When trust is at risk: What Sri Lanka’s alleged billion-dollar financial crime case tells us about governance

A country’s financial system is only as strong as the integrity of the institutions that operate within it. Sri Lanka cannot build a modern investment destination while tolerating weaknesses in governance

Sri Lanka has spent years trying to rebuild confidence in its economy, restore international credibility and convince investors that the country is moving towards stronger institutions, greater transparency and better governance. Against that backdrop, reports of a major financial investigation involving alleged illicit capital outflows and senior officials of several leading private banks should concern far more than the banking industry.

If the allegations are established through due process, this is not simply a case of individuals allegedly facilitating questionable transactions. It raises a much larger question: How strong are the institutional safeguards protecting Sri Lanka’s financial system?

The reported scale of the alleged transactions, running into hundreds of millions of dollars, makes the issue particularly serious. At a time when Sri Lanka is working hard to attract foreign investment, strengthen its foreign-exchange position and restore confidence in its economy, any perception that the country’s financial institutions can be exploited for large-scale illicit transfers could have consequences well beyond the individuals under investigation.

The first principle must be clear: allegations are allegations. Arrest does not constitute guilt, and every individual is entitled to due process and the presumption of innocence. The investigations must therefore be allowed to proceed independently and transparently. But regardless of the eventual outcome of individual cases, the reported circumstances demand a serious national conversation about corporate governance, regulatory oversight and institutional accountability.

The question cannot end with the people who processed the transactions

One of the most important questions is whether responsibility should be confined to the officials allegedly involved in facilitating transactions. Banks are not simply commercial businesses. They are custodians of public confidence and critical components of national economic infrastructure. Their operations depend on sophisticated compliance systems, risk management frameworks, internal audit mechanisms and layers of managerial oversight. Therefore, when allegations of significant financial irregularities emerge, the natural question is not only: Who processed the transaction? It is also:

Who was responsible for the system that allowed it to happen?

This is where Boards of Directors and senior management have a particularly important responsibility. A board cannot be expected to know every transaction taking place within a large financial institution. Nor should boards interfere in legitimate operational decisions. But they have a fundamental responsibility to ensure that appropriate systems, controls, risk-management structures and compliance mechanisms exist, and that warning signs are identified and acted upon. Corporate governance is not merely about approving annual reports, attending board meetings or satisfying regulatory requirements. It is ultimately about accepting responsibility for the integrity and resilience of the institution.

Compliance cannot become a box-ticking exercise

Modern banking operates in an environment of sophisticated financial crime. Money laundering, trade-based financial crime, fraudulent documentation, cyber-enabled financial transfers and complex international transactions require equally sophisticated monitoring systems. It is therefore not enough to have compliance departments simply because regulations require them. Compliance must have the authority, independence, resources and technological capability to challenge transactions and senior executives when necessary.

Internal audit must also be more than a procedural function. It should be capable of identifying weaknesses before they become crises. This requires investment in technology, data analytics, transaction monitoring, staff training and independent risk assessment. Sri Lanka has highly qualified professionals in its banking sector. The issue is therefore not a lack of talent. The challenge is whether institutions have created an environment where professionals are empowered to act when something appears wrong.

The reputation of the banking sector is a national asset

Sri Lanka’s financial institutions have built their reputations over decades. That reputation matters enormously. An investor considering Sri Lanka does not examine only tax rates, labour costs or infrastructure. Investors also look at the reliability of banks, the strength of regulators, the transparency of transactions and the predictability of institutions. International correspondent banking relationships depend heavily on confidence in a country’s financial controls. If Sri Lanka develops a reputation for weak oversight or inadequate prevention of illicit financial flows, the consequences can include increased scrutiny, higher compliance costs, reputational damage and reduced investor confidence. This is why financial crime should not be treated purely as a law-enforcement issue. It is also an economic-security issue.

Where are the regulators in this equation?

The responsibility does not rest exclusively with commercial banks. Sri Lanka has a regulatory architecture designed to protect the integrity of the financial system. The effectiveness of that architecture depends on how well institutions coordinate, share information and respond to warning signs.The Central Bank, financial intelligence and law-enforcement authorities, auditors, compliance professionals and financial institutions all have different responsibilities. The objective should not simply be to investigate after a major problem has emerged.

The real measure of an effective system is whether suspicious activity can be detected early enough to prevent significant damage. This is where technology becomes increasingly important. Artificial intelligence, advanced analytics and automated transaction-monitoring systems can help identify unusual patterns that may not be visible through traditional manual processes. But technology alone cannot solve the problem. It must be supported by strong governance, ethical leadership and independent oversight.

 Financial crime should not be treated purely as a law-enforcement issue. It is also an economic-security issue

Boards must accept the responsibility that comes with authority

There is an uncomfortable reality in corporate governance: authority and responsibility must travel together. Boards enjoy significant authority over the strategic direction of institutions. Senior management controls operations. With that authority comes a responsibility to shareholders, employees, customers and, in the case of systemically important financial institutions, the wider economy. When an institution succeeds, leadership rightly receives credit.

When serious failures occur, leadership cannot simply distance itself from the consequences by pointing to individual employees. This does not mean that every institutional failure represents misconduct by the board. It does mean that boards must ask difficult questions about whether their systems are genuinely effective.

Were red flags identified?

Were they escalated?

Were compliance officers sufficiently independent?

Were internal audit recommendations implemented?

Were unusual transactions subjected to appropriate scrutiny?

Were employees able to raise concerns without fear?

These are governance questions that every financial institution should be asking.

Sri Lanka cannot afford another crisis of confidence

The country has already experienced the consequences of institutional weakness. Economic recovery requires more than financial assistance, debt restructuring and fiscal reforms. It requires rebuilding trust. Trust among citizens. Trust among investors. Trust between businesses and regulators. And trust between Sri Lanka and the international financial community. That trust is fragile.

The answer to the present allegations should therefore not be limited to arrests, investigations and prosecutions. If wrongdoing is established, those responsible must face the consequences under the law. But equally important is learning how the system can be strengthened so that similar vulnerabilities are not exploited again. Sri Lanka should consider a comprehensive review of high-risk banking transactions, trade-finance controls, cross-border transfers, beneficial ownership verification, internal audit effectiveness and board-level risk oversight. The objective should be prevention, not merely punishment.

Integrity must begin at the top

Perhaps the most important lesson is simple. A country’s financial system is only as strong as the integrity of the institutions that operate within it. Sri Lanka cannot build a modern investment destination while tolerating weaknesses in governance. We cannot ask international investors to trust our institutions while failing to demand the highest standards from those entrusted with managing them. This is why the reported allegations should become an opportunity for institutional reflection. The question should not simply be who is responsible for the alleged transactions? The bigger question is:

What institutional weaknesses allowed such allegations to arise in the first place?

That question must be answered honestly. Boards must strengthen oversight. Senior management must strengthen accountability. Regulators must strengthen supervision. Compliance functions must be empowered. Law enforcement must remain independent. And financial institutions must embrace a culture where integrity is valued above short-term commercial convenience. Sri Lanka is trying to restore its economic reputation after one of the most difficult periods in its modern history. We cannot afford to lose the most important currency of all, trust. Because when confidence in the financial system is weakened, the damage is not confined to a bank, a boardroom or a group of officials. It ultimately reaches the reputation of the country itself.

(The author is the Secretary General of the Ceylon Chamber of Shipping, former Director General of the Institute of National Security Studies (INSS), and former Spokesman of the Ministry of Defence. He is also a Non-Resident Fellow at the London Dialogue. His areas of expertise include international relations, geopolitics, maritime affairs, national security, economic policy, and strategic governance).