By Dr Sanjana Hattotuwa
Sri Lanka has moved to shut the front door on the offshore betting industry, blocking two dozen named online services that the Government identifies as operating without Sri Lankan licences. The Gambling Regulatory Authority initiated the action and the Telecommunications Regulatory Commission of Sri Lanka (TRCSL) instructed telecommunications providers to restrict access at once, the blocked domains including those of 1xBet, Melbet, Betway, Bet365, Linebet, Coldbet, Megapari, Mostbet, WinWin and fifteen further services belonging to unlicensed operators.
The order marks the first clear enforcement step under the Gambling Regulatory Authority Act, No. 17 of 2025, which entered into operation on 1 December 2025 through Gazette Extraordinary No. 2463/03, and its licensing architecture is layered, with section 15 requiring a gambling licence, section 16 requiring an applicant to register or incorporate a company under Sri Lanka’s Companies Act, and section 18 adding a specific digital-gambling licence on top of both. Reporting on the blocking compresses the offence provisions in ways that matter, because section 42 criminalises carrying on gambling without a valid licence, while Section 44 criminalises advertising gambling that contravenes the Act. Nearly all of the evidence in my recent study of online and social media gambling promotion concerns Facebook creators, promoters, affiliates and cash agents rather than the operators alone.
Betting promotion in Sri Lanka is not hidden, and the overlap between the blocking list and what I found is substantial. That study, the first of its kind in Sri Lanka, considered 10,813 public records across Facebook and four offshore betting websites, and found four betting-branded Facebook accounts carrying roughly 29,400 followers, sixteen Facebook Groups holding about 116,700 members, and a separate search that returned thirteen further betting-related pages. Those audience figures overlap, and no combination of them yields a national prevalence estimate, but what they do show is an open promotional and payment market, reachable by anyone with a phone, operating in Sinhala, Singlish and English, and running through six months of sustained activity, with the material suggesting continued expansion, rapid reproduction and ready replacement across new pages, domains and identities. Two of the principal brands in that corpus, 1xBet and Melbet, appear on the blocking list, and my records also hold Linebet, Coldbet, Megapari, Mostbet and WinWin promotions. The list nonetheless omits other services that recur in the material, including BetSS, LS.Bet and 888starz, so while the order validates the finding that major offshore-facing brands have reached Sri Lankan audiences through an extensive public promotional environment, it neither defines the complete market nor establishes that the Authority has identified every unlicensed service.
The mismatch between brands and domains creates the more consequential problem, since the named 1X BET SRI LANKA account used 1xlanka.live in 194 collected posts before shifting to 1x-gift-lankafb.com in 277 posts, a tagged reffpa.com link redirected to 1xbet.lk, Bitly links led to melbet-srilanka.com, and lb-aff.com passed through an intermediate domain before reaching Linebet registration. By contrast 1xbet.com, the hostname on the blocking list, appeared as an external domain in only five corpus records. If telecommunications providers block no more than the precise hostnames named in the announcement, campaign domains, localised domains, referral gateways and fresh mirrors may well remain reachable, and if TRCSL instructed providers to block a wider set of related infrastructure, reporting published to date does not explain the scope.
The order is also silent on circumvention, a point the cybersecurity researcher Asela Waidyalankara made, tongue-in-cheek, soon after the news broke, given that a block imposed at the level of local telecommunications providers is defeated by a VPN, and VPN applications are free, abundant and already familiar to Sri Lankan users who reached for them during earlier social media shutdowns. Nothing in the announcement or in reporting on it suggests the Authority or TRCSL has accounted for the movement of determined users onto encrypted tunnels, where the same brands, the same affiliates and the same payment agents remain within reach, and where the traffic is considerably harder to observe than it was before the block.
My research also establishes that the website sits near the end of the acquisition chain rather than at its head, with the 10,813-record corpus containing 1,483 Facebook-group posts carrying WhatsApp calls to action, 1,893 with a contact or external route and 1,138 offering deposit or withdrawal services. Lifestyle videos and cricket posts create the attention, search instructions, biography links and promo codes carry the attribution, WhatsApp takes the conversation out of public view, and cash agents connect betting accounts to local bank transfers, receipts and account identifiers. Blocking the final portal may reduce casual access and break some existing links, but it removes none of the Facebook content, brand searches, private groups, telephone contacts, affiliate codes or local payment intermediaries that steer users towards replacement destinations.
The order may also change how the environment operates rather than shrink it, since promoters can rotate domains, instruct users to search for a brand, distribute an app, send a fresh link through WhatsApp or move an audience wholesale to another bookmaker. My corpus already documents that capacity, although it cannot establish that promoters have changed their behaviour in response to this particular order. Enforcement of this kind may therefore displace visibility from public websites into channels that are more mutable, more private and less legible, making independent scrutiny, user redress and transaction tracing harder than they already are.
Enforcement that means anything must follow the commercial chain in full, from brand to bank. The Gambling Regulatory Authority should publish a licence register connecting each licensed company to its brands, domains, mirrors, apps, affiliates, social media accounts, promo codes and approved payment intermediaries, TRCSL can restrict verified domains, the Central Bank and the Financial Intelligence Unit can examine recurring agent accounts and settlement patterns, and Meta can investigate promotions and preserve the routes that lead into WhatsApp. Sections 54 and 59 already give that wider response a legal anchor, the first addressing deceptive advertisements and claims that gambling can solve financial difficulty, the second requiring licensed operators to record customers, cash movements, electronic transfers and suspicious transactions.
Reporting to date carries none of the material that would make the measure auditable, whether the Authority’s directive, the evidence used to classify each service, a public digital-licence register, the technical blocking method, or a procedure for correcting mistakes and adding mirrors as they appear. The order shows that the State now recognises the front door into unlicensed online gambling. My research shows how many side doors stand open beside it, and if enforcement stops at a static list of twenty-four names, the market will change its links faster than the State changes its list.