Sanjeewa Bandaranayake
Chief Executive Officer/General Manager – People’s Leasing & Finance PLC
Sanjeewa Bandaranayake is Chief Executive Officer/General Manager of People’s Leasing & Finance PLC, bringing over 36 years of professional experience, including more than three decades in Sri Lanka’s NBFI sector. He joined PLC in 2007 and became its first internally promoted CEO in August 2024, having led key functions including Finance, Treasury, Human Resources, IT, Credit and Marketing. A Fellow of CA Sri Lanka and several international accounting bodies, he has held leadership roles across major industry associations. Under his leadership, PLC continues to advance financial inclusion, digital transformation, operational excellence and sustainable growth while strengthening its position in Sri Lanka’s financial services sector.
As financial services become increasingly digital, protecting customers requires more than sophisticated technology. It demands strong governance, constant vigilance and a culture of shared responsibility.
Sanjeewa Bandaranayake, Chief Executive Officer/General Manager of People’s Leasing & Finance PLC, explores the evolving cybersecurity landscape and the measures required to strengthen digital resilience.
Drawing on more than three decades of experience in Sri Lanka’s NBFI sector, he discusses social engineering, digital fraud, AI-driven threats, data privacy and customer awareness.
His perspective underscores a fundamental principle: digital transformation must advance alongside security, trust and responsible risk management to enable sustainable financial growth.
As digital financial services continue to expand rapidly across Sri Lanka, what are the most significant cyber threats and fraud risks facing financial institutions and their customers today?
As digital financial services continue to expand rapidly across Sri Lanka, the most significant cyber threats and fraud risks facing financial institutions and their customers today are largely driven by social engineering, digital payment fraud and evolving cyberattack techniques.
One of the most prominent threats is social engineering, where scammers manipulate customers into revealing sensitive information by impersonating trusted entities such as banks or financial institutions. Common attack methods include phishing through forged emails, smishing through fraudulent SMS messages and vishing through deceptive phone calls. These attacks continue to rise due to their effectiveness in exploiting human trust rather than technical vulnerabilities.
In parallel, the rapid adoption of digital payments and online financial services has made digital platforms a major target for cybercriminals. Fraudsters increasingly create fake financial portals and malicious websites designed to closely resemble legitimate platforms. With advances in AI and modern attack techniques, these fraudulent platforms have become highly sophisticated, making it increasingly difficult for customers to distinguish genuine services from malicious ones.
Another growing concern is mobile app-based fraud. Cybercriminals are using fraudulent mobile applications to steal customer credentials, financial information and other sensitive data. As the use of mobile financial services continues to increase, this attack vector presents a significant risk to both customers and institutions.
Beyond external threats, financial institutions must also pay close attention to insider threats and internal IT governance. Weak access controls, inadequate monitoring, poor segregation of duties and insufficient security governance can create serious internal vulnerabilities. Strengthening cybersecurity resilience therefore requires not only defending against external attackers but also improving internal controls, governance frameworks and security awareness across the organisation.
Could you outline your organisation’s cybersecurity strategy and the key initiatives that have been implemented to strengthen digital resilience and protect customers from emerging threats?
Our organisation’s cybersecurity strategy is focused on strengthening digital resilience, protecting customer trust and proactively responding to emerging cyber threats through a risk-based and governance-driven approach.
We recognise that the human factor remains one of the weakest links in cybersecurity. Therefore, one of our key strategic priorities is enhancing cybersecurity awareness among both staff and customers through continuous awareness programmes, training sessions and targeted campaigns. These initiatives help build a strong security culture and improve resilience against emerging threats.
From a technology perspective, we continuously review and strengthen the security controls of our online and mobile financial platforms. Security features, internal validations and system controls are regularly assessed and updated to ensure our digital channels remain resilient against evolving threats. Our focus is not only on securing existing systems but also on proactively identifying vulnerabilities and strengthening defences.
We also emphasise continuous improvement in internal process governance and system controls, especially as digital capabilities and business features evolve. Our approach is built on the principle that security must be embedded into processes and technology from the initial design and implementation stages rather than treated as an afterthought.
From a governance perspective, we follow a three-lines-of-defence model for information security, supported by close collaboration among IT, Information Security, Risk Management, Compliance and Internal Audit functions. This layered governance model ensures effective oversight, accountability and independent assurance across the organisation.
As a regulated financial institution, we operate in compliance with the requirements of the Central Bank of Sri Lanka. However, our focus goes beyond regulatory compliance or checklist-based implementation. We prioritise understanding the actual risks, business implications and effectiveness of controls to ensure meaningful cybersecurity resilience.
Our information security reporting structure is designed with clear segregation to prevent conflicts of interest. This enables independent reporting, transparent escalation of risks and timely decision-making. All identified cyber risks are assessed, prioritised and managed in accordance with our technology risk management framework to ensure appropriate treatment and continuous improvement.
Fraudsters are continuously developing new methods to exploit digital platforms. What fraud prevention and cyber risk management frameworks has your organisation adopted to detect, prevent and respond to such threats?
At People’s Leasing & Finance PLC, we follow a comprehensive information security framework designed in alignment with industry best practices, regulatory requirements and internationally recognised standards such as ISO 27001:2022.
Our Information Security Policy serves as the foundation of our cybersecurity governance and operations, providing strategic direction for protecting information assets, digital platforms and customer data. This policy is further supported by our Technology Risk Management Framework, which enables us to systematically identify, assess, monitor and mitigate cyber risks across the organisation.
To effectively manage fraud and emerging cyber threats, we have adopted a proactive approach that focuses on prevention, detection and response. This includes implementing layered security controls, strengthening system monitoring, enhancing access controls and continuously reviewing control effectiveness to address evolving threat scenarios.
We have also established both internal and external reporting channels to monitor emerging cyber threats, fraud patterns, industry trends and scam activities. These channels help us stay informed about new attack methods and ensure a timely response to potential threats. All reported incidents, suspicious activities and threat intelligence are treated as high priorities and thoroughly assessed to mitigate risks before they escalate into significant incidents.
Our overall approach emphasises continuous improvement, resilience and proactive risk management to ensure that fraud prevention and cybersecurity remain integral to our business operations and digital transformation initiatives.
Customer trust is fundamental to the success of digital financial services. What measures have you introduced to safeguard customer information, secure transactions and maintain confidence in your digital channels?
Customer trust is fundamental to the success of digital financial services, and at People’s Leasing & Finance PLC, protecting customer information and securing digital transactions remain top priorities.
We follow a continuous improvement approach to strengthen our digital channels, recognising that cybersecurity is not something achieved overnight but an ongoing journey that requires constant attention and enhancement. As cyber threats continue to evolve, we continuously invest in improving our controls, processes and technologies to maintain secure and resilient digital platforms.
Frequent security assessments are conducted by both internal teams and independent external assessors to proactively identify vulnerabilities and strengthen our digital systems. These assessments help us continuously improve our security posture and ensure our platforms remain resilient against emerging threats.
To secure transactions and protect customer accounts, we have implemented strong authentication mechanisms and transaction monitoring controls. Security alerts and validation measures are embedded within our digital payment systems to ensure that only authorised users can perform transactions through our platforms.
At the same time, customer awareness plays a critical role in maintaining digital security. Customers also share responsibility for digital security, particularly when it comes to safeguarding their login credentials.
We encourage customers to remain vigilant and report any suspicious or fraudulent activity immediately. Early detection and timely reporting can significantly reduce the impact of fraud and help prevent major incidents. Maintaining customer trust requires a shared commitment, combining strong institutional security with informed and security-conscious customer behaviour.
Artificial intelligence is transforming both cybersecurity and cybercrime. How is your organisation leveraging AI to strengthen security, and what new risks do AI-driven threats present to the financial sector?
At People’s Leasing & Finance PLC, we recognise the value of AI in strengthening cybersecurity capabilities. AI-driven technologies are increasingly being used to enhance proactive threat monitoring, improve anomaly detection and support automated response mechanisms. These capabilities enable faster identification of suspicious activities, unusual transaction patterns and potential cyber threats, allowing organisations to respond more efficiently and reduce risk exposure.
However, while AI strengthens defensive capabilities, it also introduces new risks. Cybercriminals are leveraging AI to develop more sophisticated attack methods, making threats more difficult to detect and prevent. AI can be used to craft highly convincing phishing emails, generate malicious payloads, create fraudulent websites that closely resemble official platforms and execute impersonation scams using technologies such as deepfakes.
These AI-driven attacks significantly increase the risk of social engineering and digital fraud, particularly within the financial sector, where customer trust and secure transactions are critical. The growing sophistication of AI-enabled threats demands stronger security controls, improved monitoring and increased awareness among both employees and customers.
To address these risks, we ensure that AI adoption is governed by internal policies, risk management processes and internal controls. AI-related risks are continuously assessed as part of our broader cybersecurity and technology risk management framework to ensure responsible adoption while maintaining resilience against emerging threats.
Customer awareness remains one of the most important defences against cybercrime. What initiatives has your organisation undertaken to educate customers about phishing, social engineering, online scams and other forms of digital fraud?
We conduct regular awareness campaigns focused on the safe and secure use of digital financial channels. These campaigns are delivered through multiple official communication channels, including our corporate website, verified social media platforms and SMS notifications. This multi-channel approach ensures that security awareness messages reach a wide customer base effectively and consistently.
In addition, we have implemented security alert mechanisms such as SMS-based login notifications for our online platforms. These alerts inform customers whenever their accounts are accessed, enabling them to quickly identify and respond to any unauthorised login attempts.
Through these initiatives, we aim to strengthen customer vigilance and promote safer digital financial practices.
Data privacy and information security have become critical governance priorities. How does your organisation ensure the protection of customer data while maintaining compliance with regulatory and industry requirements?
From a technical perspective, we have implemented robust security controls across all systems that process customer data. These include data encryption to protect sensitive information, strict access control mechanisms to ensure that only authorised personnel can access data and perimeter security controls to safeguard our systems from external threats.
In addition to these technical safeguards, all systems undergo comprehensive security assessments conducted by both internal teams and independent external assessors. These assessments help identify vulnerabilities in a timely manner, allowing us to remediate risks proactively and continuously strengthen our security posture.
From a data privacy standpoint, the organisation is actively working towards full compliance with the Personal Data Protection Act of Sri Lanka. We are strengthening our governance frameworks and operational processes to ensure the proper handling, protection and lawful processing of personal data, thereby safeguarding the rights of data subjects.
At People’s Leasing & Finance PLC, we view regulatory requirements and industry best practices as opportunities to enhance business value through effective risk management, rather than simply as compliance obligations.
Digital financial services, payments and financial technology continue to evolve rapidly. What security innovations or technologies have you introduced to enhance the safety and convenience of digital financial services?
We adopt a layered security approach, combining multiple controls to strengthen the overall security posture of our digital platforms. These include OTP-based two-factor authentication to verify user identity during login, biometric authentication for secure and convenient access, and transaction OTPs to validate financial transactions.
In addition, we have implemented real-time login alerts to notify customers of account access activities, enabling them to quickly identify any unauthorised access attempts. Strong encryption mechanisms are applied to protect sensitive data both in transit and at rest, ensuring the confidentiality and integrity of customer information.
To further enhance mobile security, we have introduced root detection mechanisms to prevent compromised or tampered devices from accessing our services. We also implement account balance masking to protect sensitive financial information from unauthorised visibility.
Overall, these security features work together to create a robust, multi-layered defence framework that enhances trust, strengthens resilience and ensures a secure and seamless digital financial experience for our customers.
Regulatory expectations surrounding cybersecurity and operational resilience continue to increase. How does your organisation approach compliance, risk management and governance in an increasingly complex threat environment?
Our approach is centred on integrating regulatory requirements with enterprise risk management and industry best practices, rather than treating compliance as a standalone activity. We align our cybersecurity and operational resilience practices with applicable regulatory guidelines while ensuring that controls are implemented based on risk severity and business impact.
From a governance perspective, we follow a well-defined framework with clear roles, responsibilities and accountability across IT, Information Security, Risk Management, Compliance and Internal Audit functions. This ensures effective oversight through a multi-layered control environment and supports independent assurance over security and resilience practices.
Risk management is embedded into all stages of our processes, including system design, implementation and ongoing operations. We continuously assess cyber risks, emerging threats and operational vulnerabilities and ensure that appropriate controls are implemented and regularly reviewed for effectiveness.
Looking ahead, what do you see as the biggest challenges and opportunities in combating cybercrime, and what advice would you offer to customers and business leaders seeking to protect themselves in an increasingly digital world?
In my view, the most important principle in cybersecurity is to get the fundamentals right. This includes having a clear understanding of the environment, stakeholders, assets, threats, vulnerabilities and associated risks. A strong foundation in these areas enables effective risk management and continuous improvement of security controls.
Another key factor is the importance of properly scoping and tailoring security requirements to the specific risk profile and operational environment. Security controls should not be applied in a generic or overly complex manner; instead, they must be practical, reliable and proportionate to the risks they are designed to mitigate, while also supporting business objectives and growth.
Ultimately, effective cybersecurity is not about implementing every possible control, but about implementing the right controls in the right way to manage risk effectively and enable secure business growth.
