For one, it is unclear whether the wrongdoing at Citigroup was actually limited to a single Banamex employee, as early reports indicated. The authorities, according to the people briefed on the matter, are investigating whether the scheme involved co-conspirators at the bank's offices in the United States.
Prosecutors also tend to weigh whether an episode was isolated or illustrative of a broader problem. In the case of Banamex, the fraud was the latest in a series of questionable loan deals for the Citigroup unit. Bank employees say that Banamex, which accounts for 13 percent of Citigroup's revenue, undergoes the same level of oversight as any other business arm. But others inside the bank say that the Mexican unit has always had some degree of autonomy from New York.
And even if Oceanografía defrauded Citigroup — and the fraud was indeed an "isolated incident," as the bank has said — Citigroup may have lacked the proper controls to thwart the scheme at its inception.
Under the law, banks must report suspicious activity and set up compliance programs to prevent money laundering and other illegal activity. When banks fail to do so, it could amount to a criminal or civil violation, depending on the severity of the problem. For a breakdown to be criminal, prosecutors would typically need to show that the bank willfully ignored warning signs of the fraud.
Was Citi the Fed's sacrificial lamb?
With the focus on bank controls, the Banamex case and the separate money- laundering investigation in Massachusetts echo other recent Wall Street investigations. Prosecutors have claimed that lax controls enabled drug trafficking, money laundering and business deals with blacklisted countries like Iran and Cuba. In 2012, federal prosecutors penalized HSBC for turning a "blind eye to money laundering that was happening right before their very eyes."
The HSBC case, defense lawyers say, provided a template for prosecutors to go after not just a bank's actions, but its inaction as well.
In January, Mr. Bharara's office announced a criminal case that extracted a $1.7 billion penalty from JPMorgan Chase over accusations that it ignored warning signs about Bernard L. Madoff's Ponzi scheme. Mr. Madoff's firm used JPMorgan as its primary bank for more than two decades.
At Banamex, Oceanografía became one of the bank's largest corporate clients.
Under a short-term lending arrangement, Banamex would advance money to Oceanografía, whose existence hinged almost entirely on government contracts. Banamex issued the loans with the understanding that Oceanografía had received contracts from the state-owned oil monopoly Pemex. Once the work was completed, Pemex would repay the loan to Banamex.
More from the New York Times:
4 Dead and 16 Injured in Fort Hood Attack
In Crimea, Russia Showcases a Rebooted Army
Ruling Is a Win for Big Donors and Party Leaders
But this year, Mexican authorities suspended Oceanografía from obtaining additional government contracts for several months. Shortly after, Banamex discovered a fraud.
There was valid documentation for $185 million of work, Citigroup said, but Banamex had advanced Oceanografía a total of $585 million. Some of Oceanografía's invoices, Citigroup said, "were falsified to represent that Pemex had approved them. A Banamex employee processed them."
Mexican authorities, including lawmakers and the attorney general, have directed their own investigations into the fraud.
Citigroup has said it has worked with the Mexican authorities "to initiate criminal actions" that may allow it to recover some of the missing money.
"We are exploring every available option to recoup the misappropriated funds and we will be relentless in pursuing their recovery," Mr. Corbat said in a memo to employees. "All will be held equally responsible and we will make sure that the punishment sends a crystal-clear message about the consequences of such actions."