Cyclone Ditwah and the Control Gaps a Disaster Opens

On 28 November 2025, Cyclone Ditwah made landfall in eastern Sri Lanka and triggered flooding and landslides across all 25 districts. By most measures the country’s worst flood disaster in two decades. The World Bank put direct physical damage at roughly $4.1 billion, about 4% of GDP, with total economic losses running $6–7 billion. Weeks later, UN agencies reported more than a million people, over half of them children, still needing humanitarian assistance.

To be clear at the outset, because this is a piece about disaster and money and the two together invite assumptions: nothing here alleges that fraud or relief-fund diversion occurred in Sri Lanka’s 2025 response. At the time of writing there is no public reporting establishing anything of the sort.

The point is structural. Disasters of this scale reliably open a specific, well-documented set of AML control gaps, whatever the jurisdiction and whatever the integrity of the people responding. FATF’s own guidance says as much, noting that natural disasters and resource scarcity tend to see an increase in predicate offences — corruption, fraud, related crimes — precisely because normal controls get suspended under pressure to move money and aid fast. Sri Lanka has been here before, too: relief funds after the 2004 Indian Ocean tsunami drew extensive corruption and mismanagement reporting from anti-corruption monitors and international media for years afterwards.

The pattern is the risk. So the question worth asking is what a KYC/AML programme can do structurally, before the next one.

Why disasters specifically break AML controls

Four things happen at once in almost every major response, and each strains a different part of a standard programme:

• Identity documentation gets destroyed or becomes inaccessible. Displaced people lose the physical IDs, utility bills and address proof standard CDD depends on, through no fault of their own, at exactly the moment they most need financial access.
• Money moves faster than verification can follow. Emergency cash transfers, mobile money disbursements and donor funds are built to move in hours. Onboarding and vendor-vetting cycles assume weeks.
• Oversight capacity is itself disrupted. Compliance staff, branch infrastructure and monitoring systems in the affected region are living through the same disaster as everyone else. Reduced headcount and degraded infrastructure arrive exactly when scrutiny needs to increase.
• Legitimate humanitarian flows spike alongside opportunistic ones. A genuine surge in NPO activity, charitable giving and government relief spending is perfect cover for the illegitimate version of the same thing — and FATF is explicit that overcorrecting carries its own cost, in disrupted aid that people depend on.

None of this is specific to Sri Lanka. The same pattern is documented after Hurricane Katrina, after the 2004 tsunami, and after most large-scale responses since. Which is exactly why it is a plannable weakness rather than a surprise every time.

A prevention framework: what a resilient AML programme does differently

1. Build the disaster protocol before the disaster. The biggest failure mode is improvising CDD exceptions in real time, under pressure, by whoever happens to be on shift. A resilient programme has a pre-approved, board-signed-off disaster CDD policy sitting on the shelf: what identity evidence is acceptable when standard documents are gone, who can authorise it, and for how long.

2. Calibrate CDD for displaced applicants instead of suspending it. The right answer to lost documentation is substitution, not omission. Biometric matching against pre-disaster records where they exist. Attestation plus a second independent data source — mobile carrier records, employer confirmation, community leader attestation as one factor among several. Or provisional accounts with hard transaction caps until standard documentation can be restored. A lower bar that is still a bar.

3. Ring-fence relief and NPO flows for visibility without freezing them. FATF’s guidance is explicit that enhanced monitoring should not mean disrupting humanitarian assistance. In practice that means tagging disaster-relief-linked accounts and corridors for closer automated monitoring and faster manual review. Not slower processing. Not blanket holds. A delayed relief payment can cost lives.

4. Screen reconstruction vendors like any other high-risk counterparty. Post-disaster reconstruction spending is where beneficial-ownership opacity and shell-company risk concentrate. Newly formed contracting entities winning outsized government or NGO contracts with no operating history deserve the scrutiny any new high-value corporate customer gets. Urgency is not a reason to skip it.

5. Apply targeted monitoring to cash-transfer and mobile-money channels. Government relief payments and mobile disbursements attract duplicate claims, ghost beneficiaries and agent-level skimming. Deduplication against national identity or beneficiary registries, plus monitoring rules tuned specifically for these corridors, catches that without making recipients clear onboarding hurdles they currently can’t.

6. Time-box every relaxed control so it expires on its own. Provisional accounts, relaxed thresholds and expedited vendor onboarding all carry a built-in review date — thirty, sixty, ninety days — after which the file is either brought to full standard or closed. Disaster-era controls that quietly become permanent are how a legitimate emergency measure turns into a standing vulnerability.

7. Agree a disaster posture with the FIU and regulator in advance. Ask your financial intelligence unit or regulator, the NCA and FCA in the UK or FinCEN elsewhere, before the next event: is there a disaster-specific reporting approach, an expedited SAR channel, sector-wide guidance for this scenario? A shared, pre-agreed position beats every institution guessing separately mid-crisis.

8. Run the look-back once the dust settles, and feed it back. Every account opened, every vendor onboarded, every relaxed-control decision made inside the disaster window deserves retrospective review once normal operations resume. The output isn’t only remediation of individual files. It is the next version of the protocol in step one, updated with what this particular event taught you.

The AI angle disaster response hasn’t reckoned with yet

Everything above predates generative AI, and there is now an exposure most guidance hasn’t caught up to.

Relaxed onboarding controls, built to get genuine disaster victims access to funds quickly, are also the friendliest environment imaginable for an AI-fabricated identity. A displaced person with no documents gets a deliberately lowered evidentiary bar, for good reason. A fabricated claimant with an AI-generated ID and a synthetic hardship story clears the same lowered bar, for a bad one. And disaster-era volume makes telling the second from the first considerably harder than it would be under normal conditions.

The same technology helps on the response side, though. Agentic AI systems suit exactly the triage step three describes — flagging disaster-linked accounts and corridors for closer review without slowing the transactions that are genuinely urgent. Built and tested beforehand, the way step one recommends, that is a real mitigation. Built for the first time during the crisis, it automates a bad judgment call at scale just as readily as a good one.

The broader point for anyone building AML judgment

Disaster response is where a programme’s risk-based approach gets tested against a scenario the standard playbook was not written for.

An analyst who understands why controls bend under that pressure, and can tell a deliberately designed exception from an uncontrolled one, is bringing the kind of judgment this space is short of. The technical controls matter. But the underlying skill is the same one that shows up everywhere else in KYC/AML: knowing which corners can be cut safely, which can’t, and being able to explain the difference in writing.

Further reading:

• Sri Lanka: Floods and Landslides, November 2025 — ReliefWeb
• More than a million still need aid weeks after Ditwah floods — UN News
• World Bank / ILO reporting on Cyclone Ditwah’s economic impact — WSWS
• FATF Recommendations and guidance on NPOs, humanitarian assistance, and financial inclusion — fatf-gafi.org