Want to see C full AI Analyst Report?
Citigroup (C) Risk Analysis
Risk Overview Q2, 2026
Risk Change Over Time
- Share Price & Shareholder Rights - Risk 1Citi's Ability to Return Capital to Common Shareholders Substantially Depends on Regulatory Capital Requirements, Including the Results of the CCAR Process and Dodd-Frank Act Regulatory FRB's Stress Tests, Testing and CCAR Regimes, and Other Factors.
Citi's ability to return capital to its common shareholders consistent with its capital planning efforts and targets, whether through its common stock repurchase program or its common stock dividend, substantially depends, among other things, on its regulatory capital requirements. Citi is required to hold regulatory capital buffers, including a Global Systemically Important Bank (GSIB) surcharge and a Stress Capital Buffer (SCB) based upon the results of the annual CCAR process required by the FRB. For additional information on these regulatory capital buffers, see "Capital Resources-Regulatory Capital Buffers" above. Changes in regulatory capital rules, requirements or interpretations can impact Citi's required regulatory capital. U.S. banking regulators have proposed a number of changes to the U.S. regulatory capital framework, including significant revisions to the U.S. Basel III, GSIB and supervisory stress test rules. These changes will affect Citi's regulatory capital requirements and position and the amount of capital Citi will be able to return to shareholders (see "Capital Resources-Regulatory Capital Standards and Developments" above). Citi's ability to return capital also depends on a variety of other factors, including, but not limited to, the following: - its results of operations and financial condition - any impact to capital from its remaining divestitures - its ability to maintain an effective capital planning process and management framework, which takes into account forecasts of expected macroeconomic conditions and their associated impacts to the level of Citi's regulatory capital and risk-weighted assets under both the Standardized Approach and the Advanced Approaches, as well as the Supplementary Leverage ratio (SLR)- deferred tax asset (DTA) utilization (see the ability to utilize DTA risk factor below) All firms subject to CCAR requirements, including Citi, are subject to a rigorous regulatory evaluation of capital planning practices and other reviews and examinations. Citi's ability to return capital may be adversely impacted if a regulatory evaluation or examination were to result in negative findings regarding absolute capital levels or other aspects of Citi's or any of its subsidiaries' operations, including as a result of the imposition of additional capital buffers, limitations on capital distributions or otherwise. For information on limitations on Citi's ability to return capital to common shareholders, as well as the CCAR process, supervisory stress test requirements and GSIB surcharge, see "Capital Resources-Current Regulatory Capital Standards," "-Regulatory Capital Buffers" and "-Stress Testing Component of Capital Planning" above and the risk management and legal and regulatory proceedings risk factors below.
- Accounting & Financial Operations - Risk 2Changes or Errors in or Incorrect Accounting Assumptions, Judgments or Estimates, or the Application of Certain Accounting Principles, Could Result in Significant Losses or Other Adverse Impacts.
U.S. GAAP requires Citi to use certain assumptions, judgments and estimates in preparing its financial statements, including, among other items, the estimate of the ACL; reserves related to litigation, regulatory and tax matters; valuation of DTAs; the fair values of certain assets and liabilities; and the assessment of goodwill and other assets for impairment. These assumptions, judgments and estimates are inherently limited because they involve techniques, including the use of historical data, that cannot anticipate or model every economic and financial outcome in the markets in which Citi operates, nor can they anticipate the specific impact and timing of such outcomes. For example, many models used by Citi include assumptions about correlation or lack thereof among prices of various asset classes or other market indicators that may not hold in times of market stress, limited liquidity or other unforeseen circumstances. If Citi's assumptions, judgments or estimates underlying its financial statements are incorrect or differ from actual or subsequent events, Citi could experience unexpected losses or other adverse impacts, some of which could be significant. Citi could also experience declines in its stock price, be subject to legal and regulatory proceedings and incur fines and other losses. For additional information on the key areas for which assumptions and estimates are used in preparing Citi's financial statements, see "Significant Accounting Policies and Significant Estimates" below and Notes 1 and 16. For example, the CECL methodology requires that Citi provide reserves for a current estimate of lifetime expected credit losses for its loan portfolios and other financial assets at the time those assets are originated or acquired. This estimate is adjusted each period for changes in expected lifetime credit losses. Citi's ACL estimate is subject to judgments and depends upon its CECL models and assumptions, including forecasted macroeconomic conditions, which can be more challenging to forecast during times of significant market volatility and uncertainty. These model assumptions and forecasted macroeconomic conditions will change over time, resulting in variability in Citi's ACL and, thus, impact its results of operations and financial condition, as well as regulatory capital (see the capital return risk factor above). For additional information on Citi's ACL, see "Significant Accounting Policies and Significant Estimates" below and Notes 1 ("Allowance for Credit Losses (ACL)") and 16. Moreover, Citi has incurred losses related to its foreign operations that are reported in the CTA components of Accumulated other comprehensive income (loss) (AOCI). In accordance with U.S. GAAP, a sale or other deconsolidation event of any foreign operation that results in a substantially complete liquidation of an investment in a foreign entity, such as those related to Citi's remaining divestitures or legacy businesses, would result in reclassification of any CTA component of AOCI related to that entity, including amounts associated with related hedges and taxes, into Citi's earnings. For example, during the quarter in which a deconsolidation of Banamex occurs, Citi would incur a CTA loss of approximately ($9) billion, attributable to Banamex and its consolidated subsidiaries as of December 31, 2025, recognized through earnings, although the cumulative impact of the CTA would be regulatory capital neutral (for additional information, see "All Other" above). For additional information on Citi's accounting policy for foreign currency translation and its foreign CTA components of AOCI, see Notes 1 ("Foreign Currency Translation") and 21.
- Corporate Activity and Growth - Risk 3A Failure or Disruption or Failure of Citi's Operational Processes or Systems Could Negatively Impact Its Reputation, Customers, Clients, Businesses or Results of Operations and Financial Condition.
Citi's global operations rely heavily on its technology systems and infrastructure, including the accurate, complete, timely and secure processing, management, storage and transmission of data, including confidential transactions, and other information, as well as the monitoring of a substantial amount of data and complex transactions in real time. Citi obtains and stores an extensive amount of personal and client-specific information for its consumer and institutional customers and clients, and must accurately record and reflect their account transactions. With the proliferation of emerging technologies, including AI and digital assets, and the use of the internet, mobile devices and cloud services to conduct financial transactions, and customers' and clients' increasing use of online banking and trading systems and other platforms, large global financial institutions such as Citi have been, and will continue to be, subject to an ever-increasing risk of operational loss, failure or disruption. For example, Citi's involvement in digital assets,including custody, asset tokenization and facilitation of clients' digital assets activities, exposes Citi to increased operational risks due to the unique technological requirements for securing these assets. Although Citi has continued to upgrade its technology, including systems to automate processes and gain efficiencies, operational incidents are unpredictable and can arise from numerous sources, not all of which are fully within Citi's control. These include, among others, operational or execution failures or deficiencies by third parties that provide products or services to Citi (e.g., cloud service providers), including such third parties' downstream service providers, as well as other Citi counterparties and market participants, which could be exacerbated by the concentration of third-party providers across the financial services industry; deficiencies in processes or controls; inadequate management of data governance practices, data controls and monitoring mechanisms that may adversely impact internal or external reporting and decision-making; cyber or information security incidents (see the cybersecurity risk factor below); human error, such as manual transaction processing errors (e.g., erroneous payments to lenders or manual errors by traders that cause system and market disruptions or losses), which can be exacerbated by staffing challenges and processing backlogs; fraud or malice on the part of employees or third parties; insufficient (or limited) straight-through processing between legacy or bespoke systems and any failure to design and effectively operate controls that mitigate operational risks associated with those legacy or bespoke systems, leading to potential risk of errors and operating losses; accidental system or technological failure; electrical or telecommunication outages; failures of or cyber incidents involving computer servers or infrastructure, including software updates and cloud services; or other similar losses or damage to Citi's property or assets (see also the climate change risk factor above). Additionally, Citi's ability to effectively maintain and upgrade systems and infrastructure can become more challenging as the speed, frequency, volume, interconnectivity and complexity of transactions continue to increase. For example, operational incidents can arise due to failures by third parties with which Citi does business, such as failures by internet, mobile technology and cloud service providers or other vendors to adequately follow procedures or processes, safeguard their systems or prevent system disruptions or cyberattacks. Failure by Citi to develop, implement and operate a third-party risk management program commensurate with the level of risk, complexity and nature of its third-party relationships can also result in operational incidents. In addition, Citi has experienced and could experience further losses associated with manual transaction processing errors, including erroneous payments to lenders or manual errors by Citi traders that cause system and market disruptions and losses for Citi and its clients. Irrespective of the sophistication of the technology utilized by Citi, there will always be a risk of human and other errors. In view of the large transactions in which Citi engages, such errors have in the past resulted, and could result, in significant losses. While Citi has change management processes in place to appropriately upgrade its operational processes and systems to ensure that any changes introduced do not adversely impact security and operational continuity, such change management can fail or be ineffective. Furthermore, when Citi introduces new products, systems or processes, new operational risks that may arise from those changes may not be identified, or adequate controls to mitigate the identified risks may not be appropriately implemented or operate as designed. Incidents that impact information security, technology operations or other operational processes may cause disruptions and/or malfunctions within Citi's businesses (e.g., the temporary loss of availability of Citi's online banking system or mobile banking platform), as well as the operations of its clients, customers or other third parties. In addition, operational incidents could involve the failure or ineffectiveness of internal processes or controls. Given Citi's global footprint and the high volume of transactions processed by Citi, certain failures, errors or actions may be repeated or compounded before they are discovered and rectified, which would further increase the consequences and costs. Operational incidents could result in financial losses and other costs as well as misappropriation, corruption or loss of confidential and other information or assets, which could significantly negatively impact Citi's reputation, customers, clients, employees, businesses or results of operations and financial condition, or the potential for systemic disruption due to interconnected systems and dependencies. Additionally, any unavailability or failure of backup systems could impact business continuity in the event of an operational incident. Cyber-related and other operational incidents can also result in legal and regulatory actions or proceedings, fines and other costs (see the legal and regulatory proceedings risk factor below). Failure by Citi to continue to increase its operational resilience, and ensure that important business services and their impact tolerance time and severity scales are clearly defined, could expose Citi to service disruptions, leading to harms to Citi clients, market integrity, Citi's reputation, financial stability or safety and soundness. For information on Citi's management of operational risk, see "Managing Global Risk-Operational Risk" below.
- Corporate Activity and Growth - Risk 4Citi's Ability Citi May Be Unable to Achieve Its Objectives from Its Transformation, Simplification Simplification, Transformation and Other Priorities May Not Be as Successful as It Projects or Expects. Enhanced Business Performance Priorities.
Citi has been pursuing overall simplification initiatives to enhance its client focus and reduce expenses. Citi's simplification initiatives, including completing its divestiture of Banamex, involve various execution challenges, may take longer than expected and may result in higher expenses, or lower than expected expense savings, CTA and other losses or other negative financial or strategic impacts, which could be material, and litigation and regulatory scrutiny (for information about CTA impacts, see the changes in or incorrect assumptions risk factor below). As part of its multiyear transformation, Citi also continues to make significant investments and undertake substantial actions across the Company to modernize its data and technology infrastructure, further strengthen its risk and controls environment and further enhance safety and soundness (see "Citi's Multiyear Transformation" above and the legal and regulatory proceedings risk factor below). Moreover, Citi continues to make business-led investments, as part of the execution of its strategic priorities. For example, Citi has been making technology and other investments across the Company, including hiring employees in key strategic markets and businesses; enhancing product capabilities and platforms to grow key businesses, improve client digital experiences and add scalability; and implementing new capabilities and partnerships. Citi's simplification, transformation and enhanced business performance priorities involve significant complexities and uncertainties. In addition, there is inherent risk that these initiatives will not be as productive or effective as Citi expects, or at all. Conversely, failure to adequately invest in and upgrade Citi's technology and processes could result in Citi's inability to be sufficiently competitive, meet regulatory expectations, serve clients effectively and avoid disruptions to its businesses, and operational errors (see the operational processes and systems and legal and regulatory proceedings risk factors below). Citi's ability to achieve its expected returns, including underlying expense savings, revenue growth and capital return objectives, as well as related operational improvements depends, in part, on factors that it cannot control, including, among others, macroeconomic challenges and uncertainties; customer, client and competitor actions; and ongoing regulatory requirements or changes. Further, Citi's simplification, transformation and enhanced business performance priorities may continue to evolve as its business strategies, including with respect to organic or inorganic growth, the market environment and regulatory expectations change, which could make the initiatives more costly and more challenging to implement, and limit their effectiveness.
- Corporate Activity and Growth - Risk 5If Citi's Risk Management and Other Processes, Strategies Processes or Models Strategies Are Deficient or Ineffective, Citi May Incur Significant Losses and Its Regulatory Capital and Capital Ratios Could Be Negatively Impacted.
Citi utilizes a broad and diversified set of risk management and other processes and strategies, including the use of models, in analyzing and monitoring the various risks Citi assumes in conducting its activities. Citi also relies on data to assess and manage various risk exposures. Unexpected losses can result from untimely, inaccurate or incomplete risk management processes and data. In addition, Citi's risk management and other processes and strategies, including models, are inherently limited because they involve techniques, including the use of historical data in many circumstances, assumptions and judgments that cannot anticipate every economic and financial outcome in the markets in which Citi operates, particularly given various macroeconomic, geopolitical and other challenges and uncertainties (see the macroeconomic challenges and uncertainties risk factor above), nor can they anticipate the specifics and timing of such outcomes. For example, many models used by Citi include assumptions about correlation or lack thereof among prices of various asset classes or other market indicators that may not necessarily hold in times of market stress, limited liquidity or other unforeseen circumstances, or identify changes in markets or client behaviors not yet inherent in historical data. Citi could incur significant losses, receive negative regulatory evaluation or examination findings or be subject to additional enforcement actions, and its regulatory capital, capital ratios and ability to return capital could be negatively impacted, if Citi's risk management and other processes, including its ability to manage and aggregate data in a timely and accurate manner, strategies or models are deficient or ineffective (for additional information, see the capital return risk factor above and the regulatory scrutiny and changes and the legal and regulatory proceedings risk factors below). Such deficiencies or ineffectiveness could also result in inaccurate financial, regulatory or risk reporting. Moreover, Citi's Basel III regulatory capital models, including its credit, market and operational risk models, are subject to ongoing regulatory review and approval, which may result in refinements, modifications or enhancements (required or otherwise) to these models. Modifications or requirements resulting from these ongoing reviews, as well as any future changes or guidance provided by the U.S. banking regulators regarding the U.S. regulatory capital framework applicable to Citi, including, but not limited to, potential revisions to the U.S. Basel III rules (see the capital return risk factor and "Capital Resources-Regulatory Capital Standards and Developments" above), have resulted, and could continue to result, in significant changes to Citi's risk-weighted assets. These changes can impact Citi's capital ratios and its ability to meet its regulatory capital requirements.
Risk Highlights Q2, 2026
Risk Word Cloud
Risk Factors Full Breakdown - Total Risks 24
- Share Price & Shareholder Rights - Risk 1Citi's Ability to Return Capital to Common Shareholders Substantially Depends on Regulatory Capital Requirements, Including the Results of the FRB's Stress Testing and CCAR Regimes, and Other Factors.
Citi's ability to return capital to its common shareholders consistent with its capital planning efforts and targets, whether through its common stock repurchase program or its common stock dividend, substantially depends, among other things, on its regulatory capital requirements. Citi is required to hold regulatory capital buffers, including a Global Systemically Important Bank (GSIB) surcharge and a Stress Capital Buffer (SCB) based upon the results of the annual CCAR process required by the FRB. For additional information on these regulatory capital buffers, see "Capital Resources-Regulatory Capital Buffers" above. Changes in regulatory capital rules, requirements or interpretations can impact Citi's required regulatory capital. U.S. banking regulators have proposed a number of changes to the U.S. regulatory capital framework, including significant revisions to the U.S. Basel III, GSIB and supervisory stress test rules. These changes will affect Citi's regulatory capital requirements and position and the amount of capital Citi will be able to return to shareholders (see "Capital Resources-Regulatory Capital Standards and Developments" above). Citi's ability to return capital also depends on a variety of other factors, including, but not limited to, the following: - its results of operations and financial condition - any impact to capital from its remaining divestitures - its ability to maintain an effective capital planning process and management framework, which takes into account forecasts of expected macroeconomic conditions and their associated impacts to the level of Citi's regulatory capital and risk-weighted assets under both the Standardized Approach and the Advanced Approaches, as well as the Supplementary Leverage ratio (SLR)- deferred tax asset (DTA) utilization (see the ability to utilize DTA risk factor below) All firms subject to CCAR requirements, including Citi, are subject to a rigorous regulatory evaluation of capital planning practices and other reviews and examinations. Citi's ability to return capital may be adversely impacted if a regulatory evaluation or examination were to result in negative findings regarding absolute capital levels or other aspects of Citi's or any of its subsidiaries' operations, including as a result of the imposition of additional capital buffers, limitations on capital distributions or otherwise. For information on limitations on Citi's ability to return capital to common shareholders, as well as the CCAR process, supervisory stress test requirements and GSIB surcharge, see "Capital Resources-Current Regulatory Capital Standards," "-Regulatory Capital Buffers" and "-Stress Testing Component of Capital Planning" above and the risk management and legal and regulatory proceedings risk factors below.
See a full breakdown of risk according to category and subcategory. The list starts with the category with the most risk. Click on subcategories to read relevant extracts from the most recent report.