⚠ The 2020 Consent Orders, Still in ForceModerate threat

Citigroup (C) — threat to the moat

Six years after its regulators ordered Citi to fix its data and controls, the orders are still in force.

Citi has been under regulatory orders since 7 October 2020. That day the Federal Reserve issued a cease-and-desist order requiring Citigroup to improve its firm-wide risk management, compliance risk management, data quality management and internal controls1, and the OCC fined Citibank $400 million2.

The consent orders7 Oct 2020Fed order; OCC orderand $400M penalty10 Jul 2024$135.6M more;OCC amendment18 Dec 2025amendment terminated20262020 ordersstill in forceFederal Reserve and OCC releases; Citigroup Forms 10-K FY2025 and 10-Q Q2 2026
Six years and counting.

Progress has been slow. On 10 July 2024 the two regulators fined Citi about $135.6 million more for failing to meet the orders' milestones3, and the OCC's head said "certain persistent weaknesses remain, in particular with regard to data"4. The OCC also amended its order, requiring a Resource Review Plan and adding provisions on capital distributions from Citibank5. That amendment was terminated on 18 December 20256, but the 2020 orders remain; Citi describes the remediation as "a multiyear endeavor that has not been linear"7.

The orders have teeth beyond fines. Citibank needs the OCC's prior approval for any significant new acquisition, and the OCC can limit dividends or change directors and senior executives8. The cost shows in the transformation spending of about $3.3 billion in 20259.

The 2024 penalties were small against the bank. The Federal Reserve's civil money penalty was $60,625,620 and the OCC's $75 million10. The cost that matters is the spending and the restrictions, not the fines.

Some of the spending is visible in the controls. Citi's Investor Day said its preventative controls now assess a daily average of 3.5 million payments in over 90 countries, and that 90% of its transformation programmes were at or near their target state11.

The orders will end only when the regulators say so. A new penalty or restriction would reset the clock; the lifting of the 2020 orders would remove the single largest constraint on the business.

The number that tests this threat
Reported
Transformation investments, 2025
About $3.3bn, largely data and controls

The running cost of the consent orders; a rise in 2026 instead of the promised fall would mean remediation was slipping.

Source: Citigroup Form 10-K FY2025, risk factors and regulation ↗
References
  1. ReportedThat day the Federal Reserve issued a cease-and-desist order requiring Citigroup to improve its firm-wide risk management, compliance risk management, data quality management and internal controls, and the OCC fined Citibank $400 million.
    Federal Reserve press release, 7 October 2020 - cease and desist order requiring Citigroup to improve risk management, data quality management and internal controls. — October 2020 · publ. 7 October 2020 · source ↗
  2. ReportedThat day the Federal Reserve issued a cease-and-desist order requiring Citigroup to improve its firm-wide risk management, compliance risk management, data quality management and internal controls, and the OCC fined Citibank $400 million.
    OCC News Release 2020-132 - $400 million civil money penalty against Citibank. — October 2020 · publ. 7 October 2020 · source ↗
  3. ReportedOn 10 July 2024 the two regulators fined Citi about $135.6 million more for failing to meet the orders' milestones, and the OCC's head said "certain persistent weaknesses remain, in particular with regard to data".
    Federal Reserve press release, 10 July 2024 - $60.6 million fine for violating the 2020 enforcement action; combined penalties about $135.6 million. — July 2024 · publ. 10 July 2024 · source ↗
  4. ReportedOn 10 July 2024 the two regulators fined Citi about $135.6 million more for failing to meet the orders' milestones, and the OCC's head said "certain persistent weaknesses remain, in particular with regard to data".
    OCC News Release 2024-76 - $75 million civil money penalty and amendment to the 2020 consent order. — July 2024 · publ. 10 July 2024 · source ↗
  5. ReportedThe OCC also amended its order, requiring a Resource Review Plan and adding provisions on capital distributions from Citibank.
    Citigroup Form 8-K of 10 July 2024 - Federal Reserve and OCC civil money penalties and the OCC amendment requiring a Resource Review Plan. — July 2024 · publ. 10 July 2024 · source ↗
  6. ReportedThat amendment was terminated on 18 December 2025, but the 2020 orders remain; Citi describes the remediation as "a multiyear endeavor that has not been linear".
    OCC enforcement actions for December 2025 - termination of the July 2024 amendment to the Citibank consent order. — December 2025 · publ. December 2025 · source ↗
  7. ReportedThat amendment was terminated on 18 December 2025, but the 2020 orders remain; Citi describes the remediation as "a multiyear endeavor that has not been linear".
    Citigroup Form 10-Q for the quarter ended 30 June 2026 - results, capital, the $30 billion repurchase program, dividends, staff, U.S. Consumer Cards partners and the American Airlines portfolio. — Q2 2026 · publ. 6 August 2026 · source ↗
  8. ReportedCitibank needs the OCC's prior approval for any significant new acquisition, and the OCC can limit dividends or change directors and senior executives.
    Citigroup Form 10-K for fiscal 2025 - risk factors, competition, the 2020 consent orders, transformation spending and the card-partner concentration disclosure. — FY2025 · publ. 20 February 2026 · source ↗
  9. ReportedThe cost shows in the transformation spending of about $3.3 billion in 2025.
    Citigroup Form 10-K for fiscal 2025 - risk factors, competition, the 2020 consent orders, transformation spending and the card-partner concentration disclosure. — FY2025 · publ. 20 February 2026 · source ↗
  10. ReportedThe Federal Reserve's civil money penalty was $60,625,620 and the OCC's $75 million.
    Citigroup Form 8-K of 10 July 2024 - Federal Reserve and OCC civil money penalties and the OCC amendment requiring a Resource Review Plan. — July 2024 · publ. 10 July 2024 · source ↗
  11. ReportedCiti's Investor Day said its preventative controls now assess a daily average of 3.5 million payments in over 90 countries, and that 90% of its transformation programmes were at or near their target state.
    Citigroup 2026 Investor Day financial overview presentation - RoTCE targets, business targets for Services, Cards and Markets, efficiency ratio, transformation, liquidity and capital. — May 2026 · publ. May 2026 · source ↗
Sources
Generated September 28, 2026