NDB hires foreign agency to trace Rs. 13.64 b in stolen money and digital assets

• Says independent forensic audit completed; Deloitte final report puts fraud at Rs. 13.64 b, Rs. 60 m above June interim estimate
• Bank says findings broadly match internal probe; internal action initiated against those responsible
• Insists no customer suffered losses; forensic recommendations on controls and governance being implemented

National Development Bank PLC (NDB) yesterday said it had engaged a foreign agency specialising in tracing stolen money and digital assets to recover funds lost in the fraud uncovered at the bank earlier this year, as the final forensic report put the loss at Rs. 13.64 billion.

The figure is Rs. 60 million more than that identified in the auditor’s interim report in June. The bank said it had received the final report from Deloitte Touche Tohmatsu India LLP, which confirmed the fraud at Rs. 13,639,664,684, against Rs. 13,579,664,684 announced on 26 June, 2026 following the interim report. 

The additional Rs. 60 million will be recognised in the bank’s accounts in accordance with applicable accounting standards, NDB said.

NDB said it is pursuing all avenues to recover the misappropriated funds. It has also initiated internal action against those identified as responsible for collusion, lack of supervision and control lapses that facilitated the fraud.

The revised breakdown attributes Rs. 1.46 billion to the period before 1 January, 2025, up from Rs. 1.42 billion in the interim report, and Rs. 2.56 billion to the quarter ended 31 March, 2026, up from Rs. 2.55 billion. The Rs. 9.62 billion attributed to the financial year ended 31 December, 2025 was unchanged.

The final figure compares with the bank’s initial internal estimate of Rs. 13.2 billion announced on 6 April, 2026, which was recognised in its first-quarter interim financial statements. The interim Deloitte figure was recognised in the second-quarter statements.

The bank said the report’s findings generally accord with those identified internally. The matters had been reported to law enforcement authorities and action is pending against the perpetrators in the criminal courts, it said.

NDB said Deloitte had been commissioned in consultation with, and in line with recommendations from, the Central Bank of Sri Lanka (CBSL) Director of Bank Supervision, and was required to issue its report directly to the CBSL, with the bank copied, to ensure the independence of the process.

The bank said recommendations in the report on control failures, technology lapses and governance improvements are being implemented, and that it continues to update the CBSL on measures taken.

NDB reiterated that no customer had suffered losses as a result of the fraud and that customer balances remain intact. It said it remains well capitalised with sound levels of liquidity.

“The Bank wishes to assure its depositors, customers and all other stakeholders that it does not view this forensic report as the closure of this chapter,” the statement, signed by NDB Director/CEO Kelum Edirisinghe, said. The bank said it treats the report as a step towards rebuilding its credibility and reputation, and committed to building a compliance and governance framework that would serve as a model for the financial sector.

NDB first disclosed the fraud on 2 April, 2026, saying certain employees, acting in connivance with third parties, were involved, with preliminary indications placing the exposure at about Rs. 380 million while investigations continued. Days later, the bank raised its estimate to Rs. 13.2 billion. Deloitte India was subsequently appointed as forensic auditor.

In May, the Colombo Chief Magistrate ordered the Criminal Investigation Department (CID) to arrest and produce before Court any senior NDB officials found to have aided and abetted the alleged misappropriation from the bank’s general ledger account.

The suspects in remand custody at the time were Finance Division Assistant Manager Lahiru Kodikara, his brother Pathum Kodikara, bank data operator Saranga Kosala and businessman Mohammed Inhamul Hashan.

The CID told Court the first suspect had gained the trust of other officers and allegedly masterminded the fraud, that no audit had been conducted on the general ledger account since 2022, and that 900 suspicious accounts had been identified. The Magistrate also sought a report on whether senior officials had suppressed CBSL recommendations issued after complaints related to the fraud.

In June, Parliament’s Committee on Public Finance (CoPF), chaired by Samagi Jana Balawegaya MP Dr. Harsha de Silva, subjected the CBSL to intense scrutiny over supervisory lapses and whether warning signs were missed as suspicious balances built up in the bank’s accounts.

Members questioned why NDB had participated in drafting the forensic audit’s terms of reference despite being the institution under investigation. CBSL Governor Dr. Nandalal Weerasinghe said the regulator had defined the mandate and scope.

The CBSL said the review was extended to 10 years because the employee alleged to be at the centre of the fraud had worked in reconciliation and transaction-input functions for more than nine years.

Lawmakers questioned how receivables linked to Customer Electronic Fund Transfer (CEFT) transactions, a real-time interbank payment system that normally settles within hours, could rise from around Rs. 3 billion to more than Rs. 12 billion without greater scrutiny.

CBSL officials maintained that bank supervision is prudential in nature and does not extend to transaction-level audits, an explanation several members criticised. Members also cited the IMF’s May review, which flagged the need to strengthen supervision of operational risk management and financial integrity frameworks following the fraud. Dr. de Silva said the CoPF would revisit the matter after the interim and final reports were received.