A top executive at Metropolitan Bank and Trust Co. (Metrobank), the second-largest bank in the Philippines, is accused of masterminding a fraudulent loan scheme that screwed the bank out of at least 900 million pesos ($17.75 million), local media reported on Friday.

Metrobank officials acknowledged the scam on Friday morning after the Philippine Daily Inquirer broke the news. The fraud was allegedly carried out by the bank’s Vice President for Corporate Services, who was arrested in a sting operation by agents of the National Bureau of Investigation (NBI) on Monday, July 17.

The suspect, identified as Maria Victoria Lopez, was employed by Metrobank for about 30 years and was a year from mandatory retirement, the Inquirer report said.

Billions may be missing

A Metrobank official who spoke to the Inquirer said that investigators from the country’s central bank, the NBI, and the bank’s own internal auditors had confirmed at least 900 million pesos had been stolen, but that the scam may have cost the bank as much as 2.5 billion pesos ($49.3 million).

A deputy director of the NBI explained to local television network ABS-CBN that Lopez was caught when she attempted to transfer P2.25 million pesos in interest from two bogus loans issued in the name of Universal Robina Corp.

, a well-known manufacturer of food products in the Philippines.

Irregularities in the documents led the bank’s audit team to contact the company, which denied any knowledge of the two loans, reportedly worth a total of 1.75 billion pesos ($34.5 million).

The Inquirer report said that Lopez had been moving up to 30 million pesos at a time from the spurious loans to accounts set up under Universal Robina Corp.

The money was then electronically transferred to other accounts, including some at other banks, and then was presumably collected by Lopez or others who may have been working with her.

Investigators admitted Friday that they still had not determined if anyone else was involved in the scam, or how long it had been carried out.

An NBI spokesman said that Lopez was refusing to cooperate with the investigation.

Challenge for regulators

The Metrobank scandal poses a challenge for the new governor of the Philippines’ central bank (the Bangko Sentral ng Pilipinas, or BSP), who was appointed just three weeks ago.

Governor Nestor Espenilla Jr. sought to reassure the public and investors on Friday after the scandal broke, promising a thorough investigation. Espenilla said that, despite the magnitude of the fraud, Metrobank and the banking industry as a whole is well-capitalized, and not at greater risk.

Espenilla was the long-time deputy governor in charge of banking supervision at the BSP. He replaced the respected Amado Tetangco Jr.

, who served an unprecedented 12 years as the head of the central bank, and was in recent years lauded as one of the world’s top central bankers.

Although the Philippine banking system is considered one of the most stable in Asia, it has been battered by a number of high-profile scandals in recent years. In February 2016, Rizal Commercial Banking Corp. (RCBC) was used as a conduit for $81 million stolen by hackers from the central bank of Bangladesh. A branch manager and several others involved in the money-laundering scheme are currently facing charges in that case, which led to the resignation of the bank’s CEO and a fine of one billion pesos ($19.7 million) against RCBC.

Last month, the Bank of the Philippine Islands (BPI) was virtually paralyzed for two days by an “electronic glitch” that caused unusual transactions in customer accounts.

Although BPI said that no account balances were ultimately changed, it has yet to disclose exactly what happened to its systems.

Also in June, BDO Unibank, the country’s largest bank, reported that a number of its automatic teller machines had been compromised by an apparently coordinated “skimming” attack, which led to an undisclosed number of fraudulent transactions.

Although most banks’ stock prices were not affected by the news of the Metrobank fraud, its shares dropped by more than five percent in trading on the local stock market on Friday. Shares in GT Capital Holdings, the parent company of Metrobank, likewise lost about three percent of their value.

The bank listed 1.9 trillion pesos ($37.5 billion) in assets at the end of the first quarter of this year. It had 959 domestic branches and 202 foreign branches or subsidiary offices as of last year, according to the Inquirer report.