FINANCIAL CHRONICLE – Sri Lanka’s Parliament witnessed a vigorous debate yesterday triggered by the Committee on Public Finance (COPF) report concerning a $2.5 million cyber fraud linked to sovereign debt service payments. This discussion highlighted significant rifts between government and opposition members regarding responsibility, cybersecurity shortcomings, and administrative oversight during a critical period of public debt management.
In a detailed exchange, bipartisan agreement on the fraud and significant administrative failings was evident. Kabir Hashim, representing COPF Chairman Harsha de Silva, pointed out that both parties endorsed the report’s findings, which underscored a substantial breach in sovereign debt operations. He emphasized that the transition to new debt management under the Public Debt Management Act resulted in coordination issues between the Ministry of Finance and the Central Bank. Hashim also criticized the suspension of four junior employees, linking the situation to the unfortunate suicide of one official, and called for an independent forensic audit.
Hashim referenced the report’s conclusions regarding executive accountability, stating, “The COPF report, agreed upon and signed by both government and opposition MPs, clearly holds senior officials at the Treasury and Central Bank accountable for multiple oversights.”
The government defended its actions, asserting that its response to the fraud was both swift and appropriate upon detection. Anil Jayantha, Minister of Labor and Deputy Minister of Finance and Planning, claimed that the administration promptly notified law enforcement, the Sri Lanka Computer Emergency Readiness Team (CERT), and international investigative bodies upon discovering suspicious transactions. He attributed the $2.5 million loss to fraudulent email instructions that altered banking details during the transition to the Public Debt Management Office (PDMO) and cited longstanding internal control deficiencies inherited from previous administrations. Jayantha accused the opposition of politicizing the cyber-attack, stating, “They seem to be trying to link this to numerous allegations against past governments and portray it as the largest fraud.”
Opposition leader Sajith Premadasa argued that framing the incident solely as a cybercrime overlooks the broader structural and governance failures involved. He pointed out that no Standard Operating Procedures (SOPs) or Memorandum of Understanding (MOU) were established between the Central Bank and the Treasury during the transition, creating significant institutional discord. Premadasa highlighted security audits that revealed vulnerabilities, such as weak passwords and the absence of multi-factor authentication on Treasury email servers. He challenged the government’s perspective on the breach, asserting, “This is not just a cybercrime. It is fundamentally a governance, procedural, and operational issue. Weak governance has been evident throughout the foreign debt repayment process in our country.”
Focusing on the operational missteps and their implications for the nation’s international reputation, Opposition MP Ravi Karunanayake stressed that the lack of due diligence and verification protocols compromises the country’s standing. He outlined the timeline of events, noting that following the enactment of the Public Debt Management Act on June 18, 2024, and a subsequent Coordination Council decision on September 23, 2025, the PDMO was set to take over responsibility for sovereign debt payments by January 1, 2026. However, during the transitional training phase in October 2025, cybercriminals targeted the External Resources Department (ERD) with manipulated invoices, leading to unauthorized fund transfers. Despite alerts from the US Federal Reserve regarding suspicious activity, the Finance Ministry proceeded with a payment requisition without proper verification.
Karunanayake highlighted the systemic failures in verification, stating, “Fake documents were accepted, and payments were processed. People in Australia are mocking us, saying, ‘Look at these fools in Sri Lanka falling for this.’” He criticized both the Central Bank and the Finance Ministry for their lack of accountability, arguing that inadequate verification protocols allowed fraudulent invoices to slip through the system.
Chathuranga Abeysinghe, Deputy Minister of Industry and Entrepreneurship Development, acknowledged that public institutions have suffered from outdated digital systems and inadequate internal controls for years. Following the breach, the Finance Ministry implemented stringent new protocols, including official channels through embassies and transaction verification units. He noted the necessity of interim suspensions to facilitate an independent investigation and lamented the loss of $2.5 million, alongside the tragic loss of an officer’s life.
Technical aspects surrounding server maintenance also emerged as a contentious point in the discussion. Opposition MP Ajith P Perera revealed that the Microsoft Exchange Server used by the Ministry lost its security certification in October 2025, leaving communication channels vulnerable just before the fraud occurred. He called for formal criminal investigations, urging that the matter be referred to the Criminal Investigation Department (CID) and the Bribery Commission for comprehensive scrutiny into administrative negligence.
Public Security Minister Ananda Wijepala stated that American financial investigators traced the movement of the stolen funds and shared this information with Sri Lankan authorities. However, retrieving the money remains complicated due to its routing through various international networks, including accounts in the US, Australia, the UAE, Switzerland, and Zambia. During parliamentary discussions, COPF noted that if international recovery efforts are unsuccessful, the financial burden will ultimately fall on Sri Lankan taxpayers, requiring the Ministry of Finance to allocate state funds to settle the $2.5 million debt owed to Australia.
