Bank routinely took out millions of credit in its customers’ names without telling them, to cover losses on products the bank had recommended, yet regulators failed to take action