The parliamentary Committee on Public Finance has exposed serious weaknesses in the systems that allowed Rs. 13.6 billion to disappear from National Development Bank. MP Ravi Karunanayake’s questioning about the number of transactions, reportedly approaching 3,600, raises an even more troubling issue. If money moved through Sri Lanka’s interconnected banking system, what did the receiving banks see, what should they have detected, and why has there not been a publicly disclosed, system-wide reconstruction of the money trail?
Sri Lanka’s banking establishment has a problem considerably larger than the Rs. 13.6 billion fraud at National Development Bank. The problem is whether the country’s elaborate network of financial controls, electronic payment systems, compliance officers, auditors and regulators is capable of detecting suspicious transactions before billions disappear. The latest proceedings before Parliament’s Committee on Public Finance have brought that question into sharp focus, and the answers provided thus far leave considerable room for further investigation.
During the hearings, MP Ravi Karunanayake pressed the authorities on the number of transactions associated with the fraud. His questioning pointed towards an aggregate approaching 3,600 transactions, a figure that requires confirmation against the underlying forensic records. If established, that number would transform the public understanding of this affair from a substantial financial theft into a sustained sequence of transactions that apparently escaped effective detection over an extended period.
Submit Your Press Release
Get your company news, announcements, launches, appointments and events in front of a wider audience.
The distinction matters enormously. A single fraudulent transaction might exploit an isolated weakness, but thousands of transactions raise questions about monitoring systems, reconciliation procedures, transaction patterns and the ability of financial institutions to recognise unusual activity. The forensic investigation has already identified weaknesses involving Common Electronic Fund Transfer transactions, the bank’s core banking system, access credentials, internal audit and financial controls. The Central Bank Governor himself acknowledged before the committee that individuals implicated in the wrongdoing had also been providing explanations to those responsible for oversight.
There is, however, another dimension that deserves immediate attention. Electronic fund transfers do not necessarily end where they begin, and the banking system is designed to move money between institutions with remarkable speed. Where funds leave one bank and enter another, the receiving institution ordinarily maintains records of the transaction, the beneficiary and the relevant account. That does not automatically make the receiving bank complicit in fraud, but it creates an identifiable trail that investigators should be capable of following.
This is where the NDB affair becomes a matter of wider national concern. If the reported thousands of transactions involved transfers to accounts maintained at other commercial banks, those institutions may hold information essential to understanding how the money was dispersed, accumulated, withdrawn or transferred onwards. The public has yet to receive a sufficiently detailed explanation of the destinations of the funds, the number of beneficiary accounts involved and whether suspicious transaction monitoring systems at receiving institutions generated alerts.
It would be wrong to conclude, without evidence, that other banks knowingly participated in the fraud. There is a fundamental difference between processing a transaction through an established payment network and knowingly facilitating criminal activity. Nevertheless, the absence of evidence of deliberate wrongdoing by another bank does not settle the question of whether its monitoring and compliance arrangements functioned as intended.
Indeed, that distinction makes the case for a wider investigation considerably stronger. A receiving bank might have acted entirely within its ordinary operational procedures while nevertheless failing to identify suspicious patterns that should have prompted further examination. Equally, it may have detected unusual activity and submitted reports to the appropriate authorities. Both possibilities deserve examination, and neither can be established simply by reviewing what happened inside NDB.
The Central Bank has previously stated that there was no evidence of another regulated financial institution suffering a loss arising from the NDB incident. That assurance is important, particularly for maintaining public confidence in the banking system. But it answers a different question from whether other institutions processed funds associated with the fraud, whether they identified suspicious activity or whether their internal controls operated effectively.
The scale of the financial loss makes the chronology especially significant. According to the final forensic findings, approximately Rs. 1.5 billion of the fraudulent transactions occurred before January 2025, another Rs. 9.6 billion during 2025 and approximately Rs. 2.5 billion in the first quarter of 2026. The forensic review covered the period from April 2016 to March 2026, although that does not establish that fraudulent activity occurred continuously throughout those ten years. What is established is that substantial losses accumulated across successive reporting periods without the bank’s control mechanisms preventing them.
The concentration of Rs. 9.6 billion in 2025 is particularly striking. This was not an insignificant discrepancy buried somewhere in a minor ledger account. It represented an enormous financial exposure within a regulated banking institution whose accounts were subject to management oversight, internal audit, external audit and regulatory supervision. Yet the fraud continued, and the explanations apparently provided to those responsible for detecting irregularities were accepted for long enough to allow the losses to accumulate.
Parliament has been told that weaknesses extended across transaction monitoring, daily reconciliation, compliance and the management of access credentials. These findings suggest that the problem cannot reasonably be reduced to the misconduct of a few employees without examining the institutional environment in which they operated. Criminal responsibility must be established through evidence and due process, but responsibility for governance and control failures is a separate matter that cannot simply be transferred down the organisational hierarchy.
The question of transactions reportedly conducted during weekends deserves particular scrutiny. Modern electronic payment systems are capable of operating outside conventional banking hours, and weekend processing is not inherently suspicious. But transactions occurring when ordinary staffing and supervision arrangements differ may create additional vulnerabilities, particularly where access privileges, transaction authorisations and subsequent reconciliations are inadequately controlled.
Investigators should therefore establish whether suspicious transactions were concentrated during weekends or public holidays, whether transaction limits were circumvented and whether the same individuals exercised incompatible responsibilities. They should also determine whether automated alerts were generated and, if so, who received them and what action followed. These are questions that can be answered through system logs, payment records and audit trails rather than speculation.
There is also the matter of the money itself. Previous parliamentary disclosures have raised concerns that some funds associated with the NDB fraud may have been transferred overseas through transactions presented as legitimate commercial payments. If that connection is substantiated, the investigation must extend beyond domestic receiving accounts to foreign remittances, the documentation supporting those transfers and the institutions responsible for examining them.
The Treasury should now take a direct interest in ensuring that the various strands of this investigation are brought together. The Central Bank remains the banking regulator, and criminal investigators retain their statutory responsibilities, but the Ministry of Finance has a legitimate interest in the implications for financial stability, public investments and the integrity of the country’s financial system. Parliament has already noted that institutions representing public and State funds hold a significant proportion of NDB’s shares.
A coordinated review involving the Central Bank, the Financial Intelligence Unit, LankaPay and the relevant investigative authorities could establish the complete transaction chain, subject to the legal safeguards governing confidential financial information. Such an exercise should identify the originating accounts, receiving institutions, ultimate beneficiaries, subsequent transfers and any transactions that crossed national borders. It should also determine whether existing reporting obligations were met and whether the financial intelligence generated by the system was properly examined.
Importantly, this need not become another exercise in appointing a committee to investigate what previous committees have already investigated. The forensic review has been completed, Parliament has examined its findings and the principal control failures have been identified. What is now required is an authoritative account of how the money travelled and whether the weaknesses uncovered at NDB reveal vulnerabilities elsewhere in the financial system.
The recent Commercial High Court dismissal of a minority shareholder’s application concerning the fraud does not dispose of these questions. That decision concerned whether the applicant had established the legal requirements to pursue proceedings independently of the bank. It was not a judicial determination that the underlying governance arrangements were satisfactory or that the wider financial system had nothing further to explain.
There is an additional issue of public accountability. If thousands of transactions were involved, the authorities should be able to explain how many were internal accounting entries, how many involved transfers between banks and how many resulted in withdrawals, onward transfers or overseas remittances. The distinction is essential because an internal manipulation of accounting records may create a very different investigative trail from an actual transfer of funds to an external beneficiary.
Be that as it may, the public is entitled to something more substantial than repeated assurances that customer deposits remain safe. Those assurances are welcome, and there is no reason to manufacture a banking panic. But confidence in the financial system depends not merely on the ability of banks to absorb losses; it depends on their ability to prevent wrongdoing, identify suspicious activity and hold those responsible for failures to account.
Ravi Karunanayake’s questioning has opened an important line of inquiry, and the Committee on Public Finance, chaired by Dr. Harsha de Silva, should pursue it to its logical conclusion. If approximately 3,600 transactions were involved, the country deserves to know where they went, how many institutions processed them and whether the systems designed to detect suspicious financial activity worked as intended.
The Treasury should not attempt to replace the investigators or the regulator. It should, however, insist that the findings are assembled into a coherent account of what happened across the financial system and that any weaknesses requiring legislative, regulatory or institutional reform are addressed.
The money did not simply evaporate. The accounting entries, electronic instructions and banking records must tell a story. The responsibility of the authorities is to establish precisely what that story is, including whether anyone beyond NDB knowingly assisted the fraud or whether other institutions merely processed transactions without recognising their significance.
The Rs. 13.6 billion has already been lost. The greater failure would be to investigate only the institution from which it disappeared while neglecting the financial pathways through which it may have travelled.
EDITORIAL VERIFICATION NOTE – NOT FOR PUBLICATION
The official parliamentary account confirms the Rs. 13.639 billion figure, the forensic findings and the governance failures. Reporting on the COPF hearing also confirms the Central Bank Governor’s explanation of how those implicated supplied misleading assurances to multiple layers of oversight.
Two points warrant particular care before publication. First, I have not independently verified the figure of approximately 3,600 transactions from the available published proceedings. It is therefore attributed to Ravi Karunanayake’s questioning rather than presented as an established forensic finding. Second, there is currently no verified basis for stating that several other banks knowingly participated in the fraud. The Central Bank’s published position was that there was no evidence of another regulated institution suffering a loss. That does not exclude other banks having processed transfers.
The strongest investigative distinction is between participation in the payment chain, failure to detect suspicious activity and knowing criminal complicity. Establishing the first does not prove the other two. That distinction makes the call for a system-wide transaction reconstruction both more credible and harder to dismiss.
Suggested accompanying graphic headline:
NDB’S RS. 13.6 BILLION FRAUD. 3,600 TRANSACTIONS? HOW MANY BANKS HANDLED THE MONEY?
The parliamentary investigation has exposed serious failures at NDB. Now the Treasury must ensure the authorities trace the money through the banking system and establish whether other institutions missed warning signs.
