Private lender’s outsized risk appetite ultimately proved a major vulnerability