Fact Crescendo: Sri Lanka: Friday, 13 November 2026.
Imagine being able to file a request and see any bank’s files, or even someone else’s account. That is roughly how many readers understood the headlines from October 26, which said, based on an RTI Commission ruling of October 21, 2026, that Sri Lanka’s private banks were now subject to the RTI Act. We compared those reports with the Commission’s published order, the Right to Information Act No. 12 of 2016 and earlier decisions of the Commission and the Court of Appeal, paying special attention to one question: can this ruling be used to get another person’s bank account details? Here is how the claim spread.
Social Media Posts:
From October 26, posts saying private banks were now subject to the Right to Information (RTI) Act were shared on social media in Sinhala, Tamil, and English.
A financial advice page posted on October 27 under the headline “Private banks also come under the RTI Act!” Its image said banks “must give the information requested” and called Sanasa Bank a “state authority”. Its description also said private banks could be treated as “state officials”.
Another page’s post, with an image saying, “Central Bank-licensed banks are subject to the RTI Act”, was shared to several groups on October 27.
Mainstream media also carried the story. The Hiru News Facebook page posted on October 26 under the headline “Private banks in Sri Lanka also come under the RTI Act”. A post by NewSin.lk the same day said that previously “only state banks” were directly subject to the Act, and that citizens now had the right to request information from “all licensed private banks”.
Claim Under Investigation: All licensed private banks in Sri Lanka are now directly subject to the RTI Act, just like government institutions, so any citizen can request information from them.
Fact-Check:
The Commission’s Ruling Came in One Appeal Involving Sanasa Development Bank
On April 7, 2025, a loan customer at SDB Bank’s Maharagama branch asked for a report on unclear terms in his loan agreement and on how his interest rate was calculated. The branch replied by email on April 9. Not satisfied, he appealed to the RTI Commission on July 29, 2025, according to the Commission’s order, available here.
At the hearing, the bank said it had emailed the requested information within four days and argued that as a company incorporated under the Companies Act No. 7 of 2007, it was not a “public authority” under the Act. Chairman Dayaratne Lankapura and Commissioners Attorney-at-Law Kishali Pinto-Jayawardena and A. M. Nahiya rejected that argument in their order of October 21, 2026, in appeal RTIC/Appeal/1005/2025.
The appeal was on the Commission’s hearing list for January 29, 2026, as seen here. According to the order, on January 14, 2026, the bank’s lawyer asked for time to talk to the appellant without first deciding the bank’s status. Then, on January 29, the lawyer asked the Commission to decide that status first.
So, this order decided only the preliminary question of whether the bank is a public authority. It has not yet decided whether the requested information must be released. The bank was told to file written submissions on or before November 13, 2026, and the appellant to file counter-submissions on or before November 27. The appeal is due to be considered on December 2 through written proceedings.
A Public Authority, a Public Service and a Government Institution Are Not the Same
In the Act, “public authority” is a legal term for a body that has a duty to provide information. Ministries, government departments, public corporations, and companies in which the state holds 25 per cent or more of the shares (Section 43(a) to (e)) are public authorities in full. State banks have always been in this group.
A “public function or service” is a statutory or public duty or service carried out by a private body under a contract, joint venture, agreement, or license from the government, one of its agencies or a local authority. Section 43(g) says such a body is a public authority only “to the extent of activities covered by that function”. In the Sinhala text of the Act, this paragraph is numbered (උ), and the Commission’s order uses that numbering.
So even if a private bank
operating under a Central Bank license is treated as a public authority, it
does not become a government institution. Its ownership, control and
shareholders stay the same. Going by the wording of the Act, information can
be requested only about activities tied to the licensed banking service, such
as deposits, loans, and interest rates. The Commission has not yet spelled
out exactly where that line falls.
Media reports cited paragraph (e) of Section 43. But the Commission’s order rests on paragraph (උ) of the Sinhala text, which is paragraph (g) in the English text. Paragraph (e) applies to companies in which the state holds 25 per cent or more of the shares or has a controlling interest.
According to an October
2025 report, SDB Bank’s main shareholders are LOLC Investment Holding (15%),
Senthilverl Holdings (12%), Finco Holdings (about 11%) and BIO, a Belgian
development finance institution (10%), as reported here.
The Central Bank of Sri Lanka lists SDB Bank as a licensed specialized bank, here.
This Does Not Normally Open Up Other People’s Account Details
The most important question in this story is whether someone can use RTI to get another person’s account balances, transactions, or loan details. Under Section 5(1)(a) of the Act, personal information must be refused if it has no link to any public activity or public interest, or if releasing it would cause an unwarranted invasion of a person’s privacy.
Under the law, such information can be released only if one of two conditions is met: the person concerned has agreed in writing, or a larger public interest justifies the disclosure. The Act also protects information that must be kept confidential because of a fiduciary relationship (Section 5(1)(g)), commercial secrets that would harm a third party’s competitive position (Section 5(1)(d)) and information given in confidence by a third party (Section 5(1)(i)).
When someone asks for confidential information that relates to, or was supplied by, a third party, the Information Officer must ask for that party’s views within a week (Section 29). If the third party objects, the information should be refused. Only if the public interest in disclosure clearly outweighs the private interest can the Commission order its release. Section 6 also allows the exempt parts of a document to be removed and the rest to be released.
On January 20, 2026, in a case against People’s Bank, the Court of Appeal upheld an order to release audit reports and ledger details for the accounts of a partnership in which the customer was the managing partner. The court said that since a partnership is not a legal person separate from its partners, he was not a third party, and that third parties’ details could be removed where needed, as reported here. It was reported on March 28, 2026 that the Court of Appeal quashed a Commission order against the Central Bank’s Monetary Board, saying the Act’s exemptions must be strictly followed, as reported here.
There is also a Commission ruling that deals directly with other people’s accounts. On July 4, 2024, in an appeal against Nations Trust Bank (RTIC/Appeal/1283/2023), the Commission decided the bank was a public authority. But it also ruled that the bank was right to refuse the agreements and documents on loan facilities given to another company in which the appellant held no shares. That was personal information, no link to a public activity or larger public interest had been shown, and so Section 5(1)(a) applied. That ruling is here.
Section 77 of the Banking Act deals with the “Declaration of secrecy” (here), and a 1998 report noted that it protects depositors’ confidentiality (here). Section 4 of the RTI Act gives priority over other written laws, but we could not find any court ruling that balances it against a private bank’s account secrecy. The main provisions of the Personal Data Protection Act take effect from January 1, 2027 (here), which may raise new questions about bank data.
In short, this position gives customers a legal route to ask, under RTI, for information about their own accounts, loans or bank decisions that affect them. Getting another person’s account details requires that person’s written consent or strong public interest, and the Commission or the courts will decide each request on its own merits.
The Commission’s Position on Private Banks Has Changed Since 2018
According to the hearing notes of a 2018 appeal against the Central Bank (RTIC Appeal 98/2018), the appellant said the Commission had told him, in an earlier appeal against Commercial Bank, that private banks did not fall within the Act. The record is here.
But in the 2024 Nations Trust Bank appeal mentioned above, the Commission took a different view. It held that since the Central Bank’s Monetary Board is a government body, a bank operating under its licence is a public authority under Section 43(g) [(උ) in the Sinhala text]. The SDB order itself says it follows that decision.
On March 5, 2026, the
Court of Appeal confirmed that a private television station broadcasting under
a government licence is a public authority under Section 43(g), as reported here.
It was reported on November 1 that the Commission also decided Dialog, which
uses radio frequencies under a licence, as a public authority. But that report
also said this does not automatically oblige it to release every record
requested. More details here.
So, the October 21 order is not the first decision on a private bank. It applies a position the Commission has held since 2024 to another bank. The claim in one social media post that previously “only state banks” were covered by the Act is therefore also wrong.
The Ruling Is Not Final and Does Not Automatically Bind All Banks
Under Section 34 of the Act, a citizen, or a public authority unhappy with a Commission decision can appeal to the Court of Appeal within one month of being informed of it. As of November 9, we could not confirm whether SDB Bank had appealed.
This order covers one appeal involving one bank. If another bank refuses an information request, that will have to be decided through the appeal process. Since all licensed banks work under the same licensing system, the Commission can be expected to apply the same reasoning. But we could not find any Court of Appeal ruling on a private bank.
Media Reports Left Out Several Points That Needed Correcting
Most reports got the date of the ruling, the appeal number, the Commissioners, and the bank’s arguments largely right. But the points below could mislead readers.
No Official Public Response From the Banking Sector
As of November 9, 2026, we could not find any official public statement on the order from the Sri Lanka Banks’ Association (SLBA), which represents licensed commercial and specialised banks, the Central Bank of Sri Lanka, which supervises the banking sector, or SDB Bank, the bank involved. The SLBA’s official website (here) carried no statement either.
However, a question arises over how the duties of a public authority apply to a private bank whose status is limited to its licensed service. These include appointing Information Officers and Designated Officers (Section 23), displaying their details at the institution (Section 26), maintaining records (Section 7), and submitting annual reports to the Commission (Section 10). The SDB order does not address these points.
How a Bank Customer Should Request Information
Send a written request to the bank’s Information Officer (Section 24). If no Information Officer has been appointed, the head of the institution or its chief executive is treated as that officer (Section 23). A decision should come within 14 working days (Section 25). If the request is refused, you can appeal to the bank’s Designated Officer within 14 days (Section 31), and then to the Commission within two months (Section 32). Complaints about banking services are better sent to the Central Bank department or the Financial Ombudsman listed above rather than filed as RTI requests.
Note: This is a developing story. We will update this report after the Commission decides on releasing the information, or after SDB Bank, the Sri Lanka Banks’ Association, or the Central Bank responds.
Conclusion:
It is true that the RTI Commission decided on October 21, 2026 that Sanasa Development Bank is a public authority. But that status is limited to its licensed banking service under Section 43(g) of the Act, and the bank does not become a government institution.
The Commission took the same position on Nations Trust Bank in 2024, and in that case ruled that the bank was right to refuse another company’s loan documents. So, saying private banks are now subject to the RTI Act for all information, just like government institutions, and that anyone can request bank information, leaves out essential context.
The SDB order has not yet decided whether the requested information must be released. The bank must file written submissions on or before November 13 and the appellant on or before November 27, and the appeal is due to be considered on December 2. As of November 9, 2026, we found no public response to the order from SDB Bank, the Banks’ Association, or the Central Bank.
This analysis is based on the relevant provisions of the Act, orders of the RTI Commission and related court rulings.
Imagine being able to file a request and see any bank’s files, or even someone else’s account. That is roughly how many readers understood the headlines from October 26, which said, based on an RTI Commission ruling of October 21, 2026, that Sri Lanka’s private banks were now subject to the RTI Act. We compared those reports with the Commission’s published order, the Right to Information Act No. 12 of 2016 and earlier decisions of the Commission and the Court of Appeal, paying special attention to one question: can this ruling be used to get another person’s bank account details? Here is how the claim spread.
Social Media Posts:
From October 26, posts saying private banks were now subject to the Right to Information (RTI) Act were shared on social media in Sinhala, Tamil, and English.
A financial advice page posted on October 27 under the headline “Private banks also come under the RTI Act!” Its image said banks “must give the information requested” and called Sanasa Bank a “state authority”. Its description also said private banks could be treated as “state officials”.
Another page’s post, with an image saying, “Central Bank-licensed banks are subject to the RTI Act”, was shared to several groups on October 27.
Mainstream media also carried the story. The Hiru News Facebook page posted on October 26 under the headline “Private banks in Sri Lanka also come under the RTI Act”. A post by NewSin.lk the same day said that previously “only state banks” were directly subject to the Act, and that citizens now had the right to request information from “all licensed private banks”.
Claim Under Investigation: All licensed private banks in Sri Lanka are now directly subject to the RTI Act, just like government institutions, so any citizen can request information from them.
The Commission’s Ruling Came in One Appeal Involving Sanasa Development Bank
On April 7, 2025, a loan customer at SDB Bank’s Maharagama branch asked for a report on unclear terms in his loan agreement and on how his interest rate was calculated. The branch replied by email on April 9. Not satisfied, he appealed to the RTI Commission on July 29, 2025, according to the Commission’s order, available here.
At the hearing, the bank said it had emailed the requested information within four days and argued that as a company incorporated under the Companies Act No. 7 of 2007, it was not a “public authority” under the Act. Chairman Dayaratne Lankapura and Commissioners Attorney-at-Law Kishali Pinto-Jayawardena and A. M. Nahiya rejected that argument in their order of October 21, 2026, in appeal RTIC/Appeal/1005/2025.
The appeal was on the Commission’s hearing list for January 29, 2026, as seen here. According to the order, on January 14, 2026, the bank’s lawyer asked for time to talk to the appellant without first deciding the bank’s status. Then, on January 29, the lawyer asked the Commission to decide that status first.
So, this order decided only the preliminary question of whether the bank is a public authority. It has not yet decided whether the requested information must be released. The bank was told to file written submissions on or before November 13, 2026, and the appellant to file counter-submissions on or before November 27. The appeal is due to be considered on December 2 through written proceedings.
A Public Authority, a Public Service and a Government Institution Are Not the Same
In the Act, “public authority” is a legal term for a body that has a duty to provide information. Ministries, government departments, public corporations, and companies in which the state holds 25 per cent or more of the shares (Section 43(a) to (e)) are public authorities in full. State banks have always been in this group.
A “public function or service” is a statutory or public duty or service carried out by a private body under a contract, joint venture, agreement, or license from the government, one of its agencies or a local authority. Section 43(g) says such a body is a public authority only “to the extent of activities covered by that function”. In the Sinhala text of the Act, this paragraph is numbered (උ), and the Commission’s order uses that numbering.
Media reports cited paragraph (e) of Section 43. But the Commission’s order rests on paragraph (උ) of the Sinhala text, which is paragraph (g) in the English text. Paragraph (e) applies to companies in which the state holds 25 per cent or more of the shares or has a controlling interest.
This Does Not Normally Open Up Other People’s Account Details
The most important question in this story is whether someone can use RTI to get another person’s account balances, transactions, or loan details. Under Section 5(1)(a) of the Act, personal information must be refused if it has no link to any public activity or public interest, or if releasing it would cause an unwarranted invasion of a person’s privacy.
Under the law, such information can be released only if one of two conditions is met: the person concerned has agreed in writing, or a larger public interest justifies the disclosure. The Act also protects information that must be kept confidential because of a fiduciary relationship (Section 5(1)(g)), commercial secrets that would harm a third party’s competitive position (Section 5(1)(d)) and information given in confidence by a third party (Section 5(1)(i)).
When someone asks for confidential information that relates to, or was supplied by, a third party, the Information Officer must ask for that party’s views within a week (Section 29). If the third party objects, the information should be refused. Only if the public interest in disclosure clearly outweighs the private interest can the Commission order its release. Section 6 also allows the exempt parts of a document to be removed and the rest to be released.
On January 20, 2026, in a case against People’s Bank, the Court of Appeal upheld an order to release audit reports and ledger details for the accounts of a partnership in which the customer was the managing partner. The court said that since a partnership is not a legal person separate from its partners, he was not a third party, and that third parties’ details could be removed where needed, as reported here. It was reported on March 28, 2026 that the Court of Appeal quashed a Commission order against the Central Bank’s Monetary Board, saying the Act’s exemptions must be strictly followed, as reported here.
There is also a Commission ruling that deals directly with other people’s accounts. On July 4, 2024, in an appeal against Nations Trust Bank (RTIC/Appeal/1283/2023), the Commission decided the bank was a public authority. But it also ruled that the bank was right to refuse the agreements and documents on loan facilities given to another company in which the appellant held no shares. That was personal information, no link to a public activity or larger public interest had been shown, and so Section 5(1)(a) applied. That ruling is here.
Section 77 of the Banking Act deals with the “Declaration of secrecy” (here), and a 1998 report noted that it protects depositors’ confidentiality (here). Section 4 of the RTI Act gives priority over other written laws, but we could not find any court ruling that balances it against a private bank’s account secrecy. The main provisions of the Personal Data Protection Act take effect from January 1, 2027 (here), which may raise new questions about bank data.
In short, this position gives customers a legal route to ask, under RTI, for information about their own accounts, loans or bank decisions that affect them. Getting another person’s account details requires that person’s written consent or strong public interest, and the Commission or the courts will decide each request on its own merits.
The Commission’s Position on Private Banks Has Changed Since 2018
According to the hearing notes of a 2018 appeal against the Central Bank (RTIC Appeal 98/2018), the appellant said the Commission had told him, in an earlier appeal against Commercial Bank, that private banks did not fall within the Act. The record is here.
But in the 2024 Nations Trust Bank appeal mentioned above, the Commission took a different view. It held that since the Central Bank’s Monetary Board is a government body, a bank operating under its licence is a public authority under Section 43(g) [(උ) in the Sinhala text]. The SDB order itself says it follows that decision.
So, the October 21 order is not the first decision on a private bank. It applies a position the Commission has held since 2024 to another bank. The claim in one social media post that previously “only state banks” were covered by the Act is therefore also wrong.
The Ruling Is Not Final and Does Not Automatically Bind All Banks
Under Section 34 of the Act, a citizen, or a public authority unhappy with a Commission decision can appeal to the Court of Appeal within one month of being informed of it. As of November 9, we could not confirm whether SDB Bank had appealed.
This order covers one appeal involving one bank. If another bank refuses an information request, that will have to be decided through the appeal process. Since all licensed banks work under the same licensing system, the Commission can be expected to apply the same reasoning. But we could not find any Court of Appeal ruling on a private bank.
Media Reports Left Out Several Points That Needed Correcting
Most reports got the date of the ruling, the appeal number, the Commissioners, and the bank’s arguments largely right. But the points below could mislead readers.
No Official Public Response From the Banking Sector
As of November 9, 2026, we could not find any official public statement on the order from the Sri Lanka Banks’ Association (SLBA), which represents licensed commercial and specialised banks, the Central Bank of Sri Lanka, which supervises the banking sector, or SDB Bank, the bank involved. The SLBA’s official website (here) carried no statement either.
However, a question arises over how the duties of a public authority apply to a private bank whose status is limited to its licensed service. These include appointing Information Officers and Designated Officers (Section 23), displaying their details at the institution (Section 26), maintaining records (Section 7), and submitting annual reports to the Commission (Section 10). The SDB order does not address these points.
How a Bank Customer Should Request Information
Send a written request to the bank’s Information Officer (Section 24). If no Information Officer has been appointed, the head of the institution or its chief executive is treated as that officer (Section 23). A decision should come within 14 working days (Section 25). If the request is refused, you can appeal to the bank’s Designated Officer within 14 days (Section 31), and then to the Commission within two months (Section 32). Complaints about banking services are better sent to the Central Bank department or the Financial Ombudsman listed above rather than filed as RTI requests.
Note: This is a developing story. We will update this report after the Commission decides on releasing the information, or after SDB Bank, the Sri Lanka Banks’ Association, or the Central Bank responds.
Conclusion:
It is true that the RTI Commission decided on October 21, 2026 that Sanasa Development Bank is a public authority. But that status is limited to its licensed banking service under Section 43(g) of the Act, and the bank does not become a government institution.
The Commission took the same position on Nations Trust Bank in 2024, and in that case ruled that the bank was right to refuse another company’s loan documents. So, saying private banks are now subject to the RTI Act for all information, just like government institutions, and that anyone can request bank information, leaves out essential context.
The SDB order has not yet decided whether the requested information must be released. The bank must file written submissions on or before November 13 and the appellant on or before November 27, and the appeal is due to be considered on December 2. As of November 9, 2026, we found no public response to the order from SDB Bank, the Banks’ Association, or the Central Bank.
This analysis is based on the relevant provisions of the Act, orders of the RTI Commission and related court rulings.










