Sri Lanka has never seen anything quite like this. 13.2 billion in rupees. Vanished. Roughly two thousand six hundred transactions, each carefully structured at around five million rupees apiece, bleeding through one of the country’s most prominent banks over months perhaps an entire year before anyone, apparently, said a word. The NDB fraud is not merely the largest banking scandal in this nation’s history. It is a wound that demands an honest reckoning with a question that no one in authority seems willing to ask aloud: was this catastrophic negligence, or was it something far darker?
The Criminal Investigation Department is conducting inquiries. Some minor operational figures have reportedly been called in for questioning. And yet, a deeply uncomfortable silence surrounds the larger picture. There is no visible sign that investigators are approaching this with the structured, hypothesis-driven rigour that a fraud of this staggering sophistication demands. That silence is not reassuring. It is alarming.
To understand why, one must appreciate what this fraud actually bypassed on its way to completion. It did not slip through a single crack in the wall. It sailed through operational controls, risk management systems, internal audit mechanisms, board and audit committee oversight, external auditors, regulatory supervision, and Financial Intelligence Unit monitoring all of them, apparently, without triggering a decisive intervention. Every layer of institutional defence that is supposed to exist precisely to prevent something like this either failed, looked away, or said nothing. The question that must now be answered with cold, forensic precision is whether those failures were independent of one another, or whether something or someone made sure they would be.
Three hypotheses must be placed on the table simultaneously, and none must be favoured prematurely. The first is pure systemic failure: a cascade of independent breakdowns, no coordination, no intent, just the compounding consequence of complexity, fragmentation, and dangerously delayed detection. Institutions failing in isolation, each unaware of the others’ blindness. The second is targeted, premeditated collusion by a core group of insiders who engineered the fraud from within while the outer layers of control failed passively, entirely unaware of the grand design being executed beneath them. The third and the one that the scale, duration, and structure of this fraud make impossible to dismiss is something more chilling: coordinated suppression across multiple institutions, where several actors, each knowing only what they needed to know, collectively ensured that red flags were not raised, not escalated, or quietly buried.
That third hypothesis deserves to be stated plainly. Repetition, in fraud, is the enemy of concealment. The more times a suspicious pattern recurs, the more opportunities exist for detection. And yet here, approximately two thousand six hundred transactions repeated the same structure, across the same channels, over an extended period, and the system did not stop it. That is not the fingerprint of accident. That is the fingerprint of design. Transaction structuring this deliberate, fund layering this sophisticated across multiple institutions, silence this consistent across this many control points these are not the characteristics of an unfortunate institutional oversight. They demand the hypothesis that someone, somewhere, knew exactly which levers to pull and which mouths to keep shut.
What is needed now is not a routine investigation. It is an Evidence Grid a structured, disciplined, and comprehensive forensic framework that maps every control point across every institution against a single devastating question: where did knowledge exist, and what action, or inaction, followed?
At NDB itself, investigators must ask whether the transaction patterns were internally visible and overlooked, whether system logs and user access trails were tampered with or deleted, whether risk and compliance units generated alerts that were then silenced, whether Suspicious Transaction Reports were considered and suppressed, whether internal audit reports flagged anomalies that were then buried, and whether the Board and Audit Committee were ever told or deliberately not told what was happening beneath them. At Ernst and Young, the external auditors, the questions are equally pointed: were these anomalies detectable through standard audit procedures, were direct external confirmations obtained, and do the working papers reflect genuine diligence or a troubling absence of it? At the recipient banks, investigators must establish whether unusual inflow patterns triggered any monitoring alerts, whether KYC obligations were genuinely fulfilled, and whether suspicious accounts were flagged or quietly accommodated. At the Financial Intelligence Unit and the Central Bank’s supervisory division, the record of STR filings, pattern detection, examination reports, and supervisory correspondence must be laid bare.
Any single one of the following findings should be treated as a thunderclap: repeated alerts across multiple layers overlooked without escalation, identical patterns of non-action appearing simultaneously at several institutions, manual overrides executed without justification, audit observations pursued only to be deliberately diluted, FIU queries raised but never followed through, or material inconsistencies between internal institutional records and publicly reported data. Even one of these findings, standing alone, would be significant. A constellation of them would point unmistakably toward coordinated suppression.
To operationalize this, investigators must reconstruct the complete transaction timeline from origin to final destination including any crypto conversion channels map every control point at which detection should have occurred, compile a complete dossier of alerts, reports, and actions taken or not taken, and most critically map the knowledge flow: who knew what, and precisely when did they know it.
The current investigation cannot remain where it is. Placing a financial crime of this calibre this technically complex, this institutionally layered, this potentially conspiratorial exclusively in the hands of the CID, which plainly lacks the financial forensics expertise and administrative sophistication this demands, is itself a failure of governance. What is required immediately is a multi-agency investigative team, technically knowledgeable, placed under the direction of an independent, street-smart, and genuinely fearless individual accountable to no institutional interest implicated in this affair. The Evidence Grid must be formally adopted as the primary investigative instrument. Every institution and every individual directly involved, peripherally involved, or even unknowingly involved must be compelled to produce complete records, evidence, and sworn statements. And all technical findings must be independently reviewed, perhaps by the Auditor General, to ensure they cannot be quietly undermined from within.
Because here is the truth that hangs over all of this: a fraud of this magnitude does not happen, and does not succeed, in a vacuum. It requires either a catastrophic simultaneous failure of every institutional safeguard this country has built or it requires a Mastermind, or several, who understood those safeguards intimately enough to neutralize them one by one, layer by layer, institution by institution, in coordinated silence.
Dismissing that possibility too early would be a betrayal of public trust and a gift to whoever is responsible. Assuming it without evidence would misdirect justice. What is demanded, therefore, is neither assumption nor dismissal it is rigorous, structured, hypothesis-neutral investigation, driven by evidence, and shielded from interference.
And if that investigation is not conducted with the full depth and independence it requires, one cannot help but ask the final, most unsettling question of all: could the tentacles of the Mastermind reach far enough, and run deep enough, to misdirect or quietly scuttle even that?
Only time will tell. But time, in this matter, is not a luxury Sri Lanka can afford.
