from The New York Times/ Dealbook

The accusations read like a pulp thriller:Citigroup employees in Mexico are suspected of pocketing millions of dollars in kickbacks from vendors. And bodyguards for bank executives bought audio recordings of personal phone calls and created shell companies to disguise their fraud.

A new scandal has erupted at Citigroup’s Mexican unit just months after a $400 million fraud involving a well-connected client. Now the sprawling global bank — which separately announced plans on Tuesday to withdraw from consumer banking in 11 other markets — is wrestling with how to get its house in order in one of its oldest foreign operations. A crucial part of that decision rests on how to nudge aside the most powerful executive overseeing Mexico, a country where Citigroup has been doing business since 1929.

What makes that decision particularly difficult is that the Mexican unit, Banamex, mints money. Still, the scandals at Banamex — and the investigations in two countries that have come as a result — have exposed the bank to risk at a time when Citigroup is trying to reduce its legal and regulatory burdens.

The latest scandal at Banamex centers on the bank’s security unit. An internal investigation, begun by Citigroup in July, found evidence that the security unit was overcharging vendors and may have been taking kickbacks, a person briefed on the investigation said. The internal inquiry also found shell companies that had been set up to look like vendors and receive payments from the Banamex unit.

The security unit was created in 1994, after a former Banamex president had been kidnapped and held for ransom by a guerrilla group. It remained intact after Citigroup acquired Banamex in 2001.

The offices of Banamex, Citigroup’s Mexican unit, in Mexico City. Credit Henry Romero/Reuters

The security unit’s primary purpose was to protect the Banamex leadership, but at some point, the unit started operating beyond its approved duties, according to the person briefed on the matter who was not authorized to speak publicly because of the criminal investigation. The security unit was also providing protection and security consulting services for people outside the bank, sometimes as a courtesy and at other times for money, the internal investigation found. The conduct spanned more than a decade, the investigation found, extending into last year.

The unit, which Citigroup disbanded in light of the investigation, was run by Federico Ponce Rojas, a former official with the Mexican attorney general’s office who resigned from Banamex in December. Mr. Ponce did not respond to requests for comment.

His exit was followed a few months later by the departure of Banamex’s chief executive, Javier Arrigunaga, a 12-year veteran of Banamex’s management team. There was no evidence that the fraud reached executives.

Even so, in a statement on Tuesday, Mr. Corbat called the conduct of individuals in the security unit “appalling.”