Sri Lanka did not collapse in 2022 because of economic imbalances alone. It collapsed because institutions failed, quietly, cumulatively, and then all at once. Fiscal indiscipline, external shocks, and structural weaknesses mattered, but what turned vulnerability into catastrophe was the systematic erosion of governance, oversight, and institutional integrity.
That same pattern is re-emerging and events surrounding the Public Debt Management Office (PDMO) are not merely a ‘cyber incident’. They represent a profound breakdown in the most sensitive nerve centre of the State: the management of sovereign debt.
According to facts presented before the Colombo Fort Magistrate’s Court by the Criminal Investigation Department (CID), officials at the PDMO acted on communications from a fraudulent email domain – the legitimate address exportfinance.gov.au had been altered to ‘exportfinance.av.com’ – and processed payments worth $ 2.5 million payment to a fake account.
Critically, the payment proceeded even after warning emails had been sent to the PDMO by the company responsible for maintaining the Government email system. This was not a sophisticated attack that defeated robust controls. It was a basic domain spoofing operation that succeeded because elementary verification procedures were absent.
The scale is broader than initially disclosed. The $ 2.5 million was transmitted in five separate instalments between 31 December 2025 and 20 March this year. The Committee on Public Finance (COPF) was subsequently informed that the total comprised 10 transactions. Similar attempts were made to divert other foreign payments, including one linked to India, a detail that transforms this from an isolated incident into evidence of systematic targeting of Sri Lanka’s sovereign payment infrastructure.
Institutional inertia
The core issue is institutional failure: the transfer of debt management functions from the Central Bank to the newly created PDMO proceeded without adequate systems, staffing, or safeguards, despite explicit concerns raised at parliamentary level. The COPF had repeatedly urged the Treasury to hire competent and experienced staff for the new office.
The result was predictable: a critical financial operation executed without the basic controls that any commercial bank would consider routine. Worse still, the breach was not detected internally. It came to light only after Australian export finance agencies notified Sri Lankan officials that the funds had never arrived. A sovereign that cannot reconcile its own debt payments without external prompting is a sovereign that invites risk premia and mistrust, where yields are determined by market confidence.
The breach was first identified in January. A Technical Investigation Committee was appointed in late March. The public learnt of it only on 22 April, when a former Governor of the Central Province raised it in a letter to the Speaker of Parliament. Three months of silence on a $ 2.5 million sovereign payment diversion. This was not operational discretion but a failure of democratic accountability.
When Parliament finally acted, the Executive resisted: the Treasury Secretary initially declined to appear before the COPF for the scheduled hearing on 30 April, prompting the COPF Chairman to question publicly whether the Secretary now considered himself above parliamentary oversight.
Following intense criticism and the Chair’s insistence that appearance was a constitutional obligation, the Treasury Secretary reversed course and appeared before the committee that same afternoon. That a senior official required public shaming before complying with a parliamentary summons is itself an indictment of the culture within which this failure occurred.
The independent credibility of the inquiry itself remains in question. The Free Lawyers organisation has argued that the Technical Investigation Committee cannot be considered independent, as it operates under senior Treasury officials who oversee the very functions under investigation.
The case has since taken a deeply troubling turn. On 30 April, Abeysinghe Mudiyanselage Ranga Nishantha Rajapaksa, a 50-year-old Assistant Director of the Department of External Resources and one of the four officials suspended in connection with the investigation, was found dead in the garden of his home in Kuliyapitiya. Police reported that blood vessels in both his legs and his left hand had been severed, and a blood-stained knife had been recovered near the body. The CID had previously requested him to appear and provide statements on two occasions in connection with the ongoing investigation.
The Kuliyapitiya Police has initiated a full investigation. The cause of death and full circumstances remain under formal inquiry, and it would be inappropriate to draw conclusions pending the forensic report and Police findings. What can be said is that a man is dead, his family is devastated, and the case that led to his suspension, and to his apparent distress, is one that institutional failures at every level allowed to occur and then allowed to fester for months without transparency or resolution.
On the financial consequence, the Government has argued that this does not constitute a technical default, on the basis that Sri Lanka demonstrated both the capacity and intention to service the debt, with the diversion attributed to third-party actions.
That interpretation may be legally defensible but does not address the reputational damage. Sovereign debt markets operate on confidence. If counterparties begin to question whether Sri Lanka’s payment systems are secure and subject to basic verification, the cost of borrowing will reflect that uncertainty regardless of legal characterisation.
Reverse institutional reform
At the centre of this is a structural flaw that Sri Lanka has long refused to confront: the politicisation of the bureaucracy. Dr. Harshana Suriyapperuma served as a National People’s Power (NPP) National List Member of Parliament and Deputy Minister of Finance and Planning before resigning from Parliament on 20 June 2025 and being appointed Finance Secretary three days later, something unique to Sri Lanka’s history.
The issue is not his individual qualifications but the principle: when a political appointee occupies the position of Treasury Secretary and then presides over the institutional response to a failure that occurred on his watch, the line between accountability and self-preservation structurally collapses. Serious states and administrations do not operate this way.
This matters beyond the immediate scandal. Sri Lanka is attempting to rebuild trust – with creditors, investors, and with its own citizens. That trust is not built through reaching International Monetary Fund (IMF) intended targets. It is built through demonstrable institutional competence, transparency, and the willingness to be held accountable when institutions fail. Every incident like this, and every attempt to delay, obscure, or resist scrutiny, sends the opposite signal.
The PDMO failure is not an isolated incident. It is symptomatic of a broader weakness in State capacity: inadequate cybersecurity infrastructure, the absence of standardised payment verification protocols, and the persistent substitution of political loyalty for professional expertise in positions that demand neither loyalty nor politics, but do require competence.
That the PDMO was operational without basic verification protocols that exist even in smaller commercial banks is extremely alarming. Fund transfer instruction verification and approval requires dual authorisation, what’s called the ‘four-eyes’ principle: no payment instruction above a threshold is executed by a single official; it requires independent sign-off from a second authoriser. Who authorised the payment? A $ 2.5 million outward transfer requires sign-off at Treasury Secretary/Deputy Secretary level. The ‘junior IT staff’ framing shouldn’t be allowed to obscure senior-level accountability.
Furthermore, when a loan instalment is paid, there is a counter receipt issued by the creditor, an official letterhead with details confirming receipt of payment and total loan outstanding alongside serial numbers and facility codes. There are multiple departments that must retain copies of this receipt for audit and compliance purposes.
In the banking sector, wire transfer instructions received via email are subject to strict verification protocols.
These typically include:
- Registered/whitelisted email addresses: Only emails from pre-approved, authenticated sender addresses belonging to the counterparty institution are acted upon for payment instructions.
- Email indemnities: The instructing party provides a signed indemnity accepting liability for fraudulent instructions, shifting legal risk and creating a paper trail for accountability.
- Callback verification: Any change to beneficiary account details triggers a mandatory telephone callback to a verified, separately registered contact number independent of the email channel that provided the instruction.
- Formal settlement channels: For sovereign bilateral payments, the use of SWIFT messaging with authenticated MT103 or similar formats is standard practice; a bare email is never the sole instruction medium.
- Beneficiary account change freeze periods: Banks typically impose a 24–72 hour freeze after any account detail change before executing the first payment to a new account.
The Ministry of Finance must be depoliticised and professionalised. That begins with accountability at the top. The current leadership cannot credibly lead the reform of a system it was responsible for designing and defending. The NPP Government, and President Anura Kumara Dissanayake in particular, must recognise that governance reform is incompatible with political control over senior bureaucracy.
The Finance Ministry requires technocratic leadership insulated from political cycles, operational protocols aligned with international best practices, independent audit mechanisms with genuine enforcement power, and full parliamentary accountability as a constitutional obligation, not a courtesy extended only under pressure.
Sri Lanka’s 2022 crisis was a warning about what happens when institutions are hollowed out. The recovery will depend on whether the country chooses to rebuild them in substance, or merely in appearance.
This is not about a single fraud. It is about whether the State has the capacity to govern.
A state of disarray
The incumbent Government was elected on one promise above all others: clean governance. Eighteen months in, the record is not promising.
The Speaker of Parliament, third in the constitutional order, was forced to resign within weeks of taking office, unable to produce documentation for a claimed doctorate from Japan. The man who had led protests against SAITM as a “fake degree shop” could not prove his own qualifications. At least three other NPP parliamentarians faced simultaneous allegations of falsifying academic credentials.
Energy Minister Kumara Jayakody became the first sitting Cabinet Minister in recent Sri Lankan history to be indicted by the Commission to Investigate Allegations of Bribery or Corruption (CIABOC) for corruption while remaining in office, indicted for procurement fraud at the Lanka Fertiliser Company from a previous stint in government.
The Government’s decision to back the Minister and oppose the parliamentary No-Confidence Motion was a blow to its own anti-corruption base of activists. He eventually resigned under public pressure, not Government action. The coal procurement scandal ran concurrently, with allegations that the Chairman of the Committee on Public Enterprises (COPE) directly intervened while the National Audit Office was finalising its report on the very irregularities under investigation.
The Government procured some 1,775 brand-new double cab pickup trucks through what the Opposition documented as manipulated tender procedures – the same Government that had made public theatre of collecting and auctioning vehicles from the previous administration. Suspicious container releases at the port, a compromised insurance broker appointment, and allegations of vehicle tender manipulation added to the accumulating ledger.
The auditor general post was vacant since April 2025. The President made four nominations, all rejected by the Constitutional Council. The vacancy paralysed the Committee on Public Accounts (COPA) and COPE at the precise moment the country faces post-cyclone reconstruction, a Rs. 13.2 billion banking fraud, and a sovereign Treasury diversion of funds.
Critics have alleged the delay is deliberate, that the Government cannot afford a genuinely independent auditor examining precisely these transactions. The Centre for Policy Alternatives put it with precision: four failed nominations over nine months suggest either constitutional incompetence in the advice received, or bad faith.
The National Development Bank (NDB) fraud, the largest internal banking fraud in Sri Lanka’s financial history, occurred on this Government’s regulatory watch, with the Central Bank’s own Bank Supervision Department among the institutions that failed to identify a balance sheet anomaly visible in every quarterly filing throughout 2025. And now a sovereign Treasury hack, concealed from Parliament for three months, disclosed only when a former Provincial Governor wrote to the Speaker.
The pattern is not isolated incidents. It is the systematic gap between the language of accountability and the practice of power. Every scandal has been managed reactively, resignations extracted by public pressure rather than offered voluntarily, parliamentary oversight resisted until constitutionally unavoidable, and disclosures made only when concealment became untenable.
This is not system change, it is the old system wearing new clothes. Sri Lanka has seen this before; the window for genuine course correction is narrowing faster than this Government appears to recognise. Trust and credibility, once diluted, are often difficult to reconstruct, no matter how large your majority.
(The writer is a political commentator, media presenter, and foreign affairs analyst. He serves as Adviser on Political Economy to the Leader of the Opposition and is a member of the Working Committee of the Samagi Jana Balawegaya [SJB]. A former banker, he spent 11 years in the industry in Colombo and Dubai, including nine years in corporate finance, working with some of Sri Lanka’s largest corporates on project finance, trade facilities, and working capital. He holds a Master’s in International Relations from the University of Colombo and a Bachelor’s in Accounting and Finance from the University of Kent [UK]. He can be contacted via email: kusumw@gmail.com and X: @kusumw)
(The views and opinions expressed in this article are those of the writer and do not necessarily reflect the official position of this publication)
