Sri Lanka’s central bank has restricted two Ernst & Young (EY) partners from auditing licensed banks following the discovery of a Rs. 13.64 billion (US$41 million) internal fraud at National Development Bank (NDB).
The restrictions apply to the engagement partner and quality assurance partner involved in NDB’s audit. The Central Bank of Sri Lanka clarified on 10 November that EY itself remains eligible to audit banks.
The action follows growing scrutiny of how a fraud spanning several reporting periods escaped detection by the bank’s internal controls and external auditors.
EY issued an unmodified audit opinion on NDB’s 2025 financial statements on 25 February 2026. Less than six weeks later, the bank disclosed a major internal fraud.
NDB subsequently reduced its reported 2025 after-tax profit from Rs. 11.04 billion (US$32.9 million) to Rs. 5.90 billion (US$17.6 million) — a reduction of approximately 47%.
A fraud spanning several years
NDB first disclosed the fraud on 2 April 2026, initially estimating its potential impact at Rs. 380 million. Within four days, the bank had increased that estimate to Rs. 13.20 billion (US$39.3 million).
The Central Bank confirmed that customer accounts and deposits had not been affected.
NDB subsequently appointed Deloitte Touche Tohmatsu India LLP to conduct a forensic investigation. The review established a total financial impact of Rs. 13.64 billion and identified weaknesses in transaction monitoring, account reconciliations, user access controls, internal audit and governance.
According to findings published by Sri Lanka’s Parliament, approximately Rs. 9.6 billion of the fraud’s financial impact related to 2025, with the remainder attributable to earlier periods and the first quarter of 2026.
NDB’s chief executive, Kelum Edirisinghe, told journalists that employees had been routing funds through internal accounts since approximately 2024. The fraud continued until its discovery in April 2026.
EY audited NDB throughout this period, issuing unmodified opinions on both its 2024 and 2025 financial statements. Both reports identify the signing engagement partner by the same CA Sri Lanka membership number, 4839.
NDB subsequently appointed KPMG as its external auditor for 2026 under mandatory auditor rotation requirements. Shareholders approved the appointment on 27 March, before the fraud became public.
How the fraud worked
The fraud involved NDB employees who allegedly colluded with external parties to divert money through the bank’s electronic payment systems.
According to an analysis published by Sri Lanka’s Sunday Times, employees initiated unauthorised transfers through internal suspense accounts, which banks use to hold funds temporarily while processing transactions.
According to the Sunday Times analysis, the perpetrators allegedly concealed the diverted funds by recording the resulting shortfalls as receivables — amounts supposedly owed to the bank. Although the money had left NDB, the fictitious receivables made it appear that the bank still held corresponding assets, concealing the missing funds.
The Sunday Times also identified weekend settlement delays as a potential weakness, creating opportunities for discrepancies to escape immediate scrutiny.
NDB confirmed that employees had acted in collusion. The bank suspended implicated employees, strengthened access controls and cooperated with law enforcement authorities, which made arrests in connection with the fraud.
Deloitte’s subsequent investigation identified deficiencies involving electronic fund transfers, access to the bank’s core banking system and the management of user credentials.
However, the publicly disclosed findings do not provide a complete transaction-by-transaction account of how the perpetrators executed and concealed the fraud.
What did EY miss?
EY’s independent auditor’s report, dated 25 February 2026, gave NDB’s financial statements an unmodified opinion. Weeks later, the bank disclosed a fraud that would force it to reduce its reported annual profit by nearly half.
What is troubling is the overlap between the controls EY reported examining and the weaknesses Deloitte subsequently uncovered.
EY identified IT systems and related internal controls over financial reporting as a key audit matter, acknowledging the bank’s heavy reliance on automated processes, multiple IT systems and spreadsheets.
The firm reported using internal specialists to test the design and operating effectiveness of relevant controls, including user access and change management. It also tested source data for accuracy and completeness and reviewed general ledger reconciliations.
NDB’s financial statements contained another potential warning sign. Note 36.3 of its 2025 annual report shows that gross other financial assets, a category that included electronic funds transfer receivables, increased from Rs. 3.16 billion in 2024 to Rs. 12.22 billion in 2025 — a rise of approximately 287%.
The published accounts do not establish how much of that balance resulted from fraudulent transactions. But the increase raises a further question: how did EY assess the existence, validity and recoverability of those receivables?
Yet Deloitte’s subsequent forensic investigation identified weaknesses in transaction monitoring, account reconciliations, user access controls and the management of system credentials.
The available evidence does not show whether EY and Deloitte examined precisely the same controls. Nevertheless, the overlap raises serious questions about the scope and effectiveness of EY's testing, particularly given the scale of the financial misstatements.
EY issued unmodified opinions on both the 2024 and 2025 accounts while the fraud was reportedly operating. The same engagement partner signed both reports. Why did EY's audits fail to identify the irregularities that subsequently forced NDB to restate its financial statements?
Regulators take action against EY auditors
Sri Lanka’s Central Bank has taken significant action against the two EY partners involved in NDB’s audit, effectively excluding them from licensed-bank audit engagements.
The Daily FT reported that officials disclosed the restrictions during a 5 November hearing of Parliament’s Committee on Public Finance.
The Central Bank’s Director of Banking Supervision, R. R. de Silva Jayatillake, confirmed that the regulator had acted against the auditors and that the partners could no longer undertake banking audits.
In a subsequent clarification, the Central Bank specified that it had instructed EY not to assign the engagement partner and engagement quality assurance partner involved in NDB’s audit to any licensed-bank audit engagements.
The restrictions have potentially serious career consequences for both individuals, excluding them from a significant area of their professional practice. The Central Bank has not disclosed their names or specified how long the restrictions will remain in place.
EY itself retains permission to audit licensed banks in Sri Lanka.
Although the Central Bank has not publicly explained its reasoning, its decision to exclude two EY partners from licensed-bank audits strongly suggests that it identified serious concerns about their work on NDB’s audit.
Separately, the Sri Lanka Accounting and Auditing Standards Monitoring Board completed its own investigation into EY’s conduct. Its chairperson, E. H. Mohotty, told Parliament that the board had referred its findings to the Attorney General on 15 October 2026 for advice on possible legal action.
Mohotty explained that the investigation examined EY’s compliance with applicable auditing standards and how effectively the auditor discharged its professional responsibilities.
The board has not published its findings, and no decision on possible legal action had been publicly announced as of 12 November.
The Central Bank has also required NDB to reconstitute its board audit committee, strengthen internal controls and implement corrective measures under regulatory supervision.
Questions remain over EY’s audit work
The Central Bank has not explained precisely what prompted its restrictions, while the findings of the separate investigation into EY’s compliance with auditing standards remain unpublished.
Those findings may establish whether EY obtained sufficient appropriate audit evidence, adequately challenged the bank’s financial records and responded appropriately to weaknesses in its controls.
What is already clear is that the consequences have extended beyond NDB’s management and internal controls. Regulators have now taken action against the auditors themselves.
Related Reading
KPMG Reaches $224.5 Million Settlement Over Silicon Valley Bank
How investor litigation over KPMG’s audits ended in a substantial settlement without an admission of wrongdoing.
PwC’s Audit of Ueno Bank Raises Questions After Its Collapse
The unanswered questions surrounding PwC’s audit, disputed accounting treatments and regulatory concessions.
Currency note: US dollar equivalents are approximate and calculated using the exchange rate on 12 November 2026.
This article is part of the Big4News Investigations & Analysis series, which examines the structural forces shaping Deloitte, PwC, EY and KPMG.
For more cases involving the Big Four audit firms, explore our Global Big Four Scandal Timeline, which documents major controversies, regulatory investigations, enforcement actions and corporate scandals involving the firms around the world.
About Claudine Cassar
I’m a corporate anthropologist and former Deloitte equity partner. I sold my technology business to Deloitte in 2016 and led the Malta Consulting team for five years. I am the founder and editor of Big4News, which provides independent, clear analysis of PwC, Deloitte, EY, and KPMG — free from corporate spin.
Find me on LinkedIn, X, Instagram, or my author website.
Feel free to reply to this newsletter — I read every reply.