• 800 foreign nationals arrested between Jan. and late May, almost doubling total recorded for 2024
• Chinese Embassy publicly attributes surge to SL’s telecom infrastructure, geography, lenient visa policies
• Multi-agency raids sweep Colombo, Chilaw, southern coastal belt as syndicates shift from East Asian to South Asian networks
• Free visa policy strips immigration officers of time and legal grounds to screen high-risk arrivals
• Researchers warn a significant share of detained foreign operators may be trafficking victims, not willing criminals 

When enforcement agencies across Cambodia, Myanmar, and the United Arab Emirates began dismantling the region’s industrial-scale cyber scam compounds in coordinated waves, the criminal syndicates operating within them did not dissolve.

They relocated. Sri Lanka, with its high-speed fibre-optic connectivity, accessible visa regime, and porous residential real estate market, rapidly emerged as the preferred replacement frontier and the consequences have landed squarely on local law enforcement, with many Sri Lankans rapidly becoming victims as well.

According to consolidated data provided by Police Spokesperson ASP F.U. Wootler, approximately 800 foreign nationals have been taken into custody on the island between January and late May this year.

That figure has almost doubled the 430 arrests recorded across the entirety of 2024, a year that itself included arrests of approximately 230 Chinese and 200 Indian operatives. The scale and speed of the influx have triggered a sprawling multi-agency response involving regional Police divisions, the Special Task Force (STF), Customs, and the Department of Immigration and Emigration – institutions whose frameworks were not designed for the volume or technical sophistication now being demanded of them.

When the economic crisis hit Sri Lanka in 2022, many young people fell into the trap of Myanmar’s cyber scam compounds out of desperation to seek financial stability. They were also subjected to torture and other forms of abuse. Now, the country is seeing a reversal of the situation, with Sri Lanka becoming a hub for similar forms of slavery and human trafficking.

Beijing’s direct warning

The migration of these syndicates has drawn an unusually public response from the Embassy of the People’s Republic of China in Colombo. Acknowledging that illegal activities in Sri Lanka had escalated sharply in the wake of enforcement actions across Cambodia and Myanmar, the embassy took the rare step of formally cataloguing the specific domestic vulnerabilities that network kingpins were targeting.

In an official communiqué, Beijing explicitly attributed the localised surge to Sri Lanka’s well-developed telecommunications infrastructure, favourable geographical location, and relatively lenient visa policies.

The embassy noted that these telecom fraud gangs operated with extreme internal insulation, establishing deep local footprints to execute cryptocurrency-driven financial fraud and romance scams directed at victims in mainland China. It pledged coordination with Sri Lankan authorities to facilitate the tracking, arrest, and immediate repatriation of its nationals caught within these networks.

The 2026 raid log

The operational timeline of 2026 maps a crisis that began as isolated suburban Police actions and expanded rapidly into sprawling, multi-location sweeps spanning multiple provinces.

The first significant breakthrough came on 23 February, when local Police raided two high-end residential properties in Cinnamon Gardens, Colombo 7, arresting 21 Chinese nationals operating out of luxury apartments. By March, immigration authorities had tracked down and detained a cell of 135 Chinese nationals at a single, heavily networked scam centre; the entire group was processed for visa violations and deported.

On 2 April, the geography of the crisis widened dramatically. A joint task force dismantled a fortified, tech-heavy compound in Chilaw, arresting 152 foreign nationals caught working in regimented operational shifts. The demographic breakdown – including 133 Chinese, 13 Vietnamese, and one Malaysian – gave authorities their first definitive evidence of the multi-ethnic, corporatised structure driving these operations.

As syndicates worked to maintain their hardware supply lines, Sri Lanka Customs officers at the Bandaranaike International Airport intervened on 16 April, intercepting nine Chinese nationals who had arrived on a single flight, concealing 383 mobile phones, 101 tablet computers, and six high-capacity Wi-Fi routers taped to their bodies beneath their clothing – a haul valued at Rs. 24 million.

By May, the pace of enforcement had reached its highest pitch. On 2 May, simultaneous sweeps struck two suburban nodes on the same day: a raid in Koswatta netted 37 Chinese nationals alongside 147 smart devices and 100 unused local SIM cards, while a multi-agency dragnet on Medawelikada Road in Rajagiriya detained 121 foreign suspects representing Taiwanese, Chinese, Myanmar, Malaysian, Vietnamese, and Filipino networks. 

Days later, 74 Vietnamese nationals were remanded from a Kollupitiya hospitality facility after overstaying their entry permits, followed by a Werahera raid on 7 May that detained 30 Chinese and Vietnamese operatives.

A structural shift in the composition of these networks materialised between 11 and 12 May, when the STF attached to the Akmeemana Camp launched a synchronised four-pronged sweep across the southern coastal belt.

In under 24 hours, officers arrested 221 foreign nationals – and the demographic profile had shifted dramatically away from East Asian dominance towards South Asian networks, specifically Indian and Nepalese syndicates. Twin raids on residential villas in Galle netted 110 Indian nationals operating 58 server rigs and desktop computers. 

In Dodanduwa, 35 Indians and 20 Nepalese operatives were arrested at a beachfront lodging facility, along with the 43-year-old Sri Lankan hotel owner who had knowingly provided logistical cover. Midigama and Galle Harbour followed within the same sweep.

The suspects, predominantly aged between 21 and 47, are being prosecuted under a dual legal framework: administrative immigration charges for violating the terms of tourist visas, and criminal prosecution under the Computer Crimes Act No.24 of 2007.

What the State says

ASP Wootler, speaking to The Sunday Morning, confirmed the scale of what enforcement had uncovered. 

“Foreigners involved in criminal activities, such as cybercrimes and illegal money laundering, are to be prosecuted within the existing laws. In 2026, from 1 January to date, there were approximately 700 foreign nationals arrested,” he said. Many had remained in the country illegally after their visas had expired, accruing both immigration and computer-crime charges simultaneously.

“Any foreigner who visits the country will have a valid visa and passport. These particulars are incorporated into the Department of Immigration and Emigration. Any foreigner who overstays after their valid dates commits an offence under the Immigrants and Emigrants Act, and authorities will take action against them,” he said.

Recognising the technical sophistication and rapid expansion of these networks, the Police apparatus has also undergone structural adjustment. A dedicated Cyber Crime Division has been established under the direction of the Inspector General of Police (IGP). 

“Cybercrimes are on the rise. A special Cyber Crime Division has been established under the guidance of the IGP to investigate all cyber matters, and stern, swift action will be taken against such perpetrators,” ASP Wootler said.

He also directed attention to the local property market, which had become a critical enabler in the syndicate supply chain. Property owners hold a statutory obligation to verify tenant identities and report to the nearest Police station – obligations that, when ignored, place them in direct legal jeopardy alongside the criminals they shelter. 

“In consideration of the security arrangements taking place in the country, we strongly direct the public to keep the nearest Police station informed when renting out a residence, apartment, or commercial building temporarily or permanently,” he said.

The massive wave of arrests sweeping the island is not a localised anomaly; it is a direct consequence of intense, militarised crackdowns and regulatory tightening across former safe havens in Southeast Asia, particularly Cambodia, Myanmar, and the Philippines.

What the border cannot catch

The enforcement picture looks very different from the other side of the arrival hall. An Immigration official, speaking on condition of anonymity, offered a candid account of the structural constraints that allowed these syndicates to move operatives past border control under the cover of leisure travel.

The Government’s free visa policy extended to citizens of China, India, and, recently 40 additional countries had, in practice, stripped officers of both time and legal grounds. Because there is no fee or prior vetting requirement, officers find it nearly impossible to turn arrivals away. 

The problem is compounded by volume. When hundreds of passengers arrive on a single flight, often with 100–200 individuals belonging to groups of interest, individual interviews become physically impossible. “Decisions on whether to grant entry must be made instantly,” the official said.

Suspected operators further complicate the task by arriving in coordinated groups mimicking legitimate tour parties wearing matching clothing, carrying flags, and presenting themselves as religious pilgrims. Most carry return tickets, removing one of the few legal grounds officers might otherwise use to justify refusal. Language barriers compound the problem further: many travellers claim to speak no English and respond to translation attempts with vague, non-committal answers.

When officers do attempt to refuse entry, they face pressure from an unexpected quarter. The official noted one recent instance in which a traveller turned away at the airport had filed an appeal in the Court of Appeal demanding official justification for the rejection.

“There is a tension between the Government’s goal to promote tourism and the Immigration Department’s duty to maintain security,” he said. Previously, when visa applications carried a fee and required online processing, there was a structured pre-screening window. That opportunity no longer exists, and neither does the leverage that came with it, given reduced screening due to the free visa policy. 

Arrested individuals are processed for mandatory deportation and permanently barred from re-entry through a blacklist database that flags them at every border crossing. The official noted that those turned away at the airport before entering the country were served an X form and returned on the same flight they arrived on. 

Forced criminality: The hidden layer

For law enforcement and the courts, a further complicating dimension has begun to surface in how these cases are understood. 

‘Gender, technology, and trafficking in persons: Women’s experiences of forced criminality in Southeast Asia’s cyber scam centres,’ a 2026 study by The Bali Process Regional Support Office and the Australian Institute of Criminology provides a detailed architectural account of how these syndicates recruit, manage, and retain their workforces, and raises a question largely absent from public discourse around the Sri Lankan arrests: how many of those detained are themselves victims?

The research establishes that modern syndicates no longer rely solely on overt kidnapping. Recruitment increasingly operates through trusted social relationships, exploiting familiarity and fraudulent promises of legitimate corporate employment. Once workers arrive in the host country, their passports are confiscated, their devices are monitored, and they are compelled – under threat of physical violence or financial extortion – to execute digital scams. The study standardises this under the legal category of forced criminality.

The gender architecture within these compounds is equally specific. Women and girls trafficked into scam centres are disproportionately assigned to frontline roles as the human face of romance scams and cryptocurrency investment fraud – because syndicates systematically leverage their femininity to build rapport with international targets. Within the compound, this digital labour coexists with severe sexual exploitation. Management and technical infrastructure, meanwhile, remain tightly controlled by male syndicate hierarchies.

As governments in Southeast Asia began actively dismantling these physical compounds, criminal syndicates decentralised their operations. Sri Lanka immediately emerged as a premier replacement frontier. 

The country offered an attractive environment for syndicate leaders trying to minimise overhead while maximising connectivity: exceptional telecommunications infrastructure, high-speed fibre-optic availability, and a lenient short-term tourist visa regime that allowed them to rapidly move thousands of foreign nationals past border control under the guise of leisure travel.

The implications for Sri Lanka’s processing of arrested operators are significant. Not all of the individuals currently cycling through the island’s deportation pipeline are willing participants in organised crime. A portion are themselves trapped within it – and the deportation procedure, as currently applied, makes no distinction between the two.

The deeper enforcement challenge is therefore not only operational but conceptual. Sri Lanka did not seek this crisis. It inherited it from enforcement successes elsewhere and from a set of domestic conditions that made it an attractive replacement target. Fixing the border without addressing what lies beyond it – in visa policy, landlord accountability, and the legal recognition of forced criminality – will not be enough. 

The arrests are accelerating. Whether the framework surrounding them can keep pace with the network it is pursuing remains the open question.

Multiple attempts to contact Minister of Public Security Ananda Wijepala, Deputy Minister of Public Security Sunil Watagala, and Controller General of Immigration and Emigration Chaminda Pathiraja for further information were unsuccessful.