But surely they could create an account that interacts with the rest of the banking system, but doesn't get counted in their balance sheet?

People getting paid by it aren't auditing them each time, so it should be possible to do this at a reasonable scale (e.g. if some clandestine gov entity wanted to fund itself secretly and for free)?