The Government has expanded investigations into the $ 2.5 million cyber theft from Sri Lanka’s sovereign debt repayment system, with bank and digital transaction records being sought from six countries while international law enforcement agencies assist efforts to trace the stolen funds.
Public Security and Parliamentary Affairs Minister Ananda Wijepala told Parliament yesterday that investigations into the cyber fraud remain under the supervision of the Fort Magistrate, with 91 officials questioned to date.
He said authorities had sought banking and digital transaction information from the US, Australia, the United Arab Emirates (UAE), Switzerland, and Zambia under Mutual Legal Assistance (MLA) provisions, while Interpol and the Central Intelligence Agency (CIA) were assisting investigations into suspected transactions.
Wijepala said the Government was committed to identifying those responsible, recovering the stolen funds where possible, and strengthening controls at both the Treasury and the Central Bank of Sri Lanka (CBSL).
“The Government is committed to investigate and get to the bottom of this and tighten processes at the Treasury and CBSL and take all necessary steps,” he said.
Opening the parliamentary debate on the Committee on Public Finance (CoPF) report into the cyber fraud, Samagi Jana Balawegaya (SJB) MP Kabir Hashim called for an independent forensic audit of the Treasury and the CBSL.
Quoting from the Committee’s report, Hashim said Parliament had established that a cybercrime-linked fraud involving approximately $ 2.5 million in public funds had occurred, while stressing that criminal investigations must determine whether public officials were negligent, incompetent, or complicit.
“The criminal liability is not the CoPF’s scope. Criminal investigation must determine if officials were ignorant, incompetent, or had deliberate involvement,” he said.
Hashim also questioned why four middle-level officers had been suspended when the CoPF report concluded that responsibility for several governance lapses rested at the level of the Secretary to the Treasury and the CBSL Governor.
He further questioned whether adequate secondments had been made from the CBSL to support the transition of debt management functions to the Public Debt Management Office (PDMO).
Hashim warned that the cyber fraud had implications extending beyond the value of the stolen funds, arguing that weaknesses in sovereign debt operations could undermine confidence in Sri Lanka’s public financial management.
“As a country trying to come out of its 2022 sovereign default and still rebuilding international confidence, these findings have repercussions far beyond the $ 2.5 million,” he said, calling for an immediate forensic audit by independent foreign experts.
The CoPF report concluded that governance, procedural, and operational failures across multiple institutions heightened the risk of the cyber fraud but stated that determining criminal liability falls outside Parliament’s oversight mandate. It recommended stronger internal controls, cybersecurity improvements, and tighter verification procedures for sovereign debt repayments.