Sri Lankan police arrested 198 foreign nationals late on Monday, May 11, 2026, in a coordinated operation spanning the southern coastal resort towns of Galle, Hikkaduwa, and Midigama. The group comprised 173 Indian nationals and 25 Nepalese nationals, making it one of the largest single-day arrests of Indian citizens in the country's ongoing cybercrime enforcement drive. The operation forms part of a wider, sustained crackdown that Sri Lankan authorities have been conducting since the beginning of this year, targeting foreign nationals suspected of running digital fraud networks from within the country's borders.
The arrests have drawn significant attention, not only for the number of individuals involved but also for the legal charges being brought against them, a combination of immigration law violations and provisions under Sri Lanka's cybercrime legislation. Authorities say those detained will face prosecution rather than immediate deportation, a shift in enforcement posture that marks a firmer stance by the Sri Lankan government.
The Arrests: What Happened and Who Was Detained
The 198 individuals arrested, all aged between 25 and 35, will be charged with abusing tourist visas by overstaying and finding employment, possessing duty-free imported cigarettes, and engaging in activities covered under cybercrime laws, according to police. The locations of the arrest— Galle, Hikkaduwa, and Midigama are well-known tourism corridors along Sri Lanka's southern coast. Authorities have indicated that these areas, along with several Colombo suburbs, have increasingly been used as operational bases by foreign nationals who enter the country on short-term tourist permits before setting up digital fraud operations.
The latest arrests came shortly after last week's arrest of 250 Chinese nationals for the same offence. That operation, which took place across multiple locations in and around Colombo, similarly resulted in charges tied to visa violations and suspected cybercrime activity. Together, the two operations represent a significant escalation in Sri Lanka's enforcement activity within a matter of days.
Nationals from India, China, Vietnam, Myanmar, the Philippines, and Cambodia are among those who have been arrested in Sri Lanka's cybercrime crackdowns. The diversity of nationalities involved has led investigators to conclude that these are not isolated incidents but rather interconnected operations linked to organised international fraud networks.
A Pattern of Arrests: The Scale of Sri Lanka's 2026 Crackdown
The May 11 operation did not emerge in isolation. It is the most recent action in a crackdown that began gaining momentum in early 2026 and has steadily intensified month after month. Until May 5, 628 foreigners had been arrested in Sri Lanka since the start of the year for cybercrime operations while temporarily located in the country. With the 198 new arrests on May 11 and the 250 Chinese nationals detained the week prior, the cumulative figure of foreign nationals taken into custody in 2026 now exceeds 800. In just the first three months of 2026, arrests already exceeded 50 per cent of the total cases reported throughout 2025, reflecting an emerging pattern where increased enforcement in countries such as Cambodia is pushing these criminal networks towards Sri Lanka.
Earlier in May, on May 2, a targeted raid in Talangama, a suburb of Colombo, led to the arrest of 37 Chinese nationals. During that raid, officers from the Walana Central Anti-Corruption Unit and Thalangama Police seized 35 tablet computers, 147 mobile phones, and 100 SIM cards. Two suspects were found residing in the country without valid visas, while another individual did not possess a passport. In March 2026, Sri Lankan authorities arrested 134 foreign nationals during a joint operation involving army intelligence units and the Department of Immigration and Emigration. The group included 126 Chinese nationals, as well as individuals from Myanmar and Taiwan, initially linked to a suspected large-scale online scam network operating from multiple guest houses.
A separate operation in April 2026 saw 152 foreigners detained for allegedly running a cyber scam operation out of a hotel in Sri Lanka's northwest. In 2024 alone, Sri Lankan authorities had detained 230 Chinese nationals and 200 Indian nationals accused of operating cybercrime centres across the country, indicating that this is not a new problem but one that has been growing steadily.
Legal Framework: The Charges and Laws Being Applied
Sri Lankan authorities have been deliberate in the legal path they are taking with those arrested. Police said that foreign nationals found to be engaged in cybercrime will be prosecuted under domestic legislation rather than immediately deported. Police spokesman F.U. Wootler stated that offenders would face legal proceedings under Sri Lanka's Cybercrimes Act, with deportation to be considered only after the completion of judicial processes or in cases involving immigration violations. This is a meaningful distinction. In earlier phases of Sri Lanka's crackdown, several groups of foreign nationals including 135 Chinese nationals arrested in March 2026, were deported without full prosecution. The current approach signals a commitment to building legal cases against those detained rather than removing them from the country's jurisdiction before charges are tested in court.
The primary legal instruments being applied in these cases draw from several Sri Lankan statutes. Investigative powers in such cases are drawn from the Criminal Procedural Act of 1979 and the Computer Crimes Act No. 24 of 2007. Supporting legislation includes the Mutual Assistance in Criminal Matters Act No. 25 of 2002, amended in 2018, the Prevention of Money Laundering Act No. 5 of 2006, and the Financial Transactions Reporting Act No. 6 of 2006. The Computer Crimes Act, No. 24 of 2007, serves as the foundation of Sri Lanka's legal framework for addressing cybercrime. It criminalises unauthorised access to and modification of computer systems, as well as identity theft, fraud, and other digital crimes. It also targets the use of harmful software such as viruses and malware.
The Act establishes jurisdiction over offences committed both within and outside Sri Lanka's borders, covering cases where the computer system affected was located in Sri Lanka, where the facility or service used in the commission of an offence was situated in Sri Lanka, or where loss or damage was caused within or outside Sri Lanka to a person resident in the country. This broad jurisdictional reach has allowed Sri Lankan courts to take cognisance of cases where the fraud was directed at victims in other countries, even when carried out from within Sri Lanka. Computer Crime Act prosecutions are always held in the High Court before a judge and are not heard before a jury. The Cybercrime Unit within the Criminal Investigation Department handles such investigations, and the unit operates a fully functional digital forensics laboratory to examine seized devices. In addition to cybercrime charges, those arrested in the May 11 operation face charges under immigration law for overstaying tourist visas and taking up employment, offences that carry their own penalties under Sri Lanka's immigration statutes. The possession of duty-free cigarettes in quantities beyond permissible limits constitutes a further violation under customs regulations.
Officials say such groups are often part of wider international syndicates that target victims abroad using digital platforms and communication systems, and law enforcement agencies have noted that Sri Lanka's connectivity and visa access have likely contributed to making it vulnerable to such activities, with some suspects entering the country on short-term permits. The United Nations Office on Drugs and Crime has identified Southeast Asia as a major hub for a multibillion-dollar online scam industry, reporting that such operations involve hundreds of thousands of individuals, including both voluntary participants and victims of human trafficking. Sri Lanka, while not in Southeast Asia, has increasingly been drawn into this network geography as enforcement pressures push criminal operations into new jurisdictions.
As investigations continue and cases move toward the courts, the scale of Sri Lanka's 2026 crackdown now stands as one of the most significant law enforcement actions against foreign-run cybercrime networks in the region this year. The legal proceedings against the hundreds now in custody will be closely watched by both regional governments and international law enforcement bodies.
