“None of the 10 largest U.S. banks have policies that would require them to deny bonuses to executives who engaged in inappropriate risk-taking.”