THE NDB FRAUD: THE NUMBER WAS ALREADY THERE
The most troubling dimension of the unfolding NDB fraud story is no longer confined to the fraud itself, but to the sequence – and escalation – of numbers that now appear to have been sitting in plain sight. Because when the bank prepared its Annual Report in December 2025, there existed within its own financial statements a line item – “Other Financial Assets” – carrying a value of approximately Rs 12.2 billion. This was not an isolated figure. It was part of a trajectory.
In the previous year, that same line item stood at approximately Rs 3,160,096,000.
That is not a marginal increase. That is a near four fold jump within a single reporting cycle.
Such movements, by their very nature, demand explanation. Banks do carry balances under “Other Financial Assets” – for reconciliation, settlement, and technical accounting purposes. But when a category expands from Rs 3.1 billion to Rs 12.2 billion, it ceases to be routine. It becomes a number that must be understood, broken down, and interrogated at the highest levels of oversight.
The question is not whether the category is legitimate.
The question is whether the movement within that category was sufficiently questioned.
Fast forward to April 2026, and the narrative presented to the market begins modestly. A fraud is disclosed. The initial estimate: Rs 380 million. The qualifier: it is expected to be “significantly higher.” The framing suggests an issue still being uncovered, a number still forming, a problem not yet fully visible.
And then, on 6th April 2026, the number lands with full force.
Rs 13.2 billion.
Placed alongside the December figure of Rs 12.2 billion, the proximity is striking. But when viewed against the prior year’s Rs 3.1 billion, the trajectory becomes even more significant.
Rs 3.1 billion Rs 12.2 billion Rs 13.2 billion
This is not a static balance. This is a surge. Which raises the unavoidable question:
Was this surge seen, understood, and challenged at the time?
Because if a balance of Rs 12.2 billion existed within “Other Financial Assets” at the point of financial reporting, then it would have been:
- Presented within the accounts
- Reviewed at committee level
- Available to the board
Was it explained in sufficient detail?
Was the increase from Rs 3.1 billion to Rs 12.2 billion interrogated?
Was the nature of these assets clearly understood?
Or was it accepted as part of the normal course of business?
The initial disclosure of Rs 380 million now takes on a sharper edge. How was that number derived, when a materially larger balance had already been recorded months earlier? Was it a partial identification? A preliminary estimate? Or an indication that the underlying exposure had not yet been fully recognised?
Each possibility raises a different question. None of them are easy.
This is where the issue moves beyond fraud.
Because directors are not expected to detect individual transactions. But they are expected to ensure that material balances are understood, that significant movements are explained, and that systems of control are robust enough to detect anomalies before they scale. And here, the movement was not subtle.
It was visible in the accounts themselves.
The question therefore presents itself, stark and unavoidable:
What did the Board know, when did it know it, what did it demand, and were the systems of oversight adequate?
Because if the Rs 12.2 billion was legitimate and understood, then the emergence of a Rs 13.2 billion fraud demands an explanation of what changed. And if it was not fully understood, then the question becomes why such a dramatic increase – from Rs 3.1 billion to Rs 12.2 billion – was accepted without deeper scrutiny.
Either way, this is no longer just a story of fraud. It is a story of visibility, escalation, and oversight.
NEWSLINE-STYLE TRUTH
Be that as it may, numbers do not simply grow fourfold without leaving a trail. The issue is whether that trail was followed.
THESTING
If Rs 3.1 billion became Rs 12.2 billion before it became Rs 13.2 billion, the real question is not what was discovered – but what was already there.
NDB FRAUD AT LKR 13.2 BILLION – A DIRECT HIT ON CAPITAL, CONTROL AND CONFIDENCE
One Years’ Profits down the ‘fraud drain’
Be that as it may, the latest stock exchange filing by NDB Bank confirming that its internal fraud exposure has surged to LKR 13.2 billion has transformed what was initially perceived as a contained irregularity into one of the most serious financial sector events in recent times. The magnitude of the number alone demands attention, but it is the context within which it sits that raises far deeper concerns about capital strength, internal controls, and institutional accountability.
The immediate question is simple: what does LKR 13.2 billion mean to NDB? The answer is stark. The bank’s shareholders capital base – comprising equity and reserves – stands in the region of LKR 70–75 billion. Against that, the loss now represents approximately 18% of total capital. In banking terms, this is not a routine impairment or provisioning adjustment. It is a direct erosion of the bank’s ability to absorb shocks.
The impact on profitability is equally severe. NDB’s most recent annual earnings have typically ranged between LKR 8–12 billion, depending on macroeconomic conditions. A loss of this scale effectively wipes out more than a full year of profits and potentially closer to two years when adjusted for current operating pressures. In simple terms, earnings momentum is not merely disrupted – it is reversed.
The pressure extends further into regulatory territory. NDB has historically maintained capital adequacy ratios in the mid-to-high teens, comfortably above minimum requirements. However, a full recognition of this loss is likely to compress that ratio towards the ~14% range, leaving the bank still compliant – but operating with a significantly reduced buffer. The distinction is critical. Compliance is not the same as comfort.
The bank has moved swiftly to reassure the market, stating that depositors remain unaffected, operations continue as normal, and capital ratios remain above regulatory thresholds. A forensic audit has been initiated, employees have been suspended, and authorities informed. These steps are expected.
But they do not answer the central question.
Because this was not a bad loan. Not a market loss. Not
an external shock. This was internal.
In modern banking, failures of this magnitude are not supposed to accumulate unnoticed. Systems of control – segregation of duties, audit oversight, compliance monitoring, and the so-called “four-eyes principle” – exist precisely to detect anomalies early and contain risk. Yet here, a number that was initially communicated at LKR 380 million has escalated to LKR 13.2 billion.
That is not slippage. That is failure.
DATA SNAPSHOT – THE NUMBERS THAT MATTER
- Shareholders Capital Base: ~LKR 70–75 billion
- Fraud Exposure: LKR 13.2 billion
- Shareholders Capital Impact: ~18% erosion
- Annual Profit: ~LKR 8–12 billion
- Profit Impact: >1 year wiped out
- Estimated CAR: ~14% post-impact (from ~16–18%)
WHO OWNS, WHO WATCHES, WHO ANSWERS
Be that as it may, NDB is not a purely private institution operating in isolation. Its ownership structure reveals a significant presence of state-linked institutional investors, most notably the Employees’ Provident Fund and the Sri Lanka Insurance Corporation. Together, these entities hold a meaningful minority stake, placing public funds squarely within the bank’s capital structure.
This does not amount to government control. But it does create public exposure.
The implication is unavoidable.
When pension funds and state insurers are shareholders, governance failures are not confined to private loss – they carry a broader dimension of public accountability. Board representation linked to institutional shareholders exists precisely to ensure oversight, scrutiny, and early intervention where risks emerge.
That brings the focus sharply onto the board.
Because at LKR 13.2 billion, this is not an operational anomaly. It raises questions that move beyond employees and into systems:
• Were early warning signals detected?
• Were audit findings escalated?
• Did risk committees act – or fail to act – in time?
The issue is compounded by the bank’s existing balance sheet pressures.
Like much of the sector, NDB has been managing elevated non-performing loans in the range of 6–8%, with provisioning buffers built over recent years to absorb credit stress following the economic crisis. These provisions, however, are designed to address borrower default – not internal breakdown.
The result is a dual pressure point. Credit stress from loans. Operational shock from fraud
Both converging on capital. Accountability, therefore, cannot be narrow.
At the base level sit the individuals directly involved. Above them sit management, compliance, and internal control functions. Beyond that lies executive leadership. And ultimately, the board itself.
Oversight in banking is layered by design. When a failure reaches this scale, it is rarely confined to one layer alone.
The Central Bank now enters the frame. The Central Bank of Sri Lanka, as regulator, will be expected to assess not only the financial impact, but the adequacy of controls, governance structures, and risk management systems that allowed this exposure to develop.
Whether this leads to supervisory tightening, capital directives, or broader sectoral scrutiny remains to be seen.
AUDIT CLEARED…. FRAUD EMERGES
NDB UNDER THE LENS: WHEN “TRUE & FAIR” MEETS UNANSWERED QUESTIONS
Be that as it may, the numbers were signed off. The language was familiar. The assurance, unequivocal. The 2025 accounts of NDB Bank were audited and presented as a “true and fair view” of the institution’s financial position. No qualifications. No dramatic warnings. No visible alarm bells.
And yet – here we are.
Because outside the clean lines of audited financial statements, a different narrative is beginning to surface. One that speaks not of balance sheets, but of breakdowns. Not of compliance, but of control.
THE AUDIT SAID: ALL IN ORDER
An unqualified audit opinion is not casual. It is the highest level of assurance auditors provide. It tells shareholders, regulators, and the market one thing:
We have examined the evidence, and nothing materially distorts the picture.
In banking, that assurance carries even more weight. Institutions like NDB operate in a tightly regulated environment where internal controls, transaction monitoring, and reconciliation processes are not optional – they are foundational.
Which raises the unavoidable question about the Rs 12.2 Billion of ‘Other Assets” over the previous years’ Rs 3.1 Billion
If the system was sound enough to pass audit scrutiny… what exactly went wrong?Indeed did the Auditors comment on a fourfold increase from the previous year? Had the turnover also increased proportionately you may wish to reframe it. But was it?
The Auditors are EY – respected, trusted. Their Head serves the President of Sri Lanka as an Advisor.
THE FRAUD ALLEGATIONS: A DIFFERENT STORY
Industry chatter – now spilling into the public domain – points to the possible movement of funds through internal channels not immediately visible in customer-facing systems.
Suspense accounts. Temporary holding lines.
Routine tools – until they aren’t.
Used correctly, they are housekeeping mechanisms. Used poorly – or worse, deliberately – they can become blind spots. And in banking, blind spots are not minor oversights.
They are risk corridors.
THE GAP: WHERE AUDIT ENDS AND REALITY BEGINS
Here lies the tension.
Audits do not examine every transaction. They assess systems, test controls, and rely – critically – on the integrity of those controls functioning as designed.
The integrity of these accounts depends entirely on strong controls, clear audit trails, and timely reconciliation.
If those controls are bypassed, weakened, or rendered procedural rather than substantive, then the audit process itself begins to rely on assumptions that may no longer hold.
And that is where the real risk lies.
THE STING
In banking, it is not the transaction that breaks trust. It is the failure to see it.
