What Did the Bank, Auditors and Regulators Miss?
Lakbima News Investigations Desk
September 5, 2026
A financial scandal that began with a reported loss of Rs.380 million has now become a Rs.13.58 billion mystery.
National Development Bank PLC initially disclosed in April that it had discovered fraud involving certain employees and outside parties.
Within days, the estimated amount had exploded to approximately Rs.13.2 billion.
Then came the forensic review.
In June, Deloitte Touche Tohmatsu India LLP told NDB that its examination so far had identified suspicious transactions totalling Rs.13,579,664,684 — approximately Rs.13.58 billion.
The figure was higher than the bank’s original estimate.
But the most important question is no longer simply:
Who stole the money?
It is:
How did a transaction trail worth more than Rs.13 billion survive inside a major Sri Lankan bank’s systems for so long?
From Rs.380 million to Rs.13.58 billion
NDB’s first disclosure was made on April 2.
The bank initially identified a fraud involving approximately Rs.380 million.
Four days later, the number changed dramatically.
NDB announced that a more comprehensive investigation had revealed that the fraud could amount to approximately Rs.13.2 billion.
The bank said the fraud involved certain employees acting in collusion with external parties.
It also stressed that customer balances had not been affected and that normal banking operations continued.
The Central Bank confirmed at the time that NDB’s capital adequacy and liquidity ratios remained above regulatory minimums.
But the rapid change in the estimated loss immediately raised a question:
How could an investigation initially identify Rs.380 million when the eventual exposure was more than 34 times larger?
That question goes directly to the effectiveness of internal controls and detection systems.
Deloitte found an even larger figure
The latest major development came on June 26.
Deloitte’s interim forensic review identified suspicious transactions worth Rs.13,579,664,684.
That is approximately Rs.380 million more than the initial Rs.13.2 billion estimate.
NDB stressed that Deloitte’s findings were preliminary and that the interim report was confidential under the terms of the engagement.
The bank disclosed only the amount identified so far and said further information would be provided as appropriate.
That leaves an important distinction for the public:
Rs.13.58 billion is the value of suspicious transactions identified by the forensic review. It should not automatically be described as the final proven criminal loss.
The final scope remains subject to investigation.
The timeline raises another uncomfortable question
NDB’s own financial statements show that the accounting impact of the fraud extended across multiple reporting periods.
The bank has allocated approximately:
- Rs.1.42 billion to periods before January 1, 2025;
- Rs.9.62 billion to the 2025 financial year; and
- Rs.2.55 billion to the first quarter of 2026.
That totals approximately Rs.13.58 billion.
The bank subsequently restated earlier financial statements to reflect the revised impact.
This means the problem was not confined to one isolated event in early 2026.
A substantial portion of the transactions was attributed to earlier periods.
That makes the central investigation increasingly about duration and detection.
The numbers were moving before the scandal became public
One of the most important areas for investigators and shareholders is the bank’s historical financial reporting.
Public analysis of NDB’s financial statements has highlighted large movements in certain balance-sheet categories before the fraud was disclosed.
The “Other Financial Assets” category, for example, reportedly rose from approximately Rs.3.16 billion in 2024 to around Rs.12.2 billion by the end of 2025.
Other reporting has also highlighted large movements in receivables associated with electronic transfers.
These movements do not by themselves prove that management or auditors knew that fraud was occurring.
But they demonstrate why the forensic investigation is important.
The question is whether the unusual movements were properly investigated at the time.
The Central Bank is now part of the accountability question
NDB is a regulated commercial bank.
That means the scandal is not solely an internal corporate matter.
The Central Bank of Sri Lanka supervises the banking sector and conducts prudential supervision of licensed commercial banks.
After the fraud was disclosed, the Central Bank said it was monitoring the situation and that NDB’s capital and liquidity ratios remained above regulatory minimums.
But Parliament’s Committee on Public Finance subsequently questioned Central Bank officials over the regulatory aspects of the case.
The discussion reportedly focused on how warning signs in NDB’s financial position could have gone undetected and whether the supervisory system was sufficiently effective.
The issue is particularly important because the suspected transactions were not merely a few isolated payments.
The forensic review identified transactions worth more than Rs.13.5 billion.
The human element
Investigators have already focused on employees inside the bank.
Earlier reports said the alleged scheme involved employees working with people outside NDB.
The bank suspended employees identified as being connected to the fraud and revoked their system access.
Law-enforcement authorities also arrested individuals connected to the investigation.
But an investigation into individual employees cannot answer the entire institutional question.
A sophisticated fraud may exploit weaknesses in technology.
It may exploit staff access.
It may exploit reconciliation procedures.
Or it may exploit a combination of all three.
That is why Deloitte was specifically asked to examine not just the suspicious transactions but also the circumstances surrounding them, including possible weaknesses in controls, oversight and governance.
Where did the money go?
This may ultimately be the most difficult question.
Sri Lanka’s Financial Crimes Investigation Division has been investigating whether money connected to the NDB fraud was transferred outside the country.
A June report said investigators were examining whether approximately Rs.13 billion linked to the case had been transferred abroad.
The investigation reportedly involved thousands of electronic transfers across numerous bank accounts.
Authorities were attempting to establish how much, if any, had ultimately left Sri Lanka.
There have also been reports that some of the funds may have been converted into cryptocurrency.
Those reports have not established that the entire Rs.13.58 billion was converted into cryptocurrency, nor that the funds are permanently unrecoverable.
But if cryptocurrency was used to move part of the proceeds, tracing and recovering the money becomes significantly more complicated.
The recovery problem
Finding the people responsible and recovering the money are two different things.
NDB has said that it is pursuing legal measures and cooperating with law-enforcement authorities to recover the funds.
But reports earlier in the investigation suggested that recovering a substantial portion could be difficult if money had already moved through multiple jurisdictions or digital assets.
This creates a second financial question:
Who ultimately bears the cost if only part of the money is recovered?
The bank has already recognised the financial impact in its accounts.
That does not mean the economic consequences disappear.
The loss affects profitability, retained earnings and capital.
It also changes the bank’s financial history.
NDB’s profits have already been rewritten
The scandal has changed the bank’s previously reported earnings.
NDB’s previously reported post-tax profit for 2025 was approximately Rs.11.04 billion.
After accounting for the fraud, it was restated to approximately Rs.5.90 billion.
The bank’s 2024 post-tax profit was also revised downward, from approximately Rs.9.03 billion to Rs.8.18 billion.
These changes demonstrate that the fraud was not simply an extraordinary expense appearing in one quarter.
It altered the financial presentation of previous years.
Yet the bank is still making money
There is another side to the story.
Despite the fraud, NDB reported a post-tax profit of approximately Rs.3.01 billion in the second quarter of 2026.
For the first half of the year, post-tax profit was approximately Rs.4.83 billion after accounting for the applicable fraud impact.
The bank says its underlying banking operations remain resilient.
This is important because the story should not be sensationalised into suggesting that NDB is collapsing.
The Central Bank has said the bank’s regulatory capital and liquidity remained above minimum requirements.
The evidence available does not indicate that depositors should assume their money has disappeared.
NDB itself has repeatedly said that customer balances were not affected.
The scandal is therefore better understood as an enormous governance, internal-control and financial-crime investigation, rather than evidence of a conventional bank run.
But the forensic report remains behind closed doors
This may be the most significant unresolved issue.
Deloitte has already completed an interim forensic review.
The review identified Rs.13.58 billion in suspicious transactions.
Yet the actual interim report remains confidential.
NDB has said the report is confidential under the terms of its engagement.
That creates an unavoidable public-interest dilemma.
There are legitimate reasons for investigators to protect evidence and personal information.
At the same time, shareholders, customers and the wider public have a legitimate interest in understanding how a loss of this magnitude occurred.
The answer may not be to publish every page of the forensic report.
But the public should eventually be able to understand its principal conclusions.
What should the final report answer?
When the final forensic findings become available, Lakbima News believes at least eight questions should be answered.
1. When did the fraud actually begin?
NDB’s accounting adjustments extend to periods before January 2025.
The exact starting point matters.
2. How did the transactions bypass existing controls?
Were systems manipulated?
Were passwords compromised?
Were approval procedures bypassed?
Or were legitimate processes deliberately exploited?
3. Who reviewed the relevant accounts?
A transaction trail of this size should have passed through multiple layers of oversight.
Which controls failed?
4. Were there warning signs?
If unusual balances or rapid increases were visible in financial statements, who was responsible for investigating them?
5. What did the internal auditors know?
The role of internal audit will be critical.
6. What did the external auditors know?
This is not an accusation against any particular auditor.
It is a question that the final forensic findings should answer objectively.
7. What did the regulator know?
The Central Bank’s supervisory processes will inevitably face scrutiny.
8. How much money can realistically be recovered?
The public needs a figure rather than vague assurances.
The bigger issue is trust
Banking ultimately depends on something that cannot be printed on a balance sheet:
trust.
Customers deposit money because they believe banks have systems capable of protecting it.
Investors buy shares because they believe financial statements provide a reliable picture of the institution.
Regulators exist because the public cannot independently monitor every bank.
Auditors exist because shareholders cannot personally examine every transaction.
When a fraud of this scale emerges, all four relationships are tested.
NDB has survived the immediate financial shock.
Its underlying business continues to generate profits.
Its regulatory ratios remain above minimum requirements.
But financial stability is only one measure of the damage.
The other is confidence in the systems designed to prevent the next Rs.13.58 billion.
The real investigation has only begun
Sri Lanka has seen financial scandals before.
What makes the NDB case different is the combination of its scale, the length of the suspected transaction period and the number of institutional safeguards that must now be examined.
The figure has already moved from Rs.380 million to Rs.13.2 billion and then to Rs.13.58 billion in suspicious transactions identified by the forensic review.
That progression alone demonstrates why the final investigation matters.
The country does not simply need to know who allegedly committed the fraud.
It needs to know:
Who should have detected it?
Why wasn’t it detected earlier?
Which controls failed?
What did the auditors see?
What did the regulator see?
And ultimately:
How much of the money will Sri Lanka ever get back?
Until those questions are answered, the Rs.13.58 billion figure is not the end of the NDB story.
It is the beginning of it.
Lakbima News Investigations
This investigation distinguishes between established financial disclosures, preliminary forensic findings and allegations under investigation. The Rs.13.58 billion figure represents suspicious transactions identified by Deloitte’s interim forensic review and should not automatically be treated as a final judicial finding of criminal loss. No individual should be regarded as guilty unless established through due legal process.
