A Familiar Pattern, A New Frontier
For years, Cambodia earned a grim reputation as the epicenter of a sophisticated and brutal cybercrime industry. Sprawling compounds along the Thai and Vietnamese borders became fortresses of fraud, where trafficked workers — many lured by false promises of legitimate employment — were forced to run romance scams, cryptocurrency fraud, and elaborate online cons targeting victims across the globe. The scale was staggering, the human cost devastating.
But pressure mounts. International condemnation, diplomatic interventions, and targeted crackdowns by Cambodian authorities have forced these criminal networks to adapt. And when criminal enterprises adapt, they look for the next place willing — or simply unable — to say no. Increasingly, that place may be Sri Lanka.
How the Cybercrime Compound Model Works
To understand the threat facing Sri Lanka, it helps to understand the business model that made Cambodia's cybercrime industry so resilient and so dangerous.
Cybercrime compounds operate like dark mirror versions of business process outsourcing centers. Organized criminal groups — many with ties to Chinese syndicates — acquire or rent large properties, often in jurisdictions with weak rule of law or corruptible officials. They then recruit workers through deceptive job advertisements promising call center roles, marketing positions, or IT jobs in Southeast Asia. Victims travel voluntarily at first, only to have their passports confiscated upon arrival.
Once inside the compound, workers are compelled to execute scam operations under threat of violence, debt bondage, or sale to other criminal groups. The scams themselves are sophisticated: long-con "pig butchering" schemes that cultivate romantic or financial trust with victims over weeks before stealing their savings, often through fake investment platforms. A single well-run compound can generate tens of millions of dollars annually.
When one country becomes too hot, the networks simply relocate — to Myanmar, Laos, the Philippines, or wherever the conditions allow them to operate with minimal disruption. The question now is whether Sri Lanka is positioning itself, deliberately or by default, as the next viable destination.
Why Sri Lanka Is on the Radar
Sri Lanka is not an obvious candidate for cybercrime infrastructure — and that, ironically, may be part of its appeal. The island recently emerged from a catastrophic economic crisis that gutted foreign reserves, weakened institutional capacity, and created a population desperate for economic revival. Foreign investment, in any form, can carry political weight when jobs and dollars are scarce.
Researchers and regional security analysts have noted a growing presence of foreign nationals — predominantly from China — establishing businesses in Sri Lanka under opaque corporate structures. Some of these operations have raised red flags: unusual security arrangements, restricted access to premises, and workers with limited freedom of movement. Not all of these represent cybercrime compounds, but the pattern is recognizable to those who watched Cambodia's transformation a decade ago.
Sri Lanka's geographic position also matters. It sits at a key Indian Ocean crossroads, has relatively modern telecommunications infrastructure, and — until recently — lacked specific legislative frameworks targeting the kinds of fraud and human trafficking that fuel cybercrime compound operations.
The Stakes for Sri Lanka
What happens next will determine whether Sri Lanka becomes a temporary refuge for criminal networks in transit, or whether it becomes embedded in Asia's permanent cybercrime infrastructure. The difference between those two outcomes is enormous — and the window to influence that outcome may be narrowing.
Countries that become fully integrated into cybercrime networks face consequences that extend far beyond law enforcement challenges. They become subject to international sanctions and financial watchlist designations, such as those issued by the Financial Action Task Force (FATF). These designations make legitimate banking relationships more difficult, deter genuine foreign direct investment, and impose significant reputational damage that takes years to undo. Myanmar and Cambodia have both experienced this firsthand.
There are also profound human rights implications. Once trafficking networks take root, the victims are not only foreign workers brought in to operate scam centers — local populations become targets for recruitment, exploitation, and coercion as well. Communities near compound sites often face intimidation, and local officials can find themselves under pressure to look the other way.
What an Effective Response Looks Like
Sri Lanka is not without agency in this situation. Several policy and enforcement levers, if activated decisively, could significantly reduce the island's vulnerability to becoming a cybercrime hub.
- Strengthening anti-trafficking legislation: Updating and enforcing laws specifically designed to target the recruitment, transportation, and exploitation of victims for cyber fraud operations closes legal loopholes that criminal networks rely upon.
- Enhancing corporate transparency: Requiring meaningful beneficial ownership disclosure for businesses established by foreign nationals would make it significantly harder to establish shell operations masking criminal enterprises.
- Regional intelligence sharing: Coordinating with Cambodia, Thailand, the Philippines, and international bodies such as Interpol allows Sri Lankan authorities to identify networks and individuals already flagged in other jurisdictions before they establish a foothold.
- Training financial intelligence units: Many compound operations rely on local money laundering channels. Building capacity within Sri Lanka's financial intelligence infrastructure to detect unusual transaction patterns is critical.
- Protecting economic desperation from exploitation: The economic crisis created vulnerabilities that criminal recruiters actively exploit. Public awareness campaigns targeting job seekers — particularly those considering offers abroad — can reduce the supply of trafficked labor.
A Test of Institutional Will
Cambodia's partial crackdown demonstrates something important: when governments apply sustained pressure, criminal networks do move. But it also demonstrates something sobering — they simply move somewhere else. The underlying criminal infrastructure, the profit motive, and the demand for scam labor do not disappear. They migrate.
Sri Lanka now faces a test that is fundamentally about institutional will. The country has experienced enough external shocks in recent years to understand what systemic vulnerability looks like. Allowing cybercrime networks to embed themselves would not merely invite a law enforcement problem — it would introduce a structural corruption of governance, finance, and civil society that compounds are specifically engineered to create and sustain.
The island's response in the coming months and years will be watched closely — by international partners hoping to see a success story, by criminal networks probing for weakness, and by the potential victims on both sides of the scam: the workers who might be trafficked there, and the ordinary people around the world who would become their targets.
Asia's cybercrime geography is being redrawn. Sri Lanka still has a chance to ensure it is not part of that map.