Rs. 13 b lost — What the Central Bank’s circular really reveals

The Central Bank of Sri Lanka’s circular dated 16 April 2026, titled “Strengthening the Account Reconciliation Process of Licenced Banks,” deserves close attention — not merely for its prescriptions, but for what it implicitly acknowledges. Is it a case of closing the stall door after the horse has bolted?

Issued in the aftermath of the widely reported fraud in excess of Rs. 13 billion at NDB Bank, the circular identifies weak internal controls, inadequate Board oversight, delays in reconciliation processes, and insufficient monitoring by management. Most significantly, it states that such deficiencies have “undermined the accuracy and reliability of financial reporting.”

Be that as it may, this is not a routine supervisory observation. It is a statement that goes to the heart of confidence in the banking system.

Beyond an isolated incident

In this context, the NDB fraud cannot be viewed purely as an isolated operational failure.

Reconciliation gaps, weak oversight, and ineffective monitoring are not sudden breakdowns. They are structural weaknesses that typically develop over time and, importantly, are capable of being identified through supervisory processes.

This gives rise to a central question:  

If such deficiencies were present, to what extent were they known — or reasonably detectable — prior to the event?

Regulatory effectiveness is measured not only by response, but by prevention. A system-wide circular issued after a major incident, while useful, inevitably raises questions as to whether earlier intervention might have mitigated the scale or duration of the loss.

System-wide guidance, but limited specificity

The Central Bank has addressed the issue through a general directive applicable to all licensed banks. While this may be appropriate from a prudential standpoint, the absence of publicly available information on prior supervisory engagement is notable.

There is, for instance, no clarity on:

- whether specific institutions had been identified as having material reconciliation weaknesses  

- whether supervisory directions had been issued prior to April 2026  

- what remedial timelines, if any, had been imposed  

Greater transparency on these aspects would help reinforce confidence that supervisory processes are both proactive and effective.

The audit dimension

The circular also has implications for the role of external auditors.

Sri Lanka’s banking sector is audited by leading professional firms operating under internationally accepted auditing standards. These standards require auditors to evaluate internal controls and respond appropriately where deficiencies may impact financial reporting.

Against that backdrop, the Central Bank’s acknowledgment that internal control weaknesses have affected the reliability of financial reporting raises an important question:

How were such risks assessed and addressed in the course of external audits?

This is not to suggest conclusions, but rather to recognise that the issue warrants careful professional reflection. Where systemic control challenges exist, alignment between regulatory observations and audit assessments becomes critical to maintaining confidence in financial disclosures.

Accountability and governance

In the aftermath of fraud, focus often turns to individuals directly involved. While this is necessary, it is not sufficient.

The circular itself points to broader issues — including Board oversight and management monitoring. These are governance-level responsibilities.

Accordingly, any meaningful response must consider accountability across multiple levels:

- operational controls within institutions  

- governance oversight by Boards and committees  

- assurance provided through external audit  

- and the effectiveness of regulatory supervision  

Addressing only one layer risks leaving underlying vulnerabilities intact.

Implications for confidence

At a time when Sri Lanka is seeking to strengthen engagement with international investors and financial markets, the implications of such findings extend beyond a single institution.

Investor confidence is anchored in two key assumptions:

1. That financial statements are reliable  

2. That regulatory oversight is effective  

When the regulator itself acknowledges deficiencies affecting financial reporting, it is important that the response is both robust and transparent.

The credibility of the system depends not only on identifying issues, but on demonstrating that they are being addressed decisively.

From acknowledgment to action

The 16 April 2026 circular represents an important step in recognising weaknesses within reconciliation processes and internal controls.

The next step is equally important.

Clarity on supervisory actions, reinforcement of governance expectations, and continued engagement with the audit profession will be necessary to ensure that such issues are not repeated.

Conclusion

The fraud at NDB is significant not only because of its size, but because of the broader questions it has brought into focus.

The Central Bank’s circular provides a candid acknowledgment of systemic weaknesses. That candour is welcome.

The challenge now is to translate acknowledgment into sustained action — across institutions, governance structures, and assurance frameworks.

Ultimately, confidence in the banking system will depend not on the absence of issues, but on the effectiveness with which they are identified, addressed, and prevented.

A concerned investor, Moratuwa