Sri Lanka's most senior defence official on Monday became the latest government figure to face possible criminal charges over "major lapses" linked to the Easter Sunday bombings that killed 258 people.
Hemasiri Fernando, who was defence secretary before the April 21 bombing of three churches and three hotels, should be investigated for his failure to prevent or minimise the attacks, Attorney General Dappula de Livera said.
The attorney general said in a letter to Sri Lanka's acting police chief that a presidential commission of inquiry had found "major lapses" by Fernando, who has since resigned from his top job.
While Fernando is the most senior defence official to face action, President Maithripala Sirisena also suspended police chief Pujith Jayasundara after he refused to step down over the handling of the attacks.
Jayasundara and Fernando have testified before a parliamentary inquiry and accused Sirisena of failing to follow established protocols in assessing threats to national security.
Last week, the attorney general ordered investigations against nine police officers for failing to act on warnings ahead of the bombings, carried out by Islamic State-backed local jihadists.
All nine were senior officers in the districts where the attacks were carried out and have now been transferred from their posts pending disciplinary action and criminal investigations.
Authorities have admitted that warnings sent by India of an impending attack by a local group, the National Thowheeth Jama'ath (NTJ), were ignored.
Some 45 foreign nationals were among the dead and 500 people were injured in the attacks. The tourist hotspot has been under a state of emergency since.
Sri Lanka's State Intelligence Service (SIS) has also been criticised for failing to act on the Indian warnings, but no-one from the state spy service has been put under investigation.
Sirisena, who is also defence minister and law and order minister, has also faced allegations that he could have prevented the attacks.
The president has objected to a parliamentary investigation into the attacks and ordered police not to co-operate. The hearings have gone ahead, however, and police have testified before legislators.
Indian intelligence shared information about the targets -- gleaned from a jihadist in Indian custody -- as early as April 4, more than two-and-a-half weeks before the attacks.