The Federal Reserve and the Office of the Comptroller of the Currency imposed a combined $135.6 million in civil penalties on Citigroup and its principal banking subsidiary Citibank on 10 July 2024, citing the bank's failure to make sufficient progress in remediating enterprise-wide risk management and data governance deficiencies that regulators had first identified and formally required the bank to address years earlier.
The Federal Reserve's action carried a $60.6 million penalty against Citigroup for violations of a cease-and-desist order that the central bank had issued in 2020. The OCC separately fined Citibank $75 million for violations and for inadequate data quality processes, bringing the combined regulatory penalty to $135.6 million. The two penalties were announced separately but on the same day.
THE 2020 CEASE-AND-DESIST ORDER
The Federal Reserve's 2020 cease-and-desist order required Citigroup to undertake a comprehensive remediation of its enterprise-wide risk management framework, compliance controls, and data governance architecture. The July 2024 action reflects the Fed's finding that, four years on, the bank had not fulfilled the commitments required under the original enforcement instrument.
The OCC's penalty specifically cited inadequate data quality processes.
REMEDIATION PROGRAMME
Citigroup has been engaged in a multi-year organisational overhaul that includes an effort to modernise its technology infrastructure and rebuild its compliance architecture. The bank has publicly acknowledged the scale and complexity of the work required under its regulatory obligations, and its leadership has repeatedly framed the transformation as a long-term commitment that will take several years to complete.
Both the Federal Reserve and the OCC retain authority to impose further measures should progress remain inadequate.
Bank news that matters, every weekday.
Follow The Global Banker on LinkedIn