Fraud at NDB: Suspense and Scandal in the Sector
The largest internal banking fraud in Sri Lanka’s financial history: a loss of Rs.13.2 billion, continues to cast a long shadow over one of the country’s premier sectors. Let me be clear at the outset: there is no systemic risk; in the context of NDB’s total assets of Rs.935.8 billion, total equity of around Rs.75 billion, and retained earnings of approximately Rs.41-45 billion, the bank is well equipped to absorb such a shock. NDB is a mature mid-tier institution generating approximately Rs.2-4 billion pre-tax, per quarter and will in all likelihood return to profitability within a year. Further, the fraud did not originate from customer accounts, there were no customer account breaches.
The fraudulent transactions were initiated through NDB’s own suspense accounts, internal accounts used to hold funds while transactions are processed and cleared. On Fridays, unsettled transactions carry over the weekend, creating a window of reduced supervision. It has been reported that hundreds of fraudulent transactions were concentrated precisely around these weekend windows. This mechanism is not unprecedented globally. At the Estonian branch of Danske Bank, staff enabled vast volumes of suspicious cross-border payments over several years through channels that appeared operationally valid. In the Punjab National Bank fraud, employees exploited SWIFT messaging controls to issue unauthorised guarantees unrecorded in core systems. In both cases, the systems functioned as designed, it was internal oversight that failed, allowing sustained misuse of payment infrastructure.
What is remarkable about the NDB case is not the method nor the quantum but what it reveals about Sri Lanka’s capital markets. The banking industry has long been perceived as operating under the highest standards of governance and regulatory supervision. This fraud exposes the most consequential simultaneous breakdown of statutory supervision, professional auditing, and independent market scrutiny in recent financial history, three pillars each independently incentivised to prevent exactly this kind of fraud, failed spectacularly.
The Mode and Mechanism
The internal mechanics followed a simple sequence: cash left the bank through the payments system, an imbalance was created, and that imbalance was reclassified as a receivable. The receivable was not the transaction, it was the accounting cover for it.
In a normal CEFT transfer, funds move out of the bank’s settlement balances and are matched against a legitimate debit. The system clears, and no residual balances remain. Here, insiders initiated unauthorised transfers through suspense accounts. Each payment reduced the bank’s cash position, a real outflow, but instead of triggering reconciliation, the resulting imbalance was reclassified as ‘Other Receivables’ on the balance sheet. In plain terms, missing cash was replaced with an entry implying someone owed the bank money.
The process was repeated. Each fraudulent transfer followed the same pattern: cash left, a discrepancy arose, and the discrepancy was parked as a receivable. No corresponding liability was created. One asset: cash, certain and liquid, was substituted with another: a receivable, doubtful or unrecoverable. On paper the balance sheet appeared stable, in substance, asset quality had collapsed. The receivable became the accounting residue of the fraud, accumulating in plain sight across eighteen months of reporting cycles.
The Balance Sheet Trail
Note 36.3 of the bank’s FY2025 Annual Report states: ‘Other financial assets include receivables arising from Customer Electronic Funds Transfer (CEFT) transactions.’ This single sentence is the only disclosure for a balance that grew from Rs.1.4 billion in January 2024 to Rs.12.22 billion by end 2025. The historical norm, consistent from 2021 through 2023, was approximately Rs.1.4 billion.
The table tells an unambiguous story. Through all of 2024, the gross line had already doubled from Rs.1.4 billion to Rs.3.2 billion, itself a movement that should have triggered inquiry. By March 31, 2025, the balance had reached Rs.9.4 billion, an increase of Rs.6.3 billion in a single quarter. This filing was released to the Colombo Stock Exchange on May 14, 2025, publicly available to every investor, analyst, regulator, and board member. By end December 2025, the gross balance had reached Rs.12.2 billion, a 287 per cent year-on-year increase, 8.5 times the historical norm. Ernst & Young signed an unqualified audit opinion on these accounts on February 25, 2026. Thirty-five days later, NDB disclosed the fraud.
The impairment provision recorded against this Rs.12.2 billion balance was Rs.391 million, a coverage ratio of just 3.2 per cent, implying that 97 per cent of what we now know to be a fraudulent balance was assessed as fully recoverable. Chandra Jayaratne’s “Poser”, published in the Daily FT on April 9, was the only commentary to directly engage this accounting anomaly, asking the precise question: how can an impairment provision remain broadly static: Rs. NIL in 2023, Rs.367 million in 2024, Rs.390 million in 2025; while the underlying gross balance increased nearly ninefold? Without an age analysis of the receivables, the answer is that, it cannot be accurately determined. Under SLFRS 9, a CEFT receivable outstanding well beyond its normal settlement window cannot credibly remain classified at Stage 1 or Stage 2 with 3.2 per cent coverage. A properly conducted impairment assessment would have required a full aged listing of the balance, and that listing would have revealed the fraud.
A Performative Culture
How does a single balance sheet line item that increased significantly and materially over 12 months and was disclosed in a published audited annual report, available to thousands of investors, board committees, an external auditor, and a central bank supervisor, yet trigger no inquiry whatsoever?
Detecting this fraud required no sophisticated analysis. A single year-on-year comparison of one line item in a published balance sheet was sufficient. That this elementary observation eluded every layer of oversight: internal audit, board committees, external auditors, institutional investors, and the regulator, is not merely a governance failure, it reveals a somewhat performative financial oversight culture.
The fraud was not undetectable. It was visible, disclosed in the financial statements themselves. This oversight reflects a collective failure of professional competence, institutional independence, and regulatory vigilance of the gravest kind. That is the true scandal: not that a fraud occurred, but that every system designed to intercept just such a fraud, failed completely.
Hitad.lk has you covered with quality used or brand new cars for sale that are budget friendly yet reliable! Now is the time to sell your old ride for something more attractive to today's modern automotive market demands. Browse through our selection of affordable options now on Hitad.lk before deciding on what will work best for you!