numbers for repeat payments?

Not on your own systems. Use your payment provider’s secure tokenisation or saved-card feature instead, so card data stays with a provider that meets PCI DSS requirements.

Need payments added to your website?

Microweb Global builds websites, online stores and booking systems for businesses across Sri Lanka, with secure payment gateway integration, mobile-friendly checkouts and PDPA-ready data handling. We’ll help you choose the right payment mix for your customers and set it up properly.

Talk to us about online payments →

Planning a new site? Read our guide to website cost in Sri Lanka or explore our website development services.

This article is general information based on official sources available on 16 October 2026. It is not financial, legal or tax advice. Payment rules, fees and foreign exchange regulations change, so confirm details with your bank or payment provider.

Sources