The Rs.13.6 billion fraud at National Development Bank (NDB) has developed into a major test of Sri Lanka’s banking regulatory framework, exposing disturbing weaknesses in auditing standards, corporate governance and the supervisory mechanisms intended to protect public confidence in the financial system.
The Central Bank of Sri Lanka’s decision to prohibit the Ernst & Young (EY) partners who audited NDB from undertaking further banking audits is a serious disciplinary measure. Yet it also raises a more uncomfortable question: why did the country’s financial watchdog and the bank’s independent auditors fail to identify the irregularities before they continued for nearly three years?
The fraud was uncovered only after the bank’s 2025 financial statements had been certified, raising questions about the reliability of the audit process and the effectiveness of internal financial controls.
The revelations before the Committee on Public Finance (CoPF) on November 5 indicate that the scandal cannot be treated simply as an isolated incident of employee misconduct.
Director of Banking Supervision R. R. de Silva Jayatillake informed the committee, chaired by SJB MP Dr. Harsha de Silva, that the Central Bank had barred the relevant EY partners from conducting banking audits and ordered NDB to reconstitute its Board Audit Committee.
While these interventions demonstrate regulatory action, the committee’s proceedings exposed a worrying lack of transparency regarding the precise findings and consequences of the investigations.
One particularly troubling revelation concerned the manner in which the auditors reported the fraud. Instead of issuing a formal qualification or an emphasis-of-matter statement, the irregularities were reportedly flagged with an asterisk.
For a banking institution handling billions of rupees in deposits and financial transactions, such a distinction is far from a technical detail. It raises questions about whether the audit process adequately communicated the seriousness of the irregularities to shareholders, depositors and other stakeholders.
The explanation that those involved largely complied with reporting requirements and managed to mislead regulators and possibly auditors further demonstrates how sophisticated financial manipulation can exploit weaknesses in institutional monitoring.
The Deloitte forensic audit has become another focal point of concern. Dr. de Silva questioned whether the Central Bank was satisfied with its findings, pointing out that the committee had received only basic information and had not been provided with the complete report.
He argued that the forensic investigation examined NDB’s transactions rather than the performance of the external audit firm, leaving important questions about professional responsibility to a separate investigation.
That investigation, conducted by the Sri Lanka Accounting and Auditing Standards Monitoring Board (SLAASMB), was completed and referred to the Attorney General on October 15, 2026, for advice on possible legal action.
However, Chairperson E. H. Mohotty declined to reveal its findings, prompting Dr. de Silva to remark that the undisclosed conclusions appeared alarming.
CBSL Governor Dr. Nandalal Weerasinghe said the regulator was examining the report and assessing whether action had been taken against individuals identified through the forensic audit.
Meanwhile, restrictions on NDB’s dividends, discretionary payments and branch expansion, imposed in early April, demonstrate the seriousness with which the Central Bank views the institution’s stability.
The regulator has also instructed other banks to strengthen reconciliation of suspense accounts and promised wider supervisory reforms.
But these measures must go beyond issuing instructions and reorganising committees.The fundamental question is whether Sri Lanka’s banking supervision system can identify fraud before billions disappear, rather than explaining regulatory interventions after the damage has occurred.
Depositors cannot be expected to shoulder the consequences of institutional negligence, inadequate auditing or ineffective governance.
The NDB scandal demands a transparent account of how the fraud operated, who failed to detect it, what disciplinary and legal action has followed, and whether the money can be recovered.
Without clear answers, the prohibition of two audit partners and the restructuring of board committees could become symbolic penalties in a scandal that has exposed much deeper weaknesses in the country’s financial accountability system.