Regulators Alarmed by Risky Loans, But Don’t Know Who Holds Them