A couple of weeks ago, I was at a lunch discussion of immigration policy, of all things, in which I defended Citigroup’s decision to move various risk-management operations from New York to Mexico. I was talking to a woman who was complaining about the move and about the amount of time that the Mexico office would sometimes take before arriving at a decision. But my view was that moving such operations to Mexico was probably a good thing, on net. After all, Citi’s Mexican bank — Banamex — is one of the most efficient banks in the Americas, and makes a lot of money while taking very little in the way of risk. And on the other side of the trade, the New York office was precisely the place where Citi’s risk management was worst. After all, it was New York which missed the entire subprime problem, along with many other incidents in which Citi managed to blow itself up.

Now, however, it seems that Banamex has a level of risk management which is bad even by Citi standards. Earlier this week a Reuters report showed how Banamex managed to lose some $85 million making bad loans to homebuilders, despite opposition from the head office:

The $300 million in loans were made starting in 2009. Bank executives at Citigroup in New York turned down at least some of the business because it seemed too risky, two sources involved with the lending process said… New York balked, but the bank’s Mexican subsidiary, Banco Nacional de Mexico, better known as “Banamex,” went ahead and lent to the homebuilders. Banamex, which is the second biggest bank in Mexico with 1,700 branches, has room to make some loans that do not get vetted by New York, as long as its overall portfolio is safe enough, the sources said. “New York turned them down because they made no sense,” said one of the sources, referring to loan applications by Mexican homebuilders at the time.

Today, things got much worse: it turns out that Citigroup has had to write off some $400 million of what were previously thought to be perfectly safe loans to an oil services company called Oceanografia.

The Oceanografia loans, which totaled $585 million at the end of last year, were ostensibly simple advances against Pemex receivables. The state-owned Mexican oil giant can be slow, so if you’re owed money by Pemex, and need a bit of liquidity, you can essentially sell your receivables to Banamex. The problem is that Banamex seems to have bought a large number of fake pieces of paper:

Citi estimates that it is able to support the validity of approximately $185 million of the $585 million of accounts receivables owed to Banamex by Pemex as of December 31, 2013. This $185 million consists of approximately $75 million supported by documentation in Pemex records and approximately $110 million of documented work performed that was still going through the Pemex approval process.

There are two huge failures here. The first was in the accounts receivable department, where Citi employees, through incompetence or venality, failed to ensure that the assets they were lending against were real. The second is higher up, in the bigger Banamex and Citigroup risk-management departments, where no one seems to have stopped to ask how on earth a simple accounts-receivable credit line could have grown to more than half a billion dollars in size. After all, Pemex might be slow, and it might be big, but it’s not so slow and so big that it’s likely to owe a single vendor $585 million just in simple unpaid invoices which are wending their way through its bureaucracy. As Matt Levine says:

This went on for years? That to me is the oddest part. Oceanografia is — somewhat obviously — not a public company, but a random assortment of pseudo-comps suggest that typical accounts receivable turnover in the oil-services industry averages around three months. One imagines that Pemex gets more breathing room than the average customer, but still, at some point, wouldn’t Banamex call Oceanografia after not getting paid for a year or two? Did Oceanografia just say “yeah, I know, what jerks, they’re really slow, keep trying”? And Banamex kept extending more credit on more fake receivables, to a total amount of $585 million? And never called Pemex?

This explains why Citi CEO Mike Corbat is saying that “all will be held equally responsible” in this affair: the risk managers who let this one through the cracks just as much as outright criminals who (maybe) accepted kickbacks to look the other way. In a bank the size of Citi, you can’t just assume that all your employees are excellent, law-abiding folk who will catch any attempt to get around the rules: you need protocols that ensure massive frauds simply can’t happen, even in the face of employee misconduct or idiocy.

One big question raised by this loss — and the mortgage problems, too — is what they mean for legendary Banamex chief Manuel Medina-Mora, a man who almost became Citi’s CEO. Medina-Mora is in charge not only of Banamex, these days, but also the entire global consumer bank — Citibank, as it’s known everywhere except for Mexico. There are two possibilities: either, on the one hand, Medina-Mora has simply been stretched too thin, and was forced to take his eye off the Mexican ball. Or, on the other hand, Medina-Mora made his name and his reputation by loaning enormous amounts of money to large Mexican companies, be they homebuilders or oil-services vendors, and that was a strategy which was bound to blow up in his face eventually.

Citibank has a deserved reputation for consistently making bad loans — few banks have failed more often, or more spectacularly. The latest problems in Mexico are manageable even by Mexico’s own standards, let alone by the standards of the parent company. But they do show that Citi still hasn’t managed to get its risk controls nailed down. Probably, it never will: it’s just too big. Which means that this kind of thing is going to continue to happen, not only at Citi, but also at every other commercial lender of its size.