When the financial rails cannot support the scale load
Originally published in Sunday Observer on 2026-05-03.
Read Original Article on Sunday ObserverCore Argument
In April 2026, two incidents forced Sri Lanka's financial system into uncomfortable public scrutiny. A $2.5 million cyber fraud against the Treasury's External Resources Department diverted a sovereign debt repayment through an email-compromise attack. NDB Bank disclosed a Rs. 13.2 billion internal fraud involving employee collusion, needing Rs. 4 billion in provisions and delivering a severe quarterly loss. These are not the failures of two isolated institutions. They are surface manifestations of a shared structural condition across Sri Lanka's financial operating layer. Sri Lanka's recovery trajectory remains intact, but the capital flows recovery demands, trade finance, foreign direct investment, cross-border settlement, domestic credit expansion, run through financial rails that now carry elevated perceived risk. That perception is evidence-based, not speculative. It will not be corrected by investigation outcomes. It will be corrected by demonstrated architectural change. The Treasury incident reflects the absence of verified instruction channels for sovereign payment flows. The NDB case reflects inadequate segregation of duties at the operational layer. Both are architectural failures, not conduct failures alone. Architecture does not reform through investigation. It reforms through redesign. The same control weakness acts differently across the scale spectrum. At micro level, systemic exposure is limited. At SME level, exporters processing trade finance and importers managing FX settlements absorb friction as banks impose post-incident verification layers, compounding across transactions and credit approvals. At institutional level, corporate treasuries face compliance overhead precisely when digital transaction volume growth is essential. At national level, elevated perceived country risk raises foreign borrowing costs and introduces a trust differential global buyers price explicitly. The opportunity is specific: firms that build internal financial governance ahead of the market, verified payment channels, dual-authorisation controls, treasury oversight, carry a demonstrably lower risk profile to lenders and trade finance partners. Control maturity is competitive positioning, not compliance overhead.
What I'd Revise Now
A governance detail has surfaced since this ran that makes the segregation-of-duties argument sharper than I could state it in May. NDB's Integrated Risk Management Committee and its Board Audit Committee, the bank's second and third lines of defence, shared two common directors between them. Industry commentary at the time asked directly why no question was raised over a Rs. 9 billion swing in other assets when the two committees meant to catch it were not independent of each other. That is not a footnote. It is the column's central claim, made concrete: a control architecture can look complete on an org chart while sharing the exact people whose independence the structure depends on. The Central Bank's response has also moved past "monitoring." NDB's scheduled cash dividend was suspended, discretionary payments and branch expansion were restricted, while the Central Bank confirmed customer funds remain secure and capital adequacy still exceeds regulatory minimums. That is closer to the demonstrated architectural change this column called for than to an announced intent, and it is a useful marker: regulatory response that changes what a bank can do, not just what it must disclose. Five individuals had been arrested as of mid-April; later reporting puts the number at sixteen, including bank staff. The number moving that much confirms the collusion was structural rather than a single bad actor, which is the reading this column already argued for.
Key Takeaways
- Both April incidents were architectural failures, not conduct failures: absent verified instruction channels and inadequate segregation of duties
- Elevated perceived risk on the financial rails becomes a trust tax embedded in every transaction the economy needs to complete at scale
- The control weakness compounds worst at SME level, where trade finance and FX settlement absorb new verification friction directly
- Control maturity is a capital asset: documented dual-authorisation and verified channels reduce the risk premium lenders apply
- East Asian recovery patterns show the sequence was harden the rails, then scale through them, not the reverse