CoPF says $ 2.5 m stolen via 10 transactions, ignoring red flags

• Treasury officials appear before CoPF after earlier declining summons
• CoPF Chair Dr. Harsha de Silva reveals 10 debt repayments over four months failed to reach Australia
• Transactions processed through multiple approval layers despite early warning signs
• Says Parliament not informed; questions over delay in escalation and disclosure
• Claims Australia flagged non-payment, raising concerns over Treasury verification processes
• Suspended Finance Ministry official passes away, suspected suicide

Treasury Secretary Dr. Harshana Suriyapperuma appeared before the Committee on Public Finance (CoPF) yesterday, reversing an earlier refusal to attend, as lawmakers were told that 10 Government debt repayment transactions totalling $ 2.5 million had been diverted over four months.

What was initially presented as a single $ 2.5 million breach during a “vulnerable” transition has now been revealed as 10 separate payments over several months, with red flags ignored and approvals continuing through multiple layers. The full extent appears to have been known by March rather than April.

Parliament was not informed, and questions remain over why Australia, not the Treasury, identified the non-payment, shifting the issue from a technical lapse to a failure of process, oversight, and reporting obligations.

The CoPF session, which lasted around three to three-and-a-half hours yesterday, was attended by senior Finance Ministry and Central Bank officials, with CoPF Chairman MP Dr. Harsha de Silva describing the engagement as professional despite concerns over process failures.

“After my absolute refusal to accept postponement of the summons, the Secretary to Treasury and senior officials attended the COPF meeting along with CBSL officials,” Dr. de Silva said.

He noted that all members of the Committee were present and participated in the meeting in a most professional manner, immaterial of political affiliations.

“It was revealed that 10 payments totalling $ 2.5 m had been robbed from the Treasury from October 20525 through January 2026,” he revealed in an X post.

The disclosures expand the scope of what had previously been understood as a single breach, pointing instead to a series of transactions carried out between late 2025 and early 2026 that failed to reach the intended recipient in Australia.

“Notwithstanding red flags being raised the process had continued and officials had made payments upon approvals being obtained from multiple reporting layers.

“We were astonished to find the massive gaps in procedure which had been manipulated to commit this crime over four months. Serious questions remain as to why audits did not pick up the tell-tale discrepancies,” Dr. de Silva said.

He said suspicion had first arisen in January, prompting internal inquiries and the involvement of Sri Lanka CERT and other law enforcement agencies, but that the full extent of the losses was only confirmed in March.

“It was only in January that suspicion was aroused, and the Treasury began its internal investigation and alerted CERT and other law enforcement agencies. We were told appropriate action was taken thereafter, but it was only in March that they discovered the extent of the theft,” he said.

Lawmakers also raised concerns over the handling of the incident, including delays in informing Parliament and the committee, and the reliance on external parties to flag non-payment.

One outcome of the discussion, Dr. de Silva said, was that significant gaps in processes had allowed the transactions to proceed despite warning signs, while questions remained as to why it had taken the Australian side to notify Sri Lankan authorities.

While law enforcement agencies are expected to determine responsibility, Dr. de Silva said the committee’s role was to ensure accountability in public finance management.

“While it is the duty of law enforcement to track down criminals our responsibility is to continue oversight on public finance in general and in this case debt repayment in particular. On that count, I took the strong position that it was the duty of the Treasury to inform us and not be told by outsiders. Their excuse of sensitive nature of the matter was not accepted.”

He added that the Treasury was bound by statutory obligations to escalate such incidents within defined timelines.

“The Treasury Secretary had obligations under several Acts and FRs to inform the FIU within 48 hours, to get an initial report within 7 days and have the complete report submitted to Auditor General and Parliament within 3 months. 

“While there is discrepancy on when exactly the Treasury found out about the crime, they informed us that they had initiated all such action, evidence for which we directed the officials to submit to us along with all relevant details. Next session on the matter will be held in four weeks at which point we will decide on further action,” Dr. de Silva asserted.

The Finance Ministry has been given four weeks to submit a full report with evidence, with the committee expected to determine further action thereafter. Dr. de Silva warned that if the funds are not recovered, the burden may ultimately fall on taxpayers.

The latest disclosures add to earlier findings that the breach occurred during a transitional phase in public debt management, when functions were being shifted from the Central Bank of Sri Lanka to the Treasury, creating what officials described as a “vulnerable” period with overlapping responsibilities and evolving controls.

Earlier accounts had pointed to manipulated communication channels linked to settlement processes with Export Finance Australia, with funds diverted to accounts controlled by cybercriminals, even as authorities maintained that debt servicing capacity remained intact.

The episode has intensified scrutiny of internal controls within the External Resources Department and the integrity of systems handling sovereign payments, at a time when Sri Lanka is nearing completion of its debt restructuring program and investor attention remains fixed on governance and financial credibility.

Suspended ERD official found dead

An official of the External Resources Department (ERD) of the Finance Ministry, who was among four officials suspended in late April 2026 pending a disciplinary inquiry into the $ 2.5 million cyber fraud, was found dead in Kuliyapitiya yesterday.

Police said the official, an Assistant Director, is suspected to have died by suicide.

The Government had suspended four senior Finance Ministry officials in connection with the incident, including a Director and an Assistant Director from the ERD, along with a Director and an Additional Director General from the Public Debt Management Office (PDMO).

The Criminal Investigation Department had earlier requested the official to report and record a statement in relation to the fraud, but he had failed to do so.

Kuliyapitiya Police are conducting further investigations.