The discovery of the massive NDB financial fraud has exposed how modern banking vulnerabilities can allow sophisticated digital crimes to bypass traditional safeguards. The ongoing CID and forensic investigations reveal a complex web of transactions involving international transfers, multiple bank accounts and cryptocurrency movements, raising urgent questions about Sri Lanka’s readiness to combat financial crimes in a digital era.
Investigators estimate that suspicious transactions linked to the fraud amounted to Rs. 13.58 billion, higher than the original estimate of Rs. 13.2 billion. Deloitte Touche Tohmatsu India LLP’s forensic review has examined transactions covering approximately ten years, with particular attention placed on internal suspense accounts that reportedly enabled irregular movements without timely detection.
The scale of the operation has shocked financial sector observers. According to investigation findings, Rs. 12.8 billion was allegedly transferred outside Sri Lanka through 26,108 Telegraphic Transfers distributed among 227 accounts in 13 commercial banks.
The use of multiple financial institutions demonstrates the growing complexity of cross-border financial crime. Investigators are now analysing transaction patterns, beneficiary networks and digital trails to determine how the funds moved and who benefited from the transfers.
The involvement of cryptocurrency has added another layer of difficulty. The CID’s Financial Crimes Investigation Division and Computer Crimes Division have obtained assistance from Interpol virtual currency experts from Lyon, France, as authorities attempt to track overseas crypto wallets and possible digital asset conversions.
The investigation has already resulted in arrests, including an NDB Assistant Manager accused of masterminding the scheme, along with other alleged participants. Authorities believe further arrests could follow as investigators examine whether additional employees or officials failed to comply with regulatory requirements.
The incident has placed renewed attention on cybersecurity, internal governance and risk management standards within financial institutions. Banking experts argue that traditional compliance systems must evolve rapidly as criminals increasingly exploit digital platforms, automated payment systems and international financial channels.
Meanwhile, NDB has moved to strengthen its internal framework following the discovery of the fraud. The bank stated that enhanced controls have been introduced while the forensic review and law enforcement investigations continue.
Financial results for the first half of 2026 show that the institution’s core operations remain stable. NDB reported Rs. 25.13 billion in operating income, while deposits increased to Rs. 712.5 billion. The bank maintained strong liquidity with a Liquidity Coverage Ratio exceeding 163% and capital adequacy at 15.3%.
The fraud has therefore become a major test not only for NDB but for Sri Lanka’s entire banking ecosystem. The outcome of the investigations will determine whether regulators, banks and policymakers can strengthen defences against increasingly sophisticated financial crimes
By a Special Correspondent