Compliance Essentials for Gaming Companies Setting Up Offshore Teams

Compliance Is the Foundation, Not an Afterthought

The case for Sri Lanka as an offshore location for gaming and tech companies is genuine: competitive labor costs, a large English-speaking talent pool, and a time zone that aligns well with South and Southeast Asian operations. The risk is that the strength of the business case tempts teams to move fast and sort out compliance later.

In gaming, that approach almost always backfires. The industry sits at the intersection of financial services, data-intensive consumer products, and cross-border payment flows — all areas subject to heightened regulatory scrutiny. A compliance gap that looks minor at ten employees becomes a material liability at fifty.

This article covers the five compliance dimensions that gaming companies must resolve before operational launch in Sri Lanka: licensing architecture, tax residency risk, data protection, foreign exchange controls, and employment law. Our position is clear: full compliance with applicable regulations is both the legal requirement and the only sustainable foundation for long-term operations.

---

1. Licensing Architecture: Separating the Support Entity from the Operating License

What Sri Lanka Does (and Doesn’t) Offer

Sri Lanka does not issue international online gaming or wagering operating licenses. Domestic gambling activities — land-based casinos, lotteries — are regulated under separate legislation aimed at the local market. That is not a criticism; it simply means Sri Lanka is not the jurisdiction where you hold your player-facing license.

What Sri Lanka is well-suited for is hosting the operational backbone of your gaming business:

• Software development and QA teams
• Customer support and VIP management operations
• Data analytics and BI functions
• Finance, compliance monitoring, and fraud detection teams
• Content moderation and localization

The Correct Legal Architecture

The operating license — whether MGA (Malta), PAGCOR or CEZA (Philippines), GSC (Isle of Man), or another recognized jurisdiction — sits with a separate licensed entity. The Sri Lanka company provides services to that entity under a formal Intercompany Service Agreement (ISA).

Element	Licensed Operating Entity	Sri Lanka Support Entity
Location	Malta / Philippines / Isle of Man / etc.	Sri Lanka
Primary function	Player-facing operations, revenue generation	Tech, CX, ops support
Gaming license	Required and maintained	Not applicable
Revenue model	Player deposits, wagering	Service fees from related party
Key compliance risk	License conditions, AML, player protection	Labour law, tax, PDPA

The ISA must define the scope of services, the pricing methodology (critical for transfer pricing — see below), payment terms, and IP ownership. This document will be reviewed by tax authorities in both jurisdictions, so it needs to be substantively accurate, not a formality.

---

2. Tax Residency: The Risk That Surprises Most Teams

Place of Effective Management (POEM)

Many jurisdictions — including Sri Lanka — apply a POEM test to determine corporate tax residency. Under this doctrine, a company is treated as a tax resident where its key management and control functions are actually exercised, regardless of where it is incorporated.

In practice, this means that if your CEO or a majority of your board routinely makes strategic decisions from Colombo, Sri Lanka’s tax authority may assert that your entire group — including the licensed operating entity incorporated elsewhere — is a Sri Lankan tax resident, subject to Sri Lankan corporate income tax on worldwide income.

This is not a theoretical risk. It has materialized for several gaming operators who established substantial management presence in offshore locations without corresponding adjustments to their governance structure.

Practical Mitigations

Managing POEM risk through proper structural design is entirely legitimate. The key steps:

1. Define the Sri Lanka entity’s functional scope clearly — execution, delivery, and support; not strategic decision-making
2. Hold board meetings in the incorporation jurisdiction with documented minutes and evidence of physical attendance
3. Reserve authority for major contracts in the licensed entity; the Sri Lanka team should not independently execute deals above an agreed threshold
4. Conduct a periodic POEM health check whenever headcount, titles, or reporting lines change significantly
5. Engage an international tax adviser before going live — a one-time structural review costs far less than a tax residency dispute

Transfer Pricing

Intercompany service fees between the Sri Lanka entity and the overseas parent must comply with the arm’s length principle. Under-pricing shifts profit offshore (red flag for Sri Lanka tax); over-pricing inflates Sri Lanka costs artificially (red flag in the parent jurisdiction). Both positions carry risk.

Document your transfer pricing methodology annually. Common approaches for service entities include the cost-plus method and the comparable uncontrolled price method; your tax adviser will recommend the appropriate benchmark.

---

3. Data Protection Compliance

Sri Lanka PDPA 2022

The Personal Data Protection Act came into effect to provide a statutory framework for data handling. Key obligations for gaming companies:

• Lawful basis: Collecting player data requires a valid legal basis (consent, contract performance, legitimate interest, etc.)
• Data subject rights: Players can request access to, correction of, and deletion of their personal data
• Breach notification: Data breaches must be reported to the Data Protection Authority within prescribed timeframes
• Cross-border transfers: Transfers of personal data outside Sri Lanka require appropriate safeguards

Even if your player-facing platform and databases are hosted outside Sri Lanka, your Colombo team processes data as part of their role. That processing is subject to PDPA. This is especially relevant for CX teams handling player inquiries, payment disputes, and account verification.

GDPR: Extraterritorial Reach

If your games are available to users in the EU or EEA, GDPR applies to those user interactions regardless of where your company or team is located. Your Sri Lanka-based customer service agents handling European player accounts must operate within GDPR-compliant workflows. This requires:

• Data Processing Agreements (DPAs) in place between all entities in the processing chain
• Agent access to player data limited to what is necessary for the task (data minimization)
• Documented procedures for responding to data subject access requests within statutory timelines
• Clear escalation paths for potential breaches

Internal Data Security

Beyond legal requirements, gaming companies should implement practical controls for their Sri Lanka teams:

• Tiered access control for source code repositories and production systems
• VPN and secure network policies for office and remote access
• Offboarding protocol to revoke all access on the day of departure
• Regular security awareness training aligned with the sensitivity of data handled

---

4. Foreign Exchange Controls

Sri Lanka’s Foreign Exchange Act (FEA) and Central Bank regulations govern both inbound and outbound foreign currency flows. For a Sri Lanka subsidiary in the gaming support structure, the most relevant flows are:

Inflows (service fee receipts from overseas parent)

• Must be supported by the signed ISA and corresponding invoices
• Subject to declaration requirements upon receipt
• May need to be converted to LKR within a prescribed period unless held in an approved Foreign Currency Banking Unit (FCBU) account

Outflows (dividends, management fees, loan repayments)

• Require documentary evidence of the underlying transaction
• Profit remittances require tax clearance from the IRD
• Some outflows require Central Bank approval depending on the amount and nature

Specific requirements, thresholds, and approval processes change periodically. Always verify current requirements with a licensed forex dealing bank or Central Bank-authorized adviser before executing cross-border transactions.

---

5. Employment Compliance

Contracts and Labor Law

Sri Lankan labor law is employer-unfriendly on certain dimensions — dismissal procedures are regulated, and failure to follow correct process creates significant legal exposure. Key requirements:

• Written employment contracts are mandatory and must be provided to employees before or at the time of hiring
• Contracts should clearly define role, compensation, working hours, notice periods, and termination conditions
• Non-disclosure, IP assignment, and non-compete clauses must be drafted for Sri Lankan enforceability by a qualified local lawyer — standard templates from other jurisdictions often do not hold up

Visas and Work Authorization

Foreign nationals working in Sri Lanka — including Chinese executives or technical leads stationed there — require valid work authorization. Business visas are appropriate for short-term visits only. Extended presence and active work require a Residence Visa or Employment Visa obtained through the proper channels.

The Sri Lanka Department of Immigration conducts enforcement actions. Non-compliance creates personal immigration risk for the individuals involved and reputational risk for the entity.

IP Assignment and Confidentiality

For gaming companies, code and content are the crown jewels. Employment contracts must unambiguously assign all work product created during employment to the company. Align your Sri Lankan IP assignment clauses with the Intellectual Property Act of Sri Lanka and confirm coverage with local counsel.

---

Compliance Roadmap: Prioritized by Phase

Pre-Launch (Non-Negotiable)

1. International tax review — POEM risk assessment
2. Transfer pricing methodology scoped
3. Employment contract templates reviewed by Sri Lankan counsel
4. Visa and work permit plan for all foreign assignees

First 90 Days 5. PDPA compliance assessment for data flows involving the Sri Lanka team 6. Foreign exchange procedures established with banking partner 7. IP protection mechanisms embedded in contracts and systems

Ongoing 8. Annual transfer pricing documentation update 9. Compliance training: data protection, AML awareness, workplace conduct 10. Periodic legal review as headcount and functions scale

---

MMD provides end-to-end setup services for offshore teams in Sri Lanka, including company registration, visa processing, employment contract review coordination, and ongoing HR operations. We work with trusted local legal, tax, and FX partners to ensure your compliance architecture is solid from day one. Reach out on Telegram: @MMD_BPO