A $2 billion fraud at India’s Punjab National Bank (PNB) may have been orchestrated by a few rogue employees, but it escaped detection because of widespread risk-control and monitoring lapses in many areas of the bank, the bank’s own internal probe has found.

PNB, India’s second-biggest state-controlled lender, has previously alleged that a handful of staff at a single Mumbai branch issued fake bank guarantees over several years to help two jewellery groups – controlled by Indian diamond magnate Nirav Modi and his uncle Mehul Choksi – raise billions of dollars in foreign credit and commit India’s biggest-ever bank fraud.

The bank’s CEO Sunil Mehta told Reuters in April he had suspended 21 officials and “will not spare” others found involved in lapses, but he also described the fraud as a “small turmoil”.

However, a 162-page internal report, produced by PNB officials tasked with probing the fraud, lays bare lapses that go far beyond a few branch officers. The report, a copy of which was reviewed by Reuters, lays out how failings by 54 PNB officials – ranging from clerks to foreign exchange managers, and auditors to heads of regional offices, allowed the fraud to be perpetrated. Eight of the 54 are among those who have been charged by the federal police for their roles in the scandal.

The report, which the PNB officials presented to the bank’s fraud risk management arm on April 5, along with dozens of pages of annexed bank records and internal e-mails, is also part of the evidence submitted by the federal police in its court case against those allegedly involved in the fraud. The report’s findings have not previously been made public.

The unearthing of the fraud in January has not only exposed shortcomings in the management of PNB, but has also undermined confidence in India’s state-run banking sector, which controls over two-thirds of the nation’s bank assets.

The damning conclusions of the report stand in contrast to the lack of regulatory action taken by the authorities since the fraud was reported.

No penalty has been imposed on PNB as a result of the fraud and there has been no senior management shake-up.

A PNB spokesman told Reuters the bank “cannot share details on a sub-judice case”. He added: “We must reiterate that we will not spare anybody who is found guilty irrespective of the level or position in the bank,” he said.

PNB did not respond to a question about what action was taken against the “erring” officials mentioned in the report.

The Reserve Bank of India, the nation’s central bank, and the Indian government’s federal banking secretary, Rajiv Kumar, didn’t respond to requests for comment.

The report does not say whether the PNB investigators believe those involved in the monitoring failures were aware of the fraud.

Significantly, they said one of the reasons the fraud went undetected for years was because of lapses within some of the bank’s critical areas at its New Delhi headquarters, such as its credit review and international banking units.

“There was enough evidence to suggest failures,” the team of four senior PNB investigators said in its report. “It was observed that blatant system violations/unethical practices/dereliction of responsibilities led bank to such a catastrophe.”

The epicenter of the fraud was PNB’s Brady House branch, housed in a building with an imposing colonial facade in downtown Mumbai. From there, deputy manager Gokulnath Shetty for years issued fraudulent credit guarantees over the SWIFT interbank messaging network, the bank and prosecutors have alleged.

Using those guarantees, companies controlled by Nirav Modi, whose jewelry creations were once adorned by global celebrities, and Choksi, received credit from banks overseas to fraudulently fund their businesses, PNB alleges.

Modi and Choksi, both of whom left India before PNB filed its first police complaint on Jan 29, have denied any wrongdoing.

Shetty’s lawyer has said his client is not guilty.

All face charges of criminal conspiracy and cheating, as well as allegations under India’s prevention of corruption law.

A police source told Reuters on Monday the federal investigating agency last week asked the international police agency Interpol to help locate Modi and Choksi.

Calls and text messages to lawyers for Modi and Choksi went unanswered.

Shetty escaped detection because he did not log his SWIFT transactions on the bank’s internal software — something he was supposed to do because the two systems were not integrated. PNB investigators said the bank’s international banking department and the IT division had delayed the integration work. They had also not complied with central bank advisories in 2016 calling for a comprehensive audit of SWIFT systems in use.

But more simply, the fraud could have been detected if the branch did the basic daily SWIFT reconciliation that, according to internal rules, required logs of transactions on the global payments network to be manually checked against the bank’s internal system, the investigators said.

“Only one activity would have nailed the whole act at the incipient stage,” said the report.

The lapses, however, extended beyond the branch. As per protocol, the daily reconciliation reports should travel up the chain to PNB’s headquarters in New Delhi. Along the way, they would be signed off by the Brady House branch head and sent each month to a Mumbai city regional office that would issue all-clear certificates for the branches it controls.

But despite receiving just two of the 12 monthly reports from the Brady House branch last year, the regional office signed off on a “false” compliance certificate, signalling a clean bill of health for the branch, the report said.

Moreover, despite a massive missing paper trail, none of the senior inspection officers, who conducted 10 visits between 2010 and 2017 to the branch, reported anything “adverse,” PNB’s report stated.

The Mumbai city regional office also missed another vital red flag — the Brady House branch was a star performer, largely because of its dealings with Modi firms, the PNB report said.

Its import and export transactions in the 12 months to March 2017 stood at $3.3 billion, 50 percent higher than recorded two years prior. “The exceptional growth should have been noticed,” the report said.

A former PNB internal audit official who declined to be identified but reviewed the growth numbers mentioned in the report for Reuters, said: “This was sufficient to raise a cause of concern and the reasons thereof should have been investigated.”

Signs that audit practices at Brady House were weak were also flagged by the branch itself, according to two internal PNB documents reviewed by Reuters.

In March 2012, the branch said in an internal memo that an almost 50 percent of the observations flagged in its annual inspection report – mainly auditor queries — remained “un replied/unattended to by respective concerned officers,” calling it a “critical situation.”

Four years later, in 2016, the branch’s assistant general manager issued an internal memo saying around 18 observations — five described as zero-tolerance level issues — were pending. The memo was signed by 10 bank officers, including Shetty.

Shetty joined the forex division at Brady House in April 2010. In March 2011, the branch issued the first fake credit guarantees of $15.5 million to Modi’s firms through SWIFT messages, bypassing the internal banking system, the PNB investigators said.

Over the coming years, Shetty authorized more than 1200 fraudulent credit guarantees, the report said.

As a mid-level employee, Shetty should only have been able to approve transactions of up to 2.5 million rupees ($37,000) without sign-off from more senior officials. But he had been given unlimited approval powers, the investigators said without explaining how this happened.

In the few weeks before his retirement in May last year, Shetty used his personal Yahoo e-mail address to send 22 e-mails — 18 at around midnight — to reconcile large forex transactions involving the Modi group. The use of personal e-mail was “overlooked” by the bank’s treasury department, the report said.

Under PNB policy, no officer should remain in the same office for more than three years, but Shetty retired after serving in Brady House for seven years. Three transfer orders were issued for him during his tenure, but he was never moved, the investigators found.

The report said that it is “incomprehensible” that branch staff did not notice the fraud being committed.