Citigroup Inc

AI: Artificial intelligence

Generative AI: A type of artificial intelligence that uses generative models to create text and other content.

The qualitative management adjustment component includes risks that are not fully captured in the quantitative component. These may include but are not limited to portfolio characteristics, idiosyncratic events, factors not within historical loss data or the economic forecast, uncertainty in the credit environment and other factors as required by banking supervisory guidance for the ACL. Risks that are not fully captured in the quantitative component include potential impacts on vulnerable industries and regions due to heightened macroeconomic and geopolitical risks and uncertainties, as well as risks from emerging technologies (including AI) to vulnerable sectors.

AI: Artificial intelligence

Generative AI: A type of artificial intelligence that uses generative models to create text and other content.

•applied technology solutions leveraging AI to support governance of data reported in key regulatory reports

Certain competitors may be subject to different and, in some cases, less stringent legal, regulatory and supervisory requirements, whether due to size, jurisdiction, entity type or other factors, placing Citi at a competitive disadvantage. To the extent that Citi is not able to compete effectively with other financial services companies, including private credit, financial technology and digital asset companies, and non-financial services firms, or adequately assess the competitive landscape, Citi could be placed at a competitive disadvantage, which could result in loss of customers and market share, and its businesses, results of operations and financial condition could suffer. For additional information on Citi’s competitive risks, see the co-branding and private label credit cards and qualified employees risk factors above and the AI risk factor and “Supervision, Regulation and Other—Competition” below.

Additionally, emerging technologies have the potential to accelerate disruption and intensify competition in the financial services industry. These emerging technologies, such as artificial intelligence (AI) and digital assets (including tokenized deposits, cryptocurrencies, stablecoins and other assets and products that use distributed ledger or blockchain technology) and changes in the payments space (e.g., instant and 24/7 payments) are accelerating, and, as a result, certain of Citi’s products and services could become less competitive (see the AI risk factor below).

Moreover, as Citi develops new products and services leveraging emerging technologies, new risks may emerge that, if not designed and governed adequately, may result in control gaps and in Citi operating outside of its risk appetite. For example, the use or development of emerging technologies, such as AI or digital assets, without sufficient controls, governance and risk management may result in increased risks across various risk categories (for additional information, see the AI, operational processes and systems and cybersecurity risk factors below). As another example, instant and 24/7 payments products could be accompanied by challenges to forecasting and managing liquidity, as well as increased operational and compliance risks.

The Development and Use of AI by Citi and Others Present Risks to Citi’s Businesses.

Citi has used AI and machine learning tools for many years and has more recently begun to broadly deploy Generative AI, including within its technology platforms and services. In the future, Citi expects to more broadly integrate Generative AI tools within its systems, businesses and functions, including advanced AI capabilities, such as autonomous agents and sophisticated user interactions, which if improperly managed, could result in increased risks and costs.

While Citi has policies that govern the use of emerging technologies, including in model risk management, ineffective, inadequate or faulty Generative AI development or deployment practices by Citi or third parties, including insufficient testing and monitoring, poorly structured or manipulated prompts or insufficient or inadequate human oversight, could result in adverse consequences, such as AI algorithms that produce inaccurate or incomplete output or output based on biased, incomplete and/or inaccurate datasets, infringe on intellectual property rights of others, involve data exfiltration risks, including release of confidential or proprietary information, or cause other issues, concerns or deficiencies. The complexity of AI models, particularly Generative AI models, can make it challenging to understand why particular outputs are generated, which can increase the risk of erroneous and/or biased output and complying with regulations requiring documentation, explainability or auditability on the basis of AI-influenced decisions.

Citi may also rely on AI models developed by third parties and be exposed to risks arising from their development and training methods, including potential inclusion of unauthorized material in the training data or limitations in their risk mitigation strategies, over which Citi may have limited visibility or control (see also the operational processes and systems risk factor below). While Citi may provide restrictions on use of certain data in third-party AI applications or models, a third party could breach those terms, which could expose Citi to legal and reputations risks. Citi is also exposed to risks related to the use of AI technologies by counterparties, clients and vendors, where interconnected AI systems could amplify failures and threats of cyber infiltration, as well as cause widespread disruptions.

Moreover, the use of increasingly sophisticated AI technologies by malicious actors and others has increased the risk of fraud, including identity theft and bypassing of verification controls, and exposure to cyberattacks (see the cybersecurity risk factor below), as well as disinformation and market manipulation campaigns, and failure to effectively manage such risks could result in misappropriation of funds, unauthorized transactions, exposure of sensitive client or Company information, reputational harm and increased litigation and regulatory risk.

Citi also faces competition risks to the extent that competitors may be faster and more successful in developing and deploying AI technologies to improve processes, productivity, efficiency, products and services, and thereby gain competitive advantages over Citi (see the competition risk factor above).

In addition, compliance with new or changing laws, regulations or industry standards relating to AI may impose additional operational risks and costs. Failure to sufficiently manage these risks could expose Citi to adverse legal, regulatory or reputational consequences.

With the proliferation of emerging technologies, including AI and digital assets, and the use of the internet, mobile devices and cloud services to conduct financial transactions, and customers’ and clients’ increasing use of online banking and trading systems and other platforms, large global financial institutions such as Citi have been, and will continue to be, subject to an ever-increasing risk of operational loss, failure or disruption. For example, Citi’s involvement in digital assets,

The increasing use of cloud and new and emerging technologies (such as AI and digital assets), as well as connectivity solutions to facilitate remote working for Citi’s employees, all increase Citi’s exposure to cybersecurity risks. Citi is also susceptible to cyberattacks given, among other factors, its size and scale, high-profile brand, global footprint and prominent role in the financial system. Additionally, Citi continues to operate in multiple jurisdictions in the midst of geopolitical unrest or uncertainties, including, among others, those affected by the Russia–Ukraine war and the conflicts in the Middle East, which could expose Citi to heightened risk of insider threat, cyber threats from nation-state actors, hacktivism or other cyber incidents.

Because the techniques used to initiate cyberattacks change frequently or, in some cases, are not recognized until deployed, Citi may be unable to implement effective preventive measures or otherwise proactively address these risks. In addition, cyber threats and cyberattack techniques change, develop and evolve rapidly, including from emerging technologies such as AI and quantum computing. Given the frequency and sophistication of cyberattacks, the determination of the severity and potential impact of a cyber incident may not become apparent for a substantial period of time following detection of the incident. Also, while Citi strives to implement measures to reduce the exposure resulting from outsourcing risks, such as performing security control assessments of third-party vendors and limiting third-party access to the least privileged level necessary to perform service functions, these measures cannot prevent all third-party-related cyberattacks or data breaches.

Citi is also a member of various central clearing counterparties and could incur financial losses as a result of defaults by other clearing members due to the requirements of clearing members to share losses. Additionally, systemic risks, including from leveraged finance, non-bank financial institutions, private credit and AI, could increase Citi’s credit costs.

security), technology resource and talent planning, and technology third-party management policies. Its responsibilities include reviewing and assessing significant technology investments and expenditures, overseeing and reviewing information from management regarding Citi’s approach to Generative AI and reviewing reports on technology and data quality-related matters.

Cybersecurity risk is the operational risk associated with the threat posed by a cyberattack, cyber breach or the failure to protect Citi’s most vital business information assets or operations, resulting in a financial or reputational loss (see the operational processes and systems and cybersecurity risk factors in “Risk Factors—Operational Risks” above). With an evolving threat landscape, ever-increasing sophistication of threat actor tactics, techniques and procedures, ongoing and emerging geopolitical conflicts, and the availability of new technologies, including those enabled by artificial intelligence and machine learning capabilities, to conduct financial transactions, Citi and its clients, customers and third parties (and fourth parties, etc.) continue to be at risk from cyberattacks and information security incidents. Citi leverages a threat-focused, industry-standard-aligned, defense-in-depth strategy that ensures that multiple controls work in tandem against various threats to increase the likelihood that malicious activity will be prevented, detected and mitigated.

In this context, external factors affecting Citi’s operating environment are the economic environment, geopolitical/political landscape, industry/competitive landscape, environmental, customer/client behavior, regulatory/legislative environment and trends related to investors/shareholders. Material strategic risks that Citi is monitoring include the impacts of adverse changes in inflation and interest rates in the U.S., as well as macroeconomic uncertainties driven by weak global growth, tariffs, geopolitical issues and changing regulatory requirements. AI has added competitive pressure while productivity assumptions tied to AI-driven operation model changes may materialize more slowly than expected or require additional unforeseen upfront investment. In addition to external factors affecting Citi’s operating environment, Citi also monitors risks related to the execution of its strategy, with heightened focus on delivering the transformation of its risk and control environment pursuant to the 2020 FRB and OCC Consent Orders.

AI: Artificial intelligence

Generative AI: A type of artificial intelligence that uses generative models to create text and other content.

•Expanded the adoption of Generative AI tools with the rollout of new features that enable faster and easier access and increase overall productivity

◦Approximately 1 million automated code reviews completed by Citi’s Generative AI tools year-to-date, saving approximately 100,000 hours per week across Citi’s developer population

AI: Artificial intelligence

Generative AI: A type of artificial intelligence that uses generative models to create text and other content.

Citi CEO Jane Fraser said, “The relentless execution of our strategy is delivering stronger business performance quarter after quarter and improving our returns. The cumulative effect of what we have done over the past years – our transformation, our refreshed strategy, our simplification – have put Citi in a materially different place in terms of our ability to compete. Investments in new products, digital assets and AI are driving innovation and improved capabilities across the franchise.

“We returned $3 billion in capital during the quarter, including $2 billion in share repurchases as part of our $20 billion repurchase plan. I’m particularly pleased that the momentum across our franchise includes the Transformation, as we streamline processes, drive automation and deploy AI.

•Significantly expanding adoption of Generative AI tools, increasing efficiency and productivity across Citi

◦Logged 385,000 utilizations of two enterprise-wide tools (document intelligence and virtual assistant)

◦Completed approximately 220,000 automated code reviews in the Generative AI developer tool, considerably increasing coding capacity

◦Launched Agent Assist, Citi’s first USPB Generative AI customer service tool

•Using Generative AI to enhance detection of unauthorized trading activity to improve FX trade surveillance in Markets

blockchain technology, including a more favorable regulatory approach to crypto assets. Citi may not be able to provide the same or similar products and services for legal or regulatory reasons, which may be exacerbated by rapidly evolving and conflicting regulatory requirements, as well as increased compliance and other risks. Further, the introduction of mobile platforms and emerging technologies, such as artificial intelligence (AI) and digital assets, and changes in the payments space (e.g., instant and 24/7 payments) are accelerating, and, as a result, certain of Citi’s products and services could become less competitive.

Simultaneously, as Citi develops new products and services leveraging emerging technologies, new risks may emerge that, if not designed and governed adequately, may result in control gaps and in Citi operating outside of its risk appetite. For example, the use or development of emerging technologies, such as AI or digital assets, without sufficient controls, governance and risk management may result in increased risks across various risk categories (for additional information, see the operational processes and systems risk factor below).

Citi’s operations must also comply with complex and evolving laws, regulations and heightened regulatory expectations in the jurisdictions in which it operates (see the implementation and interpretation of regulatory changes and legal proceedings risk factors below). With the proliferation of emerging technologies, including AI, and the use of the internet, mobile devices and cloud services to conduct financial transactions, and customers’ and clients’ increasing use of online banking and trading systems and other platforms, large global financial institutions such as Citi have been, and will continue to be, subject to an ever-increasing risk of operational loss, failure or disruption.

Citi has been working with AI and machine learning for a period of time and has more recently begun using Generative AI, a type of artificial intelligence that uses generative models to create text and other content. Generative AI tools are available to employees within parts of the Company, and in the future Citi may more broadly use, develop and incorporate Generative AI within its technology platform and services, systems and its businesses and functions. While Citi has policies which govern the use of emerging technologies, ineffective, inadequate or faulty Generative AI development or deployment practices by Citi or third parties could result in unintended consequences, such as AI algorithms that produce inaccurate or incomplete output or output based on biased, incomplete and/or inaccurate datasets, or cause other issues, concerns or deficiencies. Moreover, the use of increasingly sophisticated AI technologies by malicious actors and others has increased the risk of fraud, including identity theft and bypassing of verification controls, and failure to effectively manage such risks could result in misappropriation of funds, unauthorized transactions, exposure of sensitive client or Company information, reputational harm and increased litigation and regulatory risk. In addition, compliance with new or changing laws, regulations or industry standards relating to AI may impose additional operational risks and costs.

The increasing use of mobile and other digital banking platforms and services, cloud technologies, new and emerging technologies (such as AI) and connectivity solutions to facilitate remote working for Citi’s employees all increase Citi’s exposure to cybersecurity risks. Citi is also susceptible to cyberattacks given, among other things, its size and scale, high-profile brand, global footprint and prominent role in the financial system, as well as the ongoing wind-down of its

measures or any other measures can provide sufficient security. Because the techniques used to initiate cyberattacks change frequently or, in some cases, are not recognized until launched or even later, Citi may be unable to implement effective preventive measures or otherwise proactively address these methods. In addition, cyber threats and cyberattack techniques change, develop and evolve rapidly, including from emerging technologies such as AI, cloud computing and quantum computing. Given the frequency and sophistication of cyberattacks, the determination of the severity and potential impact of a cyber incident may not become apparent for a substantial period of time following detection of the incident. Also, while Citi strives to implement measures to reduce the exposure resulting from outsourcing risks, such as performing security control assessments of third-party vendors and limiting third-party access to the least privileged level necessary to perform job functions, these measures cannot prevent all third-party-related cyberattacks or data breaches. In addition, the risk of insider threats may continue to be elevated in the near term due to Citi’s recent overall simplification initiatives, including streamlining its global staff functions.

impairment. These assumptions, judgments and estimates are inherently limited because they involve techniques, which could include the use of historical data and AI, that cannot anticipate or model every economic and financial outcome in the markets in which Citi operates, nor can they anticipate the specific impact and timing of such outcomes. For example, many models used by Citi include assumptions about correlation or lack thereof among prices of various asset classes or other market indicators that may not hold in times of market stress, limited liquidity or other unforeseen circumstances.

Cybersecurity risk is the business risk associated with the threat posed by a cyberattack, cyber breach or the failure to protect Citi’s most vital business information assets or operations, resulting in a financial or reputational loss (see the operational processes and systems and cybersecurity risk factors in “Risk Factors—Operational Risks” above). With an evolving threat landscape, ever-increasing sophistication of threat actor tactics, techniques and procedures, ongoing and emerging geopolitical conflicts, and the use of new technologies, including those enabled by artificial intelligence and machine learning capabilities, to conduct financial transactions, Citi and its clients, customers and third parties (and fourth parties, etc.) continue to be at risk from cyberattacks and information security incidents. Citi leverages a threat-focused, defense-in-depth strategy that ensures that multiple controls work in tandem against various threats to increase the likelihood that malicious activity will be prevented, detected and mitigated.

market entrants. Simultaneously, as Citi develops new products and services leveraging emerging technologies, new risks may emerge that, if not designed and governed adequately, may result in control gaps and in Citi operating outside of its risk appetite. For example, failure to strategically embrace the potential of artificial intelligence (AI) may result in a competitive disadvantage to Citi. At the same time, as a new technology, use of AI without sufficient controls, governance and risk management may result in increased risks across all of Citi’s risk categories. As another example, instant and 24x7 payments products could be accompanied by challenges to forecasting and managing liquidity, as well as increased operational and compliance risks.

While Citi’s monitoring and protection services have historically generally succeeded in detecting, thwarting and/or responding to attacks targeting its systems before they become significant, certain past incidents resulted in limited losses, as well as increases in expenditures to monitor against the threat of similar future cyber incidents. There can be no assurance that such cyber incidents will not occur again, and they could occur more frequently, via novel tactics, including leveraging of tools made possible by emerging technologies, and on a more significant scale. Despite the significant resources Citi allocates to implement, maintain, monitor and regularly upgrade its systems and networks with measures such as intrusion detection and prevention systems and firewalls to safeguard critical business applications, there is no guarantee that these measures or any other measures can provide sufficient security. Because the techniques used to initiate cyberattacks change frequently or, in some cases, are not recognized until launched or even later, Citi may be unable to implement effective preventive measures or otherwise proactively address these methods. In addition, cyber threats and cyberattack techniques change, develop and evolve rapidly, including from emerging technologies such as artificial intelligence, cloud computing and quantum

Cybersecurity risk is the business risk associated with the threat posed by a cyberattack, cyber breach or the failure to protect Citi’s most vital business information assets or operations, resulting in a financial or reputational loss (see the operational processes and systems and cybersecurity risk factors in “Risk Factors—Operational Risks” above). With an evolving threat landscape, ever-increasing sophistication of threat actor tactics, techniques and procedures, ongoing and emerging geopolitical conflicts, and the use of new technologies, including those enabled by artificial intelligence and machine learning capabilities, to conduct financial transactions, Citi and its clients, customers and third parties (and fourth parties, etc.) continue to be at risk from cyberattacks and information security incidents. Citi leverages a threat-focused, defense-in-depth strategy that ensures that multiple controls work in tandem against various threats to increase the likelihood that malicious activity will be prevented, detected and mitigated.