EY, NDB Fraud and Regulatory Accountability

Richard Ebell is a former chairman of Cargills Bank in Sri Lanka, with extensive experience in corporate finance, banking governance and audit committee oversight. Full bio at the end of the article.

In April 2026, Sri Lanka’s National Development Bank (NDB) disclosed an internal fraud that would eventually be valued at approximately US$41 million. The fraud had spanned several reporting periods, escaping detection despite the bank’s extensive system of internal and external oversight.

The bank had a board, an audit committee, internal auditors and external auditors. It operated under the supervision of the Central Bank of Sri Lanka, while its external auditor, EY, was subject to separate professional and statutory oversight.

Yet the fraud continued undetected.

When it came to light, less than six weeks after EY signed off on the bank’s 2025 accounts, investigations followed. NDB commissioned an independent forensic review, which subsequently identified weaknesses in transaction monitoring, account reconciliation, internal audit and other governance and control processes.

The Central Bank also began examining the matter, as did the Sri Lanka Accounting and Auditing Standards Monitoring Board, which investigated EY’s audit work.

But it was only through further parliamentary scrutiny in October and November that important details of the regulatory response became public.

At a hearing on 5 November, officials disclosed that the Central Bank had restricted two EY partners from undertaking future bank audits and had required changes to NDB’s board audit committee. The Committee on Public Finance also learned that the accounting oversight body’s findings concerning EY had been referred to the Attorney General on 15 October for advice on possible legal action.

The oversight body’s chair declined to disclose the contents of its investigation, even though the report had been completed and shared with other regulators.

On 10 November, the Central Bank issued a public clarification confirming that the restrictions applied to the engagement partner and quality assurance partner involved in NDB’s audit. EY itself remained eligible to audit licensed banks.

But the regulator did not name the two partners, specify the duration of their restrictions or publicly explain the findings on which its decision was based.

The restrictions apply only to licensed-bank audits, raising the possibility that the partners could continue auditing other companies. Whether they are doing so, and whether the audit committees of those companies have been informed of the restrictions, is unknown.

This raises an important governance question: how can an audit committee properly assess the suitability of an external auditor if regulatory concerns about that individual are not disclosed?

Meanwhile, NDB’s own governance arrangements were undergoing significant changes.

On 31 August, the bank announced the reconstitution of its board audit, integrated risk management and nominations and governance committees, effective the following day. Hasitha Premaratne became chairman of the audit committee, while Sujeewa Mudalige, its former chairman and a former president of the Institute of Chartered Accountants of Sri Lanka, moved to chair the integrated risk management committee.

On 12 November, Mudalige resigned from NDB’s board, citing personal reasons. The bank also announced another reconstitution of its board subcommittees.

His resignation does not, in itself, establish wrongdoing, and there is no evidence that parliamentary scrutiny prompted his departure. Nevertheless, these developments illustrate the continuing governance upheaval following the discovery of the fraud.

They also raise a broader question: why did it require parliamentary scrutiny for the public to learn about significant measures taken by institutions responsible for professional oversight?

The NDB case exposes a fundamental tension between confidentiality and accountability in professional oversight.

There are legitimate reasons for keeping investigations confidential. Regulators must protect witnesses, preserve evidence, respect due process and avoid unfairly damaging the reputations of individuals against whom allegations have not been substantiated.

But confidentiality also has consequences. When regulators do not disclose the identities of restricted professionals, the reasons for their decisions or the outcomes of completed investigations, audit committees and investors relying on their professional services may not even know that concerns or restrictions exist.

In addition, while the institutions involved may consider their responsibilities discharged, outsiders have limited means of assessing whether investigations were sufficiently rigorous, whether regulatory decisions were proportionate or whether effective safeguards have been introduced.

Accountability requires more than action behind closed doors. It requires enough transparency for those affected to understand what happened, what was done about it and who is answerable.

Parliamentary scrutiny provides an essential democratic safeguard. But should it be necessary to bring fundamental questions of professional accountability into the public domain?

To explore these questions, Big4News invited Richard Ebell to contribute his perspective.

Commenting publicly on the NDB scandal, Ebell questioned the failures of oversight across management, board committees, external auditors and regulators. He also highlighted the number of regulatory institutions involved, their apparent lack of coordination and the important role played by Parliament’s Committee on Public Finance in demanding answers.

I asked him what meaningful transparency and accountability should look like in practice.

Can regulators deliver meaningful accountability without publicly disclosing the findings and outcomes of their investigations?

Yes, they can and they should. Firstly, meaningful accountability requires promptness, which in this case has been lacking; the fraud was disclosed in early April and we are only now (as of early November) seeing action taken.

The Central Bank seemed to me unduly guarded in its responses, and very slow in reacting to the serious control and governance failures in a bank it monitors and supervises.

It is also a sad reality that the Securities and Exchange Commission of Sri Lanka, which regulates the share market, and the Institute of Chartered Accountants of Sri Lanka, which regulates chartered accountants, have up to now not taken any visible action or made any public statement on this fraud.

Should audit partners subject to regulatory restrictions be publicly identified? As a former audit committee chairman, would you expect to be informed if your auditor had been restricted from auditing other clients?

I think they should not be publicly shamed for the sake of a spectacle, but the firm concerned should respond to questions asked by clients who have a legitimate right to know who they are.

The Institute of Chartered Accountants of Sri Lanka should also act against the members concerned and communicate adequately to its membership, with minimum fanfare, the action taken.

What information should audit committees be entitled to receive about an audit firm’s regulatory history, investigations and restrictions affecting its partners?

The Central Bank has a published list of auditors permitted to audit banks (EY was, and remains, one of them). If rigorously reviewed and periodically updated, this should provide the necessary assurance to banks using them.

This is the first time, to my recollection, that restrictions have been placed on audit firms or partners in this way. There is currently no formal mechanism to inform audit committees of such restrictions, nor do I foresee one being established anytime soon.

Sri Lanka is a relatively small place. Until a formal mechanism exists, communication between audit committees can, and should, serve this purpose.

Where should regulators draw the line between protecting confidential investigations and disclosing information that clients, investors and the public have a legitimate interest in knowing?

I think common sense judgement (which may be rather lacking now) will serve regulators well in balancing confidentiality and disclosure.

What we have seen with the NDB fraud is excessive caution on the part of the Central Bank of Sri Lanka, which has largely addressed these issues only when questioned by Parliament’s Committee on Public Finance. Meanwhile, there has been no visible response from the Securities and Exchange Commission of Sri Lanka or the Institute of Chartered Accountants of Sri Lanka.

Only sustained public pressure will change this. The media and other interested parties need to question these institutions consistently. In the case of the NDB fraud, there has been far too little scrutiny, including, it would seem, from the bank’s own shareholders, despite the scale, circumstances and duration of the fraud.

Why did parliamentary scrutiny prove so important in bringing details of the NDB regulatory response into the public domain? Should such disclosures happen routinely?

It proved important as it seemed to be the only way to bring the discussion into the public domain. Without it, we would have known very little. Parliamentary scrutiny will continue to be important in cases within Parliament’s scope, until the desired media and public activism take hold.

With several regulatory and professional bodies involved, who should be responsible for ensuring that investigations are coordinated and their outcomes communicated transparently?

There previously was talk of regulators coordinating and collaborating on matters of mutual interest. I recall that being said by a Deputy Governor of the Central Bank when he chaired the Sri Lanka Accounting and Auditing Standards Monitoring Board. But the fallout from the NDB fraud suggests that regulators continue to work in silos.

Establishing a mechanism is not rocket science, and should establish the ground rules for collaboration and public communication — who should communicate, through what means, and what should be said. In the case of banks, the logical coordinator is the Central Bank.

What practical changes would you recommend to make banks, audit firms and their regulators more transparent and accountable?

Banks, and their Audit Committees, should identify and keep updated the areas of accounting risk and rigorously track them in sufficiently regular discussion with the relevant members of management.

Audit Committees should meet with the external auditors before and after interim and final audits are undertaken. They should also pay attention to the Central Bank’s supervisory examination findings, and interact with them as necessary about these.

Audit Committees must promptly communicate matters of concern to the Board.

All discussion should be open and in the spirit of meaningful “give and take” rather than interactions which participants want to get away from as quickly as they can.

Richard Ebell is an experienced corporate finance and banking governance professional who served as an independent non-executive director of Cargills Bank in Sri Lanka from July 2015 to July 2024, including as chairman from January 2023 until July 2024.

His career encompasses corporate finance, banking governance and audit committee oversight, giving him extensive experience of the responsibilities of directors, external auditors and regulators in maintaining financial accountability.

His perspective on the National Development Bank fraud draws on his experience of Sri Lanka’s banking sector and the challenges of ensuring effective governance, regulatory coordination and transparency.

Sri Lanka Restricts Two EY Audit Partners After US$41 Million Bank Fraud
How a multiyear fraud escaped detection, what EY reported examining, and why regulators restricted two audit partners.

Could a Weaker PCAOB Leave Audit Failures Unpunished?
Former SEC enforcement lawyer Andrew Feller examines the challenges of investigating auditors and the risk of gaps in regulatory accountability.

EY Strengthens Independent Oversight as Australia Rethinks Big Four Governance
Why effective oversight requires more than independent appointments, including access to information and the authority to challenge management.

This article is part of the Big4News Expert Voices Series