CITIGROUP INC

The following discussion presents what management currently believes could be the material risks and uncertainties that could impact Citi’s businesses, results of operations and financial condition. Other risks and uncertainties, including those not currently known to Citi or its management, could also negatively impact Citi’s businesses, results of operations and financial condition. Thus, the following should not be considered a complete discussion of all of the risks and uncertainties that Citi may face. For additional information about risks and uncertainties that could impact Citi, see “Executive Summary,” “Citi’s Multiyear Transformation” and each respective business’s results of operations above and “Managing Global Risk” below. The following risk factors are categorized to improve the readability and usefulness of the risk factor disclosure, and, while the headings and risk factors generally align with Citi’s risk categorization, in certain instances the risk factors may not directly correspond with how Citi categorizes or manages its risks.

MARKET-RELATED RISKS

Macroeconomic, Geopolitical and Other Challenges and Uncertainties Could Continue to Have a Negative Impact on Citi.

Citi has experienced, and could experience in the future, negative impacts to its businesses, results of operations and financial condition as a result of various macroeconomic, geopolitical and other challenges, uncertainties and volatility. These include, among other things, any resurgence in inflation; government fiscal and monetary actions or expected actions, including changes in interest rate policy, reductions in central bank balance sheets or other monetary policies; and increases in unemployment rates, recessions or weak or slowing economic growth in the U.S., Europe and other regions or countries. These impacts could adversely affect Citi’s consumer and institutional clients, businesses, cost of credit and overall results of operations.

For example, inflation could resurge if the FRB were to reduce interest rates prematurely and/or at too accelerated a pace, or if certain policies were further pursued in the U.S., including those related to trade, tariffs and immigration.

Interest rates on loans Citi makes are typically based off or set at a spread over a benchmark interest rate and would likely decline or rise as benchmark rates decline or rise, respectively. A decline in interest rates would generally be expected to result in lower overall net interest income for Citi, although Corporate Treasury has various tools to manage Citi’s total interest rate risk position (see “Managing Global Risk— Market Risk—Market Risk of Non-Trading Portfolios” below). In addition, Citi’s net interest income could be adversely affected due to a flattening (a lower spread between shorter-term versus longer-term interest rates) or inversion (shorter-term interest rates exceeding longer-term interest rates) of the interest rate yield curve, as Citi typically pays interest on deposits based on shorter-term interest rates and earns money on loans based on longer-term interest rates. For additional information on Citi’s interest rate risk, see

Additional areas of uncertainty include, among others, geopolitical challenges, tensions and conflicts, including those related to the Russia–Ukraine war (see below) and conflicts in the Middle East; potential policies and priorities resulting from the new U.S. administration; economic and geopolitical challenges related to China, including weak economic growth, related policy actions, challenges in the Chinese real estate sector, banking and credit markets, trade restrictions, and tensions or conflicts between China and Taiwan and/or China and the U.S.; high and rising government debt levels in the U.S. and other countries; significant volatility and disruptions in financial markets, including foreign currency volatility and devaluations; natural disasters; and pandemics.

For example, the Russia–Ukraine war could have further negative impacts on regional and global energy and other commodities and financial markets and macroeconomic conditions, adversely impacting jurisdictions where Citi operates and its customers, clients or employees. In addition, Citi’s remaining operations in Russia subject Citi to various other risks, including foreign currency volatility, such as appreciations or devaluations; restrictions arising from retaliatory Russian laws and regulations on the conduct of Citi’s remaining businesses, including, without limitation, its provision of certain securities services to customers; sanctions or asset freezes; and other deconsolidation events. For additional information about these Russia-related risks, see the operational processes and systems, cybersecurity and emerging markets risk factors and “Managing Global Risk—Other Risks—Country Risk—Russia” below.

STRATEGIC RISKS

Citi’s Ability to Return Capital to Common Shareholders Substantially Depends on Regulatory Capital Requirements, Including the Results of the CCAR Process and Dodd-Frank Act Regulatory Stress Tests, and Other Factors.

Citi’s ability to return capital to its common shareholders consistent with its capital planning efforts and targets, whether through its common stock dividend or through share repurchases, substantially depends, among other things, on its regulatory capital requirements, including the annual recalibration of the Stress Capital Buffer (SCB), which is based upon the results of the CCAR process required by the FRB, and recalibration of the GSIB surcharge, as well as the supervisory expectations and assessments regarding individual institutions.

The FRB’s annual stress testing requirements are integrated into ongoing regulatory capital requirements. Citi’s SCB equals the maximum projected decline in its CET1 Capital ratio under the supervisory severely adverse scenario over a nine-quarter CCAR measurement period, plus four quarters of planned common stock dividends as a percentage of Citi’s risk-weighted assets, subject to a minimum requirement of 2.5%. The SCB is calculated by the FRB using its proprietary data and modeling of each firm’s results. Accordingly, Citi’s SCB may go up, based on the supervisory stress test results, thus potentially resulting in an increase in Citi’s required regulatory CET1 Capital ratio under the

Standardized Approach. In addition, a breach of the SCB and other regulatory capital buffers may result in gradual limitations on capital distributions and discretionary bonus payments to executive officers. For additional information on the SCB, see “Capital Resources—Regulatory Capital Buffers” above.

Moreover, changes in regulatory capital rules, requirements or interpretations could materially increase Citi’s required regulatory capital. For example, the U.S. banking regulators proposed a number of changes to the U.S. regulatory capital framework, including, but not limited to, significant revisions to the U.S. Basel III rules. These potential changes, if adopted as originally proposed, would likely impact Citi’s regulatory capital position and materially increase Citi’s regulatory capital requirements, and thus adversely impact the extent to which Citi is able to return capital to shareholders (see “Capital Resources—Regulatory Capital Standards and Developments” above).

Citi’s ability to return capital also depends on its results of operations and financial condition, including the capital impact related to its remaining divestitures, such as, among other things, any temporary capital impact from CTA losses, net of hedges (see the incorrect assumptions or estimates and the emerging markets risk factors below); Citi’s effectiveness in planning, managing and calculating its level of regulatory capital and risk-weighted assets under both the Advanced Approaches and the Standardized Approach, as well as the Supplementary Leverage ratio (SLR); its implementation and maintenance of an effective capital planning process and management framework; forecasts of macroeconomic conditions; and deferred tax asset (DTA) utilization (see the ability to utilize DTA risk factor below).

All firms subject to CCAR requirements, including Citi, will continue to be subject to a rigorous regulatory evaluation of capital planning practices and other reviews and examinations, including, but not limited to data quality, which is a key regulatory focus, governance, risk management and internal controls. For example, the FRB has stated that it expects capital adequacy practices to continue to evolve and to likely be determined by its yearly cross-firm review of capital plan submissions. Similarly, the FRB has indicated that, as part of its stated goal to continually evolve its annual stress testing requirements, several parameters of the annual stress testing process may continue to be altered, including the number and severity of the stress test scenarios, the FRB modeling of Citi’s balance sheet, pre-provision net revenue and stress losses, and the addition of components deemed important by the FRB. Additionally, Citi’s ability to return capital may be adversely impacted if a regulatory evaluation or examination were to result in negative findings regarding absolute capital levels or other aspects of Citi’s or any of its subsidiaries’ operations, including as a result of the imposition of additional capital buffers, limitations on capital distributions or otherwise. For information on limitations on Citi’s ability to return capital to common shareholders, as well as the CCAR process, supervisory stress test requirements and GSIB surcharge, see “Capital Resources—Overview” and “Capital Resources—Stress Testing Component of Capital Planning” above and the risk management and legal and regulatory proceedings risk factors below.

In October 2024, the FRB announced that it will maintain its current framework for calculating allowances on loans in the supervisory stress test through the 2025 stress test cycle, while continuing to evaluate appropriate future enhancements to this framework. The impacts on Citi’s capital adequacy of any potential incorporation by the FRB of CECL into its supervisory stress tests in future stress test cycles, and of other potential regulatory changes in the FRB’s stress testing methodologies, remain unclear. For additional information regarding the CECL methodology, including the transition provisions related to the adverse regulatory capital effects resulting from adoption of the CECL methodology, see “Capital Resources—Current Regulatory Capital Standards—Regulatory Capital Treatment—Modified Transition of the Current Expected Credit Losses Methodology” above and Note 1.

Although various uncertainties exist regarding the extent of, and the ultimate impact to Citi from, changes to regulatory capital, results from the FRB’s stress testing and CCAR regimes, and regulatory evaluation or examination findings, these changes could increase the level of capital Citi is required or elects to hold, including as part of Citi’s management buffer, thus potentially adversely impacting the extent to which Citi is able to return capital to shareholders.

Citi Must Continually Review, Analyze and Successfully Adapt to Ongoing Regulatory and Legislative Uncertainties and Changes in the U.S. and Globally.

Citi, its management and its businesses continue to face regulatory and legislative uncertainties and changes, both in the U.S. and globally. While the ongoing regulatory and legislative uncertainties and changes facing Citi are too numerous to list completely, examples include, but are not limited to (i) potential changes to various aspects of the U.S. regulatory capital framework and requirements applicable to Citi, including, among others, significant revisions to the U.S. Basel III rules (see the capital return risk factor and “Capital Resources—Regulatory Capital Standards and Developments” above) and (ii) potential fiscal, monetary, tax, sanctions, human capital and other changes promulgated by the U.S. federal government and other governments (see the macroeconomic and geopolitical risk factor above and the ability to utilize DTAs risk factor below). References to “regulatory” refer to both formal regulation and the views and expectations of Citi’s regulators in their supervisory and enforcement roles, which, as they change over time, can have a major impact. In particular, U.S. regulators have indicated that the level of their expectations is increasing and prompt negative examination findings/ratings and enforcements actions are more likely.

Additionally, U.S. and international regulatory and legislative initiatives have not always been undertaken or implemented on a coordinated basis, and areas of divergence have developed and continue to develop with respect to their scope, interpretation, timing, structure or approach, leading to inconsistent or even conflicting requirements, including within a single jurisdiction.

Further, ongoing regulatory and legislative uncertainties and changes make Citi’s long-term business, balance sheet and strategic budget planning difficult, subject to change and potentially more costly and may impact its results of operations. U.S. and other regulators globally have implemented and continue to discuss various changes to certain regulatory requirements, which would require ongoing assessment by management as to the impact to Citi, its businesses and business planning. Business planning must necessarily be based on possible or proposed rules or outcomes, which can change significantly upon finalization, or upon implementation or interpretive guidance from numerous regulatory bodies worldwide, and such guidance can change. Regulatory and legislative changes have also significantly increased Citi’s compliance risks and costs (see the implementation and interpretation of regulatory changes risk factor below) and can adversely affect Citi’s competitive position, as well as its businesses, revenues, results of operations and financial condition.

Citi’s Ability to Achieve Its Objectives from Its Transformation, Simplification and Other Priorities May Not Be as Successful as It Projects or Expects.

As part of its multiyear transformation, Citi continues to make significant investments and undertake substantial actions across the Company to improve its risk and controls environment, modernize its data and technology infrastructure and further enhance safety and soundness (see “Executive Summary” and “Citi’s Multiyear Transformation” above and the legal and regulatory proceedings risk factor below).

Citi has also been pursuing overall simplification initiatives that have included management and operating model changes and actions to enhance focus on clients and reduce expenses. Citi’s simplification actions also include completing its remaining divestitures, including the planned IPO of Mexico Consumer/SBMM. These simplification initiatives involve various execution challenges, may take longer than expected and may result in higher than expected expenses, CTA and other losses or other negative financial or strategic impacts, which could be material, and litigation and regulatory scrutiny (for information about potential CTA impacts, see the capital return risk factor above and the incorrect assumptions or estimates and emerging markets risk factors below).

Additionally, Citi continues to make business-led investments, as part of the execution of its strategic priorities. For example, Citi has been making investments across the Company, including hiring front office employees in key strategic markets and businesses; enhancing product capabilities and platforms to grow key businesses, improve client digital experiences and add scalability; and implementing new capabilities and partnerships. These business-led investments are designed to reduce expenses and grow revenues as well as result in retention and efficiency improvements.

Citi’s transformation, as well as its simplification and business investment initiatives, involve significant complexities and uncertainties. In addition, there is inherent risk that these initiatives will not be as productive or effective as Citi expects, or at all. Conversely, failure to adequately invest in and upgrade Citi’s technology and processes or properly implement its enterprise-wide simplification could result in Citi’s inability to meet regulatory expectations, be

sufficiently competitive, serve clients effectively and avoid disruptions to its businesses and operational errors (see the operational processes and systems and legal and regulatory proceedings risk factors below).

Citi’s ability to achieve its expected returns, including expense savings and revenue growth objectives, and operational improvements from these priorities depends, in part, on factors that it cannot control, including, among others, macroeconomic challenges and uncertainties; customer, client and competitor actions; and ongoing regulatory requirements or changes.

Moreover, Citi’s transformation, simplification and other priorities may continue to evolve as its business strategies, the market environment and regulatory expectations change, which could make the initiatives more costly and more challenging to implement, and limit their effectiveness.

Climate Change Presents Various Financial and Non-Financial Risks to Citi and Its Customers and Clients.

Climate change presents both immediate and long-term risks to Citi and its customers and clients, with the risks expected to increase over time. Climate risks can arise from both physical risks (those risks related to the physical effects of climate change) and transition risks (risks related to regulatory, market, technological, stakeholder and legal changes from a transition to a low-carbon economy). Physical and transition risks can manifest themselves differently across Citi’s risk categories in the short, medium and long terms.

Physical risks from climate change include acute risks, such as wildfires, hurricanes, floods and droughts, as well as consequences of chronic changes in climate, such as rising sea levels, prolonged droughts and systemic changes to geographies and any resulting population migration. For example, physical risks could have adverse financial, operational and other impacts on Citi, both directly on its business and operations, and indirectly as a result of impacts to Citi’s clients, customers, vendors and other counterparties. These impacts can include destruction, damage or impairment of owned or leased properties and other assets, destruction or deterioration of the value of collateral, such as real estate, disruptions to business operations and supply chains, and reduced availability or increase in the cost of insurance. Physical risks can also impact Citi’s credit risk exposures, for example, in its mortgage and commercial real estate lending businesses.

Transition risks may arise from changes in regulations or market preferences toward low-carbon industries or sectors, which in turn could have negative impacts on asset values, results of operations or the reputations of Citi and its customers and clients. For example, Citi’s corporate credit exposures include oil and gas, power and other industries that may experience reduced demand for carbon-intensive products due to the transition to a low-carbon economy. Failure to adequately consider transition risk in developing and executing on its business strategy could lead to a loss of market share, lower revenues and higher credit costs. Transition risks also include potential increased operational, compliance and energy costs driven by government policies to promote decarbonization.

Moreover, increasing legislative and regulatory changes and uncertainties regarding climate-related risk management and disclosures may result in increased regulatory, compliance, credit, reputational and other risks and costs for Citi. In addition, Citi could face increased regulatory scrutiny and reputation and litigation risks as a result of its climate risk, sustainability and other environmental and social commitments, disclosures, marketing and positioning. For example, any actual or perceived overstatement of the environmental benefits of Citi’s actions may result in legal or regulatory actions and/or reputational harm.

Even as some regulators seek to mandate additional disclosure of climate-related information, Citi’s ability to comply with such requirements and conduct more robust climate-related risk analyses may be hampered by lack of information and reliable data. Data on climate-related risks is limited in availability, often based on estimated or unverified figures, collected and reported on a time-lag, and variable in quality. Modeling capabilities to analyze climate-related risks and interconnections continue to evolve.

Additionally, if Citi is unable to achieve its objectives or commitments relating to climate change, its businesses, reputation, attractiveness to certain investors and efforts to recruit and retain employees may suffer. For example, Citi’s approach to supporting client decarbonization in a gradual and orderly way, while promoting energy security, may lead to both continued exposure to carbon-intensive activity and increased reputation risks from stakeholders with divergent points of view. Citi may also face challenges and scrutiny from stakeholders with varied views on climate change that may impact its ability to conduct certain business.

For information on Citi’s climate and other sustainability initiatives, see “Net Zero and Sustainability” below. For additional information on Citi’s management of climate risk, see “Managing Global Risk—Strategic Risk—Climate Risk” below.

Citi’s Ability to Utilize Its DTAs, and Thus Reduce the Negative Impact of the DTAs on Citi’s Regulatory Capital, Will Be Driven by Its Ability to Generate U.S. Taxable Income.

At December 31, 2024, Citi’s net DTAs were $29.8 billion, net of a valuation allowance of $4.3 billion, of which $12.8 billion was deducted from Citi’s CET1 Capital under the U.S. Basel III rules. Of this deducted amount, $11.6 billion related to net operating losses, foreign tax credit and general business credit carry-forwards, with $3.0 billion related to temporary differences in excess of the 10%/15% regulatory limitations, reduced by $1.8 billion of deferred tax liabilities, primarily associated with goodwill and certain other intangible assets that were separately deducted from capital.

Citi’s overall ability to realize its DTAs will primarily be dependent upon Citi’s ability to generate U.S. taxable income in the relevant reversal periods. Failure to realize any portion of the net DTAs would have a corresponding negative impact on Citi’s net income and financial returns.

The accounting treatment for realization of DTAs is complex and requires significant judgment and estimates regarding future taxable earnings in the jurisdictions in which the DTAs arise and available tax planning strategies. Forecasts

of future taxable earnings will depend upon various factors, including, among others, macroeconomic conditions. In addition, any future increase in U.S. corporate tax rates could result in an increase in Citi’s DTAs, which may subject more of Citi’s DTAs to exclusion from regulatory capital.

Citi has not been and does not expect to be subject to the base erosion anti-abuse tax (BEAT), which, if applicable to Citi in any given year, would have a significantly adverse effect on both Citi’s net income and regulatory capital.

The new U.S. administration has discussed potential reductions to the U.S. federal corporate tax rate and changes to the U.S. approach to the Organization for Economic Cooperation and Development (OECD) Pillar 2 framework. It is unclear whether any corporate tax rate reduction would apply to services companies like Citi. If the U.S. federal corporate tax rate applicable to Citi is reduced, Citi may benefit on a prospective net income basis, but the reduction could result in a material decrease in the value of Citi’s DTAs, which would also result in a material reduction to Citi’s net income during the period in which the change is enacted. Citi’s regulatory capital could also be reduced if the decrease in the value of Citi’s DTAs exceeds certain levels.

For additional information on Citi’s DTAs, including FTCs, see “Significant Accounting Policies and Significant Estimates—Income Taxes” below and Notes 1 and 10.

Citi’s Interpretation or Application of the Complex Tax Laws to Which It Is Subject Could Differ from Those of Governmental Authorities, Which Could Result in Litigation or Examinations and the Payment of Additional Taxes, Penalties or Interest.

Citi is subject to various income-based tax laws of the U.S. and its states and municipalities, as well as the numerous non-U.S. jurisdictions in which it operates. These tax laws are inherently complex, and Citi must make judgments and interpretations about the application of these laws to its entities, operations and businesses.

For example, the OECD Pillar 2 framework contemplates a 15% global minimum tax with respect to earnings in each country. The majority of EU member states have adopted the OECD Pillar 2 rules, and other non-U.S. countries have similarly adopted or are expected to adopt the rules. Under these rules, Citi will be required to pay a “top-up” tax to the extent that Citi’s effective tax rate in any given country is below 15%. Beginning in 2024, countries that adopted the OECD Pillar 2 rules can collect the top-up tax only with respect to earnings of entities in their jurisdiction or subsidiaries of such entities. Beginning in 2025, all countries that have adopted the OECD Pillar 2 rules can collect a share of the top-up tax owed with respect to any member of the Pillar 2 multinational group. While Citi does not currently expect the rules to have a material impact on its earnings, many aspects of the application of the rules and their implementation remain uncertain. Separately, the new U.S. administration has stated its opposition to the application of the global minimum tax to U.S. companies’ U.S. operations, and has indicated it may take retaliatory measures against other countries that seek to collect the minimum tax with respect to the U.S. operations of U.S. companies. Citi is closely monitoring developments relating to the Pillar 2 negotiations to determine their potential impact.

Additionally, Citi is subject to litigation or examinations with U.S. and non-U.S. tax authorities regarding non-income-based tax matters. While Citi has appropriately reserved for such matters where there is a probable loss, and has disclosed reasonably possible losses, the outcome of the matters may be different than Citi’s expectations. Citi’s interpretations or application of the tax laws, including with respect to withholding, stamp, service and other non-income taxes, could differ from that of the relevant governmental taxing authority, which could result in the requirement to pay additional taxes, penalties or interest, the reduction of certain tax benefits or the requirement to make adjustments to amounts recorded, which could be material. See Note 30 for additional information on litigation and examinations involving non-U.S. tax authorities.

A Deterioration in or Failure to Maintain Citi’s Co-Branding or Private Label Credit Card Relationships Could Have a Negative Impact on Citi.

Citi has co-branding and private label relationships with various retailers and merchants through its Branded Cards and Retail Services credit card businesses in USPB, whereby in the ordinary course of business Citi issues credit cards to consumers, including customers of the retailers or merchants. The five largest relationships across both businesses in USPB constituted an aggregate of approximately 12% of Citi’s revenues in 2024 (see “U.S. Personal Banking” above). Citi’s co-branding and private label agreements often provide for shared economics between the parties and generally have a fixed term.

Competition among credit card issuers, including Citi, for these relationships is significant, and Citi may not be able to maintain such relationships on existing terms or at all. Citi’s co-branding and private label relationships could also be negatively impacted by, among other things, the general economic environment, including the impacts stemming from potential increases in unemployment, inflation or interest rates or lower economic growth rates, as well as a risk of recession; changes in consumer sentiment, spending patterns and credit card usage behaviors; a decline in sales and revenues, partner store closures, any reduction in air and business travel, or other operational difficulties of the retailer or merchant; changes in partner business strategies, including changes in products and services offered; termination or non-renewal of partner agreements, including early termination due to a contractual breach or exercise of other early termination right; or other factors, including bankruptcies, liquidations, restructurings, consolidations or other similar events, whether due to a challenging macroeconomic environment or otherwise.

These events, particularly early termination and bankruptcies or liquidations, could negatively impact the results of operations or financial condition of Branded Cards, Retail Services or Citi as a whole, including as a result of loss of revenues, increased expenses, higher cost of credit, impairment of purchased credit card relationships and contract-related intangibles or other losses (see Note 17 for information on Citi’s credit card related intangibles generally).

The Application of U.S. Resolution Plan Requirements May Pose a Greater Risk of Loss to Citi’s Debt and Equity Securities Holders, and Citi’s Inability in Its Resolution Plan Submissions to Address Any Shortcomings or Deficiencies or Guidance Could Subject Citi to More Stringent Capital, Leverage or Liquidity Requirements, or Restrictions on Its Growth, Activities or Operations, and Could Eventually Require Citi to Divest Assets or Operations.

Title I of the Dodd-Frank Act requires Citi to prepare and submit a plan to the FRB and the FDIC for the orderly resolution of Citigroup (the bank holding company) and its significant legal entities under the U.S. Bankruptcy Code in the event of future material financial distress or failure.

Under Citi’s preferred “single point of entry” resolution plan strategy, only Citigroup, the parent holding company, would enter into bankruptcy, while Citigroup’s material legal entities (as defined in the public section of its 2023 resolution plan, which can be found on the FRB’s and FDIC’s websites) would remain operational outside of any resolution or insolvency proceedings. As a result, Citigroup’s losses and any losses incurred by its material legal entity subsidiaries would be imposed first on holders of Citigroup’s equity securities and thereafter on its unsecured creditors, including holders of eligible long-term debt and other debt securities.

In addition, a wholly owned, direct subsidiary of Citigroup serves as a resolution funding vehicle (the intermediate holding company, or IHC) to which Citigroup has transferred, and has agreed to transfer on an ongoing basis, certain assets. The obligations of Citigroup and of the IHC, respectively, under the amended and restated secured support agreement, are secured on a senior basis by the assets of Citigroup (other than shares in subsidiaries of the parent company and certain other assets), and the assets of the IHC, as applicable. As a result, claims of the operating material legal entities against the assets of Citigroup with respect to such secured assets are effectively senior to unsecured obligations of Citigroup. Citi’s single point of entry resolution plan strategy and the obligations under the amended and restated secured support agreement may result in the recapitalization of and/or provision of liquidity to Citi’s operating material legal entities, and the commencement of bankruptcy proceedings by Citigroup at an earlier stage of financial stress than might otherwise occur without such mechanisms in place.

In line with the FRB’s total loss-absorbing capacity (TLAC) rule, Citigroup’s shareholders and unsecured creditors—including its unsecured long-term debt holders—would bear any losses resulting from Citigroup’s bankruptcy. Accordingly, any value realized by holders of its unsecured long-term debt may not be sufficient to repay the amounts owed to such debt holders in the event of a bankruptcy or other resolution proceeding of Citigroup. For additional information on Citi’s single point of entry resolution plan strategy and the IHC and secured support agreement, see “Managing Global Risk—Liquidity Risk” below.

On November 22, 2022, the FRB and FDIC issued feedback on the resolution plans filed on July 1, 2021 by the eight U.S. GSIBs, including Citigroup. The FRB and FDIC jointly identified one shortcoming in Citigroup’s 2021 resolution plan. The shortcoming related to data integrity and data quality management issues, specifically, weaknesses in Citi’s processes and practices for producing certain data that could materially impact its resolution capabilities. On June 20, 2024, the FRB and FDIC issued feedback on the resolution plans filed on July 1, 2023 by the eight U.S. GSIBs, including Citigroup. The FRB and FDIC jointly identified one shortcoming in Citigroup’s 2023 resolution plan regarding Citi’s derivatives unwind capabilities. If a shortcoming is not satisfactorily explained or addressed before, or in, the submission of the next resolution plan, the shortcoming may be found to be a deficiency in the next resolution plan (see discussion below). Citi is required to submit a targeted resolution plan by July 1, 2025. More generally, data continues to be a subject of regulatory focus, and Citi continues to work on enhancing its data availability and quality (see “Citi’s Multiyear Transformation” above and the legal and regulatory proceedings risk factor below).

Under Title I, if the FRB and the FDIC jointly determine that Citi’s resolution plan is not “credible” (which, although not defined, is generally understood to mean the regulators do not believe the plan is feasible or would otherwise allow Citi to be resolved in a way that protects systemically important functions without severe systemic disruption), or would not facilitate an orderly resolution of Citi under the U.S. Bankruptcy Code, and Citi fails to resubmit a resolution plan that remedies any identified deficiencies, Citi could be subjected to more stringent capital, leverage or liquidity requirements, or restrictions on its growth, activities or operations. If within two years from the imposition of any such requirements or restrictions Citi has still not remediated any identified deficiencies, then Citi could eventually be required to divest certain assets or operations. Any such restrictions or actions would negatively impact Citi’s reputation, market and investor perception, operations and strategy.

Citi’s Performance and Its Ability to Effectively Execute Its Transformation, Simplification and Other Priorities Could Be Negatively Impacted if It Is Not Able to Hire and Retain Qualified Employees.

Citi’s performance and the performance of its individual businesses largely depend on the talents and efforts of its diverse and highly qualified employees. Specifically, Citi’s continued ability to compete in each of its lines of business, to manage its businesses effectively and to execute its transformation, simplification and other priorities, including, for example, hiring employees to grow businesses or hiring employees to support Citi’s priorities, depends on its ability to hire new employees and to retain and motivate its existing employees. If Citi is unable to continue to hire, retain and motivate highly qualified employees, Citi’s performance, including its competitive position, the execution of its transformation, simplification and other priorities and its results of operations could be negatively impacted.

Citi’s ability to attract, retain and motivate employees depends on numerous factors, some of which are outside of Citi’s control. For example, the competition for talent continues to be particularly intense due to various factors, such as changes in worker expectations, concerns and preferences, including demands for remote work options and other job

flexibility. Also, the banking industry generally is subject to more comprehensive regulation of employee compensation than other industries, including deferral and clawback requirements for incentive compensation, which can make it unusually challenging for Citi to compete in labor markets against businesses, including, for example, technology companies, that are not subject to such regulation. In addition, Citi recently completed a significant organizational simplification initiative, which included reducing management layers and significant reductions in functional roles that could continue to impact its ability to attract and retain employees.

Other factors that could impact Citi’s ability to attract, retain and motivate employees include, among other things, Citi’s presence in a particular market or region, the professional and development opportunities it offers, its reputation and its diversity. For information on Citi’s employee and workforce management, see “Human Capital Resources and Management” below.

Citi Faces Increased Competitive Challenges, Including from Financial Services and Other Companies and Emerging Technologies.

Citi operates in an increasingly evolving and competitive business environment, which includes both financial and non-financial services firms, such as traditional banks, online banks, private credit and financial technology companies and others. These companies compete on the basis of, among other factors, size, reach, quality and type of products and services offered, price, technology and reputation. Certain competitors may be subject to different and, in some cases, less stringent legal, regulatory and supervisory requirements, whether due to size, jurisdiction, entity type or other factors, placing Citi at a competitive disadvantage. Moreover, new or rapidly developing technologies with the potential to have significant economic or social effects (emerging technologies) also pose competitive challenges for Citi.

For example, Citi competes with other financial services companies in the U.S. and globally that have grown rapidly over the last several years or have introduced new products and services. Potential mergers and acquisitions involving traditional financial services companies, such as regional banks or credit card issuers, as well as networks and merchant acquirers, may also increase competition and impact Citi’s ability to offer competitive pricing and rewards. Non-traditional financial services firms, such as private credit, financial technology and digital asset companies, are less regulated and supervised and continue to expand their offerings of services traditionally provided by financial institutions.

In addition, emerging technologies have the potential to intensify competition and accelerate disruption in the financial services industry. Clients and investors have shown increased interest in these technologies, prompting financial services firms and other market participants to develop related products and services. As blockchain and digital assets continue to evolve, customer demand for enhanced offerings may increase. Failure to strategically embrace the potential of emerging technologies may result in a competitive disadvantage to Citi. The new U.S. administration has stated its support for the growth and use of digital assets and blockchain technology, including a more favorable regulatory approach to crypto assets. Citi may not be able to provide the same or similar products and services for legal or regulatory reasons, which may be exacerbated by rapidly evolving and conflicting regulatory requirements, as well as increased compliance and other risks. Further, the introduction of mobile platforms and emerging technologies, such as artificial intelligence (AI) and digital assets, and changes in the payments space (e.g., instant and 24/7 payments) are accelerating, and, as a result, certain of Citi’s products and services could become less competitive.

Increased competition and emerging technologies have required and could require Citi to change or adapt its products and services, as well as invest in and develop related infrastructure, to attract and retain customers or clients or to compete more effectively with competitors, including new market entrants.

Simultaneously, as Citi develops new products and services leveraging emerging technologies, new risks may emerge that, if not designed and governed adequately, may result in control gaps and in Citi operating outside of its risk appetite. For example, the use or development of emerging technologies, such as AI or digital assets, without sufficient controls, governance and risk management may result in increased risks across various risk categories (for additional information, see the operational processes and systems risk factor below).

As another example, instant and 24/7 payments products could be accompanied by challenges to forecasting and managing liquidity, as well as increased operational and compliance risks. Additionally, the growth of certain competitors has increased market and counterparty credit risks, with such risks particularly heightened in the case of a challenging macroeconomic environment (see the risk factor on credit and concentrations of risk below).

Moreover, Citi relies on third parties to support certain of its product and service offerings, which may put Citi at a disadvantage to competitors who may directly offer a broader array of products and services. Also, Citi’s businesses, results of operations and reputation may suffer if any third party is unable to provide adequate support for such product and service offerings, whether due to operational incidents or otherwise (see the operational processes and systems, cybersecurity and emerging markets risk factors below).

To the extent that Citi is not able to compete effectively with other financial services companies, including private credit and financial technology companies, and non-financial services firms, or adequately assess the competitive landscape, Citi could be placed at a competitive disadvantage, which could result in loss of customers and market share, and its businesses, results of operations and financial condition could suffer. For additional information on Citi’s competitors, see the co-brand and private label cards and qualified employees risk factors above and “Supervision, Regulation and Other—Competition” below.

OPERATIONAL RISKS

A Failure or Disruption of Citi’s Operational Processes or Systems Could Negatively Impact Its Reputation, Customers, Clients, Businesses or Results of Operations and Financial Condition.

Citi’s global operations rely heavily on its technology systems and infrastructure, including the accurate, complete, timely and secure processing, management, storage and transmission of data, including confidential transactions, and other information, as well as the monitoring of a substantial amount of data and complex transactions in real time. Citi obtains and stores an extensive amount of personal and client-specific information for its consumer and institutional customers and clients, and must accurately record and reflect their account transactions.

Citi’s operations must also comply with complex and evolving laws, regulations and heightened regulatory expectations in the jurisdictions in which it operates (see the implementation and interpretation of regulatory changes and legal proceedings risk factors below). With the proliferation of emerging technologies, including AI, and the use of the internet, mobile devices and cloud services to conduct financial transactions, and customers’ and clients’ increasing use of online banking and trading systems and other platforms, large global financial institutions such as Citi have been, and will continue to be, subject to an ever-increasing risk of operational loss, failure or disruption.

Citi has been working with AI and machine learning for a period of time and has more recently begun using Generative AI, a type of artificial intelligence that uses generative models to create text and other content. Generative AI tools are available to employees within parts of the Company, and in the future Citi may more broadly use, develop and incorporate Generative AI within its technology platform and services, systems and its businesses and functions. While Citi has policies which govern the use of emerging technologies, ineffective, inadequate or faulty Generative AI development or deployment practices by Citi or third parties could result in unintended consequences, such as AI algorithms that produce inaccurate or incomplete output or output based on biased, incomplete and/or inaccurate datasets, or cause other issues, concerns or deficiencies. Moreover, the use of increasingly sophisticated AI technologies by malicious actors and others has increased the risk of fraud, including identity theft and bypassing of verification controls, and failure to effectively manage such risks could result in misappropriation of funds, unauthorized transactions, exposure of sensitive client or Company information, reputational harm and increased litigation and regulatory risk. In addition, compliance with new or changing laws, regulations or industry standards relating to AI may impose additional operational risks and costs.

Although Citi has continued to upgrade its technology, including systems to automate processes and gain efficiencies, operational incidents are unpredictable and can arise from numerous sources, not all of which are fully within Citi’s control. These include, among others, operational or execution failures or deficiencies by third parties and third parties that provide products or services to Citi (e.g., cloud service providers), including such third parties’ downstream service providers, other market participants or those that otherwise have an ongoing partnership or business relationship with Citi; deficiencies in processes or controls; inadequate management of data governance practices, data controls and monitoring mechanisms that may adversely impact internal or external reporting and decision-making; cyber or information security incidents (see the cybersecurity risk factor below); human error, such as manual transaction processing errors (e.g., erroneous payments to lenders or manual errors by traders that cause system and market disruptions or losses), which can be exacerbated by staffing challenges and processing backlogs; fraud or malice on the part of employees or third parties; insufficient (or limited) straight-through processing between legacy or bespoke systems and any failure to design and effectively operate controls that mitigate operational risks associated with those legacy or bespoke systems, leading to potential risk of errors and operating losses; accidental system or technological failure; electrical or telecommunication outages; failures of or cyber incidents involving computer servers or infrastructure, including software updates and cloud services; or other similar losses or damage to Citi’s property or assets (see also the climate change risk factor above). Additionally, Citi’s ability to effectively maintain and upgrade systems and infrastructure can become more challenging as the speed, frequency, volume, interconnectivity and complexity of transactions continue to increase.

For example, operational incidents can arise due to failures by third parties with which Citi does business, such as failures by internet, mobile technology and cloud service providers or other vendors to adequately follow procedures or processes, safeguard their systems or prevent system disruptions or cyberattacks. Failure by Citi to develop, implement and operate a third-party risk management program commensurate with the level of risk, complexity and nature of its third-party relationships can also result in operational incidents. In addition, Citi has experienced and could experience further losses associated with manual transaction processing errors, including erroneous payments to lenders or manual errors by Citi traders that cause system and market disruptions and losses for Citi and its clients. Irrespective of the sophistication of the technology utilized by Citi, there will always be some room for human and other errors. In view of the large transactions in which Citi engages, such errors have in the past resulted, and could result, in significant losses. While Citi has change management processes in place to appropriately upgrade its operational processes and systems to ensure that any changes introduced do not adversely impact security and operational continuity, such change management can fail or be ineffective. Furthermore, when Citi introduces new products, systems or processes, new operational risks that may arise from those changes may not be identified, or adequate controls to mitigate the identified risks may not be appropriately implemented or operate as designed.

Incidents that impact information security, technology operations or other operational processes may cause disruptions and/or malfunctions within Citi’s businesses (e.g., the temporary loss of availability of Citi’s online banking system or mobile banking platform), as well as the operations of its clients, customers or other third parties. In addition,

operational incidents could involve the failure or ineffectiveness of internal processes or controls. Given Citi’s global footprint and the high volume of transactions processed by Citi, certain failures, errors or actions may be repeated or compounded before they are discovered and rectified, which would further increase the consequences and costs. Operational incidents could result in financial losses and other costs as well as misappropriation, corruption or loss of confidential and other information or assets, which could significantly negatively impact Citi’s reputation, customers, clients, businesses or results of operations and financial condition. Cyber-related and other operational incidents can also result in legal and regulatory actions or proceedings, fines and other costs (see the legal and regulatory proceedings risk factor below).

Citi will need to continue to increase its operational resilience, ensuring important business services and their impact tolerance time and severity scales are clearly defined. Failure to do so could expose Citi to service disruptions identified through scenario testing, leading to harms to Citi clients, market integrity, financial stability or Citi safety and soundness.

For information on Citi’s management of operational risk, see “Managing Global Risk—Operational Risk” below.

Citi’s and Third Parties’ Computer Systems and Networks Will Continue to Be Susceptible to an Increasing Risk of Continually Evolving, Sophisticated Cybersecurity Incidents That Could Result in the Theft, Loss, Non-Availability, Misuse or Disclosure of Confidential Client or Customer Information, Damage to Citi’s Reputation, Additional Costs to Citi, Regulatory Penalties, Legal Exposure and Financial Losses.

Citi’s computer systems, software and networks are subject to ongoing attempted cyberattacks, such as unauthorized access, loss or destruction of data (including confidential client information), account takeovers, disruptions of service, phishing, malware, ransomware, computer viruses or other malicious code and other similar events. These threats can arise from external parties, including cyber criminals, cyber terrorists, hacktivists (individuals or groups using cyberattacks to promote a political or social agenda) and nation-state actors, as well as insiders who knowingly or unknowingly engage in or enable malicious cyber activities. For example, nation-state actors have recently targeted critical U.S. infrastructure with cyberattacks.

Citi develops its own software and relies on third-party applications and software, which are susceptible to vulnerability exploitations. Software leveraged in financial services and other industries continues to be impacted by an increasing number of zero-day vulnerabilities, thus increasing inherent cyber risk to Citi.

The increasing use of mobile and other digital banking platforms and services, cloud technologies, new and emerging technologies (such as AI) and connectivity solutions to facilitate remote working for Citi’s employees all increase Citi’s exposure to cybersecurity risks. Citi is also susceptible to cyberattacks given, among other things, its size and scale, high-profile brand, global footprint and prominent role in the financial system, as well as the ongoing wind-down of its businesses in Russia (see the emerging markets risk factor and “Managing Global Risk—Other Risks—Country Risk—Russia” below). Additionally, Citi continues to operate in multiple jurisdictions in the midst of geopolitical unrest or uncertainties, including the Russia–Ukraine war and the conflicts in the Middle East, which could expose Citi to heightened risk of insider threat, cyber threats from nation-state actors, hacktivism or other cyber incidents.

Citi continues to experience increased exposure to cyberattacks through third parties, in part because financial institutions are becoming increasingly interconnected with central agents, exchanges and clearing houses. Third parties with which Citi does business, as well as retailers and other third parties with which Citi’s customers do business, and any such third parties’ downstream service providers, also pose cybersecurity risks, particularly where activities of customers are beyond Citi’s security and control systems. For example, Citi outsources certain functions, such as processing customer credit card transactions, uploading content on customer-facing websites and developing software for new products and services. These relationships allow for the storage and processing of customer information by third-party hosting of, or access to, Citi websites. This could lead to compromise or the potential to introduce vulnerable or malicious code, resulting in security breaches or business disruptions impacting Citi customers, employees or operations. While many of Citi’s agreements with third parties include indemnification provisions, Citi may not be able to recover sufficiently under these provisions, or at all, to adequately offset any losses and other adverse impacts Citi may incur from third-party cyber incidents.

Citi and some of its third-party partners have been subjected to attempted and sometimes successful cyberattacks over the last several years, including (i) denial of service attacks, which attempt to interrupt service to clients and customers; (ii) hacking and malicious software installations intended to gain unauthorized access to information systems or to disrupt those systems and/or impact availability or privacy of confidential data, with objectives including, but not limited to, extortion payments or causing reputational damage; (iii) data breaches due to unauthorized access to customer account or other data; and (iv) malicious software attacks on client systems, in attempts to gain unauthorized access to Citi systems or client data under the guise of normal client transactions.

While Citi’s monitoring and protection services have historically generally succeeded in detecting, thwarting and/or responding to attacks targeting its systems before they become significant, certain past incidents resulted in limited losses, as well as increases in expenditures to monitor against the threat of similar future cyber incidents. There can be no assurance that such cyber incidents will not occur again, and they could occur more frequently, via novel tactics, including leveraging of tools made possible by emerging technologies, and on a more significant scale.

Despite the significant resources Citi allocates to implement, maintain, monitor and regularly upgrade its systems and networks with measures such as intrusion detection and prevention systems and firewalls to safeguard critical business applications, there is no guarantee that these

measures or any other measures can provide sufficient security. Because the techniques used to initiate cyberattacks change frequently or, in some cases, are not recognized until launched or even later, Citi may be unable to implement effective preventive measures or otherwise proactively address these methods. In addition, cyber threats and cyberattack techniques change, develop and evolve rapidly, including from emerging technologies such as AI, cloud computing and quantum computing. Given the frequency and sophistication of cyberattacks, the determination of the severity and potential impact of a cyber incident may not become apparent for a substantial period of time following detection of the incident. Also, while Citi strives to implement measures to reduce the exposure resulting from outsourcing risks, such as performing security control assessments of third-party vendors and limiting third-party access to the least privileged level necessary to perform job functions, these measures cannot prevent all third-party-related cyberattacks or data breaches. In addition, the risk of insider threats may continue to be elevated in the near term due to Citi’s recent overall simplification initiatives, including streamlining its global staff functions.

Cyber incidents can result in the disclosure of personal, confidential or proprietary customer, client or employee information; damage to Citi’s reputation with its clients, other counterparties and the market; customer dissatisfaction; and additional costs to Citi, including expenses such as repairing or replacing systems, replacing customer payment cards, credit monitoring or adding new personnel or protection technologies. Cyber incidents can also result in regulatory penalties, loss of revenues, deposit flight, exposure to litigation and regulatory action and other financial losses, including loss of funds to both Citi and its clients and customers, and disruption to Citi’s operational systems (see the operational processes and systems risk factor above).

Moreover, the increasing risk of cyber incidents has resulted in increased legislative and regulatory action on cybersecurity, including, among other things, scrutiny of firms’ cybersecurity protection processes and services, laws and regulations to enhance protection of consumers’ personal data and mandated disclosure on cybersecurity matters.

While Citi maintains insurance coverage that may, subject to policy terms and conditions including significant self-insured deductibles, cover certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses and may not take into account reputational harm, the costs of which are impossible to quantify.

For additional information about Citi’s management of cybersecurity risk, see “Managing Global Risk—Operational Risk—Cybersecurity Risk” below.

Changes or Errors in Accounting Assumptions, Judgments or Estimates, or the Application of Certain Accounting Principles, Could Result in Significant Losses or Other Adverse Impacts.

U.S. GAAP requires Citi to use certain assumptions, judgments and estimates in preparing its financial statements, including, among other items, the estimate of the ACL; reserves related to litigation, regulatory and tax matters; valuation of DTAs; the fair values of certain assets and liabilities; and the assessment of goodwill and other assets for impairment. These assumptions, judgments and estimates are inherently limited because they involve techniques, which could include the use of historical data and AI, that cannot anticipate or model every economic and financial outcome in the markets in which Citi operates, nor can they anticipate the specific impact and timing of such outcomes. For example, many models used by Citi include assumptions about correlation or lack thereof among prices of various asset classes or other market indicators that may not hold in times of market stress, limited liquidity or other unforeseen circumstances.

If Citi’s assumptions, judgments or estimates underlying its financial statements are incorrect or differ from actual or subsequent events, Citi could experience unexpected losses or other adverse impacts, some of which could be significant. Citi could also experience declines in its stock price, be subject to legal and regulatory proceedings and incur fines and other losses. For additional information on the key areas for which assumptions and estimates are used in preparing Citi’s financial statements, see “Significant Accounting Policies and Significant Estimates” below and Notes 1 and 16.

For example, the CECL methodology requires that Citi provide reserves for a current estimate of lifetime expected credit losses for its loan portfolios and other financial assets, as applicable, at the time those assets are originated or acquired. This estimate is adjusted each period for changes in expected lifetime credit losses. Citi’s ACL estimate is subject to judgments and depends upon its CECL models and assumptions; forecasted macroeconomic conditions, including, among other things, the U.S. unemployment rate and U.S. inflation-adjusted gross domestic product (real GDP); and the credit indicators, composition and other characteristics of Citi’s loan portfolios and other applicable financial assets. These model assumptions and forecasted macroeconomic conditions will change over time, resulting in variability in Citi’s ACL and, thus, impact its results of operations and financial condition, as well as regulatory capital due to the CECL phase-in (see the capital return risk factor above). For additional information on Citi’s ACL, see “Significant Accounting Policies and Significant Estimates” below and Notes 1 and 16.

Moreover, Citi has incurred losses related to its foreign operations that are reported in the CTA components of Accumulated other comprehensive income (loss) (AOCI). In accordance with U.S. GAAP, a sale, substantial liquidation or other deconsolidation event of any foreign operations, such as those related to Citi’s remaining divestitures or legacy businesses, would result in reclassification of any foreign CTA component of AOCI related to that foreign operation, including related hedges and taxes, into Citi’s earnings. For example, Citi could incur a significant loss on sale due to CTA losses related to any such divestitures (see the capital risk factor above and the emerging markets risk factor below). The majority of these losses would be regulatory capital neutral at the completion of the divestiture. For additional information on Citi’s accounting policy for foreign currency translation and its foreign CTA components of AOCI, see Notes 1 and 21.

Changes to Financial Accounting and Reporting Standards or Interpretations Could Have a Material Impact on How Citi Records and Reports Its Financial Condition and Results of Operations.

Periodically, the Financial Accounting Standards Board (FASB) issues financial accounting and reporting standards that govern key aspects of Citi’s financial statements or interpretations thereof when those standards become effective, including those areas where Citi is required to make assumptions or estimates. Changes to financial accounting or reporting standards or interpretations, whether promulgated or required by the FASB, the SEC, U.S. banking regulators or others, could present operational challenges and could also require Citi to change certain of the assumptions or estimates it previously used in preparing its financial statements, which could negatively impact how it records and reports its financial condition and results of operations generally and/or with respect to particular businesses. See Note 1 for additional information on Citi’s accounting policies and changes in accounting, including the expected impacts on Citi’s results of operations and financial condition.

If Citi’s Risk Management and Other Processes, Strategies or Models Are Deficient or Ineffective, Citi May Incur Significant Losses and Its Regulatory Capital and Capital Ratios Could Be Negatively Impacted.

Citi utilizes a broad and diversified set of risk management and other processes and strategies, including the use of models in analyzing and monitoring the various risks Citi assumes in conducting its activities. For example, Citi uses models across the Company as part of its comprehensive stress testing initiatives. Citi also relies on data to aggregate, assess and manage various risk exposures. Management of these risks and the reliability of the data are made more challenging within a large, global financial institution, such as Citi, particularly due to complex, diverse and rapidly changing financial markets and conditions in which Citi operates. Unexpected losses can result from untimely, inaccurate or incomplete processes and data. In 2020 Citigroup and Citibank entered into Consent Orders with the FRB and OCC that require Citigroup and Citibank to make improvements in various aspects of enterprise-wide risk management, compliance, data quality management related to governance, and internal controls (see the legal and regulatory proceedings risk factor below).

In addition, Citi’s risk management and other processes, strategies and models are inherently limited because they involve techniques, including the use of historical data in many circumstances, assumptions and judgments that cannot anticipate every economic and financial outcome in the markets in which Citi operates, particularly given various macroeconomic, geopolitical and other challenges and uncertainties (see the macroeconomic challenges and uncertainties risk factor above), nor can they anticipate the specifics and timing of such outcomes. For example, many models used by Citi include assumptions about correlation or lack thereof among prices of various asset classes or other market indicators that may not necessarily hold in times of market stress, limited liquidity or other unforeseen circumstances, or identify changes in markets or client behaviors not yet inherent in historical data.

Citi could incur significant losses, receive negative regulatory evaluation or examination findings or be subject to additional enforcement actions, and its regulatory capital, capital ratios and ability to return capital could be negatively impacted, if Citi’s risk management and other processes, including its ability to manage and aggregate data in a timely and accurate manner, strategies or models are deficient or ineffective. For additional information, see the capital return risk factor above and the heightened regulatory scrutiny and ongoing interpretation of regulatory changes risk factor below. Such deficiencies or ineffectiveness could also result in inaccurate financial, regulatory or risk reporting.

Moreover, Citi’s Basel III regulatory capital models, including its credit, market and operational risk models, currently remain subject to ongoing regulatory review and approval, which may result in refinements, modifications or enhancements (required or otherwise) to these models. Citi is required to notify and obtain preapproval from both the OCC and FRB prior to implementing certain risk-weighted asset treatments, as well as certain model changes, resulting in a more challenging environment within which Citi must operate in managing its risk-weighted assets. Modifications or requirements resulting from these ongoing reviews, as well as any future changes or guidance provided by the U.S. banking regulators regarding the U.S. regulatory capital framework applicable to Citi, including, but not limited to, potential revisions to the U.S. Basel III rules (see the capital return risk factor and “Capital Resources—Regulatory Capital Standards and Developments” above), have resulted, and could continue to result, in significant changes to Citi’s risk-weighted assets. These changes can negatively impact Citi’s capital ratios and its ability to meet its regulatory capital requirements.

CREDIT RISKS

Credit Risk and Concentrations of Risk Can Increase the Potential for Citi to Incur Significant Losses.

Citi has credit exposures to consumer, corporate and public sector borrowers and other counterparties in the U.S. and various countries and jurisdictions globally, including end-of-period consumer loans of $393 billion and end-of-period corporate loans of $301 billion at December 31, 2024. For additional information on Citi’s corporate and consumer loan portfolios, see “Managing Global Risk—Corporate Credit” and “—Consumer Credit” below. For information on Citi’s credit and country risk, see also each respective business’s results of operations above and “Managing Global Risk—Other Risks—Country Risk” below and Notes 15 and 16.

A default by or a significant downgrade in the credit ratings of a borrower or other counterparty, or a decline in the credit quality or value of any underlying collateral, exposes Citi to credit risk. Additionally, despite Citi’s target client strategy, various macroeconomic, geopolitical, market and other factors, among other things, can increase Citi’s credit risk and credit costs, particularly for vulnerable sectors, industries or countries (see the macroeconomic challenges and uncertainties and co-branding and private label credit card risk factors above and the emerging markets risk factor below). For

example, a weakening of economic conditions can adversely affect borrowers’ ability to repay their obligations, as well as result in Citi being unable to liquidate the collateral it holds or forced to liquidate the collateral at prices that do not cover the full amount owed to Citi.

Citi is also a member of various central clearing counterparties and could incur financial losses as a result of defaults by other clearing members due to the requirements of clearing members to share losses. Additionally, due to the interconnectedness among financial institutions, concerns about the creditworthiness of or defaults by a financial institution could spread to other financial market participants and result in market-wide losses and disruption. For example, the failure of regional banks and other banking stresses in recent years resulted in market volatility across the financial sector.

While Citi provides reserves for expected losses for its credit exposures, as applicable, such reserves are subject to judgments and estimates that could be incorrect or differ from actual future events. For additional information, see the incorrect assumptions or estimates risk factor above.

Concentrations of risk to clients or counterparties engaged in the same or related industries or doing business in a particular geography, or to a particular product or asset class, especially credit and market risks, can also increase Citi’s risk of significant losses. For example, Citi routinely executes a high volume of securities, trading, derivative and foreign exchange transactions with non-U.S. sovereigns and with counterparties in the financial services industry, including banks, insurance companies, investment banks, governments, central banks and other financial institutions. Moreover, Citi has indemnification obligations in connection with various transactions that expose it to concentrations of risk, including credit risk from hedging or reinsurance arrangements related to those obligations (see Note 28). A rapid deterioration of a large borrower or other counterparty or within a sector or country in which Citi has large exposures or indemnifications or unexpected market dislocations could lead to concerns about the creditworthiness of other borrowers or counterparties in a certain geography and in related or dependent industries, and such conditions could cause Citi to incur significant losses.

LIQUIDITY RISKS

Citi’s Businesses, Results of Operations and Financial Condition Could Be Negatively Impacted if It Does Not Effectively Manage Its Liquidity.

As a large, global financial institution, adequate liquidity and sources of funding are essential to Citi’s businesses. Citi’s liquidity, sources of funding and costs of funding can be significantly and negatively impacted by factors it cannot control, such as general disruptions in the financial markets; changes in fiscal and monetary policies; regulatory requirements, including changes in regulations; negative investor or counterparty perceptions of Citi’s creditworthiness; deposit outflows or unfavorable changes in deposit mix; unexpected increases in cash or collateral requirements; credit ratings; and the consequent inability to monetize available liquidity resources. In addition, Citi competes with other banks and financial institutions for both institutional and consumer deposits, which represent Citi’s most stable and lowest cost source of long-term funding. The competition for deposits has continued to increase in recent years, including as a result of quantitative tightening by central banks and fixed income alternatives for customer funds.

Citi’s costs to obtain and access wholesale funding are directly related to changes in interest and currency exchange rates and its credit spreads. Changes in Citi’s credit spreads are driven by both external market factors and factors specific to Citi, such as negative views by investors of the financial services industry or Citi’s financial prospects, and can be highly volatile. For additional information on Citi’s primary sources of funding, see “Managing Global Risk—Liquidity Risk” below.

Citi’s ability to obtain funding may be impaired and its cost of funding could also increase if other market participants are seeking to access the markets at the same time or to a greater extent than expected, or if market appetite for corporate debt securities declines, as is likely to occur in a liquidity stress event or other market crisis. In such circumstances, Citi’s ability to sell assets may also be impaired if other market participants are seeking to sell similar assets at the same time or a liquid market does not exist for such assets. Additionally, unexpected changes in client needs due to idiosyncratic events or market conditions could result in greater than expected drawdowns from off-balance sheet committed facilities. A sudden drop in market liquidity could also cause a temporary or protracted dislocation of capital markets activity. In addition, clearing organizations, central banks, clients and financial institutions with which Citi interacts may exercise the right to require additional collateral during challenging market conditions, which could further impair Citi’s liquidity. If Citi fails to effectively manage its liquidity, its businesses, results of operations and financial condition could be negatively impacted.

Limitations on the payments that Citigroup Inc. receives from its subsidiaries could also impact its liquidity. As a holding company, Citigroup Inc. relies on interest, dividends, distributions and other payments from its subsidiaries to fund dividends as well as to satisfy its debt and other obligations. Several of Citi’s U.S. and non-U.S. subsidiaries are or may be subject to capital adequacy or other liquidity, regulatory or contractual restrictions on their ability to provide such payments, including any local regulatory stress test requirements and inter-affiliate arrangements entered into in connection with Citigroup Inc.’s resolution plan. Citigroup Inc.’s broker-dealer and bank subsidiaries are subject to restrictions on their ability to lend or transact with affiliates, as well as restrictions on their ability to use funds deposited with them in brokerage or bank accounts to fund their businesses.

A bank holding company is also required by law to act as a source of financial and managerial strength for its subsidiary banks. As a result, the FRB may require Citigroup Inc. to commit resources to its subsidiary banks even if doing so is not otherwise in the interests of Citigroup Inc. or its shareholders or creditors, reducing the amount of funds available to meet its obligations.

A Ratings Downgrade Could Adversely Impact Citi’s Funding and Liquidity.

The credit rating agencies, such as Fitch Ratings, Moody’s Ratings and S&P Global Ratings, continuously evaluate Citi and certain of its subsidiaries. Their ratings of Citi and its rated subsidiaries’ long-term debt and short-term obligations are based on firm-specific factors, including the financial strength of Citi and such subsidiaries, as well as factors that are not entirely within the control of Citi and its subsidiaries, such as the agencies’ proprietary rating methodologies and assumptions, potential impact from negative actions on U.S. sovereign ratings and conditions affecting the financial services industry and markets generally.

A ratings downgrade could result from, among other factors, delays or missteps in Citi’s transformation efforts, including risk management and internal controls improvements, public statements by Citi’s management or regulators, operational risk charges, control failures, substantial failure to meet cost targets, deterioration in Citi’s funding structure or liquidity, declines in profitability, significant increases in risk appetite or material reductions in regulatory capitalization levels.

Citi and its subsidiaries may not be able to maintain their current respective ratings and outlooks. Ratings downgrades could negatively impact Citi and its rated subsidiaries’ ability to access the capital markets and other sources of funds as well as increase credit spreads and the costs of those funds. A ratings downgrade could also have a negative impact on Citi and its rated subsidiaries’ ability to obtain funding and liquidity due to reduced funding capacity and the impact from derivative triggers, which could require Citi and its rated subsidiaries to meet cash obligations and collateral requirements or permit counterparties to terminate certain contracts. In addition, a ratings downgrade could have a negative impact on other funding sources such as secured financing and other margined transactions for which there may be no explicit triggers.

Furthermore, a credit ratings downgrade could have impacts that may not be currently known to Citi or are not possible to quantify. Some of Citi’s counterparties and clients could have ratings limitations on their permissible counterparties, of which Citi may or may not be aware. Certain of Citi’s corporate customers and trading counterparties, among other clients, could re-evaluate their business relationships with Citi and limit the trading of certain market instruments, and limit or withdraw deposits placed with Citi in response to ratings downgrades. Changes in customer and counterparty behavior could impact not only Citi’s funding and liquidity but also the results of operations of certain Citi businesses. For additional information on the potential impact of a reduction in Citi’s or Citibank’s credit ratings, see “Managing Global Risk—Liquidity Risk—Potential Impacts of Ratings Downgrades” below.

COMPLIANCE RISKS

Significantly Heightened Regulatory Expectations and Scrutiny in the U.S. and Globally and Ongoing Interpretation and Implementation of Regulatory and Legislative Requirements and Changes Have Increased Citi’s Compliance, Regulatory and Other Risks and Costs.

Large financial institutions, such as Citi, face significantly heightened regulatory and supervisory expectations and scrutiny in the U.S. and globally, including with respect to, among other things, governance, infrastructure, data and risk management practices and controls. These regulatory and supervisory expectations extend to employees and agents and also include, among other things, those related to customer and client protection, market practices, anti-money laundering, increasingly complex sanctions and disclosure regimes and various regulatory reporting requirements.

U.S. financial institutions also face increased expectations and scrutiny in the wake of the failures of several regional banks and other banking stresses in 2023. In addition, Citi is continually required to interpret and implement extensive and frequently changing regulatory and legislative requirements in the U.S. and other jurisdictions in which it does business, which may overlap or conflict across jurisdictions, resulting in substantial compliance, regulatory and other risks and costs.

A failure to comply with these expectations and requirements, even if inadvertent, or resolve any identified deficiencies in a timely and sufficiently satisfactory manner to regulators, could result in increased regulatory oversight; material restrictions, including, among others, imposition of additional capital buffers and limitations on capital distributions; enforcement proceedings; penalties; and fines (see the capital return risk factor above and legal and regulatory proceedings risk factor below).

Moreover, over the past several years, Citi has been required to implement a large number of regulatory, supervisory and legislative changes, including new regulatory, supervisory or legislative requirements or regimes, across its businesses and functions, and these changes continue. The changes themselves may be complex and subject to interpretation, and result in changes to Citi’s businesses. In addition, the changes require continued substantial technology and other investments. In some cases, Citi’s implementation of a regulatory or legislative requirement is occurring simultaneously with changing or conflicting regulatory guidance from multiple jurisdictions (including various U.S. states) and regulators, legal challenges or legislative action to modify or repeal existing rules or enact new rules.

Examples of regulatory or legislative changes that have resulted in increased compliance risks and costs include (i) the U.S. regulatory capital framework and requirements, which have continued to evolve (see the capital return risk factor and “Capital Resources” above); (ii) various laws relating to the limitation of cross-border data movement and/or collection and use of customer information, including data localization and protection and privacy laws, which also can conflict with or increase compliance complexity with respect to other laws, including anti-money laundering laws; and (iii) the EU’s Corporate Sustainability Reporting Directive, which may overlap but also diverge from climate-related disclosure

requirements expected to come into effect in other jurisdictions.

Citi Is Subject to Extensive Legal and Regulatory Proceedings, Examinations, Investigations, Consent Orders and Related Compliance Efforts and Other Inquiries That Could Result in Large Monetary Penalties, Supervisory or Enforcement Orders, Business Restrictions, Limitations on Dividends, Changes to Directors and/or Officers and Collateral Consequences Arising from Such Outcomes.

Citi’s regulators have broad powers and discretion under their prudential and supervisory authority, and have pursued active inspection and investigatory oversight. At any given time, Citi is a party to a significant number of legal and regulatory proceedings and is subject to numerous governmental and regulatory examinations. Additionally, Citi remains subject to governmental and regulatory investigations, consent orders (see discussion below) and related compliance efforts, and other inquiries. Citi could also be subject to enforcement proceedings and negative regulatory evaluation or examination findings not only because of violations of laws and regulations, but also due to failures, as determined by its regulators, to have adequate policies and procedures, or to remedy deficiencies on a timely basis (see also the capital return and resolution plan risk factors above). Citi could face further scrutiny and consequences from regulators for failing to timely resolve open regulatory issues or having repeat regulatory issues.

As previously disclosed, the 2020 FRB Consent Order and the 2020 OCC Consent Order require Citigroup and Citibank, respectively, to implement extensive targeted action plans and submit quarterly progress reports on a timely and sufficient basis detailing the results and status of improvements relating principally to various aspects of enterprise-wide risk management, compliance, data quality management related to governance, and internal controls. These improvements will result in continued significant investments by Citi during 2025 and beyond, as an essential part of Citi’s broader transformation efforts to enhance its risk, controls, data and finance infrastructure and compliance (see the transformation, simplification and other priorities-related risk factor above).

Additionally, on July 10, 2024, the FRB entered into a Civil Money Penalty Consent Order with Citigroup, and the OCC entered into a Civil Money Penalty Consent Order with Citibank. The OCC and Citibank also entered into an Amendment to the OCC’s 2020 Consent Order (the Amendment). The FRB found that Citigroup had ongoing deficiencies related to its data quality management program and had inadequate measures for managing and controlling its data quality risks. The OCC found that Citibank had failed to make sufficient and sustainable progress toward achieving compliance with its 2020 Consent Order.

The Amendment requires Citibank to formalize a process to determine whether sufficient resources are being appropriately allocated toward achieving timely and sustainable compliance with the OCC’s 2020 Consent Order, including any requirements on which Citibank is not making sufficient and sustainable progress (such process, the Resource Review Plan). There can be no assurance thatthe Resource

Review Plan and other efforts by Citi to address the deficiencies and resolve the OCC and FRB Consent Orders will occur in a manner satisfactory, in both timing and sufficiency, to the FRB and OCC. (For additional information, see “Citi’s Multiyear Transformation” above.)

Although there are no restrictions on Citi’s ability to serve its clients, the OCC Consent Order requires Citibank to obtain prior approval of any significant new acquisition, including any portfolio or business acquisition, excluding ordinary course transactions.

Moreover, the OCC Consent Order provides that the OCC has the right to assess future civil money penalties or take other supervisory and/or enforcement actions. Such actions by the OCC could include imposing business restrictions, including possible additional limitations on the declaration or payment of dividends by Citibank and changes in directors and/or senior executive officers. More generally, the OCC and/or the FRB could again take enforcement or other actions if the regulatory agency believes that Citi has not met regulatory expectations regarding compliance with the consent orders.

The global judicial, regulatory and political environment has generally been challenging for large financial institutions, which have been subject to increased regulatory scrutiny. The complexity of the federal and state regulatory and enforcement regimes in the U.S., coupled with the global scope of Citi’s operations, also means that a single event or issue may give rise to a large number of overlapping investigations and regulatory proceedings, either by multiple federal and state agencies and authorities in the U.S. or by multiple regulators and other governmental entities in foreign jurisdictions, as well as multiple civil litigation claims in multiple jurisdictions. Violations of law by other financial institutions may also result in regulatory scrutiny of Citi. Responding to regulatory inquiries and proceedings can be time consuming and costly, and divert management attention from Citi’s businesses.

U.S. and non-U.S. regulators have been increasingly focused on the culture of financial services firms, including Citi, as well as “conduct risk,” a term used to describe the risks associated with behavior by employees and agents, including third parties, that could harm clients, customers, employees or the integrity of the markets, such as improperly creating, selling, marketing or managing products and services or improper incentive compensation programs with respect thereto, failures to safeguard a party’s personal information or failures to identify and manage conflicts of interest.

In addition to the greater focus on conduct risk, the general heightened scrutiny and expectations from regulators could lead to investigations and other inquiries, as well as remediation requirements, regulatory restrictions, structural changes, more regulatory or other enforcement proceedings, civil litigation and higher compliance and other risks and costs. For additional information, see the capital return and heightened regulatory scrutiny and ongoing interpretation of regulatory changes risk factors above. Further, while Citi takes numerous steps to prevent and detect conduct by employees and agents that could potentially harm clients, customers, employees or the integrity of the markets, such behavior may not always be deterred or prevented.

Moreover, the severity of the remedies sought in legal and regulatory proceedings to which Citi is subject has remained elevated. For example, U.S. and certain non-U.S. governmental entities have increasingly brought criminal actions against, or have sought and obtained criminal guilty pleas or deferred prosecution agreements from, financial institutions and individual employees. These types of actions by U.S. and other governments may, in the future, have significant collateral consequences for Citi, including loss of customers and business, operational loss and the inability to offer certain products or services and/or operate certain businesses. Citi may be required to accept or be subject to similar types of criminal remedies, consent orders, sanctions, substantial fines and penalties, remediation and other financial costs or other requirements in the future, including for matters or practices not yet known to Citi, any of which could materially and negatively affect Citi’s businesses, business practices, financial condition or results of operations, require material changes in Citi’s operations or cause Citi substantial reputational harm.

Additionally, many large claims—both private civil and regulatory—asserted against Citi are highly complex, slow to develop and may involve novel or untested legal theories. The outcome of such proceedings is difficult to predict or estimate until late in the proceedings. Although Citi establishes accruals for its legal and regulatory matters according to accounting requirements, Citi’s estimates of, and changes to, these accruals involve significant judgment and may be subject to significant uncertainty, and the amount of loss ultimately incurred in relation to those matters may be substantially higher than the amounts accrued (see the incorrect assumptions or estimates risk factor above). In addition, certain settlements are subject to court approval and may not be approved. Furthermore, regulators may be more likely to pursue investigations or proceedings against financial institutions, such as Citi, that have previously been the subject of other regulatory actions.

For further information on Citi’s legal and regulatory proceedings, see Note 30.

OTHER RISKS

Citi’s Emerging Markets Presence Subjects It to Various Risks as well as Increased Compliance and Regulatory Risks and Costs.

Citi’s presence in the emerging markets subjects it to various risks. During 2024, emerging markets revenues accounted for approximately 28% of Citi’s total revenues (based, beginning in 2024, on the IMF and FFIEC classifications, which resulted in the exclusion of certain countries that Citi previously classified as emerging markets).

Emerging market risks include, among others, limitations or unavailability of hedges on foreign investments; foreign currency volatility, including devaluations and strength in the U.S. dollar; central bank interest rate and other monetary policies, including the impact of sustained high interest rates in the U.S.; unemployment, recessions or weak or slowing economic growth; elevated inflation and hyperinflation; foreign exchange controls, including an inability to access indirect foreign exchange mechanisms; macroeconomic, geopolitical and domestic political challenges, uncertainties and volatility, including with respect to China, the Russia–Ukraine war and conflicts in the Middle East; cyberattacks; restrictions arising from retaliatory laws and regulations; sanctions or asset freezes; sovereign debt volatility; fluctuations in commodity prices; the effects of potential policy and other changes resulting from the new U.S. administration, including those related to Mexico; the effects of potential policy and other changes resulting from the new Mexican administration and Congress, including judicial reforms; regulatory changes, including potential conflicts among regulations with other jurisdictions where Citi does business; limitations on foreign investment; sociopolitical instability; civil unrest; crime, corruption and fraud; nationalization or loss of licenses; potential criminal charges; closure of branches or subsidiaries; and confiscation of assets; and these risks can be exacerbated in the event of a deterioration in the relationship between the U.S. and an emerging market country.

For example, Citi operates in several countries that have, or have had in the past, strict capital controls, currency controls and/or sanctions, such as Argentina and Russia, that limit its ability to convert local currency into U.S. dollars and/or transfer funds outside of those countries. For instance, Citi may need to record additional translation losses due to currency controls in Argentina (see “Managing Global Risk—Other Risks—Country Risk—Argentina” below). Moreover, Citi may need to record additional reserves for expected losses for its credit exposures based on the transfer risk associated with exposures outside the U.S., driven by safety and soundness considerations under U.S. banking law (see “Managing Global Risk—Other Risks—Country Risk—Argentina” and “—Russia” and “Significant Accounting Policies and Significant Estimates” below).

In the event of a loss of control of AO Citibank in Russia, Citi would be required to (i) write off its remaining nominal net investment, (ii) recognize a CTA loss of approximately $1.6 billion through earnings and (iii) recognize a loss of $0.9 billion on intercompany liabilities owed by AO Citibank to other Citi entities outside of Russia. In the sole event of a substantial liquidation, as opposed to a loss of control, Citi would be required to recognize the CTA loss of approximately $1.6 billion through earnings and would evaluate its remaining net investment as circumstances evolve. For additional information about these risks and related potential impacts, see the operational processes and systems and cybersecurity risk factors above and “Managing Global Risk—Other Risks—Country Risk—Russia” below.

In addition, political turmoil and instability; geopolitical challenges, tensions and conflicts (including those related to China, the Russia–Ukraine war and the conflicts in the Middle East); terrorism; and other instabilities have occurred in various regions and emerging market countries across the globe, which impact Citi’s businesses, results of operations and financial conditions in those countries where Citi operates and have required, and may continue to require, management time and attention and other resources, such as managing the impact of sanctions and their effect on Citi’s operations in certain emerging market countries. For additional information, see the macroeconomic challenges and uncertainties risk factor above.

NET ZERO AND SUSTAINABILITY

This section summarizes Citi’s net zero commitment, sustainable operations and sustainable finance goals. For information regarding Citi’s management of climate risk, see “Managing Global Risk—Strategic Risk—Climate Risk” below.

Net Zero Emissions by 2050

As previously disclosed, Citi has committed to achieving net zero greenhouse gas (GHG) emissions associated with its financing by 2050, and net zero GHG emissions for its own operations by 2030. This commitment spans Citi’s select lending portfolios, capital markets business and operational footprint.

Citi’s Net Zero Plan:

•Implementation Strategy: Engage with and assess clients to determine transition opportunities.

•Engagement Strategy: Solicit feedback from clients, investors and other stakeholders as this work continues to evolve.

•Metrics and Targets: Calculate financed emissions metrics for each applicable carbon-intensive sector and report on progress for emissions reductions targets for 2030 and beyond.

Progress on Citi’s Net Zero Financing Commitment:

•Citi has published interim 2030 emissions targets for 10 loan portfolios: aluminum, auto manufacturing, aviation, cement, commercial real estate (North America), energy, power, shipping, steel and thermal coal mining. Three of these targets (auto manufacturing, energy and power) include facilitated emissions from capital markets activities as well.

•In 2024, Citi completed the initial assessments in the auto manufacturing and steel sectors, to complement those in the energy and power sectors concluded in 2023, to better understand their strategies and approach to the climate transition.

Citi recognizes that energy transition, energy security and economic growth are not mutually exclusive and must be addressed simultaneously. Citi works on executing its climate commitments and supports its clients in financing their transition to low-carbon business models, while also working with clients to prioritize global energy security, including for emerging markets where access to affordable energy is a top concern.

Sustainable Operations

In addition to the 2030 net zero GHG emissions commitment for its own operations, Citi measures progress against operational footprint goals, which include efforts to reduce the environmental impact of its facilities through reductions in emissions, energy usage, water consumption and waste generation. In 2024, Citi made progress toward these goals by increasing on-site solar generation, promoting initiatives on waste diversion and recycling, and employing more carbon-efficient techniques for building renovations.

Sustainable Finance

Citi’s $1 Trillion Sustainable Finance Goal, as previously disclosed, is an integrated effort across the organization to finance and facilitate $1 trillion in environmental and social finance activities with product and service offerings across multiple lines of business.

The “Citi Climate Report,” formerly the “Task Force on Climate-Related Financial Disclosure (TCFD) Report,” provides additional information on Citi’s continued progress to manage climate risk and its Net Zero Plan, including information on financed and facilitated emissions and 2030 interim emissions reduction targets. For additional information on Citi’s environmental and social policies and priorities, click on “Our Impact” on Citi’s website at www.citigroup.com. For information on Citi’s environmental and social governance, see Citi’s 2025 Annual Meeting Proxy Statement to be filed with the SEC in March 2025.

Citi’s climate reporting and any other environmental and social governance-related reports and information included elsewhere on Citi’s website are not incorporated by reference into, and do not form any part of, this Form 10-K.

HUMAN CAPITAL RESOURCES AND MANAGEMENT

Citi strives to deliver to its full potential by focusing on its strategic priority of attracting and retaining highly qualified and motivated employees. Citi’s vision remains—to be the preeminent banking partner for institutions with cross-border needs, a global leader in wealth management and a valued personal bank in the U.S. Citi is structured around five core interconnected businesses—Services, Markets, Banking, Wealth and USPB, a centralized client organization to strengthen how Citi delivers for clients across the Company and an international unit to oversee the local delivery of the Company’s services and products to clients in each of the markets where Citi has an on-the-ground presence to serve and support large and mid-sized companies. Citi seeks to enhance the competitive strength of its workforce through the following efforts:

• Continuously innovating its efforts to recruit, train, develop, compensate, promote and engage employees

• Actively seeking and listening to diverse perspectives at all levels of the organization

• Providing compensation programs that are competitive in the market and aligned to strategic objectives

Workforce Size and Distribution

As of December 31, 2024, Citi employed approximately 229,000 people in over 90 countries. The Company’s workforce is constantly evolving and developing, benefiting from a strong mix of internal and external hiring into new and existing positions. In 2024, Citi welcomed over 24,000 new employees in addition to 39,700 roles filled by existing employees through internal mobility, including promotions. Citi also maintains connections with former employees through its alumni network, and in 2024, welcomed more than 3,400 individuals back to Citi.

The following table presents the geographic distribution of Citi’s employees by segment, component and gender:

(1) Employee distribution is based on business and region, which may not reflect where the employee physically resides.

(2) See Note 3 for compensation by reportable segment. Compensation expense related to services provided by employees in the Corporate/Other unit within All Otheris allocated to each respective reportable segment, as applicable, through non-compensation expense.

(3) Mexico is included in International.

(4) Part-time employees represented less than 1.0% of Citi’s global workforce.

Talent Management

Citi is committed to a workforce consisting of the best talent from the broadest pools available to drive innovation and best serve its clients, customers and communities.

Driving a Culture of Excellence and Accountability

Citi’s talent and culture initiatives focus on fostering a culture of excellence and accountability that is supported by strong risk and controls management.

Citi’s Leadership Principles of “taking ownership, delivering with pride and succeeding together” have been reinforced through a behavioral science-led campaign, Citi’s New Way, which reinforces the key working habits that support Citi’s leadership culture.

Citi’s performance management approach emphasizes the Leadership Principles through a four-pillar system, evaluating what employees deliver against financial, risk and controls, and client and franchise goals, as well as how employees deliver from a leadership perspective. The performance management and incentive compensation processes, policies and frameworks promote accountability and consistency, in particular for risk and controls.

Citi’s culture initiatives are also supported by changes in the way Citi identifies, assesses, develops and promotes talent, particularly at the most senior levels of the organization.

Workforce Development

Citi’s numerous programmatic offerings aim to reinforce its culture and values, foster understanding of compliance requirements and develop competencies required to deliver excellence to its clients. Citi encourages career growth and development by offering broad and diverse opportunities to employees, including the following:

•Providing a range of internal development and rotational programs to employees at all levels, including an extensive leadership curriculum, allowing the opportunity to build the skills needed to transition to supervisory and managerial roles. Citi’s tuition assistance program further enables employees in North America to pursue their educational goals.

•Continuing to focus on internal talent development and aims to provide employees with career growth opportunities. There was a total of 39,700 mobility opportunities filled in 2024. These opportunities are particularly important as Citi focuses on providing career paths for its internal talent base as part of its efforts to increase organic growth within the organization.

•Continuing to encourage all employees to create developmental plans and consider the competencies and skills they need to develop in order to achieve their career aspirations. In 2023, Citi launched a “Development 365” campaign that drove significant increases in the number of employees across Citi who had developmental plans and conversations with their managers.

Pay Transparency and Pay Equity

In addition, Citi has continued its effort to support its global workforce, including taking actions with respect to pay equity.

Citi values pay transparency and has taken significant action to provide managers and other employees with greater clarity about Citi’s compensation philosophy. Citi has introduced market-based salary structures and bonus opportunity guidelines in various countries worldwide, and posts salary ranges on all external U.S. job postings, which aligns with strategic objectives of pay equity and transparency.

In addition, Citi has focused on measuring and addressing pay equity within the organization.

Citi’s annual pay equity analysis for 2024 determined that on an adjusted basis, global gender and U.S. racial pay gaps are in each case less than 1%. The adjusted pay gap is a true measure of pay equity, or “like for like,” that compares the compensation of women to men and U.S. minorities to non-minorities when adjusting for factors such as job function, title/level and geography.

Benefits and Well-being

Citi is proud to provide a wide range of benefits that support its employees’ mental, social, physical and financial well-being through various life stages and events. Such benefits contribute to Citi’s ability to attract, engage and retain employees.

Among the benefits Citi offers are mental health counseling for employees and their family members, access to onsite medical care clinics, fitness centers, subsidized gym memberships and virtual physical therapy in several locations, and leave programs, including parental and caregiver leaves in certain locations to continue to support employees and their families.

In addition, Citi was the first major U.S. bank to publicly embrace a flexible, hybrid work model, which Citi fully implemented across the organization. Most of Citi’s employees now work in hybrid roles, working remotely up to two days a week.

This page intentionally left blank.

(1) For additional information regarding certain credit risk, market risk and other quantitative and qualitative information, refer to

Citi’s Pillar 3 Basel III Advanced Approaches Disclosures, as required by the rules of the FRB, on Citi’s Investor Relations website.

These Pillar 3 disclosures are not incorporated by reference into, and do not form any part of, this Form 10-K.

For Citi, effective risk management is of primary importance to its overall operations. Accordingly, Citi has established an Enterprise Risk Management (ERM) Framework to ensure that all of Citi’s risks are managed appropriately and consistently across the Company and at an aggregate, enterprise-wide level. Citi’s culture drives a strong risk and control environment, and is at the heart of the ERM Framework, underpinning the way Citi conducts business. The activities that Citi engages in, and the risks those activities generate, must be consistent with Citi’s Mission and Value Proposition (see below) and the key Leadership Principles that support it, as well as Citi’s risk appetite. As discussed above, Citi also continues its efforts to comply with the 2020 FRB and OCC Consent Orders and the OCC’s 2024 Consent Order Amendment, relating principally to various aspects of risk management, compliance, data quality management related to governance, and internal controls (see “Citi’s Multiyear

Transformation—FRB and OCC Consent Orders

Compliance” and “Risk Factors—Compliance Risks” above).

Under Citi’s Mission and Value Proposition, which was developed by its senior leadership and distributed throughout the Company, Citi strives to serve its clients as a trusted partner by responsibly providing financial services that enable growth and economic progress while earning and maintaining the public’s trust by constantly adhering to the highest ethical standards. As such, Citi asks all employees to ensure that their decisions pass three tests: they are in Citi’s clients’ best interests, create economic value and are always systemically responsible.

As discussed in “Human Capital Resources and Management” above, Citi has designed Leadership Principles that represent the qualities, behaviors and expectations all employees must exhibit to deliver on Citi’s mission of enabling growth and economic progress. The Leadership Principles inform Citi’s ERM Framework and contribute to creating a culture that drives client, control and operational excellence. Citi employees share a common responsibility to uphold these Leadership Principles and hold themselves to the highest standards of ethics and professional behavior in dealing with Citi’s clients, business colleagues, shareholders, communities and each other.

Citi’s ERM Framework details the principles used to support effective enterprise-wide risk management across the end-to-end risk management lifecycle. The ERM Framework covers the risk management roles and responsibilities of the Citigroup Board of Directors (the Board), Citi’s Executive Management Team (see “Risk Governance—Executive Management Team” below) and employees across the lines of defense. The underlying pillars of the framework encompass:

•Culture—the core principles and behaviors that underpin a strong culture of risk awareness, in line with Citi’s Mission and Value Proposition, and Leadership Principles;

•Governance—the committee structure and reporting arrangements that support the appropriate oversight of risk management activities at the Board and Executive

Management Team levels and establish Citi’s Lines of Defense model;

•Risk Management—the end-to-end risk management cycle including the identification, measurement, monitoring, controlling and reporting of all risks including top, material, growing, idiosyncratic and emerging risks, and aggregated to an enterprise-wide level; and

•Enterprise Programs—the key risk management programs performed across the risk management lifecycle for all risk categories.

Each of these pillars is underpinned by supporting capabilities covering people, infrastructure and tools that are in place to enable the execution of the ERM Framework. Controls are established to mitigate the risks associated with the execution of these pillars and supporting capabilities.

Citi’s approach to risk management requires that its risk-taking be consistent with its risk appetite. Risk appetite is the aggregate level of risk that Citi is willing to tolerate in order to achieve its strategic objectives and business plan. Risk limits and thresholds represent allocations of Citi’s risk appetite to businesses and risk categories. Concentration risks are controlled through a subset of these limits and thresholds.

Citi’s risks are generally categorized and summarized as follows:

•Credit risk is the risk of loss resulting from the decline in credit quality (or downgrade risk) or failure of a borrower, counterparty, third party or issuer to honor its financial or contractual obligations.

•Liquidity risk is the risk that Citi will not be able to efficiently meet both expected and unexpected current and future cash flow and collateral needs without adversely affecting either daily operations or financial conditions of Citi. Risk may be exacerbated by the inability of the Company to access funding sources or monetize assets and the composition of liability funding and liquid assets.

•Market risk(trading and non-trading): Market risk of trading portfolios is the risk of economic or trading loss arising from changes in the value of Citi’s assets and liabilities resulting from changes in market variables, such as interest rates, equity and commodity prices, foreign exchange rates or credit spreads. Market risk of non-trading portfolios is the impact of adverse changes in market variables such as interest rates, foreign exchange rates, credit spreads and equity prices on Citi’s net interest income, economic value of equity or AOCI.

•Operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. It includes legal risk, which is the risk of loss (including litigation costs, settlements and regulatory fines) resulting from Citi’s failure to comply with laws, regulations, prudent ethical standards or contractual obligations in any aspect of Citi’s business, but excludes strategic and reputation risks (see below).

•Compliance risk is the risk to current or projected financial condition and resilience arising from violations of laws, rules or regulations, or from non-conformance with prescribed practices, internal policies and procedures or ethical standards.

•Reputation risk is the risk to current or projected financial conditions and resilience from negative opinion held by stakeholders. This risk may impair Citi’s competitiveness by affecting its ability to establish new relationships or services or continue servicing existing relationships.

•Strategic risk is the risk of a sustained impact (not episodic impact) to Citi’s core strategic objectives as measured by impacts on anticipated earnings, market capitalization or capital, arising from the external factors affecting the Company’s operating environment, as well as the risks associated with defining the strategy and executing the strategy, which are identified, measured and managed as part of the Strategic Risk Framework at the Enterprise Level.

Additionally, Citi categorizes and summarizes risks that span the above risk categories, such as concentration risk, country risk and climate risk.

Citi uses a lines of defense model as a key component of its ERM Framework to manage its risks. As discussed below, the lines of defense model brings together risk-taking, risk oversight and risk assurance under one umbrella and provides an avenue for risk accountability of the first line of defense, a construct for effective challenge by the second line of defense (Independent Risk Management and Independent Compliance Risk Management), and empowers independent risk assurance by the third line of defense (Internal Audit). In addition, the lines of defense model includes organizational units tasked with supporting a strong control environment (enterprise support functions). The first, second and third lines of defense, along with enterprise support functions, have distinct roles and responsibilities and are empowered to perform relevant risk management processes and responsibilities in order to manage Citi’s risks in a consistent and effective manner.

First Line of Defense: Front Line Units and Front Line Unit Activities

Citi’s first line of defense owns the risks and associated controls inherent in, or arising from, the execution of its business activities and is responsible for identifying, measuring, monitoring, controlling and reporting those risks consistent with Citi’s strategy, Mission and Value Proposition, Leadership Principles and risk appetite.

Front line units are responsible and held accountable for managing the risks associated with their activities within the boundaries set by independent risk management. They are also responsible for designing and implementing effective internal controls and maintaining processes for managing their risk profile, including through risk mitigation, so that it remains consistent with Citi’s established risk appetite.

Front line unit activities are considered part of the first line of defense and are subject to the oversight and challenge of independent risk management.

The first line of defense is composed of Citi’s operating segments (i.e., Services, Markets, Banking, Wealth, U.S. Personal Banking), as well as International, North America and All Other (including certain corporate functions (i.e., Chief Operating Office, Enterprise Services and Public

Affairs, Finance, Technology and Business Enablement). In addition, the first line of defense includes the front line unit activities of other organizational units. Front line units may also include lower-level enterprise support functions and/or conduct enterprise support activities—see “Enterprise Support Functions” below.

Second Line of Defense: Independent Risk Management Independent risk management units are independent of the first line of defense. They are responsible for overseeing the risk-taking activities of the first line of defense and challenging the first line of defense in the execution of its risk management responsibilities. They are also responsible for independently identifying, measuring, monitoring, controlling and reporting aggregate risks and for setting standards for the management and oversight of risk. Independent risk management is composed of Independent Risk Management (IRM) and Independent Compliance Risk Management (ICRM), which are led by the Group Chief Risk Officer (CRO) and Group Chief Compliance Officer (CCO) who have unrestricted access to the Board and its Risk Management Committee to facilitate the ability to execute their specific responsibilities pertaining to escalation to the Board.

Independent Risk Management

The IRM organization sets risk and control standards for the first line of defense and actively manages and oversees aggregate credit, market (trading and non-trading), liquidity, strategic, operational and reputation risks across Citi, including risks that span categories, such as concentration risk, country risk and climate risk.

IRM is organized to align to businesses, risk categories, legal entities/clusters and Company-wide, cross-risk functions or processes. Each of these units reports to a member of the Risk Management Executive Council, who all report to the Citigroup CRO.

Independent Compliance Risk Management

The ICRM organization actively oversees compliance risk across Citi, sets compliance standards for the first line of defense to manage compliance risk and promotes business conduct and activity that is consistent with Citi’s Mission and Value Proposition and the compliance risk appetite. Citi’s objective is to embed an enterprise-wide compliance risk management framework and culture that identifies, measures, monitors, controls and escalates compliance risk across Citi.

ICRM is aligned by business, function and geography to provide compliance risk management advice and credible challenge on day-to-day matters and strategic decision-making for key initiatives. ICRM also has program-level Enterprise Compliance units responsible for setting standards and establishing priorities for program-related compliance efforts. The CCO reports to Citi’s Chief Legal Officer and ICRM is organizationally part of the Global Legal Affairs & Compliance group. In addition, the CCO has matrix reporting into the CRO and is part of the Risk Management Executive Council.

Third Line of Defense: Internal Audit

Internal Audit is independent of the first line, second line and enterprise support functions. The role of Internal Audit is to provide independent, objective, reliable, valued and timely assurance to the Board, its Audit Committee, Citi senior management and regulators over the effectiveness of governance, risk management and controls that mitigate current and evolving risks and enhance the control culture within Citi. The Citi Chief Auditor manages Internal Audit and reports functionally to the Chair of the Citi Audit Committee and administratively to Citi’s CEO. The Citi Chief Auditor has unrestricted access to the Board and the Board Audit Committee to address risks and issues identified through Internal Audit’s activities.

Enterprise Support Functions

Enterprise support functions engage in activities that support safety and soundness across Citi. These functions provide advisory services and/or design, implement, maintain and oversee Company-wide programs that support Citi in maintaining an effective control environment.

Enterprise support functions are composed of Human Resources and Global Legal Affairs and Compliance (exclusive of ICRM, which is part of the second line of defense). Front line units may also include enterprise support units and/or conduct enterprise support activities (e.g., the Controllers Group within Finance).

Enterprise support functions, units and activities are subject to the relevant Company-wide independent oversight processes specific to the risks for which they are accountable (e.g., operational risk, compliance risk, reputation risk).

Risk Governance

Citi’s ERM Framework encompasses risk management processes to address risks undertaken by Citi through identification, measurement, monitoring, controlling and reporting of all risks. The ERM Framework integrates these processes with appropriate governance to complement Citi’s commitment to maintaining strong and consistent risk management practices.

Board Oversight

The Board is responsible for oversight of Citi and holds the Executive Management Team accountable for implementing the ERM Framework and meeting strategic objectives within Citi’s risk appetite.

Executive Management Team

The Citigroup CEO directs and oversees the day-to-day management of Citi as delegated by the Board of Directors. The CEO leads the Company through the Executive Management Team and provides oversight of group activities, both directly and through authority delegated to committees established to oversee the management of risk, to ensure continued alignment with Citi’s risk strategy.

Board and Executive Management Committees

The Board executes its responsibilities either directly or through its committees. The Board has delegated authority to the following Board standing committees to help fulfill its oversight and risk management responsibilities:

•Audit Committee: assists the Board in fulfilling its oversight responsibility relating to (i) the integrity of Citigroup’s consolidated financial statements, financial reporting process and systems of internal accounting and financial controls, (ii) the performance of the internal audit function (Internal Audit), (iii) the annual independent integrated audit of Citigroup’s consolidated financial statements and effectiveness of Citigroup’s internal control over financial reporting, the engagement of the independent registered public accounting firm (Independent Auditors) and the evaluation of the Independent Auditors’ qualifications, independence and performance, (iv) holding management accountable for the effectiveness of Citigroup’s control environment and status of corrective actions, including the timely remediation of control breaks (including, without limitation, significant compliance or operational control breaks), (v) policy standards and guidelines for risk assessment and risk management, (vi) Citigroup’s compliance with legal and regulatory requirements, including Citigroup’s disclosure controls and procedures and (vii) the fulfillment of the other responsibilities set out in the Audit Committee’s Charter.

•Compensation, Performance Management and Culture Committee: is responsible for overseeing compensation of employees of the Company and its subsidiaries and affiliates and Citi management’s sustained focus on fostering a principled culture of sound ethics, responsible conduct and accountability within the organization. The Committee regularly reviews Citi’s management resources and the performance of senior management. The Committee is responsible for determining the compensation for the Chief Executive Officer and approving the compensation of other executive officers of the Company and members of Citi’s Executive Management Team. The Committee is also responsible for approving the incentive compensation structure for other members of senior management and certain highly compensated employees (including discretionary incentive awards to covered employees as defined in applicable bank regulatory guidance), in accordance with guidelines established by the Committee from time to time. The Committee also has broad oversight over compliance with bank regulatory guidance governing Citi’s incentive compensation.

•Nomination, Governance and Public Affairs Committee: is responsible for (i) identifying individuals qualified to become Board members and recommending to the Board the director nominees for the next annual meeting of stockholders, (ii) leading the Board in its annual review of the Board’s performance, (iii) recommending to the Board directors for each committee for appointment by the Board, (iv) reviewing the Company’s policies and programs that relate to public issues of significance to the

Company and the public at large and (v) reviewing the Company’s relationships with external constituencies and issues that impact the Company’s reputation, and advising management as to its approach to each.

•Risk Management Committee: assists the Board in fulfilling its responsibility with respect to (i) oversight of Citigroup’s risk management framework and risk culture, including the significant policies and practices used in managing credit, market (trading and non-trading), liquidity, strategic, operational, compliance and reputation, including those pertaining to capital management, and (ii) oversight of the performance of the Global Risk Review (GRR) credit and collateral review function. The Committee reports to the Board of Directors regarding Citigroup’s risk profile, as well as management’s adherence to its risk management framework, including the significant policies and practices employed to manage risks in Citigroup, as well as the overall adequacy of the Risk Management function.

•Technology Committee: assists the Board in fulfilling its responsibility for oversight of the Company and its subsidiaries and affiliates with respect to (i) the planning and execution of Citigroup’s technology strategy and operating plan, (ii) the development of Citi’s target state operating model and architecture, (iii) technology-based risk management, including risk management framework, risk appetite and risk exposures of the Company, including cybersecurity, (iv) resource and talent planning of the Technology function and (v) the Company’s third-party management policies, practices and standards that relate to Technology.

In addition to the above, the Board has established the following ad hoc committee:

•Transformation Oversight Committee: provides oversight of the actions of Citi’s management to develop and execute a transformation of Citi’s risk and control environment pursuant to the FRB and OCC Consent Orders (see “Citi’s Multiyear Transformation—FRB and OCC Consent Orders Compliance” above).

The Citigroup CEO has established four standing committees that cover the primary risks to which Citi (i.e., Group) is exposed. These consist of:

•Citigroup Asset and Liability Committee (ALCO): responsible for governance over management’s liquidity risk and market risk (non-trading) management and for monitoring and influencing the balance sheet, investment securities and capital management activities of Citigroup.

•Group Business Risk and Control Committee (GBRCC): provides governance oversight of Citi’s compliance and operational risks and is responsible for ensuring that these risks are adequately identified, monitored, reported, managed and escalated, and that appropriate action is taken.

•Group Reputation Risk Committee (GRRC): provides governance oversight for reputation risk management across Citi, while promoting the culture of risk awareness and high standards of culture and conduct.

•Group Risk Management Committee (GRMC): the primary senior executive level committee responsible for (i) overseeing the execution of Citigroup’s ERM Framework, (ii) monitoring Citi’s risk profile at an aggregate level inclusive of individual risk categories, (iii) ensuring that Citi’s risk profile remains consistent with its approved risk appetite and (iv) discussing material and emerging risks facing the Company. The Committee also provides comprehensive Group-wide coverage of credit risk, market risk (trading) and strategic risk.

In addition to the Executive Management committees listed above, management may establish ad-hoc committees in response to regulatory feedback or to manage additional activities when deemed necessary.

The figure below illustrates the reporting lines between the Board and Executive Management committees:

CREDIT RISK

Credit risk is the risk of loss resulting from the decline in credit quality of a client, customer or counterparty (or downgrade risk) or the failure of a borrower, counterparty, third party or issuer to honor its financial or contractual obligations. For example, credit risk can arise from a deterioration in (i) the operating and financial performance of a borrower or (ii) a decline in the quality or value of any underlying collateral, both of which may also be impacted by adverse changes in macroeconomic, geopolitical, market and other factors. Credit risk is one of the most significant risks Citi faces as an institution (see “Risk Factors—Credit Risks” above). Credit risk arises in many of Citigroup’s business activities, including:

•consumer, commercial and corporate lending;

•capital markets derivative transactions;

•structured finance; and

•securities financing transactions (repurchase and reverse repurchase agreements, and securities loaned and borrowed).

Credit risk also arises from clearing and settlement activities, when Citi transfers an asset in advance of receiving its counter-value or advances funds to settle a transaction on behalf of a client. Concentration risk, within credit risk, is the risk associated with having credit exposure concentrated within a specific client, industry, region or other category.

Citi has an established framework in place for managing credit risk across all businesses that includes a defined risk appetite, credit limits and credit policies. Citi’s credit risk management framework also includes policies and procedures to manage problem exposures.

To manage concentration risk, Citi has in place a framework consisting of industry limits, single-name concentrations for each business and across Citigroup and a specialized product limit framework.

Credit exposures are generally reported in notional terms for accrual loans, reflecting the value at which the loans as well as other off-balance sheet commitments are carried on the Consolidated Balance Sheet. Credit exposure arising from capital markets activities is generally expressed as the current mark-to-market, net of margin, reflecting the net value owed to Citi by a given counterparty.

Citi’s loans are reported in two categories: corporate and consumer. These categories are classified primarily according to the operating segment, reporting unit and component that manage the loans in addition to the nature of the obligor, with corporate loans generally made for corporate institutional and public sector clients around the world and consumer loans to retail and small business customers.

The credit risk associated with Citi’s credit exposures is a function of the idiosyncratic creditworthiness of the obligor, as well as the terms and conditions of the specific obligation. Citi assesses the credit risk associated with its credit exposures on a regular basis through its allowance for credit losses (ACL) process (see “Significant Accounting Policies and Significant Estimates—Allowance for Credit Losses” below and Notes 1

and 16), as well as through regular stress testing at the company, business, geography and product levels. These stress-testing processes typically estimate potential incremental credit costs that would occur as a result of either downgrades in the credit quality or defaults of the obligors or counterparties. See Notes 15 and 16 for additional information on Citi’s credit risk management.

Loans

The table below details the average loans, by segment and/or business, and the total Citigroup end-of-period loans for each of the periods indicated:

On an average basis, loans increased 2% year-over-year and were relatively unchanged sequentially. The year-over-year increase was largely due to growth in USPB, Marketsand Services.

As of the fourth quarter of 2024, average loans for:

•Services increased 5% year-over-year, primarily driven by strong demand in TTS for export and agency finance, as well as working capital loans.

•Markets increased 6% year-over-year, largely driven by asset-backed securitization lending and North America residential financing in spread products.

•Banking decreased 6% year-over-year, primarily driven by regulatory capital optimization efforts.

•Wealth decreased 1%, primarily driven by regulatory capital optimization efforts.

•USPB increased 7% year-over-year, driven by growth in Retail Banking due to an increase in mortgage loans as a result of lower refinancings due to a higher interest rate environment and higher mortgage originations, as well as Branded Cards due to lower card payment rates and higher card spend volume.

End-of-period loans increased 1% year-over-year and sequentially. The year-over-year increase was largely due to growth in Branded Cards and Retail Banking in USPB, as well as growth in Markets and Services.

CORPORATE CREDIT

Consistent with its overall strategy, Citi’s corporate clients are typically corporations that value the depth and breadth of Citi’s global network. Citi aims to establish relationships with these clients whose needs encompass multiple products, including cash management and trade services, foreign exchange, lending, capital markets and M&A advisory.

Corporate Credit Portfolio

The following table details Citi’s corporate credit portfolio across Services, Markets, Bankingand the Mexico SBMM component of All Other—Legacy Franchises (excluding loans carried at fair value and loans held-for-sale), and before consideration of collateral or hedges, by remaining tenor for the periods indicated:

(1) Includes drawn loans, overdrafts, bankers’ acceptances and leases.

(2) Includes unused commitments to lend, letters of credit and financial guarantees.

Portfolio Mix—Geography and Counterparty

Citi’s corporate credit portfolio is diverse across geography and counterparty. The following table presents the percentages of this portfolio across North America and the clusters within International, based on Citi’s internal management geography (see “Other Risks—Country Risk—Top 25 Country Exposures” below):

The maintenance of accurate and consistent risk ratings across the corporate credit portfolio facilitates the comparison of credit exposure across all lines of business, geographies and products. Counterparty risk ratings reflect an estimated probability of default for a counterparty, and internal risk ratings are derived by leveraging validated statistical models and scorecards in combination with consideration of factors specific to the obligor or market, such as management experience, competitive position, regulatory environment and commodity prices. Facility risk ratings are assigned that reflect the probability of default of the obligor and factors that affect the loss given default of the facility, such as support or collateral. Internal ratings that generally correspond to BBB and above are considered investment grade, while those below are considered non-investment grade.

The following table presents the corporate credit portfolio by facility risk rating as a percentage of the total corporate credit portfolio:

Note: Total exposure includes direct outstandings and unfunded lending commitments.

In addition to the obligor and facility risk ratings assigned to all exposures, Citi may classify exposures in the corporate credit portfolio. These classifications are consistent with Citi’s interpretation of the U.S. banking regulators’ definition of criticized exposures, which may categorize exposures as special mention, substandard, doubtful or loss.

Risk ratings and classifications are reviewed regularly and adjusted as appropriate. The credit review process incorporates quantitative and qualitative factors, including financial and non-financial disclosures or metrics, idiosyncratic events or changes to the competitive, regulatory or macroeconomic environment.

Citi believes the corporate credit portfolio to be appropriately rated and classified as of December 31, 2024. Citi has applied management judgment to adjust internal ratings and classifications of exposures as both the macroeconomic environment and obligor-specific factors have changed, particularly where additional stress has been observed.

As obligor risk ratings are downgraded, the probability of default increases. Downgrades of obligor risk ratings tend to result in a higher provision for credit losses. In addition, appetite per obligor is reduced consistent with the ratings, and downgrades may result in the purchase of additional credit derivatives or other risk/structural mitigants to hedge the incremental credit risk, or may result in Citi seeking to reduce exposure to an obligor or an industry sector. Citi will continue to review exposures to ensure that the appropriate probability of default is incorporated into all risk assessments.

See Note 15 for additional information on Citi’s corporate credit portfolio.

Portfolio Mix—Industry

Citi’s corporate credit portfolio is diversified by industry. The following table details the allocation of Citi’s total corporate credit portfolio by industry:

(1) As of the periods in the table, Citi had less than 1% exposure to securities firms. See corporate credit portfolio by industry, below.

The following table details Citi’s corporate credit portfolio by industry as of December 31, 2024:

(1) Funded excludes loans carried at fair value of $7.8 billion at December 31, 2024.

(2) Includes non-accrual loan exposures and related criticized unfunded exposures.

(3) Represents the amount of purchased credit protection in the form of derivatives to economically hedge funded and unfunded exposures. Of the $37.8 billion of purchased credit protection, $34.8 billion represents the total notional amount of purchased credit derivatives on individual reference entities. The remaining $3 billion represents the first loss tranche of portfolios of purchased credit derivatives with a total notional amount of $22.9 billion, where the protection seller absorbs the first loss on the referenced loan portfolios.

(4) Autos total credit exposure includes securitization financing facilities secured by auto loans and leases, extended mainly to the finance company subsidiaries of global auto manufacturers, bank subsidiaries and independent auto finance companies, of approximately $17.5 billion ($10.5 billion of which was funded exposure with 100% rated investment grade) as of December 31, 2024.

(5) In addition to this exposure, Citi has energy-related exposure within the public sector (e.g., energy-related state-owned entities) and the transportation and industrials sector (e.g., offshore drilling entities) included in the table above. As of December 31, 2024, Citi’s total exposure to these energy-related entities was approximately $4.4 billion, of which approximately $2.1 billion consisted of direct outstanding funded loans.

(6) Includes $0.6 billion and $0.1 billion of funded and unfunded exposure at December 31, 2024, respectively, primarily related to commercial credit card delinquency-managed loans.

Exposure to Commercial Real Estate

As of December 31, 2024 and 2023, Citi’s total credit exposure to commercial real estate (CRE) was $65 billion and $66 billion, including $6 billion and $8 billion of exposure related to office buildings, respectively. This total CRE exposure consisted of approximately $56 billion and $55 billion, respectively, related to corporate clients, included in the real estate category in the tables above and below. Total CRE exposure also includes approximately $9 billion and $11 billion, respectively, related to Wealth clients that is not in the tables as they are not considered corporate exposures.

In addition, as of December 31, 2024, approximately 78% of Citi’s total CRE exposure was rated investment grade and more than 75% was to borrowers in the U.S (compared to approximately 80% rated investment grade and more than 77% to borrowers in the U.S. as of December 31, 2023).

As of December 31, 2024, the ACLL attributed to the total funded CRE exposure (including Wealth) was approximately 1.60%, and there were $574 million of non-accrual CRE loans. As of December 31, 2023, the ACLL attributed to the total funded CRE exposure (including Wealth) was approximately 1.49%, and there were $759 million of non-accrual CRE loans.

The following table details Citi’s corporate credit portfolio by industry as of December 31, 2023:

(1) Funded excludes loans carried at fair value of $7.3 billionat December 31, 2023.

(2) Includes non-accrual loan exposures and related criticized unfunded exposures.

(3) Represents the amount of purchased credit protection in the form of derivatives to economically hedge funded and unfunded exposures. Of the $35.9 billion of purchased credit protection, $33.7 billion represents the total notional amount of purchased credit derivatives on individual reference entities. The remaining $2.2 billion represents the first loss tranche of portfolios of purchased credit derivatives with a total notional amount of $16.7 billion, where the protection seller absorbs the first loss on the referenced loan portfolios.

(4) Autos total credit exposure includes securitization financing facilities secured by auto loans and leases, extended mainly to the finance company subsidiaries of global auto manufacturers, bank subsidiaries and independent auto finance companies, of approximately $16.9 billion ($10.6 billion of which was funded exposure with 100% rated investment grade) as of December 31, 2023.

(5) In addition to this exposure, Citi has energy-related exposure within the public sector (e.g., energy-related state-owned entities) and the transportation and industrials sector (e.g., offshore drilling entities) included in the table above. As of December 31, 2023, Citi’s total exposure to these energy-related entities was approximately $4.9 billion, of which approximately $2.5 billion consisted of direct outstanding funded loans.

(6) Includes $0.6 billion and $0.1 billion of funded and unfunded exposure at December 31, 2023, respectively, primarily related to commercial credit card delinquency-managed loans.

Credit Risk Mitigation

As part of its overall risk management activities, Citigroup uses credit derivatives, both partial and full term, and other risk mitigants to economically hedge portions of the credit risk in its corporate credit portfolio, in addition to outright asset sales. In advance of the expiration of partial-term economic hedges, Citi will determine, among other factors, the economic feasibility of hedging the remaining life of the instrument. The results of the mark-to-market and any realized gains or losses on credit derivatives are reflected primarily in Principal transactions in the Consolidated Statement of Income.

At December 31, 2024, September 30, 2024 and December 31, 2023, Banking had economic hedges on the corporate credit portfolio of $37.8 billion, $39.7 billion and $35.9 billion, respectively. Citi’s expected credit loss model used in the calculation of its ACL does not include the favorable impact of credit derivatives and other mitigants that are marked-to-market. In addition, the reported amounts of direct outstandings and unfunded lending commitments in the tables above do not reflect the impact of these hedging transactions. The credit protection was economically hedging underlying Banking corporate credit portfolio exposures with the following risk rating distribution:

Rating of Hedged Exposure

Loan Maturities and Fixed/Variable Pricing of Corporate Loans

(1) North America includes the U.S., Canada and Puerto Rico. Mexico is included in offices outside North America. The classification between offices in North America and outside North America is based on the domicile of the booking unit. The differences between the domicile of the booking unit and the domicile of the managing unit are not material.

(2) Loans secured primarily by real estate.

(3) Corporate loans are net of unearned income of $(969) million. Unearned income on corporate loans primarily represents loan origination fees, net of certain direct origination costs, that are deferred and recognized as Interest income over the lives of the related loans.

(4) Excludes $(72) million of unallocated portfolio-layer cumulative basis adjustments at December 31, 2024.

(5) Based on contractual terms. Repricing characteristics may effectively be modified from time to time using derivative contracts. See Note 24.

(6) Other includes installment and other and loans to government and official institutions.

CONSUMER CREDIT

Citi's consumer credit risk management framework is designed for a variety of environments. Underwriting and portfolio management policies are calibrated based on risk-return trade-offs by product and segment and changes are made based on performance against benchmarks as well as environmental stress. As warranted, Citi adjusts underwriting criteria to address consumer credit risks and macroeconomic challenges and uncertainties.

USPB provides credit cards, consumer mortgages, personal loans, small business banking and retail banking, and Wealth offers wealth management lending and other products globally that range from the affluent to ultra-high net worth customer segments through the Private Bank, Wealth at Work and Citigold. USPB’s retail banking products include a generally prime portfolio built through well-defined lending parameters within Citi’s risk appetite framework.

All Other—Legacy Franchises also provides such products in its remaining markets through Mexico Consumer and Asia Consumer (Korea, Poland and Russia).

Consumer Credit Portfolio

The following table presents Citi’s quarterly end-of-period consumer loans(1):

(1)End-of-period loans include interest and fees on credit cards.

(2)Consists of $98.0 billion, $99.8 billion, $100.9 billion, $100.0 billion and $101.6 billion of loans in North America as of December 31, 2024, September 30, 2024, June 30, 2024, March 31, 2024 and December 31, 2023, respectively. For additional information on the credit quality of the Wealth portfolio, see Note 15.

(3)Consists of $49.5 billion, $51.2 billion, $49.5 billion, $48.9 billion and $49.8 billion of loans outside North America as of December 31, 2024, September 30, 2024, June 30, 2024, March 31, 2024 and December 31, 2023, respectively.

(4)See Note 15 for details on loan-to-value ratios for the portfolios and FICO scores for the U.S. portfolio.

(5)At December 31, 2024, includes approximately $24 billion of classifiably managed loans fully collateralized by eligible financial assets and securities that have experienced very low historical net credit losses. Approximately 63% of the classifiably managed portion of these loans is investment grade.

(6)At December 31, 2024, includes approximately $20 billion of classifiably managed loans. Approximately 83% of these loans are fully collateralized (consisting primarily of marketable investment securities, commercial real estate and limited partner capital commitments in private equity) and have experienced very low historical net credit losses. As discussed below, approximately 83% of the classifiably managed portion of these loans is investment grade.

(7)Asia Consumer loan balances, reported within All Other—Legacy Franchises, include the three remaining Asia Consumer loan portfolios—Korea, Poland and Russia—as well as China until the completion of the sales of substantially all portfolios in July 2024.

(8)Primarily consists of certain North America consumer mortgages.

For information on changes to Citi’s consumer loans, see “Credit Risk—Loans” above.

Consumer Credit Trends

U.S. Personal Banking

As indicated above, USPB provides credit card products through Branded Cards and Retail Services, and mortgages and home equity, small business and personal consumer loans through Citi’s Retail Banking network. Retail Banking is concentrated in six major U.S. metropolitan areas. USPB also provides mortgages through correspondent channels.

As of December 31, 2024, approximately 77% of USPB EOP loans consisted of Branded Cards and Retail Services credit card loans, which generally drives the overall credit performance of USPB, as Branded Cards and Retail Services net credit losses represented approximately 95% of total USPB net credit losses for the fourth quarter of 2024. As of December 31, 2024, Branded Cards and Retail Services represented 69% and 31%, respectively, of EOP cards loans in USPB.

As presented in the chart above, the fourth quarter of 2024 net credit loss rate in USPB was broadly stable quarter-over-quarter. The net credit loss rate increased year-over-year, primarily reflecting the continued maturation of multiple cards loan vintages originated in recent years. The maturation was delayed by unprecedented levels of government stimulus during the pandemic. In addition, the increase was driven by macroeconomic pressures related to the elevated inflationary and interest rate environment impacting both cards portfolios, with lower FICO band customers primarily driving the increase.

The 90+ days past due delinquency rate increased quarter-over-quarter, primarily driven by seasonality, and increased year-over-year, primarily reflecting the continued maturation of multiple cards loan vintages originated in recent years. The maturation was delayed by unprecedented levels of government stimulus during the pandemic. In addition, the increase was driven by macroeconomic pressures related to the elevated inflationary and interest rate environment impacting both cards portfolios, with lower FICO band customers primarily driving the increase.

Branded Cards

USPB’s Branded Cards portfolio consists of both proprietary Citi branded cards portfolios (Value, Rewards and Cash) and co-branded cards portfolios (including Costco and American Airlines). Citi’s Branded Cards portfolio benefits from a diverse combination of products. Citi’s proprietary cards provide customers with a suite of products with rewards, cash rebates and lending solutions, while co-branded cards provide significant affinity benefits through partnerships with large-scale partners across the airline, retail and telecom sectors.

As presented in the chart above, the fourth quarter of 2024 net credit loss rate in Branded Cards was broadly stable quarter-over-quarter. The net credit loss rate increased year-over-year, primarily reflecting the continued maturation of multiple cards loan vintages originated in recent years. The maturation was delayed by unprecedented levels of government stimulus during the pandemic. In addition, the increase was driven by macroeconomic pressures related to the elevated inflationary and interest rate environment, with lower FICO band customers primarily driving the increase.

The 90+ days past due delinquency rate increased quarter-over-quarter, primarily driven by seasonality, and increased year-over-year, primarily reflecting the continued maturation of multiple cards loan vintages originated in recent years. The maturation was delayed by unprecedented levels of government stimulus during the pandemic. In addition, the increase was driven by macroeconomic pressures related to the elevated inflationary and interest rate environment, with lower FICO band customers primarily driving the increase.

Retail Services

USPB’s Retail Services partners directly with more than

20 retailers and dealers to offer private label and co-branded

cards. Retail Services’ target market focuses on select industry

segments such as home improvement, specialty retail,

consumer electronics and fuel. Retail Services continually

evaluates opportunities to add partners within target industries

that have strong loyalty, lending or payment programs and

growth potential.

As presented in the chart above, the fourth quarter of 2024

net credit loss rate in Retail Services increased quarter-over-quarter, primarily driven by seasonality, and increased year-over-year, primarily reflecting the continued maturation of multiple cards loan vintages originated in recent years. The maturation was delayed by unprecedented levels of government stimulus during the pandemic. In addition, the increase was driven by macroeconomic pressures related to the elevated inflationary and interest rate environment, with lower FICO band customers primarily driving the increase.

The 90+ days past due delinquency rate was broadly stable quarter-over-quarter and increased year-over-year, primarily reflecting the continued maturation of multiple cards loan vintages originated in recent years. The maturation was delayed by unprecedented levels of government stimulus during the pandemic. In addition, the increase was driven by macroeconomic pressures related to the elevated inflationary and interest rate environment, with lower FICO band customers primarily driving the increase.

For additional information on cost of credit, loan delinquency and other information for Citi’s cards portfolios, see each respective business’s results of operations above and Note 15.

Retail Banking

USPB’s Retail Banking portfolio consists primarily of

consumer mortgages (including home equity) and unsecured

lending products, such as small business loans and personal

loans. The portfolio is generally delinquency managed, where

Citi evaluates credit risk based on FICO scores, delinquencies

and the value of underlying collateral. The consumer

mortgages in this portfolio have historically been extended to

high credit quality customers, generally with loan-to-value

ratios that are less than or equal to 80% on first and second

mortgages. For additional information, see “Loan-to-Value

(LTV) Ratios” in Note 15.

As presented in the chart above, the fourth quarter of 2024 net credit loss rate in Retail Banking increased quarter-over-

quarter and year-over-year, primarily driven by consumer overdraft loans.

The 90+ days past due delinquency rate was largely unchanged quarter-over-quarter and decreased year-over-year. The decrease was primarily driven by lower delinquencies in consumer mortgages.

Wealth

Wealth provides consumer mortgages, margin lending, credit cards and other lending products to customer segments that range from affluent to ultra-high net worth through the Private Bank, Wealth at Work and Citigold businesses. These customer segments represent a target market that is characterized by historically low default rates and delinquencies and includes loans that are delinquency managed or classifiably managed. The delinquency-managed portfolio consists primarily of mortgages, margin lending and credit cards.

As of December 31, 2024, approximately $43 billion, or 29%, of the portfolios were classifiably managed and primarily consisted of mortgage loans, margin loans, personal and small business loans and other lending programs. These classifiably managed loans are primarily evaluated for credit risk based on their internal risk rating, of which 72% were rated investment grade. While the 90+ days past due delinquency rates shown in the chart above were calculated only for the delinquency-managed portfolio, the net credit loss rates presented were calculated using net credit losses for both the delinquency and classifiably managed portfolios.

As presented in the chart above, the fourth quarter of 2024 net credit loss rate in Wealth was broadly stable quarter-over-quarter and year-over-year. The 90+ days past due delinquency rate increased quarter-over-quarter and year-over-year, primarily driven by consumer mortgages. The low net credit loss and the 90+ days past due delinquency rates continued to reflect the strong credit profiles of the portfolios.

Mexico Consumer

Mexico Consumer operates in Mexico through Banamex and provides credit cards, consumer mortgages and small business and personal loans. Mexico Consumer serves a mass-market segment in Mexico and focuses on developing multiproduct relationships with customers.

As of December 31, 2024, approximately 40% of Mexico Consumer EOP loans consisted of credit card loans, which generally drives the overall credit performance of Mexico Consumer, as the cards net credit losses represented approximately 60% of total Mexico Consumer net credit losses for the fourth quarter of 2024.

As presented in the chart above, the fourth quarter of 2024 net credit loss rate and the 90+ days past due delinquency rate in Mexico Consumer increased quarter-over-quarter and year-over-year, primarily driven by the ongoing normalization of loss and delinquency rates from post-pandemic lows.

For additional details on cost of credit, loan delinquency and other information for Citi’s consumer loan portfolios, see each respective business’s results of operations above and Note 15.

U.S. Cards FICO Distribution

The following tables present the current FICO score distributions for Citi’s Branded Cards and Retail Services portfolios based on end-of-period receivables. FICO scores are updated as they become available.

Branded Cards

Retail Services

(1)Excludes immaterial balances for Canada and for customers for which no FICO scores are available.

The FICO distribution of both Branded Cards and Retail Services portfolios was broadly stable quarter-over-quarter and year-over-year. The FICO distribution continued to reflect the strong underlying credit quality of the portfolios. See Note 15 for additional information on FICO scores.

Additional Consumer Credit Details

Consumer Loan Delinquencies Amounts and Ratios

(1)End-of-period (EOP) loans include interest and fees on credit cards.

(2)The ratios of 90+ days past due and 30–89 days past due are calculated based on EOP loans, net of unearned income.

(3)Excludes EOP classifiably managed Private Bank loans. These loans are not included in the delinquency numerator, denominator and ratios.

(4)These loans are evaluated for non-accrual status and write-off primarily based on their internal risk classification and not solely on their delinquency status, and, therefore, delinquency metrics are excluded from this table. As of December 31, 2024, 2023 and 2022, 72%, 85% and 96% of Wealth classifiably managed loans were rated investment grade. For additional information on the credit quality of the Wealth portfolio, including classifiably managed portfolios, see “Consumer Credit Trends” above.

(5)The 90+ days past due and 30–89 days past due and related ratios for Retail Banking exclude loans guaranteed by U.S. government-sponsored agencies since the potential risk of loss predominantly resides with the U.S. government-sponsored agencies. The amounts excluded for loans 90+ days past due and (EOP loans) were $69 million ($0.5 billion), $63 million ($0.5 billion) and $89 million ($0.6 billion) at December 31, 2024, 2023 and 2022, respectively. The amounts excluded for loans 30–89 days past due (the 30–89 days past due EOP loans have the same adjustments as the 90+ days past due EOP loans) were $66 million, $73 million and $70 million at December 31, 2024, 2023 and 2022, respectively. The EOP loans in the table include the guaranteed loans.

(6)The 90+ days past due balances for Branded Cards and Retail Services are generally still accruing interest. Citi’s policy is generally to accrue interest on credit card loans until 180 days past due, unless notification of bankruptcy filing has been received earlier.

(7)Asia Consumer includes delinquencies and loans in Poland and Russia for all periods presented.

(8)Citi has entered into agreements to sell certain Asia Consumer banking businesses. Accordingly, the loans of these businesses have been reclassified as HFS in Other assets on the Consolidated Balance Sheet, and, hence, the loans and related delinquencies and ratios are not included in this table. The most recent reclassifications commenced as follows: Taiwan and Indonesia in the first quarter of 2022; Taiwan closed in the third quarter of 2023 and Indonesia closed in the fourth quarter of 2023. See Note 2.

(9)The 90+ days past due and 30–89 days past due and related ratios exclude U.S. mortgage loans that are primarily related to U.S. mortgages guaranteed by U.S. government-sponsored agencies since the potential risk of loss predominantly resides with the U.S. agencies. The amounts excluded for 90+ days past due and (EOP loans) were $66 million ($0.2 billion), $67 million ($0.2 billion) and $90 million ($0.3 billion) at December 31, 2024, 2023 and 2022, respectively. The amounts excluded for loans 30–89 days past due (the 30–89 days past due EOP loans have the same adjustments as the 90+ days past due EOP loans) were $34 million, $36 million and $37 million at December 31, 2024, 2023 and 2022, respectively. The EOP loans in the table include the guaranteed loans.

Consumer Loan Net Credit Losses (NCLs) and Ratios

(1)Average loans include interest and fees on credit cards.

(2)The ratios of net credit losses are calculated based on average loans, net of unearned income.

(3)All Other (managed basis) excludes divestiture-related impacts (Reconciling Items) related to (i) Citi’s divestitures of its Asia Consumer businesses and (ii) the

planned IPO of Mexico Consumer/SBMM within Legacy Franchises. The Reconciling Items are fully reflected in the various line items in Citi’s Consolidated Statement of Income. See “All Other—Divestiture-Related Impacts (Reconciling Items)” above.

(4)Asia Consumer also includes NCLs and average loans in Poland and Russia for all periods presented.

(5)Approximately $0 million, $25 million and $155 million in NCLs relating to certain Asia Consumer businesses classified as held-for-sale in Other assets and Other liabilities on the Consolidated Balance Sheet were recorded as a reduction in revenue (Other revenue) in 2024, 2023 and 2022, respectively. Accordingly, these NCLs are not included in this table. See footnote 3 to this table.

Loan Maturities and Fixed/Variable Pricing of Consumer Loans

Loan Maturities

(1)Credit card loans with maturities greater than one year represent loan modifications to borrowers experiencing financial difficulty and are at fixed interest rates.

Fixed/Variable Pricing

(1)Credit card loans with maturities greater than one year represent loan modifications to borrowers experiencing financial difficulty and are at fixed interest rates.

ADDITIONAL CONSUMER AND CORPORATE CREDIT DETAILS

Loans Outstanding

(1) North America includes the U.S., Canada and Puerto Rico. Mexico is included in offices outside North America. The classification of corporate loans between offices in North America and outside North America is based on the domicile of the booking unit. The difference between the domicile of the booking unit and the domicile of the managing unit is not material.

(2) Loans secured primarily by real estate.

(3) Consumer loans are net of unearned income of $889 million, $802 million, $712 million, $629 million and $692 million at December 31, 2024, 2023, 2022, 2021 and 2020, respectively. Unearned income on consumer loans primarily represents loan origination fees, net of certain direct origination costs, that are deferred and recognized as Interest income over the lives of the related loans.

(4) Installment and other includes loans to SPEs and TTS commercial cards.

(5) Corporate loans include Mexico SBMM loans and are net of unearned income of $(969) million, $(917) million, $(797) million, $(770) million and $(787) million at December 31, 2024, 2023, 2022, 2021 and 2020, respectively. Unearned income on corporate loans primarily represents loan origination fees, net of certain direct origination costs, that are deferred and recognized as Interest income over the lives of the related loans.

(6) Because loans carried at fair value do not have an ACLL, they are excluded from the ACLL ratio calculation.

Details of Credit Loss Experience

(1)On January 1, 2023, Citi adopted Accounting Standards Update (ASU) 2022-02, Financial Instruments—Credit Losses (Topic 326): TDRs and Vintage Disclosures. The ASU eliminated the accounting and disclosure requirements for TDRs, including the requirement to measure the ACLL for TDRs using a discounted cash flow (DCF) approach. On January 1, 2023, Citi recorded a $352 million decrease in the Allowance for loan losses, along with a $290 million after-tax increase to Retained earnings. See Note 1.

(2)On January 1, 2020, Citi adopted Accounting Standards Codification (ASC) 326, Financial Instruments—Credit Losses (CECL). The ASC introduces a new credit loss methodology requiring earlier recognition of credit losses while also providing additional disclosure about credit risk. On January 1, 2020, Citi recorded a $4.1 billion, or an approximate 29%, pretax increase in the Allowance for credit losses, along with a $3.1 billion after-tax decrease in Retained earnings and a deferred tax asset increase of $1.0 billion. This transition impact reflects (i) a $4.9 billion build to the consumer ACL due to longer estimated tenors than under the incurred loss methodology under prior U.S. GAAP, net of recoveries, and (ii) a $0.8 billion decrease to the corporate ACL due to shorter remaining tenors, incorporation of recoveries and use of more specific historical loss data based on an increase in portfolio segmentation across industries and geographies.

(3)Includes all adjustments to the allowance for credit losses, such as changes in the allowance from acquisitions, dispositions, securitizations, FX translation, purchase accounting adjustments, etc.

(4)2024 includes an approximate $300 million decrease related to FX translation, as well as an initial allowance for credit losses on newly purchased credit-deteriorated assets during the year.

(5)2023 includes an approximate $175 million increase related to FX translation.

(6)2022 includes an approximate $350 million reclass related to the announced sales of Citi’s consumer banking businesses in Thailand, India, Malaysia, Taiwan, Indonesia, Bahrain and Vietnam. Also includes a decrease of approximately $100 million related to FX translation.

(7)2021 includes an approximate $280 million reclass related to Citi’s agreement to sell its Australia consumer banking business and an approximate $90 million reclass related to Citi’s agreement to sell its Philippines consumer banking business. Those ACLL were reclassified to Other assets during 2021. 2021 also includes a decrease of approximately $134 million related to FX translation.

(8)2020 includes reductions of approximately $4 million related to the transfer to HFS of various real estate loan portfolios. In addition, 2020 includes an increase of approximately $97 million related to FX translation.

(9)December 31, 2024, 2023, 2022, 2021 and 2020 exclude $8.0 billion, $7.6 billion, $5.4 billion, $6.1 billion and $6.9 billion, respectively, of loans that are carried at fair value.

(10)Represents additional credit reserves recorded as Other liabilities on the Consolidated Balance Sheet.

(11)The ACLL represents management’s estimate of expected credit losses in the portfolio and troubled debt restructurings. See “Significant Accounting Policies and Significant Estimates” below. Attribution of the allowance is made for analytical purposes only and is available to absorb probable credit losses inherent in the overall portfolio.

Allowance for Credit Losses on Loans (ACLL)

The following tables detail information on Citi’s ACLL, loans and coverage ratios:

(1)Excludes loans carried at fair value, since they do not have an ACLL and are excluded from the ACLL ratio calculation.

(2)Includes both Branded Cards and Retail Services. As of December 31, 2024, the $13.6 billion of ACLL represented approximately 22 months of coincident net credit loss coverage (based on 4Q24 NCLs). As of December 31, 2024, Branded Cards ACLL as a percentage of EOP loans was 6.4% and Retail Services ACLL as a percentage of EOP loans was 11.3%. As of December 31, 2023, the $12.6 billion of ACLL represented approximately 25 months of coincident net credit loss coverage (based on 4Q23 NCLs). As of December 31, 2023, Branded Cards ACLL as a percentage of EOP loans was 6.0% and Retail Services ACLL as a percentage of EOP loans was 11.1%.

(3)Includes residential mortgages, retail loans and personal, small business and other loans, including those extended through the Private Bank network.

(4)The above corporate loan classifications are broadly based on the loan’s collateral, purpose and type of borrower, which may be different from the following industry table. For example, commercial and industrial, financial institutions, and installment and other loan classifications include various forms of loans to borrowers across multiple industries, whereas mortgage and real estate includes loans secured primarily by real estate.

The following table details Citi’s corporate credit ACLL by industry exposure:

(1) Funded exposure excludes loans carried at fair value of $7.8 billion that are not subject to ACLL under the CECL standard.

(2) As of December 31, 2024, the portion of the ACLL attributed to the total funded CRE exposure (including the Private Bank) was approximately 1.60%.

(3) Includes $0.6 billion of funded exposure at December 31, 2024, primarily related to commercial credit card delinquency-managed loans.

(4) As of December 31, 2024, the ACLL above reflects coverage of 0.4% of funded investment-grade exposure and 2% of funded non-investment-grade

exposure.

The following table details Citi’s corporate credit ACLL by industry exposure:

(1) Funded exposure excludes loans carried at fair value of $7.3 billion that are not subject to ACLL under the CECL standard.

(2) As of December 31, 2023, the portion of the ACLL attributed to the total funded CRE exposure (including the Private Bank) was approximately 1.49%.

(3) Includes $0.6 billion of funded exposure at December 31, 2023, primarily related to commercial credit card delinquency-managed loans.

(4) As of December 31, 2023, the ACLL above reflects coverage of 0.3% of funded investment-grade exposure and 2.9% of funded non-investment-grade exposure.

Non-Accrual Loans and Assets

There is a certain amount of overlap among non-accrual loans and assets. The following summary provides a general description of each category:

•Corporate and consumer (including commercial banking) non-accrual status is based on the determination that payment of interest or principal is doubtful.

•A corporate loan may be classified as non-accrual and still be current on principal and interest payments under the terms of the loan structure.

•Consumer non-accrual status is generally based on aging, i.e., the borrower has fallen behind on payments.

•Consumer mortgage loans, other than Federal Housing Administration (FHA)–insured loans, are classified as non-accrual within 60 days of notification that the borrower has filed for bankruptcy. Uninsured consumer mortgage loans are classified as non-accrual if the loan is 90 days or more past due. In addition, home equity loans are classified as non-accrual if the related residential first mortgage loan is 90 days or more past due.

•U.S. Branded Cards and Retail Services are not included because, under industry standards, credit card loans accrue interest until such loans are charged off, which typically occurs at 180 days of contractual delinquency.

Non-Accrual Loans

The table below summarizes Citigroup’s non-accrual loans (NAL) as of the periods indicated. Non-accrual loans may still be current on interest payments. In situations where Citi reasonably expects that only a portion of the principal owed will ultimately be collected, all payments received are reflected as a reduction of principal and not as interest income. For all other non-accrual loans, cash interest receipts are generally recorded as revenue.

(1)Corporate loans are placed on non-accrual status based on a review by Citigroup’s risk officers. Corporate non-accrual loans may still be current on interest payments. With limited exceptions, the following practices are applied for consumer loans: consumer loans, excluding credit cards and mortgages, are placed on non-accrual status at 90 days past due and are charged off at 120 days past due; residential mortgage loans are placed on non-accrual status at 90 days past due and written down to net realizable value at 180 days past due. Consistent with industry conventions, Citigroup generally accrues interest on credit card loans until such loans are charged off, which typically occurs at 180 days contractual delinquency. As such, the non-accrual loan disclosures do not include credit card loans. The balances above represent non-accrual loans within Corporate loansand Consumer loans on the Consolidated Balance Sheet.

(2)Approximately 61%, 50%, 50%, 56% and 64% of Citi’s corporate non-accrual loans remain current on interest and principal payments at December 31, 2024, 2023, 2022, 2021 and 2020, respectively.

(3)The December 31, 2024 total corporate non-accrual loans represented 0.46% of total corporate loans.

(4) Asia Consumer includes balances in Poland and Russia for all periods presented and in Bahrain for December 31, 2021 and 2020.

The changes in Citigroup’s non-accrual loans were as follows:

The table below summarizes Citigroup’s other real estate owned (OREO) assets. OREO is recorded on the Consolidated Balance Sheet within Other assets. This represents the carrying value of all real estate property acquired by foreclosure or other legal proceedings when Citi has taken possession of the collateral:

(1)The International OREO details by cluster are not provided due to the immateriality of such amounts.

(2)The ACLL includes the allowance for Citi’s credit card portfolios and purchased credit-deteriorated loans, while the non-accrual loans exclude credit card balances (with the exception of certain international portfolios).

LIQUIDITY RISK

Adequate and diverse sources of funding and liquidity are essential to Citi’s businesses. Funding and liquidity risks arise from several factors, many of which are mostly or entirely outside of Citi’s control, such as disruptions in the financial markets, changes in key funding sources, credit spreads, changes in Citi’s credit ratings and macroeconomic, geopolitical and other conditions. For additional information, see “Risk Factors—Liquidity Risks” above.

Citi’s funding and liquidity management objectives are aimed at (i) funding its existing asset base, (ii) growing its core businesses, (iii) maintaining sufficient liquidity, structured appropriately, so that Citi can operate under a variety of adverse circumstances, including potential Company-specific and/or market liquidity events in varying durations and severity, and (iv) satisfying regulatory requirements, including, but not limited to, those related to resolution planning (see “Resolution Plan” and “Total Loss-Absorbing Capacity (TLAC)” below). Citigroup’s primary liquidity objectives are established by entity, and in aggregate, across two major categories:

•Citibank (including Citibank Europe plc, Citibank Singapore Ltd. and Citibank (Hong Kong) Ltd.); and

•Citi’s non-bank and other entities, including the parent holding company (Citigroup Inc.), Citi’s primary intermediate holding company (Citicorp LLC), Citi’s broker-dealer subsidiaries (including Citigroup Global Markets Inc., Citigroup Global Markets Limited and Citigroup Global Markets Japan Inc.) and other bank and non-bank subsidiaries that are consolidated into Citigroup (including Banamex).

At an aggregate Citigroup level, Citi’s goal is to maintain sufficient funding in amount and tenor to fully fund customer assets and to provide an appropriate amount of cash and high-quality liquid assets (as discussed below), even in times of stress, in order to meet its payment obligations as they come due. The liquidity risk management framework provides that, in addition to the aggregate requirements, certain entities be self-sufficient or net providers of liquidity, including in conditions established under their designated stress tests.

Citi’s primary funding sources include (i) corporate and consumer deposits via Citi’s bank subsidiaries, including Citibank, N.A. (Citibank), (ii) long-term debt (primarily senior and subordinated debt) mainly issued by Citigroup Inc., as the parent, and Citibank, and (iii) stockholders’ equity. These sources may be supplemented by short-term borrowings, primarily in the form of secured funding transactions.

Citi’s funding and liquidity framework, working in concert with overall asset/liability management, helps ensure that there is sufficient liquidity and tenor in the overall liability structure (including funding products) of the Company relative to the liquidity requirements of Citi’s assets. This reduces the risk that liabilities will become due before assets mature or are

monetized. The Company holds excess liquidity, primarily in the form of high-quality liquid assets (HQLA), as presented in the table below.

Citi’s liquidity is managed centrally by Corporate Treasury, reported within Corporate/Other in All Other, in conjunction with regional and in-country treasurers with oversight provided by Independent Risk Management and various Asset and Liability Committees (ALCOs) at the individual entity, region, country and business levels. Pursuant to this approach, Citi’s HQLA are managed with emphasis on asset/liability management and entity-level liquidity adequacy throughout Citi.

Citi’s CRO and CFO co-chair Citigroup’s ALCO, which includes Citi’s Treasurer and other senior executives. The ALCO sets the strategy of the liquidity portfolio and monitors portfolio performance (see “Risk Governance—Board and Executive Management Committees” above). Significant changes to portfolio asset allocations are approved by the ALCO. Citi also has other ALCOs, which are established at various organizational levels to ensure appropriate oversight for individual entities, countries, franchise businesses and regions, serving as the primary governance committees for managing Citi’s balance sheet and liquidity.

As a supplement to Citigroup’s ALCO, Citi’s Funding and Liquidity Risk Committee (FLRC) is focused on funding and liquidity risk matters. The FLRC reviews and discusses the funding and liquidity risk profile of, as well as risk management practices for, Citigroup and Citibank and reports its findings and recommendations to each relevant ALCO as appropriate.

Liquidity Monitoring and Measurement

Stress Testing

Liquidity stress testing is performed for each of Citi’s major entities, operating subsidiaries and countries. Stress testing and scenario analyses are intended to quantify the potential impact of an adverse liquidity event on the balance sheet and liquidity position, in order to have sufficient liquidity on hand to manage through such an event. These scenarios include assumptions about significant changes in key funding sources, market triggers (such as credit ratings), potential uses of funding and macroeconomic, geopolitical and other conditions. These conditions include expected and stressed market conditions as well as Company-specific events.

Liquidity stress tests are performed to ascertain potential mismatches between liquidity sources and uses over a variety of time horizons and over different stressed conditions. To monitor the liquidity of an entity, these stress tests and potential mismatches are calculated on a daily basis.

Given the range of potential stresses, Citi maintains contingency funding plans on a consolidated basis and for individual entities. These plans specify a wide range of readily available actions for a variety of adverse market conditions or idiosyncratic stresses.

High-Quality Liquid Assets (HQLA)

Note: The amounts in the table above are presented on an average basis. For securities, the amounts represent the liquidity value that potentially could be realized and, therefore, exclude any securities that are encumbered and incorporate any haircuts applicable under the U.S. LCR rule. The table above incorporates various restrictions that could limit the transferability of liquidity between legal entities, including Section 23A of the Federal Reserve Act. Changes in HQLA line categories from the prior-year period were primarily driven by the reallocation of nontransferable HQLA, which did not change total average HQLA, and thus did not impact Citi’s LCR ratio.

(1) Foreign government debt includes securities issued or guaranteed by foreign sovereigns, agencies and multilateral development banks. Foreign government debt securities are held largely to support local liquidity requirements and Citi’s local franchises and principally include government bonds from Japan, Korea, the United Kingdom, Mexico and Hong Kong.

The table above includes average amounts of HQLA held at Citigroup’s operating entities that are eligible for inclusion in the calculation of Citigroup’s consolidated LCR, pursuant to the U.S. LCR rules. These amounts include the HQLA needed to meet the minimum requirements at these entities as well as any amounts in excess of these minimums that are available to be transferred to other entities within Citigroup. Citigroup’s average HQLA increased quarter-over-quarter as of the fourth quarter of 2024, primarily driven by an increase in average wholesale funding.

As of December 31, 2024, Citigroup had approximately $933 billion of available liquidity resources to support client and business needs, including end-of-period HQLA ($554 billion); additional unencumbered HQLA, including excess liquidity held at bank entities that is non-transferable to other entities within Citigroup ($227 billion); and unused borrowing capacity from available assets not already accounted for within Citi’s HQLA to support additional advances from the Federal Home Loan Bank (FHLB) and the Federal Reserve Bank discount window ($152 billion).

Short-Term Liquidity Measurement: Liquidity Coverage Ratio (LCR)

In addition to internal 30-day liquidity stress testing performed for Citi’s major entities, operating subsidiaries and countries, Citi also monitors its liquidity by reference to the LCR.

The LCR is calculated by dividing HQLA by estimated net outflows assuming a stressed 30-day period, with the net outflows determined by standardized stress outflow and inflow rates prescribed in the LCR rule. The outflows are partially offset by contractual inflows from assets maturing within 30 days. Similar to outflows, the inflows are calculated based on prescribed factors to various asset categories, such as retail loans as well as unsecured and secured wholesale lending. The minimum LCR requirement is 100%.

The table below details the components of Citi’s LCR calculation and HQLA in excess of net outflows for the periods indicated:

Note: The amounts are presented on an average basis.

As of December 31, 2024, Citigroup’s average LCR decreased from the quarter ended September 30, 2024. The decrease was primarily driven by increased market activity and client lending within Citi’s broker-dealer subsidiaries, partially offset by the increase in average HQLA.

In addition, considering Citi’s total available liquidity resources at quarter end of $933 billion, Citi maintained approximately $452 billion of excess liquidity resources above the stressed average net outflow of approximately $481 billion, presented in the LCR table above.

Long-Term Liquidity Measurement: Net Stable Funding Ratio (NSFR)

The NSFR measures the availability of an institution’s stable funding against the required stable funding in accordance with a calculation required by the rule. The ratio of available stable funding to required stable funding must be greater than 100%.

In general, an institution’s available stable funding includes portions of equity, deposits and long-term debt, while its required stable funding is based on the liquidity characteristics of its assets, derivatives and commitments. Standardized weightings are required to be applied to the various asset and liability classes.

For the quarter ended December 31, 2024, Citigroup’s consolidated NSFR was compliant with the 100% minimum requirement of the rule. (For additional information, see the Consolidated Citigroup NSFR Disclosure for the quarterly periods ended December 31, 2024 and September 30, 2024, on Citi’s Investor Relations website. The Consolidated Citigroup NSFR Disclosure on Citi’s Investor Relations website is not incorporated by reference into, and does not form any part of, this Form 10-K).

Select Balance Sheet Items

This section provides details of select liquidity-related assets and liabilities reported on Citigroup’s Consolidated Balance Sheet.

Cash and Investments

The table below details average and end-of-period Cash and due from banks, Deposits with banks (collectively cash) and Investment securities. Citi’s investment securities portfolio consists largely of highly liquid U.S. Treasury, U.S. agency and other sovereign bonds, with an aggregate duration of less than three years. EOP cash and investments decreased 5% quarter-over-quarter, primarily driven by reductions in deposits and total long-term debt. At December 31, 2024, Citi’s EOP cash and Investment securities comprised approximately 32% of total assets:

Deposits

The table below details the average deposits, by segment and/or business, and the total Citigroup end-of-period deposits for each of the periods indicated:

(1) During the third quarter of 2024, approximately $9 billion of institutional deposits were moved from Markets to All Other—Corporate/Other. Prior periods were not reclassified. For additional information about the reallocated deposits, see Note 3.

Citi’s deposit base is spread across a diversified set of countries, industries, clients and currencies and is subject to Citi’s Liquidity Risk Management Policy and Procedures.

End-of-period deposits decreased 2% year-over-year, primarily driven by declines in Legacy Franchises, reflecting the continued wind-downs, the impact of FX translation and reductions of corporate certificates of deposit in Corporate/Other. End-of-period deposits decreased 2% sequentially, primarily driven by temporary reductions at year end in Services.

On an average basis, deposits were relatively flat year-over-year and increased 1% sequentially, primarily driven by Services. In the fourth quarter of 2024, average deposits for:

•Services increased 4% year-over-year, as TTS increased 3% due to deepened client relationships and growth in operational deposits, and Securities Services increased 11% driven by AUC growth.

•USPB decreased 18% year-over-year, as the transfer of certain relationships and the associated deposits to Wealth more than offset underlying deposit growth.

•Wealth increased 3% year-over-year, largely reflecting the transfer of certain relationships and the associated deposits from USPB, partially offset by the shift in deposits to higher-yielding investments on Citi’s platform.

•All Other decreased 21% year-over-year, primarily reflecting the continued wind-downs, the impact of FX translation of deposits in Legacy Franchises and reductions of corporate certificates of deposit in Corporate/Other.

The majority of Citi’s $1.3 trillion of end-of-period deposits are institutional (approximately $820 billion) and span approximately 90 countries. A large majority of these institutional deposits are within TTS, and of these, approximately 80% are from clients that use all three TTS integrated services: payments and collections, liquidity management and working capital solutions. In addition, nearly 80% of TTS deposits are from clients that have a longer than 15-year relationship with Citi.

Citi also has a strong consumer and wealth deposit base, with $402 billion of USPB and Wealth deposits as of year end, which are diversified across the Private Bank, Citigold and Wealth at Work within Wealth, as well as USPB, and across regions and products. As of year end, approximately 66% of U.S. Citigold clients have been with Citi for more than 10 years and approximately 39% of Private Bank ultra-high net worth clients have been with Citi for more than 10 years. In addition, USPB’s deposits are spread across six key metropolitan areas in the U.S.

Long-Term Debt

Long-term debt (generally defined as debt with original maturities of one year or more) represents the most significant component of Citi’s funding for the Citigroup parent company and Citi’s non-bank subsidiaries and is a supplementary source of funding for the bank entities.

Weighted-Average Maturity (WAM)

The following table presents Citigroup and its affiliates’

(including Citibank) WAM of unsecured long-term debt issued with a remaining life greater than one year:

The WAM is calculated based on the contractual maturity of each security. For securities that are redeemable prior to maturity where the option is not held by the issuer, the WAM is calculated based on the earliest date an option becomes exercisable.

Long-Term Debt Outstanding

The following table presents Citi’s end-of-period total long-term debt outstanding for each of the dates indicated:

Note: Amounts represent the current value of long-term debt on Citi’s Consolidated Balance Sheet that, for certain debt instruments, includes consideration of fair value, hedging impacts and unamortized discounts and premiums.

(1) Non-bank includes long-term debt issued to third parties by the parent holding company (Citigroup) and Citi’s non-bank subsidiaries (including broker-dealer subsidiaries) that are consolidated into Citigroup. As of December 31, 2024, non-bank included $87.8 billion of long-term debt issued by Citi’s broker-dealer and other subsidiaries that are consolidated into Citigroup. Certain Citigroup consolidated hedging activities are also included in this line.

(2) Local country and other includes debt issued by Citi’s affiliates in support of their local operations. Within non-bank, certain secured financing is also included.

(3) Predominantly credit card securitizations, primarily backed by Branded Cards receivables.

Citi’s total long-term debt outstanding was essentially unchanged year-over-year. Sequentially, long-term debt outstanding decreased 4%, largely related to net maturities of senior benchmark debt at the bank and non-bank entities and customer-related debt issuances at the non-bank entities.

As part of its liability management, Citi has considered, and may continue to consider, opportunities to redeem or repurchase its long-term debt pursuant to open market purchases, tender offers or other means. Such redemptions and repurchases help reduce Citi’s overall funding costs. During 2024, Citi redeemed or repurchased an aggregate of $46.8 billion of its outstanding long-term debt.

Long-Term Debt Issuances and Maturities

The table below details Citi’s long-term debt issuances and maturities (including repurchases and redemptions) during the periods presented:

The table below details Citi’s aggregate long-term debt maturities (including repurchases and redemptions) in 2024, as well as its aggregate expected remaining long-term debt maturities by year as of December 31, 2024:

Resolution Plan

Citigroup is required under Title I of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (Dodd-Frank Act) and the rules promulgated by the FDIC and FRB to periodically submit a plan for Citi’s rapid and orderly resolution under the U.S. Bankruptcy Code in the event of material financial distress or failure. For additional information on risks related to the application of resolution plan requirements, see “Risk Factors—Strategic Risks” above. Citigroup alternates between submitting a full resolution plan and a targeted resolution plan on a biennial cycle.

Under Citi’s preferred “single point of entry” resolution plan strategy, only Citigroup, the parent holding company, would enter into bankruptcy, while Citigroup’s material legal entities (as defined in the public section of its 2023 resolution plan, which can be found on the FRB’s and FDIC’s websites) would remain operational outside of any resolution or insolvency proceedings. Citigroup’s resolution plan has been designed to minimize the risk of systemic impact to the U.S. and global financial systems, while maximizing the value of the bankruptcy estate for the benefit of Citigroup’s creditors, including its unsecured long-term debt holders.

In addition, in line with the FRB’s total loss-absorbing capacity (TLAC) rule, Citigroup’s shareholders and unsecured creditors—including its unsecured long-term debt holders—bear any losses resulting from Citigroup’s bankruptcy. Accordingly, any value realized by holders of its unsecured long-term debt may not be sufficient to repay the amounts owed to such debt holders in the event of a bankruptcy or other resolution proceeding of Citigroup.

The FDIC has also indicated that it was developing a single point of entry strategy to implement the Orderly Liquidation Authority under Title II of the Dodd-Frank Act, which provides the FDIC with the ability to resolve a firm when it is determined that bankruptcy would have serious adverse effects on financial stability in the U.S.

As previously disclosed, in response to feedback received from the FRB and FDIC, Citigroup took the following actions:

(i) Citicorp LLC (Citicorp), an existing wholly owned subsidiary of Citigroup, was established as an intermediate holding company (an IHC) for certain of Citigroup’s operating material legal entities;

(ii) Citigroup executed an inter-affiliate agreement with Citicorp, Citigroup’s operating material legal entities and certain other affiliated entities pursuant to which Citicorp is required to provide liquidity and capital support to Citigroup’s operating material legal entities in the event that Citigroup were to enter bankruptcy proceedings (Citi Support Agreement);

(iii) pursuant to the Citi Support Agreement:

•Citigroup made an initial contribution of assets, including certain high-quality liquid assets and inter-affiliate loans (Contributable Assets), to Citicorp, and Citicorp became the business-as-usual funding vehicle for Citigroup’s operating material legal entities;

•Citigroup will be obligated to continue to transfer Contributable Assets to Citicorp over time, subject to certain amounts retained by Citigroup to, among other things, meet Citigroup’s near-term cash needs;

•in the event of a Citigroup bankruptcy, Citigroup will be required to contribute most of its remaining assets to Citicorp; and

(iv) the obligations of both Citigroup and Citicorp under the Citi Support Agreement, as well as the Contributable Assets, are secured pursuant to a security agreement.

Total Loss-Absorbing Capacity (TLAC)

U.S. GSIBs are required to maintain minimum levels of TLAC and eligible LTD, each set by reference to the GSIB’s consolidated risk-weighted assets (RWA) and total leverage exposure. The intended purpose of the requirements is to facilitate the orderly resolution of U.S. GSIBs under the U.S. Bankruptcy Code and Title II of the Dodd-Frank Act. For additional information, including Citi’s TLAC and LTD amounts and ratios, see “Capital Resources—Current Regulatory Capital Standards” above.

SECURED FUNDING TRANSACTIONS AND SHORT-TERM BORROWINGS

Citi supplements its primary sources of funding with short-term financings that generally include (i) secured funding transactions consisting of securities loaned or sold under agreements to repurchase, i.e., repos, and (ii) to a lesser extent, short-term borrowings consisting of commercial paper issuances and borrowings from the FHLB and other market participants.

Secured Funding Transactions

Secured funding is primarily accessed through Citi’s broker-dealer subsidiaries, with a smaller portion executed through Citi’s bank entities to efficiently fund both (i) secured lending activity and (ii) a portion of the securities inventory held in the context of market making and customer activities. Secured funding transactions are predominantly collateralized by government debt securities. Generally, changes in the level of Citi’s secured funding are primarily due to fluctuations in secured lending activity in the matched book (as described below) and changes in securities inventory. In order to maintain reliable funding under a wide range of market conditions, Citi manages risks related to its secured funding by establishing secured funding limits and conducting daily stress tests that account for risks related to capacity, tenor, haircut, collateral type, counterparty and client actions.

Secured funding of $255 billion as of December 31, 2024 decreased 8% both year-over-year and sequentially, largely driven by lower financing to support trading-related assets within Citi’s broker-dealer subsidiaries. As of the quarter ended December 31, 2024, on an average basis, secured funding was $318 billion. The portion of secured funding in the broker-dealer subsidiaries that funds secured lending is commonly referred to as “matched book” activity and is primarily secured by high-quality liquid securities such as U.S. Treasury securities, U.S. agency securities and foreign government debt securities. Other “matched book” activity is secured by less liquid securities, including equity securities, corporate bonds and asset-backed securities, the tenor of which is generally equal to or longer than the tenor of the corresponding assets. As indicated above, the remaining portion of secured funding is used to fund securities inventory held in the context of market making and customer activities.

Short-Term Borrowings

Citi’s short-term borrowings of $49 billion as of December 31, 2024 increased 29% year-over-year, reflecting higher commercial paper issuances at the broker-dealer subsidiaries, as Citi continues to diversify its funding profile, and increased 17% sequentially, driven by the commercial paper issuances and normal business activity (see Note 19 for further information on Citigroup’s and its affiliates’ outstanding short-term borrowings).

CREDIT RATINGS

Citigroup’s funding and liquidity, funding capacity, ability to access capital markets and other sources of funds, the cost of these funds and its ability to maintain certain deposits are partially dependent on its credit ratings.

The table below presents the ratings for Citigroup and Citibank as of December 31, 2024. While not included in the table below, the long-term and short-term ratings of Citigroup Global Markets Holding Inc. (CGMHI) were A+/F1 at Fitch Ratings, A2/P-1 at Moody’s Ratings and A/A-1 at S&P Global Ratings as of December 31, 2024.

Ratings as of December 31, 2024

Potential Impacts of Ratings Downgrades

Ratings downgrades by Fitch, Moody’s or S&P could negatively impact Citigroup’s and/or Citibank’s funding and liquidity due to reduced funding capacity, including derivative triggers, which could take the form of cash obligations and collateral requirements.

The following information is provided for the purpose of analyzing the potential funding and liquidity impact to Citigroup and Citibank of a hypothetical simultaneous ratings downgrade across all three major rating agencies. This analysis is subject to certain estimates, estimation methodologies, judgments and uncertainties. Uncertainties include potential ratings limitations that certain entities may have with respect to permissible counterparties, as well as general subjective counterparty behavior. For example, certain corporate customers and markets counterparties could re-evaluate their business relationships with Citi and limit transactions in certain contracts or market instruments with Citi. Changes in counterparty behavior could impact Citi’s funding and liquidity, as well as the results of operations of certain of its businesses. The actual impact to Citigroup or Citibank is unpredictable and may differ materially from the potential funding and liquidity impacts described below. For additional information on the impact of credit rating changes on Citi and its applicable subsidiaries, see “Risk Factors—Liquidity Risks” above.

Citigroup Inc. and Citibank—Potential Derivative Triggers

As of December 31, 2024, Citi estimates that a hypothetical one-notch downgrade of the senior debt/long-term rating across all three major rating agencies could impact funding and liquidity due to derivative triggers by approximately $0.1 billion, unchanged from September 30, 2024, for Citigroup Inc., and $0.1 billion, unchanged from September 30, 2024, for Citibank. Other funding sources, such as secured financing transactions and other margin requirements, for which there are no explicit triggers, could also be adversely affected.

In total, as of December 31, 2024, Citi estimates that a one-notch downgrade of Citigroup Inc. and Citibank across all three major rating agencies could result in increased aggregate cash obligations and collateral requirements of approximately $0.2 billion, compared to $0.2 billion as of September 30, 2024. As detailed under “High-Quality Liquid Assets (HQLA)” above, Citigroup has various liquidity resources available to its bank and non-bank entities in part as a contingency for the potential events described above.

In addition, a broad range of mitigating actions are currently included in Citigroup’s and Citibank’s contingency funding plans. For Citigroup, these mitigating factors include, but are not limited to, accessing surplus funding capacity from existing clients, tailoring levels of secured lending and adjusting the size of select trading books and collateralized borrowings at certain Citibank subsidiaries. Mitigating actions available to Citibank include, but are not limited to, selling or financing highly liquid government securities, tailoring levels of secured lending, adjusting the size of select trading assets, reducing loan originations and renewals, raising additional deposits or borrowing from the FHLB or central banks. Citi believes these mitigating actions could substantially reduce the funding and liquidity risk, if any, of the potential downgrades described above.

Citibank—Additional Potential Impacts

In addition to the above derivative triggers, Citi believes that a potential downgrade of Citibank’s senior debt/long-term rating across any of the three major rating agencies could also have an adverse impact on the commercial paper/short-term rating of Citibank. Citibank has provided liquidity commitments to consolidated asset-backed commercial paper conduits, primarily in the form of asset purchase agreements. As of December 31, 2024, Citibank had liquidity commitments of approximately $14.9 billion to consolidated asset-backed commercial paper conduits (compared to $11.0 billion at December 31, 2023) (see Note 23).

In addition to the above-referenced liquidity resources of certain Citibank entities, Citibank could reduce the funding and liquidity risk, if any, of the potential downgrades described above through mitigating actions, including repricing or reducing certain commitments to commercial paper conduits. In the event of the potential downgrades described above, Citi believes that certain corporate customers could re-evaluate their deposit relationships with Citibank. This re-evaluation could result in clients adjusting their discretionary deposit levels or changing their depository institution, which could potentially reduce certain deposit levels at Citibank. However, Citi could choose to adjust pricing, offer alternative deposit products to its existing customers or seek to attract deposits from new customers, in addition to the mitigating actions referenced above.

MARKET RISK

Market risk is the potential for losses arising from changes in the value of Citi’s assets and liabilities resulting from changes in market variables such as interest rates, foreign exchange rates, equity prices, commodity prices and credit spreads, as well as their implied volatilities. Market risk arises from both Citi’s trading and non-trading portfolios. For additional information on market risk and market risk management at Citi, see “Risk Factors” above.

Each business is required to establish, with approval from Citi’s market risk management, a market risk limit framework for identified risk factors that clearly defines approved risk profiles and is within the parameters of Citi’s overall risk appetite. These limits are monitored by the Risk organization, including various regional, legal entity and business Risk Management committees, Citi’s country and business Asset and Liability Committees and the Citigroup Risk Management and Asset and Liability Committees. In all cases, the businesses are ultimately responsible for the market risks taken and for remaining within their defined limits.

MARKET RISK OF NON-TRADING PORTFOLIOS

Market risk from non-trading portfolios stems predominantly from the potential impact of changes in interest rates and foreign exchange rates on Citi’s net interest income and on Citi’s Accumulated other comprehensive income (loss) (AOCI) from its investment securities portfolios. Market risk from non-trading portfolios also includes the potential impact of changes in foreign exchange rates on Citi’s capital invested in foreign currencies.

Banking Book Interest Rate Risk

For interest rate risk purposes, Citi’s non-trading portfolios are referred to as the Banking Book. Management of interest rate risk in the Banking Book is governed by Citi’s Non-Trading Market Risk Policy. Citigroup’s Asset and Liability Committee (ALCO) establishes Citi’s risk appetite and related limits for interest rate risk in the Banking Book, which are subject to approval by Citigroup’s Board of Directors.

Corporate Treasury is responsible for the day-to-day management of Citi’s Banking Book interest rate risk as well as periodically reviewing it with the ALCO. Citi’s Banking Book interest rate risk management is also subject to independent oversight from the second line of defense team reporting to the Chief Risk Officer.

Changes in interest rates impact Citi’s net income, AOCI and CET1. These changes primarily affect Citi’s Banking Book through net interest income, due to a variety of risk factors, including:

•Differences in timing and amounts of the maturity or repricing of assets, liabilities and off-balance sheet instruments;

•Changes in the level and/or shape of interest rate curves;

•Client behavior in response to changes in interest rates (e.g., mortgage prepayments, deposit betas); and

•Changes in the maturity of instruments resulting from changes in the interest rate environment.

As part of their ongoing activities, Citi’s businesses generate interest rate-sensitive positions from their client-facing products, such as loans and deposits. Interest rate risk is transferred via Citi’s funds transfer-pricing process to Citi Corporate Treasury. Citi Corporate Treasury uses various tools to manage the total interest rate risk position within the established risk appetite and target Citi’s desired risk profile, including its investment securities portfolio, company-issued debt and interest rate derivatives.

In addition, Citi uses multiple metrics to measure its Banking Book interest rate risk. Interest Rate Exposure (IRE) is a key metric that analyzes the impact of a range of scenarios on Citi’s Banking Book net interest income versus a base case. IRE does not represent a forecast of Citi’s net interest income.

The scenarios, methodologies and assumptions used in Citi’s IRE analysis are periodically evaluated and enhanced in response to changes in the market environment, changes in Citi’s balance sheet composition, enhancements in Citi’s modeling and other factors.

Citi utilizes the most recent quarter-end balance sheet, assuming no changes to its composition and size over the forecasted horizon (holding the balance sheet static). The forecasts incorporate expectations and assumptions of deposit pricing, loan spreads and mortgage prepayment behavior implied by the interest rate curves in each scenario. The base case scenario reflects the market-implied forward interest rates, and sensitivity scenarios assume instantaneous shocks to the base case. The forecasts do not assume Citi takes any risk-mitigating actions in response to changes in the interest rate environment. Certain interest rates are subject to flooring assumptions in downward rate scenarios. Deposit pricing sensitivities (i.e., deposit betas) are informed by historical and expected behavior. Actual deposit pricing could differ from the assumptions used in these forecasts.

Citi’s IRE analysis primarily reflects the impacts from the following Banking Book assets and liabilities: loans, client deposits, Citi’s deposits with other banks, investment securities, long-term debt, any related interest rate hedges and the funds transfer pricing of positions in total trading and credit portfolio value at risk (VaR). It excludes impacts from any positions that are included in total trading and credit portfolio VaR.

In addition to IRE, Citi analyzes economic value sensitivity (EVS) as a longer-term interest rate risk metric. EVS is a net present value (NPV)–based measure of the lifetime cash flows of Citi’s Banking Book. It estimates the interest rate sensitivity of the Banking Book’s economic value from longer-term assets being potentially funded with shorter-term liabilities, or vice versa. Citi manages EVS within risk limits approved by Citigroup’s Board of Directors that are aligned with Citi’s risk appetite.

Interest Rate Risk of Investment Portfolios—Impact

on AOCI

Citi measures the potential impacts of changes in interest rates on the value of its AOCI, which can in turn impact Citi’s common equity and tangible common equity. This will impact Citi’s CET1 and other regulatory capital ratios. Citi seeks to manage its exposure to changes in the market level of interest rates, while limiting the potential impact on its AOCI and regulatory capital position.

AOCI at risk is managed as part of the Company-wide interest rate risk position. AOCI at risk considers potential changes in AOCI (and the corresponding impact on the CET1 Capital ratio) relative to Citi’s capital generation capacity.

Citi uses 100 basis point (bps) shocks in each scenario to reflect its net interest income sensitivity to unanticipated changes in market interest rates, as potential monetary policy decisions and changes in economic conditions may be reflected in current market-implied forward rates.

The following table presents the 12-month estimated impact to Citi’s net interest income, AOCI and the CET1 Capital ratio, each assuming an unanticipated parallel instantaneous 100 bps increase in interest rates:

(1)Excludes trading book and fair value option banking book portfolios and replaces them with the associated transfer pricing.

(2)Includes the effect of changes in interest rates on AOCI related to investment securities, cash flow hedges and pension liability adjustments.

(3)Excludes the effect of changes in interest rates on AOCI related to cash flow hedges, as those changes are excluded from CET1 Capital.

As presented in the table above, Citi’s balance sheet is asset sensitive (assets reprice faster than liabilities), resulting in higher net interest income in increasing interest rate scenarios. The estimated impact to Citi’s net interest income in a 100 bps upward rate shock scenario as of December 31, 2024 remained relatively stable year-over-year. At progressively higher interest rate levels, the marginal net interest income benefit is lower, as Citi assumes it will pass on a larger share of rate changes to depositors (i.e., higher betas), further reducing Citi’s IRE sensitivity. Currency-specific interest rate changes and balance sheet factors may drive quarter-to-quarter volatility in Citi’s estimated IRE for a 100 bps upward rate shock.

All other currencies of $1.1 billion as of December 31, 2024 in the table above includes the impact from the following top five non-U.S. dollar currencies by absolute size: approximately $(0.2) billion from the euro, $0.2 billion from the British pound sterling, and approximately $0.1 billion each from the Chinese yuan, Swiss franc and Indian rupee. The remaining impact is spread across more than 30 additional currencies.

In a 100 bps upward rate shock scenario, Citi expects that the approximate $1.0 billion initial negative impact to AOCI could potentially be offset in shareholders’ equity through the expected recovery of the impact on AOCI through accretion of Citi’s investment portfolio and expected net interest income benefit over a period of approximately six months.

Scenario Analysis

The following table presents the estimated impact to Citi’s net interest income and AOCI under eight different interest rate scenarios for the U.S. dollar and all other currencies in which Citi has invested capital as of December 31, 2024. The 100 bps and 200 bps downward rate scenarios potentially may be impacted by the low level of interest rates in several countries and the assumption that market interest rates, as well as rates paid to depositors and charged to borrowers, do not fall below zero (i.e., the “flooring assumption”). The interest rate scenarios are also impacted by convexity related to mortgage products and deposit pricing.

Note: Each scenario assumes that the rate change will occur instantaneously. Changes in interest rates for maturities between the overnight rate and the 10-year rate are interpolated. The interest rate exposure in the table above assumes no change in deposit size or mix from the baseline forecast included in the different interest rate scenarios presented. As a result, in higher interest rate scenarios, customer activity resulting in a shift from non-interest-bearing and low interest rate deposit products to higher-yielding deposits would reduce the expected benefit to net interest income. Conversely, in lower interest rate scenarios, customer activity resulting in a shift from higher-yielding deposits to non-interest-bearing and low interest rate deposit products would reduce the expected decrease to net interest income.

(1)The Scenario 1 impact of $1,068 million consists of the following top five non-U.S. dollar currencies as of December 31, 2024 by absolute size: approximately $(0.2) billion from the euro, $0.2 billion from the British pound sterling, and approximately $0.1 billion each from the Chinese yuan, Swiss franc and Indian rupee. The remaining balance is spread across more than 30 additional currencies.

(2)Includes the effect of changes in interest rates on AOCI related to investment securities, cash flow hedges and pension liability adjustments.

As presented in the table above, the estimated impact to Citi’s net interest income is larger in the short end compared to the long end as Citi’s Banking Book has relatively higher interest rate exposure to the short end of the yield curve. For the U.S. dollar, exposure to downward rate shocks is larger in magnitude than to upward rate shocks. This is because of the lower benefit to net interest income from Citi’s deposit base at higher rate levels, as well as the prepayment effects on mortgage loans and mortgage-backed securities.

The magnitude of the impact to AOCI is greater in the short end compared to the long end. This is because Citi’s investment portfolio and pension liabilities are more sensitive to rates at shorter- and intermediate-term maturities.

Changes in Foreign Exchange Rates—Impacts on AOCI

and Capital

As of December 31, 2024, Citi estimates that an unanticipated parallel instantaneous 5% appreciation of the U.S. dollar against all of the other currencies in which Citi has invested capital could reduce Citi’s tangible common equity (TCE) by approximately $1.5 billion, or 1.0%, as a result of changes to Citi’s CTA in AOCI, net of hedges. This reduction in the TCE would be primarily driven by depreciation in the value of the euro, Mexican peso and Indian rupee.

This reduction in the TCE does not reflect any mitigating actions Citi may take, including ongoing management of its foreign currency translation exposure. TCE is used as a simplified metric to manage CET1 capital ratio volatility. Specifically, as currency movements change the value of Citi’s net investments in foreign currency-denominated capital, these movements also change the value of Citi’s RWA

denominated in those same currencies. This, coupled with Citi’s foreign currency hedging strategies, such as foreign currency borrowings, foreign currency forwards and other currency hedging instruments, lessens the impact of foreign currency movements on Citi’s CET1 Capital ratio. Changes in these hedging strategies, as well as hedging costs, divestitures and tax impacts, can further affect the actual impact of changes in foreign exchange rates on Citi’s capital compared to an unanticipated parallel shock, as described above.

The effect of Citi’s ongoing management strategies with respect to quarterly changes in foreign exchange rates (versus the U.S. dollar), and the quarterly impact of these changes on Citi’s TCE and CET1 Capital ratio, are presented in the table below. See Note 21 for additional information on the changes in AOCI.

(1) FX spot rate change is a weighted average based on Citi’s quarterly average GAAP capital exposure to foreign countries. A negative change in FX spot rate represents foreign currency depreciation versus the U.S. dollar.

Interest Income/Expense and Net Interest Margin (NIM)

(1)Interest income and Net interest income include the taxable equivalent gross-up adjustments (TEGU) primarily related to the tax-exempt bond portfolio and certain tax-advantaged loan programs of $94 million, $101 million and $165 million for 2024, 2023 and 2022, respectively.

(2)Interest expense associated with certain hybrid financial instruments, which are classified as Long-term debtand accounted for at fair value, is reported together with any changes in fair value as part of Principal transactionsin the Consolidated Statement of Income and is therefore not reflected in Interest expensein the table above.

(3) The average rate on interest income and NIM reflects TEGU. See footnote 1 above.

(4) Citi’s NIM is calculated by dividing net interest income (including TEGU) by average interest-earning assets.

Non-Markets Net Interest Income

(1)Interest income and Net interest income include TEGU discussed in the table above.

Citi’s net interest income in the fourth quarter of 2024 was $13.7 billion on a reported basis and $13.8 billion on a taxable equivalent basis, a decrease of $0.1 billion from the prior-year period, primarily driven by Markets (down approximately $0.1 billion), partially offset by non-Markets(up approximately $0.04 billion). The decline in Markets net interest income was primarily driven by higher funding costs related to trading inventory in Fixed Income Markets.

The increase in non-Markets net interest income was largely due to loan growth in cards in USPB and maturing assets in Citi’s securities portfolio being reinvested at higher yields, partially offset by net investment securities losses reflecting the repositioning of the investment securities portfolio.

Citi’s net interest margin was 2.42% on a taxable equivalent basis in the fourth quarter of 2024, an increase of nine basis points from the prior quarter, largely driven by higher Markets net interest margin.

Citi’s net interest income for 2024 decreased 1%, or approximately $0.8 billion, to $54.1 billion ($54.2 billion on a taxable equivalent basis) versus the prior year. The decrease was primarily due to a decrease in non-Markets net interest income, largely driven by higher funding costs in the mortgage-backed securities portfolio in Corporate Treasury within All Other and lower revenue from Citi’s net investment in Argentina, partially offset by growth in USPB and Wealth.

In 2024, Citi’s net interest margin decreased to 2.40% on a taxable equivalent basis, compared to 2.46% in 2023, primarily driven by lower revenue from Citi’s net investment in Argentina and higher funding cost.

Additional Interest Rate Details

Average Balances and Interest Rates—Assets(1)(2)(3)

Taxable Equivalent Basis

(1)Interest income and Net interest income include TEGU of $94 million, $101 million and $165 million for 2024, 2023 and 2022, respectively.

(2)Interest rates and amounts include the effects of risk management activities associated with the respective asset categories.

(3)Monthly or quarterly averages have been used by certain subsidiaries where daily averages are unavailable.

(4)Average rates reflect prevailing local interest rates, including inflationary effects and monetary corrections in certain countries.

(5)Average volumes of securities borrowed or purchased under agreements to resell are reported net pursuant to ASC 210-20-45. However, Interest income excludes the impact of ASC 210-20-45.

(6)The fair value carrying amounts of derivative contracts are reported net, pursuant to ASC 815-10-45, in Non-interest-earning assets and Other non-interest-bearing liabilities.

(7)Interest expense on Trading account liabilities of Services, Markets and Banking is reported as a reduction of Interest income. Interest incomeand Interest expense on cash collateral positions are reported in interest on Trading account assets and Trading account liabilities, respectively.

(8)Net of unearned income. Includes cash-basis loans.

(9)Includes assets from businesses held-for-sale (see Note 2) and Brokerage receivables.

Average Balances and Interest Rates—Liabilities and Equity, and Net Interest Income(1)(2)(3)

Taxable Equivalent Basis

(1)Interest income and Net interest income include TEGU discussed in the table above.

(2)Interest rates and amounts include the effects of risk management activities associated with the respective liability categories.

(3)Monthly or quarterly averages have been used by certain subsidiaries where daily averages are unavailable.

(4)Consists of other time deposits and savings deposits. Savings deposits are composed of insured money market accounts and other savings deposits.

(5)Average rates reflect prevailing local interest rates, including inflationary effects and monetary corrections in certain countries.

(6)Average volumes of securities sold under agreements to repurchase are reported net pursuant to ASC 210-20-45. However, Interest expense excludes the impact of ASC 210-20-45.

(7)The fair value carrying amounts of derivative contracts are reported net, pursuant to ASC 815-10-45, in Non-interest-earning assetsand Other non-interest-bearing liabilities.

(8)Interest expense on Trading account liabilities of Services, Markets and Banking is reported as a reduction of Interest income. Interest income and Interest expense on cash collateral positions are reported in interest on Trading account assets and Trading account liabilities, respectively.

(9)Includes Brokerage payables.

(10)Excludes hybrid financial instruments and beneficial interests in consolidated VIEs that are classified as Long-term debt, as the changes in fair value for these obligations are recorded in Principal transactions.

(11)Includes non-interest-bearing deposits in both the U.S. and outside of the U.S.

(12)Includes allocations for capital and funding costs based on the location of the asset.

Analysis of Changes in Interest Revenue(1)(2)(3)

(1)Interest income and Net interest income include the taxable equivalent adjustments discussed in the table above.

(2)Rate/volume variance is allocated based on the percentage relationship of changes in volume and changes in rate to the total net change.

(3)Changes in average rates reflect changes in prevailing local interest rates, including inflationary effects and monetary corrections in certain countries.

(4)Interest expense on Trading account liabilities of Services, Markets and Bankingis reported as a reduction of Interest income. Interest income and Interest expense on cash collateral positions are reported in interest on Trading account assetsand Trading account liabilities, respectively.

(5)Includes cash-basis loans.

(6)Includes Brokerage receivables.

Analysis of Changes in Interest Expense and Net Interest Income(1)(2)(3)

(1)Interest income and Net interest income include the taxable equivalent adjustments discussed in the table above.

(2)Rate/volume variance is allocated based on the percentage relationship of changes in volume and changes in rate to the total net change.

(3)Changes in average rates reflect changes in prevailing local interest rates, including inflationary effects and monetary corrections in certain countries.

(4)Interest expense on Trading account liabilities of Services, Markets and Banking is reported as a reduction of Interest income. Interest income and Interest expense on cash collateral positions are reported in interest on Trading account assetsand Trading account liabilities, respectively.

(5)Includes Brokerage payables.

MARKET RISK OF TRADING PORTFOLIOS

Trading portfolios include positions resulting from market-making activities, hedges of certain available-for-sale (AFS) debt securities, the CVA relating to derivative counterparties and all associated hedges, fair value option loans and hedges of the loan portfolio within capital markets origination. Management of the market risk of Citi’s trading portfolio is governed by the Mark-to-Market Risk Policy and the Markets Risk Management Committee.

The market risk of Citi’s trading portfolios is monitored using a combination of quantitative and qualitative measures, including, but not limited to, factor sensitivities, value at risk (VaR) and stress testing. Each trading portfolio across Citi’s businesses has its own market risk limit framework encompassing these measures and other controls, including trading mandates, new product approval, permitted product lists and pre-trade approval for larger, more complex and less liquid transactions. These controls enable the monitoring and management of Citi’s top market risks.

The following chart of total daily trading-related revenue (loss) captures trading volatility and shows the number of days in which revenues for Citi’s trading businesses fell within particular ranges. Trading-related revenue includes trading, net interest and other revenue associated with Citi’s trading businesses. It excludes DVA, FVA and CVA adjustments incurred due to changes in the credit quality of counterparties, as well as any associated hedges of that CVA. In addition, it excludes fees and other revenue associated with capital markets origination activities. Trading-related revenues are driven by both customer flows and the changes in valuation of the trading inventory. As presented in the chart below, Citi achieved positive trading-related revenue for 98.5% of the trading days in 2024.

Daily Trading-Related Revenue (Loss)(1)—12 Months Ended December 31, 2024

In millions of dollars

(1) Reflects the effects of asymmetrical accounting for economic hedges of certain AFS debt securities. Specifically, the change in the fair value of hedging derivatives is included in trading-related revenue, while the offsetting change in the fair value of hedged AFS debt securities is included in AOCI and not reflected above.

Factor Sensitivities

When managing market risk for its trading portfolios, Citi uses factor sensitivities to measure the change in value of a position for a defined change in a market risk factor, such as a change in the value of a U.S. Treasury bond for a one-basis-point change in interest rates. Citi’s Global Market Risk function, within the Independent Risk Management organization, works to ensure that factor sensitivities are calculated, monitored and limited for all material risks taken in the trading portfolios.

Value at Risk (VaR)

VaR estimates, at a 99% confidence level, the potential decline in the value of a position or a portfolio under normal market conditions assuming a one-day holding period. VaR statistics, which are based on historical data, can be materially different across firms due to differences in portfolio composition, VaR methodologies and model parameters. As a result, Citi believes VaR statistics can be used more effectively as indicators of trends in risk-taking within a firm, rather than as a basis for inferring differences in risk-taking across firms.

Citi uses a single, independently approved Monte Carlo simulation VaR model (see “VaR Model Review and Validation” below), which has been designed to capture material risk sensitivities (such as first- and second-order

sensitivities of positions to changes in market prices) of various asset classes/risk types (such as interest rate, credit spread, foreign exchange, equity and commodity risks). Citi’s VaR includes positions that are measured at fair value; it does not include investment securities classified as AFS or HTM. See Note 14 for information on these securities.

Citi believes its VaR model is conservatively calibrated to incorporate fat-tail scaling and the greater of short-term (approximately the most recent month) and long-term (18 months for commodities and three years for others) market volatility. The Monte Carlo simulation involves approximately 550,000 market factors, making use of approximately 480,000 time series, with sensitivities updated daily, volatility parameters updated intra-monthly and correlation parameters updated monthly. As of December 31, 2024, Citi estimates that the conservative features of the VaR calibration contribute an approximate 24% add-on to what would be a VaR estimated under the assumption of stable and perfectly, normally distributed markets.

As presented in the table below, Citi’s average trading VaR decreased $10 million from 2023 to 2024, due to reduced volatility and changes in exposure. Citi’s average trading and credit portfolio VaR decreased $15 million, in line with the decline in average trading VaR.

Year-end and Average Trading VaR and Trading and Credit Portfolio VaR

(1)Covariance adjustment (also known as diversification benefit) equals the difference between the total VaR and the sum of the VaRs tied to each risk type. The benefit reflects the fact that the risks within individual and across risk types are not perfectly correlated and, consequently, the total VaR on a given day will be lower than the sum of the VaRs relating to each risk type. The determination of the primary drivers of changes to the covariance adjustment is made by an examination of the impact of both model parameter and position changes.

(2) The total trading VaR includes mark-to-market and certain fair value option trading positions with the exception of hedges of the loan portfolio, fair value option loans and all CVA exposures. Available-for-sale and accrual exposures are not included.

(3) The specific risk-only component represents the level of equity and fixed income issuer-specific risk embedded in VaR.

(4) The credit portfolio is composed of mark-to-market positions associated with non-trading business units, the CVA relating to derivative counterparties, all associated CVA hedges and market sensitivity FVA hedges. FVA and DVA are not included. The credit portfolio also includes hedges of the loan portfolio, fair value option loans and hedges of the leveraged finance pipeline within capital markets origination.

The table below provides the range of market factor VaRs associated with Citi’s total trading VaR, inclusive of specific risk:

Note: No covariance adjustment can be inferred from the above table as the high and low for each market factor will be from different close-of-business dates.

The following table provides the VaR for Markets, excluding the CVA relating to derivative counterparties, hedges of CVA, fair value option loans and hedges of the loan portfolio:

VaR Model Review and Validation

Generally, Citi’s VaR review and model validation process entails reviewing the model framework, major assumptions and implementation of the mathematical algorithm. In addition, product-specific back-testing on portfolios is periodically completed as part of the ongoing model performance monitoring process and reviewed with Citi’s U.S. banking regulators. Furthermore, Regulatory VaR back-testing (as described below) is performed against buy-and-hold profit and loss on a monthly basis for multiple sub-portfolios across the organization (trading desk level and total Citigroup) and the results are shared with U.S. banking regulators.

Material VaR model and assumption changes must be independently validated within Citi’s Independent Risk Management organization. All model changes, including those for the VaR model, are validated by the model validation group within Citi’s Model Risk Management. In the event of significant model changes, parallel model runs are undertaken prior to implementation. In addition, significant model and assumption changes are subject to the periodic reviews and approval by Citi’s U.S. banking regulators.

Citi uses the same independently validated VaR model for both Regulatory VaR and Risk Management VaR (i.e., total trading and total trading and credit portfolios VaRs) and, as such, the model review and validation process for both purposes is as described above.

Regulatory VaR, which is calculated in accordance with Basel III, differs from Risk Management VaR because certain positions included in Risk Management VaR are not eligible

for market risk treatment in Regulatory VaR. The composition of Risk Management VaR is discussed under “Value at Risk” above. The applicability of the VaR model for positions eligible for market risk treatment under U.S. regulatory capital rules is periodically reviewed and approved by Citi’s U.S. banking regulators.

In accordance with Basel III, Regulatory VaR includes all trading book-covered positions and all foreign exchange and commodity exposures. Pursuant to Basel III, Regulatory VaR excludes positions that fail to meet the intent and ability to trade requirements and are therefore classified as non-trading book and categories of exposures that are specifically excluded as covered positions. Regulatory VaR excludes CVA on derivative instruments and DVA on Citi’s own fair value option liabilities. CVA hedges are excluded from Regulatory VaR and included in credit risk-weighted assets as computed under the Advanced Approaches for determining risk-weighted assets.

Regulatory VaR Back-Testing

In accordance with Basel III, Citi is required to perform back-testing to evaluate the effectiveness of its Regulatory VaR model. Regulatory VaR back-testing is the process in which the daily one-day VaR, at a 99% confidence interval, is compared to the buy-and-hold profit and loss (i.e., the profit and loss impact if the portfolio is held constant at the end of the day and re-priced the following day). Buy-and-hold profit and loss represents the daily mark-to-market profit and loss attributable to price movements in covered positions from the close of the previous business day. Buy-and-hold profit and loss excludes realized trading revenue, net interest, fees and commissions, intra-day trading profit and loss and changes in reserves.

Based on a 99% confidence level, Citi would expect two to three days in any one year where buy-and-hold losses exceed the Regulatory VaR. Given the conservative calibration of Citi’s VaR model (as a result of taking the greater of short- and long-term volatilities and fat-tail scaling of volatilities), Citi would expect fewer exceptions under normal and stable market conditions. Periods of unstable market conditions could increase the number of back-testing exceptions.

The following graph presents the daily buy-and-hold profit and loss associated with Citi’s covered positions compared to Citi’s one-day Regulatory VaR during 2024. During 2024, no back-testing exceptions were observed at the Citigroup level.

The difference between the 58.8% of days with buy-and-hold gains for Regulatory VaR back-testing and the 98.5% of days with trading, net interest and other revenue associated with Citi’s trading businesses, presented in the histogram of daily trading-related revenue below, reflects, among other things, that a significant portion of Citi’s trading-related revenue is not generated from daily price movements on these positions and exposures, as well as differences in the portfolio composition of Regulatory VaR and Risk Management VaR.

Regulatory Trading VaR and Associated Buy-and-Hold Profit and Loss(1)—12 Months Ended December 31, 2024

In millions of dollars

(1) Buy-and-hold profit and loss, as defined by the banking regulators under Basel III, represents the daily mark-to-market revenue movement attributable to the trading position from the close of the previous business day. Buy-and-hold profit and loss excludes realized trading revenue and net interest intra-day trading profit and loss on new and terminated trades, as well as changes in reserves. Therefore, it is not comparable to the trading-related revenue presented in the chart of daily trading-related revenue above.

Stress Testing

Citi performs market risk stress testing on a regular basis to estimate the impact of extreme market movements. It is performed on individual positions and trading portfolios, as well as in aggregate, inclusive of multiple trading portfolios. Citi’s market risk management, after consultations with the businesses, develops both systemic and specific stress scenarios, reviews the output of periodic stress testing exercises and uses the information to assess the ongoing appropriateness of exposure levels and limits. Citi uses two complementary approaches to market risk stress testing across all major risk factors (i.e., equity, foreign exchange, commodity, interest rate and credit spreads): top-down systemic stresses and bottom-up business-specific stresses. Systemic stresses are designed to quantify the potential impact of extreme market movements on an institution-wide basis, and are constructed using both historical periods of market stress and projections of adverse economic scenarios. Business-specific stresses are designed to probe the risks of particular portfolios and market segments, especially those risks that are not fully captured in VaR and systemic stresses.

The systemic stress scenarios and business-specific stress scenarios at Citi are used in several reports reviewed by senior management and also to calculate internal risk capital for trading market risk, as well as enable the monitoring and managing of Citi’s top market risks.

In general, changes in market values are defined over a one-year horizon. For the most liquid positions and market factors, changes in market values are defined over a shorter two-month horizon. The limited set of positions and market factors whose market value changes are defined over a two-month horizon are those that in management’s judgment have historically remained very liquid during financial crises, even as the trading liquidity of most other positions and market factors materially declined.

OPERATIONAL RISK

Operational risk is the risk of loss resulting from inadequate or failed internal processes, human error or systems errors, or external events. As discussed further below, operational risk includes cybersecurity risk. It also includes legal risk, which is the risk of loss (including litigation costs, settlements and regulatory fines) resulting from the failure of Citi to comply with laws, regulations, prudent ethical standards and contractual obligations in any aspect of its businesses, but excludes strategic and reputation risks. Citi also recognizes the impact of operational risk on the reputation risk associated with Citi’s business activities.

Operational risk is inherent in Citi’s global business activities, as well as related support functions, and can result in losses. Citi maintains a comprehensive Company-wide risk taxonomy to classify operational risks that it faces using standardized definitions across Citi’s Operational Risk Management Framework (see discussion below). This taxonomy also supports regulatory requirements and expectations inclusive of those related to U.S. Basel III, Comprehensive Capital Analysis and Review (CCAR),

Heightened Standards for Large Financial Institutions and Dodd-Frank Act Stress Testing (DFAST).

Citi manages operational risk consistent with the overall framework described in “Managing Global Risk—Overview” above. Citi’s goal is to keep operational risk at appropriate levels relative to the characteristics of its businesses, the markets in which it operates, its capital and liquidity and the competitive, economic and regulatory environment. This includes effectively managing operational risk and maintaining or reducing operational risk exposures within Citi’s operational risk appetite.

Citi’s Independent Operational Risk Management group has established a global Operational Risk Management Framework with policies and practices for identification, measurement, monitoring, controlling and reporting operational risks and the overall operating effectiveness of the internal control environment. As part of this framework, Citi has defined its operational risk appetite and established a Manager’s Control Assessment (MCA) process for self-identification of significant operational risks, assessment of the performance of key controls and mitigation of residual risk above acceptable levels.

Each Citi operating segment must implement operational risk management processes consistent with the requirements of this framework. This includes:

•understanding and assessing the operational risks they are exposed to;

•designing, executing and testing controls that mitigate identified risks;

•establishing key indicators;

•monitoring and reporting whether the operational risk exposures are in or out of their operational risk appetite;

•having processes in place to bring operational risk exposures within acceptable levels;

•periodically estimating and aggregating the operational risks they are exposed to; and

•ensuring that sufficient resources are available to actively improve the operational risk environment and mitigate emerging risks.

Citi considers operational risks that result from the introduction of new or changes to existing products, or result from significant changes in its organizational structures, systems, processes and personnel.

Citi has a governance structure for the oversight of operational risk exposures through Business Risk and Controls Committees (BRCCs), which are focused at the group, business or function, or geography level. BRCCs provide channels to inform and escalate to senior management about operational risk exposures, control issues and operational risk events, and allow them to take and document decisions around the mitigation, remediation or acceptance of operational risk exposures.

In addition, Independent Risk Management, including the Operational Risk Management group, works proactively with Citi’s businesses and functions to drive a strong and embedded operational risk management culture and framework across Citi. The Operational Risk Management group actively challenges business and functions implementation of the

Operational Risk Management Framework requirements and the quality of operational risk management practices and outcomes.

Information about businesses’ key operational risks, historical operational risk losses and the control environment is reported by each major business segment and functional area. Citi’s operational risk profile and related information is summarized and reported to senior management, as well as to the Audit and Risk Committees of Citigroup’s Board of Directors by the Head of Operational Risk Management.

Operational risk is measured through Operational Risk Capital and Operational Risk Regulatory Capital for the Advanced Approaches under Basel III. Projected operational risk losses under stress scenarios are estimated as a required part of the FRB’s CCAR process.

For additional information on Citi’s operational risks, see “Risk Factors—Operational Risks” above.

Cybersecurity Risk

Cybersecurity risk is the business risk associated with the threat posed by a cyberattack, cyber breach or the failure to protect Citi’s most vital business information assets or operations, resulting in a financial or reputational loss (see the operational processes and systems and cybersecurity risk factors in “Risk Factors—Operational Risks” above). With an evolving threat landscape, ever-increasing sophistication of threat actor tactics, techniques and procedures, ongoing and emerging geopolitical conflicts, and the use of new technologies, including those enabled by artificial intelligence and machine learning capabilities, to conduct financial transactions, Citi and its clients, customers and third parties (and fourth parties, etc.) continue to be at risk from cyberattacks and information security incidents. Citi leverages a threat-focused, defense-in-depth strategy that ensures that multiple controls work in tandem against various threats to increase the likelihood that malicious activity will be prevented, detected and mitigated.

Citi has a mature cybersecurity threat identification and management program that relies on an industry-aligned, risk-based, defense-in-depth approach, including an internal cybersecurity intelligence center, participation in industry and government information-sharing programs, vulnerability assessment and scanning tools, intrusion detection and prevention systems, security incident and event management systems, firewalls, penetration testing, adversary emulation exercises, data management (including classification, encryption at rest and in transit, and access management), multi-factor authentication requirements and other logical, physical and technical controls designed to prevent, deter, mitigate and respond to cybersecurity threats.

Citi’s cyber and information security program is supported by comprehensive governance, including policies, standards and procedures that dictate requirements and best practices around various program aspects, including, but not limited to, third-party risk management, data management, asset management, information security practices, security incident management and regulatory compliance. Citi’s Chief Information Security Organization’s risks and controls are

measured against its Cybersecurity Risk Appetite Statement, which was initially approved by the Risk Management Committee of the Board of Directors and is reapproved annually by Citi’s Risk Committee, chaired by Citi’s Chief Risk Officer. Citi’s Cybersecurity Risk Appetite Statement leverages key risk indicators to establish enterprise risk tolerance and define risk management strategy with respect to cyber and information security. Further, Citi actively participates in financial industry, government and cross-sector knowledge-sharing groups to enhance individual and collective cybersecurity preparedness and resilience.

Cybersecurity Risk Management and Governance

Citi’s technology and cybersecurity risk management program is built on Citi’s three lines of defense, each of which is integrated into Citi’s overall risk management systems and processes.

Citi’s Chief Information Security Office, which is led by Citi’s Head of Foundational Services and Chief Information Security Officer (CISO), serves as the first line of defense. This office provides frontline business, operational and technical controls and capabilities to (1) protect against cybersecurity risks, and (2) respond to cyber incidents, including data breaches. Citi manages cybersecurity threats through its state-of-the-art fusion centers, which serve as central commands for monitoring and coordinating responses to cyber threats.

Citi’s Chief Information Security Organization is responsible for application and infrastructure defense and security controls, performing vulnerability assessments and third-party information security assessments (including cybersecurity risk assessments associated with Citi’s use of products and services from vendors and other third-party providers), employee awareness and training programs, and security incident management. In each case, the enterprise information security team works in coordination with a network of information security officers who are embedded within Citi’s global businesses and functions, consistent with Citi’s philosophy that all Citi stakeholders have a responsibility in managing cyber and information security risks.

Citi’s Technology and Cyber Compliance and Operational Risk Office (TCCORO) serves as the second line of defense. This office independently evaluates and challenges Citi’s risk mitigation practices and capabilities, from a fused operational risk and compliance lens. It functions as a joint second line of defense and in accordance with Citi’s Cybersecurity Risk Appetite Statement. TCCORO also advises first line partners in CISO, supporting enterprise-wide efforts to proactively identify and remediate cybersecurity risks before they materialize as incidents that negatively affect business operations.

To address evolving cybersecurity risks and corresponding regulations, TCCORO monitors cybersecurity legal and regulatory requirements, identifies and defines emerging risks, executes strategic cybersecurity threat assessments, performs new product and initiative reviews, performs data management risk oversight and conducts cybersecurity risk assurance reviews (inclusive of third-party assessments). In addition, this office oversees and challenges metrics related to cybersecurity and technology and ensures they remain aligned with Citi’s overall operational risk management framework to effectively track, identify and manage risk. TCCORO presents an independent viewpoint on enterprise cybersecurity risk posture, and oversees CISO’s cybersecurity risk identification, measurement and enterprise-wide governance of cybersecurity risk.

Internal Audit serves as Citi’s third line of defense and provides independent assurance to the Audit Committee of the Board on the effectiveness of controls operated by the first and second lines of defense to manage cybersecurity risk.

Citi recognizes the risks associated with outsourcing services to, sharing data with, and/or technologically interacting with third parties. Citi has built a robust third-party information security risk management program that governs third-party engagements from selection, to the establishment of legal agreements that govern the relationship, to ongoing monitoring through the duration of the relationship. Third-party risk management includes reliance on contractual requirements around data and cybersecurity, vulnerability assessments, third-party information security assessments performed at intervals determined by risk level, governance to manage end-of-life and end-of-vendor-support risks, and third-party incident response protocols.

Management Governance

Citi’s Head of Technology and Business Enablement, who reports directly to Citi’s CEO, has overall responsibility for Citi’s first line of defense cyber and information security and technology programs. Citi’s Head of Technology and Business Enablement has over 30 years of experience in the financial services industry. Prior to joining Citi, he was Senior Partner at PriceWaterhouseCoopers where he oversaw the firm’s strategy and execution. For additional information, see “Corporate Information—Executive Officers” below.

Citi’s Head of Foundational Services and CISO, who reports directly to Citi’s Head of Technology and Business Enablement, has primary responsibility to assess and manage Citi’s material risks from cybersecurity threats. Citi’s CISO has decades of experience in managing cybersecurity risks from prior roles as Deutsche Bank’s Chief Security Officer, the Chief Information Officer for the Central Intelligence Agency and the Chief Information Officer for the U.S. Intelligence Community. The CISO is supported by a team of subject matter experts in security operations, network architecture, cyber and information security governance and cybersecurity operations. Citi’s Chief Information Security Office employs approximately 3,400 individuals to manage its operations.

Citi’s Chief Technology Officer (CTO) and Head of Emerging Technology and Strategic Partnerships, who also reports to Citi’s Chief Information Officer, has primary responsibility for technology policy, innovation enablement and strategy. Citi’s CTO has served in various technology roles at Citi since 2012, including most recently as Group Head of Engineering and Architecture. Prior to joining Citi, the CTO worked in equity linked technology at Bank of America Merrill Lynch.

Multiple management committees and functions also support Citi’s cyber and information security management.

The Chief Information Officer Committee (CIOC), which consists of, among others, the Head of Technology and Business Enablement, Citi’s Co-Chief Information Officers (who report to the Head of Technology and Business Enablement), the CISO, and the Head of TCCORO (who reports both to Citi’s Head of Operational Risk within the Risk organization and its Head of Global Functions Compliance within the Global Legal and Compliance organization), serves as an escalation forum for items requiring the attention of technology senior management, including approval of policies, and reports items requiring further escalation to the Technology Committee of the Board of Directors, as appropriate.

The Information Security Risk Operating Committee (ISROC) is chaired by the CISO and comprises senior members of the Chief Information Security Office and representatives from partner organizations. This committee sets the direction and prioritization for the implementation of the cyber and information security program across Citi. The committee reports and escalates to the CIOC, including for intermediary review and approval of policies escalated from the Information Technology Policy Council (see below). Any actions constituting risk exceptions are escalated to the ISRC.

The Security Architecture Council, which reports to the ISROC, is an oversight and decision-making body focused on ensuring that the target level of security architectural maturity is attained. This council is co-chaired by two representatives from the security architecture and cybersecurity services organizations.

Citi’s Information Technology Policy Council provides a centralized review to oversee consistency in the formation of information technology policies and standards. This counsel maintains oversight of policy document requirements to ensure that information technology policy documents meet Citi’s objectives as established internally and are in line with laws and regulations as identified and communicated by ICRM.

In addition, Citi regularly engages third parties globally to assess, audit and/or exercise Citi’s cyber and information security program, which is ISO-27001 certified. ISO-27001 is an international standard for information security management systems. Citi is regulated by bodies across the globe that also regularly examine and audit Citi’s cyber and information security program against local laws, regulations and industry best practices.

Board Governance

Citigroup’s Board of Directors and its committees provide oversight of senior management’s efforts to mitigate cybersecurity risk and respond to cybersecurity incidents. Citi’s Board includes members with cybersecurity expertise and experience.

Citigroup’s full Board is briefed annually on cybersecurity risks and receives updates as needed on Citi’s cyber and information security program, including changes to the threat landscape and a roadmap for progress around addressing related risks. Additionally, Citigroup’s Board participates in cybersecurity exercises to improve preparedness to address cybersecurity incidents.

The Board’s Technology Committee receives quarterly updates from the Chief Information Security Office on the cybersecurity threat landscape, regulatory landscape, posture, and strategy and engages in discussions throughout the year with senior management and subject matter experts on the effectiveness of Citi’s overall cybersecurity program.

The Board’s Risk Management Committee (RMC) approved a standalone Cybersecurity Risk Appetite Statement against which Citi’s performance is measured quarterly. In addition, the RMC oversees Citi’s risk profile, which includes cybersecurity risk, and monitors whether Citi is operating within its cybersecurity risk appetite under its mandate to review key operational risks, including steps taken by management to control such risks.

In the event of a potentially material cybersecurity incident impacting Citi, the Board would be made aware of such incident via lines of communication that run from the Chief Information Security Office to senior management and also to the Board. This contemporaneous reporting on significant cyber events includes information and discussion around incident response, legal obligations (including disclosure), and outreach and notification to regulators and customers when needed.

For additional information on the Board’s oversight of cybersecurity risk management, see Citi’s upcoming 2025 Annual Meeting Proxy Statement to be filed with the SEC in March 2025.

COMPLIANCE RISK

Compliance risk is the risk to current or projected financial condition and resilience arising from violations of laws, rules or regulations, or from non-conformance with prescribed practices, internal policies and procedures or ethical standards. Compliance risk exposes Citi to fines, civil money penalties, payment of damages and the voiding of contracts. Compliance risk can result in diminished reputation, harm to Citi’s customers, limited business opportunities and lessened expansion potential. It encompasses the risk of noncompliance with all laws and regulations, as well as prudent ethical standards and some contractual obligations. It could also include exposure to litigation (known as legal risk) from all aspects of traditional and non-traditional banking.

Citi seeks to operate with integrity, maintain strong ethical standards and adhere to applicable policies and regulatory and legal requirements. Citi must maintain and execute a proactive Compliance Risk Management (CRM) Framework (as set forth in the CRM Policy) that is designed to

manage compliance risk effectively across Citi, with a view to fundamentally strengthen the compliance risk management culture across the lines of defense taking into account Citi’s risk governance framework and regulatory requirements.

Independent Compliance Risk Management’s (ICRM) primary objectives are to:

•Drive and embed a culture of compliance and control throughout Citi;

•Maintain and oversee an integrated CRM Framework that facilitates enterprise-wide compliance with local, national or cross-border laws, rules or regulations, Citi’s internal policies, standards and procedures and relevant standards of conduct;

•Assess compliance risks and issues across product lines, functions and geographies, supported by globally consistent systems and compliance risk management processes; and

•Provide compliance risk data aggregation and reporting capabilities.

Citi carries out its objectives and fulfills its responsibilities through the CRM Framework, which is composed of the following integrated key activities, to holistically manage compliance risk:

•Management of Citi’s compliance with laws, rules and regulations by identifying and analyzing changes, assessing the impact and implementing appropriate policies, processes and controls;

•Developing and providing compliance training to ensure employees are aware of and understand the key laws, rules and regulations;

•Monitoring the Compliance Risk Appetite, which is articulated through qualitative compliance risk statements describing Citi’s appetite for certain types of risk and quantitative measures to monitor the Company’s compliance risk exposure;

•Executing Compliance Risk Assessments, the results of which inform Compliance Risk Monitoring and testing of compliance risks and controls in assessing conformance with laws, rules, regulations and internal policies; and

•Issue identification, escalation and remediation to drive accountability, including measurement and reporting of compliance risk metrics against established thresholds in support of the CRM Policy and Compliance Risk Appetite.

To anticipate, control and mitigate compliance risk, Citi has established the CRM Policy to achieve standardization and centralization of methodologies and processes, and to enable more consistent and comprehensive execution of compliance risk management.

Citi has a commitment, as well as an obligation, to identify, assess and mitigate compliance risks associated with its businesses and functions. ICRM is responsible for oversight of Citi’s CRM Policy, while all businesses and global control functions are responsible for managing their compliance risks and operating within the Compliance Risk Appetite.

As discussed above, Citi is working to address the FRB and OCC Consent Orders and the OCC’s 2024 Consent Order Amendment, which include improvements to Citi’s CRM Framework and its enterprise-wide application (see “Citi’s Multiyear Transformation—FRB and OCC Consent Orders Compliance” above).

REPUTATION RISK

Citi’s reputation is a vital asset in building trust, and Citi is diligent in enhancing and protecting its reputation with its key stakeholders. To support this, Citi has developed a reputation risk framework. Under this framework, Citigroup and Citibank, N.A. have implemented a risk appetite statement and related key indicators to monitor corporate activities and operations relative to Citi’s risk appetite. The framework also requires that business segments escalate potential material reputation risks that require review or mitigation through the applicable business Management Forum or Group Reputation Risk Committee.

The Group Reputation Risk Committee and Management Forums, which are composed of Citi’s senior executives, govern the process by which material reputation risks are identified, measured, monitored, controlled, escalated and reported. The Group Reputation Risk Committee and Management Forums determine the appropriate actions to be taken in line with risk appetite and regulatory expectations, while promoting a culture of risk awareness and high standards of integrity and ethical behavior across the Company, consistent with Citi’s Mission and Value Proposition. The Group Reputation Risk Committee may escalate reputation risks to the Nomination, Governance and Public Affairs Committee or other appropriate committee of the Citigroup Board of Directors.

Every Citi employee is responsible for safeguarding Citi’s reputation, guided by Citi’s Code of Conduct. Employees are expected to exercise sound judgment and common sense in decisions and actions. They are also expected to promptly escalate all issues that present material reputation risk in line with policy.

STRATEGIC RISK

As discussed above, strategic risk is the risk of a sustained impact (not episodic impact) to Citi’s core strategic objectives as measured by impacts on anticipated earnings, market capitalization or capital, arising from external factors affecting the Company’s operating environment, as well as the risks associated with defining and executing the strategy, which are identified, measured and managed as part of the Strategic Risk Framework at the Enterprise Level.

In this context, external factors affecting Citi’s operating environment are the economic environment, geopolitical/political landscape, industry/competitive landscape, environmental, customer/client behavior, regulatory/legislative environment and trends related to investors/shareholders. Material strategic risks that Citi is monitoring include the impacts of adverse changes in inflation and interest rates in the U.S., as well as macroeconomic uncertainties driven by weak global growth, tariffs and geopolitical issues, including the Middle East conflict, the Russia–Ukraine war and U.S.–China tensions, and increased regulatory requirements. In addition to

external factors affecting Citi’s operating environment, Citi also monitors risks related to the execution of its strategy, with heightened focus on delivering the transformation of its risk and control environment pursuant to the 2020 FRB and OCC Consent Orders and the 2024 Amendment to the OCC’s Consent Order.

Citi’s Executive Management Team is responsible for the development and execution of Citi’s strategy. This strategy is translated into forward-looking plans (collectively Citi’s Strategic Plan) that are then cascaded across the organization. Citi’s Strategic Plan is presented to the Board on an annual basis, and is aligned with risk appetite thresholds and includes a risk assessment as required by internal frameworks. It is also aligned with limit requirements for capital allocation. Governance and oversight of strategic risk is facilitated by internal committees on a group-wide basis.

Citi works to ensure that strategic risks are adequately considered and addressed across its various risk management activities, and that strategic risks are assessed in the context of Citi’s risk appetite. Citi conducts a top-down, bottom-up risk identification process to identify risks, including strategic risks. Business segments undertake a quarterly risk identification process to systematically identify and document all material risks faced by Citi. Independent Risk Management oversees the risk identification process through regular reviews and coordinates identification and monitoring of top risks. In addition, Citi performs a quarterly Risk Assessment of the Plan (RAOP) and continuously monitors risks associated with its execution of strategy. Independent Risk Management also manages strategic risk by monitoring risk appetite thresholds in conjunction with its Global Strategic Risk Committee, which is part of the governance structure that Citi has in place to manage its strategic risks.

For additional information on Citi’s strategic risks, see “Risk Factors—Strategic Risks” above.

Climate Risk

Climate change presents near- and long-term risks to Citi and its clients and customers, with the risks expected to increase over time. Climate risk refers to the risk of loss arising from climate change and comprises both physical risk and transition risk.

Climate risk is an overarching risk that can act as a driver of other categories of risk, such as credit risk from obligors exposed to high climate risk, strategic risks if Citi fails to consider transition risk in client selection, reputational risk from increased stakeholder concerns about financing or failing to finance high-carbon industries and operational risk from physical risks to Citi’s facilities. Citi continues to make progress toward embedding climate-related considerations into its overarching risk management approach, driven by the materiality of the financial and strategic risk considerations. For additional information on climate risk, see “Risk Factors—Strategic Risks” above.

Citi continues to develop globally consistent principles and approaches for managing climate risk across the Company through its Climate Risk Management Framework (Climate RMF). The Climate RMF provides information on the governance, roles and responsibilities, and principles to support the identification, measurement, monitoring, controlling and reporting of climate risks.

Citi continues to enhance its methodologies for quantifying how climate risks could impact the individual credit profiles of its clients across various sectors. Citi has developed and embedded sector-specific climate risk assessments in its credit underwriting process for certain sectors that have been identified as higher climate risk. Such climate risk assessments are designed to incorporate publicly available client disclosures and data from third-party providers and facilitate conversations with clients on their most material climate risks and management plans for adaptation and mitigation. These assessments help Citi to better understand its clients’ businesses and climate-related risks, and support their financial needs.

Citi also reviews factors related to climate risk associated with financed projects and clients in certain sectors under its Environmental and Social Risk Management (ESRM) Policy. Citi’s ESRM Policy describes sector approaches to certain high-carbon sectors, including thermal coal mining and power.

Furthermore, Citi participates in financial industry and regulatory initiatives that inform the measurement and assessment of potential financial risks of climate change, including scenario analysis. Citi also continues to monitor and actively engage with regulators on climate risk and sustainable finance developments.

For additional information about sustainability at Citi, see “Net Zero and Sustainability” above.

OTHER RISKS

Country Risk

Top 25 Country Exposures

The following table presents Citi’s top 25 exposures by country (excluding the U.S.) as of December 31, 2024. (Including the U.S., Citi’s top 25 exposures by country would represent approximately 98% of Citi’s exposure to all countries as of December 31, 2024.)

For purposes of the table, loan amounts are reflected in the country where the loan is booked, which is generally based on the domicile of the borrower. For example, a loan to a Chinese subsidiary of a Switzerland-based corporation will generally be categorized as a loan in China. In addition, Citi has developed regional booking centers in certain countries, most significantly in the United Kingdom (U.K.) and Ireland,

in order to more efficiently serve its corporate customers. As an example, with respect to the U.K., only 43% of corporate loans presented in the table below are to U.K. domiciled counterparties (47% for unfunded commitments), with the balance of the loans predominately to counterparties domiciled in other European countries. Approximately 90% of the total U.K. funded loans and 87% of the total U.K. unfunded commitments were investment grade as of December 31, 2024.

Trading account assets and investment securities are generally categorized based on the domicile of the issuer of the security of the underlying reference entity. For additional information on the assets included in the table, see the footnotes to the table below.

For additional information on Citi’s country exposure, see “FFIEC—Cross-Border Claims on Third Parties and Local Country Assets” below.

(1)Wealth loans reflect funded corporate loans and Private Bank loans, net of unearned income. As of December 31, 2024, Private Bank loans in the table above totaled $18.6 billion, concentrated in Hong Kong ($5.9 billion), Singapore ($4.8 billion) and the U.K. ($3.8 billion).

(2) Other funded includes Legacy Franchises and other direct exposures such as accounts receivable, loans HFS, other loans in Corporate/Other and investments accounted for under the equity method.

(3) Unfunded exposure includes unfunded corporate lending commitments, letters of credit and other contingencies.

(4) Net mark-to-market (MTM) counterparty risk on OTC derivatives and securities lending/borrowing transactions (repos). Exposures are net of collateral and inclusive of CVA. Also includes margin loans.

(5) Investment securities include debt securities AFS, recorded at fair market value, and debt securities HTM, recorded at amortized cost.

(6) Trading account assets are on a net basis and include issuer risk on cash products and derivative exposure where the underlying reference entity/issuer is located in that country.

(7) As of December 31, 2023, $0.3 billion of All Other—Legacy Franchises loans were reclassified to HFS as a result of Citi’s agreement to sell its credit card portfolio in China. There were no such balances to report as of December 31, 2024 or September 30, 2024. See “All Other—Legacy Franchises” above and Note 2.

Russia

Citi previously ended nearly all of the institutional banking services it offered in Russia and ceased soliciting any new business or new clients in the country, with the remaining services only those necessary to fulfill its remaining legal and regulatory obligations, as well as support its employees.

Citi’s net investment in Russia was less than $0.1 billion as of December 31, 2024 (down from $0.2 billion at September 30, 2024). The decrease in the net investment was driven by increases in transfer risk associated with safety and soundness considerations under U.S. banking law, partially offset by an increase in interest income and custody revenue during the quarter. For more information on transfer risk reserves, see “Significant Accounting Policies and Significant Estimates—Citi’s Allowance for Credit Losses (ACL)” below.

In addition, Citi significantly reduced its All Other—Legacy Franchises consumer loan portfolio in Russia (reported

as part of Asia Consumer), largely due to loan portfolio sales and its entry into a credit card referral agreement with a Russian bank. For additional information, see “Citi’s Wind-Down of Its Russia Operations” below.

Citi’s remaining operations are conducted through Services, Markets, Banking and All Other—Legacy Franchises. Citi continues to monitor the war in Ukraine, related sanctions and economic conditions and continues to mitigate its Russia exposures and risks as appropriate.

For additional information about Citi’s risks related to its Russia exposures, see “Risk Factors—Market-Related Risks,” “—Operational Risks” and “—Other Risks” above.

Impact of the Russia–Ukraine War on Citi’s Businesses

Russia-related Balance Sheet Exposures

Citi’s remaining domestic operations in Russia are conducted through a subsidiary of Citibank, AO Citibank, which uses the Russian ruble as its functional currency.

The following table summarizes Citi’s and its clients’ Russia-related exposures:

(1) Investment securities include debt securities AFS, recorded at fair market value, primarily local government debt securities.

(2) Cash on deposit and placements are primarily with the Central Bank of Russia. Due to sanctions restrictions, as well as Citi being unable to enter into reverse repos beginning in the third quarter of 2024, any excess liquidity is placed with the Central Bank of Russia.

(3) Represents dividends relating to Russian securities held by Citi in its role as custodian for clients in Russia, which Citi is required by local regulation to hold at the DIA. Citi is unable to remit these funds, which are held at clients’ risk, to these clients due to restrictions imposed by the Russian government.

(4) Clients’ exposure of $7.4 billion as of December 31, 2024, primarily consists of corporate dividends that Citi cannot remit to its clients due to restrictions imposed by the Russian government and are held with the DIA.

(5) Citigroup’s CTA loss of $1.6 billion as of December 31, 2024 included in its AOCI related to its indirect subsidiary, AO Citibank, and $0.9 billion of intercompany liabilities owed by AO Citibank to other Citi entities outside Russia are excluded from the above table. Citi has separately described these amounts in “Deconsolidation Risk” below.

During the fourth quarter of 2024, Citi’s Russia-related exposures remained unchanged at $1.6 billion at December 31, 2024. Total clients’ exposures decreased $0.1 billion to $7.4 billion, primarily driven by depreciation of the Russian ruble, partially offset by inflows from dividends received from Russian corporations on behalf of Citi’s clients. As discussed in the table above, clients’ exposures primarily consist of corporate dividends that Citi cannot remit to its clients due to restrictions imposed by the Russian government and are held with the DIA at clients’ risk.

Citi hedges its Russian ruble/U.S. dollar spot FX exposure in AOCI through the purchase of FX derivatives. The ongoing mark-to-market of the hedging derivatives is also reported in AOCI. When the Russian ruble depreciates against the U.S. dollar, the U.S. dollar equivalent value of Citigroup’s investment in AO Citibank also declines. This change in value is offset by the change in value of the hedging instrument (FX derivative). Going forward, Citi may record devaluations on its net ruble-denominated assets in earnings, without the benefit from a change in the fair value of derivative positions used to economically hedge the exposures.

Earnings and Other Impacts on Citi’s Businesses

Services, Markets, Banking and All Other—Legacy Franchises results have been impacted by various macroeconomic factors and volatilities, including the war in Ukraine and its direct and indirect impacts on the European and global economies. For a broader discussion of the impacts of these factors and volatilities on Citi’s businesses, see “Executive Summary” and each business’s results of operations above.

As of December 31, 2024, Citigroup’s ACL included less than $0.1 billion of remaining credit reserves for Citi’s direct Russian counterparties (largely unchanged from September 30, 2024). This balance does not include the additional reserves for transfer risk associated with exposures in Russia.

Citi’s Wind-Down of Its Russia Operations

In August 2022, Citi disclosed its decision to wind down its Russia consumer, local commercial and institutional banking businesses, including actively pursuing portfolio sales. In connection with this wind-down, Citi has incurred approximately $73 million to date in charges, largely from restructuring, vendor termination fees and other related charges. Citi expects to incur an additional approximate $30 million in estimated charges (in All Other, excluding the impact from any portfolio sales). For additional information about Citi’s continued efforts to reduce its operations and exposure in Russia, see “Risk Factors” above and Note 2.

Deconsolidation Risk

Citi’s remaining operations in Russia subject it to various risks, including, among others, foreign currency volatility, including appreciation or devaluation; restrictions arising from retaliatory Russian laws and regulations on the conduct of its business; sanctions or asset freezes; or other deconsolidation events (see “Risk Factors—Other Risks” above).

As of December 31, 2024, Citi continued to consolidate AO Citibank because none of the deconsolidation factors were triggered. Examples of factors that may result in deconsolidation of AO Citibank include voluntary or forced sale of ownership or loss of control due to actions of relevant governmental authorities, including expropriation (i.e., the entity becomes subject to the complete control of a government, court, administrator, trustee or regulator); revocation of banking license; and loss of ability to elect a board of directors or appoint members of senior management.

In the event Citi deems there is a loss of control, for example, through expropriation of AO Citibank, Citi would be required to (i) write off the net investment of less than $0.1 billion (compared to $0.2 billion as of September 30, 2024), (ii) recognize a CTA loss of approximately $1.6 billion (unchanged from September 30, 2024) through earnings and (iii) recognize a loss of $0.9 billion (a $0.2 billion increase from September 30, 2024) on intercompany liabilities owed by AO Citibank to other Citi entities outside Russia. In the sole event of a substantial liquidation, as opposed to a loss of control, Citi would be required to recognize the CTA loss of approximately $1.6 billion through earnings and would evaluate its remaining net investment as circumstances evolve. The $1.6 billion CTA write-off through earnings under either event is expected to be largely equity neutral, since the reversal of the CTA loss out of AOCI would improve Citi’s total AOCI.

Citi as Paying Agent for Russia-related Clients

Citi serves or served as paying agent on bonds issued by various entities in Russia, including Russian corporate clients. Citi’s role as paying agent is administrative. In this role, Citi acts as an agent of its client, the bond issuer, receiving interest and principal payments from the bond issuer and then making payments to international central securities depositories (e.g., Depository Trust Company, Euroclear, Clearstream). The international central securities depositories (ICSDs) make payments to those participants or account holders (e.g., broker/dealers) that have clients who are investors in the applicable bonds (i.e., bondholders). As a paying agent, Citi generally does not have information about the identity of the bondholders. Citi may be exposed to risks due to its responsibilities for receiving and processing payments on behalf of its clients as a result of sanctions or other governmental requirements and prohibitions. To mitigate operational and sanctions risks, Citi has established policies, procedures and controls for client relationships and payment processing to help ensure compliance with U.S., U.K., EU and other jurisdictions’ sanctions laws.

These processes may require Citi to delay or withhold the processing of payments as a result of sanctions on the bond issuer. Citi is also prevented from making payments to accounts on behalf of bondholders should the ICSDs disclose to Citi the presence of sanctioned bondholders. In both instances, Citi is generally required to segregate, restrict or block the funds until applicable sanctions are lifted or the payments are otherwise authorized under applicable law.

Reputational Risks

Citi has continued its efforts to enhance and protect its reputation with its employees, clients, customers, investors, regulators and the public. Citi’s response to the war in Ukraine, including any action or inaction, may have a negative impact on Citi’s reputation with some or all of these parties.

For example, Citi is exposed to reputational risk as a result of its remaining presence in Russia and association with Russian individuals or entities, whether subject to sanctions or not, including Citi’s inability to support its global clients in Russia, which could adversely affect its broader client relationships and businesses; current involvement in transactions or supporting activities involving Russian assets or interests; failure to correctly interpret and apply laws and regulations, including those related to sanctions; perceived misalignment of Citi’s actions to its stated strategy in Russia; and the reputational impact from Citi’s activity and engagement with Ukraine or with non-Russian clients exiting their Russia businesses.

While Citi announced its intention to wind down its businesses in Russia, Citi will continue to manage those operations during the wind-down process and will be required to maintain certain limited operations to fulfill its remaining legal and regulatory obligations. Also, sanctions and sanctions compliance are highly complex and may change over time and result in increased operational risk. Failure to fully comply with relevant sanctions or the application of sanctions where they should not be applied may negatively impact Citi’s reputation. In addition, Citi currently performs services for, conducts business with or deals in non-sanctioned Russian-owned businesses and Russian assets. This has attracted, and will likely continue to attract, negative attention, despite the previously disclosed plan to wind down nearly all its activities in the country, cessation of new business and client originations, and reduction of other exposures.

Citi’s continued presence or divestiture of businesses in Russia could also increase its susceptibility to cyberattacks that could negatively impact its relationships with clients and customers, harm its reputation, increase its compliance costs and adversely affect its business operations and results of operations. For additional information on operational and cyber risks, see “Risk Factors—Operational Risks” above.

Board of Directors’ Role in Overseeing Related Risks

The Citigroup Board of Directors (Board) and the Board’s Risk Management Committee (RMC) and its other Committees receive regular reports from senior management regarding global geopolitical, macroeconomic and reputational impacts to Citi (including the war in Ukraine and its impact on Citi’s operations in Russia and Ukraine). The reports to the Board and its Committees from senior management who represent the impacted businesses and the international cluster, Independent Risk Management, Finance, Independent Compliance Risk Management, including those individuals responsible for sanctions compliance, and Human Resources,

have included detailed information regarding financial impacts, impacts on capital, cybersecurity, strategic considerations, sanctions compliance, employee assistance and reputational risks, enabling the Board and its Committees to properly exercise their oversight responsibilities. In addition, senior management has provided updates to Citi’s Executive Management Team and the Board, outside of formal meetings, regarding cybersecurity matters (including Russia-specific risks).

Ukraine

Citi has continued to operate in Ukraine throughout the war through its Services, Marketsand Banking businesses, serving the local subsidiaries of multinationals, along with local financial institutions and the public sector. Citi employs approximately 220 people in Ukraine and their safety is Citi’s top priority. All of Citi’s domestic operations in Ukraine are conducted through a subsidiary of Citibank, which uses the Ukrainian hryvnia as its functional currency. As of December 31, 2024, Citi had $1.7 billion of direct exposures related to Ukraine (an increase of $0.2 billion from September 30, 2024).

Argentina

Citi operates in Argentina through Services, Markets and Banking. As of December 31, 2024, Citi’s net investment in its Argentine operations was approximately $1.5 billion (compared to $1.3 billion at September 30, 2024). Citi uses the U.S. dollar (USD) as the functional currency for its operations in countries such as Argentina that are deemed highly inflationary in accordance with GAAP. Citi therefore records the impact of exchange rate fluctuations on its net Argentine peso (ARS)–denominated assets directly in earnings. Citi uses Argentina’s official market exchange rate to remeasure its net ARS-denominated assets into USD. As of December 31, 2024, the official ARS exchange rate was 1,032, which devalued by 6.3% against the USD during the fourth quarter of 2024.

The increase in Citi’s net investment in Argentina in the fourth quarter of 2024 was largely due to earnings from Citi’s normal onshore operations and a reserve release, driven by a decrease in transfer risk for safety and soundness considerations under U.S. banking law. The increase was partially offset by FX translation losses on the net investment.

The Central Bank of Argentina (BCRA) continues to maintain certain capital and currency controls that generally restrict Citi’s ability to access USD in Argentina and remit earnings from its Argentine operations. The capital and currency controls have resulted in indirect foreign exchange mechanisms that some Argentine entities may use to obtain USD, generally at rates that are significantly higher than Argentina’s official exchange rate. Citibank Argentina is generally precluded from accessing these alternative mechanisms, and under U.S. GAAP, these exchange mechanisms cannot be used to remeasure Citi’s net monetary assets into USD. If Argentina’s official exchange rate further converges with the approximate rate implied by the indirect foreign exchange mechanisms, Citi could incur additional translation losses on its net investment in Argentina. Accordingly, Citi seeks to reduce its overall ARS exposure in

Argentina while complying with local capital and currency exposure limitations.

Of the $1.5 billion net investment in Argentina as of December 31, 2024, Citi’s net ARS exposure was approximately $1.1 billion (compared to $0.9 billion as of September 30, 2024). Citi’s net ARS exposure is less than its total net investment in Argentina as a result of Citi holding approximately $175 million of USD-denominated loans as well as approximately $200 million of certain local government bonds that are USD denominated. If Citi had not invested in such instruments to reduce its ARS exposure, Citi would have recognized additional translation losses during the fourth quarter of 2024. Given current economic conditions and the local capital, currency and regulatory limitations, Citi cannot guarantee the availability or effectiveness of such mechanisms to reduce its ARS exposure in the future.

In addition to reducing the ARS exposure, Citi also seeks to economically hedge the exposure to the extent possible and prudent using non-deliverable forward (NDF) derivative instruments that are primarily executed outside of Argentina. As of December 31, 2024, Citi hedged approximately $0.4 billion of its ARS exposure through offshore hedges, including NDF derivative instruments. Citi was unable to hedge its remaining ARS exposure, given the illiquidity of the offshore NDF market. To the extent that Citi is unable to execute or renew NDF contracts in the future, Citi would record devaluations on its net ARS-denominated assets in earnings, without any benefit from a change in the fair value of such derivative positions used to economically hedge the exposure. Citi cannot predict the availability of hedging instruments in the future nor can it predict changes in foreign exchange rates and the resulting impact on earnings.

Citi continually evaluates its economic exposure to its Argentine counterparties and reserves for changes in credit risk and records mark-to-market adjustments for relevant market risks associated with its Argentine assets. Citi believes it has established an appropriate ACL on its Argentine loans, and appropriate fair value adjustments on Argentine assets and liabilities measured at fair value, for credit and sovereign risks under U.S. GAAP as of December 31, 2024. For additional information on Citi’s emerging markets risks, including those related to its Argentine exposures, see “Risk Factors—Strategic Risks” above.

FFIEC—Cross-Border Claims on Third Parties and Local Country Assets

Citi’s cross-border disclosures are presented below, based on the country exposure bank regulatory reporting guidelines of the Federal Financial Institutions Examination Council (FFIEC). The following summarizes some of the key FFIEC reporting guidelines:

•Amounts are based on the domicile of the ultimate obligor, counterparty, collateral (only including qualifying liquid collateral), issuer or guarantor, as applicable (e.g., a security recorded by a Citi U.S. entity but issued by the U.K. government is considered U.K. exposure; a loan recorded by a Citi Mexico entity to a customer domiciled in Mexico where the underlying collateral is held in Germany is considered German exposure).

•Amounts do not consider the benefit of collateral received for secured financing transactions (i.e., repurchase agreements, reverse repurchase agreements and securities loaned and borrowed) and are reported based on notional amounts.

•Netting of derivative receivables and payables, reported at fair value, is permitted, but only under a legally binding netting agreement with the same specific counterparty, and does not include the benefit of margin received or hedges.

•Credit default swaps (CDS) are included based on the gross notional amount sold and purchased and do not include any offsetting CDS on the same underlying entity.

•Loans are reported without the benefit of hedges.

Given the requirements noted above, Citi’s FFIEC cross-border exposures and total outstandings tend to fluctuate, in some cases significantly, from period to period. As an example, because total outstandings under FFIEC guidelines do not include the benefit of margin or hedges, market volatility in interest rates, foreign exchange rates and credit spreads may cause significant fluctuations in the level of total outstandings, all else being equal.

The tables below present each country whose total outstandings exceeded 0.75% of total Citigroup assets:

(1) Non-bank financial institutions.

(2) Included in total outstanding.

(3) Total outstanding includes cross-border claims on third parties, as well as local country assets. Cross-border claims on third parties include cross-border loans, securities, deposits with banks and other monetary assets, as well as net revaluation gains on foreign exchange and derivative products.

(4) Commitments (not included in total outstanding) include legally binding cross-border letters of credit and other commitments and contingencies as defined by the FFIEC guidelines. The FFIEC definition of commitments includes commitments to local residents to be funded with local currency liabilities originated within the country.

(5) Credit default swaps (CDS) are not included in total outstanding.

SIGNIFICANT ACCOUNTING POLICIES AND SIGNIFICANT ESTIMATES

This section contains a summary of Citi’s most significant accounting policies. Note 1 contains a summary of all of Citigroup’s significant accounting policies. These policies, as well as estimates made by management, are integral to the presentation of Citi’s results of operations and financial condition. While all of these policies require a certain level of management judgment and estimates, this section highlights and discusses the significant accounting policies that require management to make highly difficult, complex or subjective judgments and estimates at times regarding matters that are inherently uncertain and susceptible to change (see also “Risk Factors—Operational Risks” above). Management has discussed each of these significant accounting policies, the related estimates and its judgments with the Audit Committee of the Citigroup Board of Directors.

Valuations of Financial Instruments

Citigroup holds debt and equity securities, derivatives, retained interests in securitizations, investments in private equity and other financial instruments. A portion of these assets and liabilities is reflected at fair value on Citi’s Consolidated Balance Sheet as Trading account assets, Available-for-sale securitiesand Trading account liabilities.

Citi purchases securities under agreements to resell (reverse repos or resale agreements) and sells securities under agreements to repurchase (repos), a substantial portion of which is carried at fair value. In addition, certain loans, short-term borrowings, long-term debt and deposits, as well as certain securities borrowed and loaned positions that are collateralized with cash, are carried at fair value. Citigroup holds its investments, trading assets and liabilities, and resale and repurchase agreements on Citi’s Consolidated Balance Sheet to meet customer needs and to manage liquidity needs, interest rate risks and private equity investing.

When available, Citi generally uses quoted market prices to determine fair value and classifies such items within Level 1 of the fair value hierarchy established under ASC 820-10, Fair Value Measurement. If quoted market prices are not available, fair value is based on internally developed valuation models that use, where possible, current market-based or independently sourced market parameters, such as interest rates, currency rates and option volatilities. Such models are often based on a discounted cash flow analysis. In addition, items valued using such internally generated valuation techniques are classified according to the lowest level input or value driver that is significant to the valuation. Thus, an item may be classified under the fair value hierarchy as Level 3 even though there may be some significant inputs that are readily observable.

Citi is required to exercise subjective judgments relating to the applicability and functionality of internal valuation models, the significance of inputs or drivers to the valuation of an instrument and the degree of illiquidity and subsequent lack of observability in certain markets. The fair value of these instruments is reported on Citi’s Consolidated Balance Sheet with the changes in fair value recognized in either the Consolidated Statement of Income or in AOCI.

Losses on available-for-sale securities whose fair values are less than the amortized cost, where Citi intends to sell the security or could more-likely-than-not be required to sell the security prior to recovery, are recognized in earnings. Where Citi does not intend to sell the security nor could more-likely-than-not be required to sell the security, any portion of the loss that is attributable to credit is recognized as an allowance for credit losses with a corresponding provision for credit losses, and the remainder of the loss is recognized in AOCI. Such losses are capped at the difference between the fair value and amortized cost of the security.

For equity securities carried at cost or under the measurement alternative, decreases in fair value below the carrying value are recognized as impairment in the Consolidated Statement of Income. Moreover, for certain equity method investments, decreases in fair value are only recognized in earnings in the Consolidated Statement of Income if such decreases are judged to be an other-than-temporary impairment (OTTI). Assessing if the fair value impairment is temporary is also inherently judgmental.

The fair value of financial instruments incorporates the effects of Citi’s own credit risk and the market view of counterparty credit risk, the quantification of which is also complex and judgmental. For additional information on Citi’s fair value analysis, see Notes 1, 6, 26 and 27.

Citi’s Allowance for Credit Losses (ACL)

The table below presents Citi’s allowance for credit losses on loans (ACLL) and total ACL as of December 31, 2024 and 2023, as well as builds and releases during 2024. For information on the drivers of Citi’s ACL net build in the fourth quarter of 2024, see below. See Note 1 for additional information on Citi’s accounting policy on accounting for credit losses under ASC Topic 326, Financial Instruments—Credit Losses; Current Expected Credit Losses (CECL).

(1)All Other (managed basis) excludes divestiture-related impacts (Reconciling Items) related to (i) Citi’s divestitures of its Asia Consumer businesses and (ii) the planned IPO of Mexico Consumer/SBMM within Legacy Franchises. The Reconciling Items are fully reflected in the various line items in Citi’s Consolidated Statement of Income. These items in the table above represent the 2024 quarterly ACL builds (releases) only. See “All Other—Divestiture-Related Impacts (Reconciling Items)” above.

(2) Includes Legacy Franchises corporate loans activity related to Mexico SBMM and the Assets Finance Group (AFG) (AFG was previously reported in Markets; all periods have been reclassified to reflect this move into Legacy Franchises), as well as other Legacy Holdings Assets corporate loans.

(3) As of December 31, 2024, in USPB, Branded Cards ACLL/EOP loans was 6.4% and Retail Services ACLL/EOP loans was 11.3%.

(4) The December 31, 2024 ACLL balance includes approximately $20 million related to an acquired portfolio, which is also reflected in the FX/Other column in this table.

(5) Includes ACL on Other assets and Held-to-maturity debt securities. The ACL on Other assets includes ACL related to transfer risk associated with exposures outside the U.S., driven by safety and soundness considerations under U.S. banking law.

Citi’s reserves for expected credit losses on funded loans and for unfunded lending commitments, standby letters of credit and financial guarantees are reflected on the Consolidated Balance Sheet in the Allowance for credit losses on loans (ACLL) and Other liabilities(for Allowance for credit losses on unfunded lending commitments (ACLUC)), respectively. In addition, Citi’s reserves for expected credit losses on other financial assets carried at amortized cost, including held-to-maturity securities, reverse repurchase agreements, securities borrowed, deposits with banks and other financial receivables are reflected in Other assets. These reserves, together with the ACLL and ACLUC, are referred to as the ACL. Changes in the ACL are reflected as Provision for credit losses in the Consolidated Statement of Income for each

reporting period. Citi’s ability to estimate expected credit losses over the reasonable and supportable (R&S) period is based on the ability to forecast economic activity over a R&S timeframe. The R&S forecast period for all loans is eight quarters.

The ACL is composed of quantitative and qualitative management adjustment components. The quantitative component uses three forward-looking macroeconomic forecast scenarios—base, upside and downside. The qualitative management adjustment component reflects risks and certain economic conditions not fully captured in the quantitative component. Both the quantitative and qualitative components are further discussed below.

Quantitative Component

Citi estimates expected credit losses for its quantitative component using (i) its comprehensive internal data on loss and default history, (ii) internal credit risk ratings, (iii) external credit bureau and rating agencies information and (iv) R&S forecasts of macroeconomic conditions.

For its consumer and corporate portfolios, Citi’s expected credit losses are determined primarily by utilizing models that consider the borrowers’ probability of default (PD), loss given default (LGD) and exposure at default (EAD). The loss likelihood and severity models used for estimating expected credit losses are sensitive to changes in macroeconomic variables, including housing prices, unemployment rate and real GDP, and cover a wide range of geographic, industry, product and business segments.

In addition, Citi’s models determine expected credit losses based on leading credit indicators, including loan delinquencies, changes in portfolio size, default frequency, risk ratings and loss recovery rates, as well as other credit trends.

Qualitative Component

The qualitative management adjustment component includes risks that are not fully captured in the quantitative component. These may include but are not limited to portfolio characteristics, idiosyncratic events, factors not within historical loss data or the economic forecast, uncertainty in the credit environment and other factors as required by banking supervisory guidance for the ACL. The primary examples of these are the following:

•Transfer risk associated with exposures outside the U.S., driven by safety and soundness considerations under U.S. banking law

•Potential impacts on vulnerable industries and regions due to emerging macroeconomic risks and uncertainties, including those related to potential global recession, inflation, interest rates, commodity prices and geopolitical tensions

•Risk associated with consumer payment behavior given the elevated inflationary and interest rate environment

As of the fourth quarter of 2024, Citi’s qualitative component of the ACL decreased quarter-over-quarter. The decrease was driven by factors such as a release related to reserves for specific risks and uncertainties impacting vulnerable industries and regions.

Macroeconomic Variables

As further discussed below, Citi considers various global macroeconomic variables for the base, upside and downside probability-weighted macroeconomic scenario forecasts it uses to estimate the quantitative component of the ACL. Citi’s forecasts of the U.S. unemployment rate and U.S. real GDP growth rate represent the macroeconomic variables that most significantly affect its estimate of the ACL.

The tables below present Citi’s forecasted quarterly average U.S. unemployment rate and year-over-year U.S. real GDP growth rate used in determining the base macroeconomic forecast for Citi’s ACL at each quarterly reporting period from 4Q23 to 4Q24:

(1) Represents the average unemployment rate for the rolling, forward-looking eight quarters in the forecast horizon.

(1) The year-over-year growth rate is the percentage change in the real (inflation adjusted) GDP level.

Under the base macroeconomic forecast as of the fourth quarter of 2024, U.S. real GDP growth is expected to slow during 2025 and 2026, while the unemployment rate is expected to increase in 2025, but decline in 2026.

Scenario Weighting

Citi’s ACL is estimated using three probability-weighted macroeconomic scenarios—base, upside and downside. The macroeconomic scenario weights are estimated using a statistical model, which, among other factors, takes into consideration key macroeconomic drivers of the ACL, severity of the scenario and other macroeconomic uncertainties and risks. Citi evaluates scenario weights on a quarterly basis.

Citi’s downside scenario incorporates more adverse macroeconomic assumptions than the base scenario. For example, compared to the base scenario, Citi’s downside scenario reflects a recession, including an elevated average U.S. unemployment rate of 6.8% over the eight-quarter R&S period, with a peak difference of 3.4% in the second quarter of 2026. The downside scenario also reflects a year-over-year U.S. real GDP contraction in 2025 of 1.8%, with a peak quarter-over-quarter difference to the base scenario of 1.3%.

Citi’s ACL is sensitive to the various macroeconomic scenarios that drive the quantitative component of expected credit losses, due to changes in the length and severity of forecasted economic variables or events in the respective scenarios. Citi’s downside scenario incorporates more adverse macroeconomic assumptions than the weighted scenario assumptions. To demonstrate this sensitivity, if Citi applied

100% weight to the downside scenario as of December 31, 2024 to reflect the most severe economic deterioration forecast in the macroeconomic scenarios, there would have been a hypothetical incremental increase in the ACL of approximately $5.3 billion related to lending exposures, except for loans individually evaluated for credit losses and other financial assets carried at amortized cost.

This analysis does not incorporate any impacts or changes to the qualitative component of the ACL. These factors could change the outcome of the sensitivity analysis based on historical experience and current conditions at the time of the assessment. Given the uncertainty inherent in macroeconomic forecasting, Citi continues to believe that its ACL estimate based on a three probability-weighted macroeconomic scenario approach combined with the qualitative component remains appropriate as of December 31, 2024.

4Q24 Changes in the ACL

As further discussed below, Citi’s ending ACL balance for the fourth quarter of 2024 was $22.2 billion, a slight increase from September 30, 2024. The net build of $0.3 billion in the quarter was primarily driven by growth in cards balances in USPB. Citi believes its analysis of the ACL reflects the forward view of the economic environment as of December 31, 2024. See Note 16 for additional information.

Consumer Allowance for Credit Losses on Loans

Citi’s consumer ACLL is largely driven by U.S. cards (Branded Cards and Retail Services) in USPB. Citi’s total consumer ACLL build was $0.3 billion in the fourth quarter of 2024, primarily driven by growth in U.S. cards balances. This resulted in a December 31, 2024 ACLL balance of $16.0 billion, or 4.08% of total funded consumer loans.

For U.S. cards, the level of reserves relative to total funded loans decreased to 7.93% at December 31, 2024, due to seasonal improvement, compared to 8.15% at September 30, 2024. For the remaining consumer exposures, the level of reserves relative to total funded loans was 1.11% at December 31, 2024, compared to 1.08% at September 30, 2024.

Corporate Allowance for Credit Losses on Loans

Citi had a corporate ACLL release of less than $0.1 billion in the fourth quarter of 2024, largely driven by a release for specific risks and uncertainties impacting vulnerable industries and regions in Bankingand lower transfer risk associated with exposures outside the U.S., driven by safety and soundness considerations under U.S. banking law in Services, partially offset by a build for changes in portfolio composition in Markets. This resulted in a December 31, 2024 ACLL balance of $2.6 billion, or 0.87% of total funded corporate loans.

ACLUC

Citi had an ACLUC release of $0.1 billion in the fourth quarter of 2024, largely driven by a release for specific risks and uncertainties impacting vulnerable industries and regions. The ACLUC reserve balance, included in Other liabilities, was $1.6 billion at December 31, 2024.

ACL on Other Financial Assets

Citi had an ACL build of $0.1 billion on other financial assets carried at amortized cost for the fourth quarter of 2024, primarily due to an increase in transfer risk associated with unremittable corporate dividends outside the U.S. being held on behalf of clients, driven by safety and soundness considerations under U.S. banking law. Including FX/Other, the ACL reserve balance of $2.0 billion remained unchanged from September 30, 2024. See Note 16 for additional information.

Regulatory Capital Impact

Citi elected the modified CECL transition provision for regulatory capital purposes provided by the U.S. banking agencies’ final rule. Accordingly, the Day One regulatory capital effects resulting from the adoption of CECL, as well as the ongoing adjustments for 25% of the change in CECL-based allowances in each quarter between January 1, 2020 and December 31, 2021, started to be phased in on January 1, 2022 and were fully reflected in Citi’s regulatory capital as of January 1, 2025.

See Notes 1 and 16 for a further description of the ACL and related accounts.

Citi tests for goodwill impairment annually as of October 1 (the annual test) and conducts interim assessments between annual tests if an event occurs or circumstances change that would more-likely-than-not reduce the fair value of a reporting unit below its carrying amount. These events or circumstances include, among other things, a significant adverse change in the business climate, a decision to sell or dispose of all or a significant portion of a reporting unit or a sustained decrease in Citi’s stock price.

Citigroup’s activities were conducted through the reportable operating segments: Services, Markets, Banking, Wealth and USPB, with the remaining operations recorded in All Other, which includes activities not assigned to a specific operating segment as well as discontinued operations. Goodwill impairment testing is performed at the level below the operating segment (referred to as a reporting unit).

Citi performed its annual goodwill impairment test, which resulted in no impairment of any of Citi’s reporting units’ goodwill. No additional triggering events were identified and no goodwill was impaired during 2024. For each of the Company’s reporting units, fair value exceeded carrying value by at least 10%.

Citi utilizes allocated tangible common equity as a proxy for the carrying value of its reporting units for purposes of goodwill impairment testing. The allocated equity in the reporting units is determined based on the capital the business would require if it were operating as a standalone entity, incorporating sufficient capital to be in compliance with both current and expected regulatory capital requirements, including capital for specifically identified goodwill and intangible assets. The capital allocated to the reporting units is incorporated into the annual budget process, which is approved by Citigroup’s Board of Directors.

Goodwill impairment testing involves management judgment, requiring an assessment of whether the carrying value of a reporting unit can be supported by its fair value using widely accepted valuation techniques, such as the market approach (earnings multiples and/or transaction multiples) and/or the income approach (discounted cash flow (DCF) method). In applying these methodologies, Citi utilizes a number of factors, including actual operating results, future business plans, economic projections and market data.

Citi engaged an independent valuation specialist to assist in Citi’s valuation of all the reporting units, primarily employing both the income and market approach to determine the fair value of the reporting units. The income approach utilized discount rates that Citi believes adequately reflected the risk and uncertainty in the financial markets in the internally generated cash flow projections. The market approach utilizes observable market data from comparable publicly traded companies, such as price-to-earnings or price-to-tangible book value ratios, to estimate a reporting unit’s fair value. Management uses judgment in the selection of comparable companies and includes those with the most similar business activities.

The income approach employs a capital asset pricing model in estimating the discount rate. Since none of the Company’s reporting units are publicly traded, individual reporting unit fair value determinations cannot be directly correlated to Citigroup’s common stock price. The sum of the fair values of the reporting units exceeded the overall market capitalization of Citi as of October 1, 2024. However, Citi believes that it is not meaningful to reconcile the sum of the fair values of the Company’s reporting units to its market capitalization due to several factors. The market capitalization of Citigroup reflects the execution risk in a transaction involving Citigroup due to its size. However, the individual reporting units’ fair values are not subject to the same level of execution risk or a business model that is as global. In addition, the market capitalization of Citigroup does not include consideration of the individual reporting unit’s control premium.

Unanticipated declines in business performance, increases in credit losses, increases in capital requirements and adverse regulatory or legislative changes, as well as deterioration in economic or market conditions, are factors that could result in a material impairment loss to earnings in a future period related to some portion of the associated goodwill. See Notes 1 and 17 for additional information on goodwill, including the changes in the goodwill balance year-over-year and the segments’ goodwill balances as of December 31, 2024.

Litigation Accruals

See the discussion in Note 30 for Citi’s policies on establishing accruals for litigation and regulatory contingencies.

Income Taxes

Citi is subject to the income tax laws of the U.S., its states and local municipalities and the non-U.S. jurisdictions in which Citi operates. These tax laws are complex and are subject to differing interpretations by the taxpayer and the relevant governmental taxing authorities. Disputes over interpretations of the tax laws may be subject to review and adjudication by the court systems of the various tax jurisdictions or may be settled with the taxing authority upon audit.

In establishing a provision for income tax expense, Citi must make judgments and interpretations about the application of these inherently complex tax laws. Citi must also make estimates about when in the future certain items will affect taxable income in the various tax jurisdictions, both domestic and foreign. Deferred taxes are recorded for the future consequences of events that have been recognized in the financial statements or tax returns, based on enacted tax laws and rates. Deferred tax assets (DTAs) are recognized subject to management’s judgment that realization is more-likely-than-not. For example, if it is more-likely-than-not that a carry-forward would expire unused, Citi would set up a valuation allowance against that DTA. Citi has established valuation allowances as described below.

As a result of the Tax Cuts and Jobs Act (Tax Reform), beginning in 2018, Citi is taxed on income generated by its U.S. operations at a federal tax rate of 21%. The effect on Citi’s state tax rate is dependent upon how and when the individual states that have not yet addressed the federal tax law changes choose to adopt the various new provisions of the U.S. Internal Revenue Code.

Citi’s non-U.S. branches and subsidiaries are subject to tax at their local tax rates. Non-U.S. branches also continue to be subject to U.S. taxation. The impact of this on Citi’s earnings depends on the level of branch pretax income, the local branch tax rate, and allocations of overall domestic loss (ODL) and expenses for U.S. tax purposes to branch earnings. Citi expects no residual U.S. tax on such earnings. With respect to non-U.S. subsidiaries, dividends from these subsidiaries will be excluded from U.S. taxation. While the majority of Citi’s non-U.S. subsidiary earnings are classified as global intangible low-taxed income (GILTI), Citi expects no material residual U.S. tax on such earnings based on its non-U.S. subsidiaries’ local tax rates, which exceed, on average, the effective 13.125% GILTI tax rate. Finally, Citi does not expect the base erosion anti-abuse tax (BEAT) to affect its tax provision.

On January 4, 2022, final FTC regulations were published in the Federal Register, which eliminate the creditability of foreign taxes paid in certain situations. These include countries that do not align with U.S. tax principles in significant part and for services performed outside the recipient country. In 2023, the IRS announced that the effective date of these regulations was deferred until the IRS gives notice otherwise. The impact on Citi’s effective tax rate is not expected to be material.

The Inflation Reduction Act was signed into law on August 16, 2022. The Act includes a new corporate alternative minimum tax (AMT) and a 1% excise tax on share repurchases, both effective January 1, 2023. The corporate AMT is a 15% minimum tax on financial statement income after adjusting for foreign taxes paid. Corporate AMT paid in one year is creditable against regular corporate tax liability in future years. Citi does not expect to pay material amounts of corporate AMT given its profitability and tax profile.

The 1% excise tax is a non-deductible tax on the fair market value of stock repurchased in the taxable year, reduced by the fair market value of any stock issued in the same year. See Note 11 for the 2024 impact on earnings per share related to the excise tax.

Deferred Tax Assets and Valuation Allowances (VA)

At December 31, 2024, Citi had net DTAs of $29.8 billion. In the fourth quarter of 2024, Citi’s DTAs decreased by $0.2 billion, primarily as a result of the geographic mix of earnings. On a full-year basis, Citi’s DTAs increased by $0.2 billion from $29.6 billion at December 31, 2023.

Of Citi’s total net DTAs of $29.8 billion as of December 31, 2024, $12.8 billion, primarily related to tax carry-forwards, was deducted in calculating Citi’s regulatory capital. Net DTAs arising from temporary differences are also deducted from regulatory capital if in excess of the 10%/15% limitations (see “Capital Resources” above). For the quarter and year ended December 31, 2024, Citi had $3.0 billion of disallowed temporary difference DTAs (included in the $12.8 billion above). The remaining $17.0 billion of net DTAs as of December 31, 2024 was not deducted in calculating regulatory capital pursuant to Basel III standards and was appropriately risk weighted under those rules.

Citi’s total VA at December 31, 2024 was $4.3 billion, an increase of $0.7 billion from $3.6 billion at December 31, 2023. The increase was primarily driven by the generation of current-year FTCs in the branch basket. Citi’s VA of $4.3 billion is composed of $3.3 billion on its FTC branch basket carry-forwards, $0.6 billion on its U.S. residual DTA related to its non-U.S. branches, $0.3 billion on local non-U.S. DTAs and $0.1 billion on state net operating loss carry-forwards.

As stated above with regard to the impact of non-U.S.

branches on Citi’s earnings, the level of branch pretax income, the local branch tax rate and the allocations of ODL and expenses for U.S. tax purposes to the branch basket are the

main factors in determining the branch VA. Additional ODL

was created in 2024 as a result of reduced taxable income.

Recognized FTC carry-forwards in the general basket comprised approximately $0.7 billion of Citi’s DTAs as of December 31, 2024, compared to approximately $1.2 billion as of December 31, 2023. The decrease in FTCs year-over-year was primarily due to current-year usage. The FTC carry-forward period represents the most time-sensitive component of Citi’s DTAs.

Citi had an ODL of approximately $9 billion at December 31, 2024, which allows Citi to elect a percentage between 50% and 100% of future years’ domestic source income to be reclassified as foreign source income. (See Note 10 for a description of the ODL.)

The majority of Citi’s U.S. federal net operating loss carry-forward and all of its New York State and City net operating loss carry-forwards are subject to a carry-forward period of 20 years. This provides enough time to fully utilize the net DTAs pertaining to these existing net operating loss carry-forwards. This is due to Citi’s forecast of sufficient U.S. taxable income and the continued taxation of Citi’s non-U.S. income by New York State and City.

Although realization is not assured, Citi believes that the realization of its recognized net DTAs of $29.8 billion at December 31, 2024 is more-likely-than-not, based on management’s expectations as to future taxable income in the jurisdictions in which the DTAs arise, as well as available tax planning strategies (as defined in ASC Topic 740, Income Taxes). Citi has concluded that it has the necessary positive evidence to support the realization of its net DTAs after taking its VAs into consideration.

See Note 10 for additional information on Citi’s income taxes, including its income tax provision, tax assets and liabilities and a tabular summary of Citi’s net DTAs balance as of December 31, 2024 (including the FTCs and applicable expiration dates of the FTCs). For information on Citi’s ability to use its DTAs, see “Risk Factors—Strategic Risks” above and Note 10.

Accounting Changes

See Note 1 for a discussion of changes in accounting standards.

DISCLOSURE CONTROLS AND PROCEDURES

Citi’s disclosure controls and procedures are designed to ensure that information required to be disclosed under the Securities Exchange Act of 1934, as amended, is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms, including without limitation that information required to be disclosed by Citi in its SEC filings is accumulated and communicated to management, including the Chief Executive Officer (CEO) and Chief Financial Officer (CFO), as appropriate, to allow for timely decisions regarding required disclosure.

Citi’s Disclosure Committee assists the CEO and CFO in their responsibilities to design, establish, maintain and evaluate the effectiveness of Citi’s disclosure controls and procedures. The Disclosure Committee is responsible for, among other things, the oversight, maintenance and implementation of the disclosure controls and procedures, subject to the supervision and oversight of the CEO and CFO.

Citi’s management, with the participation of its CEO and CFO, has evaluated the effectiveness of Citigroup’s disclosure controls and procedures (as defined in Rule 13a-15(e) under the Securities Exchange Act of 1934) as of December 31, 2024. Based on that evaluation, the CEO and CFO have concluded that at that date Citigroup’s disclosure controls and procedures were effective.

MANAGEMENT’S ANNUAL REPORT ON INTERNAL CONTROL OVER FINANCIAL REPORTING

Citi’s management is responsible for establishing and maintaining adequate internal control over financial reporting. Citi’s internal control over financial reporting is designed to provide reasonable assurance regarding the reliability of its financial reporting and the preparation of financial statements for external reporting purposes in accordance with U.S. generally accepted accounting principles. Citi’s internal control over financial reporting includes those policies and procedures that (i) pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of Citi’s assets, (ii) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles and that Citi’s receipts and expenditures are made only in accordance with authorizations of Citi’s management and directors, and (iii) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of Citi’s assets that could have a material effect on its financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect all misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions or that the degree of compliance with the policies or procedures may deteriorate.

Citi’s management assessed the effectiveness of Citigroup’s internal control over financial reporting as of December 31, 2024 based on the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in Internal Control—Integrated Framework (2013). Based on this assessment, management has concluded that, as of December 31, 2024, Citi’s internal control over financial reporting was effective. In addition, there were no changes in Citi’s internal control over financial reporting during the fiscal quarter ended December 31, 2024 that materially affected, or are reasonably likely to materially affect, Citi’s internal control over financial reporting.

The effectiveness of Citi’s internal control over financial reporting as of December 31, 2024 has been audited by KPMG LLP, Citi’s independent registered public accounting firm, as stated in their report below, which expressed an unqualified opinion on the effectiveness of Citi’s internal control over financial reporting as of December 31, 2024.

FORWARD-LOOKING STATEMENTS

Certain statements in this report, including but not limited to statements included within the Management’s Discussion and Analysis of Financial Condition and Results of Operations, are “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. In addition, Citigroup may make forward-looking statements in its other documents filed or furnished with the SEC, and its management may make forward-looking statements orally to analysts, investors, representatives of the media and others.

Generally, forward-looking statements are not based on historical facts but instead represent Citigroup’s and its management’s beliefs regarding future events. Such statements may be identified by words such as believe, expect, anticipate, intend, estimate, may increase, may fluctuate, target, outlook, guidance and illustrative, and similar expressions or future or conditional verbs such as will, should, would and could.

Such statements are based on management’s current expectations and are subject to risks, uncertainties and changes in circumstances. Actual results of operations and financial conditions, including capital and liquidity, may differ materially from those included in these statements due to a variety of factors, including without limitation (i) the precautionary statements included within the “Executive Summary,” “Citi’s Multiyear Transformation” and each business’s discussion and analysis of its results of operations and (ii) the factors listed and described under “Risk Factors” above.

Any forward-looking statements made by or on behalf of Citigroup speak only as to the date they are made, and Citi does not undertake to update forward-looking statements to reflect the impact of circumstances or events that arise after the date that the forward-looking statements were made.