AI in Sri Lankan Banking

AI has entered at least one publicly disclosed credit-underwriting process in Sri Lanka. That is a meaningful development, but it is not evidence that the technology has already improved lending outcomes across the banking sector.

The distinction matters. A bank can deploy a model without publishing its validation results. A sector can report lower impaired-loan ratios without showing that AI caused the improvement. A model can also improve predictive accuracy while creating unacceptable problems in fairness, transparency, privacy or customer recourse. The available evidence supports a cautious assessment: AI may assist credit decisions, but its value and safety must be demonstrated for each use case.

Data cut-off: 12 August 2026. This article uses public information only.

Sri Lanka’s current credit-risk context

The latest published sector figures do not support the earlier description of continuously rising non-performing loans. The Central Bank of Sri Lanka’s Q1 2026 update, released on 5 June 2026, reported that banking-sector credit grew by 24.4% year on year at the end of the quarter, compared with 7.9% a year earlier. The Stage 3 loans ratio fell from 12.7% to 9.4%, while Stage 3 impairment coverage increased from 54.1% to 59.5%.

That improvement needs careful interpretation. CBSL attributed the lower ratio to both rapid credit expansion and a slight decline in the stock of Stage 3 loans. A ratio can therefore fall partly because its denominator is growing. CBSL’s Financial Stability Review 2025 summary, which generally covers data through June 2025, also described Stage 3 loans as declining but still elevated. The current problem is better stated as material credit risk during a period of rapid balance-sheet expansion, not as a simple rise in bad loans.

The CBSL figures cover the banking sector as a whole. They do not isolate private commercial banks, loan officers, individual portfolios or the effect of any particular underwriting system. They establish the operating context, not an AI outcome.

What Sri Lankan banks have disclosed

Commercial Bank of Ceylon provides the clearest public example. Its 2025 Annual Report states that the bank introduced an AI-powered SME credit-underwriting solution during 2025. The bank reports that the system uses data-driven analytics to support credit assessment, shorten turnaround times and strengthen portfolio risk management. A separate governance disclosure says that AI and machine-learning model-governance and data-cleansing policy frameworks were implemented.

These are relevant first-party disclosures. They show that AI-assisted underwriting is no longer only a proposal in Sri Lanka. They do not, however, provide an independent test of the model. The public report does not disclose comparative default rates, false-positive or false-negative rates, approval changes, subgroup fairness measures, override rates, customer complaints, validation findings or performance after deployment.

The defensible conclusion is narrow: one major private bank reported an operational AI-assisted SME underwriting system in 2025. It would be premature to describe this as sector-wide adoption or to claim that the system has reduced defaults, removed information asymmetry or improved access to credit.

Global evidence and its limits

International experience explains why banks are interested in AI. Machine-learning systems can process many variables, find nonlinear relationships, automate parts of a workflow and support portfolio monitoring. The Financial Stability Board’s June 2026 consultation report also identifies possible gains in operations and services. It is a consultation document rather than a binding final standard, and it gives equal attention to governance and risk.

The most relevant peer-reviewed source in the original article is Purificato et al. Their loan-approval case study describes a proprietary system designed to interpret model outputs and monitor decisions for unfair behaviour. It also reports a usability exercise with domain experts and other users. This supports the practical importance of explainability and fairness monitoring. It does not establish that AI underwriting is more accurate than conventional scoring in Sri Lanka, or that it lowers non-performing loans.

Global findings should therefore be used to define testable questions, not imported as local results. A Sri Lankan bank would still need to show that its model performs better than the existing decision process on representative local data, remains stable when economic conditions change, and does not create unjustified disparities between customer groups.

Human adoption is part of model risk

An accurate model can still fail in practice if staff do not understand it, trust it too readily, ignore it without reason, or lack a clear process for escalation. The Technology Acceptance Model 3 developed by Venkatesh and Bala provides a useful way to organise some of these questions. Perceived usefulness and perceived ease of use can influence an employee’s intention to adopt workplace technology, while training, organisational support and system design can shape those beliefs.

TAM3 was not developed specifically for AI lending in Sri Lanka. It should be treated as a conceptual framework, not proof of how local loan officers behave.

The 2019 conference paper by Mathipriya et al. is locally relevant because it used a questionnaire to examine employee readiness for AI in Sri Lankan banking. Its abstract reports general readiness alongside concern about job security, and describes banks at that time as being at a foundational stage. The study is now several years old. The accessible abstract does not provide enough information about the sample frame, response rate, institutional coverage or measurement quality to justify a current sector-wide conclusion.

A contemporary employee study would need to disclose the banks and roles covered, recruitment method, sample size, instrument, pilot testing, reliability and validity checks, missing-data treatment, analysis plan, ethics process and uncertainty around its estimates. Until that work exists, statements about loan-officer acceptance should remain hypotheses.

Governance requirements for credit AI

Credit decisions affect access to housing, education, working capital and business survival. Governance should therefore be proportionate to that impact. At minimum, a credible deployment should include:

• a defined decision boundary showing whether the model recommends, ranks or makes a decision;
• documented data provenance, lawful purpose, quality checks and controls on proxy variables;
• out-of-sample validation against the existing process, with error costs stated clearly;
• fairness testing across relevant customer groups and an approved response when disparities appear;
• explanations that are useful to staff and affected customers, not only to model developers;
• named human accountability, controlled overrides and records of the reasons for those overrides;
• monitoring for drift, instability and changes in approval, default and complaint patterns;
• independent validation, change control, audit trails, cybersecurity controls and third-party oversight; and
• a practical route for customers to question information, obtain a review and lodge a complaint.

These controls align with existing obligations rather than creating a separate AI exception. CBSL’s Financial Consumer Protection Regulations No. 01 of 2023 require fair and transparent treatment of financial consumers. Its Technology Risk Management and Resilience framework, amended in December 2023, places governance, security and resilience duties on licensed banks.

Sri Lanka has also enacted the Personal Data Protection Act No. 9 of 2022 and an amendment in 2025. Commencement has been phased, and an official order dated 22 July 2026 changed the timetable for specified provisions. Banks should check the current Gazette and obtain legal advice before deployment; this article does not assume that every provision is already operative. The practical direction is unchanged: credit AI needs data minimisation, a clear processing purpose, appropriate security and accountable treatment of people affected by its outputs.

What would demonstrate value

The strongest next step is not another broad claim about transformation. It is a controlled evaluation with a clear comparator.

A bank could evaluate the model prospectively alongside its current underwriting process before allowing it to affect final decisions. The evaluation should predefine approval quality, default or delinquency outcomes, processing time, override behaviour, subgroup performance, complaints and operational cost. Results should be reported with observation periods and uncertainty, because early repayment data can give a misleading impression of long-term credit performance.

For an independent sector study, the research question should separate three issues: whether AI changes predictive performance, whether employees use it appropriately, and whether customers receive fair and contestable decisions. Those questions require different data and cannot be answered by a single adoption survey.

Assessment

AI-assisted underwriting is now a real, disclosed development in Sri Lankan banking. The public evidence does not yet show that it has improved default prediction, expanded fair access to credit or reduced sector-wide losses. CBSL data show improving asset-quality ratios alongside unusually strong credit growth, but they do not identify AI as the cause.

The responsible position is therefore conditional. Banks should use AI where a specific system performs better than the existing process under independent validation and where governance remains effective after deployment. Speed and scale are useful only when the underlying decision is accurate, fair, secure and open to review.