By: Staff Writer
May 07, Colombo (LNW): Sri Lanka’s $2.5 million Treasury fraud investigation has entered its decisive phase, uncovering troubling evidence that points beyond a simple administrative lapse to a broader systemic failure. At the center of the controversy is the Central Bank of Sri Lanka, now facing mounting scrutiny over its role during a critical transition in public debt management.
The fraud, carried out through a sophisticated Business Email Compromise (BEC) scheme, saw cybercriminals impersonate officials from the Australian Export Finance Agency. Using a deceptive domain, attackers diverted funds intended for debt repayment into foreign accounts. The transfers, totaling nearly $2.5 million, reportedly occurred in multiple tranches over several months without detection.
Former Finance Minister Ravi Karunanayake has strongly rejected claims that the incident was confined to the Treasury’s recently established Public Debt Management Office (PDMO). He argues that the majority of fraudulent transactions occurred before January 2026, when the Central Bank still directly oversaw such operations through its Public Debt Department.
According to Karunanayake, seven out of ten identified fraudulent transactions were executed under the Central Bank’s watch in late 2025. Only three took place after responsibilities were formally transferred to the Treasury. This timeline raises serious concerns about oversight failures during a sensitive institutional handover.
The Central Bank’s continued control over key systems, including LankaSecure and the Scripless Securities Settlement System, further complicates the issue. Despite providing technical guidance and training to Treasury staff, basic cybersecurity protocols such as verification checks and multi-factor authentication appear to have been overlooked.
The scandal has also taken a tragic human toll. An interdicted Assistant Director from the External Resources Department died in Kuliyapitiya, in what authorities have described as a likely suicide following intense questioning by the Criminal Investigation Department.
With Sri Lanka navigating a delicate economic recovery and maintaining commitments to international creditors, the implications are severe. Confidence in financial governance particularly among institutions like the International Monetary Fund could be shaken if accountability is not established.
As the probe nears completion, the emerging narrative suggests not just a cybercrime, but a breakdown in institutional safeguards at the highest levels.