Ecommerce Payment Gateways in Sri Lanka: Full Guide

Ecommerce payment gateways in Sri Lanka at a glance

If you run an online store in Sri Lanka, the gateway you pick decides three things: which cards actually go through, how fast the money lands in your bank account, and how much time your team spends on failed-payment support tickets. Every option below is licensed to operate locally under the Payment and Settlement Systems Act supervised by the Central Bank of Sri Lanka.

Fees vary by merchant category, volume, and card type. Public rates for card-present-style ecommerce in Sri Lanka typically sit in the 2.5%–3.5% range per transaction for local Visa/Mastercard, higher for Amex and foreign-issued cards. Treat those as directional, not quotes — every gateway negotiates.

What is a payment gateway, and why does every Sri Lankan ecommerce store need one?

A payment gateway is the piece of software that sits between your website’s checkout and the card networks (Visa, Mastercard, Amex) or local rails (LankaQR, JustPay, CEFTS). It encrypts the card details, runs the 3D Secure OTP step, talks to the customer’s issuing bank, and returns an authorised-or-declined response — usually in under 8 seconds.

You cannot legally take card payments on a Sri Lankan ecommerce site without one. Direct card handling requires PCI DSS Level 1 certification, which for a small merchant is neither practical nor affordable. The gateway holds that certification on your behalf — see the PCI Security Standards Council for what that scope actually covers.

Underneath the card networks, most local rails route through LankaPay and LankaClear, the national payment infrastructure operator. LankaQR (the national QR standard) and CEFTS (real-time interbank transfers) both settle through LankaClear, which is why almost every SL gateway can offer them regardless of which acquiring bank sits behind it.

When PayHere or WebXPay is the right call

Pick one of these if you are launching in the next 30 days and don’t have a dedicated developer. Both offer a hosted checkout page — the customer is redirected to the gateway’s URL, pays, then bounces back to your success page. You never touch the raw card data, which keeps your PCI scope tiny.

• You’re on WooCommerce, Shopify, or Magento and want a plugin, not an API build.
• You need to accept local wallets (eZ Cash, mCash, Genie) alongside cards.
• Your monthly volume is under about LKR 5 million and you don’t yet have leverage to negotiate bank rates.

When a bank-run IPG (Sampath, Commercial Bank, HNB) is the right call

Pick a direct bank Internet Payment Gateway when volume is high enough that saving 0.3%–0.5% per transaction actually funds a developer to integrate it.

• You already bank with that acquirer, so settlement into your own current account is same-day or T+1.
• You have engineering capacity to build against a raw API (no drag-and-drop plugin).
• You’re okay running your own hosted checkout page and taking on the extra PCI DSS SAQ questionnaire that comes with it.

When iPay, DirectPay, Onepay, or a BNPL layer is the right call

These fill specific gaps rather than being defaults.

• iPay by Dialog is worth it if a meaningful share of your customers pay from Dialog wallets or use Genie.
• DirectPay shines for B2B where you need to send a payable link by email rather than force a full checkout.
• Onepay is a fast way to get a micro-merchant (single-product store, event ticket page) taking cards without a full contract cycle.
• Mintpay and KokoPay are BNPL layers you add on top of an existing gateway, not replacements — they let customers split into three instalments while you still get paid upfront, minus their fee.

What do people get wrong when choosing a payment gateway?

The most common mistake I see Sri Lankan merchants make is picking on headline fee alone. A gateway that’s 0.2% cheaper but silently fails 15% of foreign-issued cards will cost you far more in lost diaspora orders than the fee saving.

The second mistake is not asking about 3D Secure fallback behaviour. When a customer’s bank doesn’t return an OTP in time, some gateways auto-decline and some retry non-3DS — that single configuration choice is the difference between a 92% and a 78% checkout success rate for international cards.

The third is ignoring settlement timing. A T+3 gateway is fine for a hobby store, but if you’re paying suppliers weekly on 7-day terms, T+3 combined with a weekend can quietly push you into a cash crunch.

What settlement times, fees, and chargebacks actually look like in Sri Lanka

Here’s the operational reality behind those neat table cells.

Settlement. When a customer pays on Monday morning, the transaction is authorised in seconds but the money is not in your account for two to three working days. That’s because the acquirer batches transactions overnight, submits them to the card networks the next working day, and only credits your merchant account once the funds clear. Public holidays (of which Sri Lanka has many) extend the clock. A Thursday sale before a long weekend often settles the following Wednesday.

Fees. Beyond the per-transaction percentage, watch for: a fixed per-transaction fee (typically LKR 15–30), a monthly maintenance fee on some plans, a chargeback fee (LKR 1,500–3,000 per dispute regardless of who wins), and a foreign-card surcharge of roughly 0.5%–1.5% on top of the base rate.

Chargebacks. A cardholder has up to 120 days from the transaction date to dispute under Visa and Mastercard rules. When they do, the gateway pulls the funds from your next settlement immediately and you have a fixed window (usually 7–14 days) to submit evidence. If you lose, the funds stay reversed and you also eat the chargeback fee.

A real example from running checkout at Kapruka

At Kapruka we run gifting orders from diaspora customers in Australia, the UK, the US, Canada, and the Middle East — people sending flowers, cakes, and hampers home. That means our checkout has to work for cards issued by banks the local acquirer has never heard of.

Early in my time here I watched a repeat pattern in the failed-payment logs: a customer in Melbourne would try three times with the same Commonwealth Bank Visa, get declined each time, and then message support saying “your site is broken.” The card was fine. What was happening was a 3D Secure timeout — the Australian bank was sending the OTP by SMS to the customer’s Sri Lankan-registered phone number (their old one), not the Australian one they now used. The gateway saw no OTP response inside its window and auto-declined.

The fix wasn’t a gateway switch. It was a combination of: adding a “having trouble? try another card or contact us” nudge on the second failure, capturing the failure reason code so support could tell the customer exactly what to fix, and enabling a non-3DS fallback for a narrow list of trusted international BINs where the issuer bank had explicitly allowed it. Recovery rate on international failed payments went up noticeably in the following weeks.

The takeaway isn’t “PayHere bad” or “WebXPay good.” It’s that any gateway’s default configuration is tuned for the majority local case, and if you have a meaningful diaspora tail — as most Sri Lankan ecommerce stores do — you have to actively tune 3DS behaviour, retry logic, and failure messaging. That work sits with you, not the gateway.

For the customer-facing side of this same problem, we’ve written a longer walkthrough on handling overseas card payment issues that you can point diaspora customers to.

How do you choose the right gateway for your Sri Lankan store?

1. List the cards and rails you must accept. If a big chunk of orders come from abroad, foreign-card handling is a top-3 criterion. If you’re purely local, LankaQR and local wallet coverage matter more than Amex.
2. Check the settlement cycle against your payables. Match gateway T+N to your supplier payment days so you’re not funding working capital out of pocket.
3. Ask three current merchants (not the sales rep) about failure rates. Real merchants will tell you what percentage of attempts silently fail. Sales decks will not.
4. Read the chargeback and refund workflow. How is a chargeback notified? What evidence format is accepted? How long do refunds take to hit the customer’s card? (Usually 7–14 working days in Sri Lanka.)
5. Check the plugin or SDK against your stack. If you’re on WooCommerce and the gateway’s plugin was last updated 18 months ago, that’s a signal.
6. Negotiate. Published rates are opening positions. Volume, category, and average order value all move the number.

Broader trust and checkout hygiene matter alongside the gateway itself — we’ve covered that from the shopper’s angle in how to shop safely online in Sri Lanka, and the merchant-side version is basically the mirror image of the same checklist.

Frequently asked questions

Is Stripe available in Sri Lanka?

Stripe does not directly onboard Sri Lanka-registered businesses as of writing. Merchants sometimes route through a foreign entity, but that adds compliance and FX complexity — a local gateway is almost always the simpler answer.

What is the typical transaction fee for a Sri Lankan payment gateway?

Public rates for local Visa and Mastercard ecommerce transactions in Sri Lanka usually sit between 2.5% and 3.5% per transaction, plus a small fixed fee. Amex and foreign-issued cards attract higher rates. Volume-based negotiation is normal.

How long does it take for money to settle into my bank account?

Most Sri Lankan gateways settle T+2 to T+3 working days. Bank-run gateways paying into their own bank can settle T+1. Public holidays and weekends extend the cycle, so a Thursday sale before a long weekend often lands the following Wednesday.

Do I need PCI DSS certification if I use a hosted payment gateway?

If you use a hosted checkout where customers are redirected to the gateway to enter card details, your PCI scope is minimal and usually satisfied by a short self-assessment questionnaire. Handling card data directly on your own site triggers full PCI DSS obligations.

Can I accept LankaQR through any ecommerce gateway?

Most active Sri Lankan gateways now support LankaQR because it settles through LankaClear’s national rails. Confirm with the specific gateway before launch, and check whether QR transactions settle on the same cycle as card payments — sometimes they don’t.

How are chargebacks handled by Sri Lankan gateways?

The gateway notifies you when a cardholder disputes a transaction, pulls the funds from your next settlement immediately, and gives you a fixed window (usually 7–14 days) to submit evidence. Cardholders have up to 120 days from the transaction to raise a dispute.

Related reading on Kapruka

• Handling overseas card payment issues — the customer-facing view of the same 3D Secure and foreign-card problems merchants deal with.
• How to shop safely online in Sri Lanka — the trust and checkout checklist from the shopper’s side.
• If you’re a diaspora shopper (rather than a merchant) trying to place an order and hitting payment errors, Kapruka customer support can help resolve card and delivery issues directly.

Choosing among ecommerce payment gateways in Sri Lanka is less about finding one “winner” and more about matching a gateway’s strengths — local wallet reach, international card handling, settlement speed, integration effort — to the shape of your own order book. Start with two or three that fit, run a pilot, and let the failure logs make the final call.

About the author

Akthar is the Digital Marketing Manager at Kapruka Holdings PLC.

He has spent over four years at Kapruka working across marketing analytics, customer experience, and operations — with direct involvement in diaspora gifting logistics, payment integrations, and customer support workflows. The perspectives in his writing come from running these systems day to day, not from theory.

You can reach Akthar by email or connect with him on LinkedIn.