Even though two weeks have passed since the skimming attacks on several banks, the banking sector regulator – the Central Bank of Sri Lanka (CBSL) – is yet to make EMV cards, which can virtually eliminate skimming, mandatory for banks. When contacted, the Payments and Settlements Department of CBSL refused to comment on the matter. However, in an earlier media release, the CBSL requested customers to use EMV-enabled payment cards, but stopped short of requiring all the banks to issue EMV payment cards. The Sri Lanka Computer Emergency Readiness Team (SLCERT) said that making EMV-enabled payment cards mandatory was a regulatory measure that should be taken by the CBSL in consultation with the local banks. SLCERT Director Operations Rohan Palliyaguru stated that similar incidents have been taking place over the past few years as SLCERT received complaints with regard to skimming incidents. Such complaints made to the SLCERT are transferred to the Currency Counterfeit Bureau of the Criminal Investigation Department (CID) where they undertake relevant investigations against alleged perpetrators. However, he conceded that making EMV-enabled payment cards mandatory might face several practical issues in terms of cost to the banking industry. “Banks have to replace the ATMs with relevant card readers as well. There will also be a cost to the bank when they issue new cards with the chip.” SLCERT is mandated to control cybercrime but skimming does not fall under that category. The Finance Sector Computer Security Incident Response Team (FINCSIRT), which responds to computer security alerts and incidents affecting the banks and other licensed financial institutions in the country, also stated that the CBSL was the regulatory body that was responsible for making EMV-enabled payment cards mandatory, but refused to comment on why it had not been done so far. However, the Payment Card Industry Association of Sri Lanka (PCIASL) told The Sunday Morning Business that even if the Sri Lankan banks migrate 100% to EMV cards and even with upgraded devices, transactions made outside the EMV technology would still pose risks. A spokesperson from the PCIASL stated that to ensure complete elimination of fraudulent activities, transactions outside the EMV technology should not be allowed. “However, if such risks are to be fully eliminated, a decision that transactions will not be performed outside EMV technology has to be taken. This could result in certain transactions not going through due to a failure or a malfunction of the chip in the card or the transaction processing device,” he added.