Citigroup Inc. is a major US financial-services group headquartered in New York. Citibank N.A. is its principal banking subsidiary and forms part of a substantial international banking network.
This case should be distinguished from the TD Bank, HSBC and Danske Bank examples. The enforcement actions considered here do not establish a comparable corporate guilty plea for money laundering.
Its principal relevance to the Double Standards analysis lies in the regulatory treatment of longstanding institutional risk-management, compliance and control deficiencies, including what happened when an earlier remediation programme itself proved inadequate.
Major Governance and Control Deficiencies
In October 2020, the US Office of the Comptroller of the Currency (OCC) imposed a US$400 million civil money penalty on Citibank for deficiencies in:
- enterprise-wide risk management;
- compliance risk management;
- data governance; and
- internal controls.
The OCC characterised these deficiencies as unsafe or unsound banking practices and issued a cease-and-desist order requiring broad and comprehensive corrective action.
The significance of the action lies not merely in the size of the penalty, but in the institutional nature of the deficiencies. The problems concerned fundamental systems through which a major international bank governed risk, compliance, information and internal control.
Failure to Complete Remediation
The original corrective programme did not resolve the problems within the period expected by regulators.
In July 2024, the OCC concluded that Citibank had failed to meet remediation milestones and had failed to make sufficient and sustainable progress towards compliance with the 2020 order.
The OCC therefore amended the enforcement action, required Citibank to give greater priority and resources to the outstanding work, and imposed a further US$75 million civil money penalty.
This provides a particularly clear example of the regulatory approach:
serious institutional deficiencies → corrective programme → insufficient progress → further penalty and stronger requirements → continued remediation.
The response was not closure.
Regulatory Patience and Continued Operation
The importance of Citigroup to the BCCI comparison lies precisely in what happened when the first attempt at correction was judged inadequate.
Regulators did not conclude that the failure to complete remediation demonstrated that Citibank was inherently incapable of reform.
They increased pressure.
They imposed another substantial penalty.
They strengthened the requirements.
They required additional resources to be devoted to remediation.
And the banking institution continued operating.
In December 2025, the OCC subsequently terminated the 2024 amendment to the consent order. The OCC’s published termination framework provides for enforcement actions to be terminated when relevant requirements have been satisfied, become outdated or irrelevant, or are incorporated into another supervisory action.
Whatever the precise supervisory progression, the broader principle remained one of continued regulatory intervention and remediation rather than destruction of the banking franchise.
The FinCEN Files Context
Citigroup also appeared in reporting associated with the FinCEN Files, a collection of leaked Suspicious Activity Reports and related financial-intelligence records concerning transactions processed through the international banking system.
Care is essential when referring to this material.
A Suspicious Activity Report is not proof that money laundering occurred.
Nor does the fact that a bank processed a transaction subsequently reported as suspicious establish that the bank knowingly participated in criminal activity.
The FinCEN Files themselves represented only a very small sample of the millions of SARs filed with US authorities during the relevant period.
For that reason, a responsible comparison must distinguish between:
transactions reported as suspicious and misconduct formally established through regulatory or criminal proceedings.
Making that distinction strengthens the BCCI analysis because it avoids applying to other banks the same broad institutional assumptions that this website questions in relation to BCCI.
Comparison with BCCI
Citigroup is therefore useful primarily as a comparison of regulatory remediation and institutional patience.
Even where a regulator concluded that a major bank had longstanding deficiencies affecting enterprise-wide risk management, compliance, data governance and internal controls—and later concluded that the institution’s initial corrective efforts had still failed to achieve sufficient and sustainable progress—the response remained further remediation.
That invites comparison with BCCI’s position in 1990–91.
BCCI’s majority shareholders in Abu Dhabi were providing substantial financial support.
Management and governance arrangements were being changed.
The organisational structure was being fundamentally reconsidered.
Problem assets and accounts were being identified and addressed.
A new structure was being developed intended to preserve viable banking operations under stronger and more clearly defined supervision.
The relevant historical question is therefore not whether BCCI had serious problems requiring intervention.
It is whether its restructuring programme was given a comparable opportunity to demonstrate that those problems could be corrected.
The Double-Standards Question
If longstanding institutional risk-management and compliance deficiencies at Citibank could be followed by regulatory orders, substantial penalties and further opportunities for remediation even after the original corrective programme failed to achieve sufficient progress, why was BCCI’s shareholder-supported restructuring not afforded comparable time to demonstrate whether its deficiencies could be corrected?
The broader question is:
Why is continued remediation regarded as an appropriate regulatory response for an established major banking institution even when earlier corrective efforts prove inadequate, while BCCI’s financially supported restructuring was effectively rejected before its ultimate viability could be tested?
The comparison does not suggest that Citigroup and BCCI presented identical circumstances.
It raises a narrower question of regulatory principle:
When a large banking institution has serious but potentially remediable deficiencies, how much opportunity should regulators provide for restructuring and correction—and was that principle applied consistently in BCCI’s case?
Also read:
- Office of the Comptroller of the Currency, “OCC Assesses $400 Million Civil Money Penalty Against Citibank”, 7 October 2020. Principal official account of the deficiencies in enterprise-wide risk management, compliance risk management, data governance and internal controls.
- Office of the Comptroller of the Currency, “OCC Amends Enforcement Action Against Citibank, Assesses $75 Million Civil Money Penalty”, 10 July 2024. Important follow-up showing the regulatory response when Citibank failed to meet remediation milestones or demonstrate sufficient and sustainable progress.
- Office of the Comptroller of the Currency, “OCC Announces Enforcement Actions for December 2025”, 18 December 2025. Records termination of the July 2024 amendment.
- International Consortium of Investigative Journalists, FinCEN Files. Useful contextual material concerning suspicious-activity reporting and international banking transactions, but not evidence by itself that individual transactions or institutions were engaged in criminal money laundering.
