NDB’s Reported LKR 13.58 Billion Fraud: The Record to 27 August 2026

By 27 August 2026, the public record on the alleged internal fraud at National Development Bank PLC had moved beyond the initial LKR 13.20 billion estimate. NDB had recognised a revised estimated fraud impact of LKR 13.58 billion, restated comparative financial results and reported LKR 4.83 billion in post-tax profit for the first half of 2026. The final status of the forensic review, later court outcomes, recoveries and responsibility could not be established from the accessible public record.

The central number is LKR 13,579,664,684. On 26 June 2026, NDB told the Colombo Stock Exchange that Deloitte Touche Tohmatsu India LLP had identified suspicious transactions of that value in an interim review. The disclosure said the finding was based on work completed at that point and that the observations were preliminary and indicative. On 22 July, NDB used LKR 13.58 billion as its revised estimated fraud impact for accounting purposes and restated comparative figures.

Those statements are related, but they are not interchangeable. The interim suspicious-transaction value that NDB attributed to Deloitte’s work was not a final forensic conclusion or a judicial determination. NDB’s later accounting recognition explains how the bank reflected the estimate in its unaudited financial statements; it does not establish what may ultimately be recovered, frozen, insured or assigned as civil or criminal responsibility.

Related publication history

This is a standalone report based on public records available through 27 August 2026. Related reports published by the author on LinkedIn in April 2026 and on 27 August 2026 are retained as publication provenance; they are not treated as independent evidence for the claims below.

Four evidence labels are used throughout:

• Official or first-party record means a statement or filing by NDB, CBSL, Parliament or a rating agency. It establishes what that body said, not necessarily the truth of every underlying allegation.
• Reported court event means contemporaneous reporting of a hearing or order where the complete court record was not available for inspection.
• Party allegation means a claim by investigators, petitioners, respondents or counsel that has not been adopted as a judicial finding.
• Author analysis means an inference from the disclosed record. It is not a forensic, regulatory or legal conclusion.

Evidence cut-off and right-of-reply record: 27 August 2026. No fresh pre-publication approach was made to the named institutions or parties for this website report. Their published statements and procedural positions are recorded below. The right of reply remains open. Material responses or corrections received after publication will be assessed through the corrections channel.

What the public record establishes

The evidence supports six propositions without converting allegation into verdict.

First, NDB disclosed an internal fraud in April. CBSL said on 6 April that NDB had reported an incident capable of causing a significant loss, while also stating that customer accounts and deposits had not been affected and that capital and liquidity ratios remained above regulatory minima. CBSL repeated the customer-account and prudential position on 10 April.

Second, CBSL said on 17 April that the forensic review would address the incident and possible failures in regulatory compliance, control, oversight and governance. It said interim findings and the final report would be submitted directly to CBSL. NDB later said that its board had commissioned Deloitte and that the bank received the interim report. The record shows parallel reporting: NDB commissioned and received the work, while CBSL was to receive the findings and could engage directly with the auditors.

Third, NDB’s 26 June CSE disclosure raised the working figure from LKR 13.20 billion to exactly LKR 13,579,664,684 in suspicious transactions. The disclosure did not describe that figure as final.

Fourth, NDB’s 22 July unaudited results accounted for LKR 13.58 billion as the revised estimated fraud impact and restated comparative figures. The accounting treatment is the strongest public evidence of the amount NDB had recognised by the cut-off.

Fifth, NDB said on 22 July that law-enforcement investigations were progressing. The latest public report located on the derivative action was dated 6 July and described the petitioners as still seeking leave. No later reliable status report or final determination of individual, board, auditor or regulatory liability was located.

Sixth, Parliament’s 17 June release said CoPF had discussed the matter on 9 June and intended to return to it after completion of the forensic audit. Parliament’s official account also records serious CoPF concern in April, but it does not establish that every criticism made during those hearings was a committee finding.

From a preliminary finding to a financial restatement

The 26 June and 22 July disclosures must be read together.

NDB said Deloitte’s examination had identified LKR 13,579,664,684 in suspicious transactions so far. The bank stressed that the interim observations were preliminary and indicative and that the report was confidential under the engagement. In July, NDB described LKR 13.58 billion as the revised estimated financial impact and attributed it across accounting periods as follows:

Accounting period	Gross amount attributed by NDB
Before 1 January 2025	LKR 1.42 billion
Year ended 31 December 2025	LKR 9.62 billion
Quarter ended 31 March 2026	LKR 2.55 billion

The components are rounded to two decimal places, so their displayed sum need not reproduce the exact rupee figure. The allocation also does not, by itself, prove when each transaction occurred or that activity accelerated at the same rate as the accounting recognition. It shows how NDB assigned the recognised impact to reporting periods.

The restatement materially changed prior earnings:

Measure	Previously reported	Restated or reported in July
FY2024 post-tax profit	LKR 9.03 billion	LKR 8.18 billion
FY2025 post-tax profit	LKR 11.04 billion	LKR 5.90 billion
First-half 2026 post-tax profit	—	LKR 4.83 billion
First-half 2026 post-tax profit excluding the bank-reported fraud impact	—	LKR 6.21 billion
Second-quarter 2026 post-tax profit	—	LKR 3.01 billion

NDB presented the second-quarter result and the pro-forma figure excluding the fraud impact as evidence of underlying operating resilience. That is management’s interpretation. The observable facts are the disclosed profits and restatement.

At 30 June, NDB reported total assets of LKR 949.02 billion, deposits of LKR 712.50 billion, rupee and all-currency liquidity coverage ratios of 163.5% and 163.2%, Common Equity Tier 1 capital of 9.7%, and total capital adequacy of 15.3%. The bank said all were above applicable minima. These are point-in-time, bank-reported prudential measures. They support the narrower conclusion that the disclosed impact had been recognised without the bank reporting a breach of those ratios at end-June. They do not support a general assurance about future solvency, liquidity, share value or recovery. This investigation is not financial advice.

Forensic review: what was promised and what remains unknown

CBSL’s 17 April statement defined a broad forensic scope. It included the commission of the alleged fraud and possible failures in compliance, controls, oversight and governance during the relevant period. CBSL also directed NDB to strengthen controls and governance and required an independent third-party review of policies, procedures, systems and internal controls.

NDB announced in May that Deloitte India had been appointed. The board commissioned the review; the bank received the interim report; and CBSL had said the interim and final findings would be sent directly to the regulator. That structure shows that NDB commissioned and received the work while CBSL retained direct access to its findings.

During the June CoPF scrutiny, Daily FT reported that CBSL officials expected the final forensic report around 18 July. That was an expected submission date, not a promise that the report would be published. On 22 July, NDB still described the review as ongoing and said the final report was expected in due course. No later official NDB, CSE or CBSL announcement confirming final submission or public release was located by 27 August.

The final status was not established in the public material reviewed. That record does not support describing a completed report as “withheld” without first establishing that it had been completed and submitted. Nor does the absence of a public copy establish that no report exists.

Criminal proceedings: the last verified position

The criminal record requires particular care because later public court reporting is sparse.

Daily Mirror reported that, on 14 May, the Colombo Chief Magistrate directed the CID to arrest and produce any senior NDB official if the investigation found that person had aided or abetted the alleged fraud. The conditional clause is essential. The order was not a blanket arrest warrant against unnamed senior officials and did not itself find that a director or executive had participated.

The same report said four people were produced from remand and remanded until 29 May. NDB’s May investor presentation said four people had been arrested, including two staff members.

The accessible public record did not establish their bail or custody status after 29 May. It also did not establish the later outcome of directions concerning audit records, possible neglected duties or any CBSL recommendations. Sparse reporting does not establish the pace of the investigation, whether a conditional direction was acted on or whether other investigative steps occurred outside the public record.

No public confirmation of a criminal High Court indictment, a formal asset-freezing order or a quantified recovery was located by the cut-off. These are negative public-record findings, not proof that no such step or document exists. NDB’s May investor presentation said asset tracing was in progress with CID assistance and that it was too early to comment on recovery prospects. Asset tracing is not the same as an asset freeze or a recovery.

The derivative action: allegations are not findings

NDB’s 11 May CSE disclosure recorded a derivative action by minority shareholder M. Thiyagaraja in the Commercial High Court of the Western Province, case No. 21/2026/CO. The proceeding named the bank, its directors and Ernst & Young and its partners as at 31 December 2025.

The procedural sequence must be kept precise. Submissions on 8 May addressed notice and maintainability, and the court reserved an order. Daily FT subsequently reported that the petitioner was directed to serve notice on the respondents, returnable on 26 May, and that the application was fixed for support. Serving notice was not a decision granting leave, rejecting procedural objections or determining liability.

The petitioner and counsel argued that abnormal CEFTS-related balances should have been detected and that directors and auditors had failed in their duties. Those are party positions. Counsel for NDB, the directors and EY raised objections. The latest reliable public report located, dated 6 July, described the petitioners as still seeking leave. No later reliable status report or public ruling on leave, maintainability or the merits was located by 27 August; this review therefore cannot establish the action’s position at the evidence cut-off.

It is therefore premature to say that the case has established board failure, auditor negligence, a conflict involving Deloitte, or a precedent for personal liability. Those questions depend on the court record and any later ruling.

CBSL and parliamentary oversight

CBSL’s public position contained two strands. It repeatedly said that customer deposits and accounts were unaffected and that NDB remained above capital and liquidity minima. It also said the forensic review would test regulatory compliance, control, oversight and governance, and that it was prepared to take further measures if necessary.

One concrete regulatory measure appears in NDB’s 22 July statements. NDB said CBSL had directed it to suspend the LKR 6.46-per-share cash component of the FY2025 final dividend before payment. The LKR 2.04 scrip component had been issued. This establishes a disclosed intervention; it does not establish insolvency, civil liability or criminal responsibility.

Parliament’s CoPF was more critical. Its official record of the 7 April meeting says the committee saw apparent lapses in NDB corporate governance, deficiencies in CBSL supervision and delay in reporting material information. Those are the committee’s stated concerns, not findings of criminal or civil liability.

The next relevant CoPF meeting occurred on 9 June 2026. Parliament’s release, published on 17 June, confirms that the committee discussed technical matters and CBSL’s role and responsibilities, and decided to take the matter up again after completion of the forensic audit. More detailed media accounts reported testimony about the terms of reference, the length of the review and CEFTS settlement mechanics. Those details should be attributed to the witnesses and reports rather than presented as independent parliamentary findings.

No public appointment of a competent authority or interim administrator was located by the cut-off. CBSL’s official statements did not say that it had refused such an appointment or provide the rationale attributed to it in some commentary. The accurate public-record position is simply that no appointment was publicly announced in the sources reviewed.

Rating action and market interpretation

Fitch downgraded NDB’s National Long-Term Rating from A(lka) to A-(lka) with a Negative Outlook on 10 April. It also downgraded the bank’s Basel III subordinated debt from BBB+(lka) to BBB(lka). Fitch attributed the action to pressure on capital and profitability and internal-control weaknesses relative to peers. Those are Fitch’s credit opinions, not regulatory or judicial findings.

This review does not use the movement in NDB’s share price as a measure of reputational damage. A price change can reflect the disclosure, earnings, market-wide conditions, interest rates and other information. Establishing a causal market effect would require a defined benchmark and event-study method. No event-study analysis was conducted for this report.

What remains unresolved

The available evidence leaves several material questions open:

Question	Public-record position at 27 August 2026
Was the final Deloitte report completed and submitted?	The expected submission date, actual completion, submission to CBSL and public release are separate events. No later official announcement establishing those events was located.
How much money was traced, frozen, insured or recovered?	No public official source reviewed provided a quantified amount. Reports of funds moving offshore or through cryptocurrency remained allegations rather than established findings.
What happened in the criminal proceedings after May?	The last verified report located recorded remand until 29 May. Later custody, charges, an indictment, asset restraint and recovery were not established in the accessible record.
What was the outcome of the derivative action?	The latest reliable public report located said the petitioners were still seeking leave. No later ruling on leave, maintainability or liability was located.
Who bears responsibility for failures in control or oversight?	The forensic scope and parliamentary record raised serious questions, but no publicly located final forensic, criminal, civil or regulatory determination answered them by the cut-off.

These are evidence gaps, not conclusions that the relevant events did or did not occur.

What should change the assessment

The evidence base should be updated when any of the following becomes public:

• the final Deloitte report or an official summary stating its scope, submission date, quantified findings and control conclusions;
• a CBSL enforcement decision, governance direction or published account of completed remedial work;
• a later Magistrate’s Court or criminal High Court record establishing custody, charges, an indictment, an asset restraint or recovery;
• a Commercial High Court decision granting or refusing leave, resolving maintainability or determining the derivative action;
• an official quantified recovery, insurance payment or adjustment to the recognised financial impact; or
• a further NDB-specific rating action based on the restated results or forensic findings.

As at 27 August 2026, the public record supports a limited conclusion. NDB had recognised a revised estimated LKR 13.58 billion fraud impact in its unaudited interim financial statements. NDB reported that Deloitte’s interim work had identified the underlying LKR 13,579,664,684 as suspicious transactions on a preliminary and indicative basis. The bank reported capital and liquidity ratios above regulatory minima at end-June. Court and parliamentary proceedings raised serious questions about controls, oversight and responsibility, but the reviewed public record did not contain a final forensic, criminal or civil determination answering them.

That distinction is not a defence of NDB, its board, its auditors or the regulator. It is the discipline required to investigate them fairly.