Bank Frauds: Who Really Bears Responsibility?

By P. Samarasinghe
Former Deputy Governor, Central Bank of Sri Lanka

Former Deputy Governor P. Samarasinghe examines bank fraud responsibility, internal controls, Central Bank supervision and systemic financial risk.

---

COLOMBO — Whenever a major fraud or theft is reported at a bank, public debate quickly turns to a familiar question: who is responsible?

Former Central Bank Deputy Governor P. Samarasinghe argues that the answer lies not simply with the individuals who execute a fraudulent transaction, but also with the internal governance structures meant to prevent it, the boards and senior managers responsible for enforcing those controls, and the supervisory architecture designed to identify weaknesses before they threaten confidence in the banking system.

His analysis comes amid renewed public discussion over a major alleged fraud involving a Sri Lankan bank. Samarasinghe stresses, however, that his article is not an assessment of that particular case, nor of any other specific fraud or the present supervisory model of the Central Bank of Sri Lanka.

Instead, he sets out a broader argument based on his banking experience: fraud is an enduring risk in financial systems, but the way banks are governed and supervised determines whether such misconduct is prevented, detected early or allowed to accumulate until a crisis erupts.

Fraud Is Not New to Banking

News of bank frauds often dominates headlines for days, accompanied by large figures, technical terminology, investigations, audits and political accusations.

Samarasinghe argues that much of this coverage can be difficult for ordinary bank customers to interpret because of the complexity of modern financial reporting.

Bank fraud itself is not unusual in global financial history. Similar incidents have occurred repeatedly across countries and institutions, often becoming major public controversies before gradually fading from attention.

He cites the collapse of Silicon Valley Bank in the United States on March 10, 2023, as an example of how serious weaknesses in bank management can develop despite the existence of regulators, supervisory institutions and deposit-protection mechanisms.

His broader point is that once a banking crisis becomes public, responsibility is frequently contested among bank executives, regulators, auditors, policymakers and political actors.

The media then fills with reports of investigations and inquiries, while depositors are repeatedly assured that their money remains safe.

What Constitutes Bank Fraud?

Samarasinghe uses the term bank fraud broadly.

It can include theft of bank funds by outsiders or employees, business transactions conducted outside internal policies, and financial transactions carried out in violation of banking law.

More complex forms of misconduct can arise under the guise of modernisation or innovation, particularly when internal controls are weakened or bypassed.

In some instances, he argues, senior management may knowingly or indirectly tolerate practices that circumvent established procedures.

This makes internal governance crucial.

Fraud should not be viewed only as the act of an individual employee. A banking institution is built around layers of controls intended to ensure that no single employee or department can undertake material transactions without review.

When those safeguards fail repeatedly or are deliberately overridden, responsibility inevitably extends beyond the person who executes the final transaction.

Why Banks Are Subject to Government Regulation

Banking has historically developed under unusually strict State regulation because money creation, credit distribution and payments are central to the functioning of an economy.

Governments therefore license banks, regulate their operations and attempt to protect customers while preserving public confidence in the monetary system.

For Samarasinghe, public confidence is not incidental to banking. It is one of the foundations on which the industry operates.

Frauds may occur without immediately causing panic, but sufficiently serious failures can develop into broader banking or financial-system crises.

When that happens, governments frequently intervene to restore confidence because banking institutions form part of the infrastructure through which the monetary system itself operates.

Sri Lanka’s Supervisory Framework Under the Monetary Law Act

Sri Lanka formally incorporated bank supervision into its monetary framework through the Monetary Law Act of 1949.

The Act gave the monetary authorities responsibility for developing and stabilising the monetary system while supervising and regulating banks in support of broader economic objectives.

Although a separate Banking Act was introduced in 1988, the relevant provisions of the Monetary Law Act remained operative until that legislation was repealed on September 14, 2023.

Under the earlier framework, the Bank Supervision Director and Department were established as the statutory mechanism for supervising banks.

The Monetary Board was also given substantial regulatory authority based on reports submitted by the Bank Supervision Director.

Samarasinghe points to the views of John Exter, who designed Sri Lanka’s original central banking framework, as illustrating the philosophy behind the system.

Exter wrote:

“Supervision of banks by the central bank or some other supervisory authority has proved in the experience of many countries to be an important means of contributing to the soundness of the banking system. Banking is an economic activity which affects the public welfare to an unusual degree; it touches in one way or another almost every phase of a country’s economic life. Sound banking is essential to healthy and vigorous economic development. Supervision of banks helps to protect the public against mismanagement, bank failures and loss of confidence in the banking system. It helps to protect depositors and stock-holders against loss and frequently enables bank directors and officers to manage the affairs of their banks more wisely and intelligently.”

Samarasinghe’s interpretation is that bank supervision was originally conceived not merely as a process of checking ratios and financial statements, but as a mechanism for preventing dishonest management, bank failure and loss of public confidence.

Corporate Governance and Management Responsibility

The Central Bank subsequently issued corporate governance directions for licensed commercial banks on December 26, 2007.

Those directions, according to Samarasinghe, reinforce the principle that boards of directors and senior management bear legal responsibility for prudent bank management.

That distinction matters when fraud occurs.

A bank cannot place all responsibility on a junior employee if the transaction was possible only because controls were inadequate, management procedures were ignored or directors failed to ensure that proper governance systems were functioning.

Samarasinghe argues that prevention must therefore begin with the bank itself.

Supervisors cannot sit inside every branch, approve every transaction or detect every act of dishonesty before it happens.

Internal controls are the first line of defence.

Do Banks Simply Lend Depositors’ Money?

A substantial part of Samarasinghe’s argument challenges the familiar description of banking as a business in which institutions collect deposits and then lend those deposits to borrowers.

He describes that explanation as overly simplistic.

Modern banks operate within a State-supported monetary system in which lending itself creates deposits.

When a bank grants a loan, the loan is recorded as an asset while a corresponding deposit is credited to the borrower’s account.

No separate pile of physical cash necessarily has to be transferred into the bank before that accounting entry can occur.

The borrower then uses the balance to make payments.

When payments remain within the same bank, balances are transferred between customer accounts.

Where payments move to customers of another bank, settlement occurs through reserve balances held with the Central Bank.

If the paying bank lacks sufficient reserves, it may obtain liquidity through the interbank market or from the Central Bank, including against eligible securities.

From this perspective, bank deposits are closely connected to the process of bank lending and the broader monetary system.

Deposits also represent liabilities because banks are contractually required to repay them.

The public accepts bank deposits as money because it has confidence that those balances can be converted into State-issued currency or transferred through the recognised payments system.

Samarasinghe argues that this confidence ultimately depends on the official monetary structure, not merely on the reputation of individual banks.

Why a Bank Cannot Repay Every Depositor at Once

Banks do not hold enough physical currency in their vaults to repay every depositor simultaneously.

Only a relatively small proportion of banking transactions requires notes and coins.

Most deposits exist as digital accounting balances.

If a large number of depositors attempt to withdraw funds at the same time, a bank may need to sell assets, obtain market funding or access emergency liquidity.

When confidence collapses and withdrawals accelerate, the result can become a bank run.

Samarasinghe argues that repeated assurances about depositor safety are therefore partly intended to prevent panic from becoming self-reinforcing.

The danger is not simply that one bank has lost money. It is that fear can spread from one institution to another.

Banking by Numbers

Modern bank management has increasingly become dependent on accounting ratios, data systems and information technology.

Financial statements now provide the basis for evaluating assets, liabilities, profitability, cash flow and changes in capital.

Banks and regulators also rely on a wide range of performance measures, including:

• capital adequacy ratios;
• liquidity ratios;
• non-performing loan percentages;
• loan-to-deposit ratios;
• maturity mismatches;
• interest margins;
• return on assets;
• return on equity;
• asset growth; and
• deposit growth.

These indicators can provide important information about a bank’s condition.

Samarasinghe’s criticism is that modern management may become excessively focused on achieving favourable ratios instead of understanding the quality of the transactions producing those figures.

A bank may appear numerically healthy while weaknesses in governance, conduct or internal controls remain hidden.

Technology Creates New Risks

Information technology has transformed banking.

Transactions, reporting, risk assessment and customer services increasingly depend on automated systems, with artificial intelligence now becoming part of that evolution.

These technologies can improve speed, efficiency and monitoring.

They can also create new vulnerabilities.

Samarasinghe argues that the mechanisation of banking has reduced direct human involvement in many areas while creating forms of operational and technological risk that traditional supervisory methods may not easily detect.

A system can produce accurate ratios while still containing serious weaknesses in authorisation, data integrity, employee behaviour or third-party technology.

The increasing dependence on external technology providers creates another layer of vulnerability.

A major technological failure or cyber incident could potentially disrupt transactions across multiple institutions simultaneously.

Has Supervision Moved Too Far From Internal Controls?

Earlier models of bank management placed strong emphasis on segregation of duties and internal checks.

Transactions were deliberately divided among employees and departments so that one person could not complete an entire process without independent verification.

The objective was straightforward: make fraud difficult to execute and easier to detect.

Samarasinghe argues that modern supervision has gradually moved away from that model.

Regulators increasingly analyse historical financial data, accounting ratios, capital levels, liquidity measures and risk models.

Under Basel standards, minimum capital requirements became a central feature of bank supervision.

Liquidity ratios and stress testing were added to assess the ability of institutions to withstand adverse economic conditions.

These methods have clear regulatory value.

His criticism is that they can become substitutes for direct examination of governance and internal control rather than complements to it.

The Limits of Stress Tests and Macroprudential Analysis

Stress tests attempt to estimate how banks would perform under hypothetical adverse conditions.

Macroprudential supervision looks beyond individual institutions and examines risks across the financial system as a whole.

Central banks then publish financial stability assessments based on aggregated indicators.

Samarasinghe questions whether these approaches can identify the kinds of misconduct that develop within individual institutions.

A banking system can appear stable in aggregate even when one institution contains serious governance failures.

Similarly, a stress test built on accounting data may not expose deliberate misconduct hidden behind inaccurate information or transactions designed to bypass controls.

The problem, in his view, arises when supervisors become confident in statistical models while losing visibility into the behaviour taking place inside banks.

Monetary Policy Can Also Affect Bank Risk

Samarasinghe further argues that separating monetary policy from bank supervision can create tensions.

Interest-rate cycles, liquidity conditions and changes in the money supply can affect bank profitability, asset values and funding conditions.

Banks must then manage risks created partly by monetary policy itself.

In periods of severe liquidity stress, the traditional central banking role of lender of last resort becomes critical.

A central bank may need to provide emergency liquidity to prevent a problem at one institution from developing into a system-wide panic.

For Samarasinghe, the challenge is to distinguish between protecting financial stability and protecting management from the consequences of poor decisions.

Who Should Be Punished When Controls Fail?

If boards of directors and senior management are legally responsible for maintaining proper internal controls, Samarasinghe argues that supervisory authorities should be able to respond quickly when a major fraud indicates a serious governance failure.

He goes as far as suggesting that bank boards should face immediate supervisory consequences where large-scale fraud demonstrates that required internal controls were not functioning.

The principle behind the argument is accountability.

Employees who steal money should face investigation and prosecution.

But senior managers and directors should also be accountable if their governance failures enabled misconduct to continue undetected.

Without consequences at management level, he argues, institutions can repeatedly treat fraud as the isolated behaviour of junior personnel.

Charles Goodhart’s Warning

Samarasinghe also draws on observations attributed to Professor Charles Goodhart, the internationally recognised scholar of monetary and banking policy, during a public lecture at the Central Bank on February 23, 2003.

Those observations were subsequently included in Central Bank financial literacy publications.

The principal lessons he draws from Goodhart are:

• fraud is difficult to detect and often becomes visible suddenly;
• occasional fraud cannot be eliminated entirely;
• strong control systems should be built to limit opportunities for fraud;
• management that allows serious control failures should face consequences;
• the cost of weak governance should fall on the institution and its management rather than being transferred to the wider financial system; and
• systemic stability remains a separate responsibility of the central bank.

This distinction lies at the heart of Samarasinghe’s argument.

Central banks cannot guarantee that no employee in any bank will ever commit fraud.

They should, however, ensure that banks have credible systems of governance and that failures do not destabilise the monetary and financial system.

The Northern Rock Lesson

Samarasinghe cites the 2007 Northern Rock crisis in Britain as an example of how problems at one institution can spread rapidly through the wider financial system.

Northern Rock encountered serious funding difficulties during the global financial turmoil associated with the US subprime mortgage crisis.

As public concern intensified, customers queued to withdraw deposits, producing one of Britain’s most visible modern bank runs.

Samarasinghe argues that hesitation in providing emergency liquidity contributed to the spread of panic.

By the time substantial support was provided, confidence had already deteriorated.

The British Government eventually guaranteed deposits and Northern Rock was nationalised.

His broader conclusion is that central banks must identify liquidity stress early enough to stop an individual institutional crisis from becoming systemic.

The 2007-09 Global Financial Crisis

The global financial crisis also illustrates the limitations of formal supervisory frameworks.

Banks and financial institutions across the United States and Europe had developed increasingly complex financial products during the years preceding the crisis.

When those structures failed, governments and central banks were forced to intervene on an extraordinary scale.

Samarasinghe views that episode as evidence that regulatory systems can coexist with dangerous business models for years before their full risks become apparent.

He also points to the expansion of private credit markets as an area that deserves continued attention.

The larger lesson is that financial stability cannot be guaranteed simply because conventional indicators appear satisfactory.

Public Confidence Cannot Be Reduced to Ratios

Banking depends fundamentally on confidence.

Capital ratios, liquidity calculations, stress tests and financial stability reports are valuable tools, but they cannot by themselves create that confidence.

Customers trust banks because they believe the institution will honour its obligations and because they expect the State to maintain the integrity of the monetary system.

Once that trust collapses, seemingly technical financial weaknesses can become much more serious.

The impact of a fraud also cannot be measured solely by comparing the amount lost with the total value of the banking system.

A relatively small fraud at a highly connected institution may damage confidence far beyond the immediate monetary loss.

Customer relationships, interbank exposures, payment networks and public perceptions all matter.

What Should Modern Bank Supervision Do?

Samarasinghe argues that the future of supervision must restore greater attention to governance, human behaviour and internal controls while recognising the realities of electronic banking.

The purpose should not be to abandon capital standards, technology or statistical analysis.

Rather, those tools should be combined with direct accountability for the individuals responsible for running banks.

Where fraud exposes a serious failure of internal controls, supervisors should identify the responsible management structures and impose appropriate consequences.

At the same time, central banks must protect financial-system stability without creating what economists describe as moral hazard, where banks or executives assume that the State will rescue them regardless of their behaviour.

Banking in an Electronic-Money Era

Modern money is increasingly electronic.

The banking system is therefore becoming more dependent on technology, interconnected financial markets and digital settlement.

Samarasinghe believes this requires a new management and supervisory approach capable of addressing not only traditional banking risks but also:

• electronic-money creation;
• consumer protection;
• market conduct;
• operational resilience;
• technology dependence;
• governance;
• long-term bank survival; and
• the relationship between credit creation and productive economic activity.

He argues that credit and money creation should ultimately support productive activity and improvements in living standards rather than functioning only as mechanisms for financial expansion.

Whose Responsibility Is a Bank Fraud?

Samarasinghe’s answer is not that one institution can prevent every fraud.

Individual fraudsters remain responsible for their conduct.

Bank management remains responsible for building and enforcing internal controls.

Boards remain responsible for governance.

Supervisors remain responsible for ensuring that those systems are credible and that weaknesses do not threaten wider financial stability.

Governments ultimately remain responsible for maintaining confidence in the monetary system.

Fraud therefore becomes especially dangerous when responsibility is fragmented to the point that every institution can blame another.

A bank may blame an employee.

Management may blame a technical failure.

Supervisors may say internal control is the bank’s responsibility.

Governments may insist that regulators are independent.

By the time those arguments are resolved, the money may already be gone and public confidence damaged.

The more useful approach is to establish responsibility before a crisis occurs.

Prevention Must Come Before Post-Fraud Investigations

After a major fraud becomes public, investigations, audits and prosecutions may be necessary.

But these measures are reactive.

The central objective of governance and supervision should be prevention.

Banks must design controls capable of identifying unusual transactions, limiting individual authority and requiring meaningful independent approval.

Boards must ensure those controls are functioning rather than simply documented.

Supervisors must examine whether the governance system operates in practice, not merely whether regulatory ratios are being reported correctly.

If those responsibilities are taken seriously, fraud may never disappear, but the ability of a single dishonest transaction or management failure to threaten an institution can be reduced.

That, in Samarasinghe’s analysis, is the real purpose of bank supervision.

Not to promise that fraud will never occur, but to ensure that banks are governed in a way that detects misconduct early, holds responsible decision-makers accountable and prevents an individual failure from becoming a crisis of confidence in the banking system.

The views expressed are those of P. Samarasinghe and are presented as a contribution to the public discussion on banking, economic policy and financial-sector reform. He states that the article is based on his professional knowledge and study of economics and is not intended to criticise or embarrass any individual personally.