ISAS Working Papers

Summary

A series of financial scandals were reported in Sri Lanka in recent months. These incidents expose deeper weaknesses in state capacity against the backdrop of the International Monetary Fund-backed reforms process implemented since 2023. While these incidents have not dented the popularity of the National People’s Power government, weaknesses and loopholes in oversight bodies, combined with scattered accountability, have raised questions on the effectiveness of reform-backed institutional roles.

Introduction

Since early 2026, several financial irregularities were reported in Sri Lanka. Initially, one of Sri Lanka’s mid-tier private banks, the National Development Bank (NDB), revealed a LKR13.2 billion (S$50.2 million) fraud involving irregular transactions.[1] The fraudulent transactions appear to have been occurring since 2024, in clear violation of controls and monitoring oversight protocols within the financial institution.

Subsequently, a Sri Lankan Treasury-related phishing incident was reported, involving the diversion of a US$2.5 million (S$3.2 million) bilateral payment to a creditor in Australia.[2] Initial investigations by the Committee on Public Finance (COPF) and official reports suggest that the funds were misdirected through a combination of technical lapses and procedural failures. Of this sum, only US$200 (S$256) was later reported to have been recovered.

In May 2026, the Ministry of Finance reported that thousands of Aswesuma welfare recipients received double payments for April 2026 due to an “accidental” duplicate upload of payment files.[3] According to the Welfare Benefits Board, the mistake was accounted for as a technical error and states that the LKR248.7 million (S$945,000) mistakenly credited will be recovered from the May 2026 allowance payments, resulting in no net loss.[4]

Later that month, opposition Member of Parliament Dayasiri Jayasekara claimed that Sri Lankan Airlines, the state-owned airline carrier, had made a faulty transfer of AED974,050 (S$339,600) to a wrong bank account. Ports, Civil Aviation and Energy Minister Aruna Karunathilleke later confirmed the erroneous transaction made by Sri Lankan Airlines and stated that investigations are ongoing.[5]

This series of scams, frauds and financial mismanagement in Sri Lanka’s financial institutions and state agencies carries implications for the country’s economic recovery process since the 2022 debt crisis. The government’s response to these incidents is also significant, particularly in terms of accountability and the prevention of recurrence. However, there appears to be limited evidence of systematic action to strengthen checks and balances or to build sufficient state capacity to mitigate such risks in the future.

Financial fraud is an increasingly pressing challenge for countries in the region. The largest alleged banking fraud in India to date is the 2018 Punjab National Bank scandal, involving around US$2 billion (S$2.56 billion) in fraudulent letters of undertaking and foreign letters of credit.[6] Bangladesh dealt with a cyber-enabled heist in 2016 when hackers infiltrated the central bank of Bangladesh and exploited the SWIFT payment network to move around US$81 million (S$103.6 million), routing funds through banks in Sri Lanka and the Philippines.[7]

These incidents show that regulatory oversight of complex financial systems, undergoing governance reforms and digitalisation, remains weak and uneven across the region. The acceleration of reform processes, alongside expansion of digital financial systems, exposes weaknesses in institutional safeguards and regulatory capacity. This creates new vulnerabilities that can be exploited and which in turn can undermine both reform effectiveness and public trust in state institutions and governance.

A Question of State Capacity Amid Reforms

This is not the first instance in which Sri Lankan state institutions have fallen prey to financial scams or fraudulent schemes.[8] The proximity of these incidents in close succession to one another points to a pattern of recurring financial irregularities and administrative lapses. Taken together, these incidents can be seen as a stress test of Sri Lanka’s financial regulatory and oversight capacity.

Sri Lanka entered an extensive reform and fiscal consolidation pathway after the 2022 economic crisis, with the International Monetary Fund (IMF) support emerging as a key external anchor for macroeconomic stabilisation. However, the extent to which these reforms are being implemented primarily to satisfy IMF requirements and international donors, versus reflecting a genuine domestic commitment to long-term economic and governance stability, remains ambiguous.[9] As a result, reforms risk being treated as procedural requirements to be fulfilled for external approval rather than organically driven transitions.

Despite the establishment of institutions and laws aimed at strengthening public financial management and improving governance, implementation continues to be constrained by shortages of skilled personnel, limited autonomy and weak planning capacity. This is also reflected in the government’s constrained ability to coordinate among state and non-state institutions.[10] The Public Debt Management Office (PDMO), for example, established in 2023 as part of the IMF-led reforms programme, was established with the official aim of improving how Sri Lanka manages public debt by reducing institutional conflict of interest, increasing transparency and strengthening accountability.[11] It was expected to bring more order and efficiency to the country’s debt portfolio and improve coordination across key institutions. The PDMO was included as part of the 2023 IMF Governance Diagnostic Assessment’s recommendations which identified key governance and corruption vulnerabilities across state institutions and provided reform recommendations to strengthen transparency, accountability and institutional resilience as part of Sri Lanka’s post-crisis recovery.[12]

However, in light of the recent financial scandals, these improvements have been less clear, as there appear to be indistinct responsibilities and weaker accountability between the government and key regulators such as the Central Bank of Sri Lanka (CBSL) and the Ministry of Finance. These challenges became more visible during the transition period of the reform process, when weaknesses in systems and communication were exposed. There also appears to be a slower and less coordinated response from these institutions in handling issues.

In July 2026, a report of the COPF was presented to Parliament on the Treasury cybercrime fraud incident.[13] The report attributes the fraud incident to historic and systematic lapses in internal controls of the debt repayments process, including negligence of mid-level officers, outdated email infrastructure and procedural shortcomings within the foreign debt repayment process. In the report, it is noted that accountability gaps and operational inefficiencies persisted due to unclear roles while Sri Lanka Computer Emergency Readiness Team (SL-CERT) and National Cyber Security Operations Centre reviews in 2026 identified ongoing information technology vulnerabilities. However, SL-CERT lacks the authority to enforce compliance, leaving institutions responsible for acting on its recommendations.

In the context of the present government’s strong advocacy of a digital economy, these incidents also highlight the risks of rapid digitalisation in the absence of sufficiently robust safeguards. During the presidential election campaign, the incumbent President strongly promoted digital transformation which was subsequently reflected in the establishment of a Ministry of Digital Economy shortly after assuming office.[14] Key initiatives have included streamlining government administrative processes to reduce duplication and manual paperwork, introducing GovPay as an online platform for public service payments and expanding the digitisation of public services such as passport issuance and the electronic National Identity Card system.[15]

However, as more parts of government administration are digitised, including proposed changes such as digitising court records, there is greater exposure across critical state infrastructure including the financial system, the public administration system and the judiciary system. The recent treasury cyber fraud incident shows that these risks can affect broader economic stability and public financial management, as well as public data privacy.[16]

The NPP Government’s Response to Financial Irregularities

The government has also sought to portray these incidents as isolated cases, arguing that they are unconnected and do not warrant a broader systemic response.

Recent responses by the government and relevant authorities to these fraud and financial misconduct incidents appear reactive and defensive, suggesting that the seriousness of these cases may not be fully recognised. The NPP government’s response to these incidents appears, in part, to deflect responsibility by attributing them to errors by individual public officials within the state, or by framing them as systemic issues that predate the current administration or explaining the financial irregularities as technical errors.

While investigative committees have been established to examine the incidents, so far there has been limited visible accountability or public disclosure of outcomes. In most instances, some form of committee has been established to conduct investigations into the issues, but in the absence of sustained opposition or public pressure, their results have not been forthcoming. Communication to the public on these issues appears to be largely reactive and in response to the political opposition or media revealing them to the public.

The Finance Ministry’s report to Parliament on the US$2.5 million (S$3.2 million) scam incident involving the Treasury indicates that cybercriminals used impersonation tactics, including look-alike domains and the interception of internal email communications related to fund transfers.[17] According to Deputy Minister of Digital Economy Eranga Weeraratne, it remains unclear whether a direct system “hack” took place. Ongoing investigations are reported to be considering several possibilities, including compromised email credentials, leaked account details, or external access to communication channels used by the External Resources Department. The transaction was reportedly executed after staff acted on fraudulent instructions issued by an impersonating party and investigators have not ruled out the possibility of insider collusion.

In response to the US$2.5 million (S$3.2 million) scam incident, a Technical Investigation Committee was appointed on 24 March 2026 to investigate the phishing case. Cabinet Spokesperson and Minister Nalinda Jayatissa stated that several Treasury officials had been suspended in connection with the incident, alongside the establishment of the committee to conduct a formal inquiry. As an immediate safeguard, emergency controls were introduced, including reduced reliance on email and the mandatory use of telephone callback procedures through verified official channels to confirm financial instructions.[18] While these measures were necessary to mitigate immediate risks, they also appear to run counter to broader digital transformation efforts, at least in the short term.

Central Bank Governor Nandalal Weerasinghe also distanced himself from the incident, stating that responsibility for foreign debt repayments, previously handled by the Central Bank, had been transferred to the Department of Foreign Resources and the PDMO following the enactment of the Public Debt Management Act No. 33 of 2024. In relation to the NDB incident, the Governor further clarified that the Central Bank’s role is to ensure that banks comply with regulatory directives and maintain adequate internal controls, rather than to monitor or scrutinise every individual transaction processed by commercial banks.[19]

These incidents followed a coal procurement controversy under the NPP government that emerged in April 2026 after a National Audit Office report identified irregularities in coal supply tenders, raising concerns about procurement procedures, pricing and fuel quality.[20] The President acknowledged in Parliament that substandard coal had been purchased which led to the resignation of the energy minister. While the government maintained that there was no evidence of ministerial corruption, it announced further audits and established a Special Presidential Commission of Inquiry to investigate coal procurement practices dating back to 2009, framing the issue as a long-standing governance problem.

Political Opposition and Public Response

Opposition parties and sections of the public reacted to the recent financial scandals under the NPP with sharp criticism and growing political pressure, arguing that the government is failing to meet its mandate of system change and anti-corruption which had been framed as ending the public finance mismanagement that had led to economic crises as in 2022.[21] The lack of transparency in the investigation of the financial irregularities and loss of public money and the slow process of accountability have also been raised, in addition to administrative incompetence to anticipate, audit, respond to and prevent such financial irregularities.

In June 2026, the main opposition party Samagi Jana Balawegaya’s Member of Parliament Harsha de Silva, who is also Chairman of the COPF, stated that a report on the US$2.5 million (S$3.2 million) Treasury cybercrime fraud was transmitted to him only for personal reference.[22] He rejected this mode of submission, arguing that as Chair of COPF, the report’s contents are intended for public and parliamentary scrutiny. He further argued that such practices undermine established norms of accountability and professional standards within the democratic and institutional framework. Parliament holds full authority to oversee public financial matters and any attempt to bypass its committee system, particularly the finance-related oversight mechanisms, amounts to an erosion of institutional checks and balances. Given that the incident of financial irregularity occurred in late 2025, concerns were also raised about delays in due process and adherence to procedural timelines.

The opposition has, however, so far been unable to mobilise a sustained campaign around public finance mismanagement. In Parliament, Member of Parliament Mujibur Rahman of the main opposition party questioned the circumstances surrounding the death of Treasury Assistant Director Rangana Nishantha Rajapaksa who had been suspended in connection with the Treasury cyber fraud investigation in May 2026 and was subsequently found dead, with authorities confirming the cause of death as suicide.[23] Overall, the opposition has largely relied on slogans framing the NPP government as one characterised by deception, rhetorical excess and unfulfilled promises. This messaging is reflected in overlapping opposition campaign narratives, including the emerging ekabadda vipakshaya (joint opposition) which includes political actors from breakaway factions of the United National Party and the Sri Lanka Freedom Party.[24] It has also been taken up by other emerging political formations, such as Dinana Dakuna, which are attempting to use incidents such as this series of financial irregularities to gain political capital.

However, the continued prominence of largely delegitimised “old guard” faces within these alliances has limited the credibility and traction of this counter-narrative, creating a contrast between institutional scrutiny processes and opposition narratives that are often perceived by the public as opportunistic or lacking credibility. As a result, the opposition has struggled to effectively capitalise on these governance and accountability issues.

In terms of public opinion, these financial fraud incidents, therefore, appear to have had only a limited immediate impact among sections of the electorate that supported the NPP. The scandals did not translate into a significant erosion of public trust in the government, with many supporters framing these incidents as manifestations of systemic administrative failures and political responsibility. However, their longer-term significance may lie in how they shape perceptions of the government’s competence in managing the economy and delivering on its promise of “system change”.

Public discourse is important not only for assessing the political legitimacy of the government, but also for understanding the extent of public trust in institutions such as the banking system and in the state’s capacity to protect data privacy and ensure financial security. Public concerns about governance and checks and balances within public financial systems are often only heard when they are associated with major corruption scandals or when failures directly disrupt everyday life, as occurred during Sri Lanka’s 2022 economic crisis.

This sustains a gap between the reform-oriented narratives of movements such as the Aragalaya, the mass people’s protests of 2022 that strongly emphasised systemic change and the slower transformation of political culture and institutional practices required to ensure the effective and accountable use of public finance. This is important as financial loss through fraud would ultimately have been borne by the state, meaning taxpayers would have had to absorb the cost.

Although there is currently no strong or consolidated opposition capable of translating these incidents into sustained mobilisation, economic pressures linked to global disruptions, including rising living costs, continue to influence public sentiment. As the COPF proceedings are publicly televised, scrutiny of financial irregularities has become more visible and accessible to the public. This increases the possibility that such issues may become more central to political debate. In this context while opposition mobilisation remains weak, the government’s perceived competence and legitimacy remain vulnerable to gradual erosion through repeated incidents of financial mismanagement. Over time, political actors with demonstrated competence in public finance may gain increased credibility, particularly if they can present themselves as credible stewards of economic governance.

Contradictions of Reform, Accountability and Its Dividends

Institutions such as the PDMO and the Welfare Benefits Board were established as part of IMF-supported reform processes. However, recent incidents have exposed systemic weaknesses within the regulatory infrastructure in which they function. The July 2026 COPF report on ‘The Fraud Linked to Cybercrime in the US Dollar 2.5 Million Debt Repayment to Australia’ argues that blame cannot rest solely with transitional institutions, as the broader institutional architecture remains unchanged and must share responsibility.[25] This illustrates that creating new institutions alone cannot resolve governance failures that are systemic, deeply embedded and sustained by existing structures and practices; a fact that extends to the overall state mechanism of the country.

Similarly, the recent incident involving the NDB has raised questions about the newly independent Central Bank’s supervisory effectiveness, particularly its apparent failure to detect the issue on time. Although the Central Bank has since issued post-incident protocols and guidelines, its response has largely been reactive rather than preventive. The role of other relevant supervisory and regulatory bodies is also brought into question as most action is being taken on hindsight than routine and proactive oversight, hinting at an overall lack of coordinated and established protocols among financial regulatory bodies.

The scale of funds allegedly transferred through a regulated private banking system which is subject to ongoing monitoring by CBSL, raises broader concerns about regulatory capacity and early-warning mechanisms. This also brings into focus not only the bank’s internal governance and assurance systems, but also the effectiveness of the country’s monetary authority as a key line of defence. While efforts have been made to strengthen the independence of the Central Bank, its oversight role in the financial sector continues to face constraints, raising questions about the consistency and effectiveness of financial supervision.

Political promises made by governments emerging in the aftermath of mass protest movements that contributed to regime change across parts of South Asia have often centred on reforming entrenched weaknesses in public financial management. However, demands for “good governance” are not new and have circulated for decades in these contexts. In the current setting, the state’s capacity to respond is further constrained by the cumulative effects of long-term institutional weakening associated with liberalisation reforms and domestic political priorities (including protracted conflict), especially since the 1990s.

Periodic financial incidents would affect public trust in institutions. However, the response by governments in power is often one that sidelines accountability due to fear of the political costs, making institutional reform piecemeal and reactionary at best. At the same time, accountability also extends to the electorate which has a role in holding governments accountable to the mandates on which they were elected.

. . . . .

Dr Rajni Gamage is a Research Fellow at the Institute of South Asian Studies (ISAS), an autonomous research institute at the National University of Singapore (NUS). She can be contacted at r.gamage@nus.edu.sg. Ms Hashini Gayanga Wijesekera is a graduate research student at the Department of Economics at NUS. She can be contacted at hashinigw@u.nus.edu. The authors bear full responsibility for the facts cited and opinions expressed in this paper.

[1]     “Massive Rs.380 m fraud reported at NDB”, The Sunday Times, 2 April 2026, https://sundaytimes.lk/online/news-online/Massive-Rs-380-m-fraud-reported-at-NDB/2-1151611.

[2]     Devan Daniel, “CBSL distances supervisory role from Treasury and NDB scams”, Daily FT, 14 May 2026, https://www.ft.lk/front-page/CBSL-distances-supervisory-role-from-Treasury-and-NDB-scams/44-791877.

[3]     “Finance Ministry admits Rs. 248 million Aswesuma payment made by mistake”, Newswire, 7 May 2026, https://www.newswire.lk/2026/05/07/finance-ministry-admits-rs-248-million-aswesuma-payment-made-by-mistake/.

[4]     Buddhika Samaraweera, “Aswesuma ‘double payment’: Welfare Benefits Board blames tech error”, The Morning, 8 May 2026, https://www.themorning.lk/articles/pQxlSKc13tT8XQPXPFx2.

[5]     “Another faulty financial transaction hits government”, Daily Mirror, 15 May 2026, https://www.dailymirror.lk/print/breaking-news/Another-faulty-financial-transaction-hits-government/108-340341; and “SriLankan Airlines clarification on reports of fraudulent payments linked to a compromised service provider email account in the UAE and misappropriation of funds in India”, SriLankan Airlines, 16 May 2026 https://www.srilankan.com/ta_lk/Corporate/news-details/627.

[6]     S Narayan, “The Punjab National Bank fraud in India: Failure of institutional controls and oversights”, ISAS Brief No. 558, Institute of South Asian Studies, National University of Singapore, 2018, https://www.isas.nus.edu.sg/wp-content/uploads/2018/03/ISAS-Briefs-No.-558-The-Punjab-National-Bank-Fraud-in-India1.pdf.

[7]     Kim Zetter, “That insane, $81M Bangladesh Bank heist? Here’s what we know”, WIRED, 17 May 2016, https://www.wired.com/2016/05/insane-81m-bangladesh-bank-heist-heres-know/.

[8]     Pethmi O De Silva, Madurika Nanayakkara and Ravi Bamunusinghe, “Sri Lanka’s fraud prism: A structural and behavioural overview”, Daily FT, 20 May 2026, https://www.ft.lk/opinion/Sri-Lanka-s-fraud-prism-A-structural-and-behavioural-overview/4-79215.

[9]     Umesh Moramudali, “ශ්‍රී ලංකාවේ රාජ්‍ය ධාරිතාව පිළිබඳ බරපතළ ප්‍රශ්නයක් තිබෙනවා” (There is a serious issue regarding state capacity in Sri Lanka), රතු ඉර (Rathu Ira), 16 May 2026, https://rathuiranewspaper.lk/news/26621.

[10]     Ibid.

[11]     “Sri Lanka: Debt management reform plan (High-Level Summary Technical Assistance Report No. 2024/26)”, International Monetary Fund, 2024, p 13, https://www.imf.org/-/media/files/publications/hls/2024/english/hlsea2024046.pdf.

[12]     “Sri Lanka: Technical assistance report – Governance diagnostic assessment (IMF Staff Country Report No. 2023/340)”, International Monetary Fund, 20 September2023, https://doi.org/10.5089/9798400255977.002.

[13]     “Report of the Committee on Public Finance on the Fraud Linked to Cybercrime in the US Dollar 2.5 Million Debt Repayment to Australia”, Parliament of Sri Lanka, 10 July 2026, https://www.parliament.lk/uploads/businessdocs/english/23870_english_2026-07-10.pdf.

[14]     Sujata Gamage, “Clean Sri Lanka and digital economy initiatives: New pragmatic face of NPP”, Daily FT, 25 January 2025 https://www.ft.lk/columns/Clean-Sri-Lanka-and-digital-economy-initiatives-New-pragmatic-face-of-NPP/4-771539.

[15]     “Sri Lanka moves closer to global digital economy with nationwide PayPal rollout”, Lanka News Web, 15 May 2026, https://lankanewsweb.net/archives/205452/sri-lanka-moves-closer-to-global-digital-economy-with-nationwide-paypal-rollout/.

[16]     In the case of the Welfare Benefits Board, these concerns are especially serious because it holds the socioeconomic and personal data of millions of beneficiaries, raising wider questions about data protection and the state’s capacity to fulfil its responsibilities.

[17]     Duruthu E Chandrasekera, “Treasury’s $2.5 m heist report to Parliament soon”, The Sunday Times, 31 May 2026, https://www.sundaytimes.lk/260531/business-times/treasurys-2-5-m-heist-report-to-parliament-soon-643858.html.

[18]     “Treasury rocked by $2.5 m fraud”, Daily FT, 25 March 2026, https://www.ft.lk/top-story/Treasury-rocked-by-2-5-m-fraud/26-791019; and “Cyber theft raises questions about government competence and commitment to transparency”, The Sunday Times, 26 April 2026, https://www.sundaytimes.lk/260426/columns/cyber-theft-raises-questions-about-government-competence-and-commitment-to-transparency-640155.html.

[19]     “CBSL distances supervisory role from Treasury and NDB scams”, Daily FT, 14 May 2026, https://www.ft.lk/front-page/CBSL-distances-supervisory-role-from-Treasury-and-NDB-scams/44-791877.

[20]     Shihar Aneez, “Explainer – Sri Lanka’s tainted coal deal forces resignation of energy minister”, EconomyNext, 17 April 2026, https://economynext.com/explainer-sri-lankas-tainted-coal-deal-forces-resignation-of-energy-minister-267421/.

[21]     M Perera, “Cyber theft raises questions about government competence and commitment to transparency”, The Sunday Times, 26 April 2026, https://www.sundaytimes.lk/260426/columns/cyber-theft-raises-questions-about-government-competence-and-commitment-to-transparency-640155.html.

[22]     Harsha de Silva, “ඩොලර් මිලියන 2.5ක මූල්‍ය වාර්තාව සහ රටේ ආර්ථික තත්ත්වය ගැන හර්ෂ ද සිල්වාගෙන් අලුත්ම තොරතුරු [Latest updates from Harsha de Silva on the $2.5 million financial report and the country’s economic situation]”, YouTube, 2 June 2026, https://www.youtube.com/watch?v=Z0uSvx66ujg.

[23]     “Alleged suicide: SJB urges probe by Scotland Yard”, The Island, 6 May 2026, https://island.lk/alleged-suicide-sjb-urges-probe-by-scotland-yard/.

[24]     “PCoI questions Tilvin over remarks made on coal deals”, Sri Lanka Mirror, 28 May 2026, https://srilankamirror.com/news/pcoi-questions-tilvin-over-remarks-made-on-coal-deals/.

[25]     Report of the Committee on Public Finance on the Fraud Linked to Cybercrime in the US Dollar 2.5 Million Debt Repayment to Australia, op. cit.

Pic Credit: Shutterstock