The Central Bank has barred the Ernst & Young partners who audited National Development Bank from carrying out any further banking audits, and required the bank to reconstitute its board audit committee, following the Rs. 13.6 billion fraud disclosed in April.
“We have already taken action against the auditors,” Director of Banking Supervision R. R. de Silva Jayatillake told the Committee on Public Finance. “The partners involved cannot continue doing banking audits. We have also got the bank to reconstitute the Board audit committee,” the Daily FT reported.
The reconstitution of the audit committee and other board committees was notified to the Colombo Stock Exchange — a disclosure committee chairman Dr. Harsha de Silva said had passed largely unnoticed.
Jayatillake said the regulator had required NDB to submit a rectification timeline, was monitoring progress against it, and was conducting spot examinations. Forensic audit findings were also being used to assess the fitness and propriety of individuals and to decide whether further orders or restrictions were needed.
The asterisk
The committee was told the auditors flagged the fraud with an asterisk rather than a formal qualification or an emphasis of matter — the two mechanisms by which an auditor formally signals a problem in a set of accounts. Members were told those who carried out the fraud were largely compliant with reporting requirements and gave regulators, and possibly the auditors, “the run around.”
A second inquiry is further advanced than the Central Bank’s. Sri Lanka Accounting and Auditing Standards Monitoring Board Chairperson E. H. Mohotty said her board’s separate investigation into auditor conduct was complete and had been referred to the Attorney General on 15 October 2026 for a view on legal action.
“What SLAASMB looked at is purely on the auditing standards and how well the auditor performed the duties based on the auditing standards,” she said. Asked whether she could disclose the findings, she said: “I think it is not.”
“That means it is scary,” Dr. de Silva said.
What the committee has not been given
The Deloitte forensic report itself has not been provided to the committee. Dr. de Silva pressed on whether the Central Bank was satisfied with it: “You shared some basic points.” Jayatillake replied that it was a forensic exercise and relevant third parties had been interviewed. Dr. de Silva noted the Deloitte work examined NDB’s transactions rather than the audit firm — the gap the SLAASMB referral is meant to fill.
Governor Dr. Nandalal Weerasinghe said the Bank Supervision Department was working through the SLAASMB report to establish what action could follow. “Basically, they have identified certain individuals,” he said. He offered to set out the sector-wide supervisory changes made since the fraud, including a directive to banks to tighten reconciliation of suspense accounts. “Broader actions, I think we can share with you. That’s not an issue.”
Dr. de Silva argued the opacity around specific enforcement was hard to defend: “I’m not saying give names, but what action you have taken, so that people would feel safe that their money is safe.” The committee would accept material under confidential cover and proceed on the Attorney General’s advice.
Context, and one figure that does not match
EY’s removal from NDB’s own books is not new — the bank appointed KPMG as external auditor for 2026, replacing EY, in April. Tuesday’s disclosure is wider: it bars the individual partners from auditing any bank, not just this one.
The fraud total is settled. Deloitte Touche Tohmatsu India LLP fixed the final loss at Rs. 13,639,664,684 in September, about Rs. 60 million above the interim figure disclosed on 26 June. The Central Bank moved against NDB in early April, restricting dividends, discretionary payments and branch expansion before requiring the external forensic audit.
One detail in Tuesday’s filing sits awkwardly with the record. The Daily FT says the fraud “ran for three years.” This desk’s earlier reporting on the same fraud has described it as running close to a decade, and the parliamentary scrutiny of it has turned on how the scheme went undetected over that longer span. The filing does not state the period the forensic audit covered, so the two cannot be reconciled from it; the three-year figure is reported here as the Daily FT’s, not as established.
Not reported
The filing does not name the EY partners, say how many are affected, state whether the bar is time-limited or permanent, or identify the legal provision it was made under. It does not say what the SLAASMB found, what action the Attorney General is being asked to consider, or whether EY as a firm faces any restriction. No recovery figure is given for the Rs. 13.6 billion.
The meeting it reports took place on 5 November; the Daily FT filed five days later. No other verified newsroom had carried this account of the Central Bank’s action against the auditors at the time of writing.
