s

FINAL REPORT | FORENSIC REPORT | RFP 5 EXAMINATION ON CONDUCT OF SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBTParliament / DIRECTOR, SUPERVISION Copy OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMARY DEALERS FROM 1 JANUARY 2009 TO 31 DECEMBER 2017 THE CENTRAL BANK OF SRI LANKA 8 NOVEMBER 2019 Copy

Parliament FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

CONTENTS

1. INTRODUCTION ...... 11 1.1. BACKGROUND ...... 11 2. OBJECTIVE AND SCOPE ...... 18 2.1. THE OBJECTIVE AND SCOPE ...... 18 3. WORK PERFORMED ...... 20 3.1. OPERATIONS OF REGULATION AND SUPERVISION FUNCTION...... 20 3.2. MAPPING THE DEPARTMENTAL PROCEDURES WITH APPLICABLE LEGISLATIONS .... 22 3.3. THE CBSL INTERNAL REPORTS ...... 23 3.4. REVIEW OF DEPARTMENTAL PROCEDURE ...... 23 3.5. DIGITAL FORENSICS ...... 28 3.6. PUBLIC DOMAIN SEARCHES ...... 40 4. PROCESS UNDERSTANDING ...... 42 4.1. BACKGROUND ...... Copy ...... 42 4.2. UNDERSTANDING FOR THE CONDUCT OF REGULATORY FUNCTION ...... 45 4.3. UNDERSTANDING FOR CONDUCT OF EXAMINATION - ON-SITE ...... 48 4.4. UNDERSTANDING THE CONDUCT OF EXAMINATION - OFF-SITE SURVELLANCE ...... 49 4.5. UNDERSTANDING THE CONDUCT OF EXAMINATION – SPOT EXAMINATION ...... 50 5. EXECUTIVE SUMMARY ...... 51 5.1. SUMMARY OF KEY FINDINGS ...... 51 6. RECOMMENDATION ...... 55 7. DETAILED OBSERVATIONS ...... 57 SECTION A: REGULATION FUNCTION ...... 60 7.1. NO DEFINED PROCEDURALParliament FUNCTIONS / BENCHMARKING ...... 63 7.2. NON-EXISTENCE OF TECHNIQUES TO MONITOR MARKET INTEGRITY ...... 65 7.3. NON UPDATION OF THE OPERATIONS MANUAL ...... 67 7.4. NO MECHANISM TO ANALYSE THE MARKET DEVELOPMENT ...... 68 7.5. APPOINTMENT OF PRIMARY DEALERS...... 70 7.6. ASSESSMENT OF FITNESS AND PROPRIETY OF DIRECTORS ...... 76 7.7. POLICY FORMULATION ...... 80 7.8. ABRUPT EMPLOYEE TRANSFERS IN REGULATORY AND SUPERVISORY FUNCTION ... 81 SECTION B: SUPERVISION FRAMEWORK AND DIRECTION ...... 84 7.9. OBJECTIVE AND APPROACH:...... 87

Strictly Private and Confidential Page 3 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.10. POLICY FORMULATION ...... 90 7.11. CAPABILITY ENHANCEMENT...... 97 7.12. STAFFING DEFICIENCIES ...... 99 SECTION C: SYSTEMIC AND DESIGN GAPS IN SUPERVISION ...... 102 7.13. GAPS IN COVERAGE OF LAWS ...... 102 7.14. ABSENCE OF PRIMARY DEALER RISK SCORING SYSTEM ...... 107 7.15. ROOT CAUSE AND QUANTIFICATION ...... 108 7.16. QUALITY SELF-ASSESSMENT AND BENCHMARKING ...... 113 7.17. OVERSIGHT RESPONSIBILITY ...... 114 SECTION D: DEFICIENCIES IN OPERATIONS: CONDUCT OF EXAMINATION ...... 118 7.18. EXAMINATIONS AS THE MEDIUM OF SUPERVISION ...... 118 7.19. PLANNING AND PREPARATION ...... 119 7.20. EXAMINATION PROCEDURES ...... 121 7.21. OPERATIONS ...... 122 7.22. COMMON FINDINGS ACROSS PRIMARY DEALERS ...... 124 7.23. CONDUCT OF EXAMINATIONS ...... Copy...... 126 7.24. REPEAT FINDINGS INDICATING GAPS IN FOLLOW-UP OR REMEDIATION ...... 144 7.25. NON-REPORTING TO THE MONETARY BOARD ...... 146 8. PUBLIC DOMAIN SEARCH ...... 150 9. DIGITAL FORENSICS ...... 160 9.1. REVIEW OF EMAILS ...... 160 9.2. DELETION OF OUTLOOK FILES ...... 164 10. LIMITATIONS ...... 172 11. ANNEXURES ...... 175 12. EXHIBITS ...... Parliament...... 176

Strictly Private and Confidential Page 4 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

GLOSSARY

# ACRONYM DESCRIPTION 1 ACRA The Accounting and Corporate Regulatory Authority 2 AG The Assistant Governor 3 ASPD Additional SPD 4 BDO India or We or Us BDO India LLP 5 Bn. Billion 6 BO Back Office 7 BOC Bank of Ceylon 8 BOE Bank of England 9 BSD Bank Supervision Department 10 CBSL The Central Bank of Sri Lanka 11 CDS Central Depository System 12 CEO Chief Executive Officer The Convention on the Suppression of Terrorist Financing Act, 13 CFT No. 25 of 2005 Copy 14 CID Criminal Investigation Department 15 CL Contract 16 Client or You The Monetary Board of Central Bank of Sri Lanka 17 CoC Chain of Custody 18 COPE The Committee of Public Enterprises 19 CSL or CSF Customer Accounts in LankaSecure 20 DFCC DFCC Bank PLC 21 DG Deputy Governor 22 DIT The Director of Information Technology 23 DOD ParliamentDomestic Operations Department 24 DSNBFI Department of Supervision of Non-Bank Financial Institutions 25 DSPD Deputy Superintendent of Public Debt 26 EIC Examiner In-Charge 27 Entrust or ESL Entrust Securities PLC 28 EPF The Employees’ Provident Fund 29 ESI Electronically Stored Information 30 FAMC Forensic Audit Monitoring Committee 31 FED Federal Reserve System 32 FTRA The Financial Transactions Reporting Act 2006 The Housing Development Finance Corporation Bank of Sri 33 HDFC Lanka

Strictly Private and Confidential Page 5 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

# ACRONYM DESCRIPTION 34 IBSL The Institute of Bankers of Sri Lanka 35 ILF Intra-day Liquidity Facility 36 ISIN International Securities Identification Number 37 IT Information Technology 38 ITD Information Technology Department 39 LTBO Local Treasury Bills Ordinance No. 8 of 1923 40 MB The Monetary Board 41 MLA Monetary Law Act 42 MO Middle Office 43 MOF Ministry of Finance 44 Natwealth or NWSL Natwealth Securities Limited 45 Nihal Fonseka Anthony Nihal Fonseka 46 PABC Pan Asia Banking Corporation PLC (Primary Dealer unit) 47 PAML Perpetual Asset Management (Private) Limited 48 PCHL Perpetual Capital Holdings (Private) Limited The Presidential Commission of Inquiry on the issue of Treasury 49 PCOI Bonds during the period 1 CopyFebruary 2015 to 31 March 2016 50 PD(s) Primary Dealers / Primary Dealer 51 PDD The Public Debt Department Public Debt Operational Manual applicable during the review 52 PDD Operational Manual period 53 PMLA The Prevention of Money Laundering Act 2006 54 PTL Perpetual Treasuries Limited 55 RBI Reserve Bank of India Regulator of Primary Dealers - the PDD until June 2016 and 56 Regulator D/SNBFI 57 Report ParliamentForensic Audit Report 58 Review Period 1 January 2009 to 31 December 2017 59 ROC Registrar of Companies 60 Rs. Sri Lankan Rupees (LKR) 61 RSSO Registered Stocks and Securities Ordinance 62 SPD Superintendent of Public Debt 63 SSSS Scripless Securities Settlement System 64 Supervision Division Supervision Division of Public Debt Department 65 T-Bills Treasury Bills 66 T-Bonds Treasury Bonds 67 WealthTrust or WTSL WealthTrust Securities Limited

Strictly Private and Confidential Page 6 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

TERMS FOR REFERENCE

# TERM DESCRIPTION/ MEANING/ INTERPRETATION1 1 Active Data Data on a computer that is not deleted and is generally accessible and readily visible to the user under normal use. Source: https://burgessforensics.com/computer-forensics-glossary/ 2 Active directory A directory is a hierarchical structure that stores information about objects on the network. A directory service, such as Active Directory Domain Services (AD DS), provides the methods for storing directory data and making this data available to network users and administrators. Source: https://docs.microsoft.com/en-us/windows-server/ identity/ad-ds/get-started/virtual-dc/active-directory-domain- services-overview 3 Captive Sources Captive sources are financial institutions which are required to purchase and hold Government securities. Source: http://www.presidentsoffice.gov.lk/?p=5093 4 Central Depository A computerized central system which records primary issuance of Scripless System securities and their trades taking place in the secondary market. Source: https://www.cds.lk/introduction.php 5 Chain of Custody The chain of custody in digital forensics can also be referred to as the forensic link, the paper trail, or theCopy chronological documentation of electronic evidence. It indicates the collection, sequence of control, transfer, and analysis. It also documents each person who handled the evidence, the date/time it was collected or transferred, and the purpose for the transfer. Source:https://resources.infosecinstitute.com/category/computerf orensics/introduction/areas-of-study/legal-and-ethical- principles/chain-of-custody-in-computer-forensics/#gref 6 Department / Supervision division of Public Debt Department until 3 June 2016 and Division Supervision of Non-Bank Financial Institutions Source:ahttps://www.cbsl.gov.lk/en/about/organisational-structure /departments 7 Department / Superintendent of Public Debt Department until 3 June 2016 and Post 3 Division Head June 2016, Director of Supervision of Non-Bank Financial Institutions ParliamentSource:ahttps://www.cbsl.gov.lk/en/about/organisational -structure /departments 8 Digital Footprint The information about a person that exist on the Internet as a result of their online activity. Source: https://www.lexico.com/en/definition/digital_footprint 9 Digital Forensics Digital forensics is a branch of forensic science focused on recovery and investigation of artefacts found on digital devices. Source: https://www.lawtechnologytoday.org/2018/05/digital-forensics/

Strictly Private and Confidential Page 7 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

# TERM DESCRIPTION/ MEANING/ INTERPRETATION1 10 ESI or Electronically-stored information is any information created, stored, or Electronically best utilized with computer technology of any type. It includes but is not Stored limited to data; word-processing documents; spreadsheets; presentation Information documents; graphics; animations; images; e-mail and instant messages (including attachments); audio, video, and audio visual recordings; voicemail stored on databases; networks; computers and computer systems; servers; archives; back-up or disaster recovery systems; discs, CD’s, diskettes, drives, tapes, cartridges and other storage media; printers; the Internet; personal digital assistants; handheld wireless devices; cellular telephones; pagers; fax machines; and voicemail systems. Source: https://www.foley.com/- /media/files/insights/events/2007/04/corporate-records-what-to-keep- and-what-to-toss/files/guidelines-for-state-trial-courts-regarding- discov/fileattachment/state_cs_eldiscccjguidelines.pdf 11 FInNet Financial Information Network (FInNet) is a common interface to submit financial information by Primary Dealers Source: http://fiusrilanka.gov.lk/ 12 File Carving A process used in computer forensics to extract data from a disk drive or other storage device without the assistance of the file system that originality created the file. It is a method that recovers files at unallocated space without any file information and is used to recover data and execute a digital forensic investigation. Source: https://resources.infosecinstitute.com/fileCopy-carving/ 13 Forensic image A forensically sound and complete copy of a hard drive or other digital media generally intended for use as evidence. Such copies include unallocated space, slack space, and boot record. A forensic image is often accompanied by a calculated Hash signature to validate that the image is an exact duplicate of the original Source: https://burgessforensics.com/computer-forensics-glossary/ 14 Government Treasury Bills, Treasury Bonds and other securities issued by the CBSL on Securities behalf of the Government of Sri Lanka. Source: https://www.cbsl.gov.lk/en/financial-system/financial- markets/government-securities-market

15 Hash Values A computed numerical value that represents a “digest” of the content of Parliamenta file. If and only if two documents are identical to the letter will they return the same hash value. The Hash value is used as part of a digital signature and to compare document content in the de-duping process. Source: https://www.edrm.net/wp-content/uploads/2017/03/20160422- EDRM-Glossary-2.pdf 16 Keyword A significant word from a title or document used specially as an index to content. Source: https://www.merriam-webster.com// dictionary/keyword 17 LankaSecure The Scripless Securities Settlement System and the Central Depository System (“LSS”) System established by the CBSL in terms of the Monetary Law Act. Source:https://www.cbsl.gov.lk/sites/default/files/cbslweb_documents/ publications/LankaSecure %282006%29.pdf 18 Leakage Deliberate disclosure of confidential information. Source: https://www.lexico.com/en/definition/leakage

Strictly Private and Confidential Page 8 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

# TERM DESCRIPTION/ MEANING/ INTERPRETATION1 19 Licensed A bank licensed under the Banking Act No. 30 of 1988 as amended from Commercial Bank time to time to carry on commercial banking business as defined in that Act. Source:https://www.cbsl.gov.lk/sites/default/files/cbslweb_documents/ laws/acts/en/BankingAct30_1988.pdf 20 Licensed Any company or a body corporate which has been issued with license Specialized Bank under the Banking Act No. 30 of 1988 as amended from time to time to carry on the specialized banking of accepting deposit money and investing and lending such money. Source:https://www.cbsl.gov.lk/sites/default/files/cbslweb_documents/ laws/acts/en/BankingAct30_1988.pdf

21 Litigation Hold A litigation hold, also known as a "preservation order" or "hold order" is a temporary suspension of the company’s document retention destruction policies for the documents that may be relevant to a lawsuit or that are reasonably anticipated to be relevant. It is a stipulation requiring the company to preserve all data that may relate to a legal action involving the company. Source: https://definitions.uslegal.com/l/litigation-hold 22 Metadata Data that provides information about other data. Source: https://www.merriam-webster.com/dictionary/metadata 23 Outright Transactions by which ownership (title) of the Government Securities are Transactions transferred permanently to the buyer.Copy Source: https://www.cbsl.gov.lk/en/Monetary_Policy 24 Price Sensitive Of information, likely to affect prices of securities if it were made Information public. Source: https://www.lexico.com/en/definition/price-sensitive 25 Primary Dealers Primary Dealer means any commercial banks, company or other person appointed by the Monetary Board for the purpose of dealing with the CBSL as counterparty in the primary market in Government securities. Source: https://www.cbsl.gov.lk/en/financial-system/financial-system- stability/primary-dealers 26 Primary Market Market where securities are first issued to buyers and; the initial allocation and issue of Scripless Securities by Public Debt Department of the CBSL on behalf of the Government of Sri Lanka to buyers i.e. Primary ParliamentDealers and Designated Non-Dealer Bidders against payment. Source: https://www.cbsl.gov.lk/en/node/2627 27 Regulations Regulations made under the Monetary Law Act, the Registered Stock and Securities Ordinance and the Local Treasury Bills Ordinance Source: https://www.cbsl.gov.lk/en/financial-system/financial- infrastructure/laws-and-regulations-for-financial-Infrastructure 28 Regulator The department which is responsible to regulate the Primary Dealers and responsible for the issuing the direction under the applicable law i.e. PDD until June 2016 and D/SNBFI Source: https://www.cbsl.gov.lk/en/About_the_Financial_System 29 Report Forensic Audit Report 30 Repurchase A transaction involving a sale of Government securities with an Agreement agreement to reverse the transaction on a future date. (“REPO”) Source: https://www.cbsl.gov.lk/en/financial-system/financial- instruments/financial-instruments

Strictly Private and Confidential Page 9 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

# TERM DESCRIPTION/ MEANING/ INTERPRETATION1 31 Reverse Repo A transaction involving a purchase of Government securities with an agreement to reverse the transaction on a future date. Source: https://www.cbsl.gov.lk/en/financial-system/financial- instruments/financial-instruments 32 Review Period 1 January 2009 to 31 December 2017 33 Secondary Market The market where securities are traded and exchanged among buyers and sellers after the securities are issued at the primary market. Source: https://www.cbsl.gov.lk/en/financial-system/financial- instruments/financial-instruments 34 Settlement Date Securities industry term describing the date on which a trade (bonds, equities, foreign exchange, commodities, etc.) settles. That is, the actual day on which transfer of cash or assets is completed. Source: https://www.investopedia.com/terms/s/settlement_period.asp 35 Spreadsheet An electronic document in which data is arranged in the rows and columns of a grid and can be manipulated and used in calculations. Source: https://www.lexico.com/en/definition/spreadsheet 36 Timeline Analysis Analysis of schedule of events and procedures. Source: https://www.merriam-webster.com/dictionary/timeline 37 Treasury Bill A short-term debt instrument issued usually on a discount basis and for maturities of 91, 182, and 364 days by the CBSL on behalf of the government under the Local Treasury Bills Ordinance. Source: https://www.cbsl.gov.lk/en/About_the_Financial_SystCopy em 38 Treasury Bond A medium to long-term debt instrument issued by the CBSL on behalf of the government under the Registered Stock and Securities Ordinance. Source: https://www.cbsl.gov.lk/en/About_the_Financial_System

Parliament

Strictly Private and Confidential Page 10 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

1. INTRODUCTION

1.1. BACKGROUND

1.1.1. The Central Bank of Sri Lanka (“CBSL”) is the apex institution in the financial sector of Sri Lanka. It was established in 1950 under the Monetary Law Act No. 58 of 1949 (“MLA”) as a semi-autonomous body and with the two primary objectives2 of maintaining of economic and price stability and financial system stability of Sri Lanka by managing the rate of inflation in line with Government’s macroeconomic policies.

1.1.2. The CBSL acts as an advisor on economic affairs and banker to the Democratic Socialist Republic of Sri Lanka (the “Government of Sri Lanka”) and tasked with managing the Employees’ Provident Fund (“EPF”) and country’s public debt.

1.1.3. As per Section 21C of Registered Stock and Securities Ordinance (incorporating amendments up to 31 December 2004), the CBSL shall have the authority to take any action necessary for the issue and trading of scripless treasury bonds.

1.1.4. Arjuna Mahendran was appointed as the 13th Governor of the CBSL in January 20153. He was born in Sri Lanka but held citizenship of Singapore.Copy

1.1.5. Following concerns expressed in the public domain, with regard to the propriety of Mahendran’s intervention in the Treasury Bond Auction held on 27 February 2015 and questions raised on the Conflict of Interest his relationship with Arjun Aloysius of Perpetual Treasuries Limited (“PTL”). The Presidential Commission of Inquiry (“PCOI”)4 was formed to inquire into the allegation of irregularities in the issue of Treasury Bonds by the Public Debt Department (“PDD”) of the CBSL during the period 1 February 2015 to 31 March 2016.

1.1.6. PCOI recommended5 the CBSL for appropriate investigation / forensic audit to assess the effectiveness of the conduct of the Regulatory and Supervisory functions by the regulator i.e. SPD / DSNBFI.Parliament 1.1.7. Accordingly, BDO India LLP (“BDO India” or “We”) was appointed to examine the conduct of Regulatory and Supervisory roles by the superintendent of public debt / director, supervision of non-bank financial institutions pertaining to selected Primary Dealers for the Review Period (“1 January 2009 to 31 December 2017”).

2 Source: https://www.cbsl.gov.lk/en/about/about-the-bank/overview 3 Source: https://www.cbsl.gov.lk/en/about/about-the-bank/bank-history/arjuna-mahendran 4 As per Presidential Warrant of 27 January 2017 in pursuance of the provisions of Section 2 of the Commissions of Inquiry Act (Chapter 393) amended. 5 As per Chapter 33, Para 11 of The PCOI Report

Strictly Private and Confidential Page 11 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

1.1.8. One of the core functions of the CBSL includes licensing, regulating & supervising of banks and selected non-bank financial institutions (E.g.: Licensed Finance Companies, Specialised Leasing Companies, Licensed Microfinance Companies etc.).

1.1.9. As per Section 4 (31) of Local Treasury Bills Ordinance No. 8 of 1923 (“LTBO”), amended section 4 (1) of 2004 and the Section 6 (32) of Registered Stock and Securities Ordinance, 1995 (“RSS0”), amended Section 4 (2) of 2004; the CBSL has the authority to appoint, regulate and monitor the Primary Dealers with respect to their transactions in the securities and the performance of their duties as Primary Dealers (“PDs”).

1.1.10. As per Section 113 of MLA, the CBSL shall, as agent of the Government of Sri Lanka, be responsible for the management of public debt. Accordingly, the Public Debt Department (“PDD”) engages in function relating to the issuance, servicing and management of domestic debt and servicing of foreign debt on behalf of the Government of Sri Lanka.

1.1.11. PDD was responsible for carrying out various activities relating to the issue of Treasury Bonds, Bills and other Government securities and Primary Dealers through segregated divisions i.e. Front Office, Middle Office, Back Office, Central Depository System (“CDS”), Supervision Division and Support Services Division. (Refer Exhibit 1)6.

1.1.12. Supervision division of PDD and Department of Copy Supervision of Non-Bank Financial Institutions (“DSNBFI”) are responsible to ensure sound and safe Primary Dealer (“PD”) network including competition, liquidity and depth in to the Government securities market and assisting the Government in reduction of borrowing cost and guarantees customer protection by safeguarding their investments. (Refer Exhibit 1, Exhibit 2 and Exhibit 11)7.

1.1.13. The CBSL introduced dedicated Primary Dealer system in 2000 with two objectives, to expand the Government securities market and to raise funds at lower cost.

1.1.14. There are two categories of institutions i.e. “Primary Dealer Units of licensed commercial banks” and “Standalone Primary Dealers” eligible as authorized Primary Dealers. As on 6 June 20198, theParliament CBSL has appointed 16 Primary Dealers under the Local Treasury Bills Ordinance and the Registered Stock and Securities Ordinance.

6 Source: Refer Exhibit 1 PDD operation manual - supervision division 7 Source: Refer Exhibit 1 PDD operation manual - supervision division, version 2 updated as of 31 July 2013, Exhibit 2 PDD Operation Manual- Supervision division May 2015 and Exhibit 11 PDD operation manual – Supervision division 2007 8 Source: https://www.cbsl.gov.lk/en/authorized-financial-institutions/registered-authorized-primary-dealers/ https://www.cbsl.gov.lk/en/financial-system/financial-system-stability/primary-dealers

Strictly Private and Confidential Page 12 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Table 1 - The list of Primary Dealers as following along with their Appointment and Suspension dates

# PD NAME APPOINTMENT SUSPENSION DATE DATE Licensed Commercial Banks (Primary Dealers Unit) 1 Bank of Ceylon (Primary Dealer Unit) 17 Jan 1991 - 2 Commercial Bank of Ceylon PLC (Primary Dealer Unit) 1 Apr 2000 - 3 Pan Asia Banking Corporation PLC 1 Aug 2013 15 Aug 2017 4 People's Bank (Primary Dealer Unit) 1 Nov 2002 - 5 Sampath Bank PLC (Primary Dealer Unit) 21 Jul 2006 - 6 Seylan Bank PLC (Primary Dealer Unit) 26 Oct 1999 - 7 The Hongkong and Shanghai Banking Corporation Limited 30 Sep 2013 1 Apr 2016# (Primary Dealer Unit) 8 Union Bank of Colombo PLC (Primary Dealer Unit) 8 Apr 2011 - Standalone Primary Dealers 1 Acuity Securities Limited 3 Jan 2000 - 2 Capital Alliance Limited 10 Jan 2000 - 3 Entrust Securities PLC 1 Apr 2000 24 Jul 2017## 4 First Capital Treasuries PLC Copy1 Mar 2000 - 5 Natwealth Securities Limited 1 Dec 2003 31 May 20191 6 NSB Fund Management Company Limited 1 Mar 2000 - 7 Perpetual Treasuries Limited 30 Sep 2013 6 Jul 2017 8 Wealth Trust Securities Limited 1 Aug 2011 -

# Withdrawn their Primary Dealership

## Refrained from the Primary Dealership 1 Suspended post Review Period

1.1.15. Primary Dealers play an active role in the development of “Government Securities” market, both in its primaryParliament and secondary markets through obligations such as:

A. Participating in primary auctions; B. Acting as agent and relationship manager for the investment in Government securities; C. Predominance of investment in Government securities; D. Achieving minimum secondary market turnover ratio; and E. Maintaining efficient internal control system for fair conduct of business.

Strictly Private and Confidential Page 13 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

1.1.16. As part of Supervision, Regulation and continuous monitoring; the Public Debt Department (“PDD”) of the CBSL continued to review the existing laws and regulations9 and introduced system reforms to improve the Government securities market.

1.1.17. PDD Supervision division and DSNBFI (“department”) are responsible for Regulation and Supervision of Primary Dealers. As part of Regulation function, the department conducts assessment of application and appointment, policy formulation, assessment of fitness & propriety of directors and suspension. For Supervision function, the department conducts examinations, inspections and investigations to monitor and supervise the activities of the Primary Dealers. Details of the activities conducted by the Supervision division are as

following: (Refer Exhibit 2)10.

1. Application and Appointment:

A. The application and the accompanying documents are assessed based on relevant Acts, Regulations and Directions. The ability of the proposed applicant to conduct its business activities in a prudent and efficient manner in the interest of Primary Dealer system and investors in Government securities are taken into consideration for the assessment. The applicant should furnish information and documents, that the CBSL deems necessary for considering the suitability of the applicant.Copy B. A board paper is submitted after acquiring a complete set of information, with a detailed analysis of the applicant, with relevant recommendation of the department. The Monetary Board may grant ‘In principle approval’ with a specific timeline to fulfill the remaining requirements (if any) and sufficient time to establish technical and human resource requirements or reject the application. (Refer Exhibit 2)11.

2. Suspension:

A. The CBSL may suspend a Primary Dealer if it fails to comply with any law, regulation, direction, guideline or code of conduct applicable to it or acts in a manner which is unfavorableParliament for the Primary Dealer system or to the national economy for a period not exceeding six months or may cancel the appointment of a Primary Dealer. (Refer Exhibit 39)12.

9 Source: https://www.cbsl.gov.lk/sites/default/files/cbslweb_documents/publications/otherpub/Public%20Debt%20Management%20i n%20Sri%20Lanka.pdf 10 Source: Refer Exhibit 2 for PDD Operation Manual – Supervision division, May 2015 11 Source: Refer Exhibit 2 for PDD Operation Manual – Supervision division, May 2015 12 Source: Refer Exhibit 39 for Appointment and Suspension of PDS – LTBO and RSSO

Strictly Private and Confidential Page 14 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

3. Assessment of Fitness & Propriety of directors:

A. The affidavits and declarations submitted by directors and senior employees are assessed based on the criteria stipulated in the direction. The assessment sheets and the documents sent by the director / senior employees are sent to Legal and Compliance Department for legal clearance. B. Upon receiving the legal clearance, the approval is granted to relevant officer, in writing. With respect to existing directors and employees, Primary Dealer companies shall obtain and submit affidavits and declarations to the SPD within 30 days of this direction. (Refer Exhibit 2)13.

4. Policy Formulation:

A. Review of areas like broadening business lines for Primary Dealer activities, present tax structure and its applicability and the prevailing reporting formats submitted by Primary Dealers etc., to cope with the secondary market developments. B. It is the task of the supervision department to suggest appropriate policies to make available an efficient Government security market with a stable institutional framework. Issuing instructions via directions and ensuring the implementation of the same by issuing warning letters and show-cause Copy notice form part of the Regulatory function.

5. Off-site surveillance:

A. It is a continuous monitoring mechanism on the financial soundness and operational performance of the Primary Dealers with an objective to identify potential adverse developments of individual Primary Dealers and Primary Dealer industry; and B. It includes collection and analysis of primary, secondary market information and financial statements of the Primary Dealers. It also includes monitoring of transactions in the Government securities in Scripless Securities Settlement System (“SSSS”), Central Depository System (“CDS”) and the e-trading platform.

Parliament 6. On-site examination:

A. As part of on-site examination, supervision division focuses on risk assessment of Primary Dealers, adequacy capital, liquidity, asset quality, profitability and adherence to prudential directions, guidelines and governance practices.

13 Source: Refer Exhibit 2 for PDD Operation Manual – Supervision division, May 2015

Strictly Private and Confidential Page 15 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7. Spot examination:

A. Spot examinations are the special case-based examinations conducted to examine the specific areas raised due to certain concerns raised in the ongoing off-site surveillance, customer complaints from customers / Primary Dealer industry.

1.1.18. Transfer of Primary Dealers’ Regulation and Supervision functions from PDD to SNBFI & BS

A. Supervision function was part of PDD until May 2016. The PCOI14 in the inquiry observed that the supervision function of Primary Dealers vested with PDD, was unsuitable for PDD, since PDD engages in day-to-day dealings with Primary Dealers for issue of Government Securities, and, some employees of the PDD may form close relationships with employees of Primary Dealers. B. On 8 January 2016, the Monetary Board discussed about the PDD’s Regulatory and Supervisory roles on the Primary Dealers and determined that it conflicts with its role of market development and marketing securities. C. In pursuance of aforesaid discussion, the former Deputy Governor, P Samarasiri, had submitted a board paper on 5 February 2016 to seek the approval of the Monetary Board to assign the Regulation and Supervision of the Primary Dealers in the Government Securities market to DSNBFI. Copy D. The Monetary Board at its meeting held on 3 January 2016 raised serious concerns over considerable lapses in the Regulatory and Supervisory actions of the PDD in the case of Entrust securities PLC and expressed views on the need to examine the Regulatory and Supervisory lapses of the PDD inclusive of the lapses of the PDD officials and to introduce improvements to the Regulatory and Supervisory mechanism of the PDD to prevent occurrences of instances similar to Entrust Securities PLC in future. In addition, internal discussions on establishment of a new securities trading infrastructure for the Government securities market which will require a new Regulatory and Supervisory mechanismParliament for the market in line with the best international practices.

14 Source: Chapter 12 of PCOI report dated 30 December 2017

Strictly Private and Confidential Page 16 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

E. In view of the above, it was proposed to transfer regulatory and supervisory functions of the Central Bank of Sri Lanka now carried out by the PDD to the DSNBFI with the immediate effect. The PDD was made responsible to conduct auctions, maintenance of issuance and secondary trading systems inclusive of issuance of system rules, securities registry, debt servicing, Government securities market development, debt management database and relevant correspondence and reports. DSNBFI was made responsible to undertake all Regulation and Supervision on prudential, conduct of business (other than system rules), compliance and consumer/ investor protection aspects to promote safety and soundness and confidence on institutions and the market. F. The Director, SNBFI, will review the current regulatory and supervisory mechanism in consultation with management and market participant as appropriate and issue revised or new regulations appropriately. G. The supervision division of Primary Dealers was transferred to DSNBFI with effective from 3 June 2016 and supervision function of Primary Dealer unit of licensed commercial banks were transferred to Bank Supervision Department (“BSD”), with effective from 16 May 2018. (Refer Exhibit 3 and Exhibit 4) 15.

Copy

Parliament

15 Source: Refer Exhibit 3 for Regulation made by The Ministry of Finance under Section 55 of the RSSO (Chapter 420) and Exhibit 4 for Regulation made by the Ministry of Finance under Section 16 of the LTBO (Chapter 417)

Strictly Private and Confidential Page 17 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

2. OBJECTIVE AND SCOPE

2.1. THE OBJECTIVE AND SCOPE, DEFINED IN THE CONTRACT NO. RFP/CBSL/BS/FA/2018/05 ARE AS FOLLOWS:

2.1.1. The Monetary Board (“MB”) decided to conduct an independent examination to assess the effectiveness of the conduct of the Regulatory and Supervisory functions by the regulator, i.e. SPD / the DSNBFI with respect to the following Primary Dealers:

A. Entrust Securities PLC; B. Perpetual Treasuries Limited; C. Pan Asia Banking Corporation PLC (Primary Dealer Unit); D. WealthTrust Securities Limited; and E. Natwealth Securities Limited

2.1.2. With respect to the selected Primary Dealers as per 2.1.1 above, during the Review Period 1 January 2009 to 31 December 2017, the scope of work included to:

A. Examine the laws, regulations, policies, circulars, guidelines, manuals etc. applicable to Regulation and Supervision of Primary Dealers;Copy B. Ascertain if there were any deviations from relevant laws, regulations, policies, circulars, guidelines, etc. in performing the role of Regulation and Supervision of the selected Primary Dealers; C. Ascertain if there were any irregularities, lapses or misconduct or instances of professional negligence in conducting the role of Regulation and Supervision; D. Ascertain if there was any nexus between Central Bank Officers and external parties, which had given rise to deficiencies/lapses, misconduct, market manipulations, irregularities, violation of laws, regulations, policies, circulars, guidelines, code of conduct of the Primary Dealers, etc. in performing the Regulatory and Supervisory function. Parliament 2.1.3. Operations of the PDD / the DSNBFI to be examined with respect to Regulation and Supervision of Primary Dealers.

The following practices adopted, and actions taken by the PDD / the DSNBFI with respect to Regulation and Supervision of selected Primary Dealers during the period under review, may require comprehensive audit / scrutiny:

A. Evaluation of applications and appointment of selected Primary Dealers; B. On-site and Off-Site supervision of selected Primary Dealers and findings thereof; C. Recommendations and or any regulatory actions taken by the regulator with respect to such findings; D. Regulatory actions recommended to the Monetary Board by the regulator;

Strictly Private and Confidential Page 18 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

E. Regulatory actions approved / not approved by the Monetary Board, and F. Implementation and monitoring of regulatory actions by the regulator.

2.1.4. Investigate into the matters referred to above, and any other matters which may come to light during the examination which have a bearing or relevance to the matters referred above.

Copy

Parliament

Strictly Private and Confidential Page 19 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

3. WORK PERFORMED

3.1. OPERATIONS OF REGULATION AND SUPERVISION FUNCTION

3.1.1. The detailed work performed to examine the review conducted by the Public Debt Department (“the PDD”) - supervision division / Department of Supervision of Non-Bank Financial Institutions to supervise selected Primary Dealers with respect to Regulatory and Supervisory roles are as stated below.

3.1.2. Conducted meetings / discussions with the employees of the Department of Supervision of Non-Bank Financial Institutions (“the DSNBFI”), Bank Supervision Division (“BSD”) and Public Debt Department (“the PDD”) to gather the understanding on the Regulatory and Supervisory process relating to Primary Dealer including application, appointment, examination and issue of directions. The details of meetings scheduled are as follows:

Table 2 - The details of meetings scheduled with employees of the CBSL

# DATE OF NAME OF EMPLOYEES CURRENT DESIGNATION CURRENT MEETING DEPARTMENT 1 8 May 2019 W Ranaweera DirectorCopy SNBFI K P K Weerasekara Deputy Director SNBFI S Guruge Head of Division SNBFI D Seram Assistant Director SNBFI S Premachandra Senior Assistant Director Internal Audit 2 9 May 2019 N D Y C Weerasinghe Deputy Superintendent PDD J Gamalath Additional Director BSD N Rayigama Senior Assistant Director BSD A Amarakoon Senior Assistant Director BSD Parliament K Chandrasiri Assistant Director BSD 3 16 Sep 2019 N D Y C Weerasinghe Deputy Superintendent PDD L S Fernando Senior Manager PDD 4 17 Sep 2019 Dr. M Z M Aazim Superintendent PDD N D Y C Weerasinghe Deputy Superintendent PDD 5 18 Sep 2019 W Ranaweera Director SNBFI

6 20 Sep 2019 W Ranaweera Director SNBFI K P K Weerasekara Deputy Director SNBFI S P Sedara Senior Assistant Director SNBFI

3.1.3. Conducted meetings / discussions with the former employees who performed Regulation and Supervision functions of Primary Dealers to gather an understanding on the regulatory

Strictly Private and Confidential Page 20 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

and supervisory process relating to Primary Dealers including application, examination, regulation and other Primary Dealer related Regulatory and Supervisory functions. The details of meetings conducted are as follows:

Table 3 - The details of meeting conducted with former employees of Supervision division

# DATE OF NAME OF EMPLOYEES DESIGNATION CURRENT DEPARTMENT MEETING 1 27 June N D Y C Weerasinghe Deputy Superintendent PDD 2019 D L Nihal Deputy Superintendent PDD R D T Gunasekara Additional Director Communications 2 28 June L Sritharan Acting Deputy Director Macro Prudential 2019 Surveillance S M S M Kumari Senior Assistant Director Macro Prudential Surveillance L P S Perera Senior Assistant Employees’ Provident Superintendent Fund 3 1 July D M K B Dunuthilake Senior Assistant Director Regional Development 2019 H M N D Herath Senior Assistant Director Legal and Compliance L S Fernando Senior ManagerCopy PDD A S Fernando Senior Assistant Director Regional Development J D S J Nanayakkara Additional Superintendent Employees’ Provident Fund 4 3 July T M B A Goonetilleke Deputy Director Centre for Banking 2019 Studies D S Thenuwara Senior Manager PDD U P Jayasinghe Senior Assistant Employees’ Provident Superintendent Fund

3.1.4. Attended meetings conducted by the Honourable Governor with various division heads and the SPOC (appointedParliament by the Monetary Board) to discuss the status, data dependency, challenges faced, timelines for completion and the way forward. (Refer Exhibit 5) 16.

16 Refer Exhibit 5 for the summary of discussion with the Honourable Governor

Strictly Private and Confidential Page 21 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

3.1.5. Conducted meetings with SPD and the DSNBFI, key officials of the PDD and the DSNBFI and department personnel for clarification / additional understanding on the applicable laws, ordinance, regulations, directions issued during the Review Period, policies and manuals applicable for the Regulation and Supervision functions.

3.1.6. Meetings with legal and compliance department to gather an understanding on applicable laws, regulations, ordinance, directions and other legal documents pertaining to the Regulation and Supervision functions.

3.1.7. Conducted meetings with Criminal Investigation Department (“CID”) and team assisting PCOI to understand the investigation and legal proceedings pertaining to the Regulation and Supervision functions.

3.1.8. Provided fortnightly / regular updates to the Forensic Audit Monitoring Committee (“FAMC”) regarding the scope of work, procedures performed and challenged faced during performing Investigation / Forensic Audit. (Refer Exhibit 6) 17.

3.2. MAPPING THE DEPARTMENTAL PROCEDURES WITH APPLICABLE LEGISLATIONS

3.2.1. Attained an understanding of the applicable laws,Copy regulations, policies, circulars, guidelines, manuals and other relevant documents relating to regulatory and supervisory function of the Primary Dealers for the Review Period 1 January 2009 to 31 December 2017. (Refer Annexure 1 and Exhibit 7)18;

3.2.2. Prepared compliance checklist and mapped with department procedures and practices followed for Regulatory and Supervisory functions to ascertain whether proper procedures and adequate safeguards have been adopted by the department to ensure effective Regulation and Supervision of Primary Dealers. Parliament

17 Refer Exhibit 6 for Summary of discussions with the FAMC for status updates 18 Refer Annexure 1 for the list of applicable laws, regulations, manuals and Exhibit 7 for email communication with the Department for providing list of applicable laws and guidelines.

Strictly Private and Confidential Page 22 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

3.3. THE CBSL INTERNAL REPORTS

3.3.1. The CBSL provided copies of 26 internal reports during the Review Period on the operations of supervision division. Provided below is the list of internal reports reviewed:

A. The Presidential Commission of Inquiry Report (“PCOI”) on 30 December 2017 to Investigate and Inquire into and report on the issuance of Treasury Bonds during the period 1 February 2015 to 31 March 2016; B. The Special Audit Report updated in accordance with the information discovered up to 23 September 2016 by the Committee of Public Enterprises(“COPE”) and Auditor General since the release on 29 June 2016 of the special audit Report on the treasury bonds issued by the PDD of the CBSL during the period from February 2015 to May 2016; C. Report forwarded to The Ministry of Finance (“MOF”) in terms of Section 43 (2) of the MLA no. 58 of 1949 (2008 to 2016); D. Auditor General Report on audits of financial statement for the period 2011 to 2017; and E. Internal audit reports on supervision function for the period 2010, 2011, 2012, 2013, 2014, 2016 and 2017. Copy 3.3.2. Gathered information from the above investigations and expert reports to identify any discrepancies, irregularities and misconduct relating to regulatory and supervisory function.

3.4. REVIEW OF DEPARTMENTAL PROCEDURE

3.4.1. Meetings were conducted with the Division Head and department personnel of the PDD, the DSNBFI and BSD to understand the procedure for retaining the documents relating to application / appointment, suspension of Primary Dealers, policy formulation, assessment of fitness and propriety of directors, conducting examination – on-site, off-site and spot examinations, Parliamentcommunication to Primary Dealers and recommendations by the Monetary Board for the concerns identified during the examinations.

3.4.2. The CBSL provided following documents relating to the Regulation and Supervision of Primary Dealers during the Review Period:

A. Application and Appointment of Primary Dealers

3.4.3. Attained an understanding of the applicable acts, regulations and directions based on which the appointment of the Primary Dealers was made. Review of files provided by the department to consider the suitability of the respective Primary Dealer. Review of Board paper submitted with the detailed analysis of the applicant, with the recommendation of the department.

Strictly Private and Confidential Page 23 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

3.4.4. Review of in-principle approval granted by the Monetary Board with respective timeline to fulfill the pending requirements by the Primary Dealer.

3.4.5. Review of the below mentioned conditions stated in Local Treasury Bills (Primary Dealers) Regulations No. 01 of 2009 and Registered Stock and Securities (Primary Dealers) Regulations No. 01 of 2009, which are applicable to licensed commercial banks for appointment as Primary Dealers:

1. The licensed commercial bank shall maintain separate books of accounts in respect of activities relating to Primary Dealers (Government Securities); 2. The bank shall not have on its Board of Directors, a director or an employee of another Primary Dealer; 3. The Primary Dealer (Government Securities) operations of a licensed commercial bank shall be headed by a qualified and competent person holding a senior management position in such bank who shall devote his time to such Primary Dealer operations; 4. The bank shall be subject to operating guidelines and prudential requirements imposed by the Central Bank, from time to time, in respect of Primary Dealer activities and operations; 5. The Primary Dealer (Government Securities) activitiesCopy and operations of a licensed commercial bank shall be monitored and supervised by the CBSL.

3.4.6. Review of the below mentioned conditions stated in Local Treasury Bills (Primary Dealers) Regulations No. 01 of 2009 and Registered Stock and Securities (Primary Dealers) Regulations No. 01 of 2009, which are applicable to licensed commercial banks for appointment as Primary Dealers:

1. The Articles of Association of the Company shall limit its objects to carrying on the activities set out in Schedule III and to activities ancillary to, or about such activities; 2. The company shall maintain a minimum capital as may be determined by the Monetary Board, from time to time, of which the Tier II capital shall not exceed fifty per centum of the TierParliament I capital; 3. The company shall not have on its Board of Directors, a director or an employee of another Primary Dealer or except for the Chief Executive Officer an employee of the Company; 4. The company shall not have on its Board of Directors any person who is subject to any disqualification applicable to directors of a licensed commercial bank in terms of the Banking Act, No. 30 of 1988 provided, however, an employee or a director of a licensed commercial bank and where such bank is not a Primary Dealer, shall not be disqualified to be a director of a Primary Dealer Company; 5. The company shall not register, without prior written approval of the Monetary Board, any shareholding of a person if such shareholding results in a change in the controlling interest in the Primary Dealer; and

Strictly Private and Confidential Page 24 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

6. The company shall not without the prior written approval of the Monetary Board register any shareholding of more than Ten per centum of the issued capital of the company of a person if such person is the holding company or a subsidiary of any other Primary Dealer.

B. Details and copies of orders of suspension of Primary Dealers

3.4.7. Review of files relating to suspension of Primary Dealers where a Primary Dealer has failed to comply with any law, regulation, direction, guideline or code of conduct applicable to it or acts in a manner detrimental to the interest of the Primary Dealer system or to the national economy.

3.4.8. Review of files to verify the fact that the Primary Dealer whose appointment has been suspended or cancelled does not have any dealings with the Central Bank as counterparty in the primary and secondary markets in Securities and no transactions of any new business with customers were done.

C. Assessment of fitness and propriety of directors

3.4.9. Review of the affidavits and declarations submitted by directors and senior employees were assessed based on the criteria stipulated in the direction.Copy The assessment sheets and the documents sent by the director / senior employees were sent to Legal and Compliance Department for legal clearance. Upon receiving the legal clearance, the approval was granted to the relevant officer, in writing.

3.4.10. The timeline applicable for the submission of documents is as follows:

A. With respect to existing directors and employees, Primary Dealer companies shall submit affidavits and declarations to the SPD within 30 days of the direction; B. In respect of every continuing director/s, the Chief Executive Officer of the Primary Dealer Company shall submit affidavits and declarations to the SPD annually thirty days prior to theParliament AGM of the respective Primary Dealer Company if such directors are nominated for re-appointment; C. In respect of every continuing Chief Executive Officer of a Primary Dealer Company, the Chairman of the Board of Directors of the Primary Dealer Company shall submit an affidavit and a declaration to the SPD annually thirty days prior to the commencement of the calendar year; and D. In respect of every continuing officer, the Chief Executive Officer of Primary Dealer Company shall submit affidavits and declarations to the SPD annually thirty days prior to the commencement of the calendar year, if such employees are nominated for continuation in respective positions. D. On-site examination reports with supporting documents

Strictly Private and Confidential Page 25 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

3.4.11. Review of books, accounts, registers, files and other records kept in relation to its activities as a Primary Dealer. Review of files relating to onsite examinations which are carried out to verify the accuracy of records submitted by Primary Dealer and to assess the financial viability of the Primary Dealer.

E. Off-site surveillance Report with supporting documents

3.4.12. Review of reports relating to offsite surveillance which is carried out to check the financial soundness of a Primary Dealer and includes activities not limited to evaluation of financial position and performance of Primary Dealer. Analysis of the “FInNet” which is a web-based interface introduced in February 2012 and is used by the DSNBFI, wherein documents such as Balance Sheet, Statement of Changes in Equity and Reserves, Profit and Loss Account, Cashflow Statement, Mark to Market Report and Risk Weighted Capital Adequacy Return are uploaded periodically by the Primary Dealers. These reports are then downloaded by the department for its analysis and review. (Refer Exhibit 1 and 2) 19.

F. Spot examination reports with supporting documents

3.4.13. Review of reports relating to spot examinations which are conducted to examine specific aspects on Primary Dealer operations and such requirements may arise due to certain concerns raised in the on-going process of off-site surveillance,Copy customer complaints or complaints from the Primary Dealer industry. Therefore, the scope of this examination is limited and will primarily be based on the specific concern(s) identified.

3.4.14. As per data provided by the CBSL, prepared the examination stock sheet containing the count of examinations for selected Primary Dealers during the Review Period:

Table 4 - Count of examinations – Primary Dealer Wise

# PRIMARY DEALER NAME ON-SITE SPOT SPECIAL 1 Pan Asia Banking Corporation PLC– Primary 3 - 2 Dealer Unit 2 NatwealthParliament Securities Limited 5 2 4 3 WealthTrust Securities Limited 4 1 - 4 Entrust Securities PLC 4 4 9 5 Perpetual Treasuries Limited 2 5 1 TOTAL 18 12 16

19 Refer Exhibit 1 for the PDD Operational Manual – Supervision division 2013 and Exhibit 2 for the PDD Operation Manual- Supervision division May 2015

Strictly Private and Confidential Page 26 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Table 5 - Count of files received – Primary Dealer Wise

# PRIMARY DEALER NAME NO. OF FILES NO. OF BOXES 1 Pan Asia Banking Corporation PLC– Primary 29 1 Dealer Unit 2 Natwealth Securities Limited 39 1 3 WealthTrust Securities Limited 29 1 4 Entrust Securities PLC 114 4 5 Perpetual Treasuries Limited 64 3 TOTAL 275 10

3.4.15. BDO India reviewed the documents provided by the CBSL to identify any discrepancies, irregularities, negligence and misconduct in the following procedures:

A. Assessment of application and appointment of selected Primary Dealers; B. On-site, off-site, spot, special investigation, policy formulation, assessment of fitness and propriety of directors and officer’s Supervision of selected Primary Dealers and findings thereof; C. Recommendations and or any regulatory actions taken by the regulator with respect of such findings; Copy D. Regulatory actions recommended to the Monetary Board by the regulator; E. Regulatory actions approved /not approved by the Monetary Board; and F. Implementation and monitoring of regulatory actions by the regulator.

3.4.16. Discussions were scheduled with the Division Head and the Department personnel on any clarification / understanding required on the procedures followed.

Parliament

Strictly Private and Confidential Page 27 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

3.5. DIGITAL FORENSICS

3.5.1. During the review of documents related to Appointment, Examination and Surveillance of Primary Dealer, deviation and / or anomalies were noted in the process followed and the supporting documents maintained. A total of 21 CBSL employees (hereinafter referred to as “custodians”) were identified who were responsible for taking decisions related to Regulation and Supervision of Primary Dealers. The CBSL issued electronic devices (desktop / laptop computers, iPads and mobile phones, where applicable) to these custodians that could have been used by them and were identified by the DIT based on the “Last Log-In details” appearing in the “Active Directory”20 available. BDO India did not independently verified the completeness and accuracy of the “Last log-in” information as assessed by the DIT. The electronic devices identified (hereinafter referred to as “Target Devices”) by the DIT were physically and handed over to BDO India for performing forensic technology / eDiscovery procedures. (Refer Annexure 22)21.

3.5.2. BDO India relied upon the device identification method (based on “Last Log-In” details as per the “Active Directory”) adopted by the DIT of CBSL, in the absence of IT Asset register, with a detailed record of all electronic devices issued by the CBSL and the changes in the devices issued, if any. It is possible that the identifiedCopy devices weren’t used by the custodians during “Review Period” under the TOR-5, as identification of device was based on “Last Log In” details. This method would identify one (last / latest) machine used by the custodian/s. These machine(s) could be different from the machine(s) used by the custodians during the Review Period.

3.5.3. The Outlook email server backup / spooled copies of the respective custodians at the CBSL email accounts were provided by the DIT for review, to BDO India. We have not independently verified the completeness of the same. In respect of 20 custodians, the DIT confirmed that email backup was not available at the server prior to June 2012 and the email communications prior to this period were not accessible to BDO India for review. (Refer ExhibitParliament 20 and Annexure 2)22.

20 “The main service in Active Directory is Domain Services (AD DS), which stores directory information and handles the interaction of the user with the domain. AD DS verifies access when a user signs into a device or attempts to connect to a server over a network.” (Source: https://searchwindowsserver.techtarget.com/definition/Active-Directory) 21 Refer Annexure 22 for the list of 18 identified employees and their respective Target Devices along with rationale for their identification 22 Refer Exhibit 20 for copy of e-mail confirmation from the DIT for outlook e-mail backup and Annexure 2 for the list of 21 custodians along with rationale for their identification.

Strictly Private and Confidential Page 28 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

3.5.4. The CBSL email platform migrated from IBM Lotus notes to Microsoft Outlook in June 2012. As informed by the DIT, back-up of email communications related to the prior period of June 2012, were not maintained. Accordingly, an email communication of the custodians related to the Review Period prior to June 2012 were not accessible for BDO India for review. (Refer Exhibit 55)23.

3.5.5. The table below is a summary of 25 Target Devices acquired from 20 custodians identified as relevant for review under the TOR-5:

Table 6 - Summary of Target Devices

# PARTICULAR COUNT 1 Total number of custodians 20 2 Total number of Desktop Hard drives (A) 17 3 Total number of Laptop Hard drives (B) 4 4 Total number of I-pad (C) 4

TOTAL NUMBER OF TARGET DEVICES (A+B+C) 25

3.5.6. Provided below is a list of electronic devices and availabilityCopy of email backup copies on server identified (by the DIT) that pertains to the respective custodians:

Table 7 - Count of Target Devices and availability of email backup copies on server

# NAME DESKTOP LAPTOP I-PADS SERVER TOTAL EMAILS 1 P Samarasiri 1 2 Not 1 4 available 2 S S Ratnayake 1 Not Not 1 2 available available 3 C M D N K 1 Not Not 1 2 Seneviratne available available 4 T H B Parliament1 Not Not 1 2 Sarathchandra available available 5 U L Muthugala 1 Not Not 1 2 available available 6 N D Y C 1 Not Not 1 2 Weerasinghe available available 7 N W G R D 1 1 1 1 4 Nanayakkara

23 Refer Exhibit 55 for a copy of e-mail communication by the DIT regarding migration of email communication platform.

Strictly Private and Confidential Page 29 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

# NAME DESKTOP LAPTOP I-PADS SERVER TOTAL EMAILS 8 D S Thenuwara 1 Not Not 1 2 available available 9 L T 1 Not Not available 1 2 Amarasinghe available 10 W N S Fernando 1 Not Not 1 2 available available 11 S P Sedara 1 Not Not 1 2 available available 12 A S Fernando 1 Not Not 1 2 available available 13 J P B Ishanthi 1 Not Not 1 2 available available 14 P M C S 1 Not Not 1 2 Gunawardane available available 15 K P K Weerasekara 1 Not Not 1 2 available available 16 Arjuna Mahendran 1 1 2 1 5

17 SJK Guruge - Not CopyNot 1 1 available available 18 M Z M Aazim 1 Not 1 1 3 available 19 W Ranaweera - - - 1 1 20 U P Alawattage - - - 1 1 TOTAL 17 4 4 20 45

3.5.7. The below mentioned steps were followed while conducting digital forensic on each of the respective Target Device: Table 8: Work stepsParliament of Digital Forensics ### WORK STEP 1 Identification and Acquisition 2 Imaging 3 Returning Target Device 4 Data extraction 5 Recovery and repair of composite email files 6 Indexing of ESI data in Target Devices 7 Keyword search and review

Strictly Private and Confidential Page 30 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

### WORK STEP 8 Keyword24 list preparation 9 Timeline Analysis25 10 Review of i-pad 11 Review methodology (Refer Annexure 23 for tools used to perform Digital Forensics / e-Discovery on target devices)26.

3.6.7 ACQUISITION OF TARGET DEVICES:

The Target Devices of 21 Identified CBSL Employees related to the scope of work under TOR-5 were requested from the CBSL, to perform Digital forensic / e-Discovery procedures explained as following:

A. Target Devices were identified by the DIT based on the “Last Log-In” details as appearing in the Active Directory in absence of IT Asset register and hand-held (mobile) devices.

B. Target devices pertaining to identified custodians, who are the current employees of the CBSL were acquired directly from the respectiveCopy custodians with the help of DIT. Executives of the ITD at CBSL removed the “storage device” from the desktop / laptop of the custodians and physically handed over to BDO India, for processing. Storage media (HDD / SSD) was removed in the presence of the respective custodians and the storage media was handed over by IDT to BDO India. The handheld devices pertaining to the custodians, who are the current employees of CBSL, were identified by the DIT and were handed over to BDO India.

C. Chain of Custody (“COC”) was documented in respect of each Target Device and maintained through-out the examination. COC encompasses the custodian details, Target Device details, time, date & location of handover from the DIT or the respective custodian.Parliament COC (Refer Exhibit 5)27 was prepared for each device of the custodian and related image was marked individually.

24 “a significant word from a title or document used specially as an index to content” (Source: https://www.merriam- webster.com// dictionary/keyword) 25 “a schedule of events and procedures” (Source: https://www.merriam-webster.com/dictionary/timeline) 26 Refer Exhibit 20 for copy of e-mail confirmation from the DIT for outlook e-mail backup and Annexure 2 for the list of custodians along with rationale for their identification. 27 Refer Exhibit 5 for copies of COC forms of Target Devices for respective custodians

Strictly Private and Confidential Page 31 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

D. The DIT or custodian signed-off the COC form after verification of the facts recorded representing the acquisition of the Target Device and the associated activities performed.

E. Handheld devices were given to BDO India by the respective custodians or the DIT in presence of Executives from IT department. These devices were provided by the CBSL for review Password (if any) was provided by the custodian for the screen lock and was mentioned in COC form. Four electronic devices were identified by CBSL Board Secretariat, as were issued to Arjuna Mahendran. During the handover of handheld devices, custodians were asked to unlock the devices with the password in the presence of the CBSL IT executives.

In case access to iCloud for Apple devices, the custodians agreed to administer the password whenever required by BDO India. The password details were not captured in the COC as the custodians rejected to share the same in the COC.

3.6.8 IMAGING OF TARGET DEVICES:

After the Target Devices were physically acquired from the respective custodian or the DIT, forensic Image28 was created in the manner as explainedCopy under: A. Each hard drive or handheld device provided by the custodian or the DIT was marked uniquely in respect to the project. Same details were mentioned in the COC form of the respective identified device.

B. Globally accepted Forensic imaging tools which includes Tableau TX-1, Logicube Falcon, Tableau-T35u write blocker and Access Data Forensic Tool Kit Imager were used to create the forensic image of the Target Devices.

C. During the process of creating forensic image or acquisition of handheld device details such as case ID, evidence ID, examiner name and unique description was fed to the machine. Parliament D. These details also reflect in Additional log file (Refer Exhibit 6)29 that was generated after creation of forensic image in case of hard drives. These log files encompass the imaging details including but not limited to Target Device details, destination details, task date & time, acquisition & verification hash values30 (Md5 & SHA-1), details of forensic image and disk sectors etc.

28 “Forensic image of a device is the bit-by-bit, sector-by-sector direct copy of a physical storage device, including all files, folders and unallocated free and slack space.” (Source: https://whatis.techtarget.com/definition/forensic-image) 29 Refer Exhibit 6 for details of logs generated with forensic image of Target Devices. 30 “A Hash Value (also called as Hashes or Checksum) is a string value (of specific length), which is the result of calculation of a Hashing Algorithm. Hash Values have different uses. One of the main uses of Hash Values is to determine the Integrity of

Strictly Private and Confidential Page 32 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

E. Forensic image created from the respective Target Device was marked as primary evidence or master copy or original evidence. A duplicate copy of the forensic image was created and marked as working copy. Original evidence was stored aside after creating a duplicate copy from it. Further, Digital Forensic / e-Discovery procedures were carried out on the working copy.

F. Handheld devices were acquired using globally accepted mobile acquisition tool Cellebrite UFED. Best possible method recommended in the application for acquisition of the Target Device was adopted.

G. Advanced logical extraction and file system extraction was adopted to acquire target handheld mobile devices. Information such as but not limited to evidence ID, case ID, custodian details, device details, acquisition details, tool details and task date & time were updated in the COC form.

3.6.9 RETURNING OF TARGET DEVICES:

A. After completion of forensic imaging procedure / e-Discovery or acquisition of Target Device and handheld devices respectively were returned to the DIT or the respective custodian in the presence of the IT Executives ofCopy CBSL, as the case may be. B. At the time of returning the Target Device, COC was updated with the required information including but not limited to date of return, time & location, returned by and recipient name.

C. Physical condition of the device was also verified by the DIT or the respective custodian at the time of handing over of Target Device from BDO India to the DIT or respective custodian. After verification of physical condition of the Target Device and verification of information on COC, the DIT or respective custodian sign-off the COC.

Parliament

any Data (which can be a file, folder, email, attachments, downloads etc.”. (Source: http://www.omnisecu.com/tcpip/what-are-hash-values-important-hash-value-algorithms.php).

Strictly Private and Confidential Page 33 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

3.6.10 EXTRACTION OF ELECTRONICALLY STORED INFORMATION:

A. Duplicate or working copy was created from the original image which was directly created from the Target Device. This duplicate forensic image was administered on the forensic platform to carry out e-discovery procedures.

B. ESI31 contained therein the target Device was extracted using standard OEM provided “Encase Enscript” which is based on 4632 extensions using Guidance Encase tool.

C. Target Device system information such as Operating System Information (Refer Annexure 2)33, User account information (Refer Annexure 3)34, and basic information and volume details about the image (Refer Annexure 4)35 was extracted from the forensic image of the Target Devices to gather information about the system.

D. In case of handheld device, ESI such as device information, messages and chats, calendar notes, voice call log were extracted using mobile forensic tool.

E. The extracted ESI was verified to confirm that the extraction is comprehensive. As per SECTION 3 OF EVIDENCE ORIDNANCE ACT, No. 14 of 1895 “Evidence means and includes –

(a) All statements which the court permits or Copy requires to be made before it by witnesses in relation to matters of fact under inquiry, such statements are called oral evidence;

All documents produced for the inspection of the court; such documents are called documentary evidence” As per SECTION 38 OF COMPUTER CRIME ACT, NO. 24 OF 2007, the term “document includes an electronic record” and “electronic record means, information, record or data generated, stored, received or sent in an electronic form or microfilm, or by any other similar means”.

As per SECTION 3 OF ELECTRONIC TRASANCTION ACT, NO. 19 OF 2006 “No data message, electronicParliament document, electronic record or other information shall be denied legal recognition, effect, validity or enforceability on the ground that it is in electronic form.”

31 “Electronically stored information can be defined as any type of information that is created, used and stored in digital form, and requires a computer or other device for access”. (Source: https://www.legalmatch.com/law- library/article/electronically-stored-information-esi-laws.html) 32 Extensions used for extraction- doc, docx, docm, dot, dotx, wrd, wpt, wpd, dotm, rtf, pst, ost, dbx, eml, emlx, vcf, msg, otm, oft, ics,msf,nsf,mbox,mbx, bmp, pdf , txt , jpg, jpeg, png, tiff, tif, gif, csv, xlsm, xlsx, xls, xltm, xl, xlsb, xltx, xlb, xlc, xlt, xlk, and xlw. 33 Refer Annexure 2 for details of Operating system artefacts of reviewed Target Devices. 34 Refer Annexure 3 for details of User Accounts of reviewed Target Devices. 35 Refer Annexure 4 for Basic information and volume of data details of reviewed Target Devices.

Strictly Private and Confidential Page 34 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

F. Based on the marked status of presence and user activity on the drive ESI comprised of the four categories of data, which are as under:

1. ACTIVE DATA: Active data can be defined as ESI stored on the storage device of computer systems, which can be directly accessed, readily visible to operating system and / application software that was used to create it and is directly available to users without un-deletion, alteration, or restoration. It was identified by “Description” property in “Encase” forensic tool.

2. DELETED DATA: Deleted data comprises of files that are no longer readily accessible to the user, due to the deletion activity requested by the user. When a file is deleted by user, operating system only marks them as deleted, but they are physically present on the hard drive. Deleted data will stay on the drive for as long as it is not overwritten by the other data.

The overwritten files are the sub-set of deleted files which are overwritten by other files on its physical location on the hard drive. Deleted and Overwritten files are identified by the “Description” property in “Encase” forensic tool.

3. CARVED DATA: File carving is the process used to extract data from a disk drive or other storage devices without the assistanceCopy of the file system that originally created the file. Data extracted through this process is called Carved data and it depends on the fragments.

On forensic image of the Target Device’s carving was attempted on “all at sector boundaries” by “X-ways” Forensic tool based on the “recovery by type” option. The extracted results may contain duplicates as well due to false positive hits or repetitive attempt to carve the data. The availability / accessibility of the carved files depends on the size of the original file deleted and respective file built up from the unallocated spaces by file carving method. “RecoverParliament my Email” forensic tool was used to recover deleted message (if any) and repairing (if required) of composite email files (.ost or .pst) to the extent possible.

4. INTERNET ARTEFACTS: Internet artefacts relating to browsing activity, internet banking, emails and chats and Internet artefact, extraction was performed by using forensic tool “Magnet Axiom”.

Strictly Private and Confidential Page 35 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

G. The count of files (Refer Annexure 5)36 per extension for the Review Period was determined based on date of creation. Metadata for the ESI was extracted by means of using “Encase Enscript”. Details such as the date of creation of file was identified by “File created” metadata37 property.

H. The count of files per extension for the Review Period was determined based on date of creation of the file. The duplicate files were identified based on the “Is Duplicate” metadata were removed. “Duplicate” metadata for the file was derived from the hash values of the file computed. In case the hash value of the file was not calculated, stated file was taken as original. Count of files per extension for the review period of TOR- 5 was deduced based on the metadata extracted for the files. The metadata was extracted using “Encase Enscript” which was based on extensions. Report generated with the help of “Encase Enscript” encompasses properties of file such as but not limited to file created date, modify date, last accessed date, marked status of presence on the hard drive i.e. active file or deleted file, hash computed of the file. Count of file was calculated by following steps provided below:

1. Files were initially filtered based on the “created date” property to determine the files that were created in the Review PeriodCopy pertaining to TOR-5. 2. Later, duplicates were removed by filtering the column marked as “Duplicate” and selecting “No”. File Duplicate “Yes” or “No” was determined on the basis on hash value computed for the file. If Hash value is not computed for the file, file under stated condition was assumed as Original file (not a duplicate copy of another file).

3. Files then were filtered out on basis on their presence marked on the device i.e. active file or deleted file. Files marked in column “Is deleted” or “Deleted” as “Yes” or “No” were separated and count was taken for active and deleted files. Parliament

37 “a set of data that describes and gives information about other data”. (Source: https:// whatis.techtarget.com/ search/query? q=metadata)

Strictly Private and Confidential Page 36 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

3.6.11 INDEXING OF DATA:

Globally accepted and standard tools were used to perform indexing of the ESI extracted from the forensic image of the Target Device. Indexing of the ESI was performed to bring completed data set of ESI on one single platform and perform keyword searches for each custodian. Indexed Data comprised of active files, deleted files and carved user files extracted from Target Device image, server emails provided by the CBSL and recovered email file. Following is the classification of various indexed files:

Table 9: Classification of indexed files

# TYPE OF FILES TYPE OF DOCUMENTS

1 User Files • Word documents • Excel Files • Notepad Files 2 Email Files • Lotus Notes • Outlook message files such as msg, eml • Composite email files such as nsf, ost and pst files

To perform keyword searches, extracted ESI was distributedCopy in two types of file formats namely “searchable file format” and “non-searchable file format”.

The file formats and process of keyword searching on these file formats are as under:

A. In case of “searchable File format” such as word files, excel files, emails, pdf, keyword searching can be performed by directly searching those identified keywords in respective data set.

B. In case of “non-searchable file format” such as multimedia files, scanned pdf, images, keyword searching cannot be performed and accordingly, manual review was performed.

Parliament

Strictly Private and Confidential Page 37 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Table 11: Summary of ESI extracted using work procedures mentioned above

# CUSTODIAN FORENSIC ACTIVE ESI38 DELETED SERVER TOOL ESI39 EMAILS 1 Arjuna Tableau TX-1 18,326 719 13,374 Mahendran 2 Arjuna Tableau TX-1 18,021 34,830 13,374 Mahendran 3 N W G R D Tableau TX-1 21,740 323,199 35,805 Nanayakkara 4 N W G R D Tableau TX-1 36,209 241,605 35,805 Nanayakkara 5 S S Ratnayake Tableau TX-1 121,151 526,988 59,704

6 C M D N K Logicube 40,956 219,383 33,806 Seneviratne Falcon 7 M Z M Aazim Logicube 24,498 84,195 26,402 Falcon 8 U L Muthugala T35u and FTK 31,698 105,842 16,668 Imager 9 W N S Fernando Tableau TX-1 Copy11,361 39,021 17,149 10 P Samarasiri Tableau TX-1 4,818 314,447 11,518

11 P Samarasiri Tableau TX-1 16,432 28,556 11,518

12 P Samarasiri Tableau TX-1 18,382 26,298 11,518

13 D S Thenuwara Logicube 26,046 215,348 67,254 Falcon 14 L T T35u and FTK 22,161 283,450 7916 Amarasinghe Imager 15 S P Sedara Logicube 293,503 172,244 31,953 ParliamentFalcon 16 A S Fernando T35u and FTK 19,098 297,200 17,721 Imager 17 J P B Ishanthi T35u and FTK 55,515 256,768 7468 Imager 18 P M C S Tableau TX-1 18,905 58,689 12,044 Gunawardane

38 Active ESI comprises of the data which can be directly accessed, readily visible to OS and user 39 Deleted ESI comprises of data not readily available to the user, due to deletion activity

Strictly Private and Confidential Page 38 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

# CUSTODIAN FORENSIC ACTIVE ESI38 DELETED SERVER TOOL ESI39 EMAILS 19 K P K Tableau TX-1 26,413 59,277 16,320 Weerasekara 20 N D Y C Logicube 20,016 56,890 56,253 Weerasinghe Falcon 21 T B H Tableau TX-1 15,569 37,368 23,450 Sarathchandra

3.6.12 KEYWORD SEARCHING AND REVIEW:

A. After the extracted ESI was indexed on the e-discovery platform, the data set was filtered in order to identify relevant document with the help of “keyword40”.

B. Keyword search was performed to filter relevant evidence from the extracted data set of ESI to perform focused review.

C. The final list of keywords applied to the searchable ESI extracted from Target Devices incorporate the following: (Refer Annexure 13)41 1. Case specific keywords such as Treasury Bonds,Copy Perpetual, Arjun etc; 2. Custodian specific keywords such as name of custodian, parts of mail address, mobile number of custodians and email addresses;

3. General Keywords that apply to engagements of this nature such as irregularity, noncompliance, fraud, investments, confidential etc; and

D. In order to conduct the focus and precise review, keywords were created in consultation with the CBSL based on the document review and information available in public domain. As data set contains numerous files, keywords help to filter the relevant data. (Refer Annexure 13)42. E. After the Parliament keywords searching, results were extracted and email communication pertaining to Review Period43 were reviewed in order to collect the evidence, if any

40 “a significant word from a title or document used specially as an index to content”. (Source: https://www.merriam- webster.com// dictionary/keyword) 41 Refer Annexure 13 for count of keywords for each identified employee of the CBSL 42 Refer Annexure 13 for count of keywords for each identified employee of the CBSL 43 Review Period is January 2002 to February 2015

Strictly Private and Confidential Page 39 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

F. ESI provided to review manually and based on keyword searches was examined or reviewed on two levels. First level review of the ESI was done on the complete data set provided after extraction and keyword searching. The reviewer tags or marks important information or file in the categories such as Informative, Relevant, Suspicious, Corroborative etc. Relevant information extracted out from first level review of ESI was again later reviewed as per its relevance to the case. Thereafter, the observations were incorporated in the Report.

G. After the keywords searching, results were extracted and email communication pertaining to Review Period were reviewed in order to collect the evidence, if any

H. For I Pad’s, Report of the device was generated which encompasses details such as device information, message and chats, multimedia files, call records were exported in readable format report and reviewed manually.

3.6. PUBLIC DOMAIN SEARCHES

3.6.1. Prepared a list of employees of the CBSL, who were responsible for Regulation and Supervision functions of Primary Dealers during the Review Period, in which anomalies were noted / identified (hereinafter referred to as “identifiedCopy employees”); 3.6.2. Performed family mapping, to the extent available and gathered details with respect to the business / professional associations of the identified employees as well as family members, if any;

3.6.3. Performed analysis to identify if any business relationship / shareholding / association with the Primary Dealers to the extent available;

3.6.4. Reviewed publicly available information for Primary Dealer and Primary Dealers’ associate;

3.6.5. Reviewed records with the Registrar of Companies44 (“ROC”) to the extent available in the public domainParliament in respect of five selected Primary Dealers to determine the list of individuals associated;

3.6.6. Public domain searches were performed including but not limited social and professional media profiling on the identified employees;

44 “ROC is the authorized government body to permit the companies to be incorporated in Sri Lanka and govern their activities regularly.”

Strictly Private and Confidential Page 40 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

3.6.7. Ascertained association of the identified employees and their family members with Primary Dealer; and

3.6.8. Conducted searches for the key employees of Supervision Division of the PDD and the DSNBFI who resigned during the Review Period and identified their association with Primary Dealer post exit from the CBSL, where available.

Copy

Parliament

Strictly Private and Confidential Page 41 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

4. PROCESS UNDERSTANDING

4.1. BACKGROUND

4.1.1. The appointment of Primary Dealers is governed by the Registered Stock and Securities Ordinance No 7 of 1937 and Local Treasury Bill Ordinance No 8 of 1923. Under the Regulations issued in the relevant Acts, the Regulatory and Supervisory functions of the Primary Dealers were carried out by the Public Debt Department (“PDD”) until May 2016 and thereafter, the functions were transferred to the Department of Supervision of Non- Bank Financial Institutions (the DSNBFI).

4.1.2. Understanding was provided by the department on the following parameters:

A. The list of laws, regulations, directions and manuals applicable for the Supervision of Primary Dealers; B. The procedures adopted for conducting examinations aimed at Supervision of Primary Dealers; and C. The way the recommendations were made with respect to any findings in the Report.

4.1.3. The Supervision division of the CBSL is governed by Copythe Registered Stock and Securities Ordinance (“RSSO”), the Local Treasury Bills Ordinance No. 8 of 1923 (“LTBO”) and the Monetary Law Act (“MLA”).

4.1.4. Process45 for issue of directions by the CBSL is depicted below:

A. The CBSL issues directions, from time to time, to ensure the effective functioning of Primary Dealers. These are issued under the reference of ordinances and regulations; B. Post Parliament’s approval for Law, regulations are made by the CBSL with the reference of Law; and C. Then Ministry of Finance approves the regulation and post that it will be notified in gazette. Parliament

45 Source: Operations Manual of the PDD

Strictly Private and Confidential Page 42 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

4.1.5. The hierarchy46 of the department entrusted with the Regulation and Supervision of the Primary Dealers is depicted below:

Till June 2016, The PDD was responsible for carrying out the Regulation and Supervision functions after which it was transferred to the DSNBFI.

Hierarchy of Reporting in the Central Bank of Sri Lanka (Public Debt Department)

The

Copy

Parliament

46 Source: Operations Manual of the PDD

Strictly Private and Confidential Page 43 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Hierarchy of Reporting in the Central Bank of Sri Lanka (the DSNBFI) 47

Copy

Parliament

47 Source: Draft Operations Manual of Supervision Division

Strictly Private and Confidential Page 44 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

4.2. UNDERSTANDING FOR THE CONDUCT OF REGULATORY FUNCTION

4.2.1. As per LTBO and RSSO, the CBSL has the regulatory and the supervisory powers relating to the Government Securities market. The PDD acting on behalf of the Central Bank has issued directions and several circulars signed by the SPD to the Primary Dealer

4.2.2. The PDD was entrusted with the responsibility of conducting auctions, maintenance of issuance and secondary trading system inclusive of issuance of system rules, Securities registry, debt servicing, Government Securities market development, debt management database and relevant correspondence and reports. the DSNBFI was entrusted to undertake all the regulations and Supervision on prudential, conduct of business (other than system rules), compliance and consumer / investor protection aspects to promote safety and soundness and confidence on institutions and the market. the DSNBFI was authorised to have the access to records, systems and information on Securities issuance and trading system of the PDD in terms of Section 45 of the MLA for regulatory and supervisory purpose. As per the Monetary Board Minutes on 19 February 2016. The Director, SNBFI reviews the current regulatory and supervisory mechanism in consultation with the management of the Primary Dealer and market participant as appropriate and issue revised or new regulations appropriately. (Refer Exhibit 39)48. Copy 4.2.3. As per the understanding gathered from the discussions held with the Supervision division, it was concluded that the DSNBFI carries out four activities as part of regulation function (Refer Exhibit 39)49:

A. Appointment and Suspension of Primary Dealers; B. Assessment of fitness and propriety of directors; C. Policy formulation including issuing instructions via directions; and D. Performing Supervision function of the Primary Dealers via onsite examination, offsite surveillance, spot examination and special investigations. Parliament

48 Refer Exhibit 39 for Appointment and Suspension of Primary Dealers – LTBO and RSSO 49 Refer Exhibit 39 for Appointment and Suspension of Primary Dealers – LTBO and RSSO

Strictly Private and Confidential Page 45 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

A. Appointment of Primary Dealers

4.2.4. The appointment of Primary Dealers is done as per Regulation on 24 June 2009 of the RSSO (Chapter 420) under Section 2, 3, 4 and 5. The applicant should furnish information and documents that the CBSL deems necessary for considering the suitability of the applicant. A Board Paper is submitted after acquiring a complete set of information, with detailed analysis of the applicant, with relevant recommendation of the department. Standardization of market regulations, the PDD of the CBSL continued to review the existing laws and regulations and introduced system reforms to improve the Government Securities market. The regulatory function objective is to reduce the information asymmetry, increasing the core capital requirements, enhancing secondary market liquidity, improving safety of investors and increasing the overall efficiency of the Primary Dealer industry. (Refer Exhibit 39)50.

B. Suspension of Primary Dealers

4.2.5. The appointment of Primary Dealers is done as per Regulation of 24 June 2009 of the RSSO (Chapter 420) under Section 9. The suspension of the Primary Dealers is made as per Regulation on 24 June 2009. The CBSL may suspend a Primary Dealer if it has failed to comply with any law, regulation, direction, guideline Copyor the code of conduct applicable to it or acts in a manner detrimental to the interest of the Primary Dealer system or to the national economy for a period which shall not exceed six months or may cancel the appointment of a Primary Dealer. (Refer Exhibit 39)51.

4.2.6. A Primary Dealer whose appointment is suspended or cancelled shall not have the right to deal with the CBSL as counterparty in the primary and secondary markets in Securities and shall not transact new business with customers and shall not be entitled to utilize the facilities provided by the CBSL to Primary Dealers except to the extent permitted by the CBSL for the discharge of such Primary Dealer’s obligations and duties to the CBSL, other Primary Dealers, customers and others in accordance with directions issued by the Monetary Board. Parliament

50 Refer Exhibit 39 for Appointment and Suspension of Primary Dealers – LTBO and RSSO 51 Refer Exhibit 39 for Appointment and Suspension of Primary Dealers – LTBO and RSSO

Strictly Private and Confidential Page 46 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

C. Assessment of fitness and propriety of directors

4.2.7. As per Direction of 28 May 2013 for assessment of fitness and propriety of directors, the Board approved on the issuance of the Direction by the SPD under Regulation 11 of the Local Treasury Bills (Primary Dealers) Regulation No. 01 of 2009 and the Registered Stock and Securities (Primary Dealers) Regulation No. 01 of 2009 for assessing fitness and propriety of the Directors and employees performing executive functions of Primary Dealer companies (Refer Exhibit 41)52;

4.2.8. With respect to existing directors and employees, Primary Dealer companies shall submit affidavits and declarations to the SPD within 30 days of this direction;

4.2.9. In respect of every continuing director / s, the Chief Executive Officer of the Primary Dealer Company shall submit affidavits and declarations to the SPD annually thirty days prior to the Annual General Meeting of the respective Primary Dealer; and

4.2.10. In respect of every continuing Chief Executive Officer of a Primary Dealer, the Chairman of the BOD of the Primary Dealer shall submit an affidavit and a declaration to the SPD annually thirty days prior to the commencement of the calendar year. D. Policy Formulation Copy 4.2.11. As per the Operations Manual, the laid down departmental procedures for policy formulation, state that the department employees need to engage in search of latest market developments, especially with reference to the regulatory and institutional framework. Constant updates on developments in the international markets are required. Review of areas like broadening business lines for Primary Dealer activities, present tax structure and its applicability and the prevailing reporting formats submitted by Primary Dealers etc., to cope with the secondary market developments. It is the task of the Supervision department to suggest appropriate policies to make available an efficient Government security market with a stable institutional framework.

Parliament

52 Refer Exhibit 41 for direction on assessment of fitness and propriety of directors and officers performing executive functions of Primary Dealer companies

Strictly Private and Confidential Page 47 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

4.3. UNDERSTANDING FOR CONDUCT OF EXAMINATION - ON-SITE

4.3.1. On-site examinations are carried out to verify the accuracy of records submitted by Primary Dealer and to assess the financial viability of the Primary Dealer. These are also conducted to investigate certain aspects of Primary Dealer operations such as Custodial arrangements, repurchase and reverse repurchase transactions. These examinations are conducted by Supervision personnel by visiting Primary Dealer premises.

4.3.2. The examination procedures performed by the department aims to verify risk assessment of the Primary Dealers, adequacy of capital, liquidity, asset quality, profitability etc. and the adherence to prudential directions, guidelines and good governance practices.

4.3.3. The aforesaid examination is divided into four phases:

Phase I: This phase is preliminary stage wherein the examination team headed by an examiner-in-charge establishes its objectives, defines a preliminary risk profile of Primary Dealer, determines the scope of the examination and defines the areas to be focussed based on analytical data gathered during off-site surveillance. It includes defining the examination objectives, reviewing the existing the PDD documentation, advising the Primary Dealer of the proposed examination, requestingCopy the Primary Dealer for baseline documentation, conducting initial risk assessment, drawing up preliminary risk profiles, determining examination scope, preparing examination work plan and assigning specific tasks to examination team.

Phase II: This phase involves conducting the following activities:

A. Visits the premises of Primary Dealer and reviewing the questionnaires that contain the basic questions to be addressed for each functional area and are intended to guide the examination team. B. Verification of the material contained in each set of work papers which must be well organised, indexed, legible and understandable to other members of the Supervision division andParliament the PDD. Each set of work paper should be dated and signed by the examination officer responsible for their preparation. C. Conducting meeting with the CEO and the executive management team for advising on the status of the work, requesting assistance, arranging for specific meetings at the premises of Primary Dealers or at the CBSL and advising on the problems in securing the cooperation of the Primary Dealer personnel.

Phase III: This phase covers preparation and completion of the letter of findings and the examination Report. Preparation and completion of the LOF and the Report is the responsibility of the EIC.

Strictly Private and Confidential Page 48 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Phase IV: This phase, where the examination Report is submitted to the Monetary Board with a time bound action plan for obtaining approval for issuing the rectification plan on the findings raised by the department and then rectification plan is informed to the Board of Directors and the executive management team of Primary Dealers to take immediate action to rectify the supervisory concerns. Quarterly Report is required to be submitted to the Monetary Board on the status of the rectification plan.

4.3.4. The Primary Dealer Supervision Unit plans on-site examination annually. The annual plan is prepared by the head of division and the same is approved by the director. Standard scope of work for on-site examination is approved by the Head of department.

4.4. UNDERSTANDING THE CONDUCT OF EXAMINATION - OFF-SITE SURVELLANCE

4.4.1. Off-site surveillance is carried out to check the Primary Dealers financial soundness and includes activities not limited to evaluation of financial position and performance of Primary Dealer.

4.4.2. “FInNet” is the web-based interface introduced in February 2012 is used by the DSNBFI, wherein documents such as Balance Sheet, StatementCopy of Changes in Equity and Reserves, Profit and Loss Account, Cashflow Statement, Mark to Market Report and Risk Weighted Capital Adequacy Return are uploaded periodically by the Primary Dealers. These reports are then downloaded by the department for its analysis and review. (Refer Exhibit 1 and Exhibit 2)53.

4.4.3. Reports submitted by Primary Dealers are reviewed to check if there is any financial gap or there is a possibility of identification of any potential issues in the working of the Primary Dealers. Off-Site surveillance is like an early warning signal for the Supervision department. In case of any major deviations noted in the working of any of the Primary Dealers, then Spot Examination is carried out for detailed review of such deviations.

4.4.4. On quarterly basis,Parliament a Board Paper detailing the performance of Primary Dealer industry is prepared and submitted to the Monetary Board for information. Any special concerns on the Primary Dealer are highlighted in the Board Paper to seek the approval from the Monetary Board for the remedial action along with the timeline proposed by the department. (Refer Exhibit 1 and Exhibit 2)54.

53 Refer Exhibit 1 for the PDD Operational Manual – Supervision division 2013 and Exhibit 2 for the PDD Operation Manual- Supervision division May 2015 54 Refer Exhibit 2 for the PDD Operation Manual- Supervision division May 2015

Strictly Private and Confidential Page 49 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

4.5. UNDERSTANDING THE CONDUCT OF EXAMINATION – SPOT EXAMINATION AND SPECIAL INVESTIGATION

4.5.1. Spot examinations and Special investigations are conducted to examine specific aspects on Primary Dealer operations and such requirements may arise due to certain concerns raised in the on-going process of on-site examinations, off-site surveillance, complaints and other notified issues. Therefore, the scope of this examination is limited and will primarily be based on the specific concern(s) under observation.

Copy

Parliament

Strictly Private and Confidential Page 50 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

5. EXECUTIVE SUMMARY

The findings in this Report are based on the work performed on the information received till 15 October 2019 on examination on conduct of regulatory and supervisory role by the Superintendent of Public Debt / Director, Supervision of Non-Bank Financial Institutions pertaining to selected Primary Dealer for the Review Period from 1 January 2009 to 31 December 2017. Refer to the Section “Coverage of the Forensic Audit Report” for the procedures performed.

5.1. SUMMARY OF KEY FINDINGS

5.1.1. RSSO, LTBO and Operation Manual have not defined the roles and responsibilities of the Regulatory function and the activities to be covered for the regulation & supervision of operations of the Primary Dealers. The activities carried out by the PDD and SNBFI does not include the coverage and monitoring of the key Regulations including market manipulation, market development, investor education, customer redressal mechanism and investor protection. The Regulatory function and activities of the PDD and the SNBFI were confined to appointment supervision and suspension of the of PrimaryCopy Dealers and policy formulation for supervision function. Review of operations of the regulation function indicate that the department has not leveraged on the technological advancements that enable effectiveness of the function.

[Refer Section 6 for the recommendation and Sections 7 for detailed findings and the CBSL officer and Third party, if any, responsible for the deviations noted.]

5.1.2. Gaps were noted in the assessment of requirement for appointment of new Primary Dealers wherein the Supervision department’s views against the appointment of Perpetual Treasuries Limited as a new Primary Dealer, were not presented to the Monetary Board. Appointment of Perpetual Treasuries Limited (“PTL”) was recommended in the Board Paper of 9 May 2013.Parliament The assessment criteria do not include assessment to identify the creditability, experience of holding company / directors and capacity for Investment by the Primary Dealers.

[Refer Section 6 for the recommendation and Refer Sections 7 for detailed findings; the CBSL officer and Third party, if any, responsible for the deviations noted.]

Strictly Private and Confidential Page 51 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

5.1.3. The Regulation & Supervision functions are performed by the same department and same staff, however the missing initiatives on the Regulatory front despite the knowledge of findings from supervisory examinations indicate non-alignment of Regulation and Supervision function roles & objectives. The Supervision function methodology does not define linkage between examination and objective of Regulation and Supervision function for ensuring effectiveness of the PD system that infuses greater competition, liquidity in the Government Security market and reduction of borrowing cost of the Government of Sri Lanka by way of regulating and supervising the Primary Dealers. The Supervision function did not perform benchmarking of its operations, processes and procedures with the functions of regulators in other / homogeneous economies and jurisdictions.

[Refer Section 6 for the recommendation and Refer Section 7 for detailed findings; the CBSL officer and Third party responsible, if any, responsible for the deviations noted.]

5.1.4. The risk-based approach defined for Supervision requires assessment of risks of Primary Dealer such as Liquidity Risk, Market Risk, Legal / Reputational Risk Management and Strategic Risk, which are the risks associated with the operations of Primary Dealer enterprise, for its own business continuity. The Supervision functions’ risk-focused approach does not identify risks comprehensively such Copythat the risks a Primary Dealer brings on to the Government Securities market, such as the risks of market manipulation, money laundering, corruption and insider trading that impacts investor confidence and financial system stability.

[Refer Section 6 for the recommendation and Sections 7 for detailed findings; the CBSL officer and Third party responsible, if any, for the deviations noted.]

5.1.5. There is no risk management framework set-out consisting of risk assessment methodology, risk management protocols including Primary Dealer risk assessment / risk rating based on examination findings and measures and mechanisms for risk prevention and detection. There is no process for ongoing risk review and examination of quality enhancement through independentParliament reviews of the Supervision activities.

[Refer Section 6 for the recommendation and Sections 7 for detailed findings; the CBSL officer and Third party responsible, if any, for the deviations noted.]

Strictly Private and Confidential Page 52 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

5.1.6. The Operational Manual of Supervision function did not define the mechanism to ensure comprehensive coverage of assessment of compliance with all applicable legislations, during the examinations. The Questionnaires used by the examiners were not reviewed or kept up-to-date and compliance requirements of legislations such as Financial Transaction Reporting Act, The Convention on the Suppression of Terrorist Financing Act and Prevention of Money Laundering Act were not included in the assessment criteria.

[Refer Section 6 for the recommendation and Sections 7 for detailed findings; the CBSL officer and Third party, if any, responsible for the deviations noted.]

5.1.7. Review of on-site examinations indicated delays in timely completion of examinations, conclusion of examination reviews and submission of “Letter of Findings” to Primary Dealers and gaps in reporting to the Monetary Board. There are certain non-compliances or deviations which were noted consistent across the PDs, indicating the potential systemic deficiencies in terms of procedures towards regulation / policy / operational guidelines.

5.1.8. Certain deviations / non-compliances at the Primary Dealers t were repeated at the PDs level, which indicated deficiencies in the identification of root cause for non-compliance and missing effectiveness in the monitoring of “Time Bound Action Plan”.

5.1.9. A review of examination files indicated gaps in the comprehensiveCopy assessment of findings to identify the root cause for rectification, wherein the examiner’s recommended remedial actions were not directed towards the findings identified. Importantly, there were no penalties levied / applied for repeated deviations and the consistency of non- compliance across PDs and repeated violations were not highlighted to the Monetary Board for regulatory action. Further, certain key documents evidencing the assessments performed by the examiner and the information / explanations sought and reviewed during the examination were not documented.

[Refer Section 6 for the recommendation and Sections 7 for detailed findings; the CBSL officer and ThirdParliament party, where available, responsible for the deviations noted.] 5.1.10. Review of operations of the Supervision function indicating that the operations are handled through manual process and does not leverage on the technological advancements that enable effectiveness of the function, both at the operations and monitoring levels. While the FInNet system is used for performing off-site surveillance, the tool (external vendor tool) was more used a repository of summarized information and does not have the capability to perform analytics on the data collected. The data collected is not independently verified for validity with source of data and the results of manual review / analysis are not recorded and documented in a repository.

Strictly Private and Confidential Page 53 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

5.1.11. There was no documentation tool for the department wherein details of all examinations conducted and deviations noted historically are stored and used for the future analysis and regulation framing. The extent of usage of technology was significantly limited wherein, there was no opportunity for predictive analytics for futuristic monitoring or early warning mechanism for timely review and actions.

[Refer Section 6 for the recommendation and Sections 7 for detailed findings; the CBSL officer and Third party, if any, responsible for the deviations noted.]

5.1.12. The Supervision function is understaffed throughout the Review Period with 4 - 6 examiners handling the entire Regulation and Supervision functions’ activities including on-site, off-site, spot, special examinations, fitness reviews, appointment and suspension of Primary Dealers and policy formulation. The examiners are not technically qualified to performs audits or examinations and there were no focused trainings for the employees to enhance their subject matter capability and effectiveness of the reviews conducted.

[Refer Section 6 for the recommendation and Sections 7 for detailed findings; the CBSL officer and Third party responsible for the deviation noted.]

5.1.13. Review of the process for reporting to the Monetary Board revealed that the reporting process is driven by the division and not driven byCopy the Monetary Board. Instances of examinations not conducted as per the approved annual plan, examinations not conducted at the defined (annual) frequency, significant delays in completion of examinations, delays in reporting of findings or non-submission of examination reports by the division to the Monetary Board were not identified as part of the reporting process.

[Refer Section 6 for the recommendation and Sections 7 for detailed findings; the CBSL officer and Third party, if any, responsible for the deviations noted.]

This Executive Summary is intended to provide a high-level overview of key findings on this investigation. For a completeParliament understanding of the issues, work performed and detailed findings, this Report should be read in its entirety and in conjunction with the detailed Report including Annexure and Exhibits. This Executive Summary must be read in conjunction with detailed Report and it cannot be treated as a substitute thereof.

Strictly Private and Confidential Page 54 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

6. RECOMMENDATION

6.1.1. The Recommendations in this Section are based on the findings of our review of the onsite examinations and offsite surveillance conducted by the Supervisory division with respect to the select Primary Dealers. (Refer Section 7 – Detailed Observation).

A. The recommendations are currently, directional in nature and it is suggested that a study may be conducted for achieving the objectives. The implementation of recommendations also requires the department to align the strategy with inter- department and intra department level and this should be in line with long term and medium-term goals / objective.

B. The recommendations are categorized under two parameters based on the observations with suggestive approach for mitigation:

i. Critical initiatives: Recommendations relating to regulatory changes, systemic enhancements in operations of the Supervisory function and recommendations to strengthen the compliance of Primary Dealers are classified as critical; and ii. Essential measures: Recommendations on improvementCopy in operations of the Supervisory function such as examination coverage and capability enhancement

C. The suggestive timelines for implementation of the recommendations are as follows:

I. Short team: 0 – 6 months; II. Medium term: 6 – 18 months; and III. Long term: over 18 months.

CRITICAL INITIATIVES 6.1.2. A comprehensiveParliament study should be conducted to develop & define the Regulatory & Supervisory framework in line with the best practices and implementation. Such study should cover the following activities:

A. Benchmarking of Supervisory function with functions in other similar economies;

B. Comprehensive Risk assessment and supervision methods commensurate with the risk assessment;

C. Continuous monitoring mechanism to be developed commensurately in line with Global best practices;

D. Mechanism for tracking the need for new legislation or changes to existing legislations; and

E. Defining the Governance Function.

Strictly Private and Confidential Page 55 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

6.1.3. Conduct an assessment of need for additional regulations to be promulgated under the current RSSO legislation to empower the Regulator including initiating additional disciplinary actions and imposing penalties or specific restrictive actions to enforce compliance. An indicative list of restrictive actions is as following:

A. Imposing restrictions on the Primary Dealers from trading in Secondary Market;

B. Refrain Primary Dealers from bidding in Primary Auction for stipulated time period;

C. Restrict Primary Dealer to open new investor accounts;

D. Restrict trade limit on the related parties of the Primary Dealers;

E. Restrict primary dealer to trade with investors where certain anomalies have been observed; viz. high repo / reverse repo transactions, under allocation / non-allocation of Securities, rollover of investments without instructions, preferential rate to customer etc; and

F. Continuous monitoring of Primary Dealer operations for a defined period.

6.1.4. Conduct a detailed study of man-power requirement and capability enhancement measures for Supervision function. Copy ESSENTIAL MEASURES

6.1.5. Operations Manual for Regulation function should be developed covering the processes to be adopted for continuous oversight of market conditions and the requirement for promulgation of Regulations on an ongoing basis;

6.1.6. Following changes to the Operations Manual, to be taken up in the medium term:

A. Onsite examinations to cover additional risk areas such as market manipulation, money laundering and corruption by Primary Dealers; B. GuidelinesParliament on sampling methodology for verification of transactions; C. Identification of root cause as a process, during the supervision examination;

D. Action plan for rectification of all supervisory concerns with defined timelines;

E. Follow-up mechanism for implementation of action plan;

F. Guidelines for collection of evidence for implementation of action plans for supervisory concerns; and

G. Reporting to the Monetary Board on status of examinations;

6.1.7. Assessment of tools and automation opportunities of Supervision activities and on-going monitoring mechanism.

Strictly Private and Confidential Page 56 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7. DETAILED OBSERVATIONS

1. The methodology for assessment of regulation and supervision functions comprised of review of available documents, reports, interviews and discussions with the CBSL employees. The documents were scrutinised and analysed to assess the effectiveness of the conduct of regulatory and supervisory function by the regulator i.e. SPD / the DSNBFI during the Review Period.

2. The CBSL has the Regulatory and Supervisory powers over the licensed commercial banks and standalone Primary Dealers. As the issuer of Government Securities, the CBSL also has the Regulatory and Supervisory power over the Primary Dealers who participate both in primary and secondary markets. As the debt market grows in terms of size and complexity of government debts and the number, types and scope of Primary Dealer expand, a fragmented regulatory system could possess significant regulatory challenges and systematic risks. Establishing a single regulator covering all primary and secondary market will greatly foster government debt market development and pivotal to measure the success in future government debt market.

3. The detailed observations in this Section are based onCopy an understanding of the Regulation and Supervision functions, as detailed in Section 6 of this Report, conducted by the Public Debt Department (“the PDD”) and Department of Supervision of Non-Bank Financial Institution (“the DSNBFI”), through examinations on the following five (5) Primary Dealers during the period 1 January 2009 to 31 December 2017 (the “Review Period”).

a. Perpetual Treasuries Limited (“PTL”); b. Natwealth Securities Limited (“NWSL”); c. Pan Asia Banking Corporation PLC (Primary Dealer Unit) (“PABC”); d. Entrust Securities PLC (“ESL”); and e. WealthTrustParliament Securities Limited (“WTSL”)

Strictly Private and Confidential Page 57 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

4. At the beginning of the Review Period, the regulation and supervision functions of primary dealers was associated with the PDD. Subsequently, the regulation and supervision functions over the primary dealers was transferred to DSNBFI during June 2016. The “operations manual” of Supervision Division of the PDD, updated in 2007 was applicable at the beginning of the Review Period. This manual was subsequently revised during 2013 and 2015, during the Review Period. The Monetary Board paper was submitted by the former Deputy Governor P Samarasiri who was responsible for the PDD including supervision division stating the regulatory and supervisory concern and suggested amendment in the current regulatory and supervisory framework. Post the transfer of supervision function from the PDD to the DSNBFI, DSNBFI continued to adopt the operational manual prescribed by the PDD. (Refer Exhibit 3, Exhibit 11, Exhibit 1 and Exhibit 2)55.

5. As mentioned in para 7.10 of the Report, there was no evidence of review performed by the assistant governor and deputy governor overseeing the department. In the absence of the evidence, the accountability for deviations was determined in this Report based on the guidelines prescribed in the operations manual, understanding of the practices followed by the supervisory function, as confirmed by the CBSL and the employees associated with the examinations, identified based on the documentation provided in support of the examinations. (Refer Section 6 of this Report)31. Copy

6. At the beginning of the Review Period, there were 11 Primary Dealers who were approved by the CBSL under Registered Stock and Securities Ordinance and Local Treasury Bill Ordinance of the five (5) Primary Dealers identified by the CBSL for review, three (3) Primary Dealers were appointed during the Review Period.

Table 12 – Appointment and Suspension Date of Selected Primary Dealers

# PRIMARY DEALER NAME DATE OF DATE OF APPOINTMENT SUSPENSION 1 Pan Asia Banking Corporation-PD Unit 1 Aug 2013 15 Aug 2017 2 NatwealthParliament Securities Limited 1 Dec 2003 31 May 2018 3 WealthTrust Securities Limited 1 Aug 2011 - 4 Entrust Securities PLC 1 Apr 2000 24 Jul 2017 5 Perpetual Treasuries Limited 30 Sep 2013 6 Jul 2017

55 Refer Exhibit 3 for Regulation made by The Ministry of Finance under Section 55 of the RSSO (Chapter 420), Refer Exhibit 11 for the PDD Operational Manual Supervision Division 2007, Refer Exhibit 11 for the PDD Operational Manual Supervision Division 2007 and Exhibit 2 for the PDD Operation Manual- Supervision division May 2015

Strictly Private and Confidential Page 58 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

List of the CBSL employees responsible for regulation and supervision functions of primary dealers during the Review Period January 2007 to December 2017.

Table 13 – List of Deputy Governor, Assistant Governor and Directors / Superintendents

DG IN CHARGE-the DSNBFI AG IN CHARGE-the DSNBFI NAME ID NO. PERIOD NAME ID NO. PERIOD 10.2.2015- 19.4.2016- P Samarasiri 1422 R A A Jayalath 1514 18.8.2017 30.8.2017 21.8.2017- 31.8.2017- C J P Siriwardana 1462 J P R Karunaratne 1532 31.12.2017 31.12.2017

DEPUTY GOVERNOR ASSISTANT GOVERNOR ID NAME ID NO. PERIOD NAME PERIOD NO. 15.10.2008- 15.10.2008- W A Wijewardena 1335 C Premaratna 1373 6.7.2009 26.5.2009 7.7.2009- 27.5.2009- D S Wijesinghe 1346 H N Thenuwara 1401 31.1.2010 20.10.2009 12.2.2010- 11.11.2009- K G D D Dheerasinghe 1368 J P Mampitiya 1399 31.12.2011 14.6.2010 1.1.2012- 15.6.2010- C Premaratna 1373 C J P Siriwardana 1462 16.9.2012 27.9.2011 17.9.2012- Copy 28.9.2011- B D W A Silva 1427 C Premaratna 1373 9.2.2015 31.12.2011 10.2.2015- 1.1.2012- P Samarasiri 1422 K D Ranasinghe 1441 18.8.2017 19.8.2012 21.8.2017- 20.8.2012- C J P Siriwardana 1462 A Kamalasiri 1382 31.12.2017 20.4.2014 21.4.2014- J P Mampitiya 1399 9.2.2015 10.2.2015- S S Ratnayake 2841 21.10.2015

22.10.2015- K D Ranasinghe 1441 11.6.2016 12.6.2016- K M M Siriwardana 1557 4.7.2016 ParliamentDIRECTOR / SUPERINTENDENT NAME ID NO. PERIOD NAME ID NO. PERIOD U P 21.9.2015- 3.12.2007- 1521 C J P Siriwardana 1462 Alawattage 3.9.2017 14.6.2010 W 4.9.2017-To 21.6.2010- 1550 S S Ratnayake 2841 Ranaweera date 31.12.2011 N W G R D 1575 1.1.2012-8.2.2015 Nanayakkara C M D N K 1436 9.2.2015-20.9.2015 Seneviratne 21.9.2015- T H B Sarathchandra 1455 1.10.2017 2.10.2017- D M Rupasinghe 1442 18.12.2017 Dr M Z M Aazim 1676 19.12.2017-To date

Strictly Private and Confidential Page 59 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

SECTION A: REGULATION FUNCTION

1. An overview of the components of the Regulation function applicable for Primary Dealers market dealing in Government Securities, covered as part of the review is provided below. Discussions were held with the department employees and the examination files were to assess the effectiveness of conduct of regulatory role by the Regulator. Coverage of all applicable legislations / directions / manuals during examination for appointment of new Primary Dealers, suspension of Primary Dealers, assessment of fitness and propriety of directors and policy

formulation aspects were evaluated.

Financial Stability – Primary Dealers Market

Copy

2. Defined activities and roles to be carried out by the Regulator for achieving the objective i.e. safe and sound Primary Dealer system, investor protection and stability in financial market of Government Securities: A. Appointment and Licencing - The Regulator needs to ensure that the activities have proper credentials. The license granted by the Regulator governs the set of financial activities that the dealer is permitted to engage. The grant of license includes the acceptance of such conditions asParliament per the direction which the Regulator may deem fit including regulatory oversight, training requirements and to act in accordance with the established standards or code of ethics. Non-compliance with the code of ethics could result in fines, penalties, remedial actions, suspension and criminal charges. B. Policy formulation – The Regulator issues the rules to implement regulations which lay out the guidelines for market participants to comply. C. Oversight and Supervision – This allows regulator to ensure that the rules are being adhered to by the market participants, thus ensuring that any improper behaviour by the market participant can be ceased or modified. The supervisory priorities and point of emphasis are explained by the Regulator by issuing supervisory letters and guidance.

Strictly Private and Confidential Page 60 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

D. Enforcement and Resolution – This allows the Regulator to compel the market participants to modify their behaviour through enforcement of powers, which includes the ability to levy fines, penalties, cease / desist orders, to undertake civil or criminal actions in court and to suspend Primary Dealers. The Regulator also has the power to resolve a failing market participant by taking control of the same and running the Primary Dealer on an ongoing basis i.e. initiating the judicial process. 3. Policy and procedures defining the role of Regulator in achieving the objectives and monitoring the market participants i.e. Primary Dealers in primary and secondary market: A. Prudential risk mitigation – The purpose is to ensure safety and soundness. It focuses on risk management and risk mitigation. B. Disclosure and Reporting – The purpose is to ensure that all the relevant financial information is accurate and available to the public and the regulators to take well informed financial decisions and for the effective monitoring of the same. C. Competition and Price regulation – This allows the regulator to ensure that the market participants do not exercise undue monopoly power, engage in price fixing or take any dominant position to manipulate prices. D. Standard Setting – This allows Regulator to prescribe standards for products, markets and professional conduct. They can set permissible activitiesCopy and behaviour for market participants to achieve policy goals. 4. The objectives of a Regulator to achieve financial stability and developing the market for Government Securities. This objective shall define the effectiveness in conducting the Regulation function. A. Market efficiency and integrity – To ensure that markets operate efficiently and that market participants have confidence in the market’s integrity. Regulators contribute to market integrity by ensuring that activities are transparent, and contracts can be enforced. B. Investor and taxpayer protection – To ensure that consumers or investors do not suffer from fraud, discrimination and manipulation. Further, it can be ensured that losses or failures in financial marketsParliament do not result in pay-outs or liabilities that are ultimately borne by taxpayers. C. Capital Formation and Credit access – To ensure that market participants and consumers can access the credit and the capital to meet their needs such that credit and economic activity can grow at a healthy rate. D. Illicit activity prevention – To ensure that the financial system cannot be used to support criminal and terrorist activity which include policies to prevent money laundering, tax evasion, terrorism financing and the contravention of financial sanctions. E. Financial Stability – Financial regulation is to maintain financial stability through preventive measures that mitigate systematic risk.

Strictly Private and Confidential Page 61 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

5. On review of the documents pertaining to appointment of Primary Dealers, assessment of fitness and propriety of directors, suspension of Primary Dealers, policy formulation conducted by the department, deficiencies were noted indicating inadequate effectiveness in performing the Regulation function. In absence of defined Regulatory framework and monitoring mechanism of certain required Regulatory functions i.e. market efficiencies and interest, competition and price regulation, disclosure and reporting, illicit activity prevention, capital formulation and credit access and consumer / investor protection, the deficiencies indicate lack of effective Regulatory role for ensuring financial stability through preventive and predictive analysis to mitigate any uncertainty and circumstances impacting the economy and market participants. 6. Rectification of gaps noted above in the governance structure and regulation framework will facilitate an efficient and effective regulation of government debt market. A review of existing governance structure and regulation framework in relation to regulatory and supervisory function with benchmarking to international organisation of quality standards and comparable countries should be undertaken to assess the areas of development of Government security market capacity and strengthening the governance of Primary Dealers. Accordingly, the findings of the review are classified as following:Copy A. No defined procedural functions / benchmarking carried out by the department; B. Non-existence of techniques to monitor market integrity and price regulation; C. Absence of review process for updating the Operational Manual; D. No mechanism to analyse the market development by Primary Dealers; E. Appointment of Primary Dealers without fulfilment of necessary requirements; F. Assessment of fitness and propriety of directors; G. Policy Formulation; and H. Abrupt transfer of employees for Regulatory and Supervisory function.

Parliament

Strictly Private and Confidential Page 62 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.1. NO DEFINED PROCEDURAL FUNCTIONS / BENCHMARKING CARRIED OUT BY THE DEPARTMENT

SCOPE COVERAGE

7.1.1. Examining the laws, regulations, policies, circulars, guidelines, manuals etc. applicable to Regulation and Supervision of Primary Dealers and ascertaining if there were any deviations from relevant laws, regulations, policies, circulars, guidelines, etc. in performing the role of Regulation and Supervision of the selected Primary Dealers as part of implementation and monitoring of regulatory actions by the regulator.

7.1.2. As per the RSSO and LTBO, the Central Bank shall have the authority to undertake and carry out the appointment from time to time of Primary Dealers, and the Regulation, Supervision or monitoring of such Primary Dealers with respect to their transactions in Securities and the performance of their duties as Primary Dealers. However, the legislation does not indicate the responsible department / personnel responsible to carry out Regulation and Supervision functions for Primary Dealers.

7.1.3. The Operation Manual of the PDD does not indicate the roles and responsibilities of the regulator to carry out the Regulation function and activitiesCopy to be covered. There is no area of focus been defined to carry out the Regulation function including disclosure and reporting to be conducted and submitted by the Primary Dealers.

7.1.4. The department has not issued any direction for refraining the Primary Dealers to transact in cash. There should be a Regulation for carrying out the transaction only through banking system. The department does not monitor the cash transactions carried out by the Primary Dealers in the Government Securities during the offsite and onsite examinations. Further, based on the discussion with FIU department, it was noted that the Supervision division does not carry out any Supervision on the Primary Dealers relating to the PMLA and CFT under FTRA regulation.

7.1.5. The guidelines forParliament the regulations relate to performing the supervisory function for the Primary Dealers, determining the criteria for appointment of Primary Dealers, evaluating the performance of the Primary Dealers, issuing directions for ensuring compliance by the Primary Dealers and suspension / cancellation of the appointment of the Primary Dealer. There are no provisions determining the need for any prudential law / regulation for governing the functioning of the Primary Dealers in the Government Securities market. (Refer Exhibit 39)56.

56 Source: Refer Exhibit 39 for Appointment and Suspension of Primary Dealers – LTBO and RSSO

Strictly Private and Confidential Page 63 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.1.6. As per the Operation Manual, 2015, the department needs to amend the existing policies or formulate new policies. Constant update on developments in the international market are required and therefore assessment of updates from Bank for International Settlement (BIS), Federal Reserve System (“FED”), Reserve Bank of India (“RBI”) and Bank of England (“BOE”) on periodic basis is required. As per discussion with the W. Ranaweera, Director, SNBFI, it was noted that the department has not conducted benchmarking exercise of its Supervision function and methodologies adopted against the peer group departments such as BSD, Central Bank Operations of comparable economies and with global professional standards. (Refer Exhibit 2)57.

7.1.7. Hence, it can be concluded that the guidelines for the Regulation function are not defined in a comprehensive manner.

7.1.8. During an interview, T H B Sarathchandra, SPD in the PDD, for the period September 2015 to June 2016, stated that there were neither any areas of scope nor any procedures defined for the Regulation function. Further no examination methodology was defined for carrying out the Supervision function. The Department has not performed any benchmarking exercise for Regulation and Supervision functions with any international organisation and other geographic central banks. There was no tracker being maintainedCopy for the policy formulation. He also stated that there were no defined customer resolution procedures and the department has not maintained any tracker for the complaints received from the customer for the Primary Dealers. (Refer Exhibit 29)58.

Parliament

57 Source: Refer Exhibit 2 for the PDD operation manual – supervision division, May 2015 58 Refer Exhibit 29 for Statement of Fact of T B H Sarathchandra

Strictly Private and Confidential Page 64 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.1.9. During an interview, N W G R D Nanayakkara, SPD in the PDD, for the period January 2012 to February 2015, stated that there was absence of Regulatory and Supervisory framework for monitoring of the Primary Dealers. The Regulation and Supervision functions were limited only to Application and Appointment of Primary Dealers, Suspension of Primary Dealers, performing Supervision function through onsite, offsite, spot and special investigations and issuing of directions as a part of policy formulation. Further during that period, the department lacked on the technology advancement and required skilled staff for performing the Regulatory and Supervisory role. However, the efficiency of Supervision of Primary Dealers was enhanced by reducing the onsite examination cycle from two years to one year and submitting the examination reports, along with the Regulatory concerns and proposed corrective actions to the Monetary Board. There were no directions from the Monetary Board as to whether any changes to the extent in Regulatory and Supervisory framework were to be done. (Refer Exhibit 37)59.

7.1.10. The above deficiencies were noted across the Review Period and implies the responsibility of the SPD and Director, the DSNBFI for rectification during their tenure. (Refer Table 13).

7.2. NON-EXISTENCE OF TECHNIQUES TO MONITOR MARKET INTEGRITY AND PRICE REGULATION Copy

SCOPE COVERAGE

7.2.1. Examining the laws, regulations, policies, circulars, guidelines, manuals etc. applicable to Regulation and Supervision of Primary Dealers and ascertaining if there were any deviations from relevant laws, regulations, policies, circulars, guidelines, etc. in performing the role of Regulation and Supervision of the selected Primary Dealers as part of Implementation and monitoring of regulatory actions by the regulator.

7.2.2. As per the RSSO and LTBO, the Central Bank shall have the authority to undertake and carry out the appointment from time to time of Primary Dealers, and the Regulation, Supervision or monitoring ofParliament such Primary Dealers with respect to their transactions in Securities and the performance of their duties as Primary Dealers. However, the legislation does not indicate any defined procedures to be followed to determine the need for any regulation for monitoring the functioning of the Primary Dealers in the Government Security Market.

7.2.3. The department has not implemented any monitoring tool to identify nor monitor any market manipulation practices or strategies for price regulation including any procedures and timelines for customer complaint and resolution.

59 Refer Exhibit 37 for statement of fact of Nanayakkara

Strictly Private and Confidential Page 65 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.2.4. The department does not monitor the aspects to analyse whether the customer and investor protection are being effectively carried out by the Primary Dealers.

7.2.5. During the discussion on 18 September 2019 with W. Ranaweera, Director, the DSNBFI, it was stated that “the department had not implemented any monitoring tool to identify any market manipulation and price regulation including any procedures and timeline for customer complaint and resolution”. (Refer Exhibit 40)60.

7.2.6. During an interview, T H B Sarathchandra, SPD in the PDD, for the period September 2015 to June 2016, stated that “there was no alert / monitoring mechanism for identifying any market manipulation and illicit activities carried out by the Primary Dealers in the Government Securities and absence of any tools and techniques for carrying out the Regulation and Supervision functions. Supervision division only performed activities relating to appointment, suspension, performing examinations – onsite / offsite / spot / special investigation and issuance of directions / circulars”. (Refer Exhibit 29)61.

7.2.7. During an interview, N W G R D Nanayakkara, SPD in the PDD, for the period January 2012 to February 2015, stated that “there was absence of Regulatory and Supervisory framework for monitoring of the Primary Dealers. The Regulation and Supervision functions were limited only to Application and Appointment of PrimaryCopy Dealers, Suspension of Primary Dealers, performing Supervision function through onsite, offsite, spot and special investigations and issuing of directions as a part of policy formulation. Further during that period, the Department lacked on the technology advancement and required skilled staff for performing the Regulatory and Supervisory role. However, the efficiency of Supervision of Primary Dealers was enhanced by reducing the onsite examination cycle from two years to one year and submitting the examination reports, along with the Regulatory concerns and proposed corrective actions to the Monetary Board. There were no directions from the Monetary Board as to whether any changes to the extent in Regulatory and Supervisory framework were to be done”. (Refer Exhibit 37)62.

7.2.8. The above deficienciesParliament were noted across the Review Period and implies the responsibility of the SPD and Director, the DSNBFI for rectification during their tenure. (Refer Table 13).

60 Refer Exhibit 40 for email copy – Discussion with W Ranaweera relating to regulation function – Government Securities 61 Refer Exhibit 29 for Statement of Fact of T B H Sarathchandra 62 Refer Exhibit 37 for statement of fact of Nanayakkara

Strictly Private and Confidential Page 66 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.3. NON UPDATION OF THE OPERATIONS MANUAL

SCOPE COVERAGE

7.3.1. Examining the laws, regulations, policies, circulars, guidelines, manuals etc. applicable to Regulation and Supervision of Primary Dealers and ascertaining if there were any deviations from relevant laws, regulations, policies, circulars, guidelines, etc. in performing the role of Regulation and Supervision of the selected Primary Dealers as part of any other matters which may come to light during the examination which have a bearing or relevance to the matters referred as part of scope.

7.3.2. During the Review Period, there was no process of review of Operational Manual by Monetary Board of CBSL. As per the RSSO, there is no explicit and mandatory requirement for the Monetary Board to approve the departmental operations manuals. Accordingly, the processes followed at PDD and SNBFI with respect to Regulation and Supervision, can at best be considered as “practices” followed the departments. As informed by the Monetary Board, effective 2007, the Assistant Governor overseeing the PDD and the SNBFI review annually, the updates to the operations manual. 7.3.3. It was noted that the last update activity for the PDDCopy operational manual was in 2015. However, there is no evidence of review and sign-off on the updated the PDD Operational manual. Based on the developments in the market conditions, available policies need to be updated or new policies should be formulated. This requires the respective department to engage in search of latest market developments, especially with reference to the regulatory and institutional framework.

7.3.4. Constant updates on the developments in the international markets needs to be assessed and review of areas such as broadening of business lines for Primary Dealers activities, present tax structure and its applicability and the prevailing reporting formats submitted by Primary Dealers etc to cope with the secondary market developments. It is a task of the department to suggest appropriateParliament policies to make available an efficient Government Securities market with a stable institutional framework.

7.3.5. For policy formulation, the department needs to regular visit the website of various international organisation and the Central Bank outside geographies i.e. BIS, RBI, Federal Reserve, Bank of England to understand the changes and update in Regulatory and Supervisory framework of Primary Dealers market and in Government Securities. However, there is no evidence maintained by the department for the review carried out.

Strictly Private and Confidential Page 67 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.3.6. As per Board Paper of 5 February 2016, The Director, the DSNBFI was entrusted with the responsibility for reviewing the current regulatory and supervisory mechanism in consultation with management and market participant to issue revised or new regulations as appropriate. (Refer Exhibit 27)63.

7.3.7. During an interview, W N S Fernando, EIC / Examiner – Onsite examinations for the period February 2013 to till date, stated that inputs for updating of the operations manual were given once during the period Mid-2013 to Mid-2016. The inputs to be incorporated in the operations manual were discussed verbally in the department and amendments were communicated by HOD or the designated person by the HOD. Further it has been stated that the technique of sampling to be followed for verification of data has not been updated in the operations manual. (Refer Exhibit 30)64.

7.3.8. During an interview, A S Fernando, Examiner - Onsite Examinations for the period October 2015 to July 2018, stated that the detailed methodology for conducting examinations was not documented as part of the operations manual. (Refer Exhibit 31)65.

7.3.9. During an interview, S J K Guruge (Head of Division, the DSNBFI) for the period August 2011 to October 2012 and June 2016 to till date, stated that detailed methodology for conducting examinations was not documented as part of operationalCopy manual i.e. Relating to sample selection, work procedure and templates for pre-examination plan. (Refer Exhibit 33)66.

The above deficiencies were noted across the Review Period and implies the responsibility of the SPD and Director, the DSNBFI for rectification during their tenure. (Refer Table 13).

7.4. NO MECHANISM TO ANALYSE THE MARKET DEVELOPMENT

SCOPE COVERAGE

Examining the implementation and monitoring of regulatory actions by the regulator.

7.4.1. As per the RSSO and LTBO, the Central Bank shall have the authority to undertake and carry out the appointmentParliament from time to time of Primary Dealers, and the Regulation, Supervision or monitoring of such Primary Dealers with respect to their transactions in Securities and the performance of their duties as Primary Dealers. However, the legislation does not indicate any defined procedures to be followed to determine the functioning of the Primary Dealers towards the development done by them in the Government Security Market.

63 Refer Exhibit 27 for board paper for transfer of Regulation and Supervision role from the PDD to DNBFI 64Refer Exhibit 30 for Statement of Fact – W N S Fernando 65 Refer Exhibit 31 for Statement of fact – A S Fernando 66 Refer Exhibit 33 for Statement of Fact - S J K Guruge

Strictly Private and Confidential Page 68 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.4.2. The Primary Dealers are entrusted with the responsibility for the development and introduction of international best practices with respect to the Government Securities trading. They are also responsible for deepening the financial market, the introduction of new technology and the use of more complex financial instruments. They are responsible for creating and maintaining a secondary market in Securities.

7.4.3. They are supposed to act in fiduciary capacity in respect of its customers in the holding of and in the collection and payment of maturity proceeds and interest on Securities and shall for this purpose segregate the assets of its customers from its own assets. The assets of customers shall not form a part of the assets of the Primary Dealer in winding up.

7.4.4. It was noted that there are no prescribed procedures / programs through which the Central Bank keeps a watch on the objective of appointing Primary Dealers in the country.

7.4.5. On the review of CDS data, noted significant transaction carried out by the Primary Dealers through own investment instead of infusing investor funds into the Government Securities. This indicates the Primary Dealer has not concentrated on market development, increasing

the investor base in Government Securities and volumes in primary market. Table 14- List of transactions – Primary Dealers and customerCopy investments** YEAR 2014 2015 2016 2017 PRIMA PRIMA CUSTOMER PRIMA CUSTOMER PRIM CUSTOMER PRIMAR CUSTOME RY RY INVT. RY INVT. ARY INVT. Y R INVT. DEALE DEALE DEALE DEAL DEALER R R R ER NAME NAME NAME NAME NAME INVT. INVT. INVT. INVT. ESL 66.82 33.18 91.12 8.88 100 - 100 - NWSL 95.78 4.22 99.47 0.53 99.87 0.13 100 - PABC 100 - 99.75 0.25 99.37 0.63 86 14 PTL 97.66 2.34 99.82 0.18 99.92 0.08 100 - WTSL 98.5 1.5 98.17 1.83 98.29 1.71 98.21 1.79

** Parliament Source-Data of CDS transaction recordings

Strictly Private and Confidential Page 69 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.5. APPOINTMENT OF PRIMARY DEALERS WITHOUT FULFILLMENT OF NECESSARY REQUIREMENTS

SCOPE COVERAGE

7.5.1. Examining the laws, regulations, policies, circulars, guidelines, manuals etc. applicable to Regulation and Supervision of Primary Dealers and ascertaining if there were any deviations from relevant laws, regulations, policies, circulars, guidelines, etc. in performing the role of Regulation and Supervision of the selected Primary Dealers as part of evaluation of applications and appointment of selected Primary Dealers.

7.5.2. As per Section 2 of RSSO (Chapter 420) and LTBO (Chapter 417), the CBSL shall have the authority to undertake and carry out the appointment from time to time of Primary Dealers and the Regulation, Supervision or monitoring of such Primary Dealers with respect to their transactions in Securities and the performance of their duties as Primary Dealers.

The appointment of PTL - 6 September 2013

7.5.3. The following events are noted on the review of the application and appointment documents: Copy Comments Date

Note on the PTL application and observations related to legal matter were 06-Nov-12 submitted to SPD - Nanayakkara

Draft Letter prepared for informing the further documents needed for 09-Nov-12 evaluation of the proposal as detailed in minutes by DSPD Bandara

Draft letter was submitted for review with legal concerns to SPD – 16-Nov-12 Nanayakkara

SPD - Nanayakkara Instructed Senior Manager - Priyanka that letter should 04-Dec-12 be addressed to DG Ananda Silva and AG Kamalsiri and instructed to check if the PTL had Parliamentany secondary dealing in Government securities Note to DSPD Bandara; a draft report regarding the evaluation of the 04-Dec-12 application prepared based on inputs from Priyanka and submitted for review.

The assessment note on the rejection of PTL appointment submitted by 07-Dec-12 SPD Nanayakkara to DG Ananda Silva and AG Kamalsiri. Draft BP submitted by SPD Nanayakkara to DG Ananda Silva and AG 02-May-13 Kamalsiri

DG Ananda Silva approves the Draft Board Paper and instructed to submit 06-May-13 the Board Paper

The Monetary Board providing in principle approval for appointment of PTL 09-May-13 as Primary Dealers

Strictly Private and Confidential Page 70 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Draft BP of PTL on time extension to fulfil the conditions imposed by MB - 01-Aug-13 submitted by Head of Supervision to DSPD Bandara

Draft BP on appointment of PTL is submitted to DG/S 25-Sep-13

Press release on appointment of PTL submitted to SPD/ASPD/DSPD 09-Oct-13 (B)/Head of Supervision by Dilani (MT/D)

7.5.4. On review of application and appointment documents provided by the department, we noted the following deviations:

A. The application of PTL indicated that the company did not have adequate free capital amounting to Rs. 300 Million and the company had raised a debt for raising the debt. In absence of adequate free capital, the assessment did not consider the failure of PTL operation impacting the investor.

B. The assessment of PTL application did not assess the following key points for the appointing as Primary Dealers: 1. Prior Experience of PTL group in financial servicesCopy industry; 2. Risk of Standalone Primary Dealer in terms of Market Development, Market Integrity and Compliance towards the applicable Laws;

3. Issues noted in ESL, where the company misused the customer monies, high Related party transaction, high Staff incentives, no security allocation and non-recording of transaction in CDS; and

4. Infrastructure available with PTL for the development of Government Securities Market in rural areas of the Sri Lanka

C. In this case, recommendation was given not to give dealership to PTL. On 5 December 2012, note was addressed from Supervision department, recommending that the request of PTL to beParliament appointed as a Primary Dealer cannot be accepted. The list of regulatory concerns on non-bank Primary Dealers were enumerated which included lack of an institutional arrangement for the management of risks, inherent liquidity risk, non-bank Primary Dealers act as the conduit of funding for parent companies, limited participation at primary auctions, high level of borrowing and leverage. However, there was no communication noted towards not to give dealership to PTL. (Refer Exhibit 42)67.

67 Refer Exhibit 42 for PTL appointment rejection note

Strictly Private and Confidential Page 71 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

During an interview, N W G R D Nanayakkara, SPD-the PDD, for the period January 2012 to February 2015, stated that the issue of appointment letter of PTL as a Primary Dealer was done against the advice of appointing him as a stand-alone Primary Dealer. Nanayakkara submitted the advice to the Deputy Governor (B D W A Silva) and the Assistant Governor (A. Kamalasiri) on the application received on 5 December 2012. (Refer Exhibit 37)68.

However, the Board paper submitted through the Deputy Governor (B D W A Silva) did not include all the points from this submission for considering various factors and issue in the appointment as a standalone Primary Dealer. Ajith Cabral, the former Governor, even called him once to understand the reasons for delay in the submission of Board papers regarding the application of PTL.

D. Hence, it can be concluded that the appointment of PTL was done overlooking the considerations as were stated by the Supervision department. The submissions done for non-appointment of PTL as a Primary Dealer were modified to delete certain critical points. No remarks as to why the said critical points were deleted could be in the documents provided by the department for review, hence, the activity of deletion remains questionable. Copy E. Furthermore, the appointment of PTL was done subject to in-principle approval for 90 days against which further extension was provided for 21 days against for the fulfilment of one of the conditions. However, on review of the onsite examination of PTL done in 2014, non-compliances were noted against which the clearance for the in-principle approvals was granted. The table below shows the in-principle approvals which were cleared and against which the findings were noted in 2014 onsite examination. Hence, it can be concluded that the assessment done for granting clearance was not done in a proper manner. Moreover, there is no defined regulatory action was not considered for such non-compliances.

Parliament

68 Refer Exhibit 37 for statement of fact of Nanayakkara

Strictly Private and Confidential Page 72 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

# INITIAL APPLICATION OBSERVATION OBSERVATION NOTED IN ONSITE EXAMINATION

1 Arrangements for contingency As per onsite examination conducted in October 2014 funding lines to mitigate liquidity risk have not received Primary • Non-availability of a contingency Dealer comment-PTL has clean funding plan.

facility with following two banks to • In spite of the undertaking given meet the intraday liquidity facility by PTL to put in place a of the company. This will make contingency funding arrangement, PTL has failed to PTL to manage its liquidity risk comply as of examination date. management without any

Government Securities as

collateral

2 Board approved Business Plan • CopyAs per onsite examination should be made available. Primary conducted in October 2014, Dealer comment Business Plan for Although PTL has a Strategic Business Plan, there is no Board 2013 - 2016 is available. approval for the same.

Appointment of PABC - 1 August 2013

7.5.5. Noted instances where the fulfilment conditions provided for the appointment of Primary Dealer were not met and no evidences for the assessment performed by the department for evaluating and finalisingParliament the appointment of Primary Dealer. # INITIAL APPLICATION OBSERVATION OBSERVATION NOTED IN ONSITE EXAMINATION

1 The work plan stated that PABC • As per onsite examination conducted expects to engage in services such in February 2014, it was raised that as portfolio management, project PABC– PDU does not have a proper appraisal, loan syndication and Business Plan formulated for business expansion and enhancement of its other related fee-based activities market share. for business expansion and enhancement of its market share.

Strictly Private and Confidential Page 73 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

2 The work plan stated that through As per onsite examination conducted the Bloomberg e-trading platform it in February 2014 it was raised that an was stated to increase the e-trading platform was introduced to efficiency as well as profitability in execute and record secondary market trading Government Securities and transactions, enabling price hope to reach to a very wide discovery, transparency, generating audience by the aid of it. yield curve for the development of the secondary market for Government Securities. However, none of PABCPDU transactions have been recorded for four (4) months from September to December 2013.

3 The work plan stated that As per onsite examination conducted educating and selling Government in March 2016 it was raised that the Securities to investors efficiently senior management of PABC- PDU has and to cater the needs of retail failedCopy to conduct any market investors. promotion programs on the Government Securities for the development of Securities market and the Primary Dealer system.

Appointment of ESL - 1 April 2000

7.5.6. On review of application and appointment documents provided by the department, it was noted the followingParliament documents were not available in the files: A. Articles of Association of the Company;

B. Certificate of Incorporation of the Company;

C. Resolution of the Board of Directors to make an application to the CBSL for appointment as Primary Dealers and authorizing the signatory of the application to sign the application on behalf of the applicant;

D. An undertaking from the Company to abide by the rules and regulations, directions, code of conduct and related guidelines pertaining to Primary Dealers and to primary/secondary market transactions issued by the Central Bank from time to time; and

E. Last audited financial statements of the Company.

Strictly Private and Confidential Page 74 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Hence, it can be concluded that the assessment of documents at the time of appointment of ESL as a Primary Dealer was not conducted effectively.

Appointment of WTSL - 1 August 2011

7.5.7. On review of application and appointment documents provided by the department, we noted a non-compliance for requirement relating to increase in paid up and issued capital by Rs. 100 million against which in-principle approval was granted. Hence, assessment done for providing clearance to in principle approval was not done in the right manner.

The deficiencies noted in evaluation of the application and appointment of Primary Dealers. The following are the CBSL employees who were responsible along with respective department:

PTL and PABC

• B D W A Silva, Deputy Governor overseeing the PDD

• A Kamalasiri, Assistant Governor overseeing the PDD

• N W G R D Nanayakkara, SPD

WTSL

• K G D D Dheerasinghe Deputy director overseeing the PDD Copy

• C J P Siriwardana, Assistant Governor overseeing the PDD

• S S Ratnayake, SPD

Parliament

Strictly Private and Confidential Page 75 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.6. ASSESSMENT OF FITNESS AND PROPRIETY OF DIRECTORS

SCOPE COVERAGE

7.6.1. Examining the laws, regulations, policies, circulars, guidelines, manuals etc. applicable to Regulation and Supervision of Primary Dealers and ascertaining if there were any deviations from relevant laws, regulations, policies, circulars, guidelines, etc. in performing the role of Regulation and Supervision of the selected Primary Dealers as part of implementation and monitoring of regulatory actions by the regulator.

7.6.2. As per Direction on 28 May 2013 issued under Regulation 11(1)(p) of the Local Treasury Bills (Primary Dealers) Regulations No. 01 of 2009 and Regulation 11(1)(p) of the Registered Stock and Securities (Primary Dealers) Regulations No. 01 of 2009 for assessment of fitness and propriety of directors needs to be done to ensure good governance and risk management on the conduct of business of Primary Dealer companies which promote safety, soundness and stability of the Primary Dealer industry. Further ensuring fitness and propriety is important to promote and maintain high standards of conduct and management in the provision of Government Securities transactions and related services thereby protecting the interests of investors, creditors or public against future conduct by the officer in Primary Dealer company which may involve loss to the investors, creditors or theCopy public.

7.6.3. No person shall be appointed as a director / officer of the Primary Dealer company unless that person is a fit and proper to hold office as a director / officer. Non-compliance with any one of the criteria as per the direction shall disqualify a person to be appointed, elected or nominated as a director or an officer. (Refer Exhibit 41)69.

7.6.4. As per clause 4.2 with respect to existing directors and employees, the Primary Dealers shall submit the affidavits and declaration within thirty days (30) days of the direction. However, on review it was noted that in 2013, in case of WTSL and ESL, eight (8) instances and five (5) instances were noted respectively when the documents were not filed within timeline of 30 June 2013. No reportingParliament to the Monetary Board for this non-compliance was done nor any action was taken by the Supervision department for the same as it was evident from the files shared with us. Moreover, there was no regulatory action defined in the law for non- compliance of the fitness and propriety of directors.

69 Refer Exhibit 41 for direction on assessment of fitness and propriety of directors and officers performing executive functions of Primary Dealer companies

Strictly Private and Confidential Page 76 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Table 15 - The list of instances – non-compliance of timeline

# COMPANY NAME OF THE DESIGNATION APPOINTMENT DATE OF NAME INDIVIDUAL DATE SUBMISSION OF DOCUMENTS 1 WTSL S A B Ekanyake Chairman 8/18/2010 8/8/2013 2 WTSL D H B Ranawana Managing 1/1/2009 7/15/2013 Director/ CEO 3 WTSL E M M Boyagoda Non- Executive 4/25/2011 8/15/2013 Director 4 WTSL W S Weerasooria Non- Executive 1/11/2010 8/8/2013 Director 5 WTSL R P Weerasooria Non- Executive 1/11/2010 8/8/2013 Director 6 WTSL M R C Cooray Non- Executive 8/18/2010 8/8/2013 Director 7 WTSL K A H Kuruppu Non- Executive 6/20/2011 8/8/2013 Director 8 WTSL R R Gomez Head of 10/1/2011 7/15/2013 Treasury/CEO 9 ESL Romesha Dushyanthi Director- 11/14/2012 9/26/2013 Senerath 736610434V 10 ESL Nalin Noamal Perera Director- 8/15/2011 9/4/2013 Jayasuriya 503210266VCopy 11 ESL Godakande Aratchige Director- 10/6/2011 9/13/2013 Kishantha Nanayakkara 671870840V 12 ESL Isira Dharmapriya Director- 11/23/2012 9/23/2013 Bandara Dassanayake 730410930V 13 ESL Chanuka Upendra Director- 11/23/2012 9/27/2013 Ratwatte 730820445V

7.6.5. As per Clause 4.3 with respect to continuing directors, the Primary Dealers shall submit the affidavits and declaration annually thirty days (30) prior to the AGM if the directors are appointed for re-appointment. However, on review it was noted in case of WTSL, for a continuous periodParliament from 2014 – 2017 and in case of ESL for 2014, three (3) instances and six (6) instances were noted when the documents were filed but the date of AGM was not stated anywhere. Hence, it can be concluded that the assessments carried out in these years without recording the date of annual general meeting was not comprehensive.

Strictly Private and Confidential Page 77 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Table 16 - The list of such instances – absence of AGM date

# COMPANY NAME NAME OF THE INDIVIDUAL DESIGNATION

1 WTSL S A B Ekanyake Chairman

2 WTSL W S Weerasooria Non- Executive Director 3 WTSL K A H Kuruppu Non- Executive Director 4 ESL Romesha Dushyanthi Senerath Director-736610434V

5 ESL Nalin Noamal Perera Jayasuriya Director-503210266V

6 ESL Godakande Aratchige Kishantha Director-671870840V Nanayakkara 7 ESL Isira Dharmapriya Bandara Dassanayake Director-730410930V

8 ESL Chanuka Upendra Ratwatte Director-730820445V

9 ESL Ravindra Manohara Sri Tillakawardana Director-671690079V

7.6.6. In case of ESL, two instances were noted where the documentsCopy were not filed for assessing the fitness and propriety of directors for 2015. No reporting to the Monetary Board for this non-compliance was done nor any action was taken by the Supervision department for the same.

Table 17 - The list of such instances – no documentation files

# COMPANY NAME OF THE INDIVIDUAL DESIGNATION NAME 1 ESL Ravindra Manohara Sri Director-671690079V Tillakawardana 2 ESL Godakande Aratchige Kishantha Director-671870840V Nanayakkara Parliament

Strictly Private and Confidential Page 78 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.6.7. In case of PTL, N N D Jayasekara was appointed by the Board on 23 December 2013 as Accountant. Further, as per fitness and propriety directions “whenever director or officer submit their Affidavit and Declaration, they have to disclose in the declaration form any business transaction the director or officer performing executive functions presently has with the Primary Dealer Company or its related companies, if any”. As per the on-site Report 2016, it was noted that she had done Repo transaction with PTL and the same transaction was not disclosed in the Declaration of Assessment of Fitness and Propriety done for 2016. (Refer Exhibit 49)70.

7.6.8. Noted two (2) instances where appointment has been done, however there was no assessment of fitness and propriety being performed during the period 2014 and 2015. (Refer Exhibit 50) 71.

A. U M P Samarasinghe, was appointed by the Board of PTL on 1 November 2013 as Officer RTGS. However, there was no Affidavit and Declaration presented by CEO of PTL to the CBSL. The said declaration was submitted 8 December 2015.

B. W M Priyadarshana, was appointed by the Board of PTL on 25 November 2013 as Officer- Allocation. However, there was no Affidavit and Declaration presented by CEO of PTL to the CBSL. The said declaration was submitted on 8 DecemberCopy 2015.

7.6.9. On 3 February 2017, A S Fernando (Senior Assistant Director) provided list of Primary Dealer directors and key employees for whom the Fitness and Propriety Assessment were delayed. However, there was no evidence for any action being taken for the non-compliance. (Refer Exhibit 51) 72.

7.6.10. On 25 April 2017, A S Fernando (Senior Assistant Director) provided to the Deputy Director H D Ajith on the list of concerns and issues noted during the assessment of Fitness and Propriety of Primary Dealer directors and key employees. The Deputy Director, H D Ajith instructed A S Fernando that the discrepancies noted in PTL should be considered serious and a warning letter to be issued.Parliament However, there was no evidence available for any such warning letter being issued to PTL during the period. (Refer Exhibit 10)73.

70 Refer Exhibit 49 for fitness and Propriety of N. N. D. Jayasekara_2016 and N N D Jayasekara -Repo outstanding 71 Refer Exhibit 50 for no Fitness and Propriety performed for Manju Priyadarshana and Upeka Samarasinghe 72 Refer Exhibit 51 for delay in Fitness and Propriety by SNBFI 73 Refer Exhibit 10 for direction to issue warning letter instead of declaring un-fit

Strictly Private and Confidential Page 79 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

It was noted that there is no such warning clause mentioned under assessment of fitness and propriety direction and if there is a serious non-compliance by the director or officer they should be declared as un-fit.

The below mentioned officials during the period 2013 to 2017 were responsible for the deviation / deficiencies noted in performing the Regulatory and Supervisory role:

• N W G R D Nanayakkara – SPD - 1.1.2012 - 8.2.2015

• C M D N K Seneviratne- SPD - 9.2.2015 - 20.9.2015

• T H B Sarathchandra - SPD - 21.9.2015 - 1.10.2017

• S J K Guruge – Senior Assistant Director – 1.5.2016 – till date

• UP Alawattage- Director, SNBFI- 21.9.2015- 3.9.2017

• HD Ajith -Deputy Director – June 2016 – October 2017

7.7. POLICY FORMULATION

SCOPE COVERAGE 7.7.1. Examining the laws, regulations, policies, circulars, guidelines,Copy manuals etc. applicable to Regulation and Supervision of Primary Dealers and ascertaining if there were any deviations from relevant laws, regulations, policies, circulars, guidelines, etc. in performing the role of Regulation and Supervision of the selected Primary Dealers

7.7.2. As per the understanding provided during the discussions held with the department officials, it was noted that there was no laid down procedure to be followed for issuance of directions. The laying down of the factors to be considered were not stated in the procedure for issuance of direction.

7.7.3. No mechanism for tracking of developments in the market was established according to which the directions canParliament be framed / drafted. 7.7.4. The procedures followed for reviewing of directions issued by the DSNBFI was not included in the operations manual of the DSNBFI.

7.7.5. As per the understanding provided during the discussions held with the CBSL employees, it was noted that there were no laid down procedures for the Monetary Board to give their recommendations on the findings presented to them.

Strictly Private and Confidential Page 80 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.7.6. During an interview, N W G R D Nanayakkara, SPD-the PDD, for the period January 2012 to February 2015, stated that there was an absence of Regulatory and Supervisory framework for monitoring of the Primary Dealers. The Regulation and Supervision functions were limited only to Application and Appointment of Primary Dealers, Suspension of Primary Dealers, performing Supervision function through onsite, offsite, spot and special investigations and issuing of directions as a part of policy formulation. It was also mentioned that the department lacked on the technology infrastructure and required skilled staff for performing the Regulatory and Supervisory role. However, the efficiency of Supervision of Primary Dealers was enhanced by reducing the onsite examination cycle from two years to one year and submitting the examination reports, along with the Regulatory concerns and proposed corrective actions to the Monetary Board. There were no directions from the Monetary Board as to whether any changes to the extent in Regulatory and Supervisory framework were to be done. (Refer Exhibit 37)74.

The above deficiencies were noted for formulating and issue of directions to Primary Dealers are responsibility of SPD (the PDD) and Directors (SNBFI) during the tenure. (Refer Table 13).

7.8. ABRUPT EMPLOYEE TRANSFERS IN REGULATORY AND SUPERVISORY FUNCTION Copy

SCOPE COVERAGE

7.8.1. Examining the laws, regulations, policies, circulars, guidelines, manuals etc. applicable to Regulation and Supervision of Primary Dealers and ascertaining if there were any deviations from relevant laws, regulations, policies, circulars, guidelines, etc. in performing the role of Regulation and Supervision of the selected Primary Dealers as part of any other matters which may come to light during the examination which have a bearing or relevance to the matters referred to in the scope. Parliament

74 Refer Exhibit 37 for statement of fact of Nanayakkara

Strictly Private and Confidential Page 81 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.8.2. The Monetary Board discussed about the PDD’s Regulatory and Supervisory role on the Primary Dealers and determined that it conflicts with its role of market development and marketing Securities. In pursuance of aforesaid discussion, the former Deputy Governor, P Samarasiri, had submitted a board paper (on 5 February 2016) to seek an approval to assign the Regulation and Supervision of the Primary Dealers in the Government Securities market to the DSNBFI. Internal discussions on establishment of a new Securities trading infrastructure for the Government Securities market which will require a new regulatory and supervisory mechanism in line with the best international practices. In view of the above, it was proposed to transfer regulatory and supervisory functions of the Central Bank to the DSNBFI on 5 February 2016. (Refer Exhibit 27) 75.

7.8.3. However, only three (3) employees were transferred – A S Fernando, W N S Fernando and S P Sedara on 7 April 2016 as per the correspondence stated above.

7.8.4. It was noted that there was no notification received in the official gazette from the Parliament for transferring of power from the PDD to the DSNBFI to regulate Primary Dealers. Hence, the transfer of three (3) employees remains questionable.

7.8.5. The notification was received in the official Gazette after two (2) months when the Supervision division of Primary Dealers was transferred Copyto the DSNBFI effective 3 June 2016 and Supervision function of the Primary Dealer unit of Licensed Commercial Banks was transferred to Bank Supervision Department (“BSD”), effective from 16 May 2018. (Refer Exhibit 3 and Exhibit 4)76.

7.8.6. During the transition period, critical onsite examinations were in progress for PTL and PABC and noted that there was no evidence for the handover of understanding, issues noted, challenges and way forward. There was no defined handover procedure during the termination, transfer, resignation, retirement and long leave for the employees of Supervision division. 7.8.7. During the periodParliament March 2016, ongoing examination of PABC was transferred from W NS Fernando to A S Fernando. During the discussion with A S Fernando, he stated that the examination handover was not appropriately being provided for completion and submission to the Monetary Board. (Refer Exhibit 44)77.

75 Refer Exhibit 27 for board paper for transfer of Regulation and Supervision role from the PDD to DNBFI 76 Source: Refer Exhibit 3 for Regulation made by The Ministry of Finance under Section 55 of the RSSO (Chapter 420) and Exhibit 4 for Regulation made by The Ministry of Finance under Section 16 of the LTBO (Chapter 417) 77 Refer Exhibit 44 for copy of email sent by W N S Fernando for Handover - PABC

Strictly Private and Confidential Page 82 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.8.8. The employees responsible for the deficiencies noted in performing the Regulatory and Supervisory roles during the transfers during 2016 are as follows:

• P Samarasiri, Deputy Governor overseeing the PDD

• R A A Jayalath, Assistant Governor overseeing the PDD

• U P Alawattage, Director - SNBFI

Copy

Parliament

Strictly Private and Confidential Page 83 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

SECTION B: SUPERVISION FRAMEWORK AND DIRECTION

1. The operations of Primary Dealers are regulated by the Registered Stocks and Securities (Primary Dealers) Regulations No. 01 of 2009 and Local Treasury Bills (Primary Dealers) Regulations No. 01 of 2009, Regulations issued by the Ministry of Finance (“MOF”) and Directions issued by the CBSL. As per the Operations Manual updated during 2007, the main functions of Supervision division are to carry out / attend to: (Refer Exhibit 11)78 a. Off-site surveillance;

b. On-site examination;

c. Market monitoring;

d. Supervision policy issues; and

e. Other activities.

2. The subsequent amendments to the Operations Manual during 2013, modified the main functions of the division as to carry out: (Refer Exhibit 1)79 a. Off-site surveillance; b. On-site examination; Copy c. Spot examination;

d. Policy Formulation; and

e. Other activities / Any other activities required to ensure smooth functioning of the Primary Dealer system (Refer Exhibit 2)80.

3. The CBSL has identified five (5) Primary Dealers out of 16 Primary Dealers for the review. As on 1 January 2009, the CBSL has appointed 11 Primary Dealers under Registered Stock and Securities Ordinance and Local Treasury Bill Ordinance. During the Review Period, three (3) out of five (5) identified Primary Dealers (one bank Primary Dealer and two non-bank Primary Dealers) were appointed. Parliament

4. The Supervision division did not maintain a consolidated listing of examinations conducted. Accordingly, the count of examinations is compiled based on the documentation provided for review, in support of the examinations. As on the date of this Report, the Department has confirmed on the count of examination files and reports applicable for the Review Period.

78 Source: Refer Exhibit 11 for the PDD Operational Manual Supervision Division 2007 79 Source: Refer Exhibit 1 for the PDD Operational Manual Supervision Division 2013 80 Source: Refer Exhibit 2 for the PDD Operational Manual Supervision Division 2015

Strictly Private and Confidential Page 84 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

The count of examinations conducted by the Supervision Division at the PDD or with the DSNBFI during the Review Period are provided below: Table 18 - Count of examinations

# PRIMARY DEALER DATE OF DATE OF EXAMINATION TYPE APPOINTMENT SUSPENSION ON-SITE SPOT 1 Pan Asia Banking Corporation-PD Unit 1 Aug 2013 15 Aug 2017 3 - 2 Natwealth Securities Limited 1 Dec 2003 31 May 2019 5 2 3 WealthTrust Securities Limited 1 Aug 2011 - 4 1 4 Entrust Securities PLC 1 Apr 2000 24 Jul 2017 4 4 5 Perpetual Treasuries Limited 30 Sep 2013 6 Jul 2017 2 5 TOTAL 18 12

The Primary Dealer-wise and year-wise count of examinations conducted is as following:

Table 19 - Primary Dealer-wise and year-wise count of examinations-Onsite and Spot

# PRIMARY DEALER 2009 2010 2011 2012 2013 2014 2015 2016 2017 Total 1 Pan Asia Banking NA NA NA NA - 1 1 1 - 3 Corporation– Primary Dealer Unit Copy 2 Natwealth 1 - 1 1 1 2 1 - - 7 Securities Limited 3 WealthTrust NA NA - 1 2 1 - - 1 5 Securities Limited 4 Entrust Securities 1 1 1 2 1 1 1 - - 8 PLC 5 Perpetual NA NA NA NA - 1 2 - 4 7 Treasuries Limited TOTAL 2 1 2 4 4 6 5 1 5 30

Parliament

Strictly Private and Confidential Page 85 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

5. An overview of the components of the Supervision function applicable for Primary Dealers market dealing in Government Securities, covered as part of the review is provided below. The examination files were reviewed to assess effectiveness across the phases of planning, examination, review of findings, operational workflow management and reporting. Coverage of all applicable legislations during examination, analysis of root cause for non-compliances, oversight of the Supervision function by the Monetary Board were evaluated along with the framework for capability enhancement of the Supervision employees and policy formulation with functional vision and direction.

Copy

6. On review of the documents in support of the examinations conducted by the Supervision division, deficiencies were noted that could have reduced the effectiveness of the Supervision function. The nature of deficiencies includes systemic and operational deficiencies along with gaps in the direction, approach andParliament methodology / mechanisms adopted for Supervision. Certain deficiencies at the operations indicated absence of proactive initiatives by the division to enhance effectiveness of Supervision. Accordingly, the findings of the review are classified as following:

A. Observations on the Supervision framework and direction;

B. Systemic and design gaps in the Supervision function;

C. Deficiencies in the Operations: Conducting examinations; and

1. Common findings across Primary Dealers – indicating absence of constructive measures;

2. Repeat findings indicating gaps in follow-up or remediation;

3. Other findings specific to Primary Dealers; and

Strictly Private and Confidential Page 86 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

D. Deficiencies related to reporting to the Monetary Board.

(Refer Annexure 15 – The list of all on-site examination findings noted in the select Primary Dealers)81

Refer subsequent Sections of the Report for detailed finding across the above categories along with the associated details of examinations.

7.9. OBJECTIVE AND APPROACH:

SCOPE COVERAGE

7.9.1. Examining the laws, regulations, policies, circulars, guidelines, manuals etc. applicable to Regulation and Supervision of Primary Dealers and ascertaining if there were any deviations from relevant laws, regulations, policies, circulars, guidelines, etc. in performing the role of Regulation and Supervision of the selected Primary Dealers as part of onsite and offsite Supervision of selected Primary Dealers and findings thereof.

7.9.2. The Operations Manual of Supervision Function defines the objective of the Supervision as “…to ensure a safe and sound Primary Dealer system which infuses greater competition, liquidity and depth in to the G-sec market and thereby reducing the borrowing cost of the Government, ensure investor protection and financial Copysystem stability”. The approach for Supervision of Primary Dealers was to be “…based on a risk-focussed approach, which evaluates whether the Primary Dealers have sufficient capability in terms of assets, capital and portfolio for managing the risks associated with the business they engage in”. (Refer Exhibit 2)82.

7.9.3. During the meetings / discussions with the current and former CBSL employees who were responsible for Supervision function during their tenure, the following understanding was provided for Supervision function of Primary Dealers:

A. Supervision of Primary Dealers is carried out by conducting On-site, Off-site and Spot examinationsParliament. There was no link or relation defined along with the guidelines in adequate detail as to how Supervision would ensure a Primary Dealer system that infuses greater competition, liquidity in the Government Security market and would ensure reduction of borrowing cost of the Government of Sri Lanka;

81 Refer Annexure 15 for list of on-site examination findings identified by the Supervision division for the selected Primary Dealers 82 Source: Refer Exhibit 2 for the PDD Operational Manual Supervision Division 2015

Strictly Private and Confidential Page 87 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

B. The criteria for assessment of a “safe and sound” Primary Dealer system is not defined. The mechanisms to be set up by other departments in the CBSL, the compliance of which to be supervised by the division for ensuring “investor protection and financial system stability” were not indicated; and

C. The scope / areas of review for conducting examination were provided in the form of an examination questionnaire and coverage of examination Report. There is no defined detailed procedures and assessment parameters for evaluating the coverage of examination, leaving the actual method of assessment to the experience and capability of the examination team including examiners and examiner in-charge (“EIC”). (Refer Exhibit 12)83.

7.9.4. The approach for Supervision was defined to be risk-focussed. The areas of coverage for on- site examination include risks but not limited to Liquidity Risk, Market Risk, Legal / Reputational Risk Management and Strategic Risk Management, which are the operational risks of Primary Dealer enterprise, for its own business continuity. The risks identified for examination are not comprehensive such that the approach for risk-based assessment does not focus on the risks that a Primary Dealer would bring to the Government Security Market when onboarded or approved as a Primary Dealer. TheCopy defined risk areas (Liquidity risk, Market risk etc) are not translated into the risks that the Primary Dealer would bring into the system, which include the risk of money laundering, corruption etc and the measures to be taken by Supervision function to combat the risks.

7.9.5. The directional deficiency in the risk-based approach included missing guidelines on risk identification mechanism, risk universe definition, risk prevention and detection methodology and definition of risk mitigation plan encompassing risk avoidance, risk management and risk transfer.

7.9.6. The risk-based examination emphasis on the risk management frameworks that categorize risks based on risk controlling stage such as pre-incident prevention, post incident detection, risk appetite andParliament risk deterrence. The Supervision assessment through examination is more of a detection procedure (post facto) that has associated with limitations and is deficient in terms of prevision and deterrence.

7.9.7. During the Review Period, it was noted that the employees entrusted with the responsibility of driving the Supervision function have not initiated steps to set-up effective risk management framework or have not recommended for measures to improve the effectiveness of the Supervision function.

83 Source: Refer Exhibit 12 Examination Questionnaire

Strictly Private and Confidential Page 88 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.9.8. During the meetings with employees of the DSNBFI, it was noted that there was no initiative taken to evaluate the design effectiveness of the Supervision function through benchmarking with the other economies of similar Government Securities (primary) market / Primary Dealer operations.

7.9.9. Review of minutes of the Monetary Board during the Review Period, wherein the findings of the Supervision examinations were presented, did not indicate evidence that recommendations were made to the Monetary Board for setting up of a comprehensive Supervision framework or to enhance effectiveness of the function.

7.9.10. It can be concluded that there was no link or relation defined along with the guidelines in adequate detail as to how Supervision would ensure a Primary Dealer system that infuses greater competition, liquidity in the Government Security market and would ensure reduction of borrowing cost of the Government of Sri Lanka.

During an interview, S J K Guruge, Head of Division, SNBFI, for the period August 2011 to October 2012 and June 2016 to till date, stated that detailed methodology for conducting examinations was not documented as part of the operational manual i.e. the description of technique to be used for sampling, work procedure and templates for pre-examination plan. (Refer Exhibit 33)84. Copy During an interview, A S Fernando, Examiner - Onsite Examinations for the period October 2015 to July 2018, stated that the detailed methodology for conducting examinations was not documented as part of the operations manual. (Refer Exhibit 31)85.

The above design deficiencies were noted across the Review Period and implies the responsibility of the SPD, the PDD and Director, the DSNBFI for rectification during their tenure. (Refer Table 13).

Parliament

84 Refer Exhibit 33 for Statement of Fact - S J K Guruge 85 Refer Exhibit 31 for Statement of fact – A S Fernando

Strictly Private and Confidential Page 89 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.10. POLICY FORMULATION

SCOPE COVERAGE

7.10.1. Examining the laws, regulations, policies, circulars, guidelines, manuals etc. applicable to Regulation and Supervision of Primary Dealers and ascertaining if there were any deviations from relevant laws, regulations, policies, circulars, guidelines, etc. in performing the role of Regulation and Supervision of the selected Primary Dealers as part of recommendations and or any regulatory actions taken by the regulator with respect to the findings noted during examinations.

7.10.2. The following deficiencies were noted with respect to framing of guidelines in the Operations Manual for Supervision during the Review Period, which indicate gaps in the direction for Supervision function:

A. There was no mechanism defined pertaining to method and channels of communications with Primary Dealer in relationship to the Regulation functions for recommendations on issue of regulations and directions, following the findings of examinations such as repeat violations by Primary Dealers, common findings across Primary Dealers and missing compliance with the directions issued post examinationsCopy by Supervision division. (Refer Annexure 8)86.

B. Auditor General’s annual reports for 2013, 2015, 2016 and 2017 identified that the following violations of different regulations and directions was consistent across the Primary Dealers and clearly indicates the absence of setting up control mechanism by the supervisory function to the regulatory function for issue of suitable additional regulations on such repeated and consistent violations.

1. Lanka Settle Systems Rules Version 2.1 (2003) on usage of the Intra-Day Liquidity Facility (ILF): “…The Primary Dealer had used its customer’s Securities as collaterals to obtainParliament ILK…”; 2. The Direction of Repurchase and Reverse Repurchase Agreements on 2 May 2001: “…The Primary Dealers had failed to allocate adequate Securities against the borrowings from the customers under the Repurchase Agreements and to obtain Securities with sufficient market value for lending under the Reverse Repurchase Agreements…”; and

86 Refer Annexure 8 for Repeated observation identified in each Primary Dealer

Strictly Private and Confidential Page 90 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

3. Section 2.2 of Lanka Settle System Rules Version 2.1 (2013) Custodial Responsibilities: “…The Primary Dealer had failed to record some customer outright transactions in the Central Depository System of the Lanka Settle System…”

C. As per LTBO and RSSO, the legislation does not specify the penalties or fines to be levied for repeated violations. Also, operational manual does not specify the procedure for penalties or fines to be levied to Primary Dealer for repeated violations. Regulatory action despite levy of penalty on repeat violations was not recommended by the supervisory function to the regulatory function; (Refer Exhibit 1, Exhibit 2 and Exhibit 11)87.

D. The Operational Manual does not include the assessment criteria for compliance with Financial Transactions Reporting Act, 2006 (“FTRA”), Prevention of Money Laundering Act, 2006 (“PMLA”) and The Convention on the Suppression of Terrorist Financing Act, No. 25 of 2005 (“CFT”) that requires supervisory systems to Report on violations noted during their audits / examinations, on the non-compliance with the requirements of the legislations. Section 22 and Section 23(a) of FTRA are provided below for reference; Refer Exhibit 1, Exhibit 2 and Exhibit 11)88.

Section 22 of FTRA:

E. “Supervisory authority to ensure compliance by all Institutions.Copy The relevant supervisory authority of an Institution Shall verify through regular examinations whether that an Institution is complying with provisions of the Act and shall Report any non-compliance to the Financial Intelligence Unit

Section 23 (a) of FTRA:

F. “Functions of supervisory authority of an institution and Auditors Where a supervisory authority or an auditor of an Institution has reasonable grounds to suspect that information that it has concerning any transaction or attempted transaction may, be (a) relevant to an investigation or prosecution of a person or persons for any unlawful activity; TheParliament Financial Intelligence Unit shall consult the supervisory authority in respect of the issue of guidelines, directions or regulations to an Institution which is regulated by such supervisory authority and shall furnish to the supervisory authority copies of all guidelines, regulation or directions issued to such Institution.”

87 Refer Exhibit 1 for the PDD Operational Manual Supervision Division 2013, Exhibit 2 for the PDD Operational Manual 2015 and Exhibit 11 for the PDD Operational Manual 2015 88 Refer Exhibit 1 for the PDD Operational Manual Supervision Division 2013, Exhibit 2 for the PDD Operational Manual 2015 and Exhibit 11 for the PDD Operational Manual 2015

Strictly Private and Confidential Page 91 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

As per PMLA and CFT:

“The supervisory authority or the auditor of the Institution shall Report the transaction or attempted transaction to the Financial Intelligence Unit”

7.10.3. During the review of Operations Manual and meetings with current and former employees of the Supervision division with respect to the supervision policy, it was noted that:

A. The Operations Manual defines 16 areas of examination coverage with the objective of the review. It does not provide key aspects to be covered for specified scope of work and methodology pertaining to examination / assessment of defined areas.

Example 1:

As per annexures of operations Manual, 2015, under operational risk which contains information technology, page 49 which states that, “Are there sufficient audit trails to evaluate and ensure data integrity for the range of functional applications provided by the IT system and the assessment of IT risk been included in the work program of the internal auditor or special system auditor”.

While the objectives of review are defined, how exactly the assessment is to be performed by the examiner is not defined. Copy

Example 2:

As per annexures of operations Manual, 2015, under internal control which contains outsourcing, page 48, which states that, “Is the service provider an affiliated institution or an independent extra-group company and all the information relevant outsourced activity been made available to examination officer”.

The details of what parameters to be considered for the review, along with the associated riskParliaments were not defined.

Example 3:

As per annexures of operations Manual, 2015, under liquidity risk, page 48, which states that, “Are policies and procedure routinely reviewed and updated as be appropriate”.

The details of what parameters to be considered for the review, along with the associated risk weightages were not defined.

Strictly Private and Confidential Page 92 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Example 4:

As per annexures of operations Manual, 2015, under legal risk, page 59, which states that,

“Has the Primary Dealer established document requirements covering all aspects of training operations.”

The details of what parameters to be considered for the review, along with the associated risk weightages were not defined.

Example 5:

As per annexures of operations Manual, 2015, under code of conduct, page 61, which states that, “Are there specific restrictions to limit or preclude trading for an employee’s personal account.” The details of what parameters to be consideredCopy for the review, along with the associated risk weightages were not defined.

Example 6:

As per annexures of operations Manual, 2015, under market risk, page 63, which states that, “Are meaningful management information reports on market risk generated and distributed in a timely manner and have there been instance of market disruptions related to market risk that have affected the ability of the Primary Dealer to conduct tis trading operations.” The detailsParliament of what parameters to be considered for the review, along with the associated risk weightages were not defined.

B. The Operational Manual does not define as to how the documentation was to be maintained in support of the activities required in the operations manual, to be performed by the examination teams in respect of the examinations conducted and evaluations performed. There is no definition of document retention requirements in terms of periodicity and the nature of retention. For the purpose of our review, the PDD and DSNBI could not precisely confirm the number (count) of examinations conducted across the identified Primary Dealers during the Review Period, due to the absence of detailed guidelines on documentation. During the review of on-site examinations conducted for the Review Period, the following key documents are not available in the examination files provided.

Strictly Private and Confidential Page 93 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Table 20 – The list in relation to absence of key documents in the examinations’ files

C. The operations manual does not define procedures to be followed in case the observations were to be dropped during the process of review of examination files by the Examiner-In-Charge or were not reported as part of the “Letter of Findings” issued to Primary Dealer for their responses. There was no requirement in the Operations Manual to document and evidence the detail Copy of reviews performed, additional information or explanations evaluated and recording the rationale for not proceeding with the initial findings of the examiner. A summary of Primary Dealer-wise count of examiner’s findings which were either not included in the quarterly assessment pf Primary Dealer industry or not reported to the Monetary Board, is provided below. In the absence of these requirements, the effectiveness of the examination conducted, review and reporting process is questionable. (Refer Annexure 10)89.

Table 21 – Dropping observations

YEAR / COUNT OF INSTANCES # ParliamentPRIMARY DEALERS 2011 2013 2014 1 Natwealth Securities Limited ("NWSL") 1 - 2 2 Wealth Trust Securities Limited ("WTSL") - 4 - 3 Perpetual Treasuries Limited ("PTL") - - 2 Total 1 4 4

89 Refer Annexure 10 for dropping of examination findings from “Letter of Findings”

Strictly Private and Confidential Page 94 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

D. The Operations Manual of Supervision division does not specify the roles and responsibilities of the employees in the Supervision division of the CBSL. The Supervision division was a team with 6 (six) levels of employees, headed by a Director (in the DSNBFI) / Superintendent (in the PDD). The role of a Management Assistant and that of an Examiner-In-Charge, who is a Senior Assistant Director, level in the examinations team, was defined in the manual, however, the role of other employees till the Director / Superintendent of the department was not defined / documented. During the meetings with the current and former employees of the division, we were given to understand that the examination reports are prepared by the examiners and reviewed by the Examiner In-Charge. The examination reports are subsequently reviewed by all employees in the chain of command till the Head of the Department. However, this appears to be a practice followed that was not documented in the operations manual. During the review, the following inconsistencies were noted that indicated gaps in the effectiveness of the examinations and review process. However, the role played by various employees in the Supervision function was not evidenced in finalization of the “Letter of Findings” that was issued to the Primary Dealers. In the absence of defined roles and responsibilities, the accountability for driving effectiveness of the examination and Supervision function cannot be assigned to anyCopy specific employee. Inconsistencies in the examination findings:

1. Examination findings reported to Primary Dealers were not comprehensive;

2. Gaps in the examination plan, coverage, sampling methodology adopted; (Refer Annexure 2090).

3. SNBFI prepares an annual examination plan with regard to onsite examinations. However, the methodology followed for the preparation of the plan was not clear as it was not documented properly; 4. SNBFI doesParliament not have a formal mechanism to communicate the performance of the annual examination plan elaborating the deviations of the plan to the senior management on a periodic basis;

5. Findings of the examiner not supported by adequate work papers;

6. Repeat observations at the same Primary Dealers;

7. “Time bound action plan” (remedial action) not directed towards the examination finding;

90 Refer Annexure 20 for Coverage and Sampling technique

Strictly Private and Confidential Page 95 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

8. Missing evidence of evaluation of action plan response submitted by Primary Dealers; and

9. Removal of findings initially included by the examiner.

7.10.4. It can be concluded that there were gaps in the review process of the documents and the elaboration on the technique followed for sampling while doing the verification of data. Further SNBFI does not have a formal mechanism to communicate the performance of the annual examination plan elaborating the deviations of the plan to the Monetary Board on a periodic basis.

7.10.5. During an interview, P M C S Gunawardana, Management Assistant, stated that the EIC reviews the examination Report and the working files for preparing the Letter of Findings. The Letter of Findings was submitted to SPD for finalisation. However, SPD does not verify the observations with working files and supporting documents to ensure the completeness of examination conducted. (Refer Exhibit 34)91.

7.10.6. During an interview, S P Sedara, Senior Assistant Director, stated that annual examination plan was submitted to the Directors of SNBFI (U P Alawattage and W Ranaweera) for review. The annual examination plan was not submitted to the Monetary Board for the consideration during the period 2016 and 2017. (Refer Exhibit 35)92. Copy

7.10.7. During an interview, A S Fernando, Examiner- Onsite Examinations for the period October 2015 to July 2018, stated that the detailed methodology for conducting examinations was not documented as part of the operations manual. (Refer Exhibit 31)93.

7.10.8. The above design deficiencies were noted across the Review Period and implies the responsibility of the SPD, the PDD and Director, the DSNBFI for rectification during their tenure. (Refer Table 13).

Parliament

91 Refer Exhibit 34 for Statement of P M C S Gunawardana 92 Refer Exhibit 35 for Statement of S P Sedara 93 Refer Exhibit 1 for the PDD Operational Manual 2013, Exhibit 2 for the PDD Operational Manual 2015 and Exhibit 11 for the PDD Operational Manual 2015

Strictly Private and Confidential Page 96 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.11. CAPABILITY ENHANCEMENT

SCOPE COVERAGE

1. Ascertaining if there were any irregularities, lapses or misconduct or instances of professional negligence in conducting the role of Regulation and Supervision of the selected Primary Dealers as part of other matters which may come to light during the examination which have a bearing or relevance to the matters as referred in the scope.

2. During the meetings with the current and former CBSL employees of the Supervision division, the following deficiencies in the capability of the examination employees were noted that reduced the effectiveness of the examinations performed.

A. The Supervision employees did not possess prior experience of conducting audit or examinations of entities in the financial services sector. It was noted that approximately 60% of the interviewees stated that they did not possess the prior experience in conducting examinations or audits of entities in the banking or financial services sector. This deficiency existed throughout the Review Period. Further, details about employees with lack of necessary experience would be gathered during interviews with the PDD and the DSNBFI employees. Copy B. For effectiveness of conduct of Regulatory and Supervisory function by the regulator, regulator requires to build technical competencies of department employees in the areas of activities including legal and enforcement, supervision surveillance, government debt market development, market education, training and research and fund administration.

C. It has been noted that the department employees have competency gaps in the area such as information system audit / IT policy, understanding on international best practices relating to Regulation and Supervision of financial institutions, knowledge on guidelines issued on prudential requirements and Report writing. But it was noted that the mechanism available with the department to assess the employees’ competencies and communicateParliament the gaps to the Human Resource Department in the stated areas, was not adequate.

Strictly Private and Confidential Page 97 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

D. During the discussion, examiners and EIC stated that their educational and professional background does not include qualification related to in conducting audits or examination. Further, details about educational and professional background would be gathered during interviews with employees of the PDD Supervision and SNBFI for the Summary of discussions with the selected employees of the Supervision function. (Refer Annexure 9)94.

E. Additionally, 9 out of 12 interviewees confirmed that there were no focused trainings on the conduct of examinations and procedures to be followed during on-site examinations, off-site surveillance and spot examinations. In the absence of structured and targeted training programs in the areas of examination to enhance the skills-sets of the examination employees. All new joiners in the CBSL undergo trainings and familiarization programs that introduce CBSL operations. These trainings are generic capability trainings covering Code of Ethics to Central Bankers, Outward Bound Professional Development Programme, Applied Econometrics: Practical Approach Using E-Views Software etc., which are common for all employees of the CBSL. However, the PDD and SNBFI employees has not attended any focussed trainings to improve subject matter expertise on topics such as examination procedure, risk assessment, transaction monitoring etc. relevant for conducting effective examinations. Some of theCopy training needs highlighted by the employees during the discussions are provided below. (Refer Exhibit 13 and Annexure 9)95.

Training requirement:

1. Examination methodology;

2. Understanding the laws, ordinances, regulations and directions and related updates;

3. Procedures to be performed by Primary Dealers to comply with the laws; and

4. Assessment of key findings in the examinations.

F. The OperationsParliament Manual 2013, (page number 69 and para 7 of work-paper) requires the Head of Department (the PDD or SNBFI) or Head of Division (Supervision) to provide “examination feedback” to the examiner and EIC on the conduct of the examination. However, during the review, it was confirmed that no such feedback process was followed during the Review Period. (Refer Annexure 9)96.

94 Refer Annexure 9 for the Summary of Discussions with the selected employees of the supervision function 95 Refer Exhibit 13 for list of training programs attended by the PDD Supervision / SNBFI employees and Annexure 9 for the Summary of Discussions with the selected employees of the supervision function 96 Refer Annexure 9 for the Summary of Discussions with the selected employees of the supervision function

Strictly Private and Confidential Page 98 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

G. No evidence could be located to prove that there was a defined methodology to record and share the experiences gained, with respect to the new issues and developments identified, through onsite examinations, among the employees. The establishment of such a policy is useful for the improvement of the onsite examination process and the employees.

H. During an interview, S P Sedara, Examiner – Onsite Examinations, for the period July 2015 to till date, stated that the understanding and knowledge of performing the Supervision of Primary Dealers was acquired during on-job training and discussions with other members of the Supervision team. (Refer Exhibit 35)97.

I. During an interview, L.T Amarasinghe, Examiner – Onsite examinations for the period July 2014 to September 2015, stated that she obtained on-the job training in relation of Supervision of Primary Dealers. (Refer Exhibit 32)98.

J. The above design deficiencies were noted across the Review Period and implies the responsibility of the SPD, the PDD and Director, the DSNBFI for rectification during their tenure. (Refer Table 13). 7.12. STAFFING DEFICIENCIES Copy SCOPE COVERAGE

7.12.1. Ascertaining if there were any irregularities, lapses or misconduct or instances of professional negligence in conducting the role of Regulation and Supervision of the selected Primary Dealers as part of other matters which may come to light during the examination which have a bearing or relevance to the matters as referred in the scope.

7.12.2. During the meetings with the current and former CBSL employees of the Supervision division, the following deficiencies in staffing were noted which reduce the effectiveness and ability of Supervision employees in conducting the examinations: A. Discussions Parliamentwith the department revealed that the employees were allocated for onsite examinations based on certain criteria, size and nature of business, past issues and observations of the off-site examinations. However, the methodology had not been defined in the Operational Manual.

97 Refer Exhibit 35 for Statement of Fact – S P Sedara 98 Refer Exhibit 32 for Statement of fact – L T Amarasinghe

Strictly Private and Confidential Page 99 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Table 22 - Year-wise count of employees

# DESCRIPTION 2009 2010 2011 2012 2013 2014 2015 2016 2017

1 Total employee count 4 4 5 5 5 6 6 6 6 2 Count of employees with 1 1 2 2 1 2 1 - - tenure < 1 year

3 Count of employees with 1 2 1 1 2 3 3 3 3 tenue 1 -2 years

4 Count of employees with 2 1 2 2 2 1 1 3 3 tenue > 3 years

7.12.3. During an interview with the current and former employees of the Supervision division, it was noted that the Supervision division operated with an average count of 4 – 5 employees during the Review Period. The interviewees commented that considering the count of Primary Dealers and the average duration of on-site examinations and off-site surveillance to be conducted on an ongoing basis, these employees count was a significant challenge in ensuring coverage of all examination areas comprehensively (ReferCopy Annexure 9)99. 7.12.4. It can be concluded that there was deficiency of employees in the department and hence no rotation policy for the employees could be implemented. The team selection for the examination was done as per the availability of employees during that period of examination. Further staffing deficiency was responsible for delay in the conduct of examinations scheduled

7.12.5. During an interview, S P Sedara, Examiner – Onsite Examinations, for the period July 2015 to till date, stated that the requirement of rotation of employees was not described in the Operations Manual. Further due to limited number of employees in the DSNBFI, the rotation of employees was not possible. This problem of officer deficiency had also been informed to the Monetary Board in 2018. (Refer Exhibit 35)100.

7.12.6. During an interviewParliament, S J K Guruge (Head of Division, the DSNBFI) for the period August 2011 to October 2012 and June 2016 to till date, stated that verbal communication was made to Directors ( U P Alawattage and W Ranaweera) of the DSNBFI in relation to staff deficiency in the department. Further, it was stated that the deficiency had an adverse impact on the efficiency and effectiveness of Supervision function carried out during the period. (Refer Exhibit 33)101.

99 Refer Annexure 9 for the summary of discussions with the former employees of Supervision function. 100 Refer Exhibit 35 for Statement of fact – S P Sedara 101 Refer Exhibit 33 for Statement of Fact - S J K Guruge

Strictly Private and Confidential Page 100 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.12.7. During an interview, W N S Fernando, EIC / Examiner – Onsite examinations for the period February 2013 to till date, stated that conducting examinations (On-site and Spot) were delayed due to staff deficiency. Further, it was stated that this concern has been communicated to employees on frequent basis and it was presumed that the request for more employees was communicated to the Human Resources Department by the Director of the DSNBFI. (Refer Exhibit 30)102.

7.12.8. During an interview, T H B Sarathchandra, SPD – the PDD for the period September 2015 to June 2016, stated that there were only three employees allocated for the Regulation and Supervision functions and no additional employees had been provided to the department despite numerous verbal request placed to the HR department and P Samarasiri, Deputy Governor. Department was not able to carry out the Regulation and Supervision functions effectively due to inadequate staff. (Refer Exhibit 29)103.

7.12.9. During an interview, A S Fernando, Examiner - Onsite Examinations for the period October 2015 to July 2018, stated that non-transfer of all the employees in the Supervision division of the PDD to SNBFI lead to severe shortage of employees in Supervision division of SNBFI, resulting in delay in the preparation and submission of examination Report to the Monetary Board. (Refer Exhibit 31)104. Copy 7.12.10. During an interview, K P K Weerasekara, EIC / Examiner / Senior Assistant Director / Deputy Director for the period July 2011 to till date, stated that there were three to four employees to conduct on-site examinations, off-site surveillance and spot examinations. Further, she stated that SPD decides the employee requirement for the Supervision division along with the administration division of the PDD. (Refer Exhibit 53)105.

7.12.11. During an interview, H D Ajith, Deputy Director for the period June 2016 to October 2017, stated that the staff deficiencies were verbally communicated to the director U P Alawattage and additional staff were allocated to Supervision division. Further, U P Alawattage raised the concern in variousParliament forum and meetings with management. (Refer Exhibit 54)106. 7.12.12. The above design deficiencies were noted across the Review Period and implies the responsibility of the SPD, the PDD and Director, the DSNBFI for rectification during their tenure. (Refer Table 13).

102Refer Exhibit 30 for Statement of Fact – W N S Fernando 103 Refer Exhibit 29 for Statement of Fact - T B H Sarathchandra 104 Refer Exhibit 31 for Statement of fact – A S Fernando 105 Refer Exhibit 52 for Statement of fact - K P K Weerasekara 106 Refer Exhibit 54 for Statement of Fact – H D Ajith

Strictly Private and Confidential Page 101 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

SECTION C: SYSTEMIC AND DESIGN GAPS IN SUPERVISION

7.13. GAPS IN COVERAGE OF LAWS

SCOPE COVERAGE

Examining the laws, regulations, policies, circulars, guidelines, manuals etc. applicable to Regulation and Supervision of Primary Dealers and ascertaining if there were any deviations from relevant laws, regulations, policies, circulars, guidelines, etc. in performing the role of Regulation and Supervision of the selected Primary Dealers as part of onsite and offsite Supervision of selected Primary Dealers and findings thereof.

7.13.1. The Supervision over functioning of the Primary Dealers is to ensure compliance with laws, ordinances, regulations and directions that govern the operations of Primary Dealers. A summary of the count of legislations identified as applicable for oversight by Supervision function is provided below (Refer Annexure 1)107.

Table 23 – Count of Applicable Legislations

# CATEGORY NUMBER OF ISSUANCES 1 Law 1 2 Ordinance 2 Copy 3 Manuals 3 4 Circular 1 5 Regulations 16 6 Directions 36 Total 59

7.13.2. During the review, it was noted that the last update to the Operational Manual of Supervision division was conducted in the 2015 and there has not been any amendment for the directions and circulars issued subsequent to the update to the Operational Manual. (Refer Exhibit 2)108. Parliament

107 Refer Annexure 1 for List of applicable Laws, Regulations, Manuals and Directions 108 Refer Exhibit 2 for the PDD Operational Manual -2015

Strictly Private and Confidential Page 102 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Table 24 – List of directions and circulars were issued subsequent to the updates to the update of the PDD Operational Manual 2015

# Issue Direction / Circulars Details Year 1 2015 Direction Primary Dealer companies (minimum core capital) direction no. 1 of 2015 2 2015 Direction Primary Dealer companies (RWCAR-amendment) direction no. 2 of 2015 3 2016 Direction Recording of ownership of Government Securities in the LankaSecure Settlement System 4 2016 Direction Secondary Market trading and reporting 5 2016 Circular Payment and Settlement System circular no. 1 of 2016 6 2017 Direction Mandatory reporting of repurchase transactions in Government Securities 7 2017 Direction Direction on primary issuance of treasury bonds

7.13.3. The Supervision division does not have a comprehensive compliance checklist with detailed mapping of compliance requirements under the legislations. On review of the examination files, it was noted that the examination teams use “Questionnaire” to understand the client’s operations and compliances towards regulations and Copy seek information / data from the Primary Dealer through “Initial Data Request”. It was noted that the Questionnaire used by the examination teams did not map the specific questions referring to the compliance requirements, leading to a possible exclusion of compliance assessment requirements.

7.13.4. On comparison of applicable legislation requirement and examination procedures i.e., Questionnaire, Initial information request from the Primary Dealers and the reports sought for the off-site surveillance. It was noted that not all compliance requirements were covered as part of the Questionnaire, data request and reports obtained during Off-site surveillance. Provided below is a summary of compliance requirements not covered in the Questionnaire Parliament

Strictly Private and Confidential Page 103 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Table 25 – Summary of compliance requirements not covered in the Questionnaire

# REFERENCE AREAS COMPLIANCE REQUIREMENT 1 Circular on 1 September 2016, Bloomberg All licensed commercial banks and licensed specialized banks shall use the Secondary Market trading of trading Bloomberg trading platform (fixed income quotes- FIQ) available for Sri Lanka to (i) Government Securities and platform Conduct all outright trades with other banks and Primary Dealers and reporting by Licensed Commercial (ii) Report yield rates and volumes of all outright trades carried out over the counter Banks and licensed specialized in excess of Rs. 50 million, within 30 minutes of each such trade. In case of trades banks carried out through brokers, selling side banks shall Report under (ii) above 2 Section 3 of Direction on Limit- Primary Dealers shall engage in diversified activities only with capital over and above Diversification of Primary Dealer capital the minimum required capital under the existing directions and the said capital Activities on 20 November 2009. utilization which is utilized for the saidCopy diversified activities should be limited to 25% of the Issued under Section 11 of the for total capital of the Primary Dealer. Total capital should be the capital stated in the regulations on June 24, 2009, issued diversified latest audited financial statements. by the Minister of Finance under the activities RSSO and the LTBO (effective from 2 December 2009) 3 Direction on Adjusted Trading Methodolo 1) Primary Dealers are hereby required to refrain from having adjusted trading or (Away Prices) Issued in terms of gy for using away prices for recording their transaction Section 12 of the Regulations on transactio 2) Primary Dealer should use current market prices, for recording their transactions February 1, 2002 issued by the n Minister of Finance under the RSSO recording and the LTBO

4 Code of Conduct Honesty Primary Dealer must ensure that the advertising of their services does not and misrepresent the services that they are capable of performing for a customer or the ParliamentFairness expected performance of any Government Securities when a Primary Dealer advises or acts on behalf of a customer.

Strictly Private and Confidential Page 104 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Conflicts Primary Dealer must not undertake business with or on behalf of a customer where of Interest it has directly or indirectly a conflicting interest unless it has disclosed to the customer the nature and extent of the interest before the customer enters into any relevant transaction. A conflicting interest may be between the Primary Dealer and its customer or between the customer and another customer. Supervisio Senior management and the compliance officer should check the active dealers n by trading accounts to identify any deviations, non-compliances, violations, prohibited senior trading practices, such as churning. managem ent and the complianc e officer Customer Primary Dealer should formulate policies, procedures, mechanisms etc. to identify Trade and prevent the prohibited Copyactivities performed by any customer or dealer. The Priority- activities might include front running / forward trading, churning, market Honesty manipulation and insider dealing etc. and Fairness Front running: An activity in which a trader takes a position in a security in advance of a large trade by the dealer or a customer of the dealer that will move the security's price in a predictable fashion with the intent of making a profit on trading in the Securities thereafter.

Churning: Excessive trading in a customer's account by a person seeking to maximize fees and commissions regardless of the customer's best interests.

Market manipulation: Any deliberately dishonest attempt to affect the market price of a security through trading.

ParliamentInsider dealing: A person or company has inside information when they have information about an issuer or its Securities that has not been publicly disclosed and that is likely to have an effect on the market price of the issuer's Securities when disclosed.

Strictly Private and Confidential Page 105 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.13.5. It can be concluded that the Questionnaire did not include assessment questions to evaluate compliance requirement.

Requirements under the Financial Transaction Reporting Act, No. 6 of 2006" (“FTRA”)

7.13.6. The act defines the roles and responsibilities of supervisory authority under Section 22 and 23 of the Act respectively. The respective sections of FTRA are reproduced below:

A. Sec 22 of Financial Transaction Reporting Act Functions of supervisory authority of an institution and Auditors: 1. Where a supervisory authority or an auditor of an Institution has reasonable grounds to suspect that information that it has concerning any transaction or attempted transaction may, be relevant to an investigation or prosecution of a person or persons for any unlawful activity; and 2. The Financial Intelligence Unit shall consult the supervisory authority in respect of the issue of guidelines, directions or regulations to an Institution which is regulated by such supervisory authority and shall furnish to the supervisory authority copies of all guidelines, regulation or directions issued to such Institution.

B. Sec 23 (a) of Financial Transaction Reporting Act Copy 1. Supervisory authority to ensure compliance by all Institutions; and 2. The relevant supervisory authority of an Institution shall verify through regular examinations whether that an Institution is complying with provisions of the Act and shall Report any non-compliance to the Financial Intelligence Unit.

C. Applicability of AML and CFT 1. Functions of supervisory authority of an institution and Auditors; 2. Assistance in the enforcement of the provisions of the Prevention of Money Laundering Act, No. 5 of 2006 and the Convention on the Suppression of Terrorist Financing Act, No. 25 of 2005; and 3. The supervisoryParliament authority or the auditor of the Institution shall Report the transaction or attempted transaction to the Financial Intelligence Unit.

During the discussion with D M Rupasinghe, Director- Finance Intelligence Unit, we were being informed that the department conducts examinations based on the risk criteria assigned for each type of financial institution. Department has not conducted any examination for Primary Dealer, since the Primary Dealer is considered as low risk institution comparing to other financial institutions.

Strictly Private and Confidential Page 106 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

During an interview, D S Thenuwara, Senior Manager, stated that questionnaire was used to gather information for all examination to be conducted for respective Primary Dealers and questionnaire does not include any information on Bloomberg transactions, separate recording of related party transactions, limited capital utilisation for diversified activities and conflict of interest (Refer Exhibit 36)109.

The above design deficiencies were noted across the Review Period and implies the responsibility of the SPD, the PDD and Director, the DSNBFI for rectification during their tenure. (Refer Table 13).

7.14. ABSENCE OF PRIMARY DEALER RISK SCORING SYSTEM

SCOPE COVERAGE

7.14.1. Examining the laws, regulations, policies, circulars, guidelines, manuals etc. applicable to Regulation and Supervision of Primary Dealers and ascertaining if there were any deviations from relevant laws, regulations, policies, circulars, guidelines, etc. in performing the role of Regulation and Supervision of the selected Primary Dealers as part of onsite and offsite Supervision of selected Primary Dealers and findings thereof. 7.14.2. The framework and methodology for Supervision over PrimaryCopy Dealers does not include a Risk Scoring mechanism whereby; the Primary Dealers are assessed risk scores to assess the criticality of non-compliances or deviations from regulations are identified during an examination. The composite impact of the individual findings noted during the examination is not comprehendible. There is no monitoring mechanism to identify the extent of concerns and non-compliance towards applicable legislation and for computing the composite risk scoring. Consequently, all the Primary Dealers are subjected to same level of monitoring during the off-site surveillance without cognizance of the previous examination findings.

7.14.3. During the meetings, W Ranaweera, Director and with K P K Weerasekara, Acting Deputy Director of SNBFI, confirmed that the Supervision function has not devised a risk-based assessment systemParliament for Primary Dealers.

7.14.4. In the absence of an objective, structured system of risk assessment of a Primary Dealer based on the examination findings, the assessment of severity of the assessment findings are left to the best subjective evaluation of the Supervision division. Absence of risk rating system does not empower the Monetary Board of the CBSL to determine the nature of responsive actions and direct a sustainable remedial action for the non-compliances reported at a Primary Dealer.

109 Refer Exhibit 36 for Statement of fact – D S Thenuwara

Strictly Private and Confidential Page 107 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.14.5. During an interview, S J K Guruge, Head of Division - the DSNBFI, it was noted that the department has not documented the assessment of pre-examination plan and risk profiling for the Primary Dealer prior to the commencement of On-site examinations. (Refer Exhibit 33)110.

7.14.6. During an interview, A S Fernando, Senior Assistant Director, it was noted that the department has not defined detailed methodology for pre- examination and risk assessment of Primary Dealer. (Refer Exhibit 31)111.

7.14.7. The above design deficiencies were noted across the Review Period and implies the responsibility of the SPD, the PDD and Director, the DSNBFI for rectification during their tenure. (Refer Table 13).

7.15. ROOT CAUSE AND QUANTIFICATION

SCOPE COVERAGE

7.15.1. Examining the laws, regulations, policies, circulars, guidelines, manuals etc. applicable to Regulation and Supervision of Primary Dealers and ascertaining if there were any deviations from relevant laws, regulations, policies, circulars, guidelines, etc. in performing the role of Regulation and Supervision of the selected Primary DealersCopy as part of onsite and offsite Supervision of selected Primary Dealers and findings thereof.

7.15.2. The Operations Manual does not require analysis of “root-cause and quantification” for the examination findings before determination of “Time-bound action plan” to mitigate the non- compliances identified with the Primary Dealers. During the review, noted that the root- cause for findings were not analysed and documented for remedial action provided to Primary Dealers. Further, significant gaps were noted between the examination findings and the action plan defined for remediation. There was no practice of doing impact assessment in the form of possible loss quantification for the findings issued by the department. Thus, the action plan defined was not comprehensive and missed the direction of ensuring visible and sustainable remediationParliament to ensure non-recurrence of the deviations.

110 Refer Exhibit 33 for Statement of Fact - S J K Guruge 111 Refer Exhibit 31 for Statement of fact – A S Fernando

Strictly Private and Confidential Page 108 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.15.3. Examination findings are summarised below.

Example: 1

Examination finding:

Supervisory Observation – “Use of customers’ Securities as collateral for obtaining ILF facility without the knowledge of such customers”

Time-bound action plan defined:

Supervisory Recommendation – “NWSL should immediately discontinue the unauthorized usage of Securities that belong to customers for obtaining Intra-Day Liquidity Facility facility and put in place an internal control mechanism to ensure strict compliance with the said System Rule”

Primary Dealer comments – “Already being addressed”.

Possible root causes that lead to the finding:

“Use of customer Securities for obtaining Intra-Day Liquidity Facility indicates gaps in monitoring mechanism at Primary Dealers, missing controls, review and reconciliations and missing internal audit reviews for timely detection of suchCopy gaps. The examiner's finding did not highlight the root cause and oversight deficiencies”

Gaps in action plan due to missed RCA:

The action plan recommended by the Supervision division is based on the ongoing deficiencies identified however, it doesn’t oversee basis and future implication of such deficiencies. Further, action plans were not recommended differently for repeated violations.

“The action plan mentioned about on-going deficiency which has occurred, it doesn’t talk about what would be the implication in future and nor it talks about any warning if it is repeated violation”

Parliament

Strictly Private and Confidential Page 109 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Example: 2

Examination finding:

Supervisory Observation – “Re-investments of customer balances upon maturity have been done for over one-year period without receiving fresh instructions from the respective customers and It was also observed that certain deal tickets have been raised without written requests of the customers”

Time-bound action plan defined:

Supervisory Recommendation – “NWSL should immediately take necessary steps to make sure all investments and subsequent roll-over of investments is supported by a customer request, If the product matures more than one time during a year, NWSL shall obtain new written instructions from the customer on a yearly basis and If the maturity of product happens in more than one-year cycle, automatic roll-overs are not allowed and should obtain such instructions at the time of each and every maturity”

Primary Dealer comments – “Concern was noted, and steps are being taken to get fresh instructions from client for Rollovers. The process of obtaining such instruction will be started immediately and outstanding ones will be completedCopy by 30 Jun 2014” Possible root causes that lead to the finding:

“The extent of deviation in terms of count of transactions, number of customers, frequency of occurrence and the total transaction value were not assessed. The adequacy of (mitigation) action plan cannot be assessed in the absence of such details of the depth/ extent of deficiencies noted. The examiner's finding did not highlight the root cause and methodology deficiencies”

Gaps in action plan due to missed RCA:

“The action plan recommended by the Supervision division is based on the ongoing deficiencies identifiedParliament however, it doesn’t oversee basis and future implication of such deficiencies. Further, action plans were not recommended differently for repeated violations”

Strictly Private and Confidential Page 110 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Example: 3

Examination finding:

Supervisory Observation – “It was noted that some customer transactions in the selected sample had not been recorded in CDS-CSL account and Non-recording of transactions causes inability of claiming the ownership of the investment for the Client, as the ownership of the security is not transferred to the CDS account of the customer”

Time-bound action plan defined:

Supervisory Recommendation – “PABPD should take necessary actions immediately, to record all transactions in Lanka secure promptly and accurately”

Primary Dealer comments – “Not available”

Possible root causes that lead to the finding:

“Non-recording of transactions in CDS indicates gaps in monitoring mechanism at Primary Dealers, missing controls, review and reconciliations and missing internal audit reviews for timely detection of such gaps. The examiner's finding did not highlight the root cause and oversight deficiencies” Copy Gaps in action plan due to missed RCA:

“The reviewer’s remarks / noting on examination work paper do not indicate the above deficiencies identified during the review process or the examiner was asked to gather facts around the above possible deficiencies, the implementation recommendation is not comprehensive covering the measures to be taken to mitigate the above deficiencies at the Primary Dealer”

7.15.4. As stated in examples above relating to non-recording of transactions in CDS, as part of the rectification action, the punitive provision which was not implemented as stated below: (Refer Exhibit 38)Parliament112.

112 Refer Exhibit 38 for Violation of LankaSettle System Rules Version 2.1 (2013): Custodian Responsibilities

Strictly Private and Confidential Page 111 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Table 26 – Penalties for violation of Lankasettle System Rules

FREQUENCY OF NON- The CBSL ACTION COMPLIANCE First Instance Severe Warning Second Instance Rs. 5000 per transaction or 0.5% of the value of the transaction (face value) whichever is higher Third Instance Rs. 10000 per transaction or 1% of the value of the transaction (face value) whichever is higher Over three instances Severe regulatory action, as may be determined by the CBSL including the suspension of the DDP status of a Licensed Commercial Banks and suspend the Primary Dealer status as appropriate for a period of time determined by the CBSL

7.15.5. Dealer Direct Participant shall comply with applicable law, regulations and directions issued by the CBSL in conducting of their business. The DDP shall act as custodians for their customers in the Lanka Secure System. The custodial role includes the responsibility to promptly and accurately record the name, address and NIC, CRN or the number of any other identification document approved by the CBSL, of each Copycustomer in the Lanka Secure System when the customer obtains legal ownership of Securities. It also includes prompt and accurate recording in the LSS, ownership or any change of ownership or owner details of Securities and in the event of failure to record the said details, the CBSL may in its sole discretion impose

a charge on the DDP as stated above.

7.15.6. It can be concluded that the action plan defined was not comprehensive and missed the direction of ensuring visible and sustainable remediation to ensure non-recurrence of the

deviations.

7.15.7. During an interview, T H B Sarathchandra, SPD of the PDD, stated that department has not imposed any penaltyParliament towards the non-compliance of Lanka Secure System Rules (Refer Exhibit 113 29) .

7.15.8. The above design deficiencies were noted across the Review Period and implies the responsibility of the SPD, the PDD and Director, the DSNBFI for rectification during their

tenure. (Refer Table 13).

113 Refer Exhibit 29 for Statement of Fact – T B H Sarathchandra

Strictly Private and Confidential Page 112 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.16. QUALITY SELF-ASSESSMENT AND BENCHMARKING

SCOPE COVERAGE

7.16.1. Examining the laws, regulations, policies, circulars, guidelines, manuals etc. applicable to Regulation and Supervision of Primary Dealers and ascertaining if there were any deviations from relevant laws, regulations, policies, circulars, guidelines, etc. in performing the role of Regulation and Supervision of the selected Primary Dealers as part of onsite and offsite Supervision of selected Primary Dealers and findings thereof and implementation and monitoring of regulatory actions taken by the regulator.

7.16.2. The Supervision division does not have a process of Independent Quality Review or Self- Assessment Process to ensure effectiveness of the Supervision examination. The gaps noted the approach for examination, coverage of applicable laws during the examinations and missing direction of time-bound action plan would be avoided and the effectiveness of Supervision could be enhanced through a Quality Self-Assessment by the Supervision function.

7.16.3. As per the Operation Manual, 2015, for update in the existing manual and issue of new directions, the department needs to periodically evaluate the development in international market and internal institutions i.e. Bank for InternationalCopy Settlement (BIS), Federal Reserve System (“FED”), Reserve Bank of India (“RBI”) and Bank of England (“BOE”) (Refer Exhibit 2) 114.

7.16.4. As per discussion with the W Ranaweera, Director, SNBFI, it was noted that the department has not conducted benchmarking exercise of its Supervision function and methodologies adopted against the Peer Group departments such as BSD, the CBSL Operations of comparable economies and with global professional standards.

7.16.5. Hence it can be concluded that the Supervision division does not have a process of Independent Quality Review or Self-Assessment Process to ensure effectiveness of the Supervision examination.Parliament 7.16.6. The above design deficiencies were noted across the Review Period and implies the responsibility of the SPD, the PDD and Director, the DSNBFI for rectification during their tenure. (Refer Table 13).

114 Source: Refer Exhibit 2 for the PDD Operational Manual Supervision Division 2015

Strictly Private and Confidential Page 113 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.17. OVERSIGHT RESPONSIBILITY

SCOPE COVERAGE

7.17.1. Examining the laws, regulations, policies, circulars, guidelines, manuals etc. applicable to Regulation and Supervision of Primary Dealers and ascertaining if there were any deviations from relevant laws, regulations, policies, circulars, guidelines, etc. in performing the role of Regulation and Supervision of the selected Primary Dealers as part of onsite and offsite Supervision of selected Primary Dealers and findings thereof.

7.17.2. The Operational Manual of Supervision function defines the requirement of reporting to the Monetary Board. With respect to the on-site examinations, the Supervision division is required to Report the findings to the Monetary Board, post receipt of action plan to Primary Dealer and receipt of responses from the respective Primary Dealer. On a quarterly basis, the division has to Report to the Monetary Board on the status of “Time-Bound Action Plan” to be complied by the Primary Dealers.

7.17.3. On review of the examination reporting process defined, it was noted that the process was driven by the Supervision function but not overseen by the Monetary Board for reasoning and absence of monitoring mechanism indicating the followingCopy deficiencies noted: A. Total of 18 on-site examinations were conducted during the Review Period against 35 examinations possible, considering the annual examination cycle;

B. In case of the bank Primary Dealer, Pan Asia Banking Corporation PLC (Primary Dealer Unit), Onsight examination was conducted during 2015 and 2016, however, the Monetary Board was not informed on the examination findings;

C. Certain examination findings were consistent across the examination on Primary Dealers indicating either systemic deficiencies or need for additional regulatory action. However, such actions were not recommended or taken by the Regulatory division; D. Certain findingsParliament were repeated during the examinations at Primary Dealers indicating gaps in the effectiveness of the “Time-Bound Action Plan” monitoring by the Supervision function;

E. Noted gaps in the examination findings, where the remedial action provided in the “Time-bound Action Plan” was not consistent during the review of examinations by the examination team;

F. Significant delays (more than 200 days in certain instances, Refer below Table 27-29 for details) in completion of on-site examinations and significant delays in issue of “Letter of Findings” from the date of completion of examination field work;

G. No evidence is required to be maintained for performing the off-site surveillance as per the Operations Manual of Supervision function; and

Strictly Private and Confidential Page 114 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

H. No evidence of review by Assistant Governor and Deputy Governor (overseeing the PDD), for Operations Manual being developed for Supervision function of Primary Dealers.

7.17.4. On review of Minutes of the Monetary Board meetings, it was noted that:

A. Deviations from the approved Annual Audit Plan, if any, were not reported by the Supervision division to the Monetary Board; and

B. The gaps highlighted in para 7.25 were not reported to the Monetary Board.

Refer the below tables for an overview of significant delays noted in On-site examination

Table 27 – Time taken to send the LOF sent from the examination commencement date

Table 28 - Time taken to submit the Board Paper to the Monetary Board from LOF to Primary Dealers Copy

Table 29 – Time taken to submit the board paper to the Monetary Board from the examination commencement Parliament

(Refer Annexure 24 for detailed delays in submitting the Monetary Board papers)115.

115 Refer Annexure 24 for detailed delays in submitting the Monetary Board papers

Strictly Private and Confidential Page 115 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.25.1. On the following events noted on the review of the application and appointment document

COMMENTS DATE Draft LOF submitted by M/S/SU to DSPD(B) 3-Dec-15 - O/S Repo list with CBSL funds Note by M/S/SU to DSPD(B)- amended documents submitted. All customers 8-Dec-15 within repo balances as at 30 Sep 15 were checked Amended LOF submitted by M/S/SU to ASPD 11-Dec-15 Note by SM/F - BP preparation on hold until the new format is discussed 11-Feb-16 with DG by SPD Note by SM/F - ASPD instructed to continue with current format 1-Mar-16 Draft BP was forwarded by SM/F to SDPD and H/Supervision 3-Mar-16 Draft BP was forwarded by SM/F to ASPD 15-Mar-16 Note to SPD- Since the supervision division is to be transferred to DSNBFI 15-Mar-16 soon, it is proposed to submit this through SNBFI with new supervisory mechanisms

7.25.2. Despite several issues noted during the onsite examination of PTL and the observation noted in the examination was not reported to the MonetaryCopy Board instead Samarasiri, Deputy Governor submitted the board paper for the transfer of department from the PDD to the SNBFI without concluding on the examination report. The employee was transferred on April 2016 whereas the gazette was notified on the month June 2016 and there was no rationale for the supervision division to be transferred from the PDD to the SNBFI without concluding the examination report of PTL and PABC 2016.

7.25.3. During an interview with various employees who were responsible for Supervision of Primary Dealers, it was noted that delay in the reporting examination reports were due to staff deficiency and the existing employees were involved in providing the documents for the PTL and ESL ongoing Parliamentinvestigations. 7.25.4. During an interview, W N S Fernando, EIC / examiner – onsite examinations for the period February 2013 to till date, stated that conducting examinations (on-site and spot) were delayed due to staff deficiency. (Refer Exhibit 30)116.

116Refer Exhibit 30 for Statement of Fact – W N S Fernando

Strictly Private and Confidential Page 116 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.25.5. During an interview, A S Fernando, examiner- onsite examinations for the period October 2015 to July 2018, stated that non-transfer of all the employees in the supervision division of the PDD to SNBFI lead to severe shortage of employees in supervision division of SNBFI, resulting in delay in the preparation and submission of examination Report to the Monetary Board. He further stated that U P Alawattage (former director) informed that P Samarasiri (Deputy Governor) instructed to submit the one-page PTL’s onsite examination Report for the period 2016 to the Monetary Board and hence it was submitted without the signature of Jayalath (Assistant Governor). (Refer Exhibit 31)117.

7.25.6. During an interview, W. Ranaweera, Additional Director / Director for the period September 2016 to till date, stated that delay in submitting the reports to the Monetary Board was due staff deficiency and the existing employees were involved in providing the documents for the PTL and ESL ongoing investigations. (Refer Exhibit 19)118.

7.25.7. During an interview, S J K Guruge (Head of Division, the DSNBFI) for the period August 2011 to October 2012 and June 2016 to till date, stated that verbal communication was made to Directors ( U P Alawattage and W Ranaweera) of the DSNBFI in relation to staff deficiency in the department. Further, it was stated that the deficiency had an adverse impact on the efficiency and effectiveness of Supervision function Copy carried out during the period. He further stated that P Samarasiri (Deputy Governor) did not signed the PTL’s board paper for the period 2016. Hence, U P Alawattage (former director) got the approval from the Governor to submit the one-page board paper to the Monetary Board. (Refer Exhibit 33)119.

7.25.8. During an interview, T H B Sarathchandra, SPD – the PDD for the period September 2015 to June 2016, stated that the delay in submitting the report to Monetary Board was due to denial of the approval to submit Board paper by P Samarasiri, Deputy Governor. He further stated that the Deputy Governor had instructed to change the reporting template despite several findings noted during the examination of the Primary Dealers. (Refer Exhibit 29)120.

7.25.9. The above design deficiencies were noted across the Review Period and implies the responsibility ofParliament the SPD, the PDD and Director, the DSNBFI for rectification during their tenure. (Refer Table 13).

117 Refer Exhibit 31 for Statement of fact – A S Fernando 118 Refer Exhibit 19 for Statement of Fact – W Ranaweera 119 Refer Exhibit 33 for Statement of Fact - S J K Guruge 120 Refer Exhibit 29 for Statement of Fact - T B H Sarathchandra

Strictly Private and Confidential Page 117 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

SECTION D: DEFICIENCIES IN OPERATIONS: CONDUCT OF EXAMINATION

7.18. EXAMINATIONS AS THE MEDIUM OF SUPERVISION

SCOPE COVERAGE

1. Examining the laws, regulations, policies, circulars, guidelines, manuals etc. applicable to Regulation and Supervision of Primary Dealers and ascertaining if there were any deviations from relevant laws, regulations, policies, circulars, guidelines, etc. in performing the role of Regulation and Supervision of the selected Primary Dealers as part of onsite examination and off-site surveillance of selected Primary Dealers and findings thereof.

A. Supervision function is charged with evaluating the safety and soundness of individual Primary Dealers. For evaluation, Supervision function carries out on-site examinations and off-site surveillance.

B. On-site examinations are carried out to verify the accuracy of records submitted by Primary Dealer and to assess the financial viability of the Primary Dealers. These are also conducted to investigate certain aspects of Primary Dealer operations such as Custodial arrangements, repurchase and reverse repurchase transactions. These examinations are conducted by Supervision personnel by visiting PrimaryCopy Dealers premises.

C. Off-site surveillance is carried out on the information submitted by the Primary Dealers on daily, weekly, monthly and quarterly basis to check the Primary Dealer’s financial soundness and includes activities not limited to evaluation of financial position and performance of Primary Dealers.

2. The supervisory authority carries out examination to inspect the trading operations, governance and its compliance with applicable laws and supervisory requirements.

3. During an interview, A S Fernando, Senior Assistant Director, stated that there was no finding of any short selling of transaction conducted by PTL in the draft examination Report. However,Parliament on the review of CDS transactions (extract), it appears that PTL has submitted the incorrect and manipulated data. Further, during the spot examination for the period 2016, several instances of error transactions were deleted without source documents. There were no checks performed to identify if the transactions reported were appropriate and genuine. (Refer Exhibit 31)121.

121 Refer Exhibit 31 for Statement of fact – A S Fernando

Strictly Private and Confidential Page 118 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

4. During an interview, S P Sedara, Senior Assistant Director, stated that officers were not assigned for off-site surveillance in the PDD. However, the surveillance was carried out by all officers of the division based on specific areas assigned to them by the supervisors. In the DSNBFI, Primary Dealers were assigned to the officers for the surveillance. The monthly off-site surveillance Report was developed after transfer of Supervision to the DSNBFI and submission commences later part of 2017. (Refer Exhibit 35)122.

5. The above design deficiencies were noted across the Review Period and implies the responsibility of the SPD, the PDD and Director, the DSNBFI for rectification during their tenure. (Refer Table 13).

FINDINGS ON REVIEW OF EXAMINATIONS

7.19. PLANNING AND PREPARATION

SCOPE COVERAGE

7.19.1. Examining the laws, regulations, policies, circulars, guidelines, manuals etc. applicable to Regulation and Supervision of Primary Dealers and ascertaining if there were any deviations from relevant laws, regulations, policies, circulars, guidelines, etc. in performing the role of Regulation and Supervision of the selected Primary DealersCopy as part of onsite and off-site Supervision of selected Primary Dealers and findings thereof.

7.19.2. As per the Operation Manual for Supervision, the department is required to perform the pre- examination assessment and preparatory plan to be conducted to assess the coverage of examination and special areas to be covered during the on-site examination.

7.19.3. During the review of on-site examinations for selected five Primary Dealers. It was noted that excluding work allocation sheet, none of the examinations files has documented the pre- examination assessment and preparatory plan. The following table shows the frequency towards non-availability of work allocation plan during the review of examinations files: Parliament

122 Refer Exhibit 35 for Statement of S P Sedara

Strictly Private and Confidential Page 119 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Table 30 – Absence of work allocation plan in the on-site examination’s files

# PRIMARY DEALER NAME ESL NWSL WTSL PABC PTL

EXAMINATION YEAR 1 2009 -  NA NA NA 2 2010 - - 3 2011   4 2012    5 2013 - -  6 2014      7 2015   -   8 2016 - - - 

9 2017 - -  NA NA



Note: (“x”- Workplan not available, “” - Workplan available, “-” – No examination carried out, “NA”- Not Applicable)

7.19.4. As per the discussions with the former and current employeesCopy of Supervision division, it was noted that the on-site examination team has not maintained any documentation / evidence pertaining to the assessment pre-examination plan.

7.19.5. During an interview, S J K Guruge, Head of Division, the DSNBFI, it was noted that the department has not documented pre-examination plan and risk assessment of Primary Dealers before the commencement of on-site examination. (Refer Exhibit 33)123.

7.19.6. The above design deficiencies were noted across the Review Period and implies the responsibility of the SPD, the PDD and Director, the DSNBFI for rectification during their tenure. (Refer Table 13). Parliament

123 Refer Exhibit 33 for Statement of Fact - S J K Guruge

Strictly Private and Confidential Page 120 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.20. EXAMINATION PROCEDURES

SCOPE COVERAGE

7.20.1. Ascertaining if there were any irregularities, lapses or misconduct or instances of professional negligence in conducting the role of Regulation and Supervision of the selected Primary Dealers as part of onsite and offsite supervision of the selected Primary Dealers and findings thereof.

7.20.2. Based on the discussion with the Supervision function on the process and procedure adopted for the examination procedures, we were informed that following keys steps to be considered for the on-site examination:

A. Opening meeting with the Primary Dealers; B. Assigning of examination team member and defining the specific responsibilities; C. The scope and objective of examination to be reviewed; D. Finalization of the examination testing procedures; E. Conducting examination fieldwork as per the scope of examination; F. Monitoring of examination to ensure that the planned examination activities are completed properly; Copy G. Preparation of draft supervisory concern Report; H. Upon review, prepare a Letter of Finding and obtaining the response from Primary Dealers; I. Documentation of procedures, analysis of the management response and working papers with indexed and referred to examination Report; J. Closing meeting with the Primary Dealers and finalization of the remedial action; K. Preparing time bound action plan and upon review, prepare Board paper for Monetary Board; and L. Reporting to the Monetary Board for regulatory action. 7.20.3. On review of theParliament on-site examination for the selected Primary Dealers, it was noted that the following key documents were not documented across the period of examination.

Strictly Private and Confidential Page 121 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Table 31 – List of missing documents from the examination files

7.20.4. The above design deficiencies were noted across the Review Period and implies the responsibility of the SPD, the PDD and Director, the DSNBFI for rectification during their tenure. (Refer Table 13). 7.21. OPERATIONS Copy SCOPE COVERAGE

7.21.1. Ascertaining if there were any irregularities, lapses or misconduct or instances of professional negligence in conducting the role of Regulation and Supervision of the selected Primary Dealers as part of onsite and off-site supervision of selected Primary Dealers and findings thereof.

7.21.2. Based on discussions with the supervision division, it was noted that, there is no formal system / tool in place for the PDD Supervision and the DSNBFI for timely reporting and effective monitoring of examination activities performed by the department. There is no process followed by the department for systematically recording activities performed during on-site,Parliament off-site and spot examinations. Non -availability of audit / examination / work-flow tool results in lack of standard procedure for execution and documentation of examination process.

7.21.3. As per current practice followed by the supervision division, examinations are conducted with reference to the PDD operational manual, thus no streamlined process were defined, and no tracker / tool was used for conducting each work step in defined manner. In the absence, standard procedures for conducting examination and non-availability of documentation, it is difficult to identify completeness of various work steps performed during the examinations.

Strictly Private and Confidential Page 122 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.21.4. During the review of examination files, it was identified that various documents viz. risk profile of Primary Dealer, examination work plan, work allocation sheet, working papers, individual examiner Report, Minutes of meeting etc. required to be documented by the examiner however, the documents were not available in the examination files.

7.21.5. Audit / workflow tools will enable supervision division in conducting examinations in systematic, and standard and aligned with Laws, Regulation and Manuals.

7.21.6. Analytical use of FInNet for effective off-site surveillance:

A. Off-site surveillance works on developing an effective risk-based approach that continuously monitors different types of developments of potential risk faced by Primary Dealer market. Surveillance activity works on enhancing the early warning system, which permits supervision division to perform proactive measures for smooth functioning of the market

B. Under off-site surveillance requires full-fledged review of key risk parameters, analysis and assessment of Primary Dealers risk profile. This process involves review and analysis of financial statements, periodical capital adequacy, liquidity, profitability and various risk reports. Off-site surveillance supports to identify the scope of the on-site examination by detecting the most relevant and prioritCopyized risk areas.

C. As per the PDD Operational Manual of Supervision Division, as part of off-site surveillance, “FInNet” (computer-based reporting system) is used for collecting financial and trading information on weekly, monthly, quarterly and annual basis for performing analysis to detect potential issues and emerging risks from Primary Dealer.

D. Concerns identified during Off-site surveillance works as triggers for spot examination and special investigation. In such examinations / investigations specific identified outliers are reviewed by the supervision division to mitigate risks and concerns of Primary Dealers and Primary Dealer market.

E. On reviewParliament of Off-site Surveillance reports it was noted that various activities viz. analysis of financial statements, Monitoring the recording of transactions in the Central Depository System (“CDS”) and e-trading platform, and preparation of analytical reports is performed manually by the department. There is no automated system in place for analysis of financial and other reports collected through FInNet system. Further, there is no mechanism in place to provide automated alerts to supervision division to inform various risks from the uploaded data of Primary Dealers.

F. Non-updating of the FInNet system - All the Primary Dealers had to adopt the International Financial Reporting Standards (IFRS) from 1 January 2013 onwards. The reporting format available in the FInNet system was not updated to be in line with the IFRS requirement.

Strictly Private and Confidential Page 123 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

G. The objective of off-site surveillance is to provide early warning signals to supervision division from analysis of data to restrict various risks of each Primary Dealers and Primary Dealer market. Due to limited use of FInNet, various reports involving analysis of data collected is performed manually by the supervision division. Manual analysis of data depends on skills of individual examiner, thus scope for errors occurrence will be high and leads to ineffective examination function.

H. During off-site surveillance of Primary Dealers, the analysis is not performed on key financial and operational parameters viz. profitability statements, capital adequacy, risk weighted capital adequacy, mark to market, statement of changes in equity and reserves etc., due to non-availability of automated system.

I. During discussion with employees of the PDD supervision and the DSNBFI, it was informed that use of FInNet system was planned for automated alerts and analysis for continuous monitoring activities, however, such update was not introduced.

J. In the absence of comprehensive use of FInNet for providing analytical reports and presumptive triggers of potential risks, the objective of Off-site surveillance cannot be accomplished.

7.21.7. The above design deficiencies were noted across theCopy Review Period and implies the responsibility of the SPD, the PDD and Director, the DSNBFI for rectification during their tenure. (Refer Table 13).

7.22. COMMON FINDINGS ACROSS PRIMARY DEALERS – INDICATING ABSENCE OF CONSTRUCTIVE MEASURES

SCOPE COVERAGE

7.22.1 Examining the laws, regulations, policies, circulars, guidelines, manuals etc. applicable to Regulation and Supervision of Primary Dealers and ascertaining if there were any deviations from relevant laws,Parliament regulations, policies, circulars, guidelines, etc. in performing the role of Regulation and Supervision of the selected Primary Dealers as part of onsite and offsite supervision of selected Primary Dealers and findings thereof.

7.22.2 Review of on-site examination reports along with supporting work paper revealed that certain critical non-compliances were noted across the identified Primary Dealers. Details of the common findings are provided below along with the details of count of Primary Dealers where

Strictly Private and Confidential Page 124 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

the observations were noted and the percentage of frequency occurrence: (Refer Annexure 19)124.

Table 32 - Details of common findings

Copy

7.22.3 On the review of meeting minutes of the Monetary Board, it was noted that there is no analysis being submittedParliament on common findings across multiple Primary Dealers and they were not reported to the Monetary Board.

7.22.4 It can be concluded that the occurrence of findings across multiple Primary Dealers indicates potential systemic deficiencies that necessitate targeted regulatory actions.

124 Refer Annexure 19 for common observations

Strictly Private and Confidential Page 125 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.22.5 During an interview, D S Thenuwara, Senior Manager, it was noted that common findings and repeated observations were not communicated to the Monetary Board across the Review Period and no instruction received from the department by SPD / Director for reporting on the same. (Refer Exhibit 36)125.

7.23. CONDUCT OF EXAMINATIONS

1. On review of the examination conducted on Pan Asia Banking Corporation PLC (Primary Dealer Unit) (“PABC”), the following are the key findings noted during the examination:

Observation 1 – Examination period March 2016

Section 2.2 of Violation of Lanka Settle System Rules Version 2.1, 2013 on Custodial Responsibilities

Examination Findings Supervision Department Comments

• It was noted that some customer PABC should take necessary actions transactions in the selected sample had not immediately, to record all transactions been recorded in CDS-CSL account in Lanka Secure promptly and • Non-recording of transactions causes accuratelyCopy inability of claiming the ownership of the investment for the Client, as the ownership of the security is not transferred to the CDS account of the customer

Examiner - A S Fernando and P M C S Gunawardana, Examiner In-Charge - W N S Fernando. ASPD / SPD - U P Alawattage

Deficiencies noted in the procedures followed during examination

• The review Report was not sent to Primary Dealer for the comments nor was it sent to the MonetaryParliament Board for regulatory action. • Methodology used for concluding the findings was not detailed to assess the effectiveness of recommendation provided for ratification. • The sample pertaining to January 2016 only was considered, whereas the Review Period for the examination was February 2015 to January 2016. • Overall the examination work paper does not indicate identification of period of review.

125 Refer Exhibit 36 for Statement of fact – D S Thenuwara

Strictly Private and Confidential Page 126 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

• Non-recording of transactions in CDS indicates gaps in monitoring mechanism at Primary Dealers, missing controls, review and reconciliations and missing internal audit reviews for timely detection of such gaps. The examiner's finding did not highlight the root cause and oversight deficiencies. • The reviewer’s remarks / noting on examination work paper do not indicate the identification of procedural deficiencies identified during the review process. • The implementation recommendation is not comprehensive covering the measures to be taken to mitigate the above deficiencies at the Primary Dealer. • No evidence of the action plan testing for compliance by Primary Dealer. • No procedure defined for the communication/ notification of any such serious violation of rules defined in Act, regulation, circular and direction by the regulator.

During an interview, P M C S Gunawardana, Management Assistant, stated that CDS outright transactions during the month January 2016 were selected as sample and the same was discussed with W N S Fernando (EIC) verbally and this was not documented. (Refer Exhibit 34)126.

Observation 2 – Examination period February 2015 Copy

Direction of Customer Charter for Primary Dealers and their Customers issued on 7.11.2013

Examination Findings Supervision Department Comments

PABPD has failed to obtain fresh customer PABPD should develop a proper procedure instructions for continued roll-over of to obtain fresh customer instructions investments over one-year period. Also, it has from the customers, for all roll-overs failed to establish a written procedure to extending over a period of one year, obtain fresh instructions for the roll-over obtain approval from the Board of the instructions byParliament the customers as and when a PABC for the same and make relevant transaction requires a roll-over. changes to the process.

Primary Dealers Comments

• Noted for Future Compliance. • As we have now gone live on new treasury system, i.e. “Finacle Treasury” we have implemented a process to notify the maturing Repo / Reverse Repo portfolios to the

126 Refer Exhibit 34 for Statement of P M C S Gunawardana

Strictly Private and Confidential Page 127 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

clients and renew such contracts on or before the maturity, based on customer fresh instructions. • We shall obtain the required approvals of the Board as stipulated

Examiners - T M B A Goonetilleke and N D S Kumara. Examiner In-Charge - U P Jayasinghe. ASPD / SPD - N W G R D Nanayakkara, C M D N K Seneviratne and T H B Sarathchandra

Deficiencies noted in the procedures followed during examination

• The extent of deviation in terms of count of transactions, number of customers, frequency of occurrence and transaction value were not assessed. The adequacy of (mitigation) action plan cannot be assessed in the absence of such details of the depth / extent of deficiencies noted; • The possibility that, the Primary Dealer’s transactions without underlying instructions from the client, could indicate potential financial improprieties or missing business ethics, is not assessed by the examiner; • Missing customer authorization for the roll-over indicates gaps in monitoring mechanism at Primary Dealers including missing controls, review and reconciliations and missing internal audit reviews for timely detection of such gaps. The examiner's finding did not highlight the root cause and oversightCopy deficiencies; • The reviewer’s remarks / noting on examination work paper do not indicate the identification of procedural deficiencies identified during the review process; • The mitigation measures defined may not be appropriate enough to counter the extent of gap identified, based on the defined parameters; • The timeline for compliance by Primary Dealer for carrying out rectification was extended by three quarters without any documented rationale for extension; • The time-bound action plan did not document the action performed by the Primary Dealer for the stated remediation timeline for improvement. Comments from Primary Dealer indicate futuristic compliance without a defining specific timeline for each remedial aParliamentction. There is a missing clarity as to how the supervision department considered the appropriateness of the response for future assessment of compliance; and • Documents were not maintained in the examination relating to the review of implementation made by the Primary Dealers as part of time bound action plan. In the absence of the same, it is not possible determine if the non-reporting to Monetary Board is appropriate or otherwise.

Strictly Private and Confidential Page 128 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Observation 3 – Examination period February 2014

Violation of the Scripless Treasury Bills (Transactions) Regulations No. 02 of 2004 and Scripless Treasury Bonds (Transactions) Regulations No. 02 of 2004

Examination Findings Supervision Department Comments

PABC has failed to separate own PABC should take necessary measures to take transactions from customers immediate action to discontinue the use of the transactions. Even though PABC customer bank account for/PABC transactions. maintains a separate bank account for monies due to its customers as required by the Section 6(2)(d) of the cited regulations, it had used the said dedicated customer bank account to make brokerage payments.

Primary Dealers Comments

Discontinued the use of customer bank account for payment of brokerage transactions effective 1 March 2014. Copy Examiner – T M B A Goonetilleke and G G N H Jayasinghe. Examiner In-Charge - D S Thenuwara. ASPD / SPD - N W G R D Nanayakkara.

Deficiencies noted in the procedures followed during examination

• The extent of deviation in terms of count of transactions, amount of brokerage payments done through the bank account, frequency of occurrences was not assessed. The adequacy of (mitigation) action plan cannot be assessed in the absence of the such details of the depth / extent of deficiencies noted; • The possibility that, the Primary Dealer’s transactions in violation to the said regulations,Parliament could indicate potential financial improprieties or missing business ethics, is not assessed by the examiner; • The absence of usage of dedicated bank account for brokerage transaction indicates gaps in monitoring mechanism at Primary Dealers, missing controls, review and reconciliations and missing internal audit reviews for timely detection of such findings. The examiner's finding did not highlight the possibility of such deficiencies; • The reviewer’s remarks/ noting on examination work paper do not indicate the above deficiencies identified during the review process or the examiner was asked to gather facts around the above possible deficiencies; • The mitigation measures recommended were not appropriate to counter the extent of gaps identified in examination procedures;

Strictly Private and Confidential Page 129 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

• There is missing clarification as to how the supervision department considered the appropriateness of the response for future assessment of compliance; • Details as to how the implementation was tested by the examiner, are not available on records; and • No remedial action defined in terms of penalty etc. to avoid this kind of non- compliance.

On review of the examination conducted on Natwealth Securities Limited (“NWSL”), the following are the key findings noted during the examination:

Observation 1 – Examination period July 2012 and January 2014

Non-compliance with System Rules of LankaSettle, Version 2, issued in September 2009 on usage of Intra-Day Liquidity Facility (ILF)

Examination Findings Supervision Department Comments

Use of customers’ Securities as NWSL should immediately discontinue the collateral for obtaining ILF facility unauthorized usage of Securities that belong to without the knowledge of such customers forCopy obtaining ILF facility and put in customers i.e. Lankaputhra place an internal control mechanism to ensure Development Bank. strict compliance with the said System Rule.

Primary Dealers Comments

Already being addressed.

Examiner - In 2012 examiners were L P S Perara and K M U I Kanakarathne and in 2014 examiner were D S Thenuwara, W N S Fernando and G G N H Jayasinghe. Examiner In- Charge - In 2012 EIC was K P K Weerasekara and in 2015 EIC was T M B A Goonetilleke. ASPD / SPD - NParliament W G R D Nayanakkara Deficiencies noted in the procedures followed during examination

• The above findings are repeated violation and same findings were noted in July 2012 and January 2014. However, no action was taken against Primary Dealer for second instance of non-compliance as per Section 2.2.2.1 of System Rules of Lankasettle; • The extent of deviation in terms of count of transactions, number of customers, frequency of occurrence and total transaction value were not assessed. The adequacy of (mitigation) action plan cannot be assessed in the absence of the details of the depth / extent of deficiencies noted; • Detailed assessment on the method / procedure performed to arrive at the observation was not available;

Strictly Private and Confidential Page 130 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

• The examination work paper does not indicate the identification of sample considered during the examination; • The action plan is not comprehensive covering the measures to be taken to mitigate the above deficiencies noted during the examination file; • Use of customer Securities for obtaining ILF indicates gaps in monitoring mechanism at Primary Dealers, missing controls, review and reconciliations and missing internal audit reviews for timely detection of such gaps. The examiner's finding did not highlight the root cause and oversight deficiencies; • Details as to how the implementation was tested by the examiner, are not available on examination work-paper. In the absence of the same, it is not possible to determine if the reporting to the Monetary Board is appropriate or otherwise; • Absence of Sampling methodology and examination procedure to be followed during the review process; and • Absence of rating mechanism defined for the finding noted during the examination.

Observation 2 – Examination period January 2014

Roll-over of customer investments for extended periodsCopy without fresh instructions

Examination Findings Supervision Department Comments

• Re-investments of customer • NWSL should immediately take necessary balances upon maturity have been steps to make sure all investments and done for over one-year period subsequent roll-over of investments is without receiving fresh supported by a customer request. instructions from the respective • If the product matures more than one time customers. during a year, NWSL shall obtain new • It was observed that certain deal written instructions from the customer on a tickets have been raised without Parliamentyearly basis. written requests of the customers. • If the maturity of product happens in more than one-year cycle, automatic roll-overs are not allowed and should obtain such instructions at the time of each maturity

Primary Dealers Comments

Concern was noted, and steps are being taken to get fresh instructions from client for rollovers.

Strictly Private and Confidential Page 131 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

The process of obtaining such instruction will be started immediately and outstanding ones will be completed by 30 Jun 2014.

Examiner - D S Thenuwara, W N S Fernando and G G N H Jayasinghe. Examiner In- Charge – T M B A Goonetilleke. ASPD / SPD - N W G R D Nayanakkara.

Deficiencies noted in the procedures followed during examination

• Methodology used for arriving at the observation was not clear; • The examination work paper does not indicate identification of sample during the examination; • The extent of deviation in terms of count of transactions, number of customers, frequency of occurrence and the total transaction value were not assessed. The adequacy of (mitigation) action plan cannot be assessed in the absence of such details of the depth / extent of deficiencies noted; • Missing customer authorization for the roll-over indicates gaps in monitoring mechanism at Primary Dealers, missing controls, review and reconciliations and missing internal audit reviews for timely detection of such gaps. The examiner's finding did not highlight the possibility of such deficiencies; • Observation noted during On-site examinations wereCopy not identified earlier during off- site surveillance; • Details as to how the implementation was tested by the examiner, are not available on records. In the absence of the same, it is not possible determine if the reporting to the Monetary Board is appropriate or otherwise; • No defined examination procedure aligned with the questionnaire and areas defined in the work allocation; and • No remedial action defined in terms of penalty etc., to avoid this kind of non- compliance. Parliament

Strictly Private and Confidential Page 132 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Observation 3 – Examination period August 2009

Absence of separate records on transactions of employees, which is a requirement under the Code of Conduct

Examination Findings Supervision Department Comments

Though employees of the Primary Dealer have To maintain separate records on done investments with the company no transactions of employees. records have been kept separately which is a requirement under the Code of Conduct issued by the PDD.

Primary Dealers Comments

Already implemented; A file has been opened and; Reports will be generated monthly.

Examiner - R M A S K Ratnayake. Examiner In-Charge - R D T Gunasekara. ASPD / SPD - C J P Siriwardena.

Deficiencies noted in the procedures followed during examination

• Completeness of review for clause 3.4 of the CodeCopy of Conduct could not be identified due to non-availability of work allocation sheet; • EIC has not evaluated the functions of Compliance Officer cited in the Code of Conduct i.e. quarterly reporting of non-compliance of Primary Dealer to the supervision division; • Methodology used for arriving at the observation was not clear; • The examination work paper does not indicate the identification of sample during the review process; • The extent of deviation in terms of count of transactions, number of employees, frequency of occurrence was not assessed. The adequacy of (mitigation) action plan cannot be Parliamentassessed in the absence of the details of the depth/ extent of deficiencies noted; • Details as to how the implementation was tested by the examiner, are not available on records. In the absence of the same, it is not possible determine if the non- reporting to the Monetary Board is appropriate or otherwise; • No defined examination procedure aligned with questionnaire and areas defined in the work allocation; and • No remedial action defined in terms of penalty etc. to avoid this kind of non- compliance

Strictly Private and Confidential Page 133 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

On review of the examination conducted on Entrust Securities Limited (“ESL”), the following are the key findings noted during the examination:

Observation 1 – Examination period September 2011

Non-compliance with the System Rules relating to Intra-Day Liquidity Facility

Examination Findings Supervision Department Comments

ESL uses the customer Securities to obtain the ILF Not Available. facility, which is clearly restricted by the Lanka Settle System Rules. The participants are clearly instructed to use their own Securities in obtaining the ILF.

Primary Dealers Comments

We have addressed this issue and negotiating with few banks to obtain ILF facilities. Will be rectified soon.

Examiner - L P S Perera and S D C P P Fernando. Examiner In-Charge - K P K Weerasekera. ASPD / SPD - S S Ratnayake. Copy Deficiencies noted in the procedures followed during examination

• The extent of deviation in terms of count of transactions, the amount obtained through Intra-Day Liquidity Facility, frequency of occurrence was not assessed. The adequacy of (mitigation) action plan cannot be assessed in the absence of the details of the depth/ extent of deficiencies noted; • The use of the said customer Securities indicates gaps in monitoring mechanism at Primary Dealers, missing controls, review and reconciliations and missing internal audit reviews for timely detection of such gaps. The examiner's finding did not highlight the possibility of such deficiencies; • The reviewer’sParliament remarks/ noting on record do not indicate the above deficiencies identified during the review process or the examiner was asked to gather facts around the above possible deficiencies; • The mitigation measures defined may not be appropriate enough to counter the extent of gaps identified, based on the above parameters; • There is missing clarification as to how the supervision department considered the appropriateness of the response for future assessment of compliance; and • Details as to how the implementation was tested by the examiner, are not available on records.

Strictly Private and Confidential Page 134 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Observation 2 – Examination period September 2011

Counter party limits are not fed into the system

Examination Findings Supervision Department Comments

Though ESL has Board approved counter Feed counter party limits into the system. party limits, those limits are not fed into the system.

Primary Dealers Comments

The Counterparty limits are currently manually monitored. However, discussions are being carried out with the System Developers to assess the possibility of monitoring same from the system.

Examiner - L P S Perera and S D C P P Fernando. Examiner in-Charge - K P K Weerasekera. ASPD / SPD - S S Ratnayake.

Deficiencies noted in the procedures followed during examination

• The extent of deviation in terms of number of instances in which the limits were manually fed into the system, frequency of occurrenceCopy was not assessed. The adequacy of (mitigation) action plan cannot be assessed in the absence of the details of the depth/ extent of deficiencies noted; • The possibility that, the Primary Dealer’s transactions in violation to the said regulations, could indicate potential financial improprieties or missing business ethics, is not assessed by the examiner; • The manual feeding of limits in the system indicates gaps in monitoring mechanism at Primary Dealers, missing controls, review and reconciliations and missing internal audit reviews for timely detection of such gaps. The examiner's finding did not highlight the possibility of such deficiencies; • The reviewer’sParliament remarks / noting on record do not indicate the above deficiencies identified during the review process or the examiner was asked to gather facts around the above possible deficiencies; • The mitigation measures defined may not be appropriate enough to counter the extent of gaps identified, based on the above parameters; • There is missing clarification as to how the supervision department considered the appropriateness of the response for future assessment of compliance; and • Details as to how the implementation was tested by the examiner, are not available on records.

Strictly Private and Confidential Page 135 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

On review of the examination conducted on Perpetual Treasuries Limited (“PTL”), the following are the key findings noted during the examination:

Observation 1 – Examination period 2014 and 2015-16

Related Party Transactions

Examination Findings Supervision Department Comments

Entered into non-arm’s length PTL should ensure rate offered to related transactions with its holding company parties are in line with market rates and the i.e. Perpetual Capital Holdings Private risk management function should carry out a Ltd (PCHPL). weakly sanity check on related party transactions. The sample checked revealed that PTL has offered significantly high rates to PCHPL compared to its other counterparties.

Primary Dealers Comments Noted Copy Examiner - In 2014 examiner were, N D S Kumara and L T Amarasinghe and in 2015/16 examiner were S P Sedara, A S Fernando, J P B Ishanthi and P M C S Gunawardana. Examiner In-Charge - In 2014 EIC was D S Thenuwara and in 2015 EIC was W N S Fernando. ASPD / SPD - In 2014 SPD was N W G R D Nanayakkara and in 2015/16 SPD was T H B Sarathchandra and Director of the DSNBFI was U P Alawattage.

Deficiencies noted in the procedures followed during examination

• There were related parties existed in 2014 examination, however that was not highlighted in 2014 examination; • MethodologyParliament used for arriving at the observation was not clear: - The examination work paper does not indicate the identification of sample during the review process; - The reviewer’s remarks/ noting on record do not indicate the above deficiencies identified during the review process or the examiner was asked to gather facts around the above possible deficiencies; - The implementation recommendation is not comprehensive covering the measures to be taken to mitigate the above deficiencies at the Primary Dealer; • The extent of deviation in terms of count of transactions, number of related parties, frequency of occurrence was not assessed. The adequacy of (mitigation) action plan cannot be assessed in the absence of the details of the depth/ extent of deficiencies noted;

Strictly Private and Confidential Page 136 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

• No remedial action carried out in terms of penalty etc. to avoid this kind of non- compliance in the future; and • Review period of data, sampling technique and completeness check of data for examination is not clearly stated in operational manual for supervision division.

Observation 2 – Examination period 2014 and 2015-16

Non-availability of a contingency funding plan

Examination Findings Supervision Department Comments

In spite of the undertaking given by PTL The senior management of PTL should expedite to put in place a contingency funding formulating a Board approved contingency arrangement, PTL has failed to comply funding plan consisting of a standby liquidity as of examination date. facility with a licensed commercial bank to bridge any unforeseen liquidity shortfall, before June 30,2015. Primary Dealers Comments Copy • Noted to obtain a Bank facility to meet our liquidity shortfall with the BOD approval within the time granted to us • Later extension was requested till 31-Oct-15, because of not having audited account • No banks had agreed to provide funding, letter of comfort issued by sister concern “W M Mendis and Co Ltd.” dated 1-7-2016.

Examiner - In 2014 examiner were, N D S Kumara and L T Amarasinghe and in 2015/16 examiner were S P Sedara, A S Fernando, J P B Ishanthi and P M S Gunawardana. Examiner In-Charge - In 2014 EIC was D S Thenuwara and in 2015 EIC was W N S Fernando. ASPD / SPD - In 2014 SPD was N W G R D Nanayakkara and in 2015/16 SPD was T H B Sarathchandra and Director ofParliament the DSNBFI was U P Alawattage and W Ranaweera Deficiencies noted in the procedures followed during examination

• Repeated observation noted for the period 2014 till suspension; • Absence of rational for extension of remediation timelines and implications for non- compliance not clearly stated; • Methodology used for arriving at the observation was not clear; • Details as to how the implementation was tested by the examiner, are not available on records. In the absence of the same, it is not possible determine if the non-reporting to the Monetary Board is appropriate or otherwise; • The timeline for compliance by Primary Dealer for carrying out rectification was extended without any rationale for extension;

Strictly Private and Confidential Page 137 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

• There is no specific procedure defined for repeated non-compliances for key risk to ensure the remediation actions to be carried out appropriately and within stipulated time frame; and • No remedial action carried out in terms of penalty etc. to avoid this kind of non- compliance in the future

Observation 3 – Examination period 2014 and 2015-16

Signature verification of customers

Examination Findings Supervision Department Comments

Maintains database of scanned Entity should take necessary steps to scan all authorized signatures for cross signature templates in the system and ensure verification of customer payment signature verification of customer instructions, instructions. immediately.

As per observation, some scanned signatures are not available for cross verification of customer requests. Copy

Primary Dealers Comments

As of date all existing customer signatures are scanned and are available for verification

Examiner - In 2014 examiner were, N D S Kumara and L T Amarasinghe and in 2015/16 examiner were S P Sedara, A S Fernando, J P B Ishanthi and P M C S Gunawardana. Examiner in-Charge - In 2014 EIC was D S Thenuwara and in 2015 EIC was W N S Fernando. ASPD / SPD - In 2014 SPD was N W G R D Nanayakkara and in 2015/16 SPD was T H B Sarathchandra and Director of the DSNBFI was U P Alawattage Deficiencies notedParliament in the procedures followed during examination • In 2014, the observation has not been included in the letter of findings sent to Primary Dealers and also not included for reporting of the Monetary Board; • Methodology used for arriving at the observation was not clear whether the examination work paper does not indicate the identification of sample during the review process; • The extent of deviation in terms of number of customers, frequency of occurrence, value of transactions etc. was not assessed. The adequacy of (mitigation) action plan cannot be assessed in the absence of the details of the depth/ extent of deficiencies noted; • Rational for omitting / deletion of any observations noted during the examinations is not provided;

Strictly Private and Confidential Page 138 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

• Details as to how the implementation was tested by the examiner, are not available on records. In the absence of the same, it is not possible determine if the non-reporting to the Monetary Board is appropriate or otherwise; • No remedial action carried out in terms of penalty etc. to avoid this kind of non- compliance in the future; and Review period of data, Sampling technique and completeness check of data for examination is not clearly stated in operational manual for supervision division.

Key findings noted for NWSL spot examination- August 2014

Background-A letter from NWSL was received on 31 July 2014 informing the resignation of CEO. Market is of the opinion NWSL is facing internal issues. Therefore, the market assumes it is risky to trade with / lend to NWSL. The Spot Examination covered the issue relating to the tax liability, dealer limits and violation reports, repo / re-repo allocations, transactions with Trillion Securities Pvt (TSL) and Virtual Investment and Trading Lanka Ltd (VTL), personal files of selected employees, dealer communications for transactions with TSL and VTL and the broker fees. Copy Examination Finding Supervision Department Comments

• NWSL has Board Approved Dealer Limits and NWSL should take necessary actions such approval had been granted on 31 March to set up proper system to review 2014 Dealer limits on an on-going basis

• Also, the IT system (Deal Net) support monitoring of Dealer Limits on an on-going basis • However, it was observed that dealers have exceeded the limits and getting approval for those breachesParliament from Riyaz - CEO (via a memo) after executing the deal

Deficiencies noted in the procedures followed during examination

• No defined work plan available for the examination performed • The extent of deviation in terms of name of the dealers, number of dealers, count of transactions, frequency of occurrence and value of transaction were not assessed. The adequacy of mitigation plan cannot be assessed in the absence of the details of the depth/ extent of deficiencies noted. • The mitigation measures defined may not be appropriate enough to counter the extent of gaps identified.

Strictly Private and Confidential Page 139 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

• No document was available in the examination files relating to the findings sent to Primary Dealer for the ratification / implementation. Further, no Primary Dealer comments were available relating to implementation of dealer limits review.

KEY FINDING NOTED DURING SPOT EXAMINATION-WTSL- JUNE 2013

Document relating to objective for the spot examination was unavailable in the examination file.

Examination Finding Supervision Department Comments and Primary Dealer comments

• 38 numbers of customer mandates were Supervision Department comment- checked. It was observed some mandates do Maintain complete customer profiles not include signature template and supporting for all the customers, before documents, (copies of National Identity Card November 30,2013 (NIC) and Certificate of Incorporation) Primary Dealer comment- 1 July • Example: 2013 Letter from WTSL 1. C S P Ramanayaka - Copy of NIC not Copy All customer profiles supported by available signature templates and other 2. Commercial Bank - Authorized Signature supporting documents where template not available applicable are complete and 3. HNB Securities Ltd - Authorized documented Signature template not available 4. HNB Assurance - Copy of Certificate of 8 July 2013 meeting with SPD Incorporation not available Customer Mandates: To commence 5. Management Corporation condominium - immediately and completed by Copy of Business registration form not October 2013 availableParliament

6. Catholic Bishop Conference - Copy of Business registration form not available 7. International Water Management - Copy of Business registration form not available

Strictly Private and Confidential Page 140 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Deficiencies noted in the procedures followed during examination

• The examiner has not mentioned the work-step performed covering each activities and documentation carried out for adhering to KYC norms. • The extent of sample and population considered is not documented. • The extent of deviation in terms of number of customers, frequency of transactions and their value were not assessed. The adequacy of (mitigation) action plan cannot be assessed in the absence of the details of the depth / extent of deficiencies noted. • As per Primary Dealer operational manual, a Primary Dealer has to maintain records to verify the identity of counterparties and ascertain the counterparties’ source of funds. The supervisory concerns identified by examiner does not specify list of transactions entered with such customers and various potential risks of money laundering on transactions carried with such identified customers. • Action plan recommended by the examiner does not comprehensively restrict Primary Dealer from such non-compliance in future and to mitigate the identified non- compliance.

It can be concluded that there were gaps in the comprehensive Copyverification of the KYC documents of the customers.

1. During an interview, with W N S Fernando, Senior Assistant Director, stated that as part of the examination process, the KYC documents of the customers were checked including the availability of the NIC, registration documents and other preliminary documents. However, the document verification for authenticity cannot be performed by the CBSL employees due to lack of tools or resources to do so (Refer Exhibit 30)127.

2. During an interview, with T H B Sarathchandra, SPD – the PDD, stated that there are no defined procedures for verifying the existence of the customer and compliance with KYC norms. There were instances whereParliament the customer agreements with customer and signature details were not available and furthermore the department had not performed any procedures to ensure that the customer transactions were legitimate (Refer Exhibit 29)128.

The above design deficiencies were noted across the Review Period and implies the responsibility of the SPD, the PDD and Director, the DSNBFI for rectification during their tenure. (Refer Table 13).

127Refer Exhibit 30 for Statement of Fact – W N S Fernando 128 Refer Exhibit 29 for Statement of Fact - T B H Sarathchandra

Strictly Private and Confidential Page 141 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Key finding noted during spot examination-ESL- August 2010

Document relating to objective for the spot examination was unavailable in the examination file.

Examination Finding Supervision Department Comments and Primary Dealer comments

• Non-recording of transactions done by Sri Supervision Department comment- Lanka Telecom - Provident Fund (SLT-PF) Further investigation is necessary to • A mismatch between the amount invested establish how they had utilized the in Government Securities by the SLT - PF funds obtained through ILF.ESL has and the amount outstanding in the Lanka breached the following regulations and Secure system was revealed. is carrying on the business in a manner • ESL had originally recorded all the harmful to the investors and to the outright transactions done with the SLT- stability of the Primary Dealer system.

PF in the Lanka-Secure system. However, Primary Dealer comment- The officers subsequently they had reversed most of of ESLCopy said that they recorded a lesser those entries creating the above amount in the Lanka-Secure than the mismatches. actual investments based on the mutual • As a result, the customer is exposed to a understanding with the counterparty, very high-risk due to non-recording of verbally, on the basis that the client ownership in the Lanka-Secure system. would be offered a higher interest rate. • Since the revelation of the above incident, They also revealed that they had been records in the Lanka-Secure of another engaged in this practice for the last few customer of ESL was reviewed. It was years. They also said that the funds so found that ESL had utilized the Securities obtained were lent to Entrust Limited of the said Parliamentcustomer to obtain ILF facility by ESL. These statements should be from the Central Bank on a regular basis. verified with their records.

Deficiencies noted in the procedures followed during examination

• The Primary Dealer comments as recorded by the department indicate that the Primary Dealer didn’t comply with the CBSL rules. There is missing clarification as to how the supervision department considered the appropriateness of the response for compliance purpose. The response indicates that the non-recording of the transactions was a regular feature in which the Primary Dealer business was carried out.

Strictly Private and Confidential Page 142 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

• The adequacy of mitigation action plan cannot be assessed in the absence of the details of the depth / extent of deficiencies noted to counter the extent of gaps identified. • The extent of risk due to non-recording of the ownership in the Lanka-Secure system was not assessed. • Missing customer details in terms of customer authorization etc. indicates gaps in monitoring mechanism at Primary Dealers, missing controls, review and reconciliations and missing internal audit reviews for timely detection of such gaps. The examiner's finding did not highlight the possibility of such deficiencies. • The finding noted are repeated in September 2011 and May 2015 onsite reviews. • Details as to how the implementation was tested by the examiner, are not available on records. In the absence of the same, it is not possible determine if the reporting to the Monetary Board is appropriate or otherwise.

Key finding noted during spot examination of PTL- September 2015

PTL had published a newspaper advertisement on 14.9.2015 offering a 7.5% annualized return for 2-week, 1 month, 2-month and 3-month Repos.Copy The examination focused on the procedures being followed by PTL in offering the said rate

Examination Finding Supervision Department Comments and Primary Dealer comments

• Spot Examination Finding-Allocation of Supervision Department comment- Securities- Sufficient Securities had been Take action to ensure that adequate allocated to outstanding repo transactions Securities are allocated for as at 17-September-2015. outstanding repurchase transactions. A • Onsite Examination finding- Non- mechanism, including regular reviews complianceParliament with the Direction on by the internal audit function should Repurchase and Reverse Repurchase be put in place to ensure proper Agreements (2 May 2002)- PTL has failed allocation of Securities for all to allocate adequate Securities for some repurchase and reverse repurchase customers against the borrowings from transactions with customers. the customers under Repurchase Immediately

Agreements Primary Dealer comment- PTL has • Details of under-allocation of Securities granted Rev Repos to customers who for repurchase transactions as at 30- have been under allocated. September-2015 Accordingly, the net security requirement has been allocated

Strictly Private and Confidential Page 143 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Deficiencies noted in the procedures followed during examination

• As per on-site examination for the period 30 September 2015, noted that the Securities allocation is not adequately been maintained however as per offsite examination during the period 17 September 2015, the Securities allocation is adequately being maintained. The remarks stated in both examinations are contradicting. • The extent of deviation in terms of number of customers, frequency of transactions and their value were not assessed. The adequacy of (mitigation) action plan cannot be assessed in the absence of the details of the depth/ extent of deficiencies noted • Inadequate security allocation indicates gaps in monitoring mechanism at Primary Dealers, missing controls, review and reconciliations and missing internal audit reviews for timely detection of such gaps. The examiner's finding did not highlight the possibility of such deficiencies.

The above design deficiencies were noted across the Review Period and implies the responsibility of the SPD, the PDD and Director, the DSNBFI for rectification during their tenure. (Refer Table 13).

Copy 7.24. REPEAT FINDINGS INDICATING GAPS IN FOLLOW-UP OR REMEDIATION

SCOPE COVERAGE

Examining the laws, regulations, policies, circulars, guidelines, manuals etc. applicable to Regulation and Supervision of Primary Dealers and ascertaining if there were any deviations from relevant laws, regulations, policies, circulars, guidelines, etc. in performing the role of Regulation and Supervision of the selected Primary Dealers.

7.24.1. Review of on-site examination reports along with supporting work papers revealed that certain critical non-compliances were repeated by the Primary Dealers across Review Period (Refer AnnexureParliament 8)129.

129 Refer Annexure 8 for Repeat Findings indicating gaps in follow-up or remediation

Strictly Private and Confidential Page 144 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.24.2. It can be concluded that there was gap in the review process during the finalisation of Report along with the follow-up and remediation procedures followed because of which the repeat findings were again highlighted in the next examination Report. Furthermore, it can be concluded that the non-compliances are not taken up seriously by the Primary Dealers as there is no strict regulatory action for the same and the occurrence of findings across multiple Primary Dealers indicates potential systemic deficiencies that necessitate strengthening the review mechanism and targeted regulatory actions.

7.24.3. During an interview, L.T Amarasinghe, Examiner – Onsite examinations for the period July 2014 to September 2015, stated that the repeated findings of the onsite examination done for WTSL in 2013 with respect to availment of roll over facility was also highlighted in onsite examination done in 2014 but the same was not highlighted as a repeated finding in 2014 examination Report. (Refer Exhibit 32)130.

7.24.4. During an interview, S P Sedara, Examiner – Onsite Examinations, for the period July 2015 to till date, stated that repeated non-compliances by Primary Dealers especially in areas such as entering into agreements (MRA and customer agreements) with customers. These non- compliances were because of lack of seriousness by Primary Dealers about the requirements imposed by Regulations and Directions. The responsibilCopyity for recommending the regulatory action to mitigate the non-compliances observed during onsite examinations starts with the EIC and moves up to all the employees who review the examination Report and Board paper. (Refer Exhibit 35)131.

7.24.5. During an interview, D S Thenuwara, EIC / Examiner for Onsite Examinations, for the period February 2013 to February 2016, stated that the repeated observations identified were communicated to the Monetary Board. However, department could send letters to the relevant Primary Dealers asking to take necessary measures to rectify the stated concerns. No additional recommendations were ever given by the top management for the same. (Refer Exhibit 36)132.

7.24.6. The above designParliament deficiencies were noted across the Review Period and implies the responsibility of the SPD, the PDD and Director, the DSNBFI for rectification during their tenure. (Refer Table 13).

130 Refer Exhibit 32 for Statement of fact – L T Amarasinghe 131 Refer Exhibit 35 for Statement of fact – S P Sedara 132 Refer Exhibit 36 for Statement of Fact – D S Thenuwara

Strictly Private and Confidential Page 145 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.25. NON-REPORTING TO THE MONETARY BOARD

SCOPE COVERAGE

7.25.1. Examining the laws, regulations, policies, circulars, guidelines, manuals etc. applicable to Regulation and Supervision of Primary Dealers and ascertaining if there were any deviations from relevant laws, regulations, policies, circulars, guidelines, etc., in performing the role of Regulation and Supervision of the selected Primary Dealers.

7.25.2. The following observations were recorded in the “Examiner’s Report” but not reported to the Monetary Board. The rationale for not reporting the observation and additional information/ documentation considered is not documented in the examination file.

Table 32 – List of observations not reported to the Monetary Board

# OBSERVATION PRIMARY YEAR OF DEALER EXAMINATION NAME 1 Signature verification of customers – Primary Dealers PTL Oct-14 maintains database of scanned authorized signatures for cross verification of customer payment instructions and the same were not available for cross verification of customer requests Copy 2 No regular updates for the IT and information security policies, subsequently no approval from the PTL board 3 No regular updates for the IT and Operational manuals, WTSL Nov-13 subsequently no approval from the WTSL board 4 Unavailability of e-trading facility. WTSL should look into the possibility of obtaining this facility

5 Incomplete organizational structure – it does not clearly indicate reporting lines, authorization levels and personnel 6 Excessive brokerage fees paid to SMB Money Brokers Limited Parliament 7.25.3. There are no defined guidelines / procedure in operational manual of the supervisory function, to be followed to omit the initial findings noted in examination. The following observations were reported by the individual examiner; however, the observations have not been included in the draft supervisory concerns and Monetary Board paper.

Strictly Private and Confidential Page 146 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.25.4. On review of the on-site examination conducted for PABC during the period from February 2015 and March 2016, following are noted: (Refer Annexure 18)133.

7.25.5. The examination performed, and the findings were not reported to the Monetary Board for two (2) consecutive periods. Further, absence of any documented rationale for omission/ deletion of the reporting to the Monetary Board and the last on-site examination Report submitted to Monetary board was on February 2014.

7.25.6. The findings and recommendations for the corrective action were also not communicated to PABC for the period March 2016 and following key findings noted during the period:

Table 33 – List of key findings noted

# KEY EXAMINATION FINDINGS 1 Violation of Lanka Settle System Non-compliance with the Scripless Treasury Bills Rules Version 2.1 (2013) – Non- and Bonds – PABPD has failed to maintain a recording of transaction in CDS separate bank account for monies due to its systems. customers 2 PABPD’s transfers the outright A sample verification of related party purchased security of a customer transactions revealed that, there are deviations directly to Re-repo account and in offered Buy/Sell rates to the customer difficulties in identifying the security compared to Daily Report rates and competitor allocation for outright transactions offered rate Copy for such customers in CDS 3 PABPD had failed to enter into PABPD has failed to obtain fresh customer agreements with 20 out of 132 instructions for continued roll-over of customers having Repo transactions investments. Sample verification revealed that the following investments have been rolled over 4 The percentage of repurchase and re- without customers’ written requests. This is a repurchase transaction outstanding repeated violation of top five counter parties account for 63 per cent and 97 per cent of the total outstanding as at 31 January 2016 respectively. It is observed that 37 per cent of the reverse repurchase value outstanding and 17 per cent of the repurchase value outstanding are with relatedParliament parties.

133 Refer Annexure 18 for Non-reporting of examination Report to the Monetary Board

Strictly Private and Confidential Page 147 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.25.7. On the following events noted on the review of the application and appointment document

COMMENTS DATE Draft LOF is submitted by SAN/ NSF to DDA 24-May-16 Draft LOF submitted to D/SNBFI, Act Add director, DD/A and H/PDSU 7-Oct-16 by SAD/ASF Note by S J K Guruge (HOD) to D/SNBFI, Additional director and DD(A) 1-Nov-16 Seek advice whether to conclude the examination conducted till 30 Jan 16 or to do a follow up examination to cover the period till 30 Jun 16 to incorporate current information to the report Note by DD(A) to DSNBFI and Additional director 1-Nov-16 - refer to S J K Guruge minute - Capital gain was generated from the transactions with PABC by PTL - with a view to continue the examination to cover primary and secondary market transactions and comment on status of non- compliances identified Note by DD(A) to DSNBFI 1-Nov-16 Further I agree that the examination be conducted to examine the present position within a short period of time Note to Additional director, DD/A and SAD/Guruge 2-Nov-16 To start a fresh onsite examination to update/validate the findings of unconcluded examination. Check the transactions with other Primary Dealers like PTL to have risk based on new examinationCopy methodology. You may think the malpractices exposed in Entrust and PTL too

7.25.8. Despite several issues noted during the onsite examination of PABC and Issues noted in PTLs’ spot examination on the involvement of PABC in the market manipulation, the observation noted in the examination was not reported to the Monetary Board instead SPD instructed to the start a fresh onsite examination to conclude the examination report. Further there was no onsite examination been conducted for the Primary Dealer.

7.25.9. On discussion with the examiner in-charge during the period March 2016, it was informed that the EIC responsible for the issuance of examination Report have been transferred to another departmentParliament and no handover procedures been carried out for transferring the responsibilities to other team member.

7.25.10. There is no evidence of SPD / the DSNBFI notification for the submission of examination Report and finding noted during the examination. It can be concluded that no rationale was documented for non-submission of reports for the respective examinations conducted of PABC.

Strictly Private and Confidential Page 148 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

7.25.11. During an interview, S J K Guruge, Head of Division, SNBFI, for the period August 2011 to October 2012 and June 2016 to till date, stated that the examination reports of PABC for the period 2015 and 2016 were outdated, hence then director – U P Alawattage instructed to conduct fresh examination to update / validate the findings reported in the respective examination reports. Further the reasons for non-submission of the already prepared Report to the Monetary Board were unknown. (Refer Exhibit 33)134.

7.25.12. During an interview, A.S Fernando, Examiner- Onsite Examinations for the period October 2015 to July 2018, stated that the draft onsite examination Report of PABC for 2016 was submitted to Deputy Director (Ajith) and the Director (Alawattage) instructed to perform fresh examination and the Report was not presented to the Monetary Board. (Refer Exhibit 31)135.

7.25.13. During an interview, W Ranaweera, Additional Director / Director for the period September 2016 to till date, stated that instructions were not given by U P Alawattage to submit the onsite examination Report of PABC for 2016 to the Monetary Board as an interim Report and he has instructed to continue with the ongoing examination to update / validate the findings of the concluded examination. (Refer Exhibit 19)136. 7.25.14. During an interview, T H B Sarathchandra, SPD – the PDDCopy for the period September 2015 to June 2016, stated that the delay / non-reporting of findings/ Report to Monetary Board was due to denial of the approval to submit Board paper by P Samarasiri, Deputy Governor. He further stated that the Deputy Governor had instructed to change the reporting template despite several findings noted during the examination of the Primary Dealers. (Refer Exhibit 29)137.

The above design deficiencies were noted across the Review Period and implies the responsibility of the SPD, the PDD and Director, the DSNBFI for rectification during their tenure. (Refer Table 13).

Parliament

134 Refer Exhibit 33 for Statement of Fact - S J K Guruge 135 Refer Exhibit 31 for Statement of fact – A S Fernando 136 Refer Exhibit 19 for Statement of Fact – W Ranaweera 137 Refer Exhibit 29 for Statement of Fact - T B H Sarathchandra

Strictly Private and Confidential Page 149 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

8. PUBLIC DOMAIN SEARCH

1. During a review of documents for Regulation and Supervision Function of Primary Dealers, there were instances wherein deviation / anomalies were noted in the process followed during the Regulation and Supervision functions of Primary Dealers. A list of 21 identified employees of the CBSL was prepared who were responsible for taking decisions related to Regulation and Supervision functions of Primary Dealers during the Review Period. (Refer Annexure 2)138. 2. As per the PCOI Report, one of the Primary Dealers, PTL, was alleged to have had conflict of interest and to verify the sources which could be involved in sharing sensitive information. 3. Public domain searches were conducted for 21 identified the CBSL employees, selected Primary Dealers and 104 Key Managerial Personnel of Primary Dealers to identify possible nexus with them. (Refer Annexure 21)139. 4. The information regarding the identified CBSL employees was collated from various sources to the extent possible, to unveil any association with the Primary Dealers. The Due Diligence was conducted which consisted of online public record research to obtain their employment, professional and family background, news media to identify political / business affiliations, directorship details and adverse publicity and checkCopys on subscribed Global Compliance Databases. 5. The data regarding 5 (five) was also gathered from various sources including publicly available information, subscribed databases, Annual Reports as obtained from the respective company’s website and the data received from the Registrar of Companies (RoC). The detailed information of selected Primary Dealers for January 2009 to December 2017 were gathered and analysed which included the officer details, corporate records and filings to identify company details, corporate structure and its associated individuals. Additionally, the details were reviewed and analysed to the extent of publicly available information for Primary Dealers Parliamentand the identified employees of the CBSL.

138 Refer Annexure 2 for List of 21 identified personnel 139 Refer Annexure 21 for List of Primary Dealers’ directors and CEOs

Strictly Private and Confidential Page 150 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

POTENTIAL NEXUS BETWEEN IDENTIFIED EMPLOYEES OF THE CBSL AND PRIMARY DEALERS

A. Searches of information as available in the Public domain, subscribed database and media archives was performed to assess, any possible, link between the identified officials (current and former employees) and the employees (current and former) of the Primary Dealer. The identified officials were selected based on the review of documents and data provided by the CBSL and other data retrieved including the roles and responsibilities.

IDENTIFY ASSOCIATION BETWEEN THE OFFICIALS OF CBSL AND PRIMARY DEALERS

8.2.1. During the review of documents provided by the CBSL; there were deviation / anomalies were noted in the process followed and the supporting documents for regulation and supervision function carried out.

8.2.2. The identified officials operated in / worked in the supervision Department and officials having authority for approval or initiate action. Potential relationships which could turn out to be potential conflicts of interest, non-compliance with the CBSL Code of Conduct, professional misconduct or personal benefits were as follows:

A. Former officials of Supervision Division taking up positionCopy in other Primary Dealers; B. Social Media connections such as, personal and professional, between the CBSL officials and officials of other Primary Dealers; C. Relatives of CBSL officials in the roles of key staff employees of Primary Dealers; D. Business partnership and shareholding pattern in Primary Dealers and group companies by any higher management of the Primary Dealers involved in conducting regulation and supervision function; and E. Properties / assets held by the CBSL identified officials disproportionate to their remuneration.

8.2.3. The Due Diligence was conducted on the identified officials which covered public domain searches, press Parliament releases to identify business profile, business affiliations and adverse information through media archives. The searches were conducted for them on subscribed Global Compliance Databases to identify any involvement of these identified officials for illegal activity or litigation cases, if any.

8.2.4. During media checks performed for the former Governors of CBSL, it was noted that the relatives of the former Governors had beneficial interest, held key managerial positions through directorship or shareholding in other Primary Dealer and / or its associated company. Further, research was conducted and the below mentioned details were gathered for them:

Strictly Private and Confidential Page 151 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

A. AJITH NIVARD CABRAAL i. Ajith Nivard Cabraal (“Mr. Cabraal”) was appointed as Governor of Central Bank of Sri Lanka effective from July 2006. Until November 2005, Ajith Nivard Cabraal headed a management consulting company called Cabraal Consulting Group, specialised on corporate governance, the strategic planning and turnarounds. But he resigned from all his private positions to work full-time for CBSL. Ajith Nivard Cabraal was the Chief Economic Advisor to Mahinda Rajapaksa during his term period July 2006 to January 2015. ii. As per the Presidential Commission of Inquiry (“PCOI”) Report, electronic media and Annual Reports of various Primary Dealers and Banks supervised by the CBSL, former Governor Ajith Nivard Cabraal, while holding office from July 2006 to February 2015, had several of his close relatives appointed to the chief positions in Banks under the purview of CBSL. iii. Family relationships to be considered as conflict of interest, such as all direct descendants and ancestors, without regard to financial interests. The determination of the red flags from these identified relationships could led to a deliberation. iv. The Establishments Code of Democratic Socialist Republic of Sri Lanka issued in 1985 by the Public Administration Circulars. Copy As per the Establishment Code – Chapter XLVII: (Section: General Conduct Sub Section 1.5) “An officer shall not do anything which will bring his private interest into conflict with the public duty or which compromises his office. He should always so conduct himself as to avoid giving rise to any appearance of such conflict or of being so compromised.”

Parliament

Strictly Private and Confidential Page 152 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

FAMILY TREE OF AJIT NIVAD CABRAAL (TERM 2006- 2015) AND THEIR RELATIONSHIPS ASSOCIATED

Copy

Parliament

Strictly Private and Confidential Page 153 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

v. It was mentioned in PCOI Report and as noted during the public domain searches that the relatives of Ajith Nivard Cabraal held influential positions in Primary Dealers and / or related company of Primary Dealers, during his tenure as a Governor of the CBSL. vi. Noted that Siromi Noel Wickramasinghe and Shibani Renuka Thambiayah identified as relatives of Ajith Nivard Cabraal directly / indirectly connected to selected Primary Dealers. vii. Siromi Noel Wickramasinghe, sister of Ajith Nivard Cabraal was associated with the holding company of PTL, Perpetual Capital Holdings (Private) Limited as a Director from 23 December 2013 till 9 March 2015. The details with regards to her background were gathered from various sources which revealed that she was associated with HNB Assurance (fully owned subsidiary of HNB) as a Director from 2013 till 2017 and with Commercial Bank of Ceylon as a Director from 1 February 2009 till 26 May 2010. She was chairperson of the Housing Development Finance Corporation Bank of Sri Lanka (HDFC) from May 2010 till January 2015. It was gathered that Arjun Aloysius, son-in- law of Arjuna Mahendran (Governor of the CBSL from January 2015 till June 2016), was also associated with HDFC Bank during the said period and was appointed as a Director from May 2011*. It was noted that Siromi Noel Wickramasinghe was sharing key managerial positions at the holding companyCopy of PTL and previous organisation along with Arjun Aloysius and the details are as under:

Table 34 – Relationship of PTL and Siromi Noel Wickramasinghe

NAME OF NAME OF TYPE OF COMMON TENURE ORGANISATION INDIVIDUAL ASSOCIATION TENURE Siromi Noel May-2010 – Jan- Chairmanship Wickramasinghe 2015 HDFC 2010 –2012 Arjun Aloysius Director From May 2011*

Siromi Noel December 2013 Director Perpetual Wickramasinghe till 9 March 2015 December 2013 Capital Holdings Parliament Since its till 9 March 2015 (Private) Limited Arjun Aloysius Director inception on 10- Jun-2010 * The date of termination of association could not be confirmed. Arjun Aloysius’ association with the HDFC was not noted in the Annual Report of 2014 and onwards.

Strictly Private and Confidential Page 154 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

viii. Shibani Renuka Thambiayah, niece of Ajith Nivard Cabraal associated with Renuka Group where PTL had invested and During public domain search, as per the media article dated 19 March 2017 in the Sunday Times, Perpetual Asset Management (Pvt) Limited, which was the immediate Holding Company of Perpetual Treasuries Limited140, made substantial Investments in "Renuka Group of Companies"141 in which Ajit Nivard Cabraal had close family connections. The annual report of DFCC Bank during the period 2015, states that Shibani Renuka Thambiayah, niece of Ajith Nivard Cabraal was appointed to the Board of DFCC Bank as of March 2015. She was Joint Managing Director of Renuka Hotels Limited and Renuka City Hotels PLC at the same time. She was the General Manager from 2001 to 2010 prior to assuming the contemporary position of Managing Director of the Board with Renuka Hotels Limited. ix. Potential Conflict of Interest noted during the period July 2006 to January 2015 when Ajith Nivard Cabraal was the Governor and his family members in Primary Dealers including Banks under the supervision of CBSL:

a. Siromi Noel Wickramasinghe, sister of Ajith Nivard Cabraal, was appointed as Director of Perpetual Capital (Private) Limited on 23 December 2013. She was a director and shareholder in HNB Assurance during the period 2013 to 2017. She was also director of Ceylon Asset ManagementCopy Company Limited during the period 2000 to 2018. These companies mentioned in which she was a director were the subsidiary / holding companies of the Primary Dealers namely Perpetual Treasuries Limited, Hatton National Bank and Bank of Ceylon. b. Shibani Renuka Thambiayah, niece of Ajith Nivard Cabraal associated with Renuka Group where PTL had invested c. Initially, Perpetual Treasuries Private Limited, a private limited liability company incorporated on 1 October 2012 under the Companies Act. No 7 of 2007, submitted application for approval as licensed Primary Dealer of CBSL on 17 October 2012. The application was rejected in view of the foregoing and however,Parliament application was again submitted on 9 May 2013. It is also to be noted that the company name had changed from “Perpetual Treasuries (Pvt) Limited” to Perpetual Treasuries Limited. d. As per the Monetary Board Paper No. MB/PD/23/19/2013 dated 30 September 2013, appointment of Perpetual Treasuries Limited (“PTL”) as a Primary Dealer in Government Securities was approved in principle on 9 May 2013. Based on conditions to be fulfilled within 90 days, as a Direct Participant and a Dealer

140 http://www.sundaytimes.lk/170319/news/bond-issue-26-mps-want-to-give-evidence-233340.html 141 Refer Exhibit 102 PCOI Chapter 15, Pg. 482

Strictly Private and Confidential Page 155 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

Direct Participant in the Lanka Settle System was to be carried out. However, the conditions were fulfilled as on 25 September 2013 which had crossed the timeline of 90 days from the date of approval. The Primary Dealer had been approved by the Monetary Board members namely B.D.W.A. Silva (Deputy Governor), P Samarasiri (Secretary Monetary Board), A. Kamalasiri (Assistant Governor) and N W G R D Nanayakkarra (Superintendent Public Debt). It is also to be noted that N W G R D Nanayakkarra had recommended for rejection of the appointment of PTL during October 2012, at the time of initial application. e. In May 2013, when PTL was granted permission or approved by the Monetary Board, Siromi was also appointed as the director of the Perpetual Treasuries Limited’s holding company in December 2013. The concern related to conflict of interest of the then Governor, were not raised before this appointment.

x. As per PCOI Report following were key aspects which were considered for relationship mapping with PTL, the employees of EPF, and officials of other Primary Dealers about former Governor Ajith Nivard Cabraal. a. The Governor and the Monetary Board which held office in 2015 had been “politicized” is demonstrated by the fact that the former Governor, Ajith Nivard Cabraal and two appointed membersCopy of the Monetary Board - namely, Nimal Welgama and Neil Umagiliya - resigned from the offices on 9 January 2015 immediately after the Presidential Election results announced on 8 January 2015. As per Section 16 of the Monetary Law Act stipulates that, a Governor of the CBSL or an appointed member of the Monetary Board can be removed from office only by the President. It also proceeds on the basis that, a Governor or an appointed member of the Monetary Board shall hold office for a full term of six years. However, Ajith Nivard Cabraal, Welgama and Umagiliya considered it necessary to resign when the new president was elected in January 2015 before completion of the required term period of six years as per theParliament Act. It was noted that the President who appointed the three gentlemen ceased to be President, so they regarded themselves to ‘political appointees’ who held office at the will of the President and resigned from the Monetary Board. b. W A Wijewardana is a retired CBSL Official who was Deputy Governor from 7 August 2002 to 6 July 2009. In his witness statement at PCOI; where he was questioned about his views on aspects pertaining to steps to be carried out in a situation where a Governor of the CBSL finds himself in a situation where there could be conflict of interest. Also, Ajith Nivard Cabraal’s sister, Ms. Siromi, was director of the Holding Company of PTL while Ajith Nivard Cabraal was the Governor of the CBSL. In his response he stated, “if Nivard Cabraal has disclosed it to the Monetary Board and if he had refrain himself from any

Strictly Private and Confidential Page 156 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

dealings with PTL that would have been fine, but of course I know after my retirement from the Central Bank, Cabraal’s sister was appointed chairperson of the HDFC Bank. One of the Banks that needs to be regulated by the Central Bank and will have to examine whether the correct Governance practices had been followed by him.” When the Commission of Inquiry asked W A Wijewardena for his views on whether a failure by Ajith Nivard Cabraal to disclose to the Monetary Board that his sister, Ms. Siromi, was a Director of the Holding Company of PTL, would have been inappropriate. He replied in affirmative. c. The witness statement at PCOI of Mano Ramanathan who was appointed as a Member to the Monetary Board on 6 December 2007. She was questioned by the Presidential Commission that whether Ajith Nivard Cabraal or Arjuna Mahendran had brought to attention of the Monetary Board, the fact that a close relative was a Director of the Holding Company of Perpetual Treasuries Limited namely Ms. Siromi and Mr. Arjun Aloysius respectively. She had replied that the fact was not disclosed to the Monetary Board. B. ARJUNA MAHENDRAN i. Arjuna Mahendran is a Sri Lankan born, SingaporeanCopy economist and banker. He was appointed by the Honourable President Maithripala Sirisena, in January 2015 as the Governor of CBSL and served till 30 June 2016. He was the former Managing Director of HSBC Private Bank, Chief Investment Officer of Emirates NBD as well as the Chairman and Director-General of the Board of Investment of Sri Lanka. ii. Arjuna Mahendran’s son-in-law, Arjun Aloysius was previously associated with PTL (subsidiary of Perpetual Capital Holdings (Private) Limited) as its Chief Executive Officer and was appointed to its board from 19 September 2012 till 16 January 2015. As per a media article, Arjuna Mahendran had given assurance to the Honourable Prime Minister that his son-in-law will sever all associations with PTL prior to Arjuna Mahendran’sParliament appointment as a Governor of the CBSL on 15 January 2015142. iii. In 2015, Arjun Aloysius’ association with Perpetual Capital (Private) Limited and other group companies of PTL was noted. The same was corroborated by the statement made by Arjuna Mahendran before Commission of Inquiry that his son-in- law had a beneficial interest in PTL and continued to be a Director and Shareholder of the Holding Company of PTL while he was the Governor of the CBSL.

142 Source: Colombo Telegraph

Strictly Private and Confidential Page 157 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

iv. Arjun Aloysius started his career as a consultant to the Free Lanka Group and was later heading the Free Lanka Group’s investment arm. He was CEO of Perpetual Asset Management, Deputy Chairman of WM Mendis and Company as well as a Board member of HDFC. v. The background details of identified personnel of PTL143 were obtained during public domain searches, PCOI Report and review of ROC records, to identify their previous association in any organisation and / or with any CBSL official prior to becoming a part of PTL from 2013 onwards. The previous employers of the personnel were identified to further ascertain if any such former association coincide with the irregularities or non-compliance to applicable laws and regulation by the CBSL during the examination and to those previous employer organisations. vi. Potential Conflict of Interest noted during the period January 2015 to June 2016 when Arjun Mahendran was the Governor of the CBSL: a. It was also noted that there was significant delay in the submission of the examination report to the Monetary Board and several deviations noted in the examination report conducted by the Supervision Division during the tenure as the Governor of the CBSL. Refer Section 7 for the detail findings b. The witness statement at PCOI of Mano CopyRamanathan who was appointed as a Member to the Monetary Board on 6 December 2007. She was questioned by the Presidential Commission that whether Ajith Nivard Cabraal or Arjuna Mahendran had brought to attention of the Monetary Board, the fact that a close relative was a Director of the Holding Company of Perpetual Treasuries Limited namely Siromi and Arjun Aloysius respectively. She had replied that the fact was not disclosed to the Monetary Board.

Parliament

143 https://lk.linkedin.com/in/gajan-devarajan-b905602a, https://lk.linkedin.com/in/nuwan-salgado-65602836

Strictly Private and Confidential Page 158 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

A S FERNANADO vii. During the searches conducted, it was noted that A S Fernando’s sister namely Wlisarage Fernando Shrima was the one of the directors in Novel Equity Investments Private Ltd. The other directors in this company are Ruwan Karunaratne and Udana Siriwardena. Further, on the review of CDS transaction data and disciplinary action file of A S Fernando, it was noted that the aforesaid company was involved in bond transaction with Perpetual Treasuries Ltd. In 2014 amounting to Rs. 100 million and earned a capital gain of Rs. 43 million. During an interview with A S Fernando, he stated that the he was not aware about this transaction with the PTL and he was informed that the company was liquidated (Refer Exhibit 31144). However, there are no further document evidences available for concluding on the significant deviation noted during the examination involving A S Fernando.

Copy

Parliament

144 Refer Exhibit 31 for A S Fernando’s statement of fact_

Strictly Private and Confidential Page 159 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

9. DIGITAL FORENSICS

1. Appointment, Examination and Surveillance of Primary Dealer, deviation and / or anomalies were noted in the process followed and the supporting documents maintained. A list of 21 identified employees of the CBSL was prepared who were responsible for taking decisions related to Regulation and Supervision of Primary Dealers during the Review Period (hereinafter referred to as “custodian”) and their electronic devices (hereinafter referred as “Target Devices”) were identified and informed to the CBSL. The ITD identified the computers (desktops / laptops) issued to these employees, based on the last “Log-In” details recorded in the “Active Directory”.

9.1. REVIEW OF EMAILS

9.1.1. The summary of available digital evidences for all the 21 identified employees of CBSL was prepared and evaluated for potential linkage with the deviations and irregularities explained in the previous sections of the report. The specific electronic evidences considered relevant to the findings of the report are detailed in the respective sections of the detailed observations. (Refer Annexure 2)145. Copy 9.1.2. The table below represents the availability of data/ emails/ facts considered relevant in respect of the deviations and irregularities in Regulation and Supervision of Primary dealers for TOR-5:

Table 35 - Summary of Evidences from ESI

# NAME OF THE OFFICIAL AVAILABILITY OF DIGITAL EVIDENCES RELEVANT TO DEVIATIONS OR IRREGULARITIES 1 Arjuna Mahendran Relevant Finding 2 S S Ratnayake No relevant Finding 3 C M D N K Seneviratne No relevant Finding 4 U L MuthugalaParliament No relevant Finding 5 M Z M Aazim Relevant Finding 6 N W G R D Nanayakkara No relevant Finding 7 W N S Fernando Relevant Finding 8 P Samarasiri No relevant Finding 9 D S Thenuwara No relevant Finding 10 J P B Ishanthi No relevant Finding

145 Refer Annexure 22 for the list of 20 identified employees and their respective Target Devices along with rationale for their identification

Strictly Private and Confidential Page 160 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

# NAME OF THE OFFICIAL AVAILABILITY OF DIGITAL EVIDENCES RELEVANT TO DEVIATIONS OR IRREGULARITIES 11 K P K Weerasekera No relevant Finding 12 L T Amarasinghe No relevant Finding 13 P M C S Gunawardana No relevant Finding 14 S P Sedara No relevant Finding 15 T H B Sarathchandra No relevant Finding 16 A S Fernando Relevant Finding 17 S J K Guruge No relevant Finding 18 N D Y C Weerasinghe No relevant Finding 19 U P Alawattage No relevant Finding 20 W Ranaweera No relevant Finding 21 C J P Siriwardana No relevant Finding 9.1.3. The below mentioned observations were made basis the activities performed and completed till date:

A. REVIEW OF DESKTOP OF Dr M Z M AAZIM 1. Unauthorised access to the email account ofCopy SPD a. During the digital review of Dr Aazim’s desktop, it was noted that Nuwan Salgado, Chief Dealer of PTL sent an email to SPD ([email protected]) on 4 January 2016 and requested for an appointment. The email was forwarded to T H B Sarathchandra’s email address, who was the SPD during the said period. (Refer Exhibit 21) 146

b. It was obtained that Dr Aazim was working in Statistics Department during the stated period and his email ID was not marked in the email. Further, two instances were noted wherein emails from Nuwan Salgado / Kasun Palisena were sent on 30 July 2016 and 5 January 2016 to email account of SPD ([email protected])Parliament and said emails were found to be in the deleted folder of Outlook file ([email protected](2)_12.ost/Root - Mailbox/Shared Data/Superintendent of Public Debt/Deleted Items). (Refer Exhibit 22)147.

146 Refer Exhibit 21 for the email sent by Nuwan Salgado to SPD 147 Refer Exhibit 22 for the emails sent by Nuwan Salgado/ Kasun Palisena to SPD

Strictly Private and Confidential Page 161 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

2. Potential association with PTL

a. During the review, Curriculum Vitae (CV) of Dr M Z M Aazim’s wife (Fathima Rizwana) was found which was last modified on 16 February 2017, listing Avanthi Dassanayake as a Reference. She was found to be the Vice President of NDB Investment Bank, a subsidiary of the NDB Group during February 2017. During research conducted on the NDB Group, it was obtained that PTL and its group company (Perpetual Equities (Private) Limited) were listed among the largest shareholders of NDB Bank and held a total of 6.17% shares as at 31 December 2016148. Hence, an association of Dr M Z M Aazim was found with an organisation with which PTL is also connected. (Refer Exhibit 23)149.

B. REVIEW OF DEVICES OF ARJUNA MAHENDRAN

The review was conducted for devices of Arjuna Mahendran which included one desktop and one laptop; following observations were made during the review:

1. Potential Conflict of Interest

a. During the review, following four instances were noted wherein Kasun Palisena (+94777444669) had shared confidential Copy information to official email ID of Arjuna Mahendran, i.e., “[email protected]”. (Refer Exhibit 26)150. i. An email of 4 April 2016 at 17:21 was noted wherein Kasun Palisena wrote to Arjuna Mahendran that all the transactions are settled and cleared. He also apologised for some difficulties caused for Arjuna Mahendran because of him. ii. The above-mentioned abnormal success ratio of 96% for PTL and the verbiage mentioned in the email of CEO of PTL indicates that Arjuna Mahendran potentially shared some unpublished price sensitive information with Kasun Palisena of PTL and he acknowledged the assistance Parliamentof Arjuna Mahendran vide subject email. iii. As per an email of 16 May 2016 at 10:22, Kasun Palisena asked Arjuna Mahendran for his email address for forwarding a circular. However, response, if any, to the said email by Arjuna Mahendran was not noted during the review.

148 Source: https://www.ndbbank.com/annual-Report/2017/investor-relations.index 149 Refer Exhibit 23 for CV of MZM Aazim’s wife (Fathima Rizwana) 150 Refer Exhibit 26 for copies of emails sent by Kasun Palisena to Arjuna Mahendran

Strictly Private and Confidential Page 162 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

iv. The email of 9 June 2016 at 9:06 from Kasun Palisena to Arjuna Mahendran contained the verbiage, “Franklin highest amount maintained during the month of June 2014- approx. Rs. 460-470bn Lowest amount last week 2nd June 2016- approx. Rs. 205-210bn”. v. It was gathered during research, that Franklin is an American investment company which offers a wide range of mutual funds and investment solutions. It could not be established if Kasun Palisena referred to the same ‘Franklin’ in this email. vi. Another email of 9 June 2016 at 9:31 was noted wherein Kasun Palisena shared exit yield for 2014 – 2016. No company name or any additional detail was mentioned in the email. b. The above email communications between Kasun Palisena and Arjuna Mahendran, indicate that Arjuna Mahendran was in regular touch with the key managerial personnel of PTL for matters not related to the CBSL.

C. REVIEW OF DEVICES OF A S FERNANADO

The review was conducted for devices of A S Fernando which included one desktop; following observations were made during the review:Copy

1. Potential Conflict of Interest

a. During the review, following instance was noted wherein emails communications were exchanged between A S Fernando, Ruwan Karunaratne, Udana Siriwardana and Indika Rajakaruna i. An email of 26 November at 10:43 was noted wherein A S Fernando sent an email from his personal email id i.e. “[email protected]” to CBSL email id i.e. “[email protected]”. ii. The email contains two attachments (one word and one excel document) Parliamentnamely “Ice Making Process draft 01” and “ICECO”. (Refer Exhibit 45)151. b. Upon enquiry with A S Fernando, he stated that the emails were pertaining to a company namely “Novel Equity Investments Private Ltd.” Where his sister was a director. He further stated that he was not aware about the transaction with the PTL and Novel Equity Investments Private Ltd. During the period 2014, and he was being informed that the company is liquidated and the termination of the directorship

151 Refer Exhibit 45 for copy of email sent by A S Fernando to his personal id – Novel Equity Investments Private Ltd. Related files

Strictly Private and Confidential Page 163 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

c. Further, an email of 26 October 2016 at 8:34 was noted wherein transactions were identified between PTL and Novel Equity Investments Private Ltd. (Refer Exhibit 46)152. d. However, another email of 30 October 2013 15:23 was noted wherein he shared a word document named “TO DO LIST” to his personal email id. The documents states that “Winding up Novel” (Refer Exhibit 47)153. D. REVIEW OF DEVICES OF W N S FERNANADO

The review was conducted for device of W N S Fernando which included one desktop; following observations were made during the review:

1. Continuous Non-Compliance by ESL

a. During the review, an email of 8 January 2016 was noted wherein W N S Fernando shared a document namely “BP observations ESP” to U L Muthugala with N D Y C Weerasinghe in CC. The document contains the list of non- compliances made by ESL from 2007 onwards till 2015 (Refer Exhibit 48)154.

9.2. DELETION OF OUTLOOK FILES Copy During the extraction of ESI, logs indicating deletion of outlook .pst and .ost files were identified on target devices pertaining to custodian. The identification of deleted outlook files and the anomalies identified are explained as under: (Refer Table 36)

A. An email platform / application is used for sending or receiving emails, maintain calendar, contacts etc. the CBSL implemented, Microsoft Outlook as email platform for email communication from June 2012 (Refer Exhibit 24)155.

B. Mentioned below are the data file formats used by Microsoft Outlook156.

1. Outlook data file (.PST): It containsParliament messages and other outlook items and is saved on the local computer (Target Device). In Outlook 2013 and earlier versions, IMAP account also used as an Outlook Data file (.pst).

152 Refer Exhibit 46 for copy of email sent by S P Sedara to A S Fernando – Transaction between PTL and Novel Equity Investments Private Ltd. 153 Refer Exhibit 47 for the email sent by A S Fernando to his personal email id relating to wind up of Novel 154 Refer Exhibit 48 for the email sent by W N S Fernando 155 Refer Exhibit for email communication on 30 September 2019 156 According to Outlook app website

Strictly Private and Confidential Page 164 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

An Outlook data file (.pst) can also be created for creating backup of email messages, calendar, contact and task data. When messages or other outlook items are saved in an outlook data file (.pst), the items are available only on the computer where the file is saved.

The location of outlook data file (.pst) created by using Outlook 2013 or Outlook 2016 typically is in “documents\outlook files” folder. Outlook data file (.pst) created by microsoft outlook 2007 or earlier is on different location at “drive:\users\user\Updata\local\microsoft\outlook”.

2. Offline outlook data file (.OST):

The offline outlook data file (.ost) stores synchronised copy of mailbox information on local computer (Target Device). When the relationship to the mail server is interrupted, one can still access all emails, calendar data, contacts etc. and on the restoration of connection, changes are automatically synchronized.

The location of the offline outlook data file is at: “drive:\User\user\Update\Local\Microsoft\Outlook”. 3. Database file for Mac: Copy It is used for Mac OS X systems; Outlook stores the indices in a proprietary Database file and stores the data records as a series of files nested within folders.

C. The deleted and overwritten Outlook files were identified through description mentioned in the Encase tool.

D. As confirmed by DIT that “the user does not require any admin rights to access, delete and modify the email data file (format type “.pst/ .ost") since it is automatically created in the C:\Users folder in any laptop / desktop.” (Refer Exhibit 24)157. However,Parliament for deletion of “.ost” and “.pst”, user had to access the location “drive:\User\ user\ Updata\ Local\ Microsoft\ Outlook” OR “Documents\Outlook Files” respectively, which may require the technical assistance to the user.

E. The deletion of “.pst” and “.ost” files by a user is less common when compared to the deletion of emails through the email box and such deletion indicates a deliberate action by the user, with knowledge of the effects, to remove information from the Target Device.

157 Refer Exhibit 24 for the email communication with DIT of 29 July 2019

Strictly Private and Confidential Page 165 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

F. As per the logs generated by “Encase” tool, it was observed that composite outlook files (ost and pst) were deleted from the Target Devices and the table provided below summarizes instances of deletion of outlook files: (Refer Annexure 16)158

Table 36: Details of deleted outlook files

## CUSTODIAN DEVICE NAME OF THE FILE OBSERVATION DELETED

1 Arjuna Laptop [email protected] An outlook file named Mahendran “[email protected]” was observed as deleted on his Device. The description of the file in Encase Forensic tool was “File, Deleted, Overwritten, Archive, Not Indexed”. It was noted that “Entry modified159” detail was 30 June 2016 at 20:13 HRS. 2 C M D N K Desktop [email protected] Six instances were noted during Seneviratne the review where outlook files were deleted on the following Copyinstances from the system. The description of the file in the Encase Forensic was “File, Deleted, Overwritten, Archive, Not Indexed”. It was noted that the “Entry Modified” for the deleted files were as followed: 18-Aug-2016 at 9:24 HRS 25-Apr-2017 at 15:16 HRS 18-Jun-2018 at 9:10 HRS 2-Jan-2019 at 9:00 HRS. 2-Jan-2019 at 9:00 HRS 10-Jan-2019 at 17:54 HRS Parliament

158 Refer Annexure 16 for the details of deleted outlook files 159 Entry Modified date refers to the date when the Master File table was modified for the file

Strictly Private and Confidential Page 166 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

## CUSTODIAN DEVICE NAME OF THE FILE OBSERVATION DELETED

3 Dr M Z M Aazim Desktop [email protected](2).ost Six instances were noted during [email protected] the review where outlook files achive.pst were deleted on the following instances from the system. The description of the file in the Encase Forensic was “File, Deleted, Overwritten, Archive, Not Indexed”. The “Entry Modification” date as followed: 13- Dec-2013 at 14:48 HRS 15-Aug-2017 at 18:43 HRS, 15-Nov-2017 at 17:11 HRS 27-Aug-2018 at 16:19 HRS 20-Jun-2019 at 12:11 HRS 24-Jun-2019 at 9:10 HRS An .pst file was also deleted from the system on 13-Dec- 2013 at 14:48 HRS.

4 U L Muthugala Desktop [email protected] Eight instances were noted archive.pst Copywhere outlook files were muthugala.pst deleted from device. Muthu.pst “Entry Modified” dates as archive.pst followed: muthugala.pst 17-Apr-2004 at 9:39 HRS outlook.pst 23-Sep-2014 at 9:41 HRS BOSS.pst 23-Sep-2014 at 10:05 HRS outlook.pst 23-Sep-2014 at 9:41 HRS 10-Aug-2016 at 16:15 HRS 26-Aug-2016 at 09:29 HRS 16-Nov-2018 at 15:33 HRS 17-Apr-2019 at 09:34 HRS 5 A S Fernando Desktop archive1.pst Ten instances were noted [email protected] - where outlook files from the MAIL.ost device. “Entry Modified” dates [email protected] - are as followed: MAIL.ost 6-May-2019 at 16:12 HRS [email protected] 6-May-2019 at 16:12 HRS [email protected] - 10-Jun-2019 at 09:12 HRS MAIL.ost 17-May-2019 at 11:05 HRS archive.pst 22-Jan-2019 at 09:16 HRS archive1.pst 24-Apr-2019 at 14:23 HRS [email protected] - 24-Jun-2019 at 12:14 HRS MAIL.ost 24-Jun-2019 at 12:17 HRS archive1.pst 24-Aug-2018 at 10:21 HRS archive.pst 11-Dec-2018 at 07:57 HRS 6 N D Y C Desktop [email protected] Eleven instances were noted Weerasinghe [email protected] where outlook files were [email protected] deleted from the device. [email protected] “Entry Modified” date of the archive.pst files are as follows: archive.pst 11-Feb-2019 at 08:09 HRS

Strictly Private and Confidential Page 167 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

## CUSTODIAN DEVICE NAME OF THE FILE OBSERVATION DELETED

archive.pst 13-Dec2018 at 11:29 HRS archive.pst 7-Dec-2018 at 16:59 HRS archive.pst 7-Dec-2018 at 10:25 HRS archive.pst 30-Oct-2018 at 10:54 HRS archive.pst 13-Dec-2018 at 12:03 HRS 30-Oct-2018 at 10:54 HRS 13-Dec-2018 at 12:03 HRS 13-Dec-2018 at 12:03 HRS 7-Dec-2018 at 10:25 HRS 7-Dec-2018 at 16:59 HRS 7 P Samarasiri Desktop outlook.ost One instance of outlook file deletion was noted from the device. “Entry Modified” date of the file is 11-Nov-2015 at 17:01 HRS 8 P Samarasiri Laptop [email protected] Three instances were noted [email protected] where outlook files were [email protected] deleted from the device. “Entry Modified” date of the files are as follows: Copy14-Jul-2017 at 12:20 HRS 14-Jul-2017 at 12:20 HRS 26-Apr-17 at 14:18 HRS 9 THB Desktop BOSS.pst Six instances were noted where Sarathchandra [email protected] outlook files were deleted from [email protected] the device. [email protected] “Entry Modified” date for the [email protected] files are as follows: [email protected] 7-Oct-2014 at 14:35 HRS 22-Mar-2019 at 16:20 HRS 2-Apr-2019 at 15:52 HRS 19-Dec-2018 at16:35 HRS 21-Jan-2019 at 9:17 HRS 6-Jun-2019 at 10:05 HRS G. In the caseParliament of Dr M Z M Azim, the confidential list of devices to be procured for digital imaging was originally sent on 18 June 2019 and subsequently, the .ost file was found to be deleted on his device. It raises a concern if there was any potential leak of confidential communication between BDO India and the CBSL. Further, Dr. M Z M Aazim received a Memo on 21 June 2019 from the Governor of the CBSL mentioning that the electronic device issued to him would be obtained by the Forensic Auditors for a digital image. However, the procurement of his device was delayed and procured on 25 June 2019 due to his official commitments.

Strictly Private and Confidential Page 168 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

H. It was noted that the file named “[email protected]” was also deleted from his device. “Entry Modified” property for the mentioned file was 24 June 2019 at 9:10, a day before the date when the system was due for handover and three (3) days after memo was issued to surrender his device. The deletion of outlook files appears a deliberate attempt to remove the data available on the device, which also is a breach as per the Information Security Policy of the CBSL.

I. During an interview, Dr M Z M Aazim stated, “I regularly delete emails after responding or forwarding to respective department or employees. I delete operational emails and clean delete folder as well due to limit restrictions. I remember most of the information I receive. I don’t know if it is in policy to keep emails/ files maintained. I am not aware of any deletion of outlook files from my system. It should be checked with IT department.” He also explained that he is unaware of the method of deletion of .pst or .ost files. As a practice, he deletes emails from outlook through the user interface, by selecting the emails manually and subsequently removes emails from the ‘delete’ folder. He confirmed that he deleted emails post 1 January 2019 as well. However, he maintained that he is not aware of the deletion activity at the date and time stamps as recorded in the digital forensic review. On further inquiry, Dr M Z M Aazim confirmed that during the date of recordedCopy deletion activity, the target device was in his possession. The access to the target device is possible only through user specific log-in credentials, which were in his possession (not shared with anyone) and is known and used only by him. Also, he did not handover the target device to any other CBSL official during the process of acquisition of the device by BDO.

J. Summary

A. The logs of deletion of MS Outlook data files (“.pst” & “.ost”) were generated during the digital forensic procedures where the globally accepted forensic technology tools and evidence identification and extraction procedures were adopted.Parliament These logs were generated using the “Encase” forensic tool-based filters and standard OEM scripts in the “Encase” forensic tool.

Strictly Private and Confidential Page 169 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

B. Users of electronic email applications usually delete selected non-essential emails (such as notifications, reminders and business development communications) and other emails considered redundant, to free-out the assigned storage space in the electronic device. Identification of such emails is performed selectively, individually and manually through the email system front- end user interface. This mode of deletion is considered usual and a general practice. This method of deletion is a standard functionality of the email application / tool and does not result in deletion of entire data file160 itself. Deletion of email data files requires the user to access specific location of files on the machine (laptop / desktop, usually referred-to as “client machines”), which is a designated location of the data files. Such deletion method is not a standard functionality feature of the email application. Accordingly, this method of deletion requires a deliberate attempt / action by the user. To avoid unintentional deletion of files and loss of organizational data, as a better practice, organizations usually restrict users’ access to the designated locations of the email data files through user access controls & permissions and through “Administrative” access rights to the computer device.

C. IDT confirmed that CBSL employees’ accessCopy to the such designated locations in the client machines and the right to delete files in that folder, was not restricted and users could delete the files if they had the awareness of the file location along with an intention to perform such deletion action.

D. During an inquiry, MS Outlook publisher’s technical support division confirmed that there is no technical feature or action that results in auto deletion of Outlook email data file stored in the designated (Program Files) folder, supporting the possibility that such deletion requires a deliberated action by people having access to the client machine. E. DuringParliament the inquiries, the selected officers of CBSL (on whose machine this deletion activity was identified during the forensic technology procedures) denied having knowledge of the file location and method of deletion. However, they also confirmed that:

1. During the dates of logs indicating the deletion, the devices were in their own possession;

160 Refer paragraph B for the details of the functionality & purpose of the email data file.

Strictly Private and Confidential Page 170 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

2. Access to the devices is restricted by user-specific access controls (log-in credentials) set-up by IDT;

3. The officials have not shared the device access credentials issued by IDT to any other employees of CBSL;

4. Azim also stated that there no occasion when he handed over the device to any other officers of CBSL or to IDT staff for any IT support requirement.

K. Conclusion

A. Based on the information gathered and confirmations received, it cannot be interpreted that the deletion activity could be the result of an automated action triggered by any other IT process or activity. It cannot also be construed that the deletion activity was performed by officials other than those, who these devices were assigned-to. Despite the active denial / rejection by the selected officials, of having performed the deletion activity, the possibility of deletion of the data files by the users themselves cannot be ruled-out.

B. It is pertinent to noted that in case of Dr. Azim, the deletion activity was logged on the dates, subsequent to the intimationCopy of requirement for handover of the electronic devices for forensic investigation purposes and prior to the handover the device. Azim also stated during an inquiry that usually, he deletes the older date email communications regularly to free-out the assigned disk-space on his computer machine. He also confirmed that her performed such activity post intimation of the need for surrender of the device or forensic investigation purposes with a specific requirement to handover the device without affecting the integrity of the data on the machine.

Parliament

Strictly Private and Confidential Page 171 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

10. LIMITATIONS

The findings of this Report should be read in conjunction with the following limitations:

1. The copies of operational manual applicable to the Supervision function, were evidence of review performed by Assistant Governor and Deputy Governor overseeing the PDD is not available.

2. For the review, CBSL provided hard copies of documentation and information pertaining to the application / appointment, examinations, regulatory actions conducted for selected Primary Dealers during the Review Period. BDO India has not independently identified or collected the documentation. Accordingly, the confirmation by the DSNBFI and the PDD of the CBSL on the completeness of the data / documents / information has not been independently verified/ validated by BDO Team.

3. The review was based on the documentation and information provided by the CBSL.

4. The understanding of the operational process for regulatory and supervisory function of Primary Dealers during the period 3 June 2016 to 31 December 2017 was obtained based on the explanation provided by the current officials ofCopy the PDD and the DSNBFI and same understanding was extended to the remaining period.

5. Inability to examine the discussions between the officials of the CBSL with Primary Dealers as the telephonic discussions had not been recorded at CBSL and email communication is limited to the availability and retrieved/ recovered through e-discovery procedures.

6. Information Technology (“IT”) Asset Register was not maintained by the Information Technology Department (“ITD”) at the CBSL, accordingly, the details of IT assets assigned to CBSL employees cannot be identified with certainty. The electronic devices pertaining to the identified individuals were identified by the ITD based on the last User Account Log- In InformationParliament available. Hence, it cannot be established if acquired devices were the only device/s used by the selected employees of the CBSL during the Review Period.

7. The completeness of the email communication data cannot be established as multiple instances of email data file deletions were noted during the Digital Forensics procedure on the devices provided by the ITD and backup of the email data was not available comprehensively, on the email server. Vide an email of 29 July 2019, ITD confirmed that Litigation Hold was introduced effective January 2019 and all emails which are not permanently deleted as on January 2019, are available on the server. Our review of emails

Strictly Private and Confidential Page 172 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

was limited to the extent of email data backup provided by the IDT of the CBSL. (Refer Exhibit 25)161.

8. The CBSL migrated email communication platform from Lotus Notes to Microsoft Outlook in June 2012 and email backups prior to June 2012 were not maintained. The backup files and Lotus user id and password were not retained for the same and review of emails is limited to the extent data backup provided by the ITD of the CBSL.

9. Licensed tools were used in conducting digital forensic on the devices provided by ITD of identified officials of the CBSL. However, due to rapid change in computer’s operating, processing and storage techniques, there could be occasions when licensed forensic tools are unable to gather 100% evidence from the acquired devices.

10. The audit logs for FInNet application for the Review Period were not available. Hence, modification / changes / additions / deletion of data uploaded by Primary Dealer for examinations could not be independently verified and the person responsible for changes cannot be identified.

11. We gateway logs (year wise segregated files – text / csv format), web gateway log metadata files, network firewall configurations and change logs, network firewall activity logs for internet traffic (both inbound and outbound) for the reviewCopy period were not made available for review. Server logs for Inbound and Outbound emails across the CBSL email domains, from the earliest mail from outlook till March 2018, were not available for review. (Refer Exhibit 52)162.

Parliament

161 Refer Exhibit 25 for the email of 5 July 2019 for implementation of litigation hold 162 Refer Exhibit 52 for email of 2 August 2019 for requesting the firewall logs

Strictly Private and Confidential Page 173 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

NOTICE TO THE READER

 This Forensic Audit Report (“Report”) has been prepared by BDO India LLP (“BDO India”, or “We, or “us”) for The Monetary Board of Central Bank of Sri Lanka (the “CBSL” or the “Client” or “You”) in accordance with the scope of work defined in Contract of 1 April 2019 (“Contract”).  The Report issued by BDO India is in accordance with the Contract and for use by the CBSL. Usage of this report by the CBSL is with the understanding that (i) The CBSL will keep BDO India LLP informed about the distribution; (ii) The CBSL would take appropriate measures to avoid unauthorized distribution of the whole or part of the report; and (iii) The disclosure is in line with applicable laws. We accept no responsibility or liability to any external agency or parties not forming part of the Contract.

 BDO India does not render any legal advice or related services and, therefore, none of the Services rendered under the Contract should be considered to be legal services. In respect of any and all legal matters, the CBSL may consult its legal advisors, as they deem fit in their own discretion. Our work does not make any representation regarding questions of legal interpretation and cannot render legal advice. The Client should consult with its attorneys with respect to legal matters or items that require legal interpretation.  The Report issued is to be read in totality, and not in parts,Copy and in conjunction with the relevant sections referred to, in this Report.  We relied on the information and explanations provided to us by the CBSL and we have not independently verified the completeness of the same. Whilst, we have taken reasonable steps to corroborate the information (Refer Section 3 - Work Performed), we cannot guarantee its reliability or completeness. Hence, our ability to perform all the procedures depended on the nature and quality of the information and explanations provided to us by the CBSL. Our observations in this Report are limited accordingly.  This Report is based on the information received and discussion with stakeholders up to 27 September 2019. We / you may come across information that may have bearing on the findings and observations made in this Report subsequent to the submission of this Report. However, we take no responsibility for the possible impactParliament of such events and circumstances including updating this Report for the same. Although, in circumstances where additional information may become available with respect to the engagement, we would be glad to carry out additional procedures as may be separately agreed with the Client.  This engagement shall not create privity between BDO India and any third party. Neither this Report nor the services provided hereunder are intended for the express or implied benefit of any third party.

Our services and our Report are not intended to be, and shall not be construed to be, investment advice or legal, tax or accounting advice in accordance with the accounting standards. BDO India shall ensure all confidential information acquired shall be and remain as part of the Report rendered by BDO India in accordance with the Contract.

Strictly Private and Confidential Page 174 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

11. ANNEXURES

LIST OF ANNEXURES

# NAME OF ANNEXURE NO. OF PAGES 1 List of applicable Laws, Regulations, Manuals and Directions 4 2 List of 21 identified employees 4 3 Complete list of extensions of ESI extracted 1 4 The basic information of acquired devices 1 5 Operating system information of Target Devices 8 6 User account information of Target Devices 16 7 List of keywords 7 8 Repeated observation identified in each Primary Dealers 26 9 Summary of discussion with the employees 23 10 Dropping of examination findings from “Letter of Findings” 1 11 The profiling of the identified employees of the CBSL 13 12 The list of companies and individuals associated with PrimaryCopy Dealer 4 13 The count of keywords for each identified employee of the CBSL 4 14 The count of files (extension wise) for each custodian 10 15 List of on-site examination findings identified by the Supervision division for the 63 selected Primary Dealers 16 The details of deleted outlook files 7 17 Server email count for each identified official 1 18 Non-reporting of examination Report to The Monetary Board 12 19 Common findings across Primary Dealers 2 20 Coverage and Sampling technique 7 21 List of Primary DealerParliaments’ directors and CEOs 9 22 List of 21 identified employees for ESI review 4 23 Tools used to perform Digital Forensics / E-discovery on target devices 2 24 Detailed delays in submitting the Monetary Board papers 1

Strictly Private and Confidential Page 175 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

12. EXHIBITS

LIST OF EXHIBITS

# NAME OF EXHIBIT NO. OF PAGES 1 The PDD Operational Manual – Supervision division 2013 17 2 The PDD Operation Manual- Supervision division May 2015 17 3 Gazette copy of transfer of role from the PDD to the DSNBFI 1 4 Gazette copy of transfer of role from the DSNBFI to BSD 2 5 Summary of discussion with the Honourable Governor 6 6 Summary of discussion with FAMC for status updates 98 7 Email communication with the department for providing list of applicable laws 1 and guidelines 8 Copies of all CoC forms of target devices provided by IT team of the CBSL till date 50 9 Logs for forensic image of target devices 121 10 Direction to issue warning letter instead of declaring un-fit 2 11 The PDD operation manual – Supervision division 2007 Copy 18 12 Examination Questionnaire 32 13 List of training programs attended by the PDD Supervision / SNBFI employees 45 14 Article of 6 January 2018 published in Colombo Telegraph 36 15 The documents retrieved by the PDD during On-site Examination as at 30 1 September 2015 16 Article of 28 July 2016 published in Lanka Business Online 3 17 Article of 26 March 2015 published in Ground views 16 18 Article of 4 December 2016 published in The Sunday Times 5 19 Statement of fact of W Ranaweera 2 20 The extract of emailParliament of 4 July 2019 for discussion of email backup 4 21 The email sent by Nuwan Salgado to SPD 1 22 The emails sent by Nuwan Salgado/ Kasun Palisena to SPD 2 23 CV of MZM Aazim’s wife (Fathima Rizwana) 3 24 The email communication with DIT of 29 July 2019 3 25 The email of 5 July 2019 for implementation of litigation hold 3 26 Copies of emails sent by Kasun Palisena to Arjuna Mahendran 4 27 Board Paper for transfer of Regulation and Supervision role from the PDD to DNBFI 6 28 Gazette copy for Appointment and Suspension of Primary Dealers 1 29 Statement of fact of T H B Sarathchandra 4 30 Statement of fact of W N S Fernando 2 31 Statement of fact of A S Fernando 2

Strictly Private and Confidential Page 176 of 177 FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

# NAME OF EXHIBIT NO. OF PAGES 32 Statement of fact of L T Amarasinghe 2 33 Statement of fact of S J K Guruge 2 34 Statement of fact of P M C S Gunawardana 2 35 Statement of fact of S P Sedara 2 36 Statement of fact of D S Thenuwara 3 37 Statement of fact of Nanayakkara 4 38 Violation of Lankasettle System Rules: Custodian Responsibilities 2 39 Appointment and Suspension of Primary Dealers – LTBO and RSSO 22 40 Email copy – Discussion with W Ranaweera relating to regulation function – 2 Government Securities 41 Direction on assessment of fitness and propriety of directors and employees 11 performing executive functions of Primary Dealer companies 42 PTL appointment rejection note 6 43 The Monetary Board Paper – Appointment of PTL as a Primary Dealers in 4 Government Securities and as a direct participant and a dealer direct participant in the LankaSettle System 44 Copy of email sent by W N S Fernando for Handover - PABCCopy 1 45 Copy of email sent by A S Fernando to his personal id – Novel Equity Investments 34 Private Ltd. Related files 46 Copy of email sent by S P Sedara to A S Fernando – Transaction between PTL and 2 Novel Equity Investments Private Ltd. 47 Copy of email sent by A S Fernando to his personal id – Winding up Novel 2 48 Copy of email sent by W N S Fernando – ESL continuous non-compliances from 2007 3 onwards till 2015 49 Fitness and Propriety of N N D Jayasekara_2016 and N N D Jayasekara -Repo 11 outstanding 50 No Fitness and Propriety performed for Manju Priyadarshana and Upeka 12 Samarasinghe for 2014 and 2015 – PTL 51 Delay in Fitness andParliament Propriety by SNBFI 2 52 Email of 2 August 2019 for requesting the firewall logs 3 53 Statement of fact of K P K Weerasekara 2 54 Statement of fact of H D Ajith 2 55 Copy of e-mail communication by the DIT regarding migration of email 1 communication platform

Strictly Private and Confidential Page 177 of 177

FINAL REPORT | RFP 5 | EXAMINATION ON THE CONDUCT OF THE SUPERVISORY AND REGULATORY ROLE BY THE SUPERINTENDENT OF PUBLIC DEBT / DIRECTOR, SUPERVISION OF NON-BANK FINANCIAL INSTITUTIONS PERTAINING TO SELECTED PRIMAY DEALERS FROM 01 JANUARY 2009 TO 31 DECEMBER 2017

FOR MORE INFORMATION: The Report issued by BDO India is in accordance with the Contract and for use by the CBSL. Usage of this report by the CBSL is with the understanding that (i) The CBSL will SRINIVASA RAO keep BDO India LLP informed about the distribution; (ii) The CBSL would take appropriate measures to avoid unauthorized distribution of the whole or part of the +91 96001 13339 report; and (iii) The disclosure is in line with applicable laws. We accept no [email protected] responsibility or liability to any external agency or parties not forming part of the Contract. The Report issued is to be read in totality, and not in parts, and in conjunction with the relevant sections referred to, in this Report.

BDO INDIA LLP, an Indian LLP, is a member of BDO International Limited, a UK company limited by guarantee, and forms part of the international BDO network of independent member firms. BDO is the brand name for the BDO network and for each of the BDO Member Firms. Copyright © 2019 BDO INDIA LLP. All rights reserved. Published in the India. www.bdo.in Copy

Parliament

Strictly Private and Confidential Page 178 of 177