• CBSL and LankaPay outline plans to COPF

A central fraud monitoring system is planned to be established by September 2027, which will require individual banks to establish supplementary controls of their own, Central Bank of Sri Lanka (CBSL) and LankaPay officials told the Committee on Public Finance (COPF) last week. 

The measures aim to prevent future incidents such as major financial anomalies, collusive balance concealment, and widespread cyber scams.

The policy framework was outlined at a COPF hearing chaired by Dr. Harsha de Silva. 

The inquiry found that existing supervisory mechanisms failed to detect a multi-billion-rupee imbalance at the National Development Bank (NDB) until its audited financial statements were finalised. Lawmakers warned that without deep anomaly analytics and coordinated technical oversight, sophisticated fraud schemes would continue to outpace traditional regulation.

The push to overhaul national fraud oversight was triggered by an unprecedented balance accumulation at NDB. 

Regulators noted that interbank settlement balances typically averaged between Rs. 1 billion and Rs. 3 billion. Over a four-day year-end window spanning consecutive holidays, however, an unhedged balance at NDB surged from an earlier Rs. 3.1 billion to between Rs. 12.1 billion and Rs. 13 billion.

CBSL Governor Dr. Nandalal Weerasinghe disclosed that colluding insiders had systematically concealed missing balances over a prolonged period by parking them elsewhere ahead of financial reporting deadlines, but had been unable to hide the accumulated Rs. 13 billion when accounts closed at the end of December.

CBSL on-site examination teams did not detect the accumulation beforehand. The irregularity was investigated through a spot examination only after the audited accounts, which carried a footnote disclosing the Rs. 12.1 billion figure, were finalised on 31 March.

In response to a question raised by Dr. de Silva, LankaPay Chairman Lakshman Silva said that LankaPay had formulated a Request for Proposal (RFP) in consultation with local banking specialists and international fraud experts in order to procure a centralised monitoring platform. 

“What I can assure you is that the central fraud monitoring system will come on board by around September 2027,” he said.

LankaPay officials said that the project had begun two years earlier to track emerging fraud trends, adding that the recent bank incident had expedited its implementation. They emphasised, however, that LankaPay’s infrastructure covered only interbank traffic, noting that the system would monitor only the transactions flowing through its switches.

LankaPay further noted that technical architecture alone could not eliminate financial crime without cross-sector coordination. 

A LankaPay official said that 80–90% of frauds happened through phishing attacks which had nothing to do with financial institutions. He added that telecommunications companies, the Telecommunications Regulatory Commission of Sri Lanka, and law enforcement authorities should come on board in order to eliminate financial crime.

Because LankaPay’s switch monitors only interbank transactions, the CBSL has mandated that commercial banks implement separate, supplementary fraud management systems to oversee internal transfers. The directive was formulated through the National Payments Council (NPC).

A CBSL official explained that interbank transactions routed through LankaPay were termed ‘off-us’ transactions from a bank’s perspective, while ‘on-us’ transactions, between two parties at the same bank, did not pass through LankaPay. 

“Therefore, while we are waiting for the central fraud management system from LankaPay, all banks have been required to introduce their own supplementary fraud management system,” the official said.

The officials affirmed that they would issue regulatory guidelines and compliance timelines to ensure institutions deployed these internal fraud controls.

During the proceedings, Deputy Minister of Industry and Entrepreneurship Development Chathuranga Abeysinghe and MP Ravi Karunanayake questioned whether standard rules and static compliance reporting could ever detect covert financial manipulation. They also pressed LankaPay on its technological capabilities.

Abeysinghe cautioned regulators against relying on conventional policies and accepting institutional assurances at face value. 

He stressed that regulatory oversight required specialised technical teams with the authority and power to examine core systems directly, warning that without such a team, regulators would not be able to be comfortable with the answers provided by banks.

In response, Dr. Weerasinghe acknowledged that financial crime was evolving faster than regulatory frameworks. “Regulators are always trying to improve our skills and competencies, but [financial crime] is evolving much faster. We must always keep our eye on the ball,” he said.

He added that the CBSL had established an Artificial Intelligence (AI) hub and sandbox, led by its Statistics Department, to integrate automated analytical tools into supervisory operations.