How to you know your compliance program isn’t working? For banking giant Citigroup, the answer includes a $400 million loss to fraud and being on the receiving end of two subpoenas.

Citigroup revealed this week that it, and its Mexican subsidiary,  Banco Nacional de Mexico, also known as Banamex, received subpoenas over recently detailed bad loans and allegations they ran afoul of anti-money laundering regulations and the Bank Secrecy Act. The catalyst is the revelation, in February, that Banamex USA was defrauded by as much as $400 million by Mexican oil-services company, Oceanografia SA de CV. Loans secured by Ocenografia were found to be written against non-existent assets. In a separate filing with the Securities and Exchange Commission, Citigroup said it would revise quarterly and annual revenuesโ€œimpacted by an estimated $235 million after-tax ($360 million pretax) chargeโ€ resulting from the fraud.