The forensic investigation into the fraud at National Development Bank has produced its final number: Rs 13.64 billion. Customers have not lost their money and the bank remains well capitalised. But when that much money can disappear inside a regulated bank, the bigger question is how the controls allowed it to happen.
The number is Rs 13,639,664,684. It is worth writing it out because Rs 13.64 billion can otherwise become one of those enormous figures that is reported, absorbed and eventually forgotten.
Deloitte’s final forensic investigation into the fraud at National Development Bank has established a figure slightly higher than its interim finding of approximately Rs 13.58 billion, which itself exceeded the roughly Rs 13.2 billion initially disclosed. NDB says no customer has suffered a loss, customer balances remain intact and the bank continues to be well capitalised and liquid.
Submit Your Press Release
Get your company news, announcements, launches, appointments and events in front of a wider audience.
Although one would have presumed that the Board who ultimately ought to share responsibility appear to be left out of the ‘blame’. More amazing things have probably taken place at sea.
Those assurances are important. There is no basis from what has been disclosed to suggest that NDB depositors should fear for their money, but that cannot be allowed to obscure the extraordinary governance question sitting behind this affair.
How does Rs 13.64 billion disappear through a regulated bank? Were the Board of Directors ‘Bored’ or simply non-chalant or whatever else?
Banks are supposed to be difficult places from which to steal money. They are surrounded by authorisation procedures, transaction limits, reconciliations, compliance systems, internal audit, external audit, digital records and layers of management supervision.
That architecture exists for a reason. Banking is ultimately a business built upon trust, and depositors trust not merely the institution but the regulatory and governance system standing behind it.
The disturbing aspect of the NDB affair is therefore not simply the amount involved. The bank has said action is being pursued against persons identified in connection with collusion, inadequate supervision and control failures that facilitated the fraudulent activity.
That immediately takes the story beyond the convenient explanation of a rogue individual.
There were controls. The controls failed. There were supervisors. Supervision failed somewhere. There was technology designed to identify unusual activity, yet an extraordinary amount of money passed through the system before the fraud was finally discovered.
The timeline makes those questions still more serious. Earlier financial disclosures indicated that approximately Rs 1.42 billion of the fraud related to periods before January 2025, about Rs 9.62 billion to 2025 and another Rs 2.55 billion to the first quarter of 2026.
This was therefore not a single spectacular transaction that slipped through the net. The activity crossed accounting periods, which raises unavoidable questions about reconciliation, exception reporting, internal audit and management oversight.
NDB has already paid a substantial financial price. Its previously reported 2025 post-tax profit of about Rs 11.04 billion had to be restated to approximately Rs 5.9 billion after the interim forensic findings were incorporated into the accounts.
The bank says criminal proceedings against those responsible are pending and that every available avenue is being pursued to recover the money. A specialist foreign agency has also been engaged to trace stolen funds and digital assets, while recommendations arising from Deloitte’s investigation are being implemented.
That is exactly what should happen.
But another institution now has questions to answer. The Central Bank regulates Sri Lanka’s banking system and was involved in the arrangements surrounding the independent forensic investigation. What does it conclude about the control environment that allowed this to happen, and are the weaknesses peculiar to NDB or capable of existing elsewhere?
There is a danger whenever a spectacular fraud is uncovered that attention concentrates upon catching the alleged perpetrators. That is essential, but it addresses only half the problem.
The other half is discovering why the door was open.
NDB has described the experience as a lesson learnt and says it intends to strengthen its compliance and governance framework. That is welcome, but Rs 13.64 billion is an extraordinarily expensive lesson.
Sri Lanka’s banking system now deserves to know precisely what was learnt from it.
