Sri Lanka’s Public Debt Management Office (PDMO) is facing its biggest institutional test since its establishment, with Parliament’s Committee on Public Finance (COPF) concluding that governance failures, weak operational controls and limited specialist capacity created the conditions that allowed a US$2.5 million cyber fraud to occur.
The findings, presented during Parliament’s review of the PDMO’s 2025 Annual Debt Management Report, paint a troubling picture of an institution that assumed responsibility for managing the country’s Rs. 31.1 trillion public debt portfolio while still grappling with structural weaknesses inherited during its transition from the Central Bank of Sri Lanka (CBSL).
Committee Chairman Dr. Harsha de Silva reminded officials that Parliament’s investigation into the fraudulent debt payment had exposed failures across multiple institutions rather than a single administrative lapse. The Committee expects the Finance Ministry to demonstrate that governance, technical controls and institutional safeguards have been substantially strengthened to prevent a recurrence.
The investigation revealed that the fraud unfolded during an 18-month transition period when responsibilities between the CBSL and the newly created PDMO remained poorly defined. A prolonged dispute over which institution was responsible for validating payment instructions created accountability gaps that cyber criminals exploited.
While the CBSL continued providing secure banking infrastructure, institutional responsibility for verifying creditor account details ultimately rested with the PDMO. That ambiguity prompted Parliament to question whether adequate governance arrangements existed before sovereign debt management responsibilities were transferred.
Beyond the fraud itself, lawmakers expressed concern that the Office lacks sufficient specialist expertise to manage one of the country’s largest financial portfolios. Members warned that sovereign debt management requires highly specialised treasury-market knowledge, noting that even a 10-basis-point error in borrowing decisions could cost taxpayers millions while exposing officials to allegations over financing decisions.
Although the PDMO has undertaken training with International Monetary Fund technical assistance, officials admitted they have yet to complete a comprehensive Training Needs Assessment. COPF described the document as essential for future recruitment, professional development and resource planning, directing the Office to submit the assessment within two weeks while indicating Parliament would support increased budget allocations for specialist training.
Staffing concerns also came under scrutiny. Of an approved cadre of 80 officers, only about 60 positions have been filled, while a key Assistant Director-General post remains vacant pending disciplinary proceedings involving its previous holder.
Committee members further questioned whether the Finance Ministry’s Rs. 2 million allocation for staff training is proportionate for an institution responsible for managing billions of dollars in sovereign borrowing. Officials acknowledged that much of their current technical training continues to depend on grants from international development partners.
The review also highlighted broader strategic challenges. While the PDMO intends to reduce reliance on short-term Treasury Bills, increase longer-term bond issuance and gradually limit external borrowing, MPs cautioned that these objectives cannot depend solely on lower interest rates. Instead, they urged the Office to build stronger analytical capability and institutional resilience so that debt management decisions remain effective regardless of changing market conditions.
The Committee’s message was unmistakable: restoring confidence in Sri Lanka’s debt management framework will require far more than correcting one cyber incident. It demands a stronger institution equipped with modern governance, specialist expertise and robust accountability capable of safeguarding the country’s public finances.