CITIGROUP INC

The following discussion presents what management currently believes could be the material risks and uncertainties that could impact Citi’s businesses, results of operations and financial condition. Other risks and uncertainties, including those not currently known to Citi or its management, could also negatively impact Citi’s businesses, results of operations and financial condition. Thus, the following should not be considered a complete discussion of all of the risks and uncertainties that Citi may face. For additional information about risks and uncertainties that could impact Citi, see “Executive Summary” and each respective business’s results of operations above and “Managing Global Risk” below. The following risk factors are categorized to improve the readability and usefulness of the risk factor disclosure, and, while the headings and risk factors generally align with Citi’s risk categorization, in certain instances the risk factors may not directly correspond with how Citi categorizes or manages its risks.

MARKET-RELATED RISKS

Macroeconomic, Geopolitical and Other Challenges and Uncertainties Could Continue to Have a Negative Impact on Citi.

Citi has experienced, and could experience in the future, negative impacts to its businesses, results of operations and financial condition as a result of various macroeconomic, geopolitical and other challenges, uncertainties and volatility. These include, among other things, government fiscal and monetary actions or expected actions, including continued high interest rates, reductions in central bank balance sheets, or other restrictive interest rate or other monetary policies; potential recessions in the U.S., Europe and other regions or countries; and elevated levels of inflation.

For example, in 2023, the U.S., the U.K., the EU and other economies continued to experience elevated levels of inflation. As a result, the Federal Reserve Board (FRB) and other central banks substantially raised interest rates, reduced the size of their balance sheets and took other actions in an aggressive effort to curb inflation. These actions may continue to adversely impact certain sectors sensitive to interest rates and consumer discretionary spending. They may also slow economic growth, increase the risk of recession and increase the unemployment rate in the U.S. and other countries, all of which would likely adversely affect Citi’s consumer and institutional clients, businesses and results of operations. In addition, inflation may continue to result in higher labor and other costs, thus putting further pressure on Citi’s expenses. More recently, the FRB has signaled that it expects to reduce the benchmark U.S. interest rate in 2024. If the FRB were to reduce interest rates prematurely, inflation could resurge.

Interest rates on loans Citi makes are typically based off or set at a spread over a benchmark interest rate and would likely decline or rise as benchmark rates decline or rise, respectively. For example, while a decline in interest rates would generally be expected to result in lower overall net interest income, it could improve Citi’s funding costs. Although higher interest rates would generally be expected to

increase overall net interest income, higher rates could adversely affect funding costs, levels of deposits in its consumer and institutional businesses and certain business or product revenues. In addition, Citi’s net interest income could be adversely affected due to a flattening (a lower spread between shorter-term versus longer-term interest rates) or longer lasting or more severe inversion (shorter-term interest rates exceeding longer-term interest rates) of the interest rate yield curve, as Citi typically pays interest on deposits based on shorter-term interest rates and earns money on loans based on longer-term interest rates. For additional information on Citi’s interest rate risk, see “Managing Global Risk—Market Risk—Banking Book Interest Rate Risk” below. Additionally, Citi’s balance sheet includes interest-rate sensitive fixed-rate assets such as U.S. Treasuries, U.S. agency securities and residential mortgages, among others, whose valuation would be adversely impacted in a higher-rate environment and/or whose hedging costs may increase.

Additional areas of uncertainty include, among others, geopolitical challenges, tensions and conflicts, including those related to Russia’s war in Ukraine (see discussion below), as well as a persistent and/or escalating conflict in the Middle East, particularly if the conflict were to widen to involve additional combatants, countries or regions; economic and other geopolitical challenges related to China, including weak economic growth, related policy actions, challenges in the Chinese real estate sector, banking and credit markets, and tensions or conflicts between China and Taiwan and/or China and the U.S.; significant disruptions and volatility in financial markets, including foreign currency volatility and devaluations and continued strength in the U.S. dollar; protracted or widespread trade tensions; natural disasters; new pandemics, including new COVID-19 variants; and political polarization, election outcomes and the effects of divided government, such as with respect to any extended government shutdown in the U.S. For example, Citi’s market-making businesses can suffer losses resulting from the widening of credit spreads due to unanticipated changes in financial markets. Moreover, adverse developments or downturns in one or more of the world’s larger economies would likely have a significant impact on the global economy or the economies of other countries because of global financial and economic linkages.

Russia’s war in Ukraine has caused supply shocks in energy, food and other commodities markets, worsened inflation, increased cybersecurity risks, increased the risk of recession in Europe and heightened geopolitical tensions. Actions by Russia, and any further measures taken by the U.S. or its allies, could continue to have negative impacts on regional and global energy and other commodities and financial markets and macroeconomic conditions, adversely impacting jurisdictions where Citi operates and has customers, clients or employees. Citi’s remaining operations in Russia subject Citi to various other risks, among which are foreign currency volatility, including appreciations or devaluations; restrictions arising from retaliatory Russian laws and regulations on the conduct of its remaining businesses, including, without limitation, its provision to its customers of certain securities services; sanctions or asset freezes; and other deconsolidation events. In the event of a loss of control of AO Citibank, Citi would be required to write off its net investment in the entity, recognize a CTA loss through earnings and recognize a loss on intercompany liabilities owed by AO Citibank to other Citi entities outside of Russia. In the sole event of a substantial liquidation, as opposed to a loss of control, Citi would be required to recognize the CTA loss through earnings and would evaluate its remaining net investment as circumstances evolve. For additional information about these risks, see the operational processes and systems, cybersecurity and emerging markets risk factors and “Managing Global Risk—Other Risks—Country Risk—Russia” below.

STRATEGIC RISKS

Citi’s Ability to Return Capital to Common Shareholders Substantially Depends on Regulatory Capital Requirements, Including the Results of the CCAR Process and Dodd-Frank Act Regulatory Stress Tests, and Other Factors.

Citi’s ability to return capital to its common shareholders consistent with its capital planning efforts and targets, whether through its common stock dividend or through a share repurchase program, substantially depends, among other things, on its regulatory capital requirements, including the annual recalibration of the Stress Capital Buffer (SCB), which is based upon the results of the CCAR process required by the FRB, and recalibration of the GSIB surcharge,as well as the

supervisory expectations and assessments regarding individual

institutions.

The FRB’s annual stress testing requirements are integrated into ongoing regulatory capital requirements. Citi’s SCB equals the maximum projected decline in its CET1 Capital ratio under the supervisory severely adverse scenario over a nine-quarter CCAR measurement period, plus four quarters of planned common stock dividends as a percentage of Citi’s risk-weighted assets, subject to a minimum requirement of 2.5%. The SCB is calculated by the FRB using its proprietary data and modeling of each firm’s results. Accordingly, Citi’s SCB may change annually, based on the supervisory stress test results, thus potentially resulting in variability in the calculation of Citi’s required regulatory CET1 Capital ratio under the Standardized Approach. On October 1, 2023, Citi’s required regulatory CET1 Capital ratio increased to 12.3% from 12% under the Standardized Approach, reflecting the increase in the SCB requirement to 4.3% from 4.0%. In addition, a breach of the SCB and other regulatory capital buffers may result in gradual limitations on capital distributions and discretionary bonus payments to executive officers. For additional information on the SCB, see “Capital Resources—Regulatory Capital Buffers” above.

Moreover, changes in regulatory capital rules, requirements or interpretations could materially increase Citi’s required regulatory capital. For example, the U.S. banking regulators have proposed a number of changes to the U.S. regulatory capital framework, including, but not limited to, significant revisions to the U.S. Basel III rules, known as the Basel III Endgame (capital proposal); changes to the method for calculating the GSIB surcharge; and changes to aspects of the total loss-absorbing capacity (TLAC) requirements. The capital proposal would replace the Advanced Approaches with a new Expanded Risk-based Approach for calculating risk-

weighted assets. Under the capital proposal, a single capital buffer, including the SCB, would apply to a firm’s risk-based capital ratios, regardless of whether the applicable ratios result from the Expanded Risk-based Approach or the Modified Standardized Approach. Additionally, the capital proposal would make various changes to the calculations of credit risk, market risk and operational risk components of risk-weighted assets (see “Capital Resources—Regulatory Capital Standards and Developments” above). All of these potential changes, if adopted as proposed, would likely materially impact Citi’s regulatory capital position and substantially increase Citi’s regulatory capital requirements, and thus adversely impact the extent to which Citi is able to return capital to shareholders.

Citi’s ability to return capital also depends on its results of operations and financial condition, including the capital impact related to its remaining divestitures, such as, among other things, any temporary capital impact from CTA losses (net of hedges) between transaction signings and closings (see the continued investments and the incorrect assumptions or estimates risk factors below); Citi’s effectiveness in planning, managing and calculating its level of regulatory capital and risk-weighted assets under both the Advanced Approaches and the Standardized Approach, as well as the Supplementary Leverage ratio (SLR); its implementation and maintenance of an effective capital planning process and management framework; forecasts of macroeconomic conditions; and deferred tax asset (DTA) utilization (see the ability to utilize DTA risk factor below). The FRB could also limit or prohibit capital actions, such as paying or increasing dividends or repurchasing common stock due to macroeconomic disruptions or events, some of which occurred for a period of time during the COVID-19 pandemic.

All firms subject to CCAR requirements, including Citi, will continue to be subject to a rigorous regulatory evaluation of capital planning practices and other reviews and examinations, including, but not limited to data quality, which

is a key regulatory focus, governance, risk management and internal controls. For example, the FRB has stated that it expects capital adequacy practices to continue to evolve and to likely be determined by its yearly cross-firm review of capital plan submissions. Similarly, the FRB has indicated that, as part of its stated goal to continually evolve its annual stress testing requirements, several parameters of the annual stress testing process may continue to be altered, including the number and severity of the stress test scenarios, the FRB modeling of Citi’s balance sheet, pre-provision net revenue and stress losses, and the addition of components deemed important by the FRB. Additionally, Citi’s ability to return capital may be adversely impacted if a regulatory evaluation or examination results in negative findings regarding absolute

capital levels or other aspects of Citi’s operations, including as a result of the imposition of additional capital buffers, limitations on capital distributions or otherwise. For information on limitations on Citi’s ability to return capital to common shareholders, as well as the CCAR process, supervisory stress test requirements and GSIB surcharge, see “Capital Resources—Overview” and “Capital Resources—Stress Testing Component of Capital Planning” above and the risk management risk factor below.

In December 2023, the FRB announced that it will maintain its current framework for calculating allowances on loans in the supervisory stress test through the 2024 stress test cycle, while continuing to evaluate appropriate future enhancements to this framework. The impacts on Citi’s capital adequacy of any potential incorporation by the FRB of CECL into its supervisory stress tests in future stress test cycles, and of other potential regulatory changes in the FRB’s stress testing methodologies, remain unclear. For additional information regarding the CECL methodology, including the transition provisions related to the adverse regulatory capital effects resulting from adoption of the CECL methodology, see “Capital Resources—Current Regulatory Capital Standards—Regulatory Capital Treatment—Modified Transition of the Current Expected Credit Losses Methodology” above and Note 1.

Although various uncertainties exist regarding the extent of, and the ultimate impact to Citi from, changes to regulatory capital, results from the FRB’s stress testing and CCAR regimes, and regulatory evaluation or examination findings, these changes could increase the level of capital Citi is required or elects to hold, including as part of Citi’s management buffer, thus potentially adversely impacting the extent to which Citi is able to return capital to shareholders.

Citi Must Continually Review, Analyze and Successfully Adapt to Ongoing Regulatory and Legislative Uncertainties and Changes in the U.S. and Globally.

Citi, its management and its businesses continue to face regulatory and legislative uncertainties and changes, both in the U.S. and globally. While the ongoing regulatory and legislative uncertainties and changes facing Citi are too numerous to list completely, examples include, but are not limited to (i) potential changes to various aspects of the U.S. regulatory capital framework and requirements applicable to Citi, including, among others, significant revisions to the U.S. Basel III rules, known as the Basel III Endgame (for information about the Basel III Endgame, see the capital return risk factor and “Capital Resources—Regulatory Capital Standards Developments” above); (ii) potential fiscal, monetary, tax, sanctions and other changes promulgated by the U.S. federal government and other governments, including potential changes in regulatory requirements relating to interest rate risk management; and (iii) rapidly evolving legislative and regulatory requirements and other government initiatives in the EU, the U.S. and globally related to climate change and other ESG areas that vary, and may conflict, across jurisdictions, including any new disclosure requirements (see the climate change and heightened regulatory scrutiny and ongoing interpretation of regulatory changes risk factors below). References to “regulatory” refer to both formal regulation and the views and expectations of Citi’s regulators in their supervisory roles, which, as they

change over time, can have a major impact. In particular, the

U.S. regulators have indicated that the level of their

expectations is increasing and prompt negative examination

findings/ratings and enforcements actions are more likely.

For example, in February 2023, the Consumer Financial Protection Bureau (CFPB) proposed significant changes to the maximum amounts on credit card late fees, which, if adopted

as proposed, would reduce credit card fee revenues in Branded Cards and Retail Services in USPB. In addition, U.S. and international regulatory and legislative initiatives have not always been undertaken or implemented on a coordinated basis, and areas of divergence have developed and continue to develop with respect to their scope, interpretation, timing, structure or approach, leading to inconsistent or even conflicting requirements, including within a single jurisdiction.

Further, ongoing regulatory and legislative uncertainties and changes make Citi’s long-term business, balance sheet and strategic budget planning difficult, subject to change and potentially more costly and may impact its results of operations. U.S. and other regulators globally have implemented and continue to discuss various changes to certain regulatory requirements, which would require ongoing assessment by management as to the impact to Citi, its businesses and business planning. Business planning must necessarily be based on possible or proposed rules or outcomes, which can change significantly upon finalization, or upon implementation or interpretive guidance from numerous regulatory bodies worldwide, and such guidance can change. Regulatory and legislative changes have also significantly increased Citi’s compliance risks and costs (see the implementation and interpretation of regulatory changes risk factor below) and can adversely affect Citi’s competitive position, as well as its businesses, results of operations and financial condition.

Citi’s Ability to Achieve Its Objectives from Its Transformation, Organizational, Simplification and Other Strategic and Other Initiatives May Not Be as Successful as It Projects or Expects.

As part of its transformation initiatives, Citi continues to make significant investments to improve its risk and controls environment, modernize its data and technology infrastructure and further enhance safety and soundness (see “Executive Summary” above and the legal and regulatory proceedings risk factor below). Citi also continues to make business-led investments, as part of the execution of its strategic initiatives. For example, Citi has been making investments across the Company, including hiring front office colleagues in key strategic markets and businesses; enhancing product capabilities and platforms to grow key businesses, improve client digital experiences and add scalability; and implementing new capabilities and partnerships. These business-led investments are designed to grow revenues as well as result in retention and efficiency improvements.

Additionally, Citi has been pursuing overall simplification initiatives that include management and operating model changes and actions to enhance focus on clients and reduce expenses. Citi’s simplification actions also include divestiture of the Mexico Consumer/SBMM operations and completing other exits and wind-downs in order to streamline Citi and assist in optimizing its allocation of resources. These overall simplification initiatives involve various execution challenges and may result in higher than expected expenses, litigation and regulatory scrutiny, CTA and other losses or other negative financial or strategic impacts, which could be material (for information about potential CTA impacts, see the capital return risk factor above and the incorrect assumptions or estimates risk factor below).

Citi’s multiyear transformation, as well as its simplification initiatives, involve significant complexities and uncertainties. In addition, there is inherent risk that Citi’s transformation and simplification initiatives will not be as productive or effective as Citi expects, or at all. Conversely, failure to adequately invest in and upgrade Citi’s technology and processes or properly implement its enterprise-wide simplification could result in Citi’s inability to meet regulatory expectations, be sufficiently competitive, serve clients effectively and avoid disruptions to its businesses and operational errors (see the operational processes and systems and legal and regulatory proceedings risk factors below). Citi’s ability to achieve expected returns and operational improvements depends, in part, on factors that it cannot control, including, among others, macroeconomic challenges and uncertainties; customer, client and competitor actions; and ongoing regulatory requirements or changes.

Citi’s transformation, strategic and other initiatives may continue to evolve as its business strategies, the market environment and regulatory expectations change, which could make the initiatives more costly and more challenging to implement, and limit their effectiveness.

Climate Change Presents Various Financial and Non-Financial Risks to Citi and Its Customers and Clients.

Climate change presents both immediate and long-term risks to Citi and its customers and clients, with the risks expected to increase over time. Climate risks can arise from both physical risks (those risks related to the physical effects of climate change) and transition risks (risks related to regulatory, market, technological, stakeholder and legal changes from a transition to a low-carbon economy). Physical and transition risks can manifest themselves differently across Citi’s risk categories in the short, medium and long terms.

Physical risks from climate change include acute risks, such as hurricanes, floods and droughts, as well as consequences of chronic changes in climate, such as rising sea levels, prolonged droughts and systemic changes to geographies and any resulting population migration. For example, physical risks could have adverse financial, operational and other impacts on Citi, both directly on its business and operations, and indirectly as a result of impacts to Citi’s clients, customers, vendors and other counterparties. These impacts can include destruction, damage or impairment of owned or leased properties and other assets, destruction or deterioration of the value of collateral, such as real estate, disruptions to business operations and supply chains and reduced availability or increase in the cost of insurance. Physical risks can also impact Citi’s credit risk exposures, for example, in its mortgage and commercial real estate lending businesses.

Transition risks may arise from changes in regulations or market preferences toward low-carbon industries or sectors, which in turn could have negative impacts on asset values, results of operations or the reputations of Citi and its customers and clients. For example, Citi’s corporate credit exposures include oil and gas, power and other industries that may experience reduced demand for carbon-intensive products

due to the transition to a low-carbon economy. Failure to adequately consider transition risk in developing and executing on its business strategy could lead to a loss of market share, lower revenues and higher credit costs. Transition risks also include potential increased operational, compliance and energy costs driven by government policies to promote decarbonization.

Moreover, increasing legislative and regulatory changes and uncertainties regarding climate-related risk management and disclosures are likely to result in increased regulatory, compliance, credit, reputational and other risks and costs for Citi. New regulations have been enacted and/or are expected in several jurisdictions, including the EU’s Corporate Sustainability Reporting Directive (CSRD), the SEC climate-related disclosures that could require disclosure of climate-related information and the State of California’s legislation enacted in October 2023 requiring broad disclosure of greenhouse gas emissions and other climate-related information largely beginning in 2026. In addition, Citi could face increased regulatory scrutiny and reputation and litigation risks as a result of its climate risk, sustainability and other ESG-related commitments and disclosures.

Even as some regulators seek to mandate additional disclosure of climate-related information, Citi’s ability to comply with such requirements and conduct more robust climate-related risk analyses may be hampered by lack of information and reliable data. Data on climate-related risks is limited in availability, often based on estimated or unverified figures, collected and reported on a time-lag, and variable in quality. Modeling capabilities to analyze climate-related risks and interconnections are improving, but remain incomplete. U.S. and non-U.S. banking regulators and others are increasingly focusing on the issue of climate risk at financial institutions, both directly and with respect to their clients. For example, in October 2023, the FRB, FDIC and OCC jointly released principles that provide a high-level framework for the safe and sound management of exposures to climate-related financial risks, including physical and transition risks, for financial institutions with more than $100 billion in assets.

Additionally, if Citi’s response to climate change is perceived to be ineffective or insufficient or Citi is unable to achieve its objectives or commitments relating to climate change, its businesses, reputation, attractiveness to certain investors and efforts to recruit and retain employees may suffer. For example, Citi's approach to supporting client decarbonization in a gradual and orderly way, while promoting energy security, may lead to both continued exposure to carbon-intensive activity and increased reputation risks from stakeholders with divergent points of view. Citi also faces anti-ESG challenges from certain U.S. state and other governments that may impact its ability to conduct certain business within those jurisdictions.

For information on Citi’s climate and other sustainability initiatives, see “Climate Change and Net Zero” below. For additional information on Citi’s management of climate risk, see “Managing Global Risk—Strategic Risk—Climate Risk” below.

Citi’s Ability to Utilize Its DTAs, and Thus Reduce the Negative Impact of the DTAs on Citi’s Regulatory Capital, Will Be Driven by Its Ability to Generate U.S. Taxable Income.

At December 31, 2023, Citi’s net DTAs were $29.6 billion, net of a valuation allowance of $3.6 billion, of which $12.8 billion was deducted from Citi’s CET1 Capital under the U.S. Basel III rules. Of this deducted amount, $12.1 billion related to net operating losses, foreign tax credit and general business credit carry-forwards, with $2.3 billion related to temporary differences in excess of the 10%/15% regulatory limitations, reduced by $1.6 billion of deferred tax liabilities, primarily associated with goodwill and certain other intangible assets that were separately deducted from capital.

Citi’s overall ability to realize its DTAs will primarily be dependent upon Citi’s ability to generate U.S. taxable income in the relevant reversal periods. Failure to realize any portion of the net DTAs would have a corresponding negative impact on Citi’s net income and financial returns.

The accounting treatment for realization of DTAs is complex and requires significant judgment and estimates regarding future taxable earnings in the jurisdictions in which the DTAs arise and available tax planning strategies. Forecasts of future taxable earnings will depend upon various factors, including, among others, macroeconomic conditions. In addition, any future increase in U.S. corporate tax rates could result in an increase in Citi’s DTAs, which may subject more of Citi’s DTAs to exclusion from regulatory capital.

Citi has not been and does not expect to be subject to the base erosion anti-abuse tax (BEAT), which, if applicable to Citi in any given year, would have a significantly adverse effect on both Citi’s net income and regulatory capital.

For additional information on Citi’s DTAs, including FTCs, see “Significant Accounting Policies and Significant Estimates—Income Taxes” below and Notes 1 and 10.

Citi’s Interpretation or Application of the Complex Tax Laws to Which It Is Subject Could Differ from Those of Governmental Authorities, Which Could Result in Litigation or Examinations and the Payment of Additional Taxes, Penalties or Interest.

Citi is subject to various income-based tax laws of the U.S. and its states and municipalities, as well as the numerous non-U.S. jurisdictions in which it operates. These tax laws are inherently complex, and Citi must make judgments and interpretations about the application of these laws to its entities, operations and businesses.

For example, the Organization for Economic Cooperation and Development (OECD) Pillar 2 initiative contemplates a 15% global minimum tax with respect to earnings in each country. EU member states were required to adopt the OECD Pillar 2 rules in 2023, with an effective date of January 1, 2024 (unless an exception applied), and other non-U.S. countries have similarly adopted or are expected to adopt the rules. Under these rules, Citi will be required to pay a “top-up” tax to the extent that Citi’s effective tax rate in any given country is below 15%. Beginning in 2024, countries that adopted the OECD Pillar 2 rules in 2023 can collect the top-up tax only with respect to earnings of entities in their jurisdiction or subsidiaries of such entities. Beginning in 2025, all countries

that have adopted the OECD Pillar 2 rules can collect a share of the top-up tax owed with respect to any member of the Pillar 2 multinational group. While Citi does not currently expect the rules to have a material impact on its earnings, many aspects of the application of the rules remain uncertain.

Additionally, Citi is subject to litigation or examinations with U.S. and non-U.S. tax authorities regarding non-income-based tax matters. While Citi has appropriately reserved for such matters where there is a probable loss, and has disclosed reasonably possible losses, the outcome of the matters may be different than Citi’s expectations. Citi’s interpretations or application of the tax laws, including with respect to withholding, stamp, service and other non-income taxes, could differ from that of the relevant governmental taxing authority, which could result in the requirement to pay additional taxes, penalties or interest, the reduction of certain tax benefits or the requirement to make adjustments to amounts recorded, which could be material. See Note 30 for additional information on litigation and examinations involving non-U.S. tax authorities.

A Deterioration in or Failure to Maintain Citi’s Co-Branding or Private Label Credit Card Relationships Could Have a Negative Impact on Citi.

Citi has co-branding and private label relationships through its Branded Cards and Retail Services credit card businesses with various retailers and merchants, whereby in the ordinary course of business Citi issues credit cards to consumers, including customers of the retailers or merchants. The five largest relationships across both businesses in USPB constituted an aggregate of approximately 11% of Citi’s revenues in 2023 (see “U.S. Personal Banking” above). Citi’s co-branding and private label agreements often provide for shared economics between the parties and generally have a fixed term.

Competition among card issuers, including Citi, for these relationships is significant, and Citi may not be able to maintain such relationships on existing terms or at all. Citi’s co-branding and private label relationships could also be negatively impacted by, among other things, the general economic environment, including the impacts of continued elevated interest rates and inflation, and lower economic growth rates, as well as a continuing risk of recession; changes in consumer sentiment, spending patterns and credit card usage behaviors; a decline in sales and revenues, partner store closures, any reduction in air and business travel, or other operational difficulties of the retailer or merchant; early termination due to a contractual breach or exercise of other early termination right; or other factors, including bankruptcies, liquidations, restructurings, consolidations or other similar events, whether due to a challenging macroeconomic environment or otherwise.

These events, particularly early termination and bankruptcies or liquidations, could negatively impact the results of operations or financial condition of Branded Cards, Retail Services or Citi as a whole, including as a result of loss of revenues, increased expenses, higher cost of credit, impairment of purchased credit card relationships and contract-related intangibles or other losses (see Note 17 for information on Citi’s credit card related intangibles generally).

The Application of U.S. Resolution Plan Requirements May Pose a Greater Risk of Loss to Citi’s Debt and Equity Securities Holders, and Citi’s Inability in Its Resolution Plan Submissions to Address Any Shortcomings or Deficiencies or Guidance Could Subject Citi to More Stringent Capital, Leverage or Liquidity Requirements, or Restrictions on Its Growth, Activities or Operations, and Could Eventually Require Citi to Divest Assets or Operations.

Title I of the Dodd-Frank Act requires Citi to prepare and submit a plan to the FRB and the FDIC for the orderly resolution of Citigroup (the bank holding company) and its significant legal entities under the U.S. Bankruptcy Code in the event of future material financial distress or failure.

Under Citi’s preferred “single point of entry” resolution plan strategy, only Citigroup, the parent holding company, would enter into bankruptcy, while Citigroup’s material legal entities (as defined in the public section of its 2023 resolution plan, which can be found on the FRB’s and FDIC’s websites) would remain operational outside of any resolution or insolvency proceedings. As a result, Citigroup’s losses and any losses incurred by its material legal entity subsidiaries would be imposed first on holders of Citigroup’s equity securities and thereafter on its unsecured creditors, including holders of eligible long-term debt and other debt securities.

In addition, a wholly owned, direct subsidiary of Citigroup serves as a resolution funding vehicle (the IHC) to which Citigroup has transferred, and has agreed to transfer on an ongoing basis, certain assets. The obligations of Citigroup and of the IHC, respectively, under the amended and restated secured support agreement, are secured on a senior basis by the assets of Citigroup (other than shares in subsidiaries of the parent company and certain other assets), and the assets of the IHC, as applicable. As a result, claims of the operating material legal entities against the assets of Citigroup with respect to such secured assets are effectively senior to unsecured obligations of Citigroup. Citi’s single point of entry resolution plan strategy and the obligations under the amended and restated secured support agreement may result in the recapitalization of and/or provision of liquidity to Citi’s operating material legal entities, and the commencement of bankruptcy proceedings by Citigroup at an earlier stage of financial stress than might otherwise occur without such mechanisms in place.

In line with the FRB’s TLAC rule, Citigroup’s shareholders and unsecured creditors—including its unsecured long-term debt holders—would bear any losses resulting from Citigroup’s bankruptcy. Accordingly, any value realized by holders of its unsecured long-term debt may not be sufficient to repay the amounts owed to such debt holders in the event of a bankruptcy or other resolution proceeding of Citigroup. For additional information on Citi’s single point of entry resolution plan strategy and the IHC and secured support agreement, see “Managing Global Risk—Liquidity Risk” below.

On November 22, 2022, the FRB and FDIC issued feedback on the resolution plans filed on July 1, 2021 by the eight U.S. GSIBs, including Citi. The FRB and FDIC identified one shortcoming, but no deficiencies, in Citi’s 2021 resolution plan. The shortcoming related to data integrity and data quality management issues, specifically, weaknesses in

Citi’s processes and practices for producing certain data that could materially impact its resolution capabilities. If a shortcoming is not satisfactorily explained or addressed before, or in, the submission of the next resolution plan, the shortcoming may be found to be a deficiency in the next resolution plan (see discussion below). Citi submitted its 2023 resolution plan in June 2023. More generally, data continues

to be a subject of regulatory focus, and Citi continues to work

on enhancing its data availability and quality.

Under Title I, if the FRB and the FDIC jointly determine that Citi’s resolution plan is not “credible” (which, although not defined, is generally understood to mean the regulators do not believe the plan is feasible or would otherwise allow Citi to be resolved in a way that protects systemically important functions without severe systemic disruption), or would not facilitate an orderly resolution of Citi under the U.S. Bankruptcy Code, and Citi fails to resubmit a resolution plan that remedies any identified deficiencies, Citi could be subjected to more stringent capital, leverage or liquidity requirements, or restrictions on its growth, activities or operations. If within two years from the imposition of any such requirements or restrictions Citi has still not remediated any identified deficiencies, then Citi could eventually be required to divest certain assets or operations. Any such restrictions or actions would negatively impact Citi’s reputation, market and investor perception, operations and strategy.

Citi’s Performance and Its Ability to Effectively Execute Its Transformation and Strategic and Other Initiatives Could Be Negatively Impacted if It Is Not Able to Hire and Retain Qualified Employees.

Citi’s performance and the performance of its individual businesses largely depend on the talents and efforts of its diverse and highly qualified colleagues. Specifically, Citi’s continued ability to compete in each of its lines of business, to manage its businesses effectively and to execute its transformation and strategic and other initiatives, including, for example, hiring front office colleagues to grow businesses or hiring colleagues to support Citi’s transformation and strategic and other initiatives, depends on its ability to attract new colleagues and to retain and motivate its existing colleagues. If Citi is unable to continue to attract, retain and motivate highly qualified colleagues, Citi’s performance, including its competitive position, the execution of its transformation and strategic and other initiatives and its results of operations could be negatively impacted.

Citi’s ability to attract, retain and motivate colleagues depends on numerous factors, some of which are outside of Citi’s control. For example, the competition for talent continues to be particularly intense due to factors such as low unemployment and changes in worker expectations, concerns and preferences, including an increased demand for remote work options and other job flexibility. Also, the banking industry generally is subject to more comprehensive regulation of employee compensation than other industries, including deferral and clawback requirements for incentive compensation, which can make it unusually challenging for Citi to compete in labor markets against businesses, including, for example, technology companies, that are not subject to such regulation. In addition, in 2023 Citi announced plans to reduce management layers from 13 to a median of eight as part of organizational simplification initiatives that also involve significant reductions in functional roles, which could also impact its ability to attract and retain colleagues. Other factors that could impact its ability to attract, retain and motivate colleagues include, among other things, Citi’s presence in a particular market or region, the professional and development opportunities, its reputation and its diversity. For information on Citi’s colleagues and workforce management, see “Human Capital Resources and Management” below.

Citi Faces Increased Competitive Challenges, Including from Financial Services and Other Companies and Emerging Technologies.

Citi operates in an increasingly evolving and competitive business environment, which includes both financial and non-financial services firms, such as traditional banks, online banks, private credit and financial technology companies and others. These companies compete on the basis of, among other factors, size, reach, quality and type of products and services offered, price, technology and reputation. Certain competitors may be subject to different and, in some cases, less stringent legal and regulatory requirements, whether due to size, jurisdiction, entity type or other factors, placing Citi at a competitive disadvantage.

For example, Citi competes with other financial services companies in the U.S. and globally that have grown rapidly over the last several years or have developed and introduced new products and services. Potential mergers and acquisitions involving traditional financial services companies such as regional banks or credit card issuers, as well as networks and merchant acquirers, may also increase competition and impact Citi’s ability to offer competitive pricing and rewards. Non-traditional financial services firms, such as private credit and financial technology companies, are less regulated and continue to expand their offerings of services traditionally provided by financial institutions. The growth of certain of these competitors has increased market and counterparty credit risks, particularly in a more challenging macroeconomic environment (see the risk factor on credit and concentrations of risk below). In addition, emerging technologies have the potential to intensify competition and accelerate disruption in the financial services industry. For example, despite difficulties and turmoil faced by the digital asset market in recent years, clients and investors have exhibited a sustained interest in digital assets. Financial services firms and other market participants have begun to offer services related to those assets. Citi may not be able to provide the same or similar services for legal or regulatory reasons, which may be exacerbated by rapidly evolving and conflicting regulatory requirements, and due to increased compliance and other risks. Further, changes in the payments space (e.g., instant and 24x7 payments) are accelerating, and, as a result, certain of Citi’s products and services could become less competitive.

Increased competition and emerging technologies have required and could require Citi to change or adapt its products and services, as well as invest in and develop related infrastructure, to attract and retain customers or clients or to compete more effectively with competitors, including new

market entrants. Simultaneously, as Citi develops new products and services leveraging emerging technologies, new risks may emerge that, if not designed and governed adequately, may result in control gaps and in Citi operating outside of its risk appetite. For example, failure to strategically embrace the potential of artificial intelligence (AI) may result in a competitive disadvantage to Citi. At the same time, as a new technology, use of AI without sufficient controls, governance and risk management may result in increased risks across all of Citi’s risk categories. As another example, instant and 24x7 payments products could be accompanied by challenges to forecasting and managing liquidity, as well as increased operational and compliance risks.

Moreover, Citi relies on third parties to support certain of its product and service offerings, which may put Citi at a disadvantage to competitors who may directly offer a broader array of products and services. Also, Citi’s businesses, results of operations and reputation may suffer if any third party is unable to provide adequate support for such product and service offerings, whether due to operational incidents or otherwise (see the operational processes and systems, cybersecurity and emerging markets risk factors below).

To the extent that Citi is not able to compete effectively with financial services companies, including private credit and financial technology companies, and non-financial services firms, Citi could be placed at a competitive disadvantage, which could result in loss of customers and market share, and its businesses, results of operations and financial condition could suffer. For additional information on Citi’s competitors, see the co-brand and private label cards and qualified colleagues risk factors above and “Supervision, Regulation and Other—Competition” below.

OPERATIONAL RISKS

A Failure or Disruption of Citi’s Operational Processes or Systems Could Negatively Impact Its Reputation, Customers, Clients, Businesses or Results of Operations and Financial Condition.

Citi’s global operations rely heavily on its technology systems and infrastructure, including the accurate, timely and secure processing, management, storage and transmission of data, including confidential transactions, and other information, as well as the monitoring of a substantial amount of data and complex transactions in real time. Citi obtains and stores an extensive amount of personal and client-specific information for its consumer and institutional customers and clients, and must accurately record and reflect their account transactions. Citi’s operations must also comply with complex and evolving laws, regulations and heightened regulatory expectations in the countries in which it operates (see the implementation and interpretation of regulatory changes and legal proceedings risk factors below). With the evolving proliferation of new technologies and the increasing use of the internet, mobile devices and cloud services to conduct financial transactions and customers’ and clients’ increasing use of online banking and trading systems and other platforms, large global financial institutions such as Citi have been, and will continue to be, subject to an ever-increasing risk of operational loss, failure or disruption.

Although Citi has continued to upgrade its technology, including systems to automate processes and gain efficiencies, operational incidents are unpredictable and can arise from numerous sources, not all of which are fully within Citi’s control. These include, among others, operational or execution failures, or deficiencies by third parties, including third parties that provide products or services to Citi (e.g., cloud service providers), other market participants or those that otherwise have an ongoing partnership or business relationship with Citi; deficiencies in processes or controls; inadequate management of data governance practices, data controls and monitoring mechanisms that may adversely impact internal or external reporting and decision-making; cyber or information security incidents (see the cybersecurity risk factor below); human error, such as manual transaction processing errors (e.g., erroneous payments to lenders or manual errors by traders that cause system and market disruptions or losses), which can be exacerbated by staffing challenges and processing backlogs; fraud or malice on the part of employees or third parties; insufficient (or limited) straight-through processing between legacy or bespoke systems and any failure to design and effectively operate controls that mitigate operational risks associated with those legacy or bespoke systems, leading to potential risk of errors and operating losses; accidental system or technological failure; electrical or telecommunication outages; failures of or cyber incidents involving computer servers or infrastructure, including cloud services; or other similar losses or damage to Citi’s property or assets (see also the climate change risk factor above).

For example, operational incidents can arise as a result of failures by third parties with which Citi does business, such as failures by internet, mobile technology and cloud service providers or other vendors to adequately follow procedures or processes, safeguard their systems or prevent system disruptions or cyberattacks. Failure by Citi to develop, implement and operate a third-party risk management program commensurate with the level of risk, complexity and nature of its third-party relationships can also result in operational incidents. In addition, Citi has experienced and could experience further losses associated with manual transaction processing errors, including erroneous payments to lenders or manual errors by Citi traders that cause system and market disruptions and losses for Citi and its clients. Irrespective of the sophistication of the technology utilized by Citi, there will always be some room for human and other errors. In view of the large transactions in which Citi engages, such errors could result in significant losses. While Citi has change management processes in place to appropriately upgrade its operational processes and systems to ensure that any changes introduced do not adversely impact security and operational continuity, such change management can fail or be ineffective. Furthermore, when Citi introduces new products, systems or processes, new operational risks that may arise from those changes may not be identified, or adequate controls to mitigate the identified risks may not be appropriately implemented or operate as designed.

Incidents that impact information security, technology operations or other operational processes may cause disruptions and/or malfunctions within Citi’s businesses (e.g., the temporary loss of availability of Citi’s online banking

system or mobile banking platform), as well as the operations of its clients, customers or other third parties. In addition, operational incidents could involve the failure or ineffectiveness of internal processes or controls. Given Citi’s global footprint and the high volume of transactions processed by Citi, certain failures, errors or actions may be repeated or compounded before they are discovered and rectified, which would further increase the consequences and costs. Operational incidents could result in financial losses and other costs as well as misappropriation, corruption or loss of confidential and other information or assets, which could significantly negatively impact Citi’s reputation, customers, clients, businesses or results of operations and financial condition. Cyber-related and other operational incidents can also result in legal and regulatory actions or proceedings, fines and other costs (see the legal and regulatory proceedings risk factor below).

For information on Citi’s management of operational risk, see “Managing Global Risk—Operational Risk” below.

Citi’s and Third Parties’ Computer Systems and Networks Will Continue to Be Susceptible to an Increasing Risk of Continually Evolving, Sophisticated Cybersecurity Incidents That Could Result in the Theft, Loss, Non-Availability, Misuse or Disclosure of Confidential Client or Customer Information, Damage to Citi’s Reputation, Additional Costs to Citi, Regulatory Penalties, Legal Exposure and Financial Losses.

Citi’s computer systems, software and networks are subject to ongoing attempted cyberattacks, such as unauthorized access, loss or destruction of data (including confidential client information), account takeovers, disruptions of service, phishing, malware, ransomware, computer viruses or other malicious code and other similar events. These threats can arise from external parties, including cyber criminals, cyber terrorists, hacktivists (individuals or groups using cyberattacks to promote a political or social agenda) and nation-state actors, as well as insiders who knowingly or unknowingly engage in or enable malicious cyber activities. Citi develops its own software and relies on third-party applications and software, which are susceptible to vulnerability exploitations. Software leveraged in financial services and other industries continues to be impacted by an increasing number of zero-day vulnerabilities, thus increasing inherent cyber risk to Citi.

The increasing use of mobile and other digital banking platforms and services, cloud technologies and connectivity solutions to facilitate remote working for Citi’s employees all increase Citi’s exposure to cybersecurity risks. Citi is also susceptible to cyberattacks given, among other things, its size and scale, high-profile brand, global footprint and prominent role in the financial system, as well as the ongoing wind-down of its businesses in Russia (see the macroeconomic and geopolitical risk factor above and “Managing Global Risk—Other Risks—Country Risk—Russia” below). Additionally, Citi continues to operate in multiple jurisdictions in the midst of geopolitical unrest, including active conflicts in Ukraine and the Middle East, which could expose Citi to heightened risk of insider threat, politically motivated hacktivism or other cyber threats.

Citi continues to experience increased exposure to cyberattacks through third parties, in part because financial institutions are becoming increasingly interconnected with central agents, exchanges and clearing houses. Third parties with which Citi does business, as well as retailers and other third parties with which Citi’s customers do business, and any such third parties’ downstream service providers, also pose cybersecurity risks, particularly where activities of customers are beyond Citi’s security and control systems. For example, Citi outsources certain functions, such as processing customer credit card transactions, uploading content on customer-facing websites and developing software for new products and services. These relationships allow for the storage and processing of customer information by third-party hosting of, or access to, Citi websites. This could lead to compromise or the potential to introduce vulnerable or malicious code, resulting in security breaches or business disruptions impacting Citi customers, employees or operations. While many of Citi’s agreements with third parties include indemnification provisions, Citi may not be able to recover sufficiently, or at all, under these provisions to adequately offset any losses and other adverse impacts Citi may incur from third-party cyber incidents.

Citi and some of its third-party partners have been subjected to attempted and sometimes successful cyberattacks over the last several years, including (i) denial of service attacks, which attempt to interrupt service to clients and customers; (ii) hacking and malicious software installations intended to gain unauthorized access to information systems or to disrupt those systems and/or impact availability or privacy of confidential data, with objectives including, but not limited to, extortion payments or causing reputational damage; (iii) data breaches due to unauthorized access to customer account or other data; and (iv) malicious software attacks on client systems, in attempts to gain unauthorized access to Citi systems or client data under the guise of normal client transactions.

While Citi’s monitoring and protection services have historically generally succeeded in detecting, thwarting and/or responding to attacks targeting its systems before they become significant, certain past incidents resulted in limited losses, as well as increases in expenditures to monitor against the threat of similar future cyber incidents. There can be no assurance that such cyber incidents will not occur again, and they could occur more frequently, via novel tactics, including leveraging of tools made possible by emerging technologies, and on a more significant scale. Despite the significant resources Citi allocates to implement, maintain, monitor and regularly upgrade its systems and networks with measures such as intrusion detection and prevention systems and firewalls to safeguard critical business applications, there is no guarantee that these measures or any other measures can provide sufficient security. Because the techniques used to initiate cyberattacks change frequently or, in some cases, are not recognized until launched or even later, Citi may be unable to implement effective preventive measures or otherwise proactively address these methods. In addition, cyber threats and cyberattack techniques change, develop and evolve rapidly, including from emerging technologies such as artificial intelligence, cloud computing and quantum

computing. Given the frequency and sophistication of cyberattacks, the determination of the severity and potential impact of a cyber incident may not become apparent for a substantial period of time following detection of the incident. Also, while Citi strives to implement measures to reduce the exposure resulting from outsourcing risks, such as performing security control assessments of third-party vendors and limiting third-party access to the least privileged level necessary to perform job functions, these measures cannot prevent all third-party related cyberattacks or data breaches. In addition, the risk of insider threat may be elevated in the near term due to Citi’s overall simplification initiatives, including streamlining its global staff functions.

Cyber incidents can result in the disclosure of personal, confidential or proprietary customer, client or employee information; damage to Citi’s reputation with its clients, other counterparties and the market; customer dissatisfaction; and additional costs to Citi, including expenses such as repairing or replacing systems, replacing customer payment cards, credit monitoring or adding new personnel or protection technologies. Cyber incidents can also result in regulatory penalties, loss of revenues, deposit flight, exposure to litigation and other financial losses, including loss of funds to both Citi and its clients and customers, and disruption to Citi’s operational systems (see the operational processes and systems risk factor above). Moreover, the increasing risk of cyber incidents has resulted in increased legislative and regulatory action on cybersecurity, including, among other things, scrutiny of firms’ cybersecurity protection services, laws and regulations to enhance protection of consumers’ personal data and mandated disclosure on cybersecurity matters. For example, in July 2023, the SEC finalized new rules requiring timely disclosure of material cybersecurity incidents as well as other annual cyber-related disclosures (see “Managing Global Risk—Operational Risk—Cybersecurity Risk” below).

While Citi maintains insurance coverage that may, subject to policy terms and conditions including significant self-insured deductibles, cover certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses and may not take into account reputational harm, the costs of which are impossible to quantify.

For additional information about Citi’s management of cybersecurity risk, see “Managing Global Risk—Operational Risk—Cybersecurity Risk” below.

Changes or Errors in Accounting Assumptions, Judgments or Estimates, or the Application of Certain Accounting Principles, Could Result in Significant Losses or Other Adverse Impacts.

U.S. GAAP requires Citi to use certain assumptions, judgments and estimates in preparing its financial statements, including, among other items, the estimate of the ACL; reserves related to litigation, regulatory and tax matters; valuation of DTAs; the fair values of certain assets and liabilities; and the assessment of goodwill and other assets for impairment. These assumptions, judgments and estimates are inherently limited because they involve techniques, including the use of historical data in many circumstances, that cannot anticipate every economic and financial outcome in the markets in which Citi operates, nor can they anticipate the specifics and timing of such outcomes. For example, many models used by Citi include assumptions about correlation or lack thereof among prices of various asset classes or other market indicators that may not hold in times of market stress, limited liquidity or other unforeseen circumstances.

If Citi’s assumptions, judgments or estimates underlying its financial statements are incorrect or differ from actual or subsequent events, Citi could experience unexpected losses or other adverse impacts, some of which could be significant. Citi could also experience declines in its stock price, be subject to legal and regulatory proceedings and incur fines and other losses. For additional information on the key areas for which assumptions and estimates are used in preparing Citi’s financial statements, see “Significant Accounting Policies and Significant Estimates” below and Notes 1 and 16. For example, the CECL methodology requires that Citi provide reserves for a current estimate of lifetime expected credit losses for its loan portfolios and other financial assets, as applicable, at the time those assets are originated or acquired. This estimate is adjusted each period for changes in expected lifetime credit losses. Citi’s ACL estimate depends upon its CECL models and assumptions; forecasted macroeconomic conditions, including, among other things, the U.S. unemployment rate and U.S. inflation-adjusted gross domestic product (real GDP); and the credit indicators, composition and other characteristics of Citi’s loan portfolios and other applicable financial assets. These model assumptions and forecasted macroeconomic conditions will change over time, resulting in variability in Citi’s ACL and, thus, impact its results of operations and financial condition, as well as regulatory capital due to the CECL phase-in (see the capital return risk factor above).

Moreover, Citi has incurred losses related to its foreign operations that are reported in the CTA components of Accumulated other comprehensive income (loss) (AOCI). In accordance with U.S. GAAP, a sale, substantial liquidation or other deconsolidation event of any foreign operations, such as those related to Citi’s remaining divestitures or legacy businesses, would result in reclassification of any foreign CTA component of AOCI related to that foreign operation, including related hedges and taxes, into Citi’s earnings. For example, Citi could incur a significant loss on sale due to CTA losses related to any signing of a sale agreement for its remaining consumer banking divestitures (see the capital return and continued investments risk factors above). The majority of these losses would be regulatory capital neutral at closing. For additional information on Citi’s accounting policy for foreign currency translation and its foreign CTA components of AOCI, see Notes 1 and 21.

Changes to Financial Accounting and Reporting Standards or Interpretations Could Have a Material Impact on How Citi Records and Reports Its Financial Condition and Results of Operations.

Periodically, the Financial Accounting Standards Board (FASB) issues financial accounting and reporting standards that govern key aspects of Citi’s financial statements or interpretations thereof when those standards become effective, including those areas where Citi is required to make assumptions or estimates. Changes to financial accounting or

reporting standards or interpretations, whether promulgated or required by the FASB, the SEC, U.S. banking regulators or others, could present operational challenges and could also require Citi to change certain of the assumptions or estimates it previously used in preparing its financial statements, which could negatively impact how it records and reports its financial condition and results of operations generally and/or with respect to particular businesses. See Note 1 for additional information on Citi’s accounting policies and changes in accounting, including the expected impacts on Citi’s results of operations and financial condition.

If Citi’s Risk Management and Other Processes, Strategies or Models Are Deficient or Ineffective, Citi May Incur Significant Losses and Its Regulatory Capital and Capital Ratios Could Be Negatively Impacted.

Citi utilizes a broad and diversified set of risk management and other processes and strategies, including the use of models in analyzing and monitoring the various risks Citi assumes in conducting its activities. For example, Citi uses models as part of its comprehensive stress testing initiatives across the Company. Citi also relies on data to aggregate, assess and manage various risk exposures. Management of these risks and the reliability of the data are made more challenging within a large, global financial institution, such as Citi, particularly due to complex, diverse and rapidly changing financial markets and conditions in which Citi operates. Unexpected losses can result from untimely, inaccurate or incomplete processes and data. As discussed below, in October 2020, Citigroup and Citibank entered into consent orders with the FRB and OCC that require Citigroup and Citibank to make improvements in various aspects of enterprise-wide risk management, compliance, data quality management and governance, and internal controls (see “Citi’s Consent Order Compliance” above and the legal and regulatory proceedings risk factor below).

Citi’s risk management and other processes, strategies and models are inherently limited because they involve techniques, including the use of historical data in many circumstances, assumptions and judgments that cannot anticipate every economic and financial outcome in the markets in which Citi operates, particularly given various macroeconomic, geopolitical and other challenges and uncertainties (see the macroeconomic challenges and uncertainties risk factor above), nor can they anticipate the specifics and timing of such outcomes. For example, many models used by Citi include assumptions about correlation or lack thereof among prices of various asset classes or other market indicators that may not necessarily hold in times of market stress, limited liquidity or other unforeseen circumstances, or identify changes in markets or client behaviors not yet inherent in historical data. Citi could incur significant losses, receive

negative regulatory evaluation or examination findings or be

subject to additional enforcement actions, and its regulatory capital, capital ratios and ability to return capital could be negatively impacted, if Citi’s risk management and other processes, including its ability to manage and aggregate data in a timely and accurate manner, strategies or models are deficient or ineffective. For additional information, see the capital return risk factor above and the heightened regulatory scrutiny and ongoing interpretation of regulatory changes risk factor below. Such deficiencies or ineffectiveness could also result in inaccurate financial, regulatory or risk reporting.

Moreover, Citi’s Basel III regulatory capital models, including its credit, market and operational risk models, currently remain subject to ongoing regulatory review and approval, which may result in refinements, modifications or enhancements (required or otherwise) to these models. Citi is required to notify and obtain preapproval from both the OCC and FRB prior to implementing certain risk-weighted asset treatments, as well as certain model changes, resulting in a more challenging environment within which Citi must operate in managing its risk-weighted assets. Modifications or requirements resulting from these ongoing reviews, as well as any future changes or guidance provided by the U.S. banking regulators regarding the U.S. regulatory capital framework applicable to Citi, including, but not limited to, potential revisions to the U.S. Basel III rules, known as the Basel III Endgame (for information about the Basel III Endgame, see the capital return risk factor and “Capital Resources—Regulatory Capital Standards Developments” above), have resulted in, and could continue to result in, significant changes to Citi’s risk-weighted assets. These changes can negatively impact Citi’s capital ratios and its ability to meet its regulatory capital requirements.

CREDIT RISKS

Credit Risk and Concentrations of Risk Can Increase the Potential for Citi to Incur Significant Losses.

Citi has credit exposures to consumer, corporate and public sector borrowers and other counterparties in the U.S. and various countries and jurisdictions globally, including end-of-period consumer loans of $389 billion and end-of-period corporate loans of $300 billion at December 31, 2023. For additional information on Citi’s corporate and consumer loan portfolios, see “Managing Global Risk—Corporate Credit” and “—Consumer Credit” below.

A default by or a significant downgrade in the credit ratings of a borrower or other counterparty, or a decline in the credit quality or value of any underlying collateral, exposes Citi to credit risk. Despite Citi’s target client strategy, various macroeconomic, geopolitical, market and other factors, among other things, can increase Citi’s credit risk and credit costs, particularly for vulnerable sectors, industries or countries (see the macroeconomic challenges and uncertainties and co-branding and private label credit card risk factors above and the emerging markets risk factor below). For example, a weakening of economic conditions can adversely affect borrowers’ ability to repay their obligations, as well as result in Citi being unable to liquidate the collateral it holds or forced to liquidate the collateral at prices that do not cover the full amount owed to Citi. Citi is also a member of various central clearing counterparties and could incur financial losses as a result of defaults by other clearing members due to the requirements of clearing members to share losses. Additionally, due to the interconnectedness among financial institutions, concerns about the creditworthiness of or defaults by a financial institution could spread to other financial market participants and result in market-wide losses and disruption.

For example, the failure of regional banks and other banking stresses in the first half of 2023 resulted in market volatility across the financial sector.

While Citi provides reserves for expected losses for its credit exposures, as applicable, such reserves are subject to judgments and estimates that could be incorrect or differ from actual future events. Under the CECL accounting standard, the ACL reflects expected losses, which has resulted in and could lead to additional volatility in the allowance and the provision for credit losses (including provisions for loans and unfunded lending commitments, and ACL builds for Other assets) as forecasts of economic conditions change. For additional information, see the incorrect assumptions or estimates and changes to financial accounting and reporting standards risk factors above. For additional information on Citi’s ACL, see “Significant Accounting Policies and Significant Estimates” below and Notes 1 and 16. For additional information on Citi’s credit and country risk, see also each respective business’s results of operations above, “Managing Global Risk—Credit Risk” and “Managing Global Risk—Other Risks—Country Risk” below and Notes 15 and 16.

Concentrations of risk to clients or counterparties engaged in the same or related industries or doing business in a particular geography, or to a particular product or asset class, especially credit and market risks, can also increase Citi’s risk of significant losses. For example, Citi routinely executes a high volume of securities, trading, derivative and foreign exchange transactions with non-U.S. sovereigns and with counterparties in the financial services industry, including banks, insurance companies, investment banks, governments, central banks and other financial institutions. Moreover, Citi has indemnification obligations in connection with various transactions that expose it to concentrations of risk, including credit risk from hedging or reinsurance arrangements related to those obligations (see Note 28). A rapid deterioration of a large borrower or other counterparty or within a sector or country in which Citi has large exposures or indemnifications or unexpected market dislocations could lead to concerns about the creditworthiness of other borrowers or counterparties in a certain geography and in related or dependent industries, and such conditions could cause Citi to incur significant losses.

LIQUIDITY RISKS

Citi’s Businesses, Results of Operations and Financial Condition Could Be Negatively Impacted if It Does Not Effectively Manage Its Liquidity.

As a large, global financial institution, adequate liquidity and sources of funding are essential to Citi’s businesses. Citi’s liquidity, sources of funding and costs of funding can be significantly and negatively impacted by factors it cannot control, such as general disruptions in the financial markets (e.g., the failure of regional banks and other banking stresses in the first half of 2023); changes in fiscal and monetary policies and regulatory requirements; negative investor perceptions of Citi’s creditworthiness; deposit outflows or unfavorable changes in deposit mix; unexpected increases in cash or collateral requirements; credit ratings; and the consequent inability to monetize available liquidity resources.

In addition, Citi competes with other banks and financial institutions for both institutional and consumer deposits, which represent Citi’s most stable and lowest cost source of long-term funding. The competition for deposits has continued to increase, including as a result of quantitative tightening by central banks, the current higher interest rate environment and fixed income alternatives for customer funds.

Further, Citi’s costs to obtain and access wholesale funding are directly related to changes in interest and currency exchange rates and its credit spreads. Changes in Citi’s credit spreads are driven by both external market factors and factors specific to Citi, such as negative views by investors of the financial services industry or Citi’s financial prospects, and can be highly volatile. For additional information on Citi’s primary sources of funding, see “Managing Global Risk—Liquidity Risk” below.

Citi’s ability to obtain funding may be impaired and its cost of funding could also increase if other market participants are seeking to access the markets at the same time or to a greater extent than expected, or if market appetite for corporate debt securities declines, as is likely to occur in a liquidity stress event or other market crisis. Citi’s ability to sell assets may also be impaired if other market participants are seeking to sell similar assets at the same time or a liquid market does not exist for such assets. Additionally, unexpected changes in client needs due to idiosyncratic events or market conditions could result in greater than expected drawdowns from off-balance sheet committed facilities. A sudden drop in market liquidity could also cause a temporary or protracted dislocation of capital markets activity. In addition, clearing organizations, central banks, clients and financial institutions with which Citi interacts may exercise the right to require additional collateral during challenging market conditions, which could further impair Citi’s liquidity. If Citi fails to effectively manage its liquidity, its businesses, results of operations and financial condition could be negatively impacted.

Limitations on the payments that Citigroup Inc. receives from its subsidiaries could also impact its liquidity. As a holding company, Citigroup Inc. relies on interest, dividends, distributions and other payments from its subsidiaries to fund dividends as well as to satisfy its debt and other obligations. Several of Citi’s U.S. and non-U.S. subsidiaries are or may be subject to capital adequacy or other liquidity, regulatory or contractual restrictions on their ability to provide such payments, including any local regulatory stress test requirements and inter-affiliate arrangements entered into in connection with Citigroup Inc.’s resolution plan. Citigroup Inc.’s broker-dealer and bank subsidiaries are subject to restrictions on their ability to lend or transact with affiliates, as well as restrictions on their ability to use funds deposited with them in brokerage or bank accounts to fund their businesses.

A bank holding company is also required by law to act as a source of financial and managerial strength for its subsidiary banks. As a result, the FRB may require Citigroup Inc. to commit resources to its subsidiary banks even if doing so is not otherwise in the interests of Citigroup Inc. or its shareholders or creditors, reducing the amount of funds available to meet its obligations.

A Ratings Downgrade Could Adversely Impact Citi’s Funding and Liquidity.

The credit rating agencies, such as Fitch Ratings, Moody’s Investors Service and S&P Global Ratings, continuously evaluate Citi and certain of its subsidiaries. Their ratings of Citi and its rated subsidiaries’ long-term debt and short-term obligations are based on firm-specific factors, including the financial strength of Citi and such subsidiaries, as well as factors that are not entirely within the control of Citi and its subsidiaries, such as the agencies’ proprietary rating methodologies and assumptions, potential impact from negative actions on U.S. sovereign ratings and conditions affecting the financial services industry and markets generally.

Citi and its subsidiaries may not be able to maintain their current respective ratings and outlooks. Rating downgrades could negatively impact Citi and its rated subsidiaries’ ability to access the capital markets and other sources of funds as well as increase credit spreads and the costs of those funds. A ratings downgrade could also have a negative impact on Citi and its rated subsidiaries’ ability to obtain funding and liquidity due to reduced funding capacity and the impact from derivative triggers, which could require Citi and its rated subsidiaries to meet cash obligations and collateral requirements or permit counterparties to terminate certain contracts. In addition, a ratings downgrade could have a negative impact on other funding sources such as secured financing and other margined transactions for which there may be no explicit triggers.

Furthermore, a credit ratings downgrade could have impacts that may not be currently known to Citi or are not possible to quantify. Some of Citi’s counterparties and clients could have ratings limitations on their permissible counterparties, of which Citi may or may not be aware. Certain of Citi’s corporate customers and trading counterparties, among other clients, could re-evaluate their business relationships with Citi and limit the trading of certain market instruments, and limit or withdraw deposits placed with Citi in response to ratings downgrades. Changes in customer and counterparty behavior could impact not only Citi’s funding and liquidity but also the results of operations of certain Citi businesses. For additional information on the potential impact of a reduction in Citi’s or Citibank’s credit ratings, see “Managing Global Risk—Liquidity Risk” below.

COMPLIANCE RISKS

Significantly Heightened Regulatory Expectations and Scrutiny in the U.S. and Globally and Ongoing Interpretation and Implementation of Regulatory and Legislative Requirements and Changes Have Increased Citi’s Compliance, Regulatory and Other Risks and Costs.

Large financial institutions, such as Citi, face significantly heightened regulatory expectations and scrutiny in the U.S. and globally, including with respect to, among other things, governance, infrastructure, data and risk management practices and controls. These regulatory expectations extend to their employees and agents and also include, among other things, those related to customer and client protection, market practices, anti-money laundering, increasingly complex sanctions and disclosure regimes and various regulatory reporting requirements. U.S. financial institutions also face increased expectations and scrutiny in the wake of the failures of several regional banks and other banking stresses in the first half of 2023. In addition, Citi is continually required to interpret and implement extensive and frequently changing regulatory and legislative requirements in the U.S. and other jurisdictions in which it does business, which may overlap or conflict across jurisdictions, resulting in substantial compliance, regulatory and other risks and costs.

A failure to comply with these expectations and requirements, even if inadvertent, or resolve any identified deficiencies in a timely and sufficiently satisfactory manner to regulators, could result in increased regulatory oversight; material restrictions, including, among others, imposition of

additional capital buffers and limitations on capital

distributions; enforcement proceedings; penalties; and fines (see the capital return risk factor above and legal and regulatory proceedings risk factor below).

Over the past several years, Citi has been required to implement a large number of regulatory and legislative changes, including new regulatory or legislative requirements or regimes, across its businesses and functions, and these changes continue. The changes themselves may be complex and subject to interpretation, and result in changes to Citi’s businesses. In addition, the changes require continued substantial technology and other investments. In some cases, Citi’s implementation of a regulatory or legislative requirement is occurring simultaneously with changing or conflicting regulatory guidance from multiple jurisdictions

(including various U.S. states) and regulators, legal challenges or legislative action to modify or repeal existing rules or enact new rules.

Examples of regulatory or legislative changes that have resulted in increased compliance risks and costs include (i) the U.S. regulatory capital framework and requirements, which have continued to evolve (see the capital return risk factor and “Capital Resources” above); (ii) various laws relating to the limitation of cross-border data movement and/or collection and use of customer information, including data localization and protection and privacy laws, which also can conflict with or increase compliance complexity with respect to other laws, including anti-money laundering laws; and (iii) the EU’s Corporate Sustainability Reporting Directive, which may overlap but also diverge from climate-related disclosure requirements expected to come into effect in other jurisdictions, including in the U.S. In addition, certain U.S. regulatory agencies and states and non-U.S. authorities have prioritized issues of social, economic and racial justice, and are in the process of considering ways in which these issues can be mitigated, including through rulemaking, supervision and other means, even while certain U.S. state and other governments are pursuing and signaling challenges that may conflict with corporate ESG initiatives.

Citi Is Subject to Extensive Legal and Regulatory Proceedings, Examinations, Investigations, Consent Orders and Related Compliance Efforts and Other Inquiries That Could Result in Large Monetary Penalties, Supervisory or Enforcement Orders, Business Restrictions, Limitations on

Dividends, Changes to Directors and/or Officers and Collateral Consequences Arising from Such Outcomes.

At any given time, Citi is a party to a significant number of legal and regulatory proceedings and is subject to numerous governmental and regulatory examinations. Additionally, Citi remains subject to governmental and regulatory investigations, consent orders (see discussion below) and related compliance efforts, and other inquiries. Citi could also be subject to enforcement proceedings and negative regulatory evaluation

or examination findings not only because of violations of laws and regulations, but also due to failures, as determined by its regulators, to have adequate policies and procedures, or to remedy deficiencies on a timely basis (see also the capital return and resolution plan risk factors above). Citi’s regulators have broad powers and discretion under their prudential and supervisory authority, and have pursued active inspection and investigatory oversight.

As previously disclosed, the October 2020 FRB and OCC consent orders require Citigroup and Citibank to implement extensive targeted action plans and submit quarterly progress reports on a timely and sufficient basis detailing the results and status of improvements relating principally to various aspects of enterprise-wide risk management, compliance, data quality management and governance, and internal controls. These improvements will result in continued significant investments by Citi during 2024 and beyond, as an essential part of Citi’s broader transformation efforts to enhance its risk, controls, data and finance infrastructure and compliance. There can be no assurance that such improvements will be implemented in a manner satisfactory, in both timing and sufficiency, to the FRB and OCC.

Although there are no restrictions on Citi’s ability to serve its clients, the OCC consent order requires Citibank to obtain prior approval of any significant new acquisition, including any portfolio or business acquisition, excluding ordinary course transactions. Moreover, the OCC consent order provides that the OCC has the right to assess future civil money penalties or take other supervisory and/or enforcement actions. Such actions by the OCC could include imposing business restrictions, including possible limitations on the declaration or payment of dividends and changes in directors and/or senior executive officers. More generally, the OCC and/or the FRB could take additional enforcement or other actions if the regulatory agency believes that Citi has not met regulatory expectations regarding compliance with the consent orders. For additional information regarding the consent orders, see “Citi’s Consent Order Compliance” above.

The global judicial, regulatory and political environment has generally been challenging for large financial institutions, which have been subject to increased regulatory scrutiny. The complexity of the federal and state regulatory and enforcement regimes in the U.S., coupled with the global scope of Citi’s operations, also means that a single event or issue may give rise to a large number of overlapping investigations and regulatory proceedings, either by multiple federal and state agencies and authorities in the U.S. or by multiple regulators and other governmental entities in foreign jurisdictions, as well as multiple civil litigation claims in multiple jurisdictions. Violations of law by other financial institutions may also result in regulatory scrutiny of Citi. Responding to regulatory inquiries and proceedings can be time consuming and costly, and divert management attention from Citi’s businesses.

U.S. and non-U.S. regulators have been increasingly focused on the culture of financial services firms, including Citi, as well as “conduct risk,” a term used to describe the risks associated with behavior by employees and agents, including third parties, that could harm clients, customers, employees or the integrity of the markets, such as improperly creating, selling, marketing or managing products and services or improper incentive compensation programs with respect thereto, failures to safeguard a party’s personal information, or failures to identify and manage conflicts of interest.

In addition to the greater focus on conduct risk, the general heightened scrutiny and expectations from regulators could lead to investigations and other inquiries, as well as remediation requirements, regulatory restrictions, structural changes, more regulatory or other enforcement proceedings, civil litigation and higher compliance and other risks and costs. For additional information, see the capital return and

heightened regulatory scrutiny and ongoing interpretation of

regulatory changes risk factors above. Further, while Citi takes numerous steps to prevent and detect conduct by employees and agents that could potentially harm clients, customers, employees or the integrity of the markets, such behavior may not always be deterred or prevented.

Moreover, the severity of the remedies sought in legal and regulatory proceedings to which Citi is subject has remained elevated. For example, U.S. and certain non-U.S. governmental entities have increasingly brought criminal actions against, or have sought and obtained criminal guilty pleas or deferred prosecution agreements from, financial institutions and individual employees. These types of actions by U.S. and other governments may, in the future, have significant collateral consequences for Citi, including loss of customers and business, operational loss, and the inability to offer certain products or services and/or operate certain businesses. Citi may be required to accept or be subject to similar types of criminal remedies, consent orders, sanctions, substantial fines and penalties, remediation and other financial costs or other requirements in the future, including for matters or practices not yet known to Citi, any of which could materially and negatively affect Citi’s businesses, business practices, financial condition or results of operations, require material changes in Citi’s operations or cause Citi substantial reputational harm.

Additionally, many large claims—both private civil and regulatory—asserted against Citi are highly complex, slow to develop and may involve novel or untested legal theories. The outcome of such proceedings is difficult to predict or estimate until late in the proceedings. Although Citi establishes accruals for its legal and regulatory matters according to accounting requirements, Citi’s estimates of, and changes to, these accruals involve significant judgment and may be subject to significant uncertainty, and the amount of loss ultimately incurred in relation to those matters may be substantially higher than the amounts accrued (see the incorrect assumptions or estimates risk factor above). In addition, certain settlements are subject to court approval and may not be approved. For further information on Citi’s legal and regulatory proceedings, see Note 30.

OTHER RISKS

Citi’s Emerging Markets Presence Subjects It to Various Risks as well as Increased Compliance and Regulatory Risks and Costs.

During 2023, emerging markets revenues accounted for approximately 40% of Citi’s total revenues (Citi generally defines emerging markets as countries in Latin America, Asia (other than Japan, Australia and New Zealand), and central and Eastern Europe, the Middle East and Africa). Citi’s presence in the emerging markets subjects it to various risks.

Emerging market risks include, among others, limitations or unavailability of hedges on foreign investments; foreign currency volatility, including devaluations and strength in the U.S. dollar; sustained elevated interest rates and quantitative tightening; elevated inflation and hyperinflation; foreign exchange controls, including an inability to access indirect foreign exchange mechanisms; macroeconomic, geopolitical and domestic political challenges, uncertainties and volatility, including with respect to Russia (see the macroeconomic and geopolitical risk factor above and “Managing Global Risk—Other Risks—Country Risk—Russia” and “—Ukraine” below); cyberattacks; restrictions arising from retaliatory laws and regulations; sanctions or asset freezes; sovereign debt volatility; fluctuations in commodity prices; election outcomes; regulatory changes, including potential conflicts among regulations with other jurisdictions where Citi does business; limitations on foreign investment; sociopolitical instability; civil unrest; crime, corruption and fraud; nationalization or loss of licenses; potential criminal charges; closure of branches or subsidiaries; and confiscation of assets; and these risks can be exacerbated in the event of a deterioration in the relationship between the U.S. and an emerging market country.

For example, Citi operates in several countries that have, or have had in the past, strict capital controls, currency controls and/or sanctions, such as Argentina and Russia, that limit its ability to convert local currency into U.S. dollars and/or transfer funds outside of those countries. For instance, Citi may need to record additional translation losses due to currency controls in Argentina (see “Managing Global Risk—Other Risks—Country Risk—Argentina” below). Moreover, Citi may need to record additional reserves for expected losses for its credit exposures based on the transfer risk associated with exposures outside the U.S., driven by safety and soundness considerations under U.S. banking law (see “Managing Global Risk—Other Risks—Country Risk—Argentina” and “—Russia” and “Significant Accounting

Policies and Significant Estimates” below).

In addition, political turmoil and instability; geopolitical challenges, tensions and conflicts (including those related to Russia’s war in Ukraine as well as a persistent and/or escalating conflict in the Middle East); terrorism; and other instabilities have occurred in various regions and emerging market countries across the globe, which impact Citi’s businesses, results of operations and financial conditions in affected countries and have required, and may continue to require, management time and attention and other resources, such as managing the impact of sanctions and their effect on Citi’s operations in certain emerging market countries. For additional information, see the macroeconomic challenges and uncertainties risk factor above.

CLIMATE CHANGE AND NET ZERO

Introduction

This section summarizes Citi’s Operational Footprint goals and Net Zero commitment.

Citi’s annual ESG Report provides information on a broad set of ESG-related efforts. The upcoming Citi Climate Report, formerly named the Task Force on Climate-Related Financial Disclosures (TCFD) Report, provides information on Citi’s continued progress to manage climate risk and its Net Zero plan, including information on financed emissions and 2030 interim emissions reduction targets.

For information regarding Citi’s management of climate risk, see “Managing Global Risk—Strategic Risk—Climate Risk” below.

ESG and Climate-Related Governance

Citi’s Board of Directors (Board) provides oversight of Citi’s management activities (see “Managing Global Risk—Risk Governance” below).

•The Nomination, Governance and Public Affairs Committee of the Board provides oversight and receives updates on Citi’s environmental and social policies and commitments.

•The Risk Management Committee of the Board provides oversight of Citi’s Risk Management Framework and risk culture and reviews Citi’s key risk policies and frameworks, including receiving climate risk-related updates.

•The Audit Committee of the Board provides oversight of controls and procedures pertaining to the ESG-related metrics and related disclosures in Citi’s SEC filed reports and group-level voluntary ESG reporting, as well as management’s evaluation of the effectiveness of Citi’s disclosure controls and procedures for group-level ESG reporting.

Additionally, Citi’s ESG Council consists of senior members of the management team and certain subject matter experts who provide oversight of Citi’s ESG goals and activities.

Sustainable Finance

Citi’s Sustainable Finance Goal, as previously disclosed, supports a combination of environmental and social finance activities. Delivering on the sustainable finance goal is an integrated effort across the organization with products and service offerings across multiple lines of business.

Net Zero Emissions by 2050

As previously disclosed, Citi has committed to achieving net zero greenhouse gas (GHG) emissions associated with its financing by 2050, and net zero GHG emissions for its own operations by 2030; both are significant targets given the size and breadth of Citi’s lending portfolios, businesses and operational footprint.

Citi’s Net Zero plan includes:

•Net Zero Metrics and Target Setting: Calculate metrics and assess targets for carbon-intensive sectors

•Client Engagement and Assessment: Seek to understand client GHG emissions and transition plans and advise on capacity building

•Risk Management: Assess climate risk exposure across Citi’s lending portfolios and review client carbon reduction progress, with ongoing review and refining of Citi’s risk appetite and thresholds and policies related to Climate Risk Management

•Clean Technology and Transition Finance: Support existing and, where possible, new technologies to accelerate commercialization and provide transition advisory and finance products and services

•Portfolio Management: Active portfolio management of Citi financings to align with net zero targets, including considerations of transition measures taken by clients

•Public Policy and Regulatory Engagement: Contribute to an enabling public policy and regulatory environment which is essential to stimulating demand for clean technologies and helping ensure a responsible transition

Progress on Citi’s Net Zero plan:

•Citi has published interim 2030 emissions targets for six loan portfolios: auto manufacturing, commercial real estate (North America), energy, power, steel and thermal coal mining.

•Citi has developed a client transition assessment process to help internal teams better understand the alignment of clients’ strategies with transition or decarbonization pathways applicable to their respective sectors. In 2022–2023, Citi completed the initial assessment process for energy and power clients, and in 2023 began the transition assessment process for auto manufacturing and steel clients. The assessment process focuses on clients with material emissions relative to each sector’s baseline emission profiles.

Operational Footprint Goals

Citi measures progress against operational footprint goals, which include efforts to reduce the environmental impact of its facilities through reductions in emissions, energy, water consumption and waste generation. Citi’s efforts to integrate sustainable practices include sustainable building certifications, renewable electricity sourcing, employee engagement and seeking opportunities for efficiency in business travel. In 2023, Citi made progress toward these goals by increasing on-site solar generation, promoting initiatives on waste diversion and recycling, mapping weather- related risk at its facilities and employing carbon-reduction techniques for building renovations.

For additional information on Citi’s environmental and social policies and priorities, click on “Our Impact” on Citi’s website at www.citigroup.com. For information on Citi’s ESG and Sustainability (including climate change) governance, see Citi’s 2024 Annual Meeting Proxy Statement to be filed with the SEC in March 2024.

Citi’s climate reporting and any other ESG-related reports and information included elsewhere on Citi’s website are not incorporated by reference into, and do not form any part of, this 2023 Annual Report on Form 10-K.

HUMAN CAPITAL RESOURCES AND MANAGEMENT

Citi strives to deliver to its full potential by focusing on its strategic priority of attracting and retaining highly qualified and motivated colleagues. Citi seeks to enhance the competitive strength of its workforce through the following efforts:

•Continuously innovating its efforts to recruit, train, develop, compensate, promote and engage colleagues

•Actively seeking and listening to diverse perspectives at all levels of the organization

•Optimizing transparency concerning workforce goals to promote accountability, credibility and effectiveness in achieving those goals

•Providing compensation programs that are competitive in the market and aligned to strategic objectives

In 2023, Citi undertook significant changes to simplify the Company and accelerate the progress it is making in executing its strategy. As previously disclosed, Citi aligned its organizational structure to its business strategy—making the Company more client centric and agile, speeding up decision-making, improving productivity to deliver efficiency and driving increased accountability across the organization. Citi is aligned around five businesses—Services, Markets, Banking, USPB and Wealth—focusing on a streamlined client organization to strengthen how Citi delivers for clients across the Company and around the globe.

Workforce Size and Distribution

As of December 31, 2023, Citi employed approximately 239,000 colleagues in over 90 countries. The Company’s workforce is constantly evolving and developing, benefiting from a strong mix of internal and external hiring into new and existing positions. In 2023, Citi welcomed over 38,000 new colleagues in addition to 44,600 roles filled by colleagues through internal mobility and promotions. Citi also sustains connections with former colleagues through its Alumni Network, and in 2023 hired more than 3,000 “returnees” back to Citi.

The following table presents the geographic distribution of Citi’s colleagues by segment or component and gender:

(1) Colleague distribution is based on assigned region, which may not reflect where the colleague physically resides.

(2) Mexico is included in International.

(3) Part-time colleagues represented less than 0.9% of Citi’s global workforce.

(4) Information regarding gender is self-identified by colleagues.

Driving a Culture of Excellence and Accountability

Citi continues to embark on a talent and culture transformation to drive a culture of excellence and accountability that is supported by strong risk and controls management.

Citi’s Leadership Principles of “taking ownership, delivering with pride and succeeding together” have been reinforced through a behavioral science-led campaign, referred to as Citi’s New Way, that reinforces the key working habits that support Citi’s leadership culture.

Citi’s performance management approach also emphasizes the Leadership Principles through a four-pillar system, evaluating colleagues against financial performance, risk and controls, and client and franchise goals as well as how colleagues deliver from a leadership perspective. The performance management and incentive compensation processes and associated policies and frameworks have enhanced accountability through increased rigor and consistency, in particular for risk and controls.

The culture shift is supported by changes in the way Citi identifies, assesses, develops and promotes talent, particularly at senior levels of the Company. Citi promotes a new class of managing directors each year. This is a testament to these individuals’ performance and commitment to living the Leadership Principles and instilling them throughout their teams and the entire company. Further, all potential successors to Executive Management Team roles are evaluated by the Board and are now subject to a risk and controls assessment.

Diversity, Equity and Inclusion

Citigroup’s Board is committed to ensuring that the Board and Citi’s Executive Management Team are composed of individuals whose backgrounds reflect the diversity of Citi’s employees, customers and other stakeholders. In addition, Citi has continued its efforts to support its globally diverse workforce, including, among other things, taking actions with respect to pay equity, setting aspirational representation goals and the use of diverse slates and hiring panels in recruiting.

Citi’s commitment to diversity, equity and inclusion continues to reflect a workforce that represents the clients it serves globally from all walks of life, backgrounds and origins. Understanding that diversity fuels the Company’s culture and business success, Citi’s 2025 aspirational representation goals are embedded in its business strategy. Having aspirational goals across all levels—from early career through senior leadership roles—will help ensure Citi not only has diverse talent in leadership roles but will also help build a diverse talent pipeline for the future.

The Company constantly strives to ensure Citi remains a great place to work, where people can thrive professionally and personally. In 2023, Citi increased its unique Inclusion Network membership by 23.8% and added 15 new global Inclusion Network chapters. The Company launched the Allyship 365 initiative, focused on cultivating allyship year round and educating colleagues on its diversity, equity and inclusion efforts.

Citi values pay transparency and has taken significant action to provide both managers and colleagues with greater clarity around Citi’s compensation philosophy. Citi has introduced market-based salary structures and bonus opportunity guidelines in various countries worldwide, and posts salary ranges on all external U.S. job postings, which aligns with strategic objectives of pay equity and transparency. Citi also raised its U.S. minimum wage in 2022, the second broad-based increase in less than two years.

In addition, Citi has focused on measuring and addressing pay equity within the organization:

•In 2018, Citi was the first major U.S. financial institution to publicly release the results of a pay equity review comparing its compensation of women to that of men, as well as U.S. minorities to U.S. non-minorities. Since 2018, Citi has continued to be transparent about pay equity, including disclosing its unadjusted or “raw” pay gap for both women and U.S. minorities. The raw gap measures the difference in median compensation. The existence of Citi’s raw pay gap reflects a need to increase representation of women and U.S. minorities in senior and higher-paying roles.

•In 2023, due to its organizational and management simplification initiatives, Citi paused its annual pay equity analysis, as the Company continues the process of aligning roles to its new organizational structure. Citi looks forward to resuming routine pay equity reviews once that work is complete.

•For historical context, Citi’s 2022 pay equity review determined that on an adjusted basis, women globally are paid on average more than 99% of what men are paid at Citi, and that there was not a statistically significant difference in adjusted compensation for U.S. minorities and non-minorities.

•Citi’s 2022 raw pay gap analysis showed that the median pay for women globally was 78% of the median for men, up from 74% in 2021 and 2020. The median pay for U.S. minorities was more than 97% of the median for non- minorities, which was up from just above 96% in 2021 and 94% in 2020.

Workforce Development

Citi’s numerous programmatic offerings aim to reinforce its culture and values, foster understanding of compliance requirements and develop competencies required to deliver excellence to its clients. Citi encourages career growth and development by offering broad and diverse opportunities to colleagues, including the following:

•Citi provides a range of internal development and rotational programs to colleagues at all levels, including an extensive leadership curriculum, allowing the opportunity to build the skills needed to transition to supervisory and managerial roles. Citi’s tuition assistance program further enables colleagues in North America to pursue their educational goals.

•Citi continues to focus on internal talent development and aims to provide colleagues with career growth opportunities. Of the 44,600 mobility opportunities filled in 2023, 14% were open roles applied for and filled by internal candidates, and 38% were filled by colleagues who applied for, and were promoted into, new opportunities. These opportunities are particularly important as Citi focuses on providing career paths for its

internal talent base as part of its efforts to increase organic growth within the organization.

•Citi enabled Development Plans for colleagues of all levels. Last year, more than 100,000 employees completed a plan, setting a roadmap for how they can achieve their career aspirations.

Well-being and Benefits

Citi is proud to provide a wide range of benefits that support its colleagues’ mental, emotional, physical and financial well-being through various life stages and events. Citi is focused on providing equitable benefits that are designed to attract, engage and retain colleagues.

Citi has significantly enhanced mental well-being programs by offering free, accessible counseling sessions for colleagues and their family members, as well as offering an online tool so that all colleagues around the globe can easily find their local Employee Assistance Programs and resources. Citi offers instructor-led mental health training for people managers to equip them in supporting their team members.

Citi also continues to value the importance of physical well-being—providing employees in several office locations and countries access to onsite medical care clinics, fitness centers, subsidized gym memberships and virtual fitness programs. Citi continues to make modern telemedicine programs increasingly available to colleagues and their family members through programs like Sword Health’s digital physical therapy, which rolled out in the U.S. in 2022.

In 2023, one year after the Company became the first major U.S. bank to publicly embrace a flexible, hybrid work model, Citi fully implemented it across the organization. Most of Citi’s colleagues now work in hybrid roles, working remotely up to two days a week. How We Work provides the majority of colleagues with the ability to balance the demands of their home lives with the work commitments that are necessary for success. The program includes three role designations for colleagues globally: Resident, Hybrid or Remote. The implementation and continuation of this program differentiates Citi from other financial organizations with respect to flexible working arrangements. By embracing a flexible model of work, Citi has focused on keeping its approach consistent and aligned with its values and priorities.

For additional information about Citi’s human capital management initiatives and goals, see Citi’s 2022 ESG Report available at www.citigroup.com. The 2022 ESG Report and other information included elsewhere on Citi’s Investor Relations website are not incorporated by reference into, and do not form any part of, this 2023 Annual Report on Form 10- K.

Managing Global Risk Table of Contents

(1) For additional information regarding certain credit risk, market risk and other quantitative and qualitative information, refer to Citi’s Pillar 3 Basel III Advanced Approaches Disclosures, as required by the rules of the Federal Reserve Board, on Citi’s Investor Relations website.

For Citi, effective risk management is of primary importance to its overall operations. Accordingly, Citi has established an Enterprise Risk Management (ERM) Framework to ensure that all of Citi’s risks are managed appropriately and consistently across the Company and at an aggregate, enterprise-wide level. Citi’s culture drives a strong risk and control environment, and is at the heart of the ERM Framework, underpinning the way Citi conducts business. The activities that Citi engages in, and the risks those activities generate, must be consistent with Citi’s Mission and Value Proposition (see below) and the key Leadership Principles that support it, as well as Citi’s risk appetite. As discussed above, Citi also continues its efforts to comply with the FRB and OCC consent orders, relating principally to various aspects of risk management, compliance, data quality management and governance, and internal controls (see “Citi’s Consent Order Compliance” and “Risk Factors—Compliance Risks” above).

Under Citi’s Mission and Value Proposition, which was developed by its senior leadership and distributed throughout the Company, Citi strives to serve its clients as a trusted partner by responsibly providing financial services that enable growth and economic progress while earning and maintaining the public’s trust by constantly adhering to the highest ethical standards. As such, Citi asks all colleagues to ensure that their decisions pass three tests: they are in Citi’s clients’ best interests, create economic value and are always systemically responsible.

As discussed in “Human Capital Resources and Management” above, Citi has designed Leadership Principles that represent the qualities, behaviors and expectations all employees must exhibit to deliver on Citi’s mission of enabling growth and economic progress. The Leadership Principles inform Citi’s ERM Framework and contribute to creating a culture that drives client, control and operational excellence. Citi colleagues share a common responsibility to uphold these Leadership Principles and hold themselves to the highest standards of ethics and professional behavior in dealing with Citi’s clients, business colleagues, shareholders, communities and each other.

Citi’s ERM Framework details the principles used to support effective enterprise-wide risk management across the end-to-end risk management lifecycle. The ERM Framework covers the risk management roles and responsibilities of the Citigroup Board of Directors (the Board), Citi’s Executive Management Team (see “Risk Governance—Executive Management Team” below) and employees across the lines of defense. The underlying pillars of the framework encompass:

•Culture—the core principles and behaviors that underpin a strong culture of risk awareness, in line with Citi’s Mission and Value Proposition, and Leadership Principles;

•Governance—the committee structure and reporting arrangements that support the appropriate oversight of risk management activities at the Board and Executive Management Team levels and establishes Citi’s Lines of Defense model;

•Risk Management—the end-to-end risk management cycle including the identification, measurement, monitoring, controlling and reporting of all risks including top, material, growing, idiosyncratic and emerging risks, and aggregated to an enterprise-wide level; and

•Enterprise Programs—the key risk management programs performed across the risk management lifecycle for all risk categories.

Each of these pillars is underpinned by supporting capabilities covering people, infrastructure and tools that are in place to enable the execution of the ERM Framework.

Citi’s approach to risk management requires that its risk-taking be consistent with its risk appetite. Risk appetite is the aggregate level of risk that Citi is willing to tolerate in order to achieve its strategic objectives and business plan. Risk limits and thresholds represent allocations of Citi’s risk appetite to businesses and risk categories. Concentration risks are controlled through a subset of these limits and thresholds.

Citi’s risks are generally categorized and summarized as follows:

•Credit risk is the risk of loss resulting from the decline in credit quality (or downgrade risk) or failure of a borrower, counterparty, third party or issuer to honor its financial or contractual obligations.

•Liquidity risk is the risk that Citi will not be able to efficiently meet both expected and unexpected current and future cash flow and collateral needs without adversely affecting either daily operations or financial conditions of Citi. Risk may be exacerbated by the inability of the Company to access funding sources or monetize assets and the composition of liability funding and liquid assets.

•Market risk(Trading and Non-Trading): Market risk of trading portfolios is the risk of loss arising from changes in the value of Citi’s assets and liabilities resulting from changes in market variables, such as interest rates, equity and commodity prices, foreign exchange rates or credit spreads. Market risk of non-trading portfolios is the impact of adverse changes in market variables such as interest rates, foreign exchange rates, credit spreads and equity prices on Citi’s net interest income, economic value of equity, or AOCI.

•Operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. It includes legal risk, which is the risk of loss (including litigation costs, settlements and regulatory fines) resulting from Citi’s failure to comply with laws, regulations, prudent ethical standards or contractual obligations in any aspect of Citi’s business, but excludes strategic and reputation risks (see below).

•Compliance risk is the risk to current or projected financial condition and resilience arising from violations of laws, rules or regulations, or from non-conformance with prescribed practices, internal policies and procedures or ethical standards.

•Reputation risk is the risk to current or projected financial conditions and resilience from negative opinion held by stakeholders. This risk may impair Citi’s competitiveness by affecting its ability to establish new relationships or services or continue servicing existing relationships.

•Strategic risk is the risk of a sustained impact (not episodic impact) to Citi’s core strategic objectives as measured by impacts on anticipated earnings, market capitalization or capital, arising from the external factors affecting the Company’s operating environment; as well as the risks associated with defining the strategy and executing the strategy, which are identified, measured and managed as part of the Strategic Risk Framework at the Enterprise Level.

Citi uses a lines of defense model as a key component of its ERM Framework to manage its risks. As discussed below, the lines of defense model brings together risk-taking, risk oversight and risk assurance under one umbrella and provides an avenue for risk accountability of the first line of defense, a construct for effective challenge by the second line of defense (Independent Risk Management and Independent Compliance Risk Management), and empowers independent risk assurance by the third line of defense (Internal Audit). In addition, the lines of defense model includes organizational units tasked with supporting a strong control environment (“enterprise support functions”). The first, second and third lines of defense, along with enterprise support functions, have distinct roles and responsibilities and are empowered to perform relevant risk management processes and responsibilities in order to manage Citi’s risks in a consistent and effective manner.

First Line of Defense: Front Line Units and Front Line Unit Activities

Citi’s first line of defense owns the risks and associated controls inherent in, or arising from, the execution of its business activities and is responsible for identifying, measuring, monitoring, controlling and reporting those risks consistent with Citi’s strategy, Mission and Value Proposition, Leadership Principles and risk appetite.

Front line units are responsible and held accountable for managing the risks associated with their activities within the boundaries set by independent risk management. They are also responsible for designing and implementing effective internal controls and maintaining processes for managing their risk profile, including through risk mitigation, so that it remains consistent with Citi’s established risk appetite.

Front line unit activities are considered part of the first line of defense and are subject to the oversight and challenge of independent risk management.

The first line of defense is composed of Citi’s operating segments (i.e., Services, Markets, Banking, U.S. Personal Banking, Wealth), as well as Client, Legacy Franchises and certain corporate functions (i.e., Chief Operating Office, Enterprise Services and Public Affairs, Finance, Operations and Technology). In addition, the first line of defense includes the front line unit activities of other organizational units. Front line units may also include enterprise support units and/or conduct enterprise support activities—see “Enterprise Support Functions” below.

Second Line of Defense: Independent Risk Management Independent risk management units are independent of the first line of defense. They are responsible for overseeing the risk-taking activities of the first line of defense and challenging the first line of defense in the execution of its risk management responsibilities. They are also responsible for independently identifying, measuring, monitoring, controlling and reporting aggregate risks and for setting standards for the management and oversight of risk. Independent risk management is composed of Independent Risk Management (IRM) and Independent Compliance Risk Management (ICRM), which are led by the Group Chief Risk Officer (CRO) and Group Chief Compliance Officer (CCO) who have unrestricted access to the Board and its Risk Management Committee to facilitate the ability to execute their specific responsibilities pertaining to escalation to the Board.

Independent Risk Management

The IRM organization sets risk and control standards for the first line of defense and actively manages and oversees aggregate credit, market (trading and non-trading), liquidity, strategic, operational and reputation risks across Citi, including risks that span categories, such as concentration risk, country risk and climate risk.

IRM is organized to align to risk categories, legal entities/regions and Company-wide, cross-risk functions or processes. Each of these units reports to a member of the Risk Management Executive Council, who are all direct reports to the Citigroup CRO.

Independent Compliance Risk Management

The ICRM organization actively oversees compliance risk across Citi, sets compliance standards for the first line of defense to manage compliance risk and promotes business conduct and activity that is consistent with Citi’s Mission and Value Proposition and the compliance risk appetite. Citi’s objective is to embed an enterprise-wide compliance risk management framework and culture that identifies, measures, monitors, controls and escalates compliance risk across Citi.

ICRM is aligned by product line, function and geography to provide compliance risk management advice and credible challenge on day-to-day matters and strategic decision-making for key initiatives. ICRM also has program-level Enterprise Compliance units responsible for setting standards and establishing priorities for program-related compliance efforts. The CCO reports to Citi’s General Counsel and ICRM is organizationally part of the Global Legal Affairs & Compliance group. In addition, the CCO has matrix reporting into the CRO and is part of the Risk Management Executive Council.

Third Line of Defense: Internal Audit

Internal Audit is independent of the first line, second line and enterprise support functions. The role of Internal Audit is to provide independent, objective, reliable, valued and timely assurance to the Board, its Audit Committee, Citi senior management and regulators over the effectiveness of governance, risk management and controls that mitigate current and evolving risks and enhance the control culture within Citi. The Citi Chief Auditor manages Internal Audit and reports functionally to the Chair of the Citi Audit Committee and administratively to the Citi Chief Executive Officer. The Citi Chief Auditor has unrestricted access to the Board and the Board Audit Committee to address risks and issues identified through Internal Audit’s activities.

Enterprise Support Functions

Enterprise support functions engage in activities that support safety and soundness across Citi. These functions provide advisory services and/or design, implement, maintain and oversee Company-wide programs that support Citi in maintaining an effective control environment.

Enterprise support functions are composed of Human Resources and Global Legal Affairs and Compliance (exclusive of ICRM, which is part of the second line of defense). Front line units may also include enterprise support units and/or conduct enterprise support activities (e.g., the Controllers Group within Finance).

Enterprise support functions, units and activities are subject to the relevant Company-wide independent oversight processes specific to the risks for which they are accountable (e.g., operational risk, compliance risk, reputation risk).

Risk Governance

Citi’s ERM Framework encompasses risk management processes to address risks undertaken by Citi through identification, measurement, monitoring, controlling and reporting of all risks. The ERM Framework integrates these processes with appropriate governance to complement Citi’s commitment to maintaining strong and consistent risk management practices.

Board Oversight

The Board is responsible for oversight of Citi and holds the Executive Management Team accountable for implementing the ERM Framework and meeting strategic objectives within Citi’s risk appetite.

Executive Management Team

The Citigroup CEO directs and oversees the day-to-day management of Citi as delegated by the Board of Directors. The CEO leads the Company through the Executive Management Team and provides oversight of group activities, both directly and through authority delegated to committees established to oversee the management of risk, to ensure continued alignment with Citi’s risk strategy.

Board and Executive Management Committees

The Board executes its responsibilities either directly or through its committees. The Board has delegated authority to the following Board standing committees to help fulfill its oversight and risk management responsibilities:

•Risk Management Committee (RMC): assists the Board in fulfilling its responsibility with respect to (i) oversight of Citi’s risk management framework and risk culture, including the significant policies and practices used in managing credit, market (trading and non-trading), liquidity, strategic, operational, compliance, reputation and certain other risks, including those pertaining to

capital management, and (ii) oversight of the Global Risk Review—credit, capital and collateral review functions.

•Audit Committee: provides oversight of Citi’s financial and regulatory reporting and internal control risk, as well as Internal Audit and Citi’s external independent accountants.

•Compensation, Performance Management and Culture Committee: provides oversight of compensation of Citi’s employees and Citi management’s sustained focus on fostering a principled culture of sound ethics, responsible conduct and accountability within the organization.

•Nomination, Governance and Public Affairs Committee: responsible for (i) identifying individuals qualified to become Board members and recommending to the Board the director nominees for the next annual meeting of stockholders, (ii) leading the Board in its annual review of the Board’s performance, (iii) recommending to the Board directors for each committee for appointment by the Board, (iv) reviewing the Company’s policies and programs that relate to public issues of significance to the Company and the public at large, including but not limited to Environmental, Social and Corporate Governance (ESG) matters and (v) reviewing the Company’s relationships with external constituencies and issues that impact the Company’s reputation, and advising management as to its approach to each.

•Technology Committee: assists the Board in fulfilling its responsibility with respect to oversight of (i) the planning and execution of Citigroup’s technology, strategy and operating plan, (ii) the development of Citi’s target state operating model and architecture, including the incorporation of Global Business Services, (iii) technology-based risk management, including risk management framework, risk appetite and risk exposures of the Company, (iv) resource and talent planning of the Technology function and (v) the Company’s third-party management policies, practices and standards that relate to Technology.

In addition to the above, the Board has established the following ad hoc committee:

•Transformation Oversight Committee: provides oversight of the actions of Citi’s management to develop and execute a transformation of Citi’s risk and control environment pursuant to the FRB and OCC consent orders (see “Citi’s Consent Order Compliance” above).

The Citigroup CEO has established four standing committees that cover the primary risks to which Citi (i.e., Group) is exposed. These consist of:

•Group Risk Management Committee (GRMC): the primary senior executive level committee responsible for (i) overseeing the execution of Citigroup’s ERM Framework, (ii) monitoring Citi’s risk profile at an aggregate level inclusive of individual risk categories, (iii) ensuring that Citi’s risk profile remains consistent with its approved risk appetite and (iv) discussing material and emerging risk issues facing the Company. The Committee also provides comprehensive Group-wide coverage of all risk categories, including Credit Risk, Market Risk (trading) and Strategic Risk.

•Citigroup Asset and Liability Committee (ALCO): responsible for governance over management’s Liquidity Risk and Market Risk (non-trading) management and for monitoring and influencing the balance sheet, investment securities and capital management activities of Citigroup.

•Group Business Risk and Control Committee (GBRCC): provides governance oversight of Citi’s Compliance and Operational Risks.

•Group Reputation Risk Committee (GRRC): provides governance oversight for Reputation Risk management across Citi.

In addition to the Executive Management committees listed above, management may establish ad-hoc committees in response to regulatory feedback or to manage additional activities when deemed necessary.

The figure below illustrates the reporting lines between the Board and Executive Management committees:

CREDIT RISK

Credit risk is the risk of loss resulting from the decline in credit quality of a client, customer or counterparty (or downgrade risk) or the failure of a borrower, counterparty, third party or issuer to honor its financial or contractual obligations. Credit risk is one of the most significant risks Citi faces as an institution (see “Risk Factors—Credit Risks” above). Credit risk arises in many of Citigroup’s business activities, including:

•consumer, commercial and corporate lending;

•capital markets derivative transactions;

•structured finance; and

•securities financing transactions (repurchase and reverse repurchase agreements, and securities loaned and borrowed).

Credit risk also arises from clearing and settlement activities, when Citi transfers an asset in advance of receiving its counter-value or advances funds to settle a transaction on behalf of a client. Concentration risk, within credit risk, is the risk associated with having credit exposure concentrated within a specific client, industry, region or other category.

Citi has an established framework in place for managing credit risk across all businesses that includes a defined risk appetite, credit limits and credit policies. Citi’s credit risk management framework also includes policies and procedures to manage problem exposures.

To manage concentration risk, Citi has in place a framework consisting of industry limits, single-name concentrations for each business and across Citigroup and a specialized product limit framework.

Credit exposures are generally reported in notional terms for accrual loans, reflecting the value at which the loans as well as other off-balance sheet commitments are carried on the Consolidated Balance Sheet. Credit exposure arising from capital markets activities is generally expressed as the current mark-to-market, net of margin, reflecting the net value owed to Citi by a given counterparty.

The credit risk associated with Citi’s credit exposures is a function of the idiosyncratic creditworthiness of the obligor, as well as the terms and conditions of the specific obligation. Citi assesses the credit risk associated with its credit exposures on a regular basis through its allowance for credit losses (ACL) process (see “Significant Accounting Policies and Significant Estimates—Allowance for Credit Losses” below and Notes 1 and 16), as well as through regular stress testing at the company, business, geography and product levels. These stress-testing processes typically estimate potential incremental credit costs that would occur as a result of either downgrades in the credit quality or defaults of the obligors or counterparties. See Note 15 for additional information on Citi’s credit risk management.

Loans

The table below details the average loans, by business and/or segment, and the total Citigroup end-of-period loans for each of the periods indicated:

(1)See footnote 2 to the table in “Credit Risk—Consumer Credit—Consumer Credit Portfolio” below.

End-of-period loans increased 5% year-over-year, largely reflecting growth in cards in USPB. End-of-period loans increased 3% sequentially.

On an average basis, loans increased 3% year-over-year and 2% sequentially. The year-over-year increase was largely due to growth in USPB, Services and Markets, partially offset by a decline in Banking.

As of the fourth quarter of 2023, average loans for:

•USPB increased 12% year-over-year, driven by growth in Branded Cards, Retail Banking and Retail Services.

•Wealth were largely unchanged.

•Services increased 6% year-over-year, primarily driven by strong demand for working capital loans in TTS in North America and internationally.

•Markets increased 4% year-over-year, reflecting increased client demand in warehouse lending.

•Banking decreased 9% year-over-year, primarily driven by capital optimization efforts.

CORPORATE CREDIT

Consistent with its overall strategy, Citi’s corporate clients are typically corporations that value the depth and breadth of Citi’s global network. Citi aims to establish relationships with these clients whose needs encompass multiple products, including cash management and trade services, foreign exchange, lending, capital markets and M&A advisory.

Corporate Credit Portfolio

The following table details Citi’s corporate credit portfolio within Services, Markets, Bankingand the Mexico SBMM component of All Other—Legacy Franchises (excluding loans carried at fair value and loans held-for-sale), and before consideration of collateral or hedges, by remaining tenor for the periods indicated:

(1) Includes drawn loans, overdrafts, bankers’ acceptances and leases.

(2) Includes unused commitments to lend, letters of credit and financial guarantees.

Portfolio Mix—Geography and Counterparty

Citi’s corporate credit portfolio is diverse across geography and counterparty. The following table presents the percentage of this portfolio by region based on Citi’s internal management geography:

The maintenance of accurate and consistent risk ratings across the corporate credit portfolio facilitates the comparison of credit exposure across all lines of business, geographic regions and products. Counterparty risk ratings reflect an estimated probability of default for a counterparty, and internal risk ratings are derived by leveraging validated statistical models and scorecards in combination with consideration of factors specific to the obligor or market, such as management experience, competitive position, regulatory environment and commodity prices. Facility risk ratings are assigned that reflect the probability of default of the obligor and factors that affect the loss given default of the facility, such as support or collateral. Internal obligor ratings that generally correspond to BBB and above are considered investment grade, while those below are considered non-investment grade.

The following table presents the corporate credit portfolio by facility risk rating as a percentage of the total corporate credit portfolio:

Note: Total exposure includes direct outstandings and unfunded lending commitments.

In addition to the obligor and facility risk ratings assigned to all exposures, Citi may classify exposures in the corporate credit portfolio. These classifications are consistent with Citi’s interpretation of the U.S. banking regulators’ definition of criticized exposures, which may categorize exposures as special mention, substandard, doubtful or loss.

Risk ratings and classifications are reviewed regularly and adjusted as appropriate. The credit review process incorporates quantitative and qualitative factors, including financial and non-financial disclosures or metrics, idiosyncratic events or changes to the competitive, regulatory or macroeconomic environment.

Citi believes the corporate credit portfolio to be appropriately rated and classified as of December 31, 2023. Citi has taken action to adjust internal ratings and classifications of exposures as both the macroeconomic environment and obligor-specific factors have changed, particularly where additional stress has been seen.

As obligor risk ratings are downgraded, the probability of default increases. Downgrades of obligor risk ratings tend to result in a higher provision for credit losses. In addition, appetite per obligor is reduced consistent with the ratings, and downgrades may result in the purchase of additional credit derivatives or other risk/structural mitigants to hedge the incremental credit risk, or may result in Citi’s seeking to reduce exposure to an obligor or an industry sector. Citi will continue to review exposures to ensure that the appropriate probability of default is incorporated into all risk assessments.

See Note 15 for additional information on Citi’s corporate credit portfolio.

Portfolio Mix—Industry

Citi’s corporate credit portfolio is diversified by industry. The following table details the allocation of Citi’s total corporate credit portfolio by industry:

(1) As of the periods in the table, Citi had less than 1% exposure to securities firms. See corporate credit portfolio by industry, below.

The following table details Citi’s corporate credit portfolio by industry as of December 31, 2023:

(1) Funded excludes loans carried at fair value of $7.3 billion at December 31, 2023.

(2) Includes non-accrual loan exposures and related criticized unfunded exposures.

(3) Represents the amount of purchased credit protection in the form of derivatives to economically hedge funded and unfunded exposures. Of the $35.9 billion of purchased credit protection, $33.7 billion represents the total notional amount of purchased credit derivatives on individual reference entities. The remaining $2.2 billion represents the first loss tranche of portfolios of purchased credit derivatives with a total notional of $16.7 billion, where the protection seller absorbs the first loss on the referenced loan portfolios.

(4) Autos total credit exposure includes securitization financing facilities secured by auto loans and leases, extended mainly to the finance company subsidiaries of global auto manufacturers, bank subsidiaries and independent auto finance companies, of approximately $16.9 billion ($10.6 billion in funded, with 100% rated investment grade) as of December 31, 2023.

(5) In addition to this exposure, Citi has energy-related exposure within the public sector (e.g., energy-related state-owned entities) and the transportation and industrials sector (e.g., off-shore drilling entities) included in the table above. As of December 31, 2023, Citi’s total exposure to these energy-related entities was approximately $4.9 billion, of which approximately $2.5 billion consisted of direct outstanding funded loans.

(6) Includes $0.6 billion and $0.1 billion of funded and unfunded exposure at December 31, 2023, respectively, primarily related to commercial credit card delinquency-managed loans.

Exposure to Commercial Real Estate

As of December 31, 2023, Citi’s total credit exposure to commercial real estate (CRE) was $66 billion, including $8 billion of exposure related to office buildings. This total CRE exposure consisted of approximately $55 billion related to corporate clients, included in the real estate category in the table above, and approximately $11 billion related to Wealth clients that is not in the table above as they are not considered corporate exposures.

In addition, as of December 31, 2023, approximately 80% of Citi’s total CRE exposure was rated investment grade and more than 77% was to borrowers in the U.S.

As of December 31, 2023, the ACLL attributed to the total funded CRE exposure (including the Private Bank) was approximately 1.49%, and there were $759 million of non-accrual CRE loans.

The following table details Citi’s corporate credit portfolio by industry as of December 31, 2022:

(1) Funded excludes loans carried at fair value of $5.1 billionat December 31, 2022.

(2) Includes non-accrual loan exposures and related criticized unfunded exposures.

(3) Represents the amount of purchased credit protection in the form of derivatives to economically hedge funded and unfunded exposures. Of the $39.8 billion of purchased credit protection, $36.6 billion represents the total notional amount of purchased credit derivatives on individual reference entities. The remaining $3.2 billion represents the first loss tranche of portfolios of purchased credit derivatives with a total notional of $27.6 billion, where the protection seller absorbs the first loss on the referenced loan portfolios.

(4) Autos total credit exposure includes securitization financing facilities secured by auto loans and leases, extended mainly to the finance company subsidiaries of global auto manufacturers, bank subsidiaries and independent auto finance companies, of approximately $17.4 billion ($10.3 billion in funded, with more than 99% rated investment grade) at December 31, 2022.

(5) In addition to this exposure, Citi has energy-related exposure within the public sector (e.g., energy-related state-owned entities) and the transportation and industrials sector (e.g., off-shore drilling entities) included in the table above. As of December 31, 2022, Citi’s total exposure to these energy-related entities was approximately $4.7 billion, of which approximately $2.4 billion consisted of direct outstanding funded loans.

(6) Includes $0.6 billion and $0.1 billion of funded and unfunded exposure at December 31, 2022, respectively, primarily related to commercial credit card delinquency-managed loans.

Credit Risk Mitigation

As part of its overall risk management activities, Citigroup uses credit derivatives, both partial and full term, and other risk mitigants to economically hedge portions of the credit risk in its corporate credit portfolio, in addition to outright asset sales. In advance of the expiration of partial-term economic hedges, Citi will determine, among other factors, the economic feasibility of hedging the remaining life of the instrument. The results of the mark-to-market and any realized gains or losses on credit derivatives are reflected primarily in Principal transactions in the Consolidated Statement of Income.

At December 31, 2023, September 30, 2023 and December 31, 2022, Banking had economic hedges on the corporate credit portfolio of $35.9 billion, $36.0 billion and $39.8 billion, respectively. Citi’s expected credit loss model used in the calculation of its ACL does not include the favorable impact of credit derivatives and other mitigants that are marked-to-market. In addition, the reported amounts of direct outstandings and unfunded lending commitments in the tables above do not reflect the impact of these hedging transactions. The credit protection was economically hedging underlying Banking corporate credit portfolio exposures with the following risk rating distribution:

Rating of Hedged Exposure

Loan Maturities and Fixed/Variable Pricing of Corporate Loans

(1) North America includes the U.S., Canada and Puerto Rico. Mexico is included in offices outside North America. The classification between offices in North America and outside North America is based on the domicile of the booking unit. The differences between the domicile of the booking unit and the domicile of the managing unit are not material.

(2) Loans secured primarily by real estate.

(3) Corporate loans are net of unearned income of ($917) million. Unearned income on corporate loans primarily represents loan origination fees, net of certain direct origination costs, that are deferred and recognized as Interest income over the lives of the related loans.

(4) Excludes $93 million of unallocated portfolio layer cumulative basis adjustments at December 31, 2023.

(5) Based on contractual terms. Repricing characteristics may effectively be modified from time to time using derivative contracts. See Note 24.

(6) Other includes installment and other and loans to government and official institutions.

CONSUMER CREDIT

Citi's consumer credit risk management framework is designed for a variety of environments. Underwriting and portfolio management policies are calibrated based on risk-return trade-offs by product and segment and changes are made based on performance against benchmarks as well as environmental stress. As warranted, Citi adjusts underwriting criteria to address consumer credit risks and macroeconomic challenges and uncertainties.

USPB provides credit cards, mortgages, personal loans, small business banking and retail banking, and Wealth offers wealth management lending and other products globally that range from the affluent to ultra-high net worth customer segments through the Private Bank, Wealth at Work and Citigold. USPB’s retail banking products include a generally prime portfolio built through well-defined lending parameters within Citi’s risk appetite framework.

All Other—Legacy Franchises also provides such products in its remaining markets through Mexico Consumer and Asia Consumer (Korea, Poland, China and Russia).

Consumer Credit Portfolio

The following table presents Citi’s quarterly end-of-period consumer loans(1):

(1)End-of-period loans include interest and fees on credit cards.

(2)See Note 15 for details on loan-to-value ratios for the portfolios and FICO scores for the U.S. portfolio.

(3)Consists of $101.6 billion, $101.1 billion, $99.5 billion, $98.9 billion and $98.2 billion of loans in North America as of December 31, 2023, September 30, 2023, June 30, 2023, March 31, 2023 and December 31, 2022, respectively. For additional information on the credit quality of the Wealth portfolio, see Note 15.

(4)Consists of $49.9 billion, $49.5 billion, $51.0 billion, $51.0 billion and $51.0 billion of loans outside North America as of December 31, 2023, September 30, 2023, June 30, 2023, March 31, 2023 and December 31, 2022, respectively.

(5)At December 31, 2023, includes approximately $24 billion of classifiably managed loans fully collateralized by eligible financial assets and securities that have experienced very low historical net credit losses (NCLs). Approximately 85% of the classifiably managed portion of these loans are investment grade.

(6)At December 31, 2023, includes approximately $22 billion of classifiably managed loans. Approximately 87% of these loans are fully collateralized (consisting primarily of commercial real estate and limited partner capital commitments in private equity) and have experienced very low historical net credit losses (NCLs). Approximately 85% of the classifiably managed portion of these loans are investment grade.

(7)Asia Consumer loan balances, reported within All Other—Legacy Franchises, include the four remaining Asia Consumer loan portfolios: Korea, Poland, China and Russia.

(8)Primarily consists of certain North America consumer mortgages.

For information on changes to Citi’s consumer loans, see “Credit Risk—Loans” above.

Consumer Credit Trends

U.S. Personal Banking

As indicated above, USPB provides card products through Branded Cards and Retail Services, and mortgages and home equity, small business and personal consumer loans through Citi’s Retail Banking network. Retail Banking is concentrated in six major U.S. metropolitan areas. USPB also provides mortgages through correspondent channels.

As of December 31, 2023, approximately 79% of USPB EOP loans consisted of Branded Cards and Retail Services card loans, which generally drives the overall credit performance of USPB, as U.S. cards net credit losses represented approximately 96% of total USPB net credit losses for the fourth quarter of 2023. As of December 31, 2023, Branded Cards represented 67% of total U.S. cards EOP loans and Retail Services represented 33% of U.S. cards EOP loans.

As presented in the chart above, the fourth quarter of 2023 net credit loss rate and 90+ days past due delinquency rate in USPB increased quarter-over-quarter and year-over-year, largely driven by a continued increase in net flow rates, primarily reflecting normalization to pre-pandemic levels in Branded Cards and Retail Services as well as the impact of macroeconomic pressures related to the higher inflationary and interest rate environment. Citi expects the net credit loss rate for both Branded Cards and Retail Services to continue to rise above pre-pandemic levels and, on a full-year basis, peak in 2024. The higher net credit losses expectation is already reflected in the Company’s ACL on loans for outstanding balances at December 31, 2023.

Branded Cards

USPB’s Branded Cards portfolio includes proprietary and co-branded cards.

As presented in the chart above, the fourth quarter of 2023 net credit loss rate and 90+ days past due delinquency rate in Branded Cards increased quarter-over-quarter and year-over-year, largely driven by a continued increase in net flow rates, primarily reflecting normalization to pre-pandemic levels as well as the impact of macroeconomic pressures related to the higher inflationary and interest rate environment.

Retail Services

USPB’s Retail Services partners directly with more than 20 retailers and dealers to offer private label and co-branded cards. Retail Services’ target market focuses on select industry segments such as home improvement, specialty retail, consumer electronics and fuel. Retail Services continually evaluates opportunities to add partners within target industries that have strong loyalty, lending or payment programs and growth potential.

As presented in the chart above, the fourth quarter of 2023 net credit loss rate and 90+ days past due delinquency rate in Retail Services increased quarter-over-quarter and year-over-year, largely driven by a continued increase in net flow rates, primarily reflecting normalization to pre-pandemic levels as well as the impact of macroeconomic pressures related to the higher inflationary and interest rate environment.

For additional information on cost of credit, loan delinquency and other information for Citi’s cards portfolios, see each respective business’s results of operations above and Note 15.

Retail Banking

USPB’s Retail Banking portfolio consists primarily of consumer mortgages (including home equity) and unsecured lending products, such as small business loans and personal loans. The portfolio is generally delinquency managed, where Citi evaluates credit risk based on FICO scores, delinquencies and the value of underlying collateral. The consumer mortgages in this portfolio have historically been extended to high credit quality customers, generally with loan-to-value ratios that are less than or equal to 80% on first and second mortgages. For additional information, see “Loan-to-Value (LTV) Ratios” in Note 15.

As presented in the chart above, the net credit loss rate in Retail Banking for the fourth quarter of 2023 was broadly stable quarter-over-quarter and increased year-over-year, primarily driven by the growth and seasoning of personal loans.

The 90+ days past due delinquency rate was broadly stable quarter-over-quarter and decreased year-over-year, primarily driven by lower delinquencies in U.S. mortgages.

Wealth

As indicated above, Wealth provides consumer mortgages, margin lending, cards and other lending products to customer segments that range from affluent to ultra-high net worth through the Private Bank, Wealth at Work and Citigold. These customer segments represent a target market that is characterized by historically low default rates and delinquencies and includes loans that are delinquency managed or classifiably managed. The delinquency-managed portfolio consists primarily of mortgages, margin lending and cards.

As of December 31, 2023, approximately $46 billion, or 30%, of the portfolio was classifiably managed and primarily consisted of margin lending, commercial real estate, subscription credit finance and other lending programs. These classifiably managed loans are primarily evaluated for credit

risk based on their internal risk rating, of which 85% is rated investment grade. While the delinquency rate in the chart above is calculated only for the delinquency-managed portfolio, the net credit loss rate is calculated using net credit losses for both the delinquency and classifiably managed portfolios.

As presented in the chart above, the net credit loss rate and 90+ days past due delinquency rate in Wealth for the fourth quarter of 2023 were broadly stable quarter-over-quarter and year-over-year. The low net credit loss and the 90+ days past due delinquency rates continued to reflect the strong credit profiles of the portfolios.

Mexico Consumer

Mexico Consumer operates in Mexico through Citibanamex and provides credit cards, consumer mortgages and small business and personal loans. Mexico Consumer serves a more mass-market segment in Mexico and focuses on developing multiproduct relationships with customers.

As presented in the chart above, the fourth quarter of 2023 net credit loss rate in Mexico Consumer increased quarter-over-quarter and year-over-year, primarily driven by the ongoing normalization of loss rates from post-pandemic lows.

The 90+ days past due delinquency rate was relatively stable quarter-over-quarter and year-over-year.

For additional information on cost of credit, loan delinquency and other information for Citi’s consumer loan portfolios, see each respective business’s results of operations above and Note 15.

U.S. Cards FICO Distribution

The following tables present the current FICO score distributions for Citi’s Branded Cards and Retail Services portfolios based on end-of-period receivables. FICO scores are updated monthly for substantially all of the portfolio and on a quarterly basis for the remaining portfolio.

Branded Cards

Retail Services

(1)The FICO bands in the tables are consistent with general industry peer presentations.

The FICO distribution of both card portfolios declined slightly during 2023, primarily reflecting the normalization in net credit loss and delinquency rates. The FICO distribution continued to reflect strong underlying credit quality of the portfolios. See Note 15 for additional information on FICO scores.

Additional Consumer Credit Details

Consumer Loan Delinquencies Amounts and Ratios

(1)End-of-period (EOP) loans include interest and fees on credit cards.

(2)The ratios of 90+ days past due and 30–89 days past due are calculated based on EOP loans, net of unearned income.

(3)The 90+ days past due and 30–89 days past due and related ratios for Retail Banking exclude loans guaranteed by U.S. government-sponsored agencies since the potential risk of loss predominantly resides with the U.S. government-sponsored agencies. The amounts excluded for loans 90+ days past due and (EOP loans) were $63 million ($0.5 billion), $89 million ($0.6 billion) and $185 million ($1.1 billion) at December 31, 2023, 2022 and 2021, respectively. The amounts excluded for loans 30–89 days past due (the 30–89 days past due EOP loans have the same adjustments as the 90+ days past due EOP loans) were $73 million, $70 million and $74 million at December 31, 2023, 2022 and 2021, respectively. The EOP loans in the table include the guaranteed loans.

(4)The 90+ days past due balances for Branded Cards and Retail Services are generally still accruing interest. Citi’s policy is generally to accrue interest on credit card loans until 180 days past due, unless notification of bankruptcy filing has been received earlier.

(5)Excludes EOP classifiably managed Private Bank loans. These loans are not included in the delinquency numerator, denominator and ratios.

(6)These loans are evaluated for non-accrual status and write-off primarily based on their internal risk classification and not solely on their delinquency status, and therefore delinquency metrics are excluded from this table. As of December 31, 2023, 2022 and 2021, 85%, 96% and 94% of Wealth classifiably managed loans were rated investment grade. For additional information on the credit quality of the Wealth portfolio, including classifiably managed portfolios, see “Consumer Credit Trends” above.

(7)Asia Consumer includes delinquencies and loans in Poland and Russia for all periods presented and in Bahrain for 2021 only.

(8)Citi has entered into agreements to sell certain Asia Consumer banking businesses. Accordingly, the loans of these businesses have been reclassified as HFS in Other assets on the Consolidated Balance Sheet, and hence the loans and related delinquencies and ratios are not included in this table. The reclassifications commenced as follows: Bahrain, India, Indonesia, Malaysia, Taiwan, Thailand and Vietnam in 1Q22 (Bahrain, Malaysia and Thailand closed in 4Q22; India and Vietnam closed in 1Q23; Taiwan closed in 3Q23; and Indonesia closed in 4Q23); Australia in 3Q21 (closed in 2Q22); and the Philippines in 4Q21 (closed in 3Q22). In addition, a portfolio was reclassified to HFS in the first quarter of 2023 and subsequently sold in the second quarter of 2023. See Note 2.

(9)The 90+ days past due and 30–89 days past due and related ratios exclude U.S. mortgage loans that are primarily related to U.S. mortgages guaranteed by U.S. government-sponsored agencies since the potential risk of loss predominantly resides with the U.S. agencies. The amounts excluded for 90+ days past due and (EOP loans) were $67 million ($0.2 billion), $90 million ($0.3 billion) and $138 million ($0.4 billion) at December 31, 2023, 2022 and 2021, respectively. The amounts excluded for loans 30–89 days past due (the 30–89 days past due EOP loans have the same adjustments as the 90+ days past due EOP loans) were $36 million, $37 million and $35 million at December 31, 2023, 2022 and 2021, respectively. The EOP loans in the table include the guaranteed loans.

Consumer Loan Net Credit Losses and Ratios

(1)Average loans include interest and fees on credit cards.

(2)The ratios of net credit losses are calculated based on average loans, net of unearned income.

(3)All Other (managed basis) excludes divestiture-related impacts (Reconciling Items) related to (i) Citi’s divestitures of its Asia Consumer businesses and (ii) the

planned divestiture of Mexico consumer banking and small business and middle-market banking within Legacy Franchises. The Reconciling Items are fully reflected in the various line items in Citi’s Consolidated Statement of Income. See “All Other—Divestiture-Related Impacts (Reconciling Items)” below.

(4)Asia Consumer also includes NCLs and average loans in Poland and Russia for all periods presented and in Bahrain for 2021 only.

(5)Approximately $25 million, $155 million and $6 million in NCLs relating to certain Asia Consumer businesses classified as held-for-sale in Other assets and Other liabilities on the Consolidated Balance Sheet were recorded as a reduction in revenue (Other revenue) in 2023, 2022 and 2021, respectively. Accordingly, these NCLs are not included in this table. See footnote 3 to this table.

Loan Maturities and Fixed/Variable Pricing of Consumer Loans

Loan Maturities

(1)Credit card loans with maturities greater than one year represent loan modifications to borrowers experiencing financial difficulty and are at fixed interest rates.

Fixed/Variable Pricing

(1)Credit card loans with maturities greater than one year represent loan modifications to borrowers experiencing financial difficulty and are at fixed interest rates.

ADDITIONAL CONSUMER AND CORPORATE CREDIT DETAILS

Loans Outstanding

(1) North America includes the U.S., Canada and Puerto Rico. Mexico is included in offices outside North America. The classification of corporate loans between offices in North America and outside North America is based on the domicile of the booking unit. The difference between the domicile of the booking unit and the domicile of the managing unit is not material.

(2) Loans secured primarily by real estate.

(3) Consumer loans are net of unearned income of $802 million, $712 million, $629 million, $692 million and $732 million at December 31, 2023, 2022, 2021, 2020 and 2019, respectively. Unearned income on consumer loans primarily represents loan origination fees, net of certain direct origination costs, that are deferred and recognized as Interest income over the lives of the related loans.

(4) Corporate loans include Mexico SBMM loans and are net of unearned income of $(917) million, $(797) million, $(770) million, $(787) million and $(763) million at December 31, 2023, 2022, 2021, 2020 and 2019, respectively. Unearned income on corporate loans primarily represents loan origination fees, net of certain direct origination costs, that are deferred and recognized as Interest income over the lives of the related loans.

(5) Because loans carried at fair value do not have an ACLL, they are excluded from the ACLL ratio calculation.

Details of Credit Loss Experience

(1)On January 1, 2023, Citi adopted Accounting Standards Update (ASU) 2022-02, Financial Instruments—Credit Losses (Topic 326): TDRs and Vintage Disclosures. The ASU eliminated the accounting and disclosure requirements for TDRs, including the requirement to measure the ACLL for TDRs using a discounted cash flow (DCF) approach. On January 1, 2023, Citi recorded a $352 million decrease in the Allowance for loan losses, along with a $290 million after-tax increase to Retained earnings. See Note 1.

(2)On January 1, 2020, Citi adopted Accounting Standards Codification (ASC) 326, Financial Instruments—Credit Losses (CECL). The ASC introduces a new credit loss methodology requiring earlier recognition of credit losses while also providing additional disclosure about credit risk. On January 1, 2020, Citi recorded a $4.1 billion, or an approximate 29%, pretax increase in the Allowance for credit losses, along with a $3.1 billion after-tax decrease in Retained earnings and a deferred tax asset increase of $1.0 billion. This transition impact reflects (i) a $4.9 billion build to the consumer ACL due to longer estimated tenors than under the incurred loss methodology under prior U.S. GAAP, net of recoveries, and (ii) a $0.8 billion decrease to the corporate ACL due to shorter remaining tenors, incorporation of recoveries and use of more specific historical loss data based on an increase in portfolio segmentation across industries and geographies.

(3)Citi had a change in accounting related to its variable post-charge-off third-party collection costs that was recorded as an adjustment to its January 1, 2020 opening allowance for credit losses on loans of $443 million.

(4)Includes all adjustments to the allowance for credit losses, such as changes in the allowance from acquisitions, dispositions, securitizations, FX translation, purchase accounting adjustments, etc.

(5)2023 includes an approximate $175 million increase related to FX translation.

(6)2022 includes an approximate $350 million reclass related to the announced sales of Citi’s consumer banking businesses in Thailand, India, Malaysia, Taiwan, Indonesia, Bahrain and Vietnam. Also includes a decrease of approximately $100 million related to FX translation.

(7)2021 includes an approximate $280 million reclass related to Citi’s agreement to sell its Australia consumer banking business and an approximate $90 million reclass related to Citi’s agreement to sell its Philippines consumer banking business. Those ACLL were reclassified to Other assets during 2021. 2021 also includes a decrease of approximately $134 million related to FX translation.

(8)2020 includes reductions of approximately $4 million related to the transfer to HFS of various real estate loan portfolios. In addition, 2020 includes an increase of approximately $97 million related to FX translation.

(9)2019 includes reductions of approximately $42 million related to the sale or transfer to HFS of various loan portfolios. In addition, 2019 includes a reduction of approximately $60 million related to FX translation.

(10)December 31, 2023, 2022, 2021, 2020 and 2019 exclude $7.6 billion, $5.4 billion, $6.1 billion, $6.9 billion and $4.1 billion, respectively, of loans that are carried at fair value.

(11)Represents additional credit reserves recorded as Other liabilities on the Consolidated Balance Sheet.

(12)2020 corporate ACLUC includes a non-provision transfer of $68 million, representing reserves on performance guarantees. The reserves on these contracts were reclassified out of the ACL on unfunded lending commitments and into Other liabilities.

(13)Beginning in 2020, under CECL, the ACLL represents management’s estimate of expected credit losses in the portfolio and troubled debt restructurings. See “Significant Accounting Policies and Significant Estimates.” Attribution of the ACLL is made for analytical purposes only and the entire ACLL is available to absorb credit losses in the overall portfolio. Prior to 2020, the ACLL represented management’s estimate of probable losses inherent in the portfolio, as well as probable losses related to large individually evaluated impaired loans and TDRs.

Allowance for Credit Losses on Loans (ACLL)

The following tables detail information on Citi’s ACLL, loans and coverage ratios:

(1)Excludes loans carried at fair value, since they do not have an ACLL and are excluded from the ACLL ratio calculation.

(2)Includes both Branded Cards and Retail Services. As of December 31, 2023, the $12.6 billion of ACLL represented approximately 25 months of coincident net credit loss coverage (based on 4Q23 NCLs). As of December 31, 2023, Branded Cards ACLL as a percentage of EOP loans was 6.0% and Retail Services ACLL as a percentage of EOP loans was 11.1%. As of December 31, 2022, the $11.4 billion of ACLL represented approximately 43 months of coincident net credit loss coverage (based on 4Q22 NCLs). The decrease in the coincident coverage ratio at December 31, 2023 was primarily due to the higher levels of NCLs in 4Q23 versus 4Q22. As of December 31, 2022, Branded Cards ACLL as a percentage of EOP loans was 6.2% and Retail Services ACLL as a percentage of EOP loans was 10.3%.

(3)Includes residential mortgages, retail loans and personal, small business and other loans, including those extended through the Private Bank network.

The following table details Citi’s corporate credit ACLL by industry exposure:

(1) Funded exposure excludes loans carried at fair value of $7.3 billion that are not subject to ACLL under the CECL standard.

(2) As of December 31, 2023, the portion of the ACLL attributed to the total funded CRE exposure (including the Private Bank) was approximately 1.49%.

(3) Includes $0.6 billion of funded exposure at December 31, 2023, primarily related to commercial credit card delinquency-managed loans.

(4) As of December 31, 2023, the ACLL above reflects coverage of 0.3% of funded investment-grade exposure and 2.9% of funded non-investment-grade

exposure.

The following table details Citi’s corporate credit ACLL by industry exposure:

(1) Funded exposure excludes loans carried at fair value of $5.1 billion that are not subject to ACLL under the CECL standard.

(2) Includes $0.6 billion of funded exposure at December 31, 2022, primarily related to commercial credit card delinquency-managed loans.

(3) As of December 31, 2022, the ACLL above reflects coverage of 0.4% of funded investment-grade exposure and 3.0% of funded non-investment-grade exposure.

Non-Accrual Loans and Assets

There is a certain amount of overlap among non-accrual loans and assets. The following summary provides a general description of each category:

•Corporate and consumer (including commercial banking) non-accrual status is based on the determination that payment of interest or principal is doubtful.

•A corporate loan may be classified as non-accrual and still be current on principal and interest payments under the terms of the loan structure. Citi’s corporate non-accrual loans were $1.9 billion, $2.0 billion and $1.1 billion as of December 31, 2023, September 30, 2023 and December 31, 2022, respectively.

•Consumer non-accrual status is generally based on aging, i.e., the borrower has fallen behind on payments.

•Consumer mortgage loans, other than Federal Housing Administration (FHA)–insured loans, are classified as non-accrual within 60 days of notification that the borrower has filed for bankruptcy. In addition, home equity loans are classified as non-accrual if the related residential first mortgage loan is 90 days or more past due.

•U.S. Branded Cards and Retail Services are not included because, under industry standards, credit card loans accrue interest until such loans are charged off, which typically occurs at 180 days of contractual delinquency.

Non-Accrual Loans

The table below summarizes Citigroup’s non-accrual loans as of the periods indicated. Non-accrual loans may still be current on interest payments. In situations where Citi reasonably expects that only a portion of the principal owed will ultimately be collected, all payments received are reflected as a reduction of principal and not as interest income. For all other non-accrual loans, cash interest receipts are generally recorded as revenue.

(1)Corporate loans are placed on non-accrual status based on a review by Citigroup’s risk officers. Corporate non-accrual loans may still be current on interest payments. With limited exceptions, the following practices are applied for consumer loans: consumer loans, excluding credit cards and mortgages, are placed on non-accrual status at 90 days past due and are charged off at 120 days past due; residential mortgage loans are placed on non-accrual status at 90 days past due and written down to net realizable value at 180 days past due. Consistent with industry conventions, Citigroup generally accrues interest on credit card loans until such loans are charged off, which typically occurs at 180 days contractual delinquency. As such, the non-accrual loan disclosures do not include credit card loans. The balances above represent non-accrual loans within Corporate loansand Consumer loans on the Consolidated Balance Sheet.

(2)Approximately 50%, 50%, 56%, 64% and 44% of Citi’s corporate non-accrual loans remain current on interest and principal payments at December 31, 2023, 2022, 2021, 2020 and 2019, respectively.

(3)The December 31, 2023 total corporate non-accrual loans represented 0.63% of total corporate loans.

(4)The increase at December 31, 2023 was primarily related to two commercial real estate loans.

(5) Asia Consumer includes balances in Poland and Russia for all periods presented and in Bahrain for December 31, 2021, 2020 and 2019.

Modified Loans to Borrowers Experiencing Financial Difficulty

On January 1, 2023, Citi adopted ASU 2022-02, which eliminated the accounting and disclosure requirements for TDRs (see Note 1). See Note 15 for information on loan modifications during the year ended December 31, 2023.

The changes in Citigroup’s non-accrual loans were as follows:

The table below summarizes Citigroup’s other real estate owned (OREO) assets. OREO is recorded on the Consolidated Balance Sheet within Other assets. This represents the carrying value of all real estate property acquired by foreclosure or other legal proceedings when Citi has taken possession of the collateral:

(1)The ACLL includes the allowance for Citi’s credit card portfolios and purchased credit-deteriorated loans, while the non-accrual loans exclude credit card balances (with the exception of certain international portfolios) and, prior to 2020, include purchased credit-deteriorated loans as these continue to accrue interest until charge-off.

LIQUIDITY RISK

Adequate and diverse sources of funding and liquidity are essential to Citi’s businesses. Funding and liquidity risks arise from several factors, many of which are mostly or entirely outside of Citi’s control, such as disruptions in the financial markets, changes in key funding sources, credit spreads, changes in Citi’s credit ratings and macroeconomic, geopolitical and other conditions. For additional information, see “Risk Factors—Liquidity Risks” above.

Citi’s funding and liquidity management objectives are aimed at (i) funding its existing asset base, (ii) growing its core businesses, (iii) maintaining sufficient liquidity, structured appropriately, so that Citi can operate under a variety of adverse circumstances, including potential Company-specific and/or market liquidity events in varying durations and severity, and (iv) satisfying regulatory requirements, including, but not limited to, those related to resolution planning (see “Resolution Plan” and “Total Loss-Absorbing Capacity (TLAC)” below). Citigroup’s primary liquidity objectives are established by entity, and in aggregate, across two major categories:

•Citibank (including Citibank Europe plc, Citibank Singapore Ltd. and Citibank (Hong Kong) Ltd.); and

•Citi’s non-bank and other entities, including the parent holding company (Citigroup Inc.), Citi’s primary intermediate holding company (Citicorp LLC), Citi’s broker-dealer subsidiaries (including Citigroup Global Markets Inc., Citigroup Global Markets Limited and Citigroup Global Markets Japan Inc.) and other bank and non-bank subsidiaries that are consolidated into Citigroup (including Citibanamex).

At an aggregate Citigroup level, Citi’s goal is to maintain sufficient funding in amount and tenor to fully fund customer assets and to provide an appropriate amount of cash and high-quality liquid assets (as discussed below), even in times of stress, in order to meet its payment obligations as they come due. The liquidity risk management framework provides that, in addition to the aggregate requirements, certain entities be self-sufficient or net providers of liquidity, including in conditions established under their designated stress tests.

Citi’s primary funding sources include (i) corporate and consumer deposits via Citi’s bank subsidiaries, including Citibank, N.A. (Citibank), (ii) long-term debt (primarily senior and subordinated debt) mainly issued by Citigroup Inc., as the parent, and Citibank, and (iii) stockholders’ equity. These sources may be supplemented by short-term borrowings, primarily in the form of secured funding transactions.

Citi’s funding and liquidity framework, working in concert with overall asset/liability management, helps ensure that there is sufficient liquidity and tenor in the overall liability structure (including funding products) of the Company relative to the liquidity requirements of Citi’s assets. This reduces the

risk that liabilities will become due before assets mature or are monetized. The Company holds excess liquidity, primarily in the form of high-quality liquid assets (HQLA), as presented in the table below.

Citi’s liquidity is managed centrally by Corporate Treasury, in conjunction with regional and in-country treasurers with oversight provided by Independent Risk Management and various Asset & Liability Committees (ALCOs) at the individual entity, region, country and business levels. Pursuant to this approach, Citi’s HQLA are managed with emphasis on asset/liability management and entity-level liquidity adequacy throughout Citi.

Citi’s CRO and CFO co-chair Citigroup’s ALCO, which includes Citi’s Treasurer and other senior executives. The ALCO sets the strategy of the liquidity portfolio and monitors portfolio performance (see “Risk Governance—Board and Executive Management Committees” above). Significant changes to portfolio asset allocations are approved by the ALCO. Citi also has other ALCOs, which are established at various organizational levels to ensure appropriate oversight for individual entities, countries, franchise businesses and regions, serving as the primary governance committees for managing Citi’s balance sheet and liquidity.

As a supplement to ALCO, Citi’s Funding and Liquidity Risk Committee (FLRC) is focused on funding and liquidity risk matters. The FLRC reviews and discusses the funding and liquidity risk profile of, as well as risk management practices for, Citigroup and Citibank and reports its findings and recommendations to each relevant ALCO as appropriate.

Liquidity Monitoring and Measurement

Stress Testing

Liquidity stress testing is performed for each of Citi’s major entities, operating subsidiaries and countries. Stress testing and scenario analyses are intended to quantify the potential impact of an adverse liquidity event on the balance sheet and liquidity position, in order to have sufficient liquidity on hand to manage through such an event. These scenarios include assumptions about significant changes in key funding sources, market triggers (such as credit ratings), potential uses of funding and macroeconomic, geopolitical and other conditions. These conditions include expected and stressed market conditions as well as Company-specific events.

Liquidity stress tests are performed to ascertain potential mismatches between liquidity sources and uses over a variety of time horizons and over different stressed conditions. To monitor the liquidity of an entity, these stress tests and potential mismatches are calculated on a daily basis.

Given the range of potential stresses, Citi maintains contingency funding plans on a consolidated basis and for individual entities. These plans specify a wide range of readily available actions for a variety of adverse market conditions or idiosyncratic stresses.

High-Quality Liquid Assets (HQLA)

Note: The amounts in the table above are presented on an average basis. For securities, the amounts represent the liquidity value that potentially could be realized and, therefore, exclude any securities that are encumbered and incorporate any haircuts applicable under the U.S. LCR rule. The table above incorporates various restrictions that could limit the transferability of liquidity between legal entities, including Section 23A of the Federal Reserve Act.

(1) Foreign government debt includes securities issued or guaranteed by foreign sovereigns, agencies and multilateral development banks. Foreign government debt securities are held largely to support local liquidity requirements and Citi’s local franchises and principally include government bonds from Japan, Korea, Mexico, India and Hong Kong.

The table above includes average amounts of HQLA held at Citigroup’s operating entities that are eligible for inclusion in the calculation of Citigroup’s consolidated Liquidity Coverage ratio (LCR), pursuant to the U.S. LCR rules. These amounts include the HQLA needed to meet the minimum requirements at these entities as well as any amounts in excess of these minimums that are available to be transferred to other entities within Citigroup. Citigroup’s average HQLA decreased quarter-over-quarter as of the fourth quarter of 2023, primarily driven by a reduction in average unsecured debt.

As of December 31, 2023, Citigroup had approximately $965 billion of available liquidity resources to support client and business needs, including end-of-period HQLA ($562 billion); additional unencumbered HQLA, including excess liquidity held at bank entities that is non-transferable to other entities within Citigroup ($232 billion); and unused borrowing capacity from available assets not already accounted for within Citi’s HQLA to support additional advances from the Federal Home Loan Bank (FHLB) and the Federal Reserve Bank discount window ($171 billion).

Short-Term Liquidity Measurement: Liquidity Coverage Ratio (LCR)

In addition to internal 30-day liquidity stress testing performed for Citi’s major entities, operating subsidiaries and countries, Citi also monitors its liquidity by reference to the LCR.

The LCR is calculated by dividing HQLA by estimated net outflows assuming a stressed 30-day period, with the net outflows determined by standardized stress outflow and inflow rates prescribed in the LCR rule. The outflows are partially offset by contractual inflows from assets maturing within 30 days. Similar to outflows, the inflows are calculated based on prescribed factors to various asset categories, such as retail loans as well as unsecured and secured wholesale lending. The minimum LCR requirement is 100%.

The table below details the components of Citi’s LCR calculation and HQLA in excess of net outflows for the periods indicated:

Note: The amounts are presented on an average basis.

As of December 31, 2023, Citigroup’s average LCR decreased from the quarter ended September 30, 2023. The decrease was primarily driven by the reduction in average HQLA.

In addition, considering Citi’s total available liquidity resources at quarter end of $965 billion, Citi maintained approximately $482 billion of excess liquidity above the stressed average net outflow of approximately $483 billion, shown in the LCR table above.

Long-Term Liquidity Measurement: Net Stable Funding Ratio (NSFR)

As previously disclosed, the U.S. banking agencies adopted a rule to assess the availability of a bank’s stable funding against a required level.

In general, a bank’s available stable funding includes portions of equity, deposits and long-term debt, while its required stable funding will be based on the liquidity characteristics of its assets, derivatives and commitments. Standardized weightings are required to be applied to the various asset and liability classes. The ratio of available stable funding to required stable funding is required to be greater than 100%.

For the quarter ended December 31, 2023, Citigroup’s consolidated NSFR was compliant with the rule. Refer to Citi’s U.S. NSFR Disclosure report covering December 31, 2023 and September 30, 2023 on its website for additional information.

Select Balance Sheet Items

This section provides details of select liquidity-related assets and liabilities reported on Citigroup’s Consolidated Balance Sheet on an average and end-of-period basis.

Cash and Investments

The table below details average and end-of-period Cash and due from banks, Deposits with banks (collectively cash) and Investment securities. Citi’s investment portfolio consists largely of highly liquid U.S. Treasury, U.S. agency and other sovereign bonds, with an aggregate duration of less than three years. At December 31, 2023, Citi’s EOP cash and Investment securities comprised approximately 32% of Citigroup’s total assets:

Deposits

The table below details the average deposits, by business and/or segment, and the total Citigroup end-of-period deposits for each of the periods indicated:

End-of-period deposits decreased 4% year-over-year, largely due to a reduction in Services reflecting quantitative tightening, and a reduction in USPBand Wealth reflecting a shift of deposits to higher-yielding products. End-of-period deposits increased 3% sequentially.

On an average basis, deposits declined 3% year-over-year and were largely unchanged sequentially.

As of the fourth quarter of 2023, average deposits for:

•Services decreased 3% year-over-year, while TTS and Securities Services decreased 2% and 7%, respectively. These declines reflected the impact of quantitative tightening that more than offset deposits from new client acquisitions and deepening of relationships with existing clients.

•USPB decreased 5% year-over-year, driven by the transfer of relationships and the associated deposits to Wealth.

•Wealth decreased 3% year-over-year, reflecting the continued mix shift of deposits to higher-yielding investments on Citi’s platform, partially offset by the benefits of the transfer of certain relationships and the associated deposit balances from USPB.

Long-Term Debt

Long-term debt (generally defined as debt with original maturities of one year or more) represents the most significant component of Citi’s funding for the Citigroup parent company and Citi’s non-bank subsidiaries and is a supplementary source of funding for the bank entities.

Weighted-Average Maturity (WAM)

The following table presents Citigroup and its affiliates’

(including Citibank) WAM of unsecured long-term debt issued with a remaining life greater than one year:

The WAM is calculated based on the contractual maturity of each security. For securities that are redeemable prior to maturity where the option is not held by the issuer, the WAM is calculated based on the earliest date an option becomes exercisable.

Long-Term Debt Outstanding

The following table presents Citi’s end-of-period total long-term debt outstanding for each of the dates indicated:

Note: Amounts represent the current value of long-term debt on Citi’s Consolidated Balance Sheet that, for certain debt instruments, includes consideration of fair value, hedging impacts and unamortized discounts and premiums.

(1) Non-bank includes long-term debt issued to third parties by the parent holding company (Citigroup) and Citi’s non-bank subsidiaries (including broker-dealer subsidiaries) that are consolidated into Citigroup. As of December 31, 2023, non-bank included $92.6 billion of long-term debt issued by Citi’s broker-dealer and other subsidiaries that are consolidated into Citigroup. Certain Citigroup consolidated hedging activities are also included in this line.

(2) Local country and other includes debt issued by Citi’s affiliates in support of their local operations. Within non-bank, certain secured financing is also included.

(3) Predominantly credit card securitizations, primarily backed by Branded Cards receivables.

Citi’s total long-term debt outstanding increased 6% year-over-year, largely driven by issuance of customer-related debt at the non-bank entities, as well as increased senior benchmark debt and FHLB borrowings at the bank. The increase was partially offset by a decline in senior benchmark debt at the non-bank entities. Sequentially, long-term debt outstanding also increased 4%, largely driven by an increase in customer-related debt at the non-bank entities and increased FHLB borrowings and benchmark senior debt at the bank.

As part of its liability management, Citi has considered, and may continue to consider, opportunities to redeem or repurchase its long-term debt pursuant to open market purchases, tender offers or other means. Such redemptions and repurchases help reduce Citi’s overall funding costs. During 2023, Citi redeemed or repurchased an aggregate of approximately $32.0 billion of its outstanding long-term debt.

Long-Term Debt Issuances and Maturities

The table below details Citi’s long-term debt issuances and maturities (including repurchases and redemptions) during the periods presented:

The table below details Citi’s aggregate long-term debt maturities (including repurchases and redemptions) in 2023, as well as its aggregate expected remaining long-term debt maturities by year as of December 31, 2023:

Resolution Plan

Citigroup is required under Title I of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (Dodd-Frank Act) and the rules promulgated by the FDIC and Federal Reserve Board (FRB) to periodically submit a plan for Citi’s rapid and orderly resolution under the U.S. Bankruptcy Code in the event of material financial distress or failure. Citigroup will alternate between submitting a full resolution plan and a targeted resolution plan on a biennial cycle.

Under Citi’s preferred “single point of entry” resolution plan strategy, only Citigroup, the parent holding company, would enter into bankruptcy, while Citigroup’s material legal entities (as defined in the public section of its 2023 resolution plan, which can be found on the FRB’s and FDIC’s websites) would remain operational outside of any resolution or insolvency proceedings. Citigroup’s resolution plan has been designed to minimize the risk of systemic impact to the U.S. and global financial systems, while maximizing the value of the bankruptcy estate for the benefit of Citigroup’s creditors, including its unsecured long-term debt holders.

In addition, in line with the FRB’s total loss-absorbing capacity (TLAC) rule, Citigroup’s shareholders and unsecured creditors—including its unsecured long-term debt holders—bear any losses resulting from Citigroup’s bankruptcy. Accordingly, any value realized by holders of its unsecured long-term debt may not be sufficient to repay the amounts owed to such debt holders in the event of a bankruptcy or other resolution proceeding of Citigroup.

The FDIC has also indicated that it was developing a single point of entry strategy to implement the Orderly Liquidation Authority under Title II of the Dodd-Frank Act, which provides the FDIC with the ability to resolve a firm when it is determined that bankruptcy would have serious adverse effects on financial stability in the U.S.

As previously disclosed, in response to feedback received from the FRB and FDIC, Citigroup took the following actions:

(i) Citicorp LLC (Citicorp), an existing wholly owned subsidiary of Citigroup, was established as an intermediate holding company (an IHC) for certain of Citigroup’s operating material legal entities;

(ii) Citigroup executed an inter-affiliate agreement with Citicorp, Citigroup’s operating material legal entities and certain other affiliated entities pursuant to which Citicorp is required to provide liquidity and capital support to Citigroup’s operating material legal entities in the event that Citigroup were to enter bankruptcy proceedings (Citi Support Agreement);

(iii) pursuant to the Citi Support Agreement:

•Citigroup made an initial contribution of assets, including certain high-quality liquid assets and inter-affiliate loans (Contributable Assets), to Citicorp, and Citicorp became the business-as-usual funding vehicle for Citigroup’s operating material legal entities;

•Citigroup will be obligated to continue to transfer Contributable Assets to Citicorp over time, subject to certain amounts retained by Citigroup to, among other things, meet Citigroup’s near-term cash needs;

•in the event of a Citigroup bankruptcy, Citigroup will be required to contribute most of its remaining assets to Citicorp; and

(iv) the obligations of both Citigroup and Citicorp under the Citi Support Agreement, as well as the Contributable Assets, are secured pursuant to a security agreement.

Total Loss-Absorbing Capacity (TLAC)

U.S. GSIBs are required to maintain minimum levels of TLAC and eligible LTD, each set by reference to the GSIB’s consolidated risk-weighted assets (RWA) and total leverage exposure. The intended purpose of the requirements is to facilitate the orderly resolution of U.S. GSIBs under the U.S. Bankruptcy Code and Title II of the Dodd-Frank Act. For additional information, including Citi’s TLAC and LTD amounts and ratios, see “Capital Resources—Current Regulatory Capital Standards” above.

SECURED FUNDING TRANSACTIONS AND SHORT-TERM BORROWINGS

Citi supplements its primary sources of funding with short-term financings that generally include (i) secured funding transactions consisting of securities loaned or sold under agreements to repurchase, i.e., repos, and (ii) to a lesser extent, short-term borrowings consisting of commercial paper and borrowings from the FHLB and other market participants.

Secured Funding Transactions

Secured funding is primarily accessed through Citi’s broker-dealer subsidiaries, with a smaller portion executed through Citi’s bank entities to efficiently fund both (i) secured lending activity and (ii) a portion of the securities inventory held in the context of market making and customer activities. Secured funding transactions are predominantly collateralized by government debt securities. Generally, changes in the level of Citi’s secured funding are primarily due to fluctuations in secured lending activity in the matched book (as described below) and changes in securities inventory. In order to maintain reliable funding under a wide range of market conditions, Citi manages risks related to its secured funding by establishing secured funding limits and conducting daily stress tests that account for risks related to capacity, tenor, haircut, collateral type, counterparty and client actions.

Secured funding of $269 billion as of December 31, 2023 increased 33% year-over-year and 5% sequentially, largely driven by additional financing to support increases in trading-related assets within Citi’s broker-dealer subsidiaries. As of the quarter ended December 31, 2023, on an average basis, secured funding was $288 billion. The portion of secured funding in the broker-dealer subsidiaries that funds secured lending is commonly referred to as “matched book” activity and is primarily secured by high-quality liquid securities such as U.S. Treasury securities, U.S. agency securities and foreign government debt securities. Other “matched book” activity is secured by less liquid securities, including equity securities, corporate bonds and asset-backed securities, the tenor of which is generally equal to or longer than the tenor of the corresponding assets. As indicated above, the remaining portion of secured funding is used to fund securities inventory held in the context of market making and customer activities.

Short-Term Borrowings

Citi’s short-term borrowings of $37 billion as of the fourth quarter of 2023 decreased 20% year-over-year, reflecting lower commercial paper issuances at the broker-dealer subsidiaries, as Citi continues to diversify its funding profile, and decreased 1% sequentially, driven by normal business activity (see Note 18 for further information on Citigroup’s and its affiliates’ outstanding short-term borrowings).

CREDIT RATINGS

Citigroup’s funding and liquidity, funding capacity, ability to access capital markets and other sources of funds, the cost of these funds and its ability to maintain certain deposits are partially dependent on its credit ratings.

The table below presents the ratings for Citigroup and Citibank as of December 31, 2023. While not included in the table below, the long-term and short-term ratings of Citigroup Global Markets Holding Inc. (CGMHI) were A+/F1 at Fitch Ratings, A2/P-1 at Moody’s Investors Service and A/A-1 at S&P Global Ratings as of December 31, 2023.

Ratings as of December 31, 2023

Potential Impacts of Ratings Downgrades

Ratings downgrades by Fitch, Moody’s or S&P could negatively impact Citigroup’s and/or Citibank’s funding and liquidity due to reduced funding capacity, including derivative triggers, which could take the form of cash obligations and collateral requirements.

The following information is provided for the purpose of analyzing the potential funding and liquidity impact to Citigroup and Citibank of a hypothetical simultaneous ratings downgrade across all three major rating agencies. This analysis is subject to certain estimates, estimation methodologies, judgments and uncertainties. Uncertainties include potential ratings limitations that certain entities may have with respect to permissible counterparties, as well as general subjective counterparty behavior. For example, certain corporate customers and markets counterparties could re-evaluate their business relationships with Citi and limit transactions in certain contracts or market instruments with Citi. Changes in counterparty behavior could impact Citi’s funding and liquidity, as well as the results of operations of certain of its businesses. The actual impact to Citigroup or Citibank is unpredictable and may differ materially from the potential funding and liquidity impacts described below. For additional information on the impact of credit rating changes on Citi and its applicable subsidiaries, see “Risk Factors—Liquidity Risks” above.

Citigroup Inc. and Citibank—Potential Derivative Triggers

As of December 31, 2023, Citi estimates that a hypothetical one-notch downgrade of the senior debt/long-term rating of Citigroup Inc. across all three major rating agencies could impact Citigroup’s funding and liquidity due to derivative triggers by approximately $0.2 billion, compared to $0.3 billion as of September 30, 2023. Other funding sources, such as secured financing transactions and other margin requirements, for which there are no explicit triggers, could also be adversely affected.

As of December 31, 2023, Citi estimates that a hypothetical one-notch downgrade of the senior debt/long-term rating of Citibank across all three major rating agencies could impact Citibank’s funding and liquidity due to derivative triggers by approximately $0.3 billion, compared to $0.4 billion as of September 30, 2023. Other funding sources, such as secured financing transactions and other margin requirements, for which there are no explicit triggers, could also be adversely affected.

In total, as of December 31, 2023, Citi estimates that a one-notch downgrade of Citigroup Inc. and Citibank across all three major rating agencies could result in increased aggregate cash obligations and collateral requirements of approximately $0.5 billion, compared to $0.7 billion as of September 30, 2023 (see also Note 20). As detailed under “High-Quality Liquid Assets (HQLA)” above, Citigroup has various liquidity resources available to its bank and non-bank entities in part as a contingency for the potential events described above.

In addition, a broad range of mitigating actions are currently included in Citigroup’s and Citibank’s contingency funding plans. For Citigroup, these mitigating factors include, but are not limited to, accessing surplus funding capacity from existing clients, tailoring levels of secured lending and adjusting the size of select trading books and collateralized borrowings at certain Citibank subsidiaries. Mitigating actions available to Citibank include, but are not limited to, selling or financing highly liquid government securities, tailoring levels of secured lending, adjusting the size of select trading assets, reducing loan originations and renewals, raising additional deposits or borrowing from the FHLB or central banks. Citi believes these mitigating actions could substantially reduce the funding and liquidity risk, if any, of the potential downgrades described above.

Citibank—Additional Potential Impacts

In addition to the above derivative triggers, Citi believes that a potential downgrade of Citibank’s senior debt/long-term rating across any of the three major rating agencies could also have an adverse impact on the commercial paper/short-term rating of Citibank. Citibank has provided liquidity commitments to consolidated asset-backed commercial paper conduits, primarily in the form of asset purchase agreements. As of December 31, 2023, Citibank had liquidity commitments of approximately $11.0 billion to consolidated asset-backed commercial paper conduits, unchanged from December 31, 2022 (see Note 23).

In addition to the above-referenced liquidity resources of certain Citibank entities, Citibank could reduce the funding and liquidity risk, if any, of the potential downgrades described above through mitigating actions, including repricing or reducing certain commitments to commercial paper conduits. In the event of the potential downgrades described above, Citi believes that certain corporate customers could re-evaluate their deposit relationships with Citibank. This re-evaluation could result in clients adjusting their discretionary deposit levels or changing their depository institution, which could potentially reduce certain deposit levels at Citibank. However, Citi could choose to adjust pricing, offer alternative deposit products to its existing customers or seek to attract deposits from new customers, in addition to the mitigating actions referenced above.

MARKET RISK

Market risk is the potential for losses arising from changes in the value of Citi’s assets and liabilities resulting from changes in market variables such as interest rates, foreign exchange rates, equity prices, commodity prices and credit spreads, as well as their implied volatilities. Market risk arises from both Citi’s trading and non-trading portfolios. For additional information on market risk and market risk management at Citi, see “Risk Factors” above.

Each business is required to establish, with approval from Citi’s market risk management, a market risk limit framework for identified risk factors that clearly defines approved risk profiles and is within the parameters of Citi’s overall risk appetite. These limits are monitored by the Risk organization, including various regional, legal entity and business Risk Management committees, Citi’s country and business Asset & Liability Committees and the Citigroup Risk Management and Asset & Liability Committees. In all cases, the businesses are ultimately responsible for the market risks taken and for remaining within their defined limits.

MARKET RISK OF NON-TRADING PORTFOLIOS

Market risk from non-trading portfolios stems predominantly from the potential impact of changes in interest rates and foreign exchange rates on Citi’s net interest income and on Citi’s Accumulated other comprehensive income (loss) (AOCI) from its investment securities portfolios. Market risk from non-trading portfolios also includes the potential impact of changes in foreign exchange rates on Citi’s capital invested in foreign currencies.

Banking Book Interest Rate Risk

For interest rate risk purposes, Citi’s non-trading portfolios are referred to as the Banking Book. Management of interest rate risk in the Banking Book is governed by Citi’s Non-Trading Market Risk Policy. Management’s Asset & Liability Committee (ALCO) establishes Citi’s risk appetite and related limits for interest rate risk in the Banking Book, which are subject to approval by Citigroup’s Board of Directors. Corporate Treasury is responsible for the day-to-day management of Citi’s Banking Book interest rate risk as well as periodically reviewing it with the ALCO. Citi’s Banking Book interest rate risk management is also subject to independent oversight from the second line of defense team reporting to the Chief Risk Officer.

Changes in interest rates impact Citi’s net income, AOCI and CET1. These changes primarily affect Citi’s Banking Book through net interest income, due to a variety of risk factors, including:

•Differences in timing and amounts of the maturity or repricing of assets, liabilities and off-balance sheet instruments;

•Changes in the level and/or shape of interest rate curves;

•Client behavior in response to changes in interest rates (e.g., mortgage prepayments, deposit betas); and

•Changes in the maturity of instruments resulting from changes in the interest rate environment.

As part of their ongoing activities, Citi’s businesses generate interest rate-sensitive positions from their client-facing products, such as loans and deposits. The component of this interest rate risk that can be hedged is transferred via Citi’s funds transfer pricing process to Corporate Treasury. Corporate Treasury uses various tools to manage the total interest rate risk position within the established risk appetite and target Citi’s desired risk profile, including its investment securities portfolio, company-issued debt and interest rate derivatives.

In addition, Citi uses multiple metrics to measure its Banking Book interest rate risk. Interest Rate Exposure (IRE) is a key metric that analyzes the impact of a range of scenarios on Citi’s Banking Book net interest income and certain other interest rate-sensitive income versus a base case. IRE does not represent a forecast of Citi’s net interest income.

The scenarios, methodologies and assumptions used in this analysis are periodically evaluated and enhanced in response to changes in the market environment, changes in Citi’s balance sheet composition, enhancements in Citi’s modeling and other factors.

Since the third quarter of 2022, Citi has employed enhanced IRE methodologies and changes to certain assumptions. The changes included, among other things, assumptions around the projected balance sheet and revisions to the treatment of certain business contributions (notably accrual positions in the Markets businesses). These changes resulted in a higher impact to Citi’s net interest income over a 12-month period.

Under the enhanced methodology, Citi utilizes the most recent quarter-end balance sheet, assuming no changes to its composition and size over the forecasted horizon (holding the balance sheet static). The forecasts incorporate expectations and assumptions of deposit pricing, loan spreads and mortgage prepayment behavior implied by the interest rate curves in each scenario. The base case scenario reflects the market-implied forward interest rates, and sensitivity scenarios assume instantaneous shocks to the base case. The forecasts do not assume Citi takes any risk-mitigating actions in response to changes in the interest rate environment. Certain interest rates are subject to flooring assumptions in downward rate scenarios. Deposit pricing sensitivities (i.e., deposit betas) are informed by historical and expected behavior. Actual deposit pricing could differ from the assumptions used in these forecasts.

Citi’s IRE analysis primarily reflects the impacts from the following Banking Book assets and liabilities: loans, client deposits, Citi’s deposits with other banks, investment securities, long-term debt, any related interest rate hedges and the funds transfer pricing of positions in total trading and credit portfolio value at risk (VAR). It excludes impacts from any positions that are included in total trading and credit portfolio VAR.

In addition to IRE, Citi analyzes economic value sensitivity (EVS) as a longer-term interest rate risk metric. EVS is a net present value (NPV)–based measure of the lifetime cash flows of Citi’s Banking Book. It estimates the interest rate sensitivity of the Banking Book’s economic value from longer-term assets being potentially funded with shorter-term liabilities, or vice versa. Citi manages EVS within risk limits approved by Citigroup’s Board of Directors that are aligned with Citi’s risk appetite.

Interest Rate Risk of Investment Portfolios—Impact

on AOCI

Citi also measures the potential impacts of changes in interest rates on the value of its AOCI, which can in turn impact Citi’s common equity and tangible common equity. This will impact Citi’s CET1 and other regulatory capital ratios. Citi seeks to manage its exposure to changes in the market level of interest rates, while limiting the potential impact on its AOCI and regulatory capital position.

AOCI at risk is managed as part of the Company-wide interest rate risk position. AOCI at risk considers potential changes in AOCI (and the corresponding impact on the CET1 Capital ratio) relative to Citi’s capital generation capacity.

Citi uses 100 basis point (bps) shocks in each scenario to reflect its net interest income sensitivity to unanticipated changes in market interest rates, as potential monetary policy decisions and changes in economic conditions may be reflected in current market-implied forward rates. The following table presents the 12-month estimated impact to Citi’s net interest income, AOCI and the CET1 Capital ratio, each assuming an unanticipated parallel instantaneous 100 bps increase in interest rates:

(1)Excludes trading book and fair value option banking book portfolios and replaces them with the associated transfer pricing.

(2)Includes the effect of changes in interest rates on AOCI related to investment securities, cash flow hedges and pension liability adjustments.

The All other currencies of $1,219 billion as of December 31, 2023 in the table above includes the impact from the following top six non-U.S. dollar currencies, which represents approximately 50% of the total non-U.S. dollar currency impact: approximately $0.2 billion from the Japanese yen, and approximately $0.1 billion each from the Indian rupee, Singapore dollar, Korean won, Swiss franc and Chinese yuan. These impacts per currency are generally in the same direction (estimated positive impact in the +100 bps shock scenario) and not offsetting.

Citi’s balance sheet is asset sensitive (assets reprice faster than liabilities), resulting in higher net interest income in increasing interest rate scenarios. The estimated impact to Citi’s net interest income in a 100 bps upward rate shock scenario as of December 31, 2023 decreased quarter-over-quarter and year-over-year, primarily reflecting the net impact of lower expected gains due to U.S. dollar interest rate moves that have already been realized and changes in Citi’s balance sheet. At progressively higher interest rate levels, the marginal net interest income benefit is lower, as Citi assumes it will pass on a larger share of rate changes to depositors (i.e., higher betas), further reducing Citi’s IRE sensitivity. Currency-specific interest rate changes and balance sheet factors may drive quarter-to-quarter volatility in Citi’s estimated IRE.

In a 100 bps upward rate shock scenario, Citi expects that the approximate $0.8 billion initial negative impact to AOCI could potentially be offset in shareholders’ equity through the expected recovery of the impact on AOCI through accretion of Citi’s investment portfolio and expected net interest income benefit over a period of approximately four months.

Scenario Analysis

The following table presents the estimated impact to Citi’s net interest income, AOCI and CET1 Capital ratio (on a fully implemented basis) under six different scenarios of changes in interest rates for the U.S. dollar and all other currencies in which Citi has invested capital as of December 31, 2023. The 100 bps downward rate scenarios are impacted by the low level of interest rates in several countries and the assumption that market interest rates, as well as rates paid to depositors and charged to borrowers, do not fall below zero (i.e., the “flooring assumption”). The interest rate scenarios are also impacted by convexity related to mortgage products and deposit pricing.

Note: Each scenario assumes that the rate change will occur instantaneously. Changes in interest rates for maturities between the overnight rate and the 10-year rate are interpolated. The interest rate exposure in the table above assumes no change in deposit size or mix from the baseline forecast included in the different interest scenarios presented. As a result, in higher interest rate scenarios, customer activity resulting in a shift from non-interest-bearing and low interest rate deposit products to higher-yielding deposits would reduce the expected benefit to net interest income. Conversely, in lower interest rate scenarios, customer activity resulting in a shift from higher-yielding deposits to non-interest-bearing and low interest rate deposit products would reduce the expected decrease to net interest income.

(1)Scenario 1 includes the impact from the following top six non-U.S. dollar currencies, which represents approximately 50% of the total non-U.S. dollar currency impact: approximately $0.2 billion from the Japanese yen, and approximately $0.1 billion each from the Indian rupee, Singapore dollar, Korean won, Swiss franc and Chinese yuan. These impacts per currency are generally in the same direction (estimated positive impact in the +100 bps shock scenario) and not offsetting.

(2)Includes the effect of changes in interest rates on AOCI related to investment securities, cash flow hedges and pension liability adjustments.

As presented in the table above, the estimated impact to Citi’s net interest income is larger under Scenario 2 than Scenario 3, as Citi’s Banking Book has relatively higher interest rate exposure to the short end of the yield curve. For U.S. dollars, exposure to downward rate shocks is larger in magnitude than to upward rate shocks. This is because of the lower benefit to net interest income from Citi’s deposit base at higher rate levels, as well as the prepayment effects on mortgage loans and mortgage-backed securities. For other non-U.S. dollar currencies, exposure to downward rate shocks is smaller in magnitude as a result of Citi’s flooring assumption, given low rate levels for certain non-U.S. dollar currencies.

The magnitude of the impact to AOCI is greater under Scenario 2 compared to Scenario 3. This is because the combination of changes to Citi’s investment portfolio, partially offset by changes related to Citi’s pension liabilities, results in a net position that is more sensitive to rates at shorter- and intermediate-term maturities.

Changes in Foreign Exchange Rates—Impacts on AOCI

and Capital

As of December 31, 2023, Citi estimates that an unanticipated parallel instantaneous 5% appreciation of the U.S. dollar against all of the other currencies in which Citi has invested capital could reduce Citi’s tangible common equity (TCE) by approximately $1.7 billion, or 1.0%, as a result of changes to Citi’s CTA in AOCI, net of hedges. This impact would be primarily due to changes in the value of the Mexican peso, Euro, Singapore dollar and Indian rupee.

This impact is also before any mitigating actions Citi may take, including ongoing management of its foreign currency translation exposure. Specifically, as currency movements change the value of Citi’s net investments in foreign currency-denominated capital, these movements also change the value of Citi’s risk-weighted assets denominated in those currencies.

This, coupled with Citi’s foreign currency hedging strategies, such as foreign currency borrowings, foreign currency forwards and other currency hedging instruments, lessens the impact of foreign currency movements on Citi’s CET1 Capital ratio. Changes in these hedging strategies, as well as hedging costs, divestitures and tax impacts, can further affect the actual impact of changes in foreign exchange rates on Citi’s capital compared to an unanticipated parallel shock, as described above.

The effect of Citi’s ongoing management strategies with respect to quarterly changes in foreign exchange rates, and the quarterly impact of these changes on Citi’s TCE and CET1 Capital ratio, are presented in the table below. See Note 21 for additional information on the changes in AOCI.

(1) FX spot rate change is a weighted average based on Citi’s quarterly average GAAP capital exposure to foreign countries.

Interest Income/Expense and Net Interest Margin (NIM)

(1)Interest income and Net interest income include the taxable equivalent adjustments primarily related to the tax-exempt bond portfolio and certain tax-advantaged loan programs of $101 million, $165 million and $192 million for 2023, 2022 and 2021, respectively.

(2)Interest expense associated with certain hybrid financial instruments, which are classified as Long-term debtand accounted for at fair value, is reported together with any changes in fair value as part of Principal transactionsin the Consolidated Statement of Income and is therefore not reflected in Interest expensein the table above.

(3) The average rate on interest income and net interest margin reflects the taxable equivalent gross-up adjustment. See footnote 1 above.

(4) Citi’s NIM is calculated by dividing net interest income by average interest-earning assets.

Non-Markets Net Interest Income

Citi’s net interest income in the fourth quarter of 2023 was $13.8 billion, on both a reported and taxable equivalent basis, an increase of $0.6 billion versus the prior year, primarily driven by Markets (up approximately $0.4 billion) and non-Markets (up approximately $0.1 billion). The increase in Markets net interest income was primarily driven by Fixed Income. The increase in non-Markets primarily reflected higher interest rates and growth in U.S. cards interest-earning balances, partially offset by a reduction from the exited markets and continued wind-downs in All Other—Legacy Franchises. Citi’s net interest margin was 2.46% on a taxable equivalent basis in the fourth quarter of 2023, a decrease of three basis points from the prior quarter, largely driven by higher deposit costs, partially offset by higher Markets net interest margin.

Citi’s net interest income for 2023 increased 13%, or approximately $6.2 billion, to $54.9 billion ($55.0 billion on a taxable equivalent basis) versus the prior year. The increase was primarily due to an increase in non-Markets net interest income, largely reflecting higher interest rates and higher loan balances in USPB. In 2023, Citi’s net interest margin increased to 2.46% on a taxable equivalent basis, compared to 2.25% in 2022, primarily driven by higher interest rates and a mix-shift in balances.

Additional Interest Rate Details

Average Balances and Interest Rates—Assets(1)(2)(3)

Taxable Equivalent Basis

(1)Interest income and Net interest income include the taxable equivalent adjustments primarily related to the tax-exempt bond portfolio and certain tax-advantaged loan programs of $101 million, $165 million and $192 million for 2023, 2022 and 2021, respectively.

(2)Interest rates and amounts include the effects of risk management activities associated with the respective asset categories.

(3)Monthly or quarterly averages have been used by certain subsidiaries where daily averages are unavailable.

(4)Average rates reflect prevailing local interest rates, including inflationary effects and monetary corrections in certain countries.

(5)Average volumes of securities borrowed or purchased under agreements to resell are reported net pursuant to ASC 210-20-45. However, Interest revenue excludes the impact of ASC 210-20-45.

(6)The fair value carrying amounts of derivative contracts are reported net, pursuant to ASC 815-10-45, in Non-interest-earning assets and Other non-interest-bearing liabilities.

(7)Interest expense on Trading account liabilities of Services, Markets and Banking is reported as a reduction of Interest income. Interest incomeand Interest expense on cash collateral positions are reported in interest on Trading account assets and Trading account liabilities, respectively.

(8)Net of unearned income. Includes cash-basis loans.

(9)Includes assets from businesses held-for-sale (see Note 2) and Brokerage receivables.

Average Balances and Interest Rates—Liabilities and Equity, and Net Interest Income(1)(2)(3)

Taxable Equivalent Basis

(2)Interest rates and amounts include the effects of risk management activities associated with the respective liability categories.

(3)Monthly or quarterly averages have been used by certain subsidiaries where daily averages are unavailable.

(4)Consists of other time deposits and savings deposits. Savings deposits are made up of insured money market accounts, NOW accounts and other savings deposits.

(5)Average rates reflect prevailing local interest rates, including inflationary effects and monetary corrections in certain countries.

(6)Average volumes of securities sold under agreements to repurchase are reported net pursuant to ASC 210-20-45. However, Interest expense excludes the impact of ASC 210-20-45.

(7)The fair value carrying amounts of derivative contracts are reported net, pursuant to ASC 815-10-45, in Non-interest-earning assetsand Other non-interest-bearing liabilities.

(8)Interest expense on Trading account liabilities of Services, Markets and Banking is reported as a reduction of Interest income. Interest income and Interest expense on cash collateral positions are reported in interest on Trading account assets and Trading account liabilities, respectively.

(9)Includes Brokerage payables.

(10)Excludes hybrid financial instruments and beneficial interests in consolidated VIEs that are classified as Long-term debt, as the changes in fair value for these obligations are recorded in Principal transactions.

(11)Includes allocations for capital and funding costs based on the location of the asset.

Analysis of Changes in Interest Revenue(1)(2)(3)

(2)Rate/volume variance is allocated based on the percentage relationship of changes in volume and changes in rate to the total net change.

(3)Changes in average rates reflect changes in prevailing local interest rates, including inflationary effects and monetary corrections in certain countries.

(4)Interest expense on Trading account liabilities of Services, Markets and Bankingis reported as a reduction of Interest income. Interest income and Interest expense on cash collateral positions are reported in interest on Trading account assetsand Trading account liabilities, respectively.

(5)Includes cash-basis loans.

(6)Includes Brokerage receivables.

Analysis of Changes in Interest Expense and Net Interest Income(1)(2)(3)

(2)Rate/volume variance is allocated based on the percentage relationship of changes in volume and changes in rate to the total net change.

(3)Changes in average rates reflect changes in prevailing local interest rates, including inflationary effects and monetary corrections in certain countries.

(4)Interest expense on Trading account liabilities of Services, Markets and Banking is reported as a reduction of Interest income. Interest income and Interest expense on cash collateral positions are reported in interest on Trading account assetsand Trading account liabilities, respectively.

(5)Includes Brokerage payables.

MARKET RISK OF TRADING PORTFOLIOS

Trading portfolios include positions resulting from market-making activities, hedges of certain available-for-sale (AFS) debt securities, the CVA relating to derivative counterparties and all associated hedges, fair value option loans and hedges of the loan portfolio within capital markets origination.

The market risk of Citi’s trading portfolios is monitored using a combination of quantitative and qualitative measures, including, but not limited to, factor sensitivities, value at risk (VAR) and stress testing. Each trading portfolio across Citi’s businesses has its own market risk limit framework encompassing these measures and other controls, including trading mandates, new product approval, permitted product lists and pre-trade approval for larger, more complex and less liquid transactions. These controls enable the monitoring and management of Citi’s top market risks.

The following chart of total daily trading-related revenue (loss) captures trading volatility and shows the number of days in which revenues for Citi’s trading businesses fell within particular ranges. Trading-related revenue includes trading, net interest and other revenue associated with Citi’s trading businesses. It excludes DVA, FVA and CVA adjustments incurred due to changes in the credit quality of counterparties, as well as any associated hedges of that CVA. In addition, it excludes fees and other revenue associated with capital markets origination activities. Trading-related revenues are driven by both customer flows and the changes in valuation of the trading inventory. As presented in the chart below, positive trading-related revenue was achieved for 94.6% of the trading days in 2023.

Daily Trading-Related Revenue (Loss)(1)—12 Months Ended December 31, 2023

In millions of dollars

(1) Reflects the effects of asymmetrical accounting for economic hedges of certain AFS debt securities. Specifically, the change in the fair value of hedging derivatives is included in trading-related revenue, while the offsetting change in the fair value of hedged AFS debt securities is included in AOCI and not reflected above.

Factor Sensitivities

Factor sensitivities are expressed as the change in the value of a position for a defined change in a market risk factor, such as a change in the value of a U.S. Treasury Bond for a one-basis-point change in interest rates. Citi’s Global Market Risk function, within the Independent Risk Management organization, works to ensure that factor sensitivities are calculated, monitored and limited for all material risks taken in the trading portfolios.

Value at Risk (VAR)

VAR estimates, at a 99% confidence level, the potential decline in the value of a position or a portfolio under normal market conditions assuming a one-day holding period. VAR statistics, which are based on historical data, can be materially different across firms due to differences in portfolio composition, VAR methodologies and model parameters. As a result, Citi believes VAR statistics can be used more effectively as indicators of trends in risk-taking within a firm, rather than as a basis for inferring differences in risk-taking across firms.

Citi uses a single, independently approved Monte Carlo simulation VAR model (see “VAR Model Review and Validation” below), which has been designed to capture

material risk sensitivities (such as first- and second-order sensitivities of positions to changes in market prices) of various asset classes/risk types (such as interest rate, credit spread, foreign exchange, equity and commodity risks). Citi’s VAR includes positions that are measured at fair value; it does not include investment securities classified as AFS or HTM. See Note 14 for information on these securities.

Citi believes its VAR model is conservatively calibrated to incorporate fat-tail scaling and the greater of short-term (approximately the most recent month) and long-term (18 months for commodities and three years for others) market volatility. The Monte Carlo simulation involves approximately 550,000 market factors, making use of approximately 480,000 time series, with sensitivities updated daily, volatility parameters updated intra-monthly and correlation parameters updated monthly. The conservative features of the VAR calibration contribute an approximate 30% add-on to what would be a VAR estimated under the assumption of stable and perfectly, normally distributed markets.

As presented in the table below, Citi’s average trading VAR increased $12 million from 2022 to 2023, mainly due to increased market volatility. Citi’s average trading and credit portfolio VAR decreased $6 million from 2022 to 2023.

Year-end and Average Trading VAR and Trading and Credit Portfolio VAR

(1)Covariance adjustment (also known as diversification benefit) equals the difference between the total VAR and the sum of the VARs tied to each risk type. The benefit reflects the fact that the risks within individual and across risk types are not perfectly correlated and, consequently, the total VAR on a given day will be lower than the sum of the VARs relating to each risk type. The determination of the primary drivers of changes to the covariance adjustment is made by an examination of the impact of both model parameter and position changes.

(2) The total trading VAR includes mark-to-market and certain fair value option trading positions with the exception of hedges of the loan portfolio, fair value option loans and all CVA exposures. Available-for-sale and accrual exposures are not included.

(3) The specific risk-only component represents the level of equity and fixed income issuer-specific risk embedded in VAR.

(4) The credit portfolio is composed of mark-to-market positions associated with non-trading business units, the CVA relating to derivative counterparties, all associated CVA hedges and market sensitivity FVA hedges. FVA and DVA are not included. The credit portfolio also includes hedges of the loan portfolio, fair value option loans and hedges of the leveraged finance pipeline within capital markets origination.

The table below provides the range of market factor VARs associated with Citi’s total trading VAR, inclusive of specific risk:

Note: No covariance adjustment can be inferred from the above table as the high and low for each market factor will be from different close-of-business dates.

The following table provides the VAR for Markets, excluding the CVA relating to derivative counterparties, hedges of CVA, fair value option loans and hedges to the loan portfolio:

VAR Model Review and Validation

Generally, Citi’s VAR review and model validation process entails reviewing the model framework, major assumptions and implementation of the mathematical algorithm. In addition, product-specific back-testing on portfolios is periodically completed as part of the ongoing model performance monitoring process and reviewed with Citi’s U.S. banking regulators. Furthermore, Regulatory VAR back-testing (as described below) is performed against buy-and-hold profit and loss on a monthly basis for multiple sub-portfolios across the organization (trading desk level and total Citigroup) and the results are shared with U.S. banking regulators.

Material VAR model and assumption changes must be independently validated within Citi’s Independent Risk Management organization. All model changes, including those for the VAR model, are validated by the model validation group within Citi’s Model Risk Management. In the event of significant model changes, parallel model runs are undertaken prior to implementation. In addition, significant model and assumption changes are subject to the periodic reviews and approval by Citi’s U.S. banking regulators.

Citi uses the same independently validated VAR model for both Regulatory VAR and Risk Management VAR (i.e., total trading and total trading and credit portfolios VARs) and, as such, the model review and validation process for both purposes is as described above.

Regulatory VAR, which is calculated in accordance with Basel III, differs from Risk Management VAR because certain positions included in Risk Management VAR are not eligible

for market risk treatment in Regulatory VAR. The composition of Risk Management VAR is discussed under “Value at Risk” above. The applicability of the VAR model for positions eligible for market risk treatment under U.S. regulatory capital rules is periodically reviewed and approved by Citi’s U.S. banking regulators.

In accordance with Basel III, Regulatory VAR includes all trading book-covered positions and all foreign exchange and commodity exposures. Pursuant to Basel III, Regulatory VAR excludes positions that fail to meet the intent and ability to trade requirements and are therefore classified as non-trading book and categories of exposures that are specifically excluded as covered positions. Regulatory VAR excludes CVA on derivative instruments and DVA on Citi’s own fair value option liabilities. CVA hedges are excluded from Regulatory VAR and included in credit risk-weighted assets as computed under the Advanced Approaches for determining risk-weighted assets.

Regulatory VAR Back-Testing

In accordance with Basel III, Citi is required to perform back-testing to evaluate the effectiveness of its Regulatory VAR model. Regulatory VAR back-testing is the process in which the daily one-day VAR, at a 99% confidence interval, is compared to the buy-and-hold profit and loss (i.e., the profit and loss impact if the portfolio is held constant at the end of the day and re-priced the following day). Buy-and-hold profit and loss represents the daily mark-to-market profit and loss attributable to price movements in covered positions from the close of the previous business day. Buy-and-hold profit and loss excludes realized trading revenue, net interest, fees and commissions, intra-day trading profit and loss and changes in reserves.

Based on a 99% confidence level, Citi would expect two to three days in any one year where buy-and-hold losses exceed the Regulatory VAR. Given the conservative calibration of Citi’s VAR model (as a result of taking the greater of short- and long-term volatilities and fat-tail scaling of volatilities), Citi would expect fewer exceptions under normal and stable market conditions. Periods of unstable market conditions could increase the number of back-testing exceptions.

The following graph presents the daily buy-and-hold profit and loss associated with Citi’s covered positions compared to Citi’s one-day Regulatory VAR during 2023. During 2023, three back-testing exceptions were observed at the Citigroup level.

The difference between the 47.7% of days with buy-and-hold gains for Regulatory VAR back-testing and the 94.6% of days with trading, net interest and other revenue associated with Citi’s trading businesses, presented in the histogram of daily trading-related revenue below, reflects, among other things, that a significant portion of Citi’s trading-related revenue is not generated from daily price movements on these positions and exposures, as well as differences in the portfolio composition of Regulatory VAR and Risk Management VAR.

Regulatory Trading VAR and Associated Buy-and-Hold Profit and Loss(1)(2)—12 Months Ended December 31, 2023

In millions of dollars

(1) Buy-and-hold profit and loss, as defined by the banking regulators under Basel III, represents the daily mark-to-market revenue movement attributable to the trading position from the close of the previous business day. Buy-and-hold profit and loss excludes realized trading revenue and net interest intra-day trading profit and loss on new and terminated trades, as well as changes in reserves. Therefore, it is not comparable to the trading-related revenue presented in the chart of daily trading-related revenue above.

(2) The loss values for mid-August and mid-December 2023 were driven by the devaluation of the Argentine peso.

Stress Testing

Citi performs market risk stress testing on a regular basis to estimate the impact of extreme market movements. It is performed on individual positions and trading portfolios, as well as in aggregate, inclusive of multiple trading portfolios. Citi’s market risk management, after consultations with the businesses, develops both systemic and specific stress scenarios, reviews the output of periodic stress testing exercises and uses the information to assess the ongoing appropriateness of exposure levels and limits. Citi uses two complementary approaches to market risk stress testing across all major risk factors (i.e., equity, foreign exchange, commodity, interest rate and credit spreads): top-down systemic stresses and bottom-up business-specific stresses. Systemic stresses are designed to quantify the potential impact of extreme market movements on an institution-wide basis, and are constructed using both historical periods of market stress and projections of adverse economic scenarios. Business-specific stresses are designed to probe the risks of particular portfolios and market segments, especially those risks that are not fully captured in VAR and systemic stresses.

The systemic stress scenarios and business-specific stress scenarios at Citi are used in several reports reviewed by senior management and also to calculate internal risk capital for trading market risk, as well as enable the monitoring and managing of Citi’s top market risks.

In general, changes in market values are defined over a one-year horizon. For the most liquid positions and market factors, changes in market values are defined over a shorter two-month horizon. The limited set of positions and market factors whose market value changes are defined over a two-month horizon are those that in management’s judgment have historically remained very liquid during financial crises, even as the trading liquidity of most other positions and market factors materially declined.

OPERATIONAL RISK

Operational risk is the risk of loss resulting from inadequate or failed internal processes or systems, including human error or misjudgment, or from external events. This includes legal risk, which is the risk of loss (including litigation costs, settlements and regulatory fines) resulting from the failure of Citi to comply with laws, regulations, prudent ethical standards and contractual obligations in any aspect of its businesses, but excludes strategic and reputation risks. Citi also recognizes the impact of operational risk on the reputation risk associated with Citi’s business activities.

Operational risk is inherent in Citi’s global business activities, as well as related support functions, and can result in losses. Citi maintains a comprehensive Company-wide risk taxonomy to classify operational risks that it faces using standardized definitions across Citi’s Operational Risk Management Framework (see discussion below). This taxonomy also supports regulatory requirements and expectations inclusive of those related to U.S. Basel III, Comprehensive Capital Analysis and Review (CCAR), Heightened Standards for Large Financial Institutions and Dodd-Frank Act Stress Testing (DFAST).

Citi manages operational risk consistent with the overall framework described in “Managing Global Risk—Overview” above. Citi’s goal is to keep operational risk at appropriate levels relative to the characteristics of its businesses, the markets in which it operates, its capital and liquidity and the competitive, economic and regulatory environment. This includes effectively managing operational risk and maintaining or reducing operational risk exposures within Citi’s operational risk appetite.

Citi’s Independent Operational Risk Management group has established a global Operational Risk Management Framework with policies and practices for identification, measurement, monitoring, managing and reporting operational risks and the overall operating effectiveness of the internal control environment. As part of this framework, Citi has defined its operational risk appetite and established a manager’s control assessment (MCA) process for self-identification of significant operational risks, assessment of the performance of key controls and mitigation of residual risk above acceptable levels.

Each Citi operating segment must implement operational risk processes consistent with the requirements of this framework. This includes:

•understanding the operational risks they are exposed to;

•designing controls to mitigate identified risks;

•establishing key indicators;

•monitoring and reporting whether the operational risk exposures are in or out of their operational risk appetite;

•having processes in place to bring operational risk exposures within acceptable levels;

•periodically estimating and aggregating the operational risks they are exposed to; and

•ensuring that sufficient resources are available to actively improve the operational risk environment and mitigate emerging risks.

Citi considers operational risks that result from the introduction of new or changes to existing products, or result from significant changes in its organizational structures, systems, processes and personnel.

Citi has a governance structure for the oversight of operational risk exposures through Business Risk and Controls Committees (BRCCs), which are focused at the group, business or function, or geography level. BRCCs provide channels to inform senior management about operational risk exposures, control issues and operational risk events, and allow them to take and document decisions around the mitigation, remediation or acceptance of operational risk exposures.

In addition, Independent Risk Management, including the Operational Risk Management group, works proactively with Citi’s businesses and functions to drive a strong and embedded operational risk management culture and framework across Citi. The Operational Risk Management group actively challenges business and functions implementation of the Operational Risk Management Framework requirements and the quality of operational risk management practices and outcomes.

Information about businesses’ key operational risks, historical operational risk losses and the control environment is reported by each major business segment and functional area. Citi’s operational risk profile and related information is summarized and reported to senior management, as well as to the Audit and Risk Committees of Citi’s Board of Directors by the Head of Operational Risk Management.

Operational risk is measured through Operational Risk Capital and Operational Risk Regulatory Capital for the Advanced Approaches under Basel III. Projected operational risk losses under stress scenarios are estimated as a required part of the FRB’s CCAR process.

For additional information on Citi’s operational risks, see “Risk Factors—Operational Risks” above.

Cybersecurity Risk

Cybersecurity risk is the business risk associated with the threat posed by a cyberattack, cyber breach or the failure to protect Citi’s most vital business information assets or operations, resulting in a financial or reputational loss (see the operational processes and systems and cybersecurity risk factors in “Risk Factors—Operational Risks” above). With an evolving threat landscape, ever-increasing sophistication of threat actor tactics, techniques and procedures, ongoing and emerging geopolitical conflicts, and the use of new technologies, including those enabled by artificial intelligence and machine learning capabilities, to conduct financial transactions, Citi and its clients, customers and third parties (and fourth parties, etc.) continue to be at risk from cyberattacks and information security incidents. Citi leverages a threat-focused, defense-in-depth strategy that ensures that multiple controls work in tandem against various threats to increase the likelihood that malicious activity will be prevented, detected and mitigated.

Citi has a mature cybersecurity threat identification and management program that relies on an industry-aligned defense-in-depth approach, including an internal cybersecurity intelligence center, participation in industry and government information-sharing programs, vulnerability assessment and scanning tools, intrusion detection and prevention systems, security incident and event management systems, firewalls, penetration testing, adversary emulation exercises, data management (including classification, encryption at rest and in transit, and access management), multi-factor authentication requirements and other logical, physical and technical controls designed to prevent, deter, mitigate and respond to cybersecurity threats.

Citi’s cyber and information security program is supported by comprehensive governance, including policies, standards and procedures that dictate requirements and best practices around various topics, including, but not limited to, third-party risk management, data management, asset management, information security practices, security incident management, and regulatory and disclosure compliance. Citi’s Chief Information Security Office’s risks and controls are measured against its Cybersecurity Risk Appetite Statement, which was initially approved by the Risk Management Committee of the Board of Directors and is reapproved

annually by Citi’s Risk Committee, chaired by Citi’s Chief Risk Officer. Citi’s Cybersecurity Risk Appetite Statement leverages key risk indicators to establish enterprise risk tolerance and define risk management strategy with respect to cyber and information security. Further, Citi actively participates in financial industry, government and cross-sector knowledge-sharing groups to enhance individual and collective cybersecurity preparedness and resilience.

Cybersecurity Risk Management and Governance

Citi’s technology and cybersecurity risk management program is built on Citi’s three lines of defense, each of which is integrated into Citi’s overall risk management systems and processes.

Citi’s Chief Information Security Office, which is led by Citi’s Chief Information Security Officer (CISO), serves as the first line of defense. This office provides frontline business, operational and technical controls and capabilities to (1) protect against cybersecurity risks, and (2) respond to cyber incidents and data breaches. Citi manages cybersecurity threats through its state-of-the-art fusion centers, which serve as central commands for monitoring and coordinating responses to cyber threats.

Citi’s Chief Information Security Office is responsible for application and infrastructure defense and security controls, performing vulnerability assessments and third-party information security assessments (including cybersecurity risk assessments associated with Citi’s use of products and services from vendors and other third-party providers), employee awareness and training programs and security incident management. In each case, the enterprise information security team works in coordination with a network of information security officers who are embedded within Citi’s global businesses and functions, consistent with Citi’s philosophy that all Citi stakeholders have a responsibility in managing cyber and information security risks.

Citi’s Technology and Cyber Compliance and Operational Risk Office (TCCORO) serves as the second line of defense. This office independently evaluates and challenges Citi’s risk mitigation practices and capabilities, from a fused operational risk and compliance lens. It functions as a joint second line of defense and in accordance with Citi’s Cybersecurity Risk Appetite Statement. TCCORO also advises first line partners in CISO, supporting enterprise-wide efforts to proactively identify and remediate cybersecurity risks before they materialize as incidents that negatively affect business operations.

To address evolving cybersecurity risks and corresponding regulations, TCCORO monitors cybersecurity legal and regulatory requirements, identifies and defines emerging risks, executes strategic cybersecurity threat assessments, performs new product and initiative reviews, performs data management risk oversight and conducts cybersecurity risk assurance reviews (inclusive of third-party assessments). In addition, this office oversees and challenges metrics related to cybersecurity and technology and ensures they remain aligned with Citi’s overall operational risk management framework to effectively track, identify and manage risk. TCCORO presents an independent viewpoint on enterprise cybersecurity risk posture, and oversees CISO’s cybersecurity risk identification, measurement and enterprise-wide governance of cybersecurity risk.

Internal Audit serves as Citi’s third line of defense and provides independent assurance to the Audit Committee of the Board on the effectiveness of controls operated by the first and second lines of defense to manage cybersecurity risk.

Citi recognizes the risks associated with outsourcing services to, sharing data with, and/or technologically interacting with third parties. Citi has built a robust third-party information security risk management program that governs third-party engagements from selection, to the establishment of legal agreements that govern the relationship, to ongoing monitoring through the duration of the relationship. Third-party risk management includes contractual requirements around data and cybersecurity, vulnerability assessments, third-party information security assessments performed at intervals determined by risk, governance to manage end-of-life and end-of-vendor-support risks, and third-party incident response protocols.

Management Governance

Citi’s Head of Operations and Technology (O&T), who reports directly to Citi’s CEO, has overall responsibility for Citi’s first line of defense cyber and information security and technology programs. Citi’s Head of O&T has over 40 years of experience in financial services and technology focused roles, including prior positions at Citi as a regional Chief Information Officer, Head of Technology for Citi’s former Institutional Clients Group and Head of Securities and Banking Operations and Technology. For additional information, see “Corporate Information—Executive Officers” below.

Citi’s CISO, who reports directly to Citi’s Head of O&T, has primary responsibility to assess and manage Citi’s material risks from cybersecurity threats. Citi’s CISO has decades of experience in managing cybersecurity risks from prior roles as Deutsche Bank’s Chief Security Officer, the Chief Information Officer for the Central Intelligence Agency and the Chief Information Officer for the U.S. Intelligence Community. The CISO is supported by a team of subject matter experts in security operations, network architecture, cyber and information security governance and cybersecurity operations. Citi’s Chief Information Security Office employs approximately 3,400 individuals to manage its operations.

Citi’s Chief Technology Officer (CTO), who also reports directly to Citi’s Head of O&T, has primary responsibility for technology policy, innovation enablement and strategy. Citi’s CTO has decades of subject matter experience in financial services and technology from previously leading the Engineering and Architecture Services group at J.P. Morgan Chase, and serving as the Chief Technology Officer at Deutsche Bank and the Chief Information Officer for Sales, Research and Securities Data Services at Goldman Sachs.

Multiple management committees and functions also support Citi’s cyber and information security management.

Citi’s Information Security Risk Committee (ISRC) governs enterprise-level risk tolerance, including cybersecurity risk. This committee serves as the most senior cyber and information security forum within Citi and is supported by other committees/forums described below. The committee is

co-chaired by Citi’s Chief Risk Officer and Head of O&T and meets at least quarterly. In addition, the committee oversees risk tolerance determinations, reviews emerging threats and their business impacts, commits to appropriate resource levels and investments and supports the continual improvement of the cyber and information security management programs across all of Citi’s businesses and geographies.

The Chief Information Officer Committee (CIOC), which consists of, among others, the Head of O&T, Citi’s Co-Chief Information Officers (who report to the Head of O&T), the CISO, and the Head of TCCORO (who reports both to Citi’s Head of Operational Risk within the Risk Organization and its Head of Global Functions Compliance within the Global Legal and Compliance Organization), serves as an escalation forum for items requiring the attention of technology senior management, including approval of policies, and reports items requiring further escalation to the Technology Committee of the Board of Directors, as appropriate.

The Information Security Risk Operating Committee (ISROC) is chaired by the CISO and comprises senior members of the Chief Information Security Office and representatives from partner organizations. This committee sets the direction and prioritization for the implementation of the cyber and information security program across Citi. The committee reports and escalates to the CIOC, including for intermediary review and approval of policies escalated from the Information Technology Policy Council (see below). Any actions constituting risk exceptions are escalated to the ISRC.

The Security Architecture Council, which reports to the ISROC, is an oversight and decision-making body focused on ensuring that the target level of security architectural maturity is attained. This council is co-chaired by two representatives from the security architecture and cybersecurity services organizations.

Citi’s Information Technology Policy Council provides a centralized review to oversee consistency in the formation of information technology policies and standards. This counsel maintains oversight of policy document requirements to ensure that information technology policy documents meet Citi’s objectives as established internally and are in line with laws and regulations as identified and communicated by ICRM.

In addition, Citi regularly engages third parties globally to assess, audit and/or exercise Citi’s cyber and information security program, which is ISO-27001 certified. ISO-27001 is an international standard for information security management systems. Citi is regulated by bodies across the globe that also regularly examine and audit Citi’s cyber and information security program against local laws, regulations and industry best practices.

Board Governance

Citi’s Board of Directors and its committees provide oversight of senior management’s efforts to mitigate cybersecurity risk and respond to cybersecurity incidents. Citi’s Board includes members with cybersecurity expertise and experience.

Citi’s full Board is briefed annually on cybersecurity risks and receives updates as needed on Citi’s cyber and information security program, including changes to the threat landscape and a roadmap for progress around addressing related risks. Additionally, Citi’s Board participates in cybersecurity exercises to improve preparedness to address cybersecurity incidents.

The Board’s Technology Committee receives quarterly updates from the Chief Information Security Office on the cybersecurity threat landscape, regulatory landscape, posture, and strategy and engages in discussions throughout the year with senior management and subject matter experts on the effectiveness of Citi’s overall cybersecurity program.

The Board’s Risk Management Committee (RMC) approved a standalone Cybersecurity Risk Appetite Statement against which Citi’s performance is measured quarterly. In addition, the RMC oversees Citi’s risk profile, which includes cybersecurity risk, and monitors whether Citi is operating within its cybersecurity risk appetite under its mandate to review key operational risks, including steps taken by management to control such risks.

In the event of a potentially material cybersecurity incident impacting Citi, the Board would be made aware of such incident via lines of communication that run from the Chief Information Security Office to senior management and also to the Board. This contemporaneous reporting on significant cyber events includes information and discussion around incident response, legal obligations (including disclosure), and outreach and notification to regulators and customers when needed.

For additional information on the Board’s oversight of cybersecurity risk management, see Citi’s upcoming 2024 Annual Meeting Proxy Statement to be filed with the SEC in March 2024.

COMPLIANCE RISK

Compliance risk is the risk to current or projected financial condition and resilience arising from violations of laws, rules or regulations, or from non-conformance with prescribed practices, internal policies and procedures or ethical standards. Compliance risk exposes Citi to fines, civil money penalties, payment of damages and the voiding of contracts. Compliance risk can result in diminished reputation, harm to Citi’s customers, limited business opportunities and lessened expansion potential. It encompasses the risk of noncompliance with all laws and regulations, as well as prudent ethical standards and some contractual obligations. It could also include exposure to litigation (known as legal risk) from all aspects of traditional and non-traditional banking.

Citi seeks to operate with integrity, maintain strong ethical standards and adhere to applicable policies and regulatory and legal requirements. Citi must maintain and execute a proactive Compliance Risk Management (CRM) Framework (as set forth in the CRM Policy) that is designed to manage compliance risk effectively across Citi, with a view to fundamentally strengthen the compliance risk management culture across the lines of defense taking into account Citi’s risk governance framework and regulatory requirements.

Independent Compliance Risk Management’s (ICRM) primary objectives are to:

•Drive and embed a culture of compliance and control throughout Citi;

•Maintain and oversee an integrated CRM Framework that facilitates enterprise-wide compliance with local, national or cross-border laws, rules or regulations, Citi’s internal policies, standards and procedures and relevant standards of conduct;

•Assess compliance risks and issues across product lines, functions and geographies, supported by globally consistent systems and compliance risk management processes; and

•Provide compliance risk data aggregation and reporting capabilities.

Citi carries out its objectives and fulfills its responsibilities through the CRM Framework, which is composed of the following integrated key activities, to holistically manage compliance risk:

•Management of Citi’s compliance with laws, rules and regulations by identifying and analyzing changes, assessing the impact, and implementing appropriate policies, processes and controls;

•Developing and providing compliance training to ensure colleagues are aware of and understand the key laws, rules and regulations;

•Monitoring the Compliance Risk Appetite, which is articulated through qualitative compliance risk statements describing Citi’s appetite for certain types of risk and quantitative measures to monitor the Company’s compliance risk exposure;

•Executing Compliance Risk Assessments, the results of which inform Compliance Risk Monitoring and testing of compliance risks and controls in assessing conformance with laws, rules, regulations and internal policies; and

•Issue identification, escalation and remediation to drive accountability, including measurement and reporting of compliance risk metrics against established thresholds in support of the CRM Policy and Compliance Risk Appetite.

To anticipate, control and mitigate compliance risk, Citi has established the CRM Policy to achieve standardization and centralization of methodologies and processes, and to enable more consistent and comprehensive execution of compliance risk management.

Citi has a commitment, as well as an obligation, to identify, assess and mitigate compliance risks associated with its businesses and functions. ICRM is responsible for oversight of Citi’s CRM Policy, while all businesses and global control functions are responsible for managing their compliance risks and operating within the Compliance Risk Appetite.

As discussed above, Citi is working to address the FRB and OCC consent orders, which include improvements to Citi’s CRM Framework and its enterprise-wide application (see “Citi’s Consent Order Compliance” above).

REPUTATION RISK

Citi’s reputation is a vital asset in building trust, and Citi is diligent in enhancing and protecting its reputation with its key stakeholders. To support this, Citi has developed a reputation risk framework. Under this framework, Citigroup and Citibank, N.A. have implemented a risk appetite statement and related key indicators to monitor corporate activities and operations relative to Citi’s risk appetite. The framework also requires that business segments escalate potential material reputation risks that require review or mitigation through the applicable business Management Forum or Group Reputation Risk Committee.

The Group Reputation Risk Committee and Management Forums, which are composed of Citi’s senior executives, govern the process by which material reputation risks are identified, measured, monitored, controlled, escalated and reported. The Group Reputation Risk Committee and Management Forums determine the appropriate actions to be taken in line with risk appetite and regulatory expectations, while promoting a culture of risk awareness and high standards of integrity and ethical behavior across the Company, consistent with Citi’s Mission and Value Proposition. The Group Reputation Risk Committee may escalate reputation risks to the Nomination, Governance and Public Affairs Committee or other appropriate committee of the Citigroup Board of Directors.

Every Citi employee is responsible for safeguarding Citi’s reputation, guided by Citi’s Code of Conduct. Colleagues are expected to exercise sound judgment and common sense in decisions and actions. They are also expected to promptly escalate all issues that present material reputation risk in line with policy.

STRATEGIC RISK

As discussed above, strategic risk is the risk of a sustained impact (not episodic impact) to Citi’s core strategic objectives as measured by impacts on anticipated earnings, market capitalization or capital, arising from external factors affecting the Company’s operating environment, as well as the risks associated with defining and executing the strategy, which are identified, measured and managed as part of the Strategic Risk Framework at the Enterprise Level.

In this context, external factors affecting Citi’s operating environment are the economic conditions, geopolitical/political landscape, industry/competitive landscape, customer/client behavior, regulatory/legislative environment and trends related to investors/shareholders. Material strategic risks that Citi is monitoring include the impacts of an extended period of high inflation and interest rates, as well as macroeconomic uncertainties driven by low global growth and geopolitical issues including the Middle East conflict, the Russia–Ukraine war and U.S.–China tensions. Heightened regulatory requirements, specifically with regard to capital as well as climate-related transition risk, remain in focus. In addition to external factors affecting Citi’s operating environment, Citi also monitors risks related to the execution of its strategy, with heightened focus on delivering the transformation of its risk and control environment pursuant to the FRB and OCC consent orders.

Citi’s Executive Management Team is responsible for the development and execution of Citi’s strategy. This strategy is translated into forward-looking plans (collectively Citi’s Strategic Plan) that are then cascaded across the organization. Citi’s Strategic Plan is presented to the Board on an annual basis, and is aligned with risk appetite thresholds and includes a risk assessment as required by internal frameworks. It is also aligned with limit requirements for capital allocation. Governance and oversight of strategic risk is facilitated by internal committees on a group-wide basis.

Citi works to ensure that strategic risks are adequately considered and addressed across its various risk management activities, and that strategic risks are assessed in the context of Citi’s risk appetite. Citi conducts a top-down, bottom-up risk identification process to identify risks, including strategic risks. Business segments undertake a quarterly risk identification process to systematically identify and document all material risks faced by Citi. Independent Risk Management oversees the risk identification process through regular reviews and coordinates identification and monitoring of top risks. In addition, Citi performs a quarterly Risk Assessment of the Plan (RAOP) and continuously monitors risks associated with its execution of strategy. Independent Risk Management also manages strategic risk by monitoring risk appetite thresholds in conjunction with its Global Strategic Risk Committee, which is part of the governance structure that Citi has in place to manage its strategic risks.

For additional information on Citi’s strategic risks, see “Risk Factors—Strategic Risks” above.

Climate Risk

Climate change presents immediate and long-term risks to Citi and its clients and customers, with the risks expected to increase over time. Climate risk refers to the risk of loss arising from climate change and comprises both physical risk and transition risk.

Climate risk is an overarching risk that can act as a driver of other categories of risk, such as credit risk from obligors exposed to high climate risk, strategic risks if Citi fails to consider transition risk in client selection, reputational risk from increased stakeholder concerns about financing or failing to finance high-carbon industries and operational risk from physical risks to Citi’s facilities. Citi’s focus on climate risk continues to advance, driven by materiality of strategic, reputation and financial risk considerations. Citi continues to make progress toward embedding these considerations into its overarching risk management approach. For additional information on climate risk, see “Risk Factors—Strategic Risks” above.

Citi continues to develop globally consistent principles and approaches for managing climate risk across the Company through the implementation of its Climate Risk Management Framework (Climate RMF). The Climate RMF provides information on the governance, roles and responsibilities, and principles to support the identification, measurement, monitoring, controlling and reporting of climate risks. Through this implementation, climate risk is being embedded into relevant policies and processes over time.

Citi continues to enhance its methodologies for quantifying how climate risks could impact the individual credit profiles of its clients across various sectors. Citi has developed and embedded sector-specific climate risk assessments in its credit underwriting process for certain sectors that Citi has identified as higher climate risk. Such climate risk assessments are designed to incorporate publicly available client disclosures and data from third-party providers and facilitate conversations with clients on their most material climate risks and management plans for adaptation and mitigation. This helps Citi better understand its clients’ businesses and climate-related risks and support their financial needs. Citi’s Net Zero plan implementation is leading to the further integration of climate risk discussions into client engagement and client selection.

Citi also reviews factors related to climate risk under its Environmental and Social Risk Management (ESRM) Policy, which includes a focus on climate risk related to financed projects and clients in certain sectors. Considering the credit risk of stranded assets, as well as the reputational risks, Citi’s ESRM Policy describes sector approaches to certain high-carbon sectors, including thermal coal mining and power.

Furthermore, Citi continues to participate in financial industry initiatives and develop and pilot methodologies and approaches for measuring and assessing the potential financial risks of climate change, including scenario analysis. Citi also continues to monitor regulatory developments on climate risk and sustainable finance and actively engage with regulators on these topics.

For additional information about sustainability and other ESG matters at Citi, see “Climate Change and Net Zero” above.

OTHER RISKS

LIBOR Transition Risk

As previously disclosed, the USD LIBOR bank panel ended on June 30, 2023. The overnight and 12-month USD LIBOR settings have permanently ceased, and the Financial Conduct Authority is requiring ICE Benchmark Administration to continue publishing one-, three- and six-month USD LIBOR settings using a synthetic methodology, which is based on the relevant CME Term SOFR Reference Rate plus the respective ISDA fixed spread adjustment. These synthetic settings are expected to cease on September 30, 2024. As previously disclosed, as of June 30, 2023, Citi transitioned nearly all of its USD LIBOR-referencing contracts to SOFR plus a credit spread adjustment. There remain a de minimis number of unremediated USD LIBOR-referencing contracts that are temporarily utilizing synthetic LIBOR, and Citi is continuing to focus on remediating these remaining contracts.

Country Risk

Top 25 Country Exposures

The following table presents Citi’s top 25 exposures by country (excluding the U.S.) as of December 31, 2023. (Including the U.S., Citi’s top 25 exposures by country would represent approximately 99% of Citi’s exposure to all countries as of December 31, 2023.)

For purposes of the table, loan amounts are reflected in the country where the loan is booked, which is generally based on the domicile of the borrower. For example, a loan to a Chinese subsidiary of a Switzerland-based corporation will generally be categorized as a loan in China. In addition, Citi has developed regional booking centers in certain countries, most significantly in the United Kingdom (U.K.) and Ireland,

in order to more efficiently serve its corporate customers. As an example, with respect to the U.K., only 39% of corporate loans presented in the table below are to U.K. domiciled entities (42% for unfunded commitments), with the balance of the loans predominately to European domiciled counterparties. Approximately 90% of the total U.K. funded loans and 88% of the total U.K. unfunded commitments were investment grade as of December 31, 2023.

Trading account assets and investment securities are generally categorized based on the domicile of the issuer of the security of the underlying reference entity. For additional information on the assets included in the table, see the footnotes to the table below.

(1)Wealth loans reflect funded loans, including those related to the Private Bank, net of unearned income. As of December 31, 2023, Private Bank loans in the table above totaled $19.3 billion, concentrated in Singapore ($5.4 billion), the U.K. ($5.2 billion) and Hong Kong ($3.8 billion).

(2) Other funded includes other direct exposures such as accounts receivable and investments accounted for under the equity method.

(3) Unfunded exposure includes unfunded corporate lending commitments, letters of credit and other contingencies.

(4) Net mark-to-market (MTM) counterparty risk on OTC derivatives and securities lending/borrowing transactions (repos). Exposures are net of collateral and inclusive of CVA. Also includes margin loans.

(5) Investment securities include debt securities AFS, recorded at fair market value, and debt securities HTM, recorded at amortized cost.

(6) Trading account assets are on a net basis and include issuer risk on cash products and derivative exposure where the underlying reference entity/issuer is located in that country.

(7) December 31, 2023, September 30, 2023 and December 31, 2022 include All Other—Legacy Franchises loans reclassified to HFS as a result of Citi’s agreement to sell its consumer banking business in each applicable country. See “All Other—Legacy Franchises” above and Note 2.

Russia

In Russia, Citi’s remaining operations are conducted through Services, Markets, Banking and All Other—Legacy Franchises. Citi continues to monitor the war in Ukraine, related sanctions and economic conditions and continues to mitigate its Russia exposures and risks as appropriate.

As part of previously disclosed plans, Citi ended nearly all of the institutional banking services it offered in Russia, with the remaining services only those necessary to fulfill its remaining legal and regulatory obligations. In addition, Citi significantly reduced its All Other—Legacy Franchises consumer loan portfolio in Russia (reported as part of Asia Consumer), largely due to loan portfolio sales and its entry into a credit card referral agreement with a Russian bank.

Citi has ceased soliciting any new business or new clients in Russia. Citi will continue to manage its existing legal and regulatory commitments and obligations, as well as support its employees, during this period. For additional information on Citi’s wind-down of its Russia operations, see “Citi’s Wind-Down of Its Russia Operations” below.

For additional information about Citi’s risks related to its Russia exposures, see “Risk Factors—Market-Related Risks,” “—Operational Risks” and “—Other Risks” above.

Impact of Russia’s Invasion of Ukraine on Citi’s Businesses

Russia-related Balance Sheet Exposures

Citi’s remaining domestic operations in Russia are conducted through a subsidiary of Citibank, AO Citibank, which uses the Russian ruble as its functional currency.

The following table summarizes Citi’s exposures related to its Russia operations:

(1) Investment securities include debt securities AFS, recorded at fair market value, primarily local government debt securities.

(2) Reverse repurchase agreements are gross of collateral and are included in net MTM on derivatives/repos in the table above, as netting of collateral for Russia-related reverse repurchase agreements was removed in the second quarter of 2022. This removal was due to the inability to conclude, with a well-founded basis, the enforceability of contractual rights in the Russian legal system in the event of a counterparty default, given the geopolitical uncertainty caused by the war in Ukraine.

(3) Unfunded exposure consists of unfunded corporate lending commitments, letters of credit and other contingencies.

(4) Cash on deposit and placements are primarily with the Central Bank of Russia and foreign financial institutions.

(5) Represents dividends received by Citi in its role as custodian for investor clients in Russia, which Citi is required by local regulation to hold at the Deposit Insurance Agency (DIA). Citi is unable to remit these funds to clients due to restrictions imposed by the Russian government. In accordance with a Central Bank of Russia regulatory requirement, all balances in the National Settlements Depository were transferred to the DIA in the second quarter of 2023.

(6) The majority of AO Citibank’s third-party exposures was funded with the dividends under footnote 5 and domestic deposit liabilities from both corporate and personal banking clients.

(7) Citigroup’s CTA loss included in its AOCI related to its indirect subsidiary, AO Citibank, is excluded from the above table, because the CTA loss is not held in AO Citibank and would be recognized in Citigroup’s earnings only upon either the substantial liquidation or a loss of control of AO Citibank. Citi has separately described these risks in “Deconsolidation Risk” below.

During the fourth quarter of 2023, Citi’s Russia-related exposures increased by $0.7 billion, as presented in the table above. The increase in exposure was drivenby a $0.4 billion appreciation of the ruble against the U.S. dollar (USD) as well as dividend inflows during the quarter, received from Russian corporations on behalf of Citi’s clients. The dividend inflows were partially offset by deposit outflows and tax payments to local authorities. Approximately 71% of Citi’s remaining exposures in Russia are corporate dividends that Citi cannot remit to its clients due to restrictions imposed by the Russian government, of which $3.9 billion is held with the Deposit Insurance Agency as of December 31, 2023.

Citi’s net investment in Russia was approximately $0.2 billion as of December 31, 2023 (down from $1.0 billion as of September 30, 2023). The decline was due to a reserve build related to increases in transfer risk associated with exposures in Russia driven by safety and soundness considerations under U.S. banking law (see “Significant Accounting Policies and Significant Estimates” below).

Citi hedges its ruble/USD spot FX exposure in AOCI through the purchase of FX derivatives. The ongoing mark-to-market of the hedging derivatives is also reported in AOCI. When the ruble depreciates against the USD, the USD equivalent value of Citigroup’s investment in AO Citibank also declines. This change in value is offset by the change in value of the hedging instrument (FX derivative). Going forward, Citi may record devaluations on its net ruble-denominated assets in earnings, without the benefit from a change in the fair value of derivative positions used to economically hedge the exposures.

Earnings and Other Impacts on Citi’s Businesses

Services, Markets, Banking, USPB and All Other results have been impacted by various macroeconomic factors and volatilities, including Russia’s invasion of Ukraine and its direct and indirect impact on the European and global economies. For a broader discussion of these factors and volatilities on Citi’s businesses, see “Executive Summary” and each business’s results of operations above.

As of December 31, 2023, Citigroup’s ACL included a $0.1 billion remaining credit reserve for Citi’s direct Russian counterparties (unchanged from September 30, 2023). This balance does not include the additional reserves to transfer risk for exposures in Russia.

Citi’s Wind-Down of Its Russia Operations

In August 2022, Citi disclosed its decision to wind down its Russia consumer, local commercial and institutional banking businesses, including actively pursuing portfolio sales. In connection with this wind-down, Citi has incurred approximately $63 million to-date in charges, largely from restructuring, vendor termination fees and other related charges. Citi expects to incur an additional approximate $58 million in estimated charges (approximately $2 million in Services, Markets and Banking and $56 million in All Other, excluding the impact from any portfolio sales). This estimate was revised down during the fourth quarter of 2023 from $85 million at September 30, 2023. For additional information about Citi’s continued efforts to reduce its operations and exposure in Russia, see “Risk Factors” above and Note 2.

Deconsolidation Risk

Citi’s remaining operations in Russia subject it to various risks, including, among others, foreign currency volatility, including appreciation or devaluation; restrictions arising from retaliatory Russian laws and regulations on the conduct of its business; sanctions or asset freezes; or other deconsolidation events (see “Risk Factors—Other Risks” above). Examples of triggers that may result in deconsolidation of AO Citibank include voluntary or forced sale of ownership or loss of control due to actions of relevant governmental authorities, including expropriation (i.e., the entity becomes subject to the complete control of a government, court, administrator, trustee or regulator); revocation of banking license; and loss of ability to elect a board of directors or appoint members of senior management. As of December 31, 2023, Citi continued to consolidate AO Citibank because none of the deconsolidation factors were triggered.

In the event Citi deems there is a loss of control, for example, through expropriation of AO Citibank, Citi’s foreign entity in Russia, Citi would be required to (i) write off the net investment of approximately $0.2 billion (compared to $1.0 billion as of September 30, 2023), (ii) recognize a CTA loss of approximately $1.6 billion (unchanged from September 30, 2023) through earnings, and (iii) recognize a loss of $0.6 billion (unchanged from September 30, 2023) on intercompany liabilities owed by AO Citibank to other Citi entities outside Russia. In the sole event of a substantial liquidation, as opposed to a loss of control, Citi would be required to recognize the CTA loss of approximately $1.6 billion through earnings and would evaluate its remaining net investment as circumstances evolve.

Citi as Paying Agent for Russia-related Clients

Citi serves or served as paying agent on bonds issued by various entities in Russia, including Russian corporate clients. Citi’s role as paying agent is administrative. In this role, Citi acts as an agent of its client, the bond issuer, receiving interest and principal payments from the bond issuer and then making payments to international central securities depositories (e.g., Depository Trust Company, Euroclear, Clearstream). The international central securities depositories (ICSDs) make payments to those participants or account holders (e.g., broker/dealers) that have clients who are investors in the applicable bonds (i.e., bondholders). As a paying agent, Citi generally does not have information about the identity of the bondholders. Citi may be exposed to risks due to its responsibilities for receiving and processing payments on behalf of its clients as a result of sanctions or other governmental requirements and prohibitions. To mitigate operational and sanctions risks, Citi has established policies, procedures and controls for client relationships and payment processing to help ensure compliance with U.S., U.K., EU and other jurisdictions’ sanctions laws.

These processes may require Citi to delay or withhold the processing of payments as a result of sanctions on the bond issuer. Citi is also prevented from making payments to accounts on behalf of bondholders should the ICSDs disclose to Citi the presence of sanctioned bondholders. In both instances, Citi is generally required to segregate, restrict or block the funds until applicable sanctions are lifted or the payment is otherwise authorized under applicable law.

Reputational Risks

Citi has continued its efforts to enhance and protect its reputation with its colleagues, clients, customers, investors, regulators and the public. Citi’s response to the war in Ukraine, including any action or inaction, may have a negative impact on Citi’s reputation with some or all of these parties.

For example, Citi is exposed to reputational risk as a result of its remaining presence in Russia and association with Russian individuals or entities, whether subject to sanctions or not, including Citi’s inability to support its global clients in Russia, which could adversely affect its broader client relationships and businesses; current involvement in transactions or supporting activities involving Russian assets or interests; failure to correctly interpret and apply laws and regulations, including those related to sanctions; perceived misalignment of Citi’s actions to its stated strategy in Russia; and the reputational impact from Citi’s activity and engagement with Ukraine or with non-Russian clients exiting their Russia businesses.

While Citi announced its intention to wind down its businesses in Russia, Citi will continue to manage those operations during the wind-down process and will be required to maintain certain limited operations to fulfill its remaining legal and regulatory obligations. Also, sanctions and sanctions compliance are highly complex and may change over time and result in increased operational risk. Failure to fully comply with relevant sanctions or the application of sanctions where they should not be applied may negatively impact Citi’s reputation. In addition, Citi currently performs services for, conducts business with or deals in non-sanctioned Russian-owned businesses and Russian assets. This has attracted, and will likely continue to attract, negative attention, despite the previously disclosed plan to wind down nearly all its activities in the country, cessation of new business and client originations, and reduction of other exposures.

Citi’s continued presence or divestiture of businesses in Russia could also increase its susceptibility to cyberattacks that could negatively impact its relationships with clients and customers, harm its reputation, increase its compliance costs and adversely affect its business operations and results of operations. For additional information on operational and cyber risks, see “Risk Factors—Operational Risks” above.

Board’s Role in Overseeing Related Risks

The Citi Board of Directors (Board) and the Board’s Risk Management Committee (RMC) and its other Committees have received and continue to receive regular reports from senior management regarding the war in Ukraine and its impact on Citi’s operations in Russia, Ukraine and elsewhere, as well as the war’s broader geopolitical, macroeconomic and reputational impacts. The reports to the Board and its Committees from senior management who represent the impacted businesses and the International region, Independent Risk Management, Finance, Independent Compliance Risk Management, including those individuals responsible for sanctions compliance, and Human Resources, have included detailed information regarding financial impacts, impacts on

capital, cybersecurity, strategic considerations, sanctions compliance, employee assistance and reputational risks, enabling the Board and its Committees to properly exercise their oversight responsibilities. In addition, senior management has also provided updates to Citi’s Executive Management Team and the Board, outside of formal meetings, regarding Citi’s Russia-related risks, including with respect to cybersecurity matters.

Ukraine

Citi has continued to operate in Ukraine throughout the war through its Services, Marketsand Banking businesses, serving the local subsidiaries of multinationals, along with local financial institutions and the public sector. Citi employs approximately 230 people in Ukraine and their safety is Citi’s top priority. All of Citi’s domestic operations in Ukraine are conducted through a subsidiary of Citibank, which uses the Ukrainian hryvnia as its functional currency. As of December 31, 2023, Citi had $1.5 billion of direct exposures related to Ukraine, unchanged from September 30, 2023.

Argentina

Citi operates in Argentina through its Services, Markets and Banking businesses. As of December 31, 2023, Citi’s net investment in its Argentine operations was approximately $1.0 billion (compared to $1.9 billion at September 30, 2023). Citi uses the U.S. dollar (USD) as the functional currency for its operations in countries such as Argentina that are deemed highly inflationary in accordance with GAAP. Citi therefore records the impact of exchange rate fluctuations on its net Argentine peso (ARS)–denominated assets directly in earnings. Citi uses Argentina’s official market exchange rate to remeasure its net ARS-denominated assets into USD. As of December 31, 2023, the official ARS exchange rate was 808.48, which devalued by 57% against the USD during the fourth quarter of 2023.

The decline in Citi’s net investment in Argentina during the fourth quarter of 2023 was primarily a result of approximately $880 million in translation losses in revenues due to devaluation of the ARS (approximately $1.9 billion in

aggregate translation losses in revenues for full-year 2023,

compared to approximately $820 million for full-year 2022). The decline in the net investment was also due to reserve builds in the quarter related to increases in transfer risk associated with exposures in Argentina driven by safety and soundness considerations under U.S. banking law. These reductions in the net investment were partially offset by aggregate other net income, consisting of net interest income in Argentina, and interest earned on the net investment, of which a significant portion is invested at high local overnight rates in Argentina.

The Central Bank of Argentina has continued to maintain certain capital and currency controls that generally restrict Citi’s ability to access USD in Argentina and remit earnings from its Argentine operations. Citi’s net investment in Argentina will therefore continue to be exposed to additional foreign currency translation losses to the extent it is denominated in ARS and is unable to be remitted or exchanged. Furthermore, the capital and currency controls have resulted in indirect foreign exchange mechanisms that some Argentine entities may use to obtain USD, generally at rates that are significantly higher than Argentina’s official exchange rate. Citibank Argentina is precluded from accessing these alternative mechanisms, and under U.S. GAAP, these exchange mechanisms cannot be used to re-measure Citi’s net monetary assets into USD. If Argentina’s official exchange rate further converges with the approximate rate implied by the indirect foreign exchange mechanisms, Citi could incur additional translation losses on its net investment in Argentina. Accordingly, Citi seeks to reduce its overall ARS exposure in Argentina while complying with local capital and currency exposure limitations.

Of the $1.0 billion net investment in Argentina as of December 31, 2023, Citi’s net ARS exposure was approximately $0.4 billion. The net ARS exposure is reduced as a result of Citi holding approximately $100 million of USD-denominated loans as well as approximately $500 million of certain local government bonds that are indexed to the higher of the USD exchange rate or the local inflation index. If Citi had not invested in such instruments to reduce its ARS exposure, Citi would have recognized additional translation losses during the fourth quarter of 2023. Given current economic conditions and the local capital, currency and regulatory limitations, Citi cannot guarantee the availability or effectiveness of such mechanisms to reduce its ARS exposure in the future.

In addition to reducing the ARS exposure, Citi also seeks to economically hedge the exposure to the extent possible and prudent using non-deliverable forward (NDF) derivative instruments that are primarily executed outside of Argentina. As of December 31, 2023, the international NDF market had very limited liquidity, resulting in Citi’s inability to economically hedge its remaining net ARS exposure. Accordingly, and to the extent that Citi does not execute NDF contracts for this unhedged exposure in the future, Citi would record devaluations on its net ARS-denominated assets in earnings, without any benefit from a change in the fair value of derivative positions used to economically hedge the exposure. Citi cannot predict the availability of hedging instruments in the future nor can it predict changes in foreign exchange rates and the resulting impact on earnings.

Citi continually evaluates its economic exposure to its Argentine counterparties and reserves for changes in credit risk and records mark-to-market adjustments for relevant market risks associated with its Argentine assets. Citi believes it has established an appropriate ACL on its Argentine loans, and appropriate fair value adjustments on Argentine assets and liabilities measured at fair value, for credit and sovereign risks under U.S. GAAP as of December 31, 2023. For additional information on Citi’s emerging markets risks, including those related to its Argentine exposures, see “Risk Factors—Strategic Risks” above.

FFIEC—Cross-Border Claims on Third Parties and Local Country Assets

Citi’s cross-border disclosures are presented below, based on the country exposure bank regulatory reporting guidelines of the Federal Financial Institutions Examination Council (FFIEC). The following summarizes some of the key FFIEC reporting guidelines:

•Amounts are based on the domicile of the ultimate obligor, counterparty, collateral (only including qualifying liquid collateral), issuer or guarantor, as applicable (e.g., a security recorded by a Citi U.S. entity but issued by the U.K. government is considered U.K. exposure; a loan recorded by a Citi Mexico entity to a customer domiciled in Mexico where the underlying collateral is held in Germany is considered German exposure).

•Amounts do not consider the benefit of collateral received for secured financing transactions (i.e., repurchase agreements, reverse repurchase agreements and securities loaned and borrowed) and are reported based on notional amounts.

•Netting of derivative receivables and payables, reported at fair value, is permitted, but only under a legally binding netting agreement with the same specific counterparty, and does not include the benefit of margin received or hedges.

•Credit default swaps (CDS) are included based on the gross notional amount sold and purchased and do not include any offsetting CDS on the same underlying entity.

•Loans are reported without the benefit of hedges.

Given the requirements noted above, Citi’s FFIEC cross-border exposures and total outstandings tend to fluctuate, in some cases significantly, from period to period. As an example, because total outstandings under FFIEC guidelines do not include the benefit of margin or hedges, market volatility in interest rates, foreign exchange rates and credit spreads may cause significant fluctuations in the level of total outstandings, all else being equal.

The tables below present each country whose total outstandings exceeded 0.75% of total Citigroup assets:

(1) Non-bank financial institutions.

(2) Included in total outstanding.

(3) Total outstanding includes cross-border claims on third parties, as well as local country assets. Cross-border claims on third parties include cross-border loans, securities, deposits with banks and other monetary assets, as well as net revaluation gains on foreign exchange and derivative products.

(4) Commitments (not included in total outstanding) include legally binding cross-border letters of credit and other commitments and contingencies as defined by the FFIEC guidelines. The FFIEC definition of commitments includes commitments to local residents to be funded with local currency liabilities originated within the country.

(5) Credit default swaps (CDS) are not included in total outstanding.

SIGNIFICANT ACCOUNTING POLICIES AND SIGNIFICANT ESTIMATES

This section contains a summary of Citi’s most significant accounting policies. Note 1 contains a summary of all of Citigroup’s significant accounting policies. These policies, as well as estimates made by management, are integral to the presentation of Citi’s results of operations and financial condition. While all of these policies require a certain level of management judgment and estimates, this section highlights and discusses the significant accounting policies that require management to make highly difficult, complex or subjective judgments and estimates at times regarding matters that are inherently uncertain and susceptible to change (see also “Risk Factors—Operational Risks” above). Management has discussed each of these significant accounting policies, the related estimates and its judgments with the Audit Committee of the Citigroup Board of Directors.

Valuations of Financial Instruments

Citigroup holds debt and equity securities, derivatives, retained interests in securitizations, investments in private equity and other financial instruments. A portion of these assets and liabilities is reflected at fair value on Citi’s Consolidated Balance Sheet as Trading account assets, Available-for-sale securitiesand Trading account liabilities.

Citi purchases securities under agreements to resell (reverse repos or resale agreements) and sells securities under agreements to repurchase (repos), a substantial portion of which is carried at fair value. In addition, certain loans, short-term borrowings, long-term debt and deposits, as well as certain securities borrowed and loaned positions that are collateralized with cash, are carried at fair value. Citigroup holds its investments, trading assets and liabilities, and resale and repurchase agreements on Citi’s Consolidated Balance Sheet to meet customer needs and to manage liquidity needs, interest rate risks and private equity investing.

When available, Citi generally uses quoted market prices to determine fair value and classifies such items within Level 1 of the fair value hierarchy established under ASC 820-10, Fair Value Measurement. If quoted market prices are not available, fair value is based on internally developed valuation models that use, where possible, current market-based or independently sourced market parameters, such as interest rates, currency rates and option volatilities. Such models are often based on a discounted cash flow analysis. In addition, items valued using such internally generated valuation techniques are classified according to the lowest level input or value driver that is significant to the valuation. Thus, an item may be classified under the fair value hierarchy as Level 3 even though there may be some significant inputs that are readily observable.

Citi is required to exercise subjective judgments relating to the applicability and functionality of internal valuation models, the significance of inputs or drivers to the valuation of an instrument and the degree of illiquidity and subsequent lack of observability in certain markets. The fair value of these instruments is reported on Citi’s Consolidated Balance Sheet with the changes in fair value recognized in either the Consolidated Statement of Income or in AOCI.

Losses on available-for-sale securities whose fair values are less than the amortized cost, where Citi intends to sell the security or could more-likely-than-not be required to sell the security prior to recovery, are recognized in earnings. Where Citi does not intend to sell the security nor could more-likely-than-not be required to sell the security, any portion of the loss that is attributable to credit is recognized as an allowance for credit losses with a corresponding provision for credit losses, and the remainder of the loss is recognized in AOCI. Such losses are capped at the difference between the fair value and amortized cost of the security.

For equity securities carried at cost or under the measurement alternative, decreases in fair value below the carrying value are recognized as impairment in the Consolidated Statement of Income. Moreover, for certain equity method investments, decreases in fair value are only recognized in earnings in the Consolidated Statement of Income if such decreases are judged to be an other-than-temporary impairment (OTTI). Assessing if the fair value impairment is temporary is also inherently judgmental.

The fair value of financial instruments incorporates the effects of Citi’s own credit risk and the market view of counterparty credit risk, the quantification of which is also complex and judgmental. For additional information on Citi’s fair value analysis, see Notes 1, 6, 26 and 27.

Citi’s Allowance for Credit Losses (ACL)

The table below presents Citi’s allowance for credit losses on loans (ACLL) and total ACL as of the fourth quarter of 2023. For information on the drivers of Citi’s ACL build in the fourth quarter of 2023, see below. See Note 1 for additional information on Citi’s accounting policy on accounting for credit losses under ASC Topic 326, Financial Instruments—Credit Losses; Current Expected Credit Losses (CECL).

(1) Includes a decrease of $352 million from the adoption of ASU 2022-02 related to the recognition and measurement of TDRs under the modified retrospective approach related to USPB, Wealth and All Other consumer loans as of January 1, 2023. See Notes 1 and 15.

(2) As of December 31, 2023, in USPB, Branded Cards ACLL/EOP loans was 6.0% and Retail Services ACLL/EOP loans was 11.1%.

(3)All Other (managed basis) excludes divestiture-related impacts (Reconciling Items) related to (i) Citi’s divestitures of its Asia Consumer businesses and (ii) the planned divestiture of Mexico consumer banking and small business and middle-market banking within Legacy Franchises. The Reconciling Items are fully reflected in the various line items in Citi’s Consolidated Statement of Income. These items in the table above represent the 2023 quarterly ACL builds (releases) only. See “All Other—Divestiture-Related Impacts (Reconciling Items)” above.

(4) Includes ACL on Other assets and Held-to-maturity debt securities. The ACL on Other assets includes ACL related to transfer risk associated with exposures outside the U.S. for safety and soundness considerations under U.S. banking law.

Citi’s reserves for expected credit losses on funded loans and for unfunded lending commitments, standby letters of credit and financial guarantees are reflected on the Consolidated Balance Sheet in the Allowance for credit losses on loans (ACLL) and Other liabilities(for Allowance for credit losses on unfunded lending commitments (ACLUC)), respectively. In addition, Citi’s reserves for expected credit losses on other financial assets carried at amortized cost, including held-to-maturity securities, reverse repurchase agreements, securities borrowed, deposits with banks and other financial receivables are reflected in Other assets. These reserves, together with the ACLL and ACLUC, are referred to as the ACL. Changes in the ACL are reflected as Provision for credit losses in the Consolidated Statement of Income for each reporting period. Citi’s ability to estimate expected credit losses over the reasonable and supportable (R&S) period is

based on the ability to forecast economic activity over a R&S timeframe. The R&S forecast period for consumer and corporate loans is eight quarters.

The ACL is composed of quantitative and qualitative management adjustment components. The quantitative component uses three forward-looking macroeconomic forecast scenarios—base, upside and downside. The qualitative management adjustment component reflects risks and certain economic conditions not fully captured in the quantitative component. Both the quantitative and qualitative components are further discussed below.

Quantitative Component

Citi estimates expected credit losses for its quantitative component using (i) its comprehensive internal data on loss and default history, (ii) internal credit risk ratings, (iii) external credit bureau and rating agencies information and (iv) R&S forecasts of macroeconomic conditions.

For its consumer and corporate portfolios, Citi’s expected credit losses are determined primarily by utilizing models that consider the borrowers’ probability of default (PD), loss given default (LGD) and exposure at default (EAD). The loss likelihood and severity models used for estimating expected credit losses are sensitive to changes in macroeconomic variables, including housing prices, unemployment rate and real GDP, and cover a wide range of geographic, industry, product and business segments.

In addition, Citi’s models determine expected credit losses based on leading credit indicators, including loan delinquencies, changes in portfolio size, default frequency, risk ratings and loss recovery rates, as well as other credit trends.

Qualitative Component

The qualitative management adjustment component includes risks that are not fully captured in the quantitative component. These may include but are not limited to portfolio characteristics, idiosyncratic events, factors not within historical loss data or the economic forecast, uncertainty in the credit environment and other factors as required by banking supervisory guidance for the ACL. The primary examples of these are the following:

•Transfer risk associated with exposures outside the U.S. for certain safety and soundness considerations under U.S. banking law

•Potential impacts on vulnerable industries and regions due to emerging macroeconomic risks and uncertainties, including those related to potential global recession, inflation, interest rates, commodity prices and geopolitical tensions

•Normalization of portfolio performance and consumer behavior from low losses as a result of government stimulus and market liquidity during the COVID-19 pandemic

As of the fourth quarter of 2023, Citi’s qualitative component of the ACL increased quarter-over-quarter. The increase was primarily driven by increases in transfer risk associated with exposures outside the U.S. for safety and soundness considerations under U.S. banking law, and more specifically, with cross-border and cross-currency exposures in Argentina, based on prevailing economic trends, currency devaluation and geopolitical risk that may impact Argentina’s ability to sustain external debt service, and in Russia for the prolonged political and economic instability. These increases were partially offset by releases of COVID-19–related uncertainty reserves, as the portfolio delinquencies and losses continue to increase, reaching pre-pandemic losses and as risks are captured in the quantitative component of the ACL.

Macroeconomic Variables

As further discussed below, Citi considers a multitude of global macroeconomic variables for the base, upside and downside probability-weighted macroeconomic scenario forecasts it uses to estimate the quantitative component of the ACL. Citi’s forecasts of the U.S. unemployment rate and U.S. real GDP growth rate represent the key macroeconomic variables that most significantly affect its estimate of the ACL.

The tables below present Citi’s forecasted quarterly average U.S. unemployment rate and year-over-year U.S. real GDP growth rate used in determining the base macroeconomic forecast for Citi’s ACL for each quarterly reporting period from 4Q22 to 4Q23:

(1) Represents the average unemployment rate for the rolling, forward-looking eight quarters in the forecast horizon.

(1) The year-over-year growth rate is the percentage change in the real (inflation adjusted) GDP level.

Under the base macroeconomic forecast as of 4Q23, U.S. real GDP growth is expected to decline during 2024, while the unemployment rate is expected to increase modestly over the eight-quarter forecast horizon, broadly returning to pre-pandemic levels.

Scenario Weighting

Citi’s ACL is estimated using three probability-weighted macroeconomic scenarios—base, upside and downside. The macroeconomic scenario weights are estimated using a statistical model, which, among other factors, takes into consideration key macroeconomic drivers of the ACL, severity of the scenario and other macroeconomic uncertainties and risks. Citi evaluates scenario weights on a quarterly basis.

Citi’s downside scenario incorporates more adverse macroeconomic assumptions than the base scenario. For example, compared to the base scenario, Citi’s downside scenario reflects a recession, including an elevated average U.S. unemployment rate of 6.8% over the eight-quarter R&S period, with a peak difference of 3.2% in the second quarter of 2025. The downside scenario also reflects a year-over-year

U.S. real GDP contraction in 2024 of 1.9%, with a peak quarter-over-quarter difference to the base scenario of 1.2% in the first quarter of 2024.

Citi’s ACL is sensitive to the various macroeconomic scenarios that drive the quantitative component of expected credit losses, due to changes in the length and severity of forecasted economic variables or events in the respective scenarios. To demonstrate this sensitivity, Citi applied 100% weight to the downside scenario as of December 31, 2023 to reflect the most severe economic deterioration forecast in the multiple macroeconomic scenarios. Citi’s downside scenario incorporates more adverse macroeconomic assumptions than the weighted scenario assumptions; therefore, applying a 100% downside scenario weight would result in a hypothetical increase in the ACL of approximately $5.2 billion related to lending exposures, except for loans individually evaluated for credit losses and other financial assets carried at amortized cost.

This analysis does not incorporate any impacts or changes to the qualitative component of the ACL. These factors could change the outcome of the sensitivity analysis based on historical experience and current conditions at the time of the assessment. Given the uncertainty inherent in macroeconomic forecasting, Citi continues to believe that its ACL estimate based on a three probability-weighted macroeconomic scenario approach combined with the qualitative component remains appropriate as of December 31, 2023.

4Q23 Changes in the ACL

As further discussed below, Citi’s ending ACL balance for the fourth quarter of 2023 was $21.8 billion, compared to $20.2 billion as of September 30, 2023. The net build of $1.5 billion is primarily related to (i) an approximate $1.3 billion build for increases in transfer risk associated with exposures in Argentina and Russia (see “ACL on Other Financial Assets” below), and (ii) an approximate $0.5 billion build for growth in card balances in USPB. Citi believes its analysis of the ACL reflects the forward view of the economic environment as of December 31, 2023. See Note 16 for additional information.

Consumer Allowance for Credit Losses on Loans

Citi’s consumer ACLL is largely driven by U.S. cards (Branded Cards and Retail Services) in USPB. Citi’s total consumer ACLL build was $0.5 billion in the fourth quarter of 2023, primarily driven by growth in U.S. cards balances, resulting in a December 31, 2023 ACLL balance of $15.4 billion, or 3.97% of total funded consumer loans.

For U.S. cards, the level of reserves relative to total funded loans decreased to 7.67% as of December 31, 2023, due to seasonal improvement, compared to 7.81% at September 30, 2023. For the remaining consumer exposures, the level of reserves relative to total funded loans was 1.25% at December 31, 2023, compared to 1.24% at September 30, 2023.

Corporate Allowance for Credit Losses on Loans

Citi had a corporate ACLL build of less than $0.1 billion in the fourth quarter of 2023. The build was primarily driven by loan growth and was mainly offset by releases related to reserves for specific risks and uncertainties impacting

vulnerable industries and regions. The ACLL reserve balance remained at $2.7 billion, or 0.93% of total funded corporate loans as of December 31, 2023.

ACLUC

Citi had an ACLUC release of $0.1 billion in the fourth quarter of 2023, which decreased the ACLUC reserve balance, included in Other liabilities, to $1.7 billion. The release was primarily driven by releases related to reserves for specific risks and uncertainties impacting vulnerable industries and regions.

ACL on Other Financial Assets

Citi’s ending ACL balance on other financial assets carried at amortized cost for the fourth quarter of 2023 was $1.9 billion, compared to $0.8 billion as of September 30, 2023. The net build of $1.1 billion was primarily related to increases in transfer risk associated with exposures outside the U.S., driven by safety and soundness considerations under U.S. banking law, and more specifically, to cross-border and cross-currency exposures in Argentina, based on prevailing economic trends, currency devaluation and geopolitical risk that may impact Argentina’s ability to sustain external debt service, and in Russia for the prolonged political and economic instability. See Note 16 for additional information.

Regulatory Capital Impact

Citi elected the modified CECL transition provision for regulatory capital purposes provided by the U.S. banking agencies’ final rule. Accordingly, the Day One regulatory capital effects resulting from the adoption of CECL, as well as the ongoing adjustments for 25% of the change in CECL-based allowances in each quarter between January 1, 2020 and December 31, 2021, started to be phased in on January 1, 2022 and will be fully reflected in Citi’s regulatory capital as of January 1, 2025.

See Notes 1 and 16 for a further description of the ACL and related accounts.

Citi tests for goodwill impairment annually as of October 1 (the annual test) and conducts interim assessments between annual tests if an event occurs or circumstances change that would more-likely-than-not reduce the fair value of a reporting unit below its carrying amount. These events or circumstances include, among other things, a significant adverse change in the business climate, a decision to sell or dispose of all or a significant portion of a reporting unit or a sustained decrease in Citi’s stock price.

As of December 31, 2023, Citigroup’s activities were conducted through the reportable operating segments: Services, Markets, Banking, USPB and Wealth, with the remaining operations recorded in All Other, which includes activities not assigned to a specific operating segment as well as discontinued operations. Goodwill impairment testing is performed at the level below the operating segment (referred to as a reporting unit).

Citi performed its annual goodwill impairment test as of October 1, 2023, which resulted in no impairment of any of Citi’s reporting units’ goodwill.

Citi utilizes allocated tangible common equity as a proxy for the carrying value of its reporting units for purposes of goodwill impairment testing. The allocated equity in the reporting units is determined based on the capital the business would require if it were operating as a standalone entity, incorporating sufficient capital to be in compliance with both current and expected regulatory capital requirements, including capital for specifically identified goodwill and intangible assets. The capital allocated to the reporting units is incorporated into the annual budget process, which is approved by Citi’s Board of Directors.

Goodwill impairment testing involves management judgment, requiring an assessment of whether the carrying value of a reporting unit can be supported by its fair value using widely accepted valuation techniques, such as the market approach (earnings multiples and/or transaction multiples) and/or the income approach (discounted cash flow (DCF) method). In applying these methodologies, Citi utilizes a number of factors, including actual operating results, future business plans, economic projections and market data.

Similar to 2022, Citi engaged an independent valuation specialist in 2023 to assist in Citi’s valuation of all the reporting units, primarily employing both the income and market approach to determine the fair value of the reporting units. The income approach utilized discount rates that Citi believes adequately reflected the risk and uncertainty in the financial markets in the internally generated cash flow projections. The market approach utilizes observable market data from comparable publicly traded companies, such as price-to-earnings or price-to-tangible book value ratios, to estimate a reporting unit’s fair value. Management uses judgment in the selection of comparable companies and includes those with the most similar business activities.

The income approach employs a capital asset pricing model in estimating the discount rate. Since none of the Company’s reporting units are publicly traded, individual reporting unit fair value determinations cannot be directly correlated to Citigroup’s common stock price. The sum of the fair values of the reporting units exceeded the overall market capitalization of Citi as of October 1, 2023. However, Citi believes that it is not meaningful to reconcile the sum of the fair values of the Company’s reporting units to its market capitalization due to several factors. The market capitalization of Citigroup reflects the execution risk in a transaction involving Citigroup due to its size. However, the individual reporting units’ fair values are not subject to the same level of execution risk or a business model that is as global. In addition, the market capitalization of Citigroup does not include consideration of the individual reporting unit’s control premium.

As discussed in Note 3, effective in the fourth quarter of 2023, as part of its organizational simplification, Citi made changes to its management structure, which resulted in changes in its operating segments and reporting units to reflect how the CEO, who is the chief operating decision maker, manages the Company, including allocating resources and measuring performance.

The reorganization of Citi’s segment structure, including the change of management, and the business realignment between Banking and Markets were identified as triggering events for purposes of goodwill impairment testing. Consistent with the requirements of ASC 350, additional interim goodwill impairment tests were performed as of December 13, 2023, which resulted in no impairment during the fourth quarter. Additionally, goodwill was reallocated from Bankingto Markets related to the business realignment based on their relative fair values using the valuation performed as of the effective date of the reorganization. No additional triggering events were identified and no goodwill was impaired during 2023.

Based on the fourth-quarter assessments, the results of the impairment tests showed that the fair values of Citi’s reporting units exceeded their carrying values for all reporting units. The impairment tests results also showed that the fair value of the Mexico Consumer/SBMM reporting unit as a percentage of its carrying value was 106%, with the carrying value including approximately $1.1 billion of goodwill. For each of the remaining reporting units, fair value exceeded carrying value by at least 10%.

While the inherent risk related to uncertainty is embedded in the key assumptions used in the valuations of the reporting units, the economic and business environments continue to evolve as Citi’s management implements its organizational simplification. If management’s future estimates of key economic and market assumptions were to differ from its current assumptions, Citi could potentially experience material goodwill impairment charges in the future. See Notes 1 and 17 for additional information on goodwill, including the changes in the goodwill balance year-over-year and the segments’ goodwill balances as of December 31, 2023.

Litigation Accruals

See the discussion in Note 30 for Citi’s policies on establishing accruals for litigation and regulatory contingencies.

Income Taxes

Citi is subject to the income tax laws of the U.S., its states and local municipalities and the non-U.S. jurisdictions in which Citi operates. These tax laws are complex and are subject to differing interpretations by the taxpayer and the relevant governmental taxing authorities. Disputes over interpretations of the tax laws may be subject to review and adjudication by the court systems of the various tax jurisdictions or may be settled with the taxing authority upon audit.

In establishing a provision for income tax expense, Citi must make judgments and interpretations about the application of these inherently complex tax laws. Citi must also make estimates about when in the future certain items will affect taxable income in the various tax jurisdictions, both domestic and foreign. Deferred taxes are recorded for the future consequences of events that have been recognized in the financial statements or tax returns, based on enacted tax laws and rates. Deferred tax assets (DTAs) are recognized subject to management’s judgment that realization is more-likely- than-not. For example, if it is more-likely-than-not that a carry-forward would expire unused, Citi would set up a valuation allowance against that DTA. Citi has established valuation allowances as described below.

As a result of the Tax Cuts and Jobs Act (Tax Reform), beginning in 2018, Citi is taxed on income generated by its U.S. operations at a federal tax rate of 21%. The effect on Citi’s state tax rate is dependent upon how and when the individual states that have not yet addressed the federal tax law changes choose to adopt the various new provisions of the U.S. Internal Revenue Code.

Citi’s non-U.S. branches and subsidiaries are subject to tax at their local tax rates. Non-U.S. branches also continue to be subject to U.S. taxation. The impact of this on Citi’s earnings depends on the level of branch pretax income, the local branch tax rate, and allocations of overall domestic loss (ODL) and expenses for U.S. tax purposes to branch earnings. Citi expects no residual U.S. tax on such earnings. With respect to non-U.S. subsidiaries, dividends from these subsidiaries will be excluded from U.S. taxation. While the majority of Citi’s non-U.S. subsidiary earnings are classified as global intangible low-taxed income (GILTI), Citi expects no material residual U.S. tax on such earnings based on its non-U.S. subsidiaries’ local tax rates, which exceed, on average, the effective 13.125% GILTI tax rate. Finally, Citi does not expect the base erosion anti-abuse tax (BEAT) to affect its tax provision.

On January 4, 2022, final FTC regulations were published in the Federal Register, which eliminate the creditability of foreign taxes paid in certain situations. These include countries that do not align with U.S. tax principles in significant part and for services performed outside the recipient country. In 2023, the IRS announced that the effective date of these regulations was deferred until the IRS gives notice otherwise. The impact on Citi’s effective tax rate is not expected to be material.

The Inflation Reduction Act was signed into law on August 16, 2022. The Act includes a new corporate alternative minimum tax (AMT) and a 1% excise tax on stock buybacks, both effective January 1, 2023. The corporate AMT is a 15% minimum tax on financial statement income after adjusting for foreign taxes paid. Corporate AMT paid in one year is creditable against regular corporate tax liability in future years. Citi does not expect to pay material amounts of corporate AMT given its profitability and tax profile.

The 1% excise tax is a non-deductible tax on the fair market value of stock repurchased in the taxable year, reduced by the fair market value of any stock issued in the same year. See Note 11 for the 2023 impact on earnings per share related to the excise tax.

Deferred Tax Assets and Valuation Allowances (VA)

At December 31, 2023, Citi had net DTAs of $29.6 billion. In the fourth quarter of 2023, Citi’s DTAs increased by $1.3 billion, primarily as a result of the geographic mix of earnings. On a full-year basis, Citi’s DTAs increased by $1.9 billion from $27.7 billion at December 31, 2022.

Of Citi’s total net DTAs of $29.6 billion as of December 31, 2023, $12.8 billion, primarily related to tax carry-forwards, was deducted in calculating Citi’s regulatory capital.

Net DTAs arising from temporary differences are deducted from regulatory capital if in excess of the 10%/15% limitations (see “Capital Resources” above). For the quarter and year ended December 31, 2023, Citi had $2.3 billion of disallowed temporary difference DTAs (included in the $12.8 billion above). The remaining $16.8 billion of net DTAs as of December 31, 2023 was not deducted in calculating regulatory capital pursuant to Basel III standards and was appropriately risk weighted under those rules.

Citi’s total VA at December 31, 2023 was $3.6 billion, an increase of $1.2 billion from $2.4 billion at December 31, 2022. The increase was primarily driven by the generation of current-year FTCs in the branch basket. Citi’s VA of $3.6 billion is composed of $1.9 billion on its FTC branch basket carry-forwards, $1.2 billion on its U.S. residual DTA related to its non-U.S. branches, $0.4 billion on local non-U.S. DTAs and $0.1 billion on state net operating loss carry-forwards.

As stated above with regard to the impact of non-U.S. branches on Citi’s earnings, the level of branch pretax income, the local branch tax rate, and the allocations of ODL and expenses for U.S. tax purposes to the branch basket are the main factors in determining the branch VA. The allocated ODL was affected by reduced taxable income generated in the current year.

Recognized FTCs comprised approximately $1.2 billion of Citi’s DTAs as of December 31, 2023, compared to approximately $1.9 billion as of December 31, 2022. The decrease in FTCs year-over-year was primarily due to current-year usage. The FTC carry-forward period represents the most time-sensitive component of Citi’s DTAs.

Citi had an ODL of approximately $7 billion at December 31, 2023, which allows Citi to elect a percentage between 50% and 100% of future years’ domestic source income to be reclassified as foreign source income. (See Note 10 for a description of the ODL.)

The majority of Citi’s U.S. federal net operating loss carry-forward and all of its New York State and City net operating loss carry-forwards are subject to a carry-forward period of 20 years. This provides enough time to fully utilize the net DTAs pertaining to these existing net operating loss carry-forwards. This is due to Citi’s forecast of sufficient U.S. taxable income and the continued taxation of Citi’s non-U.S. income by New York State and City.

Although realization is not assured, Citi believes that the realization of its recognized net DTAs of $29.6 billion at December 31, 2023 is more-likely-than-not, based on management’s expectations as to future taxable income in the jurisdictions in which the DTAs arise, as well as available tax planning strategies (as defined in ASC Topic 740, Income Taxes). Citi has concluded that it has the necessary positive evidence to support the realization of its net DTAs after taking its VAs into consideration.

See Note 10 for additional information on Citi’s income taxes, including its income tax provision, tax assets and liabilities and a tabular summary of Citi’s net DTAs balance as of December 31, 2023 (including the FTCs and applicable expiration dates of the FTCs). For information on Citi’s ability to use its DTAs, see “Risk Factors—Strategic Risks” above and Note 10.

Accounting Changes

See Note 1 for a discussion of changes in accounting standards.

DISCLOSURE CONTROLS AND PROCEDURES

Citi’s disclosure controls and procedures are designed to ensure that information required to be disclosed under the Securities Exchange Act of 1934, as amended, is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms, including without limitation that information required to be disclosed by Citi in its SEC filings is accumulated and communicated to management, including the Chief Executive Officer (CEO) and Chief Financial Officer (CFO), as appropriate, to allow for timely decisions regarding required disclosure.

Citi’s Disclosure Committee assists the CEO and CFO in their responsibilities to design, establish, maintain and evaluate the effectiveness of Citi’s disclosure controls and procedures. The Disclosure Committee is responsible for, among other things, the oversight, maintenance and implementation of the disclosure controls and procedures, subject to the supervision and oversight of the CEO and CFO.

Citi’s management, with the participation of its CEO and CFO, has evaluated the effectiveness of Citigroup’s disclosure controls and procedures (as defined in Rule 13a-15(e) under the Securities Exchange Act of 1934) as of December 31, 2023. Based on that evaluation, the CEO and CFO have concluded that at that date Citigroup’s disclosure controls and procedures were effective.

MANAGEMENT’S ANNUAL REPORT ON INTERNAL CONTROL OVER FINANCIAL REPORTING

Citi’s management is responsible for establishing and maintaining adequate internal control over financial reporting. Citi’s internal control over financial reporting is designed to provide reasonable assurance regarding the reliability of its financial reporting and the preparation of financial statements for external reporting purposes in accordance with U.S. generally accepted accounting principles. Citi’s internal control over financial reporting includes those policies and procedures that (i) pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of Citi’s assets, (ii) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles and that Citi’s receipts and expenditures are made only in accordance with authorizations of Citi’s management and directors, and (iii) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of Citi’s assets that could have a material effect on its financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect all misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions or that the degree of compliance with the policies or procedures may deteriorate.

Citi’s management assessed the effectiveness of Citigroup’s internal control over financial reporting as of December 31, 2023 based on the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in Internal Control—Integrated Framework (2013). Based on this assessment, management has concluded that, as of December 31, 2023, Citi’s internal control over financial reporting was effective. In addition, there were no changes in Citi’s internal control over financial reporting during the fiscal quarter ended December 31, 2023 that materially affected, or are reasonably likely to materially affect, Citi’s internal control over financial reporting.

The effectiveness of Citi’s internal control over financial reporting as of December 31, 2023 has been audited by KPMG LLP, Citi’s independent registered public accounting firm, as stated in their report below, which expressed an unqualified opinion on the effectiveness of Citi’s internal control over financial reporting as of December 31, 2023.

FORWARD-LOOKING STATEMENTS

Certain statements in this report, including but not limited to statements included within the Management’s Discussion and Analysis of Financial Condition and Results of Operations, are “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. In addition, Citigroup also may make forward-looking statements in its other documents filed with or furnished to the SEC, and its management may make forward-looking statements orally to analysts, investors, representatives of the media and others.

Generally, forward-looking statements are not based on historical facts but instead represent Citigroup’s and its management’s beliefs regarding future events. Such statements may be identified by words such as believe, expect, anticipate, intend, estimate, may increase, may fluctuate, target and illustrative, and similar expressions or future or conditional verbs such as will, should, would and could.

Such statements are based on management’s current expectations and are subject to risks, uncertainties and changes in circumstances. Actual results of operations and financial conditions, including capital and liquidity, may differ materially from those included in these statements due to a variety of factors, including without limitation (i) the precautionary statements included within the “Executive Summary” and each business’s discussion and analysis of its results of operations and (ii) the factors listed and described under “Risk Factors” above.

Any forward-looking statements made by or on behalf of Citigroup speak only as to the date they are made, and Citi does not undertake to update forward-looking statements to reflect the impact of circumstances or events that arise after the date that the forward-looking statements were made.