By Adolf
The derivative action now before the Commercial High Court against the board of National Development Bank PLC and its auditors Ernst & Young may become one of the most consequential governance cases in Sri Lanka’s banking history.
The issue is no longer merely about a Rs. 13.2 billion fraud. The larger question is whether directors of systemically important financial institutions can be held personally accountable for prolonged governance failures, weak oversight, and breakdowns in internal controls. In simple terms, can directors lose not just reputations, but potentially their personal financial protection and legal standing?
A derivative action is rare in Sri Lanka. It allows shareholders to sue on behalf of the company when they believe the board itself has failed to act in the company’s best interests. That alone signals the seriousness of the allegations. The petition paints a troubling picture: prolonged concentration of duties in a sensitive settlements role, inadequate segregation of responsibilities, weak system controls, suspicious growth in suspense account balances, and alleged failures to react even after an earlier fraud warning emerged.
If proven, these are not ordinary operational lapses. They strike at the heart of fiduciary responsibility. Directors of banks are not ceremonial figures. They are custodians of depositor confidence, shareholder value, regulatory trust, and systemic stability. Banking boards are expected to exercise a far higher standard of diligence than ordinary corporate boards because they oversee institutions that operate largely on public trust.
The most damaging aspect may not ultimately be the fraud itself, but the allegation that warning signals were visible over a prolonged period. An eightfold increase in a suspense account should ordinarily trigger heightened scrutiny from management, the Board Audit Committee, the Risk Committee, internal audit, compliance functions, and external auditors. Questions naturally arise: Who asked the difficult questions? Who challenged management explanations? Were board papers sufficiently interrogated? Was there overreliance on management assurances?
The case also puts the spotlight on the evolving role of independent directors. Regulators increasingly expect directors to demonstrate active oversight rather than passive attendance. Modern governance standards require directors to understand technology risk, cyber vulnerabilities, operational resilience, anti-money laundering controls, and data governance. Banking today is as much about digital risk as financial risk.
Importantly, the legal threshold for personal liability is high. Courts generally distinguish between business judgment errors and reckless negligence. Directors are not insurers against every fraud. Even the best-controlled institutions globally have experienced internal frauds. However, where there is evidence of sustained inaction, ignored red flags, or systemic governance indifference, courts may take a far sterner view.
This case will therefore be closely watched not only by bankers and lawyers, but by every boardroom in Sri Lanka. It could redefine expectations of accountability in listed companies and financial institutions.
Whether the NDB board ultimately “loses their trousers” will depend on what the court concludes about negligence, oversight, and fiduciary failure. But regardless of the outcome, one lesson is already clear: the era of passive directorships is rapidly coming to an end. Chairman and Directors better watch out . If they are not compensated for the risk they take, it is better to get out than ending up paying hefty fines.