Sri Lanka debt payment fraud deepens as CBSL disputes Finance Ministry claims over the diversion of nearly $2.5 million to fraudulent accounts.
The Sri Lanka debt payment fraud controversy has deepened after the Central Bank rejected parts of the Finance Ministry’s account of how nearly USD 2.5 million reached fraudulent accounts.
The Central Bank of Sri Lanka submitted a special report to the Parliamentary Committee on Public Finance, or COPF, addressing what it described as false or incomplete information in the ministry’s report.
The disputed payment totalled USD 2,489,441. It formed part of a foreign debt obligation owed to the Australian lending institution Export Finance Australia.
According to the Central Bank’s account, fraudsters created false payment instructions after gaining access to an email system connected to the Ministry of Finance, Planning and Economic Development.
COPF has separately identified systemic failures surrounding the incident, which caused a USD 2.5 million Treasury loss and left Sri Lanka in arrears to Export Finance Australia. However, the committee noted that determining criminal responsibility falls outside Parliament’s oversight mandate.
Sri Lanka Debt Payment Fraud Linked to Verification Failures
The Central Bank said agreements signed with the Australian lender on October 27, 2025, remained available within the Finance Ministry’s External Resources Department.
However, ministry officials allegedly failed to compare the bank account details in the invoices with those contained in the original agreements.
CBSL said its Treasury Department acted as the Government’s banker and executed payment instructions approved and forwarded by the Finance Ministry.
The Central Bank also said its Treasury Department had raised concerns under the Anti-Money Laundering framework.
According to its report, the beneficiary bank listed in the ministry’s invoice was located in a different state from the expected recipient details.
CBSL officials therefore advised the ministry to verify the banking information directly with the creditor.
However, the Central Bank alleged that ministry officials failed to obtain direct confirmation. Instead, they proceeded using information received through the compromised or fraudulent communication channel.
The wider incident involved hackers or impersonators using altered payment instructions to redirect a debt repayment intended for Australia.
CBSL Rejects Claim of Direct Supervision
The Central Bank’s Public Debt Department had provided training to the Public Debt Management Office established under the Public Debt Management Act No. 33 of 2024.
Following that training, PDMO officials began independently preparing Standard Settlement Instructions from October 24, 2025.
They also entered transactions into the NRM system through their own user accounts, the Central Bank said.
CBSL cited system logs to challenge the Finance Ministry’s claim that the disputed transactions occurred under the Central Bank’s direct supervision or approval.
According to CBSL, the Public Debt Management Office had operated independently within the Finance Ministry from October 2025.
Ministry officials reportedly handled the relevant transactions and approvals after receiving the necessary training and technical assistance.
The Central Bank therefore argued that neither its training nor any defect in its systems caused the diversion.
Instead, it blamed a serious failure within the ministry’s internal verification and control procedures.
CBSL maintained that it had continued to fulfil its responsibilities as the Government’s banker while supporting the country’s foreign debt payments.
Central Bank Highlights Five Areas of Concern
1. Breakdown of Internal Controls
The Central Bank identified the compromised email communications and alleged negligence within the External Resources Department as the direct causes of the fraud.
It said officials failed to compare the payment instructions with the original loan documents before authorising the transaction.
According to CBSL, ministry officials treated the altered instructions supplied by the fraudsters as genuine.
2. Disputed Claims About CBSL Oversight
The Central Bank rejected the claim that the Public Debt Management Office remained under its direct supervision when the fraud occurred.
It said the office had functioned independently under the Finance Ministry since October 2025.
CBSL maintained that ministry officials prepared, entered and approved the transactions themselves after receiving prior technical training.
3. Warnings Allegedly Ignored
The Central Bank said its officials questioned changes linked to the beneficiary’s address and banking information during the transaction.
However, the report alleged that the ministry did not verify the information directly with Export Finance Australia.
Instead, officials reportedly relied on the fraudulent source and continued with the payment process.
CBSL also described any allegation that it neglected its Anti-Money Laundering responsibilities as “legally unfounded.”
Payment Rejection Claim Also Disputed
The Central Bank also challenged the ministry’s reported claim that the payments had previously faced rejection on three occasions.
According to CBSL, banking system records showed no evidence of three rejected payment attempts.
It accused the ministry of presenting an inaccurate account of what occurred. However, that remains the Central Bank’s position in an ongoing dispute over institutional responsibility.
CBSL reiterated that its role as the Government’s banker involves executing valid payment instructions authorised by the Finance Ministry.
It argued that the ministry retains responsibility for verifying the authenticity and accuracy of account details before sending instructions for execution.
The Sri Lanka debt payment fraud has consequently exposed serious questions about cybersecurity, internal controls and the division of responsibility between two major state institutions.
While the Central Bank has strongly rejected responsibility for the verification breakdown, the complete allocation of administrative or criminal liability will depend on official investigations and the examination of records from all institutions involved.
