Sri Lanka's tax-treaty fix and the new geometry of South Asian fraud

India and Sri Lanka signed an amendment to their bilateral tax treaty on 18 July 2026, rewriting rules that for decades had let Indian firms route investment through Colombo to escape withholding tax at home. The protocol, implemented in New Delhi by the Central Board of Direct Taxes, is the first material overhaul of the 1985 Indo-Sri Lanka Double Taxation Avoidance Agreement in more than a generation, and it lands inside a wider South Asian crackdown on cross-border financial crime.

The story running alongside it is uglier. On 15 July 2026, Indian police arrested the alleged mastermind of what investigators are calling the "Boss Scam," a corporate identity-fraud scheme that drained Rs 10 crore (roughly $1.2 million at current rates) from an unnamed mid-sized Indian firm through 63 successive bank transfers. The perpetrator, posing as a senior executive on email and messaging apps, instructed junior finance staff to move funds in tranches to mule accounts, eventually withdrawing the cash in cash. No one inside the firm appears to have queried a single transfer.

Read together, the two stories sketch a region in which the perimeter is hardening: capital flows between India and its neighbours are being re-engineered by formal treaty amendments, while informal deception inside Indian corporate treasuries is industrialising. The link is not legal, but it is real. Both flows are responses to the same underlying pressure: India's sudden, $4-trillion-GDP economy is leaky enough that criminals and corporates alike are paying attention to its seams.

What the treaty change actually does

The Indo-Sri Lanka DTAA, signed in 1985 and last amended in 2012, has long allowed a Sri Lankan subsidiary of an Indian parent company to pay dividends, interest and royalties to its Indian owner at a reduced withholding rate. Critics inside India's tax administration had argued for years that the arrangement functioned less as a tool for legitimate cross-border investment and more as a way station. A firm wanting to book income in a low-jurisdiction environment could park capital in a Sri Lankan special-purpose vehicle, route it back as a "foreign dividend", and pay India the concessionary rate instead of the standard one.

The amendment, reported by The Indian Express on 19 July, tightens the principal-purpose test that determines whether a transaction qualifies for treaty benefits. It also brings capital gains treatment into closer alignment with India's 2024 domestic rules, which had already withdrawn most exemptions for offshore indirect transfers of Indian assets. Indian officials have framed the change as a routine housekeeping exercise. Sri Lankan officials in Colombo are saying little in public, but local tax advisers told Indian outlets the amendment will affect roughly 240 Indian-owned Sri Lankan vehicles, mostly in Colombo's favoured special economic zones.

For Sri Lanka, the timing is awkward. The country is still working through the restructuring that followed its 2022 sovereign default, and Indian capital is among the larger external flows still arriving. New Delhi says the change is not aimed at Colombo, but at avoidance. Either reading is correct, which is what makes the amendment interesting: it is being sold as an anti-avoidance measure, and it is, but it is also a quiet lever India can use against a neighbour that depends on it.

The 'Boss Scam' economy

Five hundred miles north, Indian corporate finance departments are losing the kind of money that, before 2023, would have been reserved for advanced persistent threats run by foreign state actors. The Indian Express's reporting on the 15 July arrest describes a patient, almost corporate-grade operation. Posing as a senior executive over WhatsApp and signed email, the alleged perpetrator issued instructions that referenced prior internal conversations, real colleague names, and the firm's quarterly closing calendar. Sixty-three transfers later, the treasury was empty and the mule accounts were drained.

That the perpetrator succeeded across so many transactions says less about their skill than about the architecture of the firm that lost the money. Mid-cap Indian companies have rebuilt their back offices over the last decade for speed, not for verification. The Reserve Bank of India's 2024 digital lending rules have forced a generational leap in compliance infrastructure at the consumer-facing end of finance, but corporate-side transfers between own accounts still move under signature and callback. The scam exploits that seam.

There is also a recruiting pattern here that Indian investigators are starting to catalogue. Junior finance staff, often the lowest paid and most overworked in the firm, are the natural target of the impersonation. The fraudster doesn't have to defeat a system designed to detect fraud; they only have to exhaust a single individual on the inside.

The South Asian seam

A conventional framing is that India and Sri Lanka are doing two unrelated things at once: one is sovereign policy, the other is a crime story. That reading is polite and incomplete. The machinery being built inside India to police inbound and outbound capital is the same machinery that would catch a boss scam if anyone inside Indian finance ever bothered to switch it on.

Treaty amendments of the type signed this month raise the cost of moving money through Colombo to escape Indian tax. Identity-fraud prosecutions in places like Mumbai and Bengaluru raise the cost of moving it through the domestic banking system under false pretences. Both moves widen the perimeter for capital inside the Indian regulatory space. Together, they describe a state that is finally getting serious about its own plumbing.

There is a counterpoint worth taking seriously. Sri Lankan tax practitioners and at least one ruling-party commentator in Colombo have argued that the treaty's amendment could chill smaller, legitimate Indian investment into Sri Lankan tourism, IT services and port-adjacent logistics, all sectors the island is leaning on during its post-restructuring recovery. Foreign-direct-investment data through Q2 2026 is too thin to settle the argument; the next 18 months will tell whether the new clause merely denies treaty benefits to a handful of avoidance structures, or whether it has a measurable scarring effect on real inflows.

What to watch next

The Central Board of Direct Taxes is expected to release the operational guidance for the new principal-purpose test within 60 days, which is also when Sri Lanka's Department of Inland Revenue will have to publish its own compliance notes. Indian finance ministry officials have separately hinted at a renewed push on the OECD's Pillar Two minimum-tax framework during the upcoming G20. Watch whether the Indo-Sri Lanka amendment becomes the template for renegotiating India's other South Asian treaties, with Mauritius and Singapore in particular. Watch also whether India's cyber-crime coordination centre files formal charges in the Boss Scam case within the next quarter; the current Rs 10 crore figure may not be the final one. The currency of the moment is administrative seriousness. India is buying it. Sri Lanka has to live with the price.

This article was produced by Monexus's Asia desk. We treated the Indo-Sri Lanka treaty amendment as the policy spine and the 'Boss Scam' arrest as the texture around it. Where Indian outlets leaned on insider-source quotes, we paraphrased rather than reproduce, and we noted rather than asserted any estimate of the wider scam economy.