More Wells Fargo & Co customers may have been affected by a scandal over phony accounts than previously believed, the third-largest U.S. lender said in a regulatory filing on Wednesday.

Wells Fargo had previously estimated that up to 2.1 million customers may have had checking and credit-card accounts opened in their names without their permission over a period of several years.

As part of an expanded review there could be “an increase in the identified number of potentially impacted customers,” Wells said.

The search for unauthorized accounts now covers a broader time frame, from 2009 to September 2016. An ongoing analysis of customer data may also be turning up more affected customers, according to Wells’ annual 10-K filing with the U.S. Securities and Exchange Commission.

In a separate filing, the bank said it expects to release findings of the review ahead of its annual meeting on April 25.

Wells initially disclosed the number of affected customers as part of a $185 million settlement in September, leading to multiple government probes, lawsuits and an internal review, and hurting Wells Fargo’s reputation.

Thousands of employees were fired over customer abuses, which stemmed from aggressive sales targets implemented by managers. Wells’ then-CEO John Stumpf abruptly left the bank because of the scandal.

Wells has been working to repair the damage, in part by determining whether customers were charged improper fees or had their credit scores hurt by the phony accounts.

The San Francisco-based lender does not expect that any additional remediation efforts will have a “significant financial impact.” However, it said the review could lead to more legal or regulatory proceedings, reputational damage and other negative consequences.

Eight senior executives, including Chief Executive Tim Sloan and Chief Financial Officer John Shrewsberry, are not receiving cash bonuses for 2016. The bank also dismissed four mid-level executives as part of the probe.