How to Do Background Checks on Employees in Sri Lanka

To do a background check on an employee in Sri Lanka, obtain the candidate's written consent as required under the Personal Data Protection Act, collect identity and qualification documents, select checks that match the role, verify each claim directly with employers, universities, and official registries, then compile the findings into a report and act on them fairly.

Done properly, screening is neither slow nor complicated—but the steps have to happen in the right order, and the consent step is not optional. This guide walks through the full process, the documents involved, and the choices you will need to make along the way.

Why Employers in Sri Lanka Screen Before They Hire

Hiring on trust alone is expensive. A bad hire can cost up to 30% of the employee's first-year potential earnings once you account for recruitment, training, lost productivity, and replacement. And the risk is not rare: an estimated 40–50% of resumes contain some inaccuracy or exaggeration, from stretched job titles and inflated tenure to qualifications that were never earned.

Screening protects more than the budget. It reduces compliance exposure in regulated industries, protects colleagues and customers from safety risks, and shields your brand from the reputational damage a fraudulent hire can cause. That is why background verification services in Sri Lanka have moved from a nice-to-have for large corporates to standard practice for growing businesses of every size.

Step 1: Obtain Written Candidate Consent

Background verification is fully lawful in Sri Lanka, but it is governed primarily by the Personal Data Protection Act (No. 9 of 2022). There is no single dedicated "background check" law—instead, the PDPA sets the ground rules for how you collect, process, and store a candidate's personal data. The most important rule is simple: you must obtain the candidate's consent before running any checks.

In practice, that means a written consent form signed before verification begins. A good form names the specific checks you intend to run, explains why the data is being collected, states who will process it, and tells the candidate how long the information will be retained. Blanket or buried consent clauses are a poor substitute—make the authorization explicit and keep a copy on file.

Step 2: Collect the Documents You Will Verify

With consent in hand, gather the source documents for each claim you plan to check. For most roles this means:

• Identity documents — National Identity Card (NIC) or passport
• Education certificates — degree, diploma, and professional certification copies
• Employment letters — service letters or experience certificates from previous employers
• Proof of address — a utility bill, bank statement, or Grama Niladhari certificate
• Reference contacts — names and details of professional referees

Collect documents through a secure channel rather than open email threads—a secure candidate document portal keeps sensitive data protected and gives you a clean record of what was submitted and when. For a role-by-role breakdown of exactly what to gather, see our pre-employment screening checklist for Sri Lankan employers.

Step 3: Choose the Checks That Fit the Role

Not every position needs every check. Matching the depth of screening to the seniority and risk profile of the role keeps the process fast and the budget sensible.

Entry-level roles

Identity and address verification plus a single professional reference is usually enough. This confirms the person is who they say they are and lives where they claim, without over-engineering the process for a junior hire.

Mid-level and specialist roles

Add employment history for the last two employers, education verification, a second reference, and a criminal record check. These are the roles where resume exaggeration is most common and where a fabricated qualification does real damage.

Executive and compliance-sensitive roles

Extend employment verification to the last three employers and add global sanction and watchlist screening plus statutory and registry checks. For directors, finance leaders, and anyone with signing authority, the cost of a missed red flag far outweighs the cost of a deeper check. For a closer look at how these tiers are typically priced, read our guide to background verification costs in Sri Lanka.

Step 4: Verify Every Claim Through Primary Sources

This is where most in-house efforts stall. Genuine verification means going back to the original source of each claim—not accepting the certificate or letter at face value:

1. Employment history — contact the HR department of each previous employer to confirm job title, tenure, and reason for leaving. See how professional employment verification works in practice.
2. Education — write to the registrar or examinations department of each university or institute to confirm the qualification, dates, and the institution's accreditation.
3. Criminal and legal records — check police and court records through the appropriate official channels.
4. Identity and address — authenticate the NIC or passport and, where needed, conduct a physical field visit to the stated address.
5. References — speak to referees directly and ask structured questions rather than accepting a written testimonial.

Doing this yourself is possible, but it is slow and error-prone. Registrars and HR departments respond faster to organizations they already know; an untrained coordinator can miss a forged certificate or accept a friend posing as a former manager. A professional BGV provider runs these checks in parallel through established primary-source channels—employment checks typically take 3–5 working days, education 4–7, criminal records 5–7, and identity or address 2–4—so a complete multi-check case can still close within 7 working days.

Step 5: Quality-Check and Compile the Report

Raw verification responses are not a report. Before anyone makes a hiring decision, the findings should be reviewed for accuracy, discrepancies should be clearly flagged and categorized, and every result should be traceable to its source. This is why mature screening operations use dual-analyst quality control—a second analyst independently reviews each case before release, which is how accuracy rates above 98% are sustained. The output should be a single, dated report your hiring managers can read in minutes, with the underlying evidence preserved as an audit trail.

Step 6: Act on the Findings Fairly

A discrepancy is not automatically a disqualification. A date that is off by a month may be a memory slip; a job title that differs slightly may reflect an internal restructure. Before withdrawing an offer, share the finding with the candidate and give them a genuine opportunity to explain. Apply the same standard to every candidate for the same role, document the reasoning behind your decision, and store the report securely with access limited to those who need it—consistent with your obligations under the PDPA.

Common Mistakes Employers Make

• Skipping written consent — running checks first and asking permission later creates avoidable legal exposure under the PDPA.
• Verifying documents instead of claims — a well-made forgery passes a visual inspection; only the issuing institution can confirm it is genuine.
• Screening after the start date — once an employee is onboarded, acting on adverse findings becomes far harder. Verify before the offer is confirmed.
• Using one-size-fits-all checks — over-screening juniors wastes money; under-screening executives invites serious risk.
• Letting checks run sequentially — running one check at a time can stretch screening into months. Checks should run in parallel.
• Keeping no audit trail — if a hire is ever challenged, you need dated evidence of what was verified, by whom, and what it showed.

DIY In-House vs. a Professional BGV Provider

Many companies start by screening in-house and switch to outsourced employee screening once volume or risk grows. Here is how the two approaches compare:

Get Screening Right From the First Hire

Employee background checks in Sri Lanka come down to six disciplined steps: consent, documents, the right checks for the role, primary-source verification, quality-controlled reporting, and fair decisions. If you would rather have a dedicated team handle it—with a dedicated account manager, a secure candidate portal, and complete cases in 7 working days—get in touch with Ontriq and we will scope the right screening program for your roles.