Citigroup Inc. is a major US financial-services group headquartered in New York. Citibank N.A. is its principal banking subsidiary and forms part of a substantial international banking network.
The first penalty
In October 2020, the US Office of the Comptroller of the Currency (OCC) imposed a US$400 million civil money penalty on Citibank for deficiencies across enterprise-wide risk management, compliance risk management, data governance, and internal controls - a wide-ranging governance failure, not a narrow technical breach.
Citibank then failed to fix it
The correction didn't work the first time. In July 2024, the OCC found that Citibank had failed to meet remediation milestones and failed to make sufficient and sustainable progress toward the 2020 order's requirements - four years after the original penalty. The OCC responded by amending the enforcement action and imposing a further US$75 million civil penalty, demanding more resources be devoted to the outstanding work.
A separate failure, in a separate jurisdiction: the UK's £61.6 million fine
The US wasn't the only regulator finding serious control failures at Citi. In May 2024, the Bank of England's Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA) jointly fined Citigroup £61.6 million (approximately US$78.5 million) for trading-control failures at its London unit, Citigroup Global Markets Limited, spanning April 2018 through May 2022 - one of the largest UK penalties ever imposed for systems and controls breaches of this kind.
The trigger was a so-called "fat-finger" trading error on 2 May 2022: a trader intended to place an order worth $58 million, but Citi's electronic trading systems instead generated an order for $444 billion, triggering roughly $1.4 billion in mistaken sell orders and a sudden, measurable drop across several European stock indices before the trade could be cancelled. Regulators found the immediate cause was human error, but the real failing was Citi's own systems - weaknesses regulators said had persisted despite repeated supervisory warnings, and despite Citi's own internal systems having already flagged problems.
Regulators kept working with the bank, not against its survival
By December 2025, the OCC terminated the 2024 amendment to its US consent order - a sign the tougher remediation effort had finally taken hold. The UK fine, imposed separately just months after the second US penalty, showed the same pattern on the other side of the Atlantic: another substantial penalty, another demand for stronger controls, no suggestion the bank's licence to operate was in question.
Still operating
Across this multi-year run of failures - a US governance penalty, a missed US remediation deadline, a second US penalty, and a UK trading-controls fine tied to a near-catastrophic $444 billion order - at no point was Citibank's or Citigroup Global Markets' continued existence ever put in question. Citi continued operating throughout, in both the US and the UK, as one of the largest banks in the world.
The comparison with BCCI
Citigroup shows what happens when a bank's failures recur, across different regulators and different jurisdictions, over the better part of a decade. Two US regulators and two UK regulators - the OCC, the Federal Reserve system generally, the PRA, and the FCA - each found serious, repeated control failures at the same institution, and each time the answer was a bigger fine and a demand for better systems, never closure. BCCI's Abu Dhabi-backed restructuring never even got the chance to attempt a "first fix" that might then be judged insufficient - it was still in its initial implementation, funded and under way, when regulators moved straight to closure.
Also read:
