The private banker, Patrice Lescaudron, was sentenced to five years in prison in 2018 for fraud and forgery. He admitted cutting and pasting client signatures to divert money and make stock bets without their knowledge, causing more than $150 million in losses, according to the Geneva criminal court.

The regulator, Finma, publicly censured Credit Suisse in 2018 for inadequately supervising and disciplining Mr. Lescaudron as a top earner, and said he had repeatedly broken internal rules, but it revealed little else about the bank’s actions in the matter. Credit Suisse said it discovered Mr. Lescaudron’s fraud in September 2015 when a stock he had bought for clients crashed.

However, the report, commissioned by Finma in 2016 and reviewed by The Wall Street Journal, found Mr. Lescaudron’s activities triggered hundreds of alerts in the bank that weren’t fully probed in the 2009-15 period studied. In addition, around a dozen executives or managers in Credit Suisse’s private bank knew Mr. Lescaudron was repeatedly breaking rules but turned a blind eye, proposed lenient punishment for his misconduct or otherwise glossed over the issues because he brought in around $25 million in revenue a year, the report found.

It said Mr. Lescaudron’s “disregard of internal directives and guidelines, the inadequate safeguarding of client documentation as well as unauthorized settlements of client transactions had been known to the bank since June 2011.”

The report found the irregularities were analyzed and escalated to a certain extent, but not enough. “None of the parties involved felt responsible for conclusively analyzing the already known as well as the resulting questions and drawing the necessary conclusions,” it said.

A business-risk manager who reported some of the incidents to superiors told law-firm investigators that he had feared further escalation would be seen as disloyal or that he would lose his job, according to the report.

Credit Suisse lost a bid last year in Switzerland’s Supreme Court to prevent the 272-page report by Swiss law firm Geissbühler Weber & Partner from being accessed by Geneva prosecutors still investigating the bank over the matter.

According to the report, the bank fired two executives after its own investigations into the fraud, and three more got written sanctions in their employment files.

A Credit Suisse spokesman said the report was part of the early stages of the review Finma concluded in 2018. It said the review “did not reveal any facts that would support the criminal complaints against Credit Suisse.” After Finma’s 2018 rebuke, Credit Suisse said it had improved its systems and added hundreds more compliance staff.

Mr. Lescaudron served a two-year pretrial detention and was released in 2019. He killed himself last year.

Finma declined to comment. The law firm said it couldn’t comment. The Geneva prosecutor’s office declined to comment on its investigation. A lawyer for Mr. Lescaudron’s family declined to comment.

The Journal reviewed a copy of the law firm’s April 2017 report obtained by some former clients of Mr. Lescaudron who formed a group called CS Victims. The former clients include Bidzina Ivanishvili, a billionaire former prime minister of Georgia who is suing Credit Suisse in Singapore and Bermuda for around $800 million, alleging breach of trust. Credit Suisse is contesting Mr. Ivanishvili’s claims and denies any wrongdoing.

A spokesperson for CS Victims said the report shows Credit Suisse ignored alerts and warnings and had multiple opportunities to prevent Mr. Lescaudron’s crimes but chose not to. The spokesperson said the bank “must now accept responsibility and compensate the clients without delay.”

The law firm’s report said it didn’t find misconduct by Credit Suisse employees executing Mr. Lescaudron’s falsified orders. But it said the fact the orders could be falsified for so long without anyone noticing showed weaknesses in the bank’s antifraud measures.

The high-profile case is among several controversies that have bruised Credit Suisse’s standing with shareholders and the global rich who expect it to be a fortress for their money. Finma started enforcement proceedings in September over the bank’s handling of employee surveillance after a spying scandal, and Swiss federal prosecutors charged it with failing to prevent money laundering through the bank by a Bulgarian criminal organization and an employee more than a decade ago.

In January, Credit Suisse said it would post a fourth-quarter 2020 loss because of an $850 million legal charge for toxic security sales.

Credit Suisse said it was cooperating with Finma in the spying enforcement proceedings and would incorporate lessons learned. It denies the allegations in the federal criminal charges.

Chief Executive Thomas Gottstein said in December the bank would be more disciplined to avoid future litigation.

Mr. Lescaudron joined Credit Suisse in 2004 after working for a cosmetics company in Russia and as an auditor. He hadn’t worked in banking but swiftly became one of the bank’s top revenue producers as a handler to Russian and post-Soviet state billionaires.