C, §1A diff (2024 → 2025)

<div style="min-height:36pt;width:100%"><div><span><br/></span></div></div><div style="width:100.000%"><div style="display:inline-block;vertical-align:top;width:46.666%"><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:12pt;font-weight:700;line-height:120%">RISK FACTORS</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">The following discussion presents what management currently believes could be the material risks and uncertainties that could impact Citi&#8217;s businesses, results of operations and financial condition. As a large, global financial institution, Citi faces particularly complex, diverse and rapidly changing risks and uncertainties. Other risks and uncertainties, including those not currently known to Citi or its management, could also negatively impact Citi&#8217;s businesses, results of operations and financial condition. Thus, the following should not be considered a complete discussion of all of the risks and uncertainties that Citi may face. For additional information about risks and uncertainties that could impact Citi, see &#8220;Executive Summary,&#8221; &#8220;Citi&#8217;s Multiyear Transformation&#8221; and each respective business&#8217;s results of operations above and &#8220;Managing Global Risk&#8221; below. The following headings and risk factors generally align with Citi&#8217;s risk categorization, although in certain instances the risk factors may not directly correspond with how Citi categorizes or manages its risks.</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:700;line-height:120%">MARKET-RELATED RISKS</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">Macroeconomic, Geopolitical and Other Challenges and Uncertainties Could Continue to Have a Negative Impact on Citi.</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi has experienced, and could experience in the future, negative impacts to its businesses, cost of credit, results of operations and financial condition as a result of various macroeconomic, geopolitical and other challenges, uncertainties and volatility. These include, among other things:</span></div><div><span><br/></span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">increases in unemployment rates, recessions or slowing economic growth in the U.S., Europe and other regions or countries</span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">deterioration in consumer and corporate confidence</span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">elevated inflation</span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">significant volatility and disruptions in financial markets</span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">government fiscal or monetary actions (see the changes to interest rates risk factor below)</span></div><div style="text-indent:18pt"><span><br/></span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">For example, substantial new import tariffs and a significant increase in the U.S. effective tariff rate occurred in 2025. There can be no assurance that there will not be additional significant changes in tariff or trade policies. Potential impacts in the U.S. and globally related to trade or tariff policies could include heightened market volatility, increased economic uncertainty, adverse impacts to inflation and global economic activity, disruptions in global supply chains and trade flows, impacts on corporate profitability and credit losses, and other adverse impacts.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Additional areas of uncertainty include, among others, geopolitical challenges, tensions and conflicts, such as those related to the Russia&#8211;Ukraine war (see the emerging markets risk factor below) and conflicts in the Middle East and in other regions; economic and geopolitical challenges related to China, including weak economic growth, related policy actions, challenges in the Chinese real estate sector, banking and credit markets, trade restrictions, and tensions or conflicts </span></div></div><div style="display:inline-block;max-width:6.666%;min-width:5.666%;vertical-align:top"></div><div style="display:inline-block;vertical-align:top;width:46.668%"><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">between China and Taiwan and/or China and the U.S.; high and rising government debt levels in the U.S. and other countries; sanctions; natural disasters; and pandemics. </span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">Changes to Interest Rates Could Adversely Affect Citi&#8217;s Results of Operations.</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Central banks&#8217; decisions on key interest rates directly affect borrowing and investment costs, loan and investment returns, and the valuation of financial assets. U.S. and global interest rate levels can significantly affect Citi&#8217;s results of operations. </span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Interest rates on loans Citi makes are typically based off or set at a spread over a benchmark interest rate and would likely decline or rise as benchmark rates decline or rise, respectively. While interest Citi earns on its assets and pays on its liabilities generally tends to move in the same direction as changes in benchmark rates, one can decline or rise faster than the other, thereby decreasing or increasing Citi&#8217;s net interest income. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">A decline in interest rates would generally be expected to result in lower net interest income for Citi, although Corporate Treasury has various tools to manage Citi&#8217;s total interest rate risk position (see &#8220;Managing Global Risk&#8212; Market Risk&#8212;Market Risk of Non-Trading Portfolios&#8221; below). Central banks&#8217; prematurely or disproportionately lowering benchmark interest rates could result in a resurgence of inflation.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Higher interest rates can negatively impact the economy, resulting in higher unemployment and lower growth. Increases in interest rates can also adversely impact the fair value of available-for-sale (AFS) and held-to-maturity (HTM) debt securities held by Citi, and thereby Citi&#8217;s capital levels and regulatory liquidity position. Interest rate movements, as well as pricing and product competition, can also impact depositor behavior and thereby affect net interest income. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">In addition, Citi&#8217;s net interest income could be adversely affected due to a flattening (a lower spread between shorter-term versus longer-term interest rates) or inversion (shorter-term interest rates exceeding longer-term interest rates) of the interest rate yield curve, as Citi typically pays interest on deposits based on shorter-term interest rates and earns money on loans based on longer-term interest rates. For additional information on Citi&#8217;s interest rate risk, see the liquidity risk factor and &#8220;Managing Global Risk&#8212;Market Risk&#8212;Banking Book Interest Rate Risk&#8221; below.</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:700;line-height:120%">STRATEGIC RISKS</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">Citi&#8217;s Ability to Return Capital to Common Shareholders Substantially Depends on Regulatory Capital Requirements, Including the Results of the FRB&#8217;s Stress Testing and CCAR Regimes, and Other Factors.</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi&#8217;s ability to return capital to its common shareholders consistent with its capital planning efforts and targets, whether through its common stock repurchase program or its common stock dividend, substantially depends, among other things, on its regulatory capital requirements. Citi is required to hold regulatory capital buffers, including a Global Systemically Important Bank (GSIB) surcharge and a Stress Capital Buffer (SCB) based upon the results of the annual CCAR process required by the FRB. For additional information on these regulatory capital buffers, see &#8220;Capital Resources&#8212;Regulatory Capital Buffers&#8221; above. </span></div></div></div><div style="height:36pt;position:relative;width:100%"><div style="bottom:0;position:absolute;width:100%"><div style="text-align:center"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">49 </span></div></div></div><hr style="page-break-after:always"/><div style="min-height:36pt;width:100%"><div><span><br/></span></div></div><div style="width:100.000%"><div style="display:inline-block;vertical-align:top;width:46.666%"><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Changes in regulatory capital rules, requirements or interpretations can impact Citi&#8217;s required regulatory capital. U.S. banking regulators have proposed a number of changes to the U.S. regulatory capital framework, including significant revisions to the U.S. Basel III, GSIB and supervisory stress test rules. These changes will affect Citi&#8217;s regulatory capital requirements and position and the amount of capital Citi will be able to return to shareholders (see &#8220;Capital Resources&#8212;Regulatory Capital Standards and Developments&#8221; above).</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi&#8217;s ability to return capital also depends on a variety of other factors, including, but not limited to, the following:</span></div><div><span><br/></span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">its results of operations and financial condition</span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">any impact to capital from its remaining divestitures</span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">its ability to maintain an effective capital planning process and management framework, which takes into account forecasts of expected macroeconomic conditions and their associated impacts to the level of Citi&#8217;s regulatory capital and risk-weighted assets under both the Standardized Approach and the Advanced Approaches, as well as the Supplementary Leverage ratio (SLR</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:400;line-height:120%">)</span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:400;line-height:120%">&#8226;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">deferred tax asset (DTA) utilization (see the ability to utilize DTA risk factor below)</span></div><div><span><br/></span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">All firms subject to CCAR requirements, including Citi, are subject to a rigorous regulatory evaluation of capital planning practices and other reviews and examinations. Citi&#8217;s ability to return capital may be adversely impacted if a regulatory evaluation or examination were to result in negative findings regarding absolute capital levels or other aspects of Citi&#8217;s or any of its subsidiaries&#8217; operations, including as a result of the imposition of additional capital buffers, limitations on capital distributions or otherwise. For information on limitations on Citi&#8217;s ability to return capital to common shareholders, as well as the CCAR process, supervisory stress test requirements and GSIB surcharge, see &#8220;Capital Resources&#8212;Current Regulatory Capital Standards,&#8221; &#8220;&#8212;Regulatory Capital Buffers&#8221; and &#8220;&#8212;Stress Testing Component of Capital Planning&#8221; above and the risk management and legal and regulatory proceedings risk factors below.</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">Citi Faces Ongoing Regulatory and Legislative Uncertainties and Changes in the U.S. and Globally.</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi, its management and its businesses continue to face regulatory and legislative uncertainties and changes, both in the U.S. and globally. While the ongoing regulatory and legislative uncertainties and changes facing Citi are numerous and subject to change, examples include, but are not limited to, the following:</span></div><div><span><br/></span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">potential changes to U.S. laws or regulations with respect to credit cards, including a possible cap on interest rates</span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">potential changes to various aspects of the U.S. regulatory capital framework and requirements applicable to Citi (see the capital return risk factor and &#8220;Capital Resources&#8212;Regulatory Capital Standards and Developments&#8221; above)</span></div><div><span><br/></span></div></div><div style="display:inline-block;max-width:6.666%;min-width:5.666%;vertical-align:top"></div><div style="display:inline-block;vertical-align:top;width:46.668%"><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:2pt;font-weight:400;line-height:120%"> </span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">potential fiscal, monetary, tax, sanctions and other changes promulgated by the U.S. federal government and other governments (see the macroeconomic challenges and uncertainties and changes to interest rates risk factors above)</span></div><div><span><br/></span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">References to &#8220;regulatory&#8221; refer to both formal regulation and the views and expectations of Citi&#8217;s regulators in their supervisory and enforcement roles, which, as they change over time, can have a major impact. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Additionally, U.S. and international regulatory and legislative initiatives have not always been undertaken or implemented on a coordinated basis, and areas of divergence have developed and continue to develop with respect to their scope, interpretation, timing, structure or approach, leading to inconsistent or even conflicting requirements, including within a single jurisdiction. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Further, ongoing regulatory and legislative uncertainties and changes make Citi&#8217;s long-term business, balance sheet and strategic planning difficult, subject to change, and potentially more costly and may impact its results of operations. U.S. and other regulators globally continue to discuss various changes to regulatory requirements, which require ongoing assessment by management as to the impact to Citi, its businesses and business planning. Business planning must necessarily be based on possible or proposed rules or outcomes, which can change significantly upon finalization, or upon implementation or interpretive guidance from numerous regulatory bodies worldwide, and such guidance can change. Regulatory and legislative changes have also significantly increased Citi&#8217;s compliance risks and costs (see the implementation and interpretation of regulatory</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">scrutiny and changes risk factor below) and can adversely affect Citi&#8217;s competitive position, as well as its businesses, revenues, results of operations and financial condition.</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">Citi May Be Unable to Achieve Its Objectives from Its Simplification, Transformation and Enhanced Business Performance Priorities.</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi has been pursuing overall simplification initiatives to enhance its client focus and reduce expenses. Citi&#8217;s simplification initiatives, including completing its divestiture of Banamex, involve various execution challenges, may take longer than expected and may result in higher expenses, or lower than expected expense savings, CTA and other losses or other negative financial or strategic impacts, which could be material, and litigation and regulatory scrutiny (for information about CTA impacts, see the changes in or incorrect assumptions risk factor below).</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">As part of its multiyear transformation, Citi also continues to make significant investments and undertake substantial actions across the Company to modernize its data and</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">technology infrastructure, further strengthen its risk and controls environment and further enhance safety and soundness (see &#8220;Citi&#8217;s Multiyear Transformation&#8221; above and the legal and regulatory proceedings risk factor below). </span></div><div style="text-indent:18pt"><span><br/></span></div></div></div><div style="height:36pt;position:relative;width:100%"><div style="bottom:0;position:absolute;width:100%"><div style="text-align:center"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">50 </span></div></div></div><hr style="page-break-after:always"/><div style="min-height:36pt;width:100%"><div><span><br/></span></div></div><div style="width:100.000%"><div style="display:inline-block;vertical-align:top;width:46.666%"><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Moreover, Citi continues to make business-led investments, as part of the execution of its strategic priorities. For example, Citi has been making technology and other investments across the Company, including hiring employees in key strategic markets and businesses; enhancing product capabilities and platforms to grow key businesses, improve client digital experiences and add scalability; and implementing new capabilities and partnerships.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi&#8217;s simplification, transformation and enhanced business performance priorities involve significant complexities and uncertainties. In addition, there is inherent risk that these initiatives will not be as productive or effective as Citi expects, or at all. Conversely, failure to adequately invest in and upgrade Citi&#8217;s technology and processes could result in Citi&#8217;s inability to be sufficiently competitive, meet regulatory expectations, serve clients effectively and avoid disruptions to its businesses, and operational errors (see the operational processes and systems and legal and regulatory proceedings risk factors below). </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi&#8217;s ability to achieve its expected returns, including underlying expense savings, revenue growth and capital return objectives, as well as related operational improvements depends, in part, on factors that it cannot control, including, among others, macroeconomic challenges and uncertainties; customer, client and competitor actions; and ongoing regulatory requirements or changes.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Further, Citi&#8217;s simplification, transformation and enhanced business performance priorities may continue to evolve as its business strategies, including with respect to organic or inorganic growth, the market environment and regulatory expectations change, which could make the initiatives more costly and more challenging to implement, and limit their effectiveness. </span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">Climate Change Presents Various Financial and Non-Financial Risks to Citi.</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Climate change presents both immediate and long-term risks to Citi, with the risks expected to increase over time. Climate risks can arise from both physical risks and transition risks. Physical and transition risks can manifest differently across Citi&#8217;s risk categories in the short, medium and long terms. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Physical risks include acute risks, such as wildfires, tropical cyclones, heat waves, floods and droughts, as well as consequences of chronic changes in climate. For example, physical risks could have adverse financial, operational and other impacts on Citi, both directly on its business and operations, and indirectly as a result of impacts to Citi&#8217;s clients, customers, vendors and other counterparties. These impacts can include the following:</span></div><div style="text-indent:18pt"><span><br/></span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">destruction, damage or impairment of owned or leased properties and other assets</span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">destruction or deterioration of the value of collateral, such as real estate</span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">disruptions to business operations and supply chains</span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">reduced availability or increases in the cost of insurance</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Physical risks can also impact Citi&#8217;s credit risk exposures, for example, in its mortgage and commercial real estate lending businesses.</span></div></div><div style="display:inline-block;max-width:6.666%;min-width:5.666%;vertical-align:top"></div><div style="display:inline-block;vertical-align:top;width:46.668%"><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Transition risks may arise from changes in regulations or market preferences toward low-carbon industries or sectors, which in turn could have negative impacts on asset values, results of operations or the reputations of Citi and its customers and clients, and lead to a loss of market share, lower revenues and higher credit costs. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Diverging legislative and regulatory changes and uncertainties regarding climate-related risk management and disclosures can increase Citi&#8217;s regulatory and compliance risks and costs. Furthermore, Citi may face heightened scrutiny and litigation risks stemming from its climate and sustainability commitments, disclosures and marketing.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Even as some regulators seek to mandate additional disclosure of climate-related information, Citi&#8217;s ability to comply with such requirements and conduct more robust climate-related risk analyses may be hampered by lack of information and reliable data. Data on climate-related risks is limited in availability, often based on estimated or unverified figures, collected and reported on a time-lag, and variable in quality. Modeling capabilities to analyze climate-related risks and interconnections continue to evolve.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi&#8217;s approach to supporting clients in their efforts to decarbonize may lead to both continued exposure to carbon-intensive activity and increased reputation risks from stakeholders with divergent points of view. Additionally, if Citi is unable to achieve some of its objectives or commitments relating to climate change, its businesses, reputation and attractiveness to certain investors or clients may suffer. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">For additional information, see &#8220;Sustainability&#8221; and &#8220;Managing Global Risk&#8212;Strategic Risk&#8212;Climate Risk&#8221; below.</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">Citi&#8217;s Ability to Utilize Its DTAs, and Thus Reduce the Negative Impact of the DTAs on Citi&#8217;s Regulatory Capital, Will Be Driven by Its Ability to Generate U.S. Taxable Income.</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">At December 31, 2025, Citi&#8217;s net DTAs were $29.5 billion, net of a valuation allowance of $5.0 billion, of which $13.1 billion was deducted from Citi&#8217;s CET1 Capital under the U.S. Basel III rules. Of this deducted amount, </span><span style="color:#231f20;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">$10.8 billion</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%"> related to net operating losses, foreign tax credit and general business credit carry-forwards, with </span><span style="color:#231f20;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">$3.1 billion</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%"> related to temporary differences in excess of the 10%/15% regulatory limitations, reduced by $0.8 billion of deferred tax liabilities, primarily associated with goodwill and certain other intangible assets that were separately deducted from capital.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi&#8217;s ability to realize its DTAs will primarily be dependent upon its ability to generate U.S. taxable income in the relevant reversal periods. Failure to realize any portion of the net DTAs would have a corresponding negative impact on Citi&#8217;s net income and financial returns.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">The accounting treatment for realization of DTAs is complex and requires significant judgment and estimates regarding future taxable earnings in the jurisdictions in which the DTAs arise and available tax planning strategies. Forecasts of future taxable earnings will depend upon various factors, including, among others, macroeconomic conditions. </span></div></div></div><div style="height:36pt;position:relative;width:100%"><div style="bottom:0;position:absolute;width:100%"><div style="text-align:center"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">51 </span></div></div></div><hr style="page-break-after:always"/><div style="min-height:36pt;width:100%"><div><span><br/></span></div></div><div style="width:100.000%"><div style="display:inline-block;vertical-align:top;width:46.666%"><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">For additional information on Citi&#8217;s DTAs, including FTCs, see &#8220;Significant Accounting Policies and Significant Estimates&#8212;Income Taxes&#8221; below and Notes 1 and 10.</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">Citi Is Subject to Complex Tax Laws, Which May Change, and Citi&#8217;s Interpretation or Application of These Complex Tax Laws Could Differ from Those of Governmental Authorities, Which Could Result in Litigation or Examinations and the Payment of Additional Taxes, Penalties or Interest.</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi is subject to various tax laws of the U.S. and its states and municipalities, as well as the numerous non-U.S. jurisdictions in which it operates. These tax laws are inherently complex, and Citi must make judgments and interpretations about the application of these laws to its entities, operations and businesses. Moreover, these tax laws and related regulations may change, which could result in additional tax liability for Citi. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Additionally, Citi is subject to litigation or examinations with U.S. and non-U.S. tax authorities regarding tax matters. While Citi has appropriately reserved for such matters where there is a probable loss, and has disclosed reasonably possible losses, the outcome of the matters may be different than Citi&#8217;s expectations. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi&#8217;s interpretations or application of the tax laws, including with respect to withholding, stamp, service and other non-income taxes, as well as in connection with asset dispositions, divestitures or similar transactions, could differ from that of the relevant governmental taxing authority, which could result in the requirement to pay additional taxes, penalties or interest, the reduction of certain tax benefits or the requirement to make adjustments to amounts recorded, which could be material. See Note 30 for additional information on how Citi accrues for potential losses from tax matters.</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">A Deterioration in or Failure to Maintain Citi&#8217;s Co-Branding or Private Label Credit Card Relationships Could Have a Negative Impact on Citi.</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi has co-branding and private label relationships with various retailers and merchants through its Branded Cards and Retail Services credit card businesses, whereby in the ordinary course of business Citi issues credit cards to consumers, including customers of the retailers or merchants. The five largest relationships across both businesses constituted an aggregate of approximately 12% of Citi&#8217;s revenues in 2025 (see &#8220;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:400;line-height:120%">U.S. Personal Banking</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8221; above). Citi&#8217;s co-branding and private label agreements often provide for shared economics between the parties and generally have a fixed term.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Competition among credit card issuers, including Citi, for these relationships is significant, and Citi may not be able to maintain such relationships on existing terms or at all. Citi&#8217;s co-branding and private label relationships could also be negatively impacted by, among other things, the general economic environment, including the impacts stemming from potential increases in unemployment, inflation or interest rates or lower economic growth rates, as well as a risk of recession; changes in consumer sentiment, spending patterns and credit card usage behaviors; a decline in sales and revenues, partner store closures, any reduction in air and business travel, or other operational difficulties of the retailer or merchant; </span></div></div><div style="display:inline-block;max-width:6.666%;min-width:5.666%;vertical-align:top"></div><div style="display:inline-block;vertical-align:top;width:46.668%"><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">changes in partner business strategies, including changes in products and services offered; termination or non-renewal of partner agreements, including early termination due to a contractual breach or exercise of other early termination rights; or other factors, including bankruptcies, liquidations, restructurings, consolidations or other similar events, whether due to a challenging macroeconomic environment or otherwise.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">These events, particularly early termination and bankruptcies or liquidations, could negatively impact the results of operations or financial condition of Branded Cards, Retail Services or Citi as a whole, including as a result of loss of revenues, increased expenses, higher cost of credit, impairment of purchased credit card relationships and contract-related intangibles or other losses (see Note 17 for information on Citi&#8217;s credit card-related intangibles generally).</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">The Application of U.S. Resolution Plan Requirements May Pose a Greater Risk of Loss to Citi&#8217;s Debt and Equity Securities Holders, and Citi&#8217;s Inability in Its Resolution Plan Submissions to Address Any Shortcomings or Deficiencies or Guidance Could Subject Citi to More Stringent Capital, Leverage or Liquidity Requirements, or Restrictions on Its Growth, Activities or Operations, and Could Eventually Require Citi to Divest Assets or Operations.</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Every two years, Title I of the Dodd-Frank Act requires Citi to prepare and submit a plan to the FRB and the FDIC for the orderly resolution of Citigroup (the bank holding company) and its significant legal entities under the U.S. Bankruptcy Code in the event of future material financial distress or failure. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Under Citi&#8217;s preferred &#8220;single point of entry&#8221; resolution plan strategy, only Citigroup, the parent holding company, would enter into bankruptcy, while Citigroup&#8217;s material legal entities (as defined in the public section of its 2025 resolution plan, which can be found on the FRB&#8217;s and FDIC&#8217;s websites) would remain operational outside of any resolution or insolvency proceedings. As a result, Citigroup&#8217;s losses and any losses incurred by its material legal entity subsidiaries would be imposed first on holders of Citigroup&#8217;s equity securities and thereafter on its unsecured creditors, including holders of eligible long-term debt and other debt securities. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">In addition, a wholly owned, direct subsidiary of Citigroup serves as a resolution funding vehicle (the intermediate holding company, or IHC) to which Citigroup has transferred, and has agreed to transfer on an ongoing basis, certain assets. The obligations of Citigroup and of the IHC, respectively, under the amended and restated secured support agreement, are secured on a senior basis by the assets of Citigroup (other than shares in subsidiaries of the parent company and certain other assets), and the assets of the IHC, as applicable. As a result, claims of the operating material legal entities against the assets of Citigroup with respect to such secured assets are effectively senior to unsecured obligations of Citigroup. Citi&#8217;s single point of entry resolution plan strategy and the obligations under the amended and restated secured support agreement may result in the recapitalization of and/or provision of liquidity to Citi&#8217;s operating material legal entities, and the commencement of bankruptcy proceedings by Citigroup at an earlier stage of </span></div></div></div><div style="height:36pt;position:relative;width:100%"><div style="bottom:0;position:absolute;width:100%"><div style="text-align:center"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">52 </span></div></div></div><hr style="page-break-after:always"/><div style="min-height:36pt;width:100%"><div><span><br/></span></div></div><div style="width:100.000%"><div style="display:inline-block;vertical-align:top;width:46.666%"><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">financial stress than might otherwise occur without such mechanisms in place.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">In line with the FRB&#8217;s total loss-absorbing capacity (TLAC) rule, Citigroup&#8217;s shareholders and unsecured creditors&#8212;including its unsecured long-term debt holders&#8212;would bear any losses resulting from Citigroup&#8217;s bankruptcy. Accordingly, any value realized by holders of its unsecured long-term debt may not be sufficient to repay the amounts owed to such debt holders in the event of a bankruptcy or other resolution proceeding of Citigroup. For additional information on Citi&#8217;s single point of entry resolution plan strategy and the IHC and secured support agreement, see &#8220;Managing Global Risk&#8212;Liquidity Risk&#8221; below.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">On November 22, 2022, the FRB and FDIC issued feedback on the resolution plans filed on July 1, 2021 by the eight U.S. GSIBs, including Citigroup. The FRB and FDIC jointly identified one shortcoming in Citigroup&#8217;s 2021 resolution plan. The shortcoming related to data integrity and data quality management issues, specifically, weaknesses in Citi&#8217;s processes and practices for producing certain data that could materially impact its resolution capabilities. On June 20, 2024, the FRB and FDIC issued feedback on the resolution plans filed on July 1, 2023 by the eight U.S. GSIBs, including Citigroup. The FRB and FDIC jointly identified one shortcoming in Citigroup&#8217;s 2023 resolution plan regarding Citi&#8217;s derivatives unwind capabilities. If a shortcoming is not satisfactorily explained or addressed before, or in, the submission of the next resolution plan, the shortcoming may be found to be a deficiency in the next resolution plan (see discussion below). Citi submitted a targeted resolution plan on July 1, 2025.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Under Title I, if the FRB and the FDIC jointly determine that Citi&#8217;s resolution plan is not &#8220;credible&#8221; (which, although not defined, is generally understood to mean the regulators do not believe the plan is feasible or would otherwise allow Citi to be resolved in a way that protects systemically important functions without severe systemic disruption), or would not facilitate an orderly resolution of Citi under the U.S. Bankruptcy Code, and Citi fails to resubmit a resolution plan that remedies any identified deficiencies, Citi could be subjected to more stringent capital, leverage or liquidity requirements, or restrictions on its growth, activities or operations. If within two years from the imposition of any such requirements or restrictions Citi has still not remediated any identified deficiencies, then Citi could eventually be required to divest certain assets or operations. Any such restrictions or actions would negatively impact Citi&#8217;s reputation, market and investor perception, operations and strategy.</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">Citi&#8217;s Performance Could Be Negatively Impacted if It Is Not Able to Hire and Retain Qualified Employees.</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi&#8217;s performance and the performance of its individual businesses largely depend on the talents and efforts of its highly qualified employees. Specifically, Citi&#8217;s continued ability to compete in each of its lines of business, grow and manage its businesses effectively, as well as to execute its strategic priorities, depends on its ability to hire new employees and to retain and motivate its existing employees. If Citi is unable to continue to hire, retain and motivate highly </span></div></div><div style="display:inline-block;max-width:6.666%;min-width:5.666%;vertical-align:top"></div><div style="display:inline-block;vertical-align:top;width:46.668%"><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">qualified employees, Citi&#8217;s performance, including its competitive position, the achievement of its priorities and its results of operations could be negatively impacted.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi&#8217;s ability to attract, retain and motivate employees depends on numerous factors, some of which are outside of Citi&#8217;s control. For example, the competition for talent continues to be particularly intense due to various factors, such as changes in worker expectations, concerns and preferences. Also, the banking industry generally is subject to more comprehensive regulation of employee compensation than other industries, including deferral and clawback requirements for incentive compensation, which can make it unusually challenging for Citi to compete in labor markets against businesses, including, for example, technology companies, that are not subject to such regulation. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Other factors that could impact Citi&#8217;s ability to attract, retain and motivate employees include, among other things, Citi&#8217;s presence in a particular market or region, the professional and development opportunities it offers and its reputation. For information on Citi&#8217;s employee and workforce management, see &#8220;Human Capital Resources and Management&#8221; below.</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">Citi Faces Potential Disruptions from an Evolving</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">Business Environment, Including Competitive Challenges and Emerging Technologies.</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi operates in an increasingly evolving and competitive business environment, which includes both financial and non-financial services firms, such as banks and private credit, financial technology and digital asset companies, among others.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Certain competitors may be subject to different and, in some cases, less stringent legal, regulatory and supervisory requirements, whether due to size, jurisdiction, entity type or other factors, placing Citi at a competitive disadvantage. To the extent that Citi is not able to compete effectively with other financial services companies, including private credit, financial technology and digital asset companies, and non-financial services firms, or adequately assess the competitive landscape, Citi could be placed at a competitive disadvantage, which could result in loss of customers and market share, and its businesses, results of operations and financial condition could suffer. For additional information on Citi&#8217;s competitive risks, see the co-branding and private label credit cards and qualified employees risk factors above and the AI risk factor and &#8220;Supervision, Regulation and Other&#8212;Competition&#8221; below. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi competes with other financial services companies in the U.S. and globally that have grown rapidly over the last several years or have introduced new products and services. Mergers and acquisitions involving traditional financial services companies, such as regional banks or credit card issuers, as well as networks and merchant acquirers, may also increase competition. Non-traditional financial services firms, such as private credit, financial technology and digital asset companies, are less regulated and supervised and continue to expand their offerings of services traditionally provided by financial institutions. </span></div><div style="text-indent:18pt"><span><br/></span></div></div></div><div style="height:36pt;position:relative;width:100%"><div style="bottom:0;position:absolute;width:100%"><div style="text-align:center"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">53 </span></div></div></div><hr style="page-break-after:always"/><div style="min-height:36pt;width:100%"><div><span><br/></span></div></div><div style="width:100.000%"><div style="display:inline-block;vertical-align:top;width:46.666%"><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Additionally, emerging technologies have the potential to accelerate disruption and intensify competition in the financial services industry. These emerging technologies, such as artificial intelligence (AI) and digital assets (including tokenized deposits, cryptocurrencies, stablecoins and other assets and products that use distributed ledger or blockchain technology) and changes in the payments space (e.g., instant and 24/7 payments) are accelerating, and, as a result, certain of Citi&#8217;s products and services could become less competitive (see the AI risk factor below). </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Increased competition and emerging technologies could require Citi to change or adapt its products and services, as well as invest in and develop related infrastructure, to attract and retain customers or clients. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">The U.S. administration and Congress have been</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">supportive of the growth and use of digital assets, including</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">passing legislation such as the GENIUS Act and pursuing a</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">more favorable regulatory approach, although the legal and</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">regulatory landscape remains highly uncertain. As digital</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">assets continue to evolve, customer demand for enhanced</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">offerings may increase. Failure to strategically adopt emerging</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">technologies may result in a competitive disadvantage to Citi.</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi also may not be able to provide the same or similar</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">products and services for legal or regulatory reasons, which</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">may be exacerbated by rapidly evolving and conflicting</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">regulatory requirements.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Moreover, as Citi develops new products and services leveraging emerging technologies, new risks may emerge that, if not designed and governed adequately, may result in control gaps and in Citi operating outside of its risk appetite. For example, the use or development of emerging technologies, such as AI or digital assets, without sufficient controls, governance and risk management may result in increased risks across various risk categories (for additional information, see the AI, operational processes and systems and cybersecurity risk factors below). As another example, instant and 24/7 payments products could be accompanied by challenges to forecasting and managing liquidity, as well as increased operational and compliance risks. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi relies on third parties to support certain of its product and service offerings, which may put Citi at a disadvantage to competitors who may directly offer a broader array of products and services. Citi&#8217;s businesses, results of operations and reputation may suffer if any third party is unable to provide adequate support for such product and service offerings, whether due to operational incidents or otherwise (see the operational processes and systems and cybersecurity risk factors below).</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">The Development and Use of AI by Citi and Others Present Risks to Citi&#8217;s Businesses.</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi has used AI and machine learning tools for many years and has more recently begun to broadly deploy Generative AI, including within its technology platforms and services. In the future, Citi expects to more broadly integrate Generative AI tools within its systems, businesses and functions, including advanced AI capabilities, such as autonomous agents and sophisticated user interactions, which if improperly managed, could result in increased risks and costs. </span></div><div style="text-indent:18pt"><span><br/></span></div></div><div style="display:inline-block;max-width:6.666%;min-width:5.666%;vertical-align:top"></div><div style="display:inline-block;vertical-align:top;width:46.668%"><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">While Citi has policies that govern the use of emerging technologies, including in model risk management, ineffective, inadequate or faulty Generative AI development or deployment practices by Citi or third parties, including insufficient testing and monitoring, poorly structured or manipulated prompts or insufficient or inadequate human oversight, could result in adverse consequences, such as AI algorithms that produce inaccurate or incomplete output or output based on biased, incomplete and/or inaccurate datasets, infringe on intellectual property rights of others, involve data exfiltration risks, including release of confidential or proprietary information, or cause other issues, concerns or deficiencies. The complexity of AI models, particularly Generative AI models, can make it challenging to understand why particular outputs are generated, which can increase the risk of erroneous and/or biased output and complying with regulations requiring documentation, explainability or auditability on the basis of AI-influenced decisions. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi may also rely on AI models developed by third parties and be exposed to risks arising from their development and training methods, including potential inclusion of unauthorized material in the training data or limitations in their risk mitigation strategies, over which Citi may have limited visibility or control (see also the operational processes and systems risk factor below). While Citi may provide restrictions on use of certain data in third-party AI applications or models, a third party could breach those terms, which could expose Citi to legal and reputations risks. Citi is also exposed to risks related to the use of AI technologies by counterparties, clients and vendors, where interconnected AI systems could amplify failures and threats of cyber infiltration, as well as cause widespread disruptions. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Moreover, the use of increasingly sophisticated AI technologies by malicious actors and others has increased the risk of fraud, including identity theft and bypassing of verification controls, and exposure to cyberattacks (see the cybersecurity risk factor below), as well as disinformation and market manipulation campaigns, and failure to effectively manage such risks could result in misappropriation of funds, unauthorized transactions, exposure of sensitive client or Company information, reputational harm and increased litigation and regulatory risk. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi also faces competition risks to the extent that competitors may be faster and more successful in developing and deploying AI technologies to improve processes, productivity, efficiency, products and services, and thereby gain competitive advantages over Citi (see the competition risk factor above). </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">In addition, compliance with new or changing laws, regulations or industry standards relating to AI may impose additional operational risks and costs. Failure to sufficiently manage these risks could expose Citi to adverse legal, regulatory or reputational consequences.</span></div><div><span><br/></span></div><div><span><br/></span></div></div></div><div style="height:36pt;position:relative;width:100%"><div style="bottom:0;position:absolute;width:100%"><div style="text-align:center"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">54 </span></div></div></div><hr style="page-break-after:always"/><div style="min-height:36pt;width:100%"><div><span><br/></span></div></div><div style="width:100.000%"><div style="display:inline-block;vertical-align:top;width:46.666%"><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:700;line-height:120%">OPERATIONAL RISKS</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">A Disruption or Failure of Citi&#8217;s Operational Processes or Systems Could Negatively Impact Its Reputation, Customers, Clients, Businesses or Results of Operations and Financial Condition.</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi&#8217;s global operations rely heavily on its technology systems and infrastructure, including the accurate, complete, timely and secure processing, management, storage and transmission of data, including confidential transactions, and other information, as well as the monitoring of a substantial amount of data and complex transactions in real time. Citi obtains and stores an extensive amount of personal and client-specific information for its consumer and institutional customers and clients, and must accurately record and reflect their account transactions. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">With the proliferation of emerging technologies, including AI and digital assets, and the use of the internet, mobile devices and cloud services to conduct financial transactions, and customers&#8217; and clients&#8217; increasing use of online banking and trading systems and other platforms, large global financial institutions such as Citi have been, and will continue to be, subject to an ever-increasing risk of operational loss, failure or disruption. For example, Citi&#8217;s involvement in digital assets,</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">including custody, asset tokenization and facilitation of clients&#8217; digital assets activities, exposes Citi to increased operational risks due to the unique technological requirements for securing these assets.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Although Citi has continued to upgrade its technology, including systems to automate processes and gain efficiencies, operational incidents are unpredictable and can arise from numerous sources, not all of which are fully within Citi&#8217;s control. These include, among others, operational or execution failures or deficiencies by third parties that provide products or services to Citi (e.g., cloud service providers), including such third parties&#8217; downstream service providers, as well as other Citi counterparties and market participants, which could be exacerbated by the concentration of third-party providers across the financial services industry; deficiencies in processes or controls; inadequate management of data governance practices, data controls and monitoring mechanisms that may adversely impact internal or external reporting and decision-making; cyber or information security incidents (see the cybersecurity risk factor below); human error, such as manual transaction processing errors (e.g., erroneous payments to lenders or manual errors by traders that cause system and market disruptions or losses), which can be exacerbated by staffing challenges and processing backlogs; fraud or malice on the part of employees or third parties; insufficient (or limited) straight-through processing between legacy or bespoke systems and any failure to design and effectively operate controls that mitigate operational risks associated with those legacy or bespoke systems, leading to potential risk of errors and operating losses; accidental system or technological failure; electrical or telecommunication outages; failures of or cyber incidents involving computer servers or infrastructure, including software updates and cloud services; or other similar losses or damage to Citi&#8217;s property or assets (see also the climate change risk factor above). Additionally, Citi&#8217;s ability to effectively maintain and upgrade systems and infrastructure </span></div></div><div style="display:inline-block;max-width:6.666%;min-width:5.666%;vertical-align:top"></div><div style="display:inline-block;vertical-align:top;width:46.668%"><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">can become more challenging as the speed, frequency, volume, interconnectivity and complexity of transactions continue to increase.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">For example, operational incidents can arise due to failures by third parties with which Citi does business, such as failures by internet, mobile technology and cloud service providers or other vendors to adequately follow procedures or processes, safeguard their systems or prevent system disruptions or cyberattacks. Failure by Citi to develop, implement and operate a third-party risk management program commensurate with the level of risk, complexity and nature of its third-party relationships can also result in operational incidents. In addition, Citi has experienced and could experience further losses associated with manual transaction processing errors, including erroneous payments to lenders or manual errors by Citi traders that cause system and market disruptions and losses for Citi and its clients. Irrespective of the sophistication of the technology utilized by Citi, there will always be a risk of human and other errors. In view of the large transactions in which Citi engages, such errors have in the past resulted, and could result, in significant losses. While Citi has change management processes in place to appropriately upgrade its operational processes and systems to ensure that any changes introduced do not adversely impact security and operational continuity, such change management can fail or be ineffective. Furthermore, when Citi introduces new products, systems or processes, new operational risks that may arise from those changes may not be identified, or adequate controls to mitigate the identified risks may not be appropriately implemented or operate as designed. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Incidents that impact information security, technology operations or other operational processes may cause disruptions and/or malfunctions within Citi&#8217;s businesses (e.g., the temporary loss of availability of Citi&#8217;s online banking system or mobile banking platform), as well as the operations of its clients, customers or other third parties. In addition, operational incidents could involve the failure or ineffectiveness of internal processes or controls. Given Citi&#8217;s global footprint and the high volume of transactions processed by Citi, certain failures, errors or actions may be repeated or compounded before they are discovered and rectified, which would further increase the consequences and costs. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Operational incidents could result in financial losses and other costs as well as misappropriation, corruption or loss of confidential and other information or assets, which could significantly negatively impact Citi&#8217;s reputation, customers, clients, employees, businesses or results of operations and financial condition, or the potential for systemic disruption due to interconnected systems and dependencies. Additionally, any unavailability or failure of backup systems could impact business continuity in the event of an operational incident. Cyber-related and other operational incidents can also result in legal and regulatory actions or proceedings, fines and other costs (see the legal and regulatory proceedings risk factor below).</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Failure by Citi to continue to increase its operational resilience, and ensure that important business services and their impact tolerance time and severity scales are clearly defined, could expose Citi to service disruptions, leading to </span></div></div></div><div style="height:36pt;position:relative;width:100%"><div style="bottom:0;position:absolute;width:100%"><div style="text-align:center"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">55 </span></div></div></div><hr style="page-break-after:always"/><div style="min-height:36pt;width:100%"><div><span><br/></span></div></div><div style="width:100.000%"><div style="display:inline-block;vertical-align:top;width:46.666%"><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">harms to Citi clients, market integrity, Citi&#8217;s reputation, financial stability or safety and soundness. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">For information on Citi&#8217;s management of operational risk, see &#8220;Managing Global Risk&#8212;Operational Risk&#8221; below.</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">Citi&#8217;s and Third Parties&#8217; Computer Systems and Networks Continue to Be Susceptible to an Increasing Risk of Evolving, Sophisticated Cybersecurity Incidents That Could Result in the Theft, Loss, Non-Availability, Alteration, Misuse or Disclosure of Confidential Information, Damage to Citi&#8217;s Reputation, Regulatory Penalties, Legal Exposure and Financial Losses. </span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi&#8217;s computer systems, software and networks are subject to ongoing attempted cyberattacks, as attempts to effectuate unauthorized access to, theft or destruction of data (including confidential client information), account takeovers, and disruptions of service, using techniques including phishing, malware, ransomware, computer viruses or other malicious code, exploitation of vulnerabilities, and others. These threats can arise from external parties, including cyber criminals, cyber terrorists, hacktivists and nation-state actors, as well as insiders who knowingly or unknowingly engage in or enable malicious cyber activities. For example, nation-state actors have recently targeted critical U.S. infrastructure with cyberattacks. Some cyber and information security incidents may also occur as a result of unintentional conduct on the part of employees, customers or suppliers.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi develops its own software and relies on third-party applications and software, which are susceptible to vulnerability exploitations. Software leveraged in financial services and other industries continues to be impacted by an increasing number of zero-day vulnerabilities, thus increasing inherent cyber risk to Citi. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">The increasing use of cloud and new and emerging technologies (such as AI and digital assets), as well as connectivity solutions to facilitate remote working for Citi&#8217;s employees, all increase Citi&#8217;s exposure to cybersecurity risks. Citi is also susceptible to cyberattacks given, among other factors, its size and scale, high-profile brand, global footprint and prominent role in the financial system. Additionally, Citi continues to operate in multiple jurisdictions in the midst of geopolitical unrest or uncertainties, including, among others, those affected by the Russia&#8211;Ukraine war and the conflicts in the Middle East, which could expose Citi to heightened risk of insider threat, cyber threats from nation-state actors, hacktivism or other cyber incidents. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi continues to experience increased exposure to cyberattacks through third parties. Third parties with which Citi does business, as well as retailers and other third parties with which Citi&#8217;s customers do business, and any such third parties&#8217; downstream service providers, also pose cybersecurity risks, particularly where activities of customers are beyond Citi&#8217;s security and control systems. For example, Citi outsources certain functions, such as processing customer credit card transactions, uploading content on customer-facing websites and developing software for new products and services. These relationships allow for the storage and processing of customer information by third-party hosting of, or access to, Citi websites. This could lead to compromise or the potential to introduce vulnerable or malicious code, </span></div></div><div style="display:inline-block;max-width:6.666%;min-width:5.666%;vertical-align:top"></div><div style="display:inline-block;vertical-align:top;width:46.668%"><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">resulting in security breaches or business disruptions impacting Citi customers, employees or operations. While many of Citi&#8217;s agreements with third parties include indemnification provisions, Citi may not be able to recover sufficiently under these provisions, or at all, to adequately offset any losses and other adverse impacts Citi may incur from third-party cyber incidents. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi and some of its third-party partners have been subjected to attempted and sometimes successful cyberattacks over the last several years, including the following:</span></div><div><span><br/></span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">denial of service attacks, which attempt to interrupt service to clients and customers</span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">hacking and malicious software installations intended to gain unauthorized access to information systems or to disrupt those systems and/or impact availability or privacy of confidential data, with objectives including, but not limited to, extortion payments or causing reputational damage</span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">data breaches due to unauthorized access to customer accounts or other data</span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">malicious software attacks on client systems, in attempts to gain unauthorized access to Citi systems or client data under the guise of normal client transactions </span></div><div style="text-indent:18pt"><span><br/></span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">While Citi&#8217;s cyber and information security program has historically generally succeeded in detecting, thwarting and/or responding to attacks targeting its systems before they become significant, certain past incidents resulted in limited losses, as well as increases in expenditures to monitor against the threat of similar future cyber incidents. There can be no assurance that such cyber incidents will not occur again, and they could occur more frequently, via novel tactics, including leveraging of tools made possible by emerging technologies, and on a more significant scale. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Because the techniques used to initiate cyberattacks change frequently or, in some cases, are not recognized until deployed, Citi may be unable to implement effective preventive measures or otherwise proactively address these risks. In addition, cyber threats and cyberattack techniques change, develop and evolve rapidly, including from emerging technologies such as AI and quantum computing. Given the frequency and sophistication of cyberattacks, the determination of the severity and potential impact of a cyber incident may not become apparent for a substantial period of time following detection of the incident. Also, while Citi strives to implement measures to reduce the exposure resulting from outsourcing risks, such as performing security control assessments of third-party vendors and limiting third-party access to the least privileged level necessary to perform service functions, these measures cannot prevent all third-party-related cyberattacks or data breaches. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Cyber incidents can result in the disclosure of personal, confidential or proprietary customer, client or employee information; damage to Citi&#8217;s reputation with its clients, other counterparties and the market; customer dissatisfaction; and additional costs to Citi, including expenses such as repairing or replacing systems, replacing customer payment cards, credit monitoring or adding new personnel or protection technologies. Cyber incidents can also result in regulatory </span></div></div></div><div style="height:36pt;position:relative;width:100%"><div style="bottom:0;position:absolute;width:100%"><div style="text-align:center"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">56 </span></div></div></div><hr style="page-break-after:always"/><div style="min-height:36pt;width:100%"><div><span><br/></span></div></div><div style="width:100.000%"><div style="display:inline-block;vertical-align:top;width:46.666%"><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">penalties, loss of revenues, deposit outflows, exposure to litigation and regulatory action and other financial losses, including loss of funds to both Citi and its clients and customers, and disruption to Citi&#8217;s operational systems (see the operational processes and systems risk factor above). </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Moreover, the increasing risk of cyber incidents has resulted in increased legislative and regulatory action on cybersecurity, including, among other things, scrutiny of firms&#8217; cybersecurity programs, laws and regulations to enhance protection of consumers&#8217; personal data and mandated disclosure on cybersecurity matters and of certain cybersecurity incidents.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">While Citi maintains insurance coverage that may, subject to policy terms and conditions including significant self-insured deductibles, transfer certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses and may not take into account reputational harm, the costs of which are impossible to quantify.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">For additional information about Citi&#8217;s management of cybersecurity risk, see &#8220;Managing Global Risk&#8212;Operational Risk&#8212;Cybersecurity Risk&#8221; below. </span></div><div style="text-indent:18pt"><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">Changes in or Incorrect Accounting Assumptions, Judgments or Estimates, or the Application of Certain Accounting Principles, Could Result in Significant Losses or Other Adverse Impacts.</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">U.S. GAAP requires Citi to use certain assumptions, judgments and estimates in preparing its financial statements, including, among other items, the estimate of the ACL; reserves related to litigation, regulatory and tax matters; valuation of DTAs; the fair values of certain assets and liabilities; and the assessment of goodwill and other assets for impairment. These assumptions, judgments and estimates are inherently limited because they involve techniques, including the use of historical data, that cannot anticipate or model every economic and financial outcome in the markets in which Citi operates, nor can they anticipate the specific impact and timing of such outcomes. For example, many models used by Citi include assumptions about correlation or lack thereof among prices of various asset classes or other market indicators that may not hold in times of market stress, limited liquidity or other unforeseen circumstances. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">If Citi&#8217;s assumptions, judgments or estimates underlying its financial statements are incorrect or differ from actual or subsequent events, Citi could experience unexpected losses or other adverse impacts, some of which could be significant. Citi could also experience declines in its stock price, be subject to legal and regulatory proceedings and incur fines and other losses. For additional information on the key areas for which assumptions and estimates are used in preparing Citi&#8217;s financial statements, see &#8220;Significant Accounting Policies and Significant Estimates&#8221; below and Notes 1 and 16. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">For example, the CECL methodology requires that Citi provide reserves for a current estimate of lifetime expected credit losses for its loan portfolios and other financial assets at the time those assets are originated or acquired. This estimate is adjusted each period for changes in expected lifetime credit losses. Citi&#8217;s ACL estimate is subject to judgments and depends upon its CECL models and assumptions, including forecasted macroeconomic conditions, which can be more </span></div></div><div style="display:inline-block;max-width:6.666%;min-width:5.666%;vertical-align:top"></div><div style="display:inline-block;vertical-align:top;width:46.668%"><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">challenging to forecast during times of significant market volatility and uncertainty. These model assumptions and forecasted macroeconomic conditions will change over time, resulting in variability in Citi&#8217;s ACL and, thus, impact its results of operations and financial condition, as well as regulatory capital (see the capital return risk factor above). For additional information on Citi&#8217;s ACL, see &#8220;Significant Accounting Policies and Significant Estimates&#8221; below and Notes 1 (&#8220;Allowance for Credit Losses (ACL)&#8221;) and 16.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Moreover, Citi has incurred losses related to its foreign operations that are reported in the CTA components of </span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:400;line-height:120%">Accumulated other comprehensive income (loss) (AOCI)</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">. In accordance with U.S. GAAP, a sale or other deconsolidation event of any foreign operation that results in a substantially complete liquidation of an investment in a foreign entity, such as those related to Citi&#8217;s remaining divestitures or legacy businesses, would result in reclassification of any CTA component of </span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:400;line-height:120%">AOCI </span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">related to that entity, including amounts associated with related hedges and taxes, into Citi&#8217;s earnings. For example, during the quarter in which a deconsolidation of Banamex occurs, Citi would incur a CTA loss of approximately ($9) billion, attributable to Banamex and its consolidated subsidiaries as of December 31, 2025, recognized through earnings, although the cumulative impact of the CTA would be regulatory capital neutral (for additional information, see &#8220;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:400;line-height:120%">All Other</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8221; above). For additional information on Citi&#8217;s accounting policy for foreign currency translation and its foreign CTA components of </span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:400;line-height:120%">AOCI</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">, see Notes 1 (&#8220;Foreign Currency Translation&#8221;) and 21. </span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">Changes to Financial Accounting and Reporting Standards or Interpretations Could Have a Material Impact on How Citi Records and Reports Its Financial Condition and Results of Operations.</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Changes to financial accounting or reporting standards or interpretations, whether promulgated or required by the Financial Accounting Standards Board (FASB), the SEC, U.S. banking regulators or others, could present operational challenges and could require Citi to change certain of the assumptions or estimates it previously used in preparing its financial statements, which could negatively impact how it records and reports its financial condition and results of operations generally and/or with respect to particular businesses. For example, the FASB issues financial accounting and reporting standards that govern key aspects of Citi&#8217;s financial statements or interpretations thereof when those standards become effective, including those areas where Citi is required to make assumptions or estimates. See &#8220;Significant Accounting Policies and Significant Estimates&#8221; below and Note 1 for additional information on Citi&#8217;s accounting policies (&#8220;Summary of Significant Accounting Policies&#8221;) and changes in accounting (&#8220;Accounting Changes&#8221;), including the expected impacts on Citi&#8217;s results of operations and financial condition.</span></div><div><span><br/></span></div><div><span><br/></span></div></div></div><div style="height:36pt;position:relative;width:100%"><div style="bottom:0;position:absolute;width:100%"><div style="text-align:center"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">57 </span></div></div></div><hr style="page-break-after:always"/><div style="min-height:36pt;width:100%"><div><span><br/></span></div></div><div style="width:100.000%"><div style="display:inline-block;vertical-align:top;width:46.666%"><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">If Citi&#8217;s Risk Management and Other Processes or Strategies Are Deficient or Ineffective, Citi May Incur Significant Losses and Its Regulatory Capital and Capital Ratios Could Be Negatively Impacted.</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi utilizes a broad and diversified set of risk management and other processes and strategies, including the use of models, in analyzing and monitoring the various risks Citi assumes in conducting its activities. Citi also relies on data to assess and manage various risk exposures. Unexpected losses can result from untimely, inaccurate or incomplete risk management processes and data. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">In addition, Citi&#8217;s risk management and other processes and strategies, including models, are inherently limited because they involve techniques, including the use of historical data in many circumstances, assumptions and judgments that cannot anticipate every economic and financial outcome in the markets in which Citi operates, particularly given various macroeconomic, geopolitical and other challenges and uncertainties (see the macroeconomic challenges and uncertainties risk factor above), nor can they anticipate the specifics and timing of such outcomes. For example, many models used by Citi include assumptions about correlation or lack thereof among prices of various asset classes or other market indicators that may not necessarily hold in times of market stress, limited liquidity or other unforeseen circumstances, or identify changes in markets or client behaviors not yet inherent in historical data. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi could incur significant losses, receive negative regulatory evaluation or examination findings or be subject to additional enforcement actions, and its regulatory capital, capital ratios and ability to return capital could be negatively impacted, if Citi&#8217;s risk management and other processes, including its ability to manage and aggregate data in a timely and accurate manner, strategies or models are deficient or ineffective (for additional information, see the capital return risk factor above and the regulatory scrutiny and changes and the legal and regulatory proceedings risk factors below). Such deficiencies or ineffectiveness could also result in inaccurate financial, regulatory or risk reporting.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Moreover, Citi&#8217;s Basel III regulatory capital models, including its credit, market and operational risk models, are subject to ongoing regulatory review and approval, which may result in refinements, modifications or enhancements (required or otherwise) to these models. Modifications or requirements resulting from these ongoing reviews, as well as any future changes or guidance provided by the U.S. banking regulators regarding the U.S. regulatory capital framework applicable to Citi, including, but not limited to, potential revisions to the U.S. Basel III rules (see the capital return risk factor and &#8220;Capital Resources&#8212;Regulatory Capital Standards and Developments&#8221; above), have resulted, and could continue to result, in significant changes to Citi&#8217;s risk-weighted assets. These changes can impact Citi&#8217;s capital ratios and its ability to meet its regulatory capital requirements. </span></div><div><span><br/></span></div><div><span><br/></span></div></div><div style="display:inline-block;max-width:6.666%;min-width:5.666%;vertical-align:top"></div><div style="display:inline-block;vertical-align:top;width:46.668%"><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:700;line-height:120%">CREDIT RISKS</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">Credit Risk and Concentrations of Risk Can Increase the Potential for Citi to Incur Significant Losses.</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi has credit exposures to consumer, corporate and public sector borrowers and other counterparties in the U.S. and various countries and jurisdictions globally, including:</span></div><div><span><br/></span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">end-of-period consumer loans of $409 billion</span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">end-of-period corporate loans of $344 billion at December 31, 2025</span></div><div style="text-indent:18pt"><span><br/></span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">A default by or a significant downgrade in the credit ratings of a consumer or corporate borrower or other counterparty, or a decline in the credit quality or value of any underlying collateral, exposes Citi to credit risk. Additionally, despite Citi&#8217;s target client strategy, various macroeconomic, geopolitical, market and other factors, among other things, can increase Citi&#8217;s consumer and corporate credit risk and credit costs, particularly for vulnerable sectors, industries or countries (see the macroeconomic challenges and uncertainties and co-branding and private label credit cards risk factors above and the emerging markets risk factor below). For example, a weakening of economic conditions, including increases in unemployment rates, can adversely affect borrowers&#8217; ability to repay their obligations, as well as result in Citi&#8217;s inability to liquidate the collateral it holds or forced to liquidate the collateral at prices that do not cover the full amount owed to Citi. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">For additional information on Citi&#8217;s corporate and consumer loan portfolios, see &#8220;Managing Global Risk&#8212;Corporate Credit&#8221; and &#8220;&#8212;Consumer Credit&#8221; below. For information on Citi&#8217;s credit and country risk, see also each respective business&#8217;s results of operations above and</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8220;Managing Global Risk&#8212;Other Risks&#8212;Country Risk&#8221; below</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">and Notes 15 and 16.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi is also a member of various central clearing counterparties and could incur financial losses as a result of defaults by other clearing members due to the requirements of clearing members to share losses. Additionally, systemic risks, including from leveraged finance, non-bank financial institutions, private credit and AI, could increase Citi&#8217;s credit costs.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">While Citi provides reserves for expected losses for its credit exposures, as applicable, such reserves are subject to judgments and estimates that could be incorrect or differ from actual future events. For additional information, including on the CECL methodology, see the changes in or incorrect assumptions risk factor above. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Concentrations and/or high correlation of risk to clients or counterparties engaged in the same or related industries or doing business in a particular geography, or to a particular product or asset class, especially credit and market risks, can also increase Citi&#8217;s risk of significant losses. For example, due to the interconnectedness among financial institutions, concerns about the creditworthiness of or defaults by a financial institution could spread to other financial market participants and result in market-wide losses and disruption. Citi also routinely executes a high volume of securities, trading, derivative and foreign exchange transactions with </span></div></div></div><div style="height:36pt;position:relative;width:100%"><div style="bottom:0;position:absolute;width:100%"><div style="text-align:center"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">58 </span></div></div></div><hr style="page-break-after:always"/><div style="min-height:36pt;width:100%"><div><span><br/></span></div></div><div style="width:100.000%"><div style="display:inline-block;vertical-align:top;width:46.666%"><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">non-U.S. sovereigns and with counterparties in the financial services industry, including banks, insurance companies, investment banks, governments, central banks and other financial institutions. Moreover, Citi has indemnification obligations in connection with various transactions that expose it to concentrations of risk, including credit risk from hedging or reinsurance arrangements related to those obligations (see Note 28). A rapid deterioration of a large borrower or other counterparty or within a sector or country in which Citi has large exposures or indemnifications or unexpected market dislocations could lead to concerns about the creditworthiness of other borrowers or counterparties in a certain geography and in related or dependent industries, and such conditions could cause Citi to incur significant losses.</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:700;line-height:120%">LIQUIDITY RISKS</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">Citi&#8217;s Businesses, Results of Operations and Financial Condition Could Be Negatively Impacted if It Does Not Effectively Manage Its Liquidity. </span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">As a large, global financial institution, adequate liquidity and sources of funding are essential to Citi. Citi&#8217;s liquidity, sources of funding and costs of funding can be significantly and negatively impacted by factors it cannot control, such as general disruptions in the financial markets; changes in fiscal and monetary policies; regulatory requirements, including changes in regulations; negative investor or counterparty perceptions of Citi&#8217;s creditworthiness; deposit outflows or unfavorable changes in deposit mix; unexpected increases in cash or collateral requirements; credit ratings; and the consequent inability to monetize available liquidity resources. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Additionally, Citi competes with other banks and non-bank financial institutions for both institutional and consumer deposits, which represent Citi&#8217;s most stable and lowest cost source of long-term funding. The competition for deposits has continued to increase in recent years, including as a result of fixed income alternatives for customer funds.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi&#8217;s costs to obtain and access wholesale funding are directly related to changes in interest and currency exchange rates and its credit spreads. Changes in Citi&#8217;s credit spreads are driven by both external market factors and factors specific to Citi, such as negative views by investors of the financial services industry or Citi&#8217;s financial prospects, and can be highly volatile. For additional information on Citi&#8217;s primary sources of funding, see &#8220;Managing Global Risk&#8212;Liquidity Risk&#8221; below. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi&#8217;s ability to obtain funding may be impaired and its cost of funding could also increase if other market participants are seeking to access the markets at the same time or to a greater extent than expected, or if market appetite for corporate debt securities declines, as is likely to occur in a liquidity stress event or other market crisis. In such circumstances, Citi&#8217;s ability to sell assets may also be impaired if other market participants are seeking to sell similar assets at the same time or a liquid market does not exist for such assets. Additionally, unexpected changes in client needs due to idiosyncratic events or market conditions could result in greater than expected drawdowns from off-balance sheet committed facilities. A sudden drop in market liquidity could also cause a temporary or protracted dislocation of capital </span></div></div><div style="display:inline-block;max-width:6.666%;min-width:5.666%;vertical-align:top"></div><div style="display:inline-block;vertical-align:top;width:46.668%"><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">markets activity. In addition, clearing organizations, central banks, clients and financial institutions with which Citi interacts may exercise the right to require additional collateral during challenging market conditions, which could further impair Citi&#8217;s liquidity. If Citi fails to effectively manage its liquidity, its businesses, results of operations and financial condition could be negatively impacted.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Limitations on the payments that Citigroup Inc. receives from its subsidiaries could also impact its liquidity. As a holding company, Citigroup Inc. relies on interest, dividends, distributions and other payments from its subsidiaries to fund dividends as well as to satisfy its debt and other obligations. Several of Citi&#8217;s U.S. and non-U.S. subsidiaries are or may be subject to capital adequacy or other liquidity, regulatory or contractual restrictions on their ability to provide such payments, including any local regulatory stress test requirements and inter-affiliate arrangements entered into in connection with Citigroup Inc.&#8217;s resolution plan. Citigroup Inc.&#8217;s broker-dealer and bank subsidiaries are subject to restrictions on their ability to lend or transact with affiliates, as well as restrictions on their ability to use funds deposited with them in brokerage or bank accounts to fund their businesses. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">A bank holding company is also required by law to act as a source of financial and managerial strength for its subsidiary banks. As a result, the FRB may require Citigroup Inc. to commit resources to its subsidiary banks even if doing so is not otherwise in the interests of Citigroup Inc. or its shareholders or creditors, reducing the amount of funds available to meet its obligations.</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">A Ratings Downgrade Could Adversely Impact Citi&#8217;s Funding and Liquidity.</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">The credit rating agencies, such as Fitch Ratings, Moody&#8217;s Ratings and S&amp;P Global Ratings, continuously evaluate Citi and certain of its subsidiaries. Their ratings of Citi and its rated subsidiaries&#8217; long-term debt and short-term obligations are based on firm-specific factors, including the financial strength of Citi and such subsidiaries, as well as factors that are not entirely within the control of Citi and its subsidiaries, such as the agencies&#8217; proprietary rating methodologies and assumptions, potential impact from negative actions on U.S. sovereign ratings and conditions affecting the financial services industry and markets generally.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">A ratings downgrade could result from, among other factors, declines in profitability, reductions in regulatory capitalization levels, deterioration in Citi&#8217;s funding structure or liquidity, significant increases in risk appetite, delays or missteps in Citi&#8217;s transformation efforts, public statements by Citi&#8217;s management or regulators or control failures. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">A ratings downgrade could negatively impact Citi and its rated subsidiaries&#8217; ability to access the capital markets and other sources of funds as well as increase credit spreads and the costs of those funds. A ratings downgrade could also have a negative impact on Citi and its rated subsidiaries&#8217; ability to obtain funding and liquidity due to reduced funding capacity and the impact from derivative triggers, which could require Citi and its rated subsidiaries to meet cash obligations and collateral requirements or permit counterparties to terminate certain contracts. In addition, a ratings downgrade could have a negative impact on other funding sources such as secured </span></div></div></div><div style="height:36pt;position:relative;width:100%"><div style="bottom:0;position:absolute;width:100%"><div style="text-align:center"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">59 </span></div></div></div><hr style="page-break-after:always"/><div style="min-height:36pt;width:100%"><div><span><br/></span></div></div><div style="width:100.000%"><div style="display:inline-block;vertical-align:top;width:46.666%"><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">financing and other margined transactions for which there may be no explicit triggers. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Furthermore, a credit ratings downgrade could have impacts that may not be currently known to Citi or are not possible to quantify. Some of Citi&#8217;s counterparties and clients could have ratings limitations on their permissible counterparties, of which Citi may or may not be aware. Certain of Citi&#8217;s corporate customers and trading counterparties, among other clients, could re-evaluate their business relationships with Citi and limit the trading of certain market instruments, and limit or withdraw deposits placed with Citi in response to ratings downgrades. Changes in customer and counterparty behavior could impact not only Citi&#8217;s funding and liquidity but also the results of operations of certain Citi businesses. For additional information on the potential impact of a reduction in Citi&#8217;s or Citibank&#8217;s credit ratings, see &#8220;Managing Global Risk&#8212;Liquidity Risk&#8212;Potential Impacts of Ratings Downgrades&#8221; below.</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:700;line-height:120%">COMPLIANCE RISKS</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">Regulatory Expectations and Scrutiny in the U.S. and Globally as well as Ongoing Interpretation and Implementation of Regulatory and Legislative Requirements and Changes Subject Citi to Significant Compliance, Regulatory and Other Risks and Costs.</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Large financial institutions, such as Citi, face significant regulatory and supervisory expectations and scrutiny in the U.S. and globally, including with respect to, among other things, infrastructure, data and risk management practices and controls. These regulatory and supervisory expectations extend to employees and agents and also include, among other things, those related to anti-money laundering; increasingly complex sanctions regimes; customer and client protection; market practices; and various disclosure and regulatory reporting requirements. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi is also continually required to interpret and implement extensive and frequently changing regulatory and legislative requirements within the U.S. and in other jurisdictions in which it does business, which may overlap or conflict across jurisdictions, resulting in substantial compliance, regulatory and other risks and costs. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">A failure to comply with regulatory requirements or expectations, even if inadvertent, or resolve any identified deficiencies in a timely and sufficiently satisfactory manner to regulators, could result in increased regulatory oversight; material restrictions, including, among others, imposition of additional capital buffers and limitations on capital distributions; enforcement proceedings; penalties; and fines (see the capital return risk factor above and legal and regulatory proceedings risk factor below). </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Moreover, over the past several years, Citi has been required to implement a large number of regulatory, supervisory and legislative changes, including new regulatory, supervisory or legislative requirements or regimes, across its businesses and functions, and these changes continue. The changes themselves may be complex and subject to interpretation, and result in changes to Citi&#8217;s businesses. In addition, the changes require continued substantial technology and other investments. In some cases, Citi&#8217;s implementation of </span></div></div><div style="display:inline-block;max-width:6.666%;min-width:5.666%;vertical-align:top"></div><div style="display:inline-block;vertical-align:top;width:46.668%"><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">a regulatory or legislative requirement is occurring simultaneously with changing or conflicting regulatory guidance from multiple jurisdictions (including various U.S. states) and regulators, legal challenges or legislative action to modify or repeal existing rules or enact new rules. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Examples of regulatory or legislative changes that have resulted in increased compliance risks and costs include (i) the U.S. regulatory capital framework and requirements, which have continued to evolve (see the capital return risk factor and &#8220;Capital Resources&#8221; above); and (ii) various laws relating to the limitation of cross-border data movement and/or collection and use of customer information, including data localization and protection and privacy laws, which also can conflict with or increase compliance complexity with respect to other laws, including anti-money laundering laws. </span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">Citi Is Subject to Extensive Legal and Regulatory Proceedings, Examinations, Investigations, Consent Orders and Related Compliance Efforts and Other Inquiries That Have in the Past and Could in the Future Result in Large Monetary Penalties, Supervisory or Enforcement Orders, Business Restrictions, Limitations on Dividends, Changes to Directors and/or Officers and Collateral Consequences Arising from Such Outcomes.</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi&#8217;s regulators have broad powers and discretion under their prudential and supervisory authority, and have pursued active inspection and investigatory oversight. At any given time, Citi is a party to a significant number of legal and regulatory proceedings and is subject to numerous governmental and regulatory examinations. Additionally, Citi remains subject to governmental and regulatory investigations, consent orders (see discussion below) and related compliance efforts, and other inquiries. Citi could also be subject to enforcement proceedings and negative regulatory evaluation or examination findings not only because of violations of laws and regulations, but also due to failures, as determined by its regulators, to remedy deficiencies on a timely basis (see also the capital return and resolution plan risk factors above). Under U.S. banking law, Citi is prohibited from disclosing confidential supervisory information, and may therefore be unable to disclose even potentially material regulatory or supervisory matters. Citi could face further scrutiny and consequences from regulators for failing to timely resolve open regulatory issues or having repeat regulatory issues. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">As previously disclosed, the 2020 FRB Consent Order and the 2020 OCC Consent Order require Citigroup and Citibank, respectively, to implement extensive targeted action plans and submit quarterly progress reports on a timely and sufficient basis detailing the results and status of improvements relating principally to various aspects of enterprise-wide risk management, compliance, data quality management related to governance, and internal controls. These improvements will require continued significant investments by Citi during 2026 and beyond, as an essential part of Citi&#8217;s broader transformation efforts (see the simplification, transformation and enhanced business performance priorities risk factor above). Further, in 2024, the FRB entered into a Civil Money Penalty Consent Order with Citigroup, and the OCC entered into a Civil Money Penalty Consent Order with Citibank. The FRB found that Citigroup </span></div></div></div><div style="height:36pt;position:relative;width:100%"><div style="bottom:0;position:absolute;width:100%"><div style="text-align:center"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">60 </span></div></div></div><hr style="page-break-after:always"/><div style="min-height:36pt;width:100%"><div><span><br/></span></div></div><div style="width:100.000%"><div style="display:inline-block;vertical-align:top;width:46.666%"><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">had ongoing deficiencies related to its data quality management program and had inadequate measures for managing and controlling its data quality risks. The OCC found that Citibank had failed to make sufficient and sustainable progress toward achieving compliance with its 2020 Consent Order. </span><span style="background-color:#ffffff;color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">There can be no assurance that </span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">efforts by Citi to address the deficiencies and resolve the OCC and FRB Consent Orders will occur in a manner satisfactory, in both timing and sufficiency, to the FRB and OCC. (For additional information, see &#8220;Citi&#8217;s Multiyear Transformation&#8221; above.)</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Although there are no restrictions on Citi&#8217;s ability to serve its clients, the OCC Consent Order requires Citibank to obtain prior approval of any significant new acquisition, including any portfolio or business acquisition, excluding ordinary course transactions.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Moreover, the OCC Consent Order provides that the OCC has the right to assess future civil money penalties or take other supervisory and/or enforcement actions. Such actions by the OCC could include imposing business restrictions, including possible additional limitations on the declaration or payment of dividends by Citibank and changes in directors and/or senior executive officers. More generally, the OCC and/or the FRB could again take enforcement or other actions if the regulatory agency believes that Citi has not met regulatory expectations regarding compliance with the consent orders. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Large financial institutions face a challenging global judicial, regulatory and political environment. The complexity of the federal and state regulatory and enforcement regimes in the U.S., coupled with the global scope of Citi&#8217;s operations, also means that a single event or issue may give rise to a large number of overlapping investigations and regulatory proceedings, either by multiple federal and state agencies and authorities in the U.S. or by multiple regulators and other governmental entities in foreign jurisdictions, as well as multiple civil litigation claims in multiple jurisdictions. Violations of law by other financial institutions may also result in regulatory scrutiny of Citi. Responding to regulatory inquiries and proceedings can be time consuming and costly, and divert management attention from Citi&#8217;s businesses. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">U.S. and non-U.S. regulators have focused on the culture of financial services firms, including Citi, as well as &#8220;conduct risk,&#8221; a term used to describe the risks associated with behavior by employees and agents, including third parties, that could harm clients, customers, employees or the integrity of the markets, such as improperly creating, selling, marketing or managing products and services, failures to safeguard a party&#8217;s personal information or failures to identify and manage conflicts of interest.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Scrutiny and expectations from regulators could lead to investigations and other inquiries, as well as remediation requirements, regulatory restrictions, structural changes, more regulatory or other enforcement proceedings, civil litigation and higher compliance and other risks and costs. For additional information, see the capital return and regulatory scrutiny and changes risk factors above. Further, while Citi takes numerous steps to prevent and detect conduct by employees and agents that could potentially harm clients, customers, employees or the integrity of the markets, such behavior may not always be deterred or prevented. </span></div></div><div style="display:inline-block;max-width:6.666%;min-width:5.666%;vertical-align:top"></div><div style="display:inline-block;vertical-align:top;width:46.668%"><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Moreover, the severity of the remedies sought in legal and regulatory proceedings to which Citi is subject has remained elevated. Citi may be required to accept or be subject to remedies, consent orders, sanctions, substantial fines and penalties, remediation and other financial costs or other requirements in the future, including for matters or practices not yet known to Citi, any of which could materially and negatively affect Citi&#8217;s businesses, business practices, financial condition or results of operations, require material changes in Citi&#8217;s operations or cause Citi substantial reputational harm. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Additionally, many large claims&#8212;both private civil and regulatory&#8212;asserted against Citi are highly complex, slow to develop and may involve novel or untested legal theories. The outcome of such proceedings is difficult to predict or estimate until late in the proceedings. Although Citi establishes accruals for its legal and regulatory matters according to accounting requirements, Citi&#8217;s estimates of, and changes to, these accruals involve significant judgment and may be subject to significant uncertainty, and the amount of loss ultimately incurred in relation to those matters may be substantially higher than the amounts accrued (see the changes in or incorrect assumptions risk factor above). In addition, certain settlements are subject to court approval and may not be approved. Furthermore, regulators may be more likely to pursue investigations or proceedings against financial institutions, such as Citi, that have previously been the subject of other regulatory actions.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">For further information on Citi&#8217;s legal and regulatory proceedings, see Note 30.</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:700;line-height:120%">OTHER RISKS</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-style:italic;font-weight:700;line-height:120%">Citi&#8217;s Emerging Markets Presence Subjects It to Various Risks as well as Increased Compliance and Regulatory Risks and Costs.</span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">During 2025, emerging markets revenues accounted for approximately 25% of Citi&#8217;s total revenues. Citi&#8217;s presence in the emerging markets subjects it to various risks.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi&#8217;s emerging markets risks include, among others, limitations or unavailability of hedges on foreign investments; foreign currency volatility, including devaluations; central bank interest rate and other monetary policies; macroeconomic, geopolitical and domestic political challenges, uncertainties and volatilities; foreign exchange controls, including an inability to access indirect foreign exchange mechanisms; cyberattacks; restrictions arising from retaliatory laws and regulations; sanctions or asset freezes; sovereign debt volatility; fluctuations in commodity prices; limitations on foreign investment; sociopolitical instability; nationalization or loss of licenses; potential criminal charges; closure of branches or subsidiaries; and confiscation of assets; and these risks can be exacerbated in the event of a deterioration in the relationship between the U.S. and an emerging market country. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">For example, Citi operates in several countries that have strict capital controls, currency controls and/or sanctions that limit its ability to convert local currency into U.S. dollars and/or transfer funds outside of those countries. As a result, Citi might need to record additional translation losses due to these </span></div></div></div><div style="height:36pt;position:relative;width:100%"><div style="bottom:0;position:absolute;width:100%"><div style="text-align:center"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">61 </span></div></div></div><hr style="page-break-after:always"/><div style="min-height:36pt;width:100%"><div><span><br/></span></div></div><div style="width:100.000%"><div style="display:inline-block;vertical-align:top;width:46.666%"><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">or other currency controls. Moreover, Citi could be required to adjust its reserves for expected losses for its credit exposures based on the transfer risk associated with exposures outside the U.S., driven by safety and soundness considerations under U.S. banking law (see &#8220;Significant Accounting Policies and Significant Estimates&#8221; below and Note 1).</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Moreover, the Russia&#8211;Ukraine war could have further negative impacts on macroeconomic conditions, financial markets and commodities prices, adversely impacting Citi and its customers, clients or employees. For additional information about these Russia-related risks, see the macroeconomic challenges and uncertainties and cybersecurity risk factors above.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Emerging markets risks may adversely impact Citi&#8217;s businesses, results of operations and financial condition in those countries where Citi operates and have required, and may continue to require, management time and attention and other resources. </span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:2pt;font-weight:400;line-height:120%"> </span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:2pt;font-weight:400;line-height:120%"> </span></div><div id="iffa471fccb154c4395823fdabb3bda1a_142"></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:12pt;font-weight:700;line-height:120%">SUSTAINABILITY</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi and its clients face escalating global environmental and social challenges, including climate change and the energy transition. Citi&#8217;s net zero approach and sustainable finance activity include the Company&#8217;s work to support clients in financing their transition to low-carbon business models, as well as broader energy security priorities, including access to affordable energy in emerging markets. Citi recognizes that energy transition, energy security and economic growth are not mutually exclusive and must be addressed simultaneously. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">The &#8220;Citi Climate Report&#8221; provides additional information on Citi&#8217;s continued progress to manage climate risk and its net zero approach, including information on financed and facilitated emissions and 2030 interim emissions reduction targets. Citi&#8217;s &#8220;Sustainability Report&#8221; provides information on its $1 Trillion Sustainable Finance Goal, including sustainable finance products and services that Citi provides to its clients to support their sustainability objectives. For additional information on Citi&#8217;s environmental and social policies and priorities, click on &#8220;Our Impact&#8221; on Citi&#8217;s website at www.citigroup.com. Climate and sustainability reporting and any other environmental and social governance-related reports and information included elsewhere on Citi&#8217;s website are not incorporated by reference into, and do not form any part of, this Form 10-K. </span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">For information regarding Citi&#8217;s management of climate risk, see &#8220;Managing Global Risk&#8212;Strategic Risk&#8212;Climate Risk&#8221; below.</span></div><div><span><br/></span></div><div><span><br/></span></div></div><div style="display:inline-block;max-width:6.666%;min-width:5.666%;vertical-align:top"></div><div style="display:inline-block;vertical-align:top;width:46.668%"><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:2pt;font-weight:400;line-height:115%"> </span></div><div id="iffa471fccb154c4395823fdabb3bda1a_145"></div></div></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:12pt;font-weight:700;line-height:120%">HUMAN CAPITAL RESOURCES AND MANAGEMENT</span></div><div><span><br/></span></div><div><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">At December 31, 2025, Citi had approximately 226,000 full-time employees, compared to approximately 229,000 at December 31, 2024. Citi has employees in over 90 countries, across all of its segments. Approximately 31% are based in the U.S.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Attracting and retaining highly qualified and motivated employees is a strategic priority. Citi seeks to enhance the competitive strength of its workforce through:</span></div><div><span><br/></span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">continuously innovating its efforts to recruit, train, develop, compensate, promote and engage employees</span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#242424;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">actively seeking and listening to diverse perspectives at all levels of the organization</span></div><div style="padding-left:18pt;text-indent:-18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">&#8226;</span><span style="color:#242424;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%;padding-left:14.5pt">providing compensation programs that are competitive in the market and aligned to strategic objectives</span></div><div><span><br/></span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi values pay transparency and has introduced market-based salary structures and bonus opportunity guidelines in various countries worldwide, and posts salary ranges on all external U.S. job postings, which align with Citi&#8217;s commitment to pay equity and transparency. In addition, Citi has focused on measuring and addressing pay equity within the organization. Citi&#8217;s annual pay equity analysis for 2025 determined that on an adjusted basis, global gender and U.S. racial base pay gaps are in each case less than 1%. The raw pay gap analysis determined that the median base pay for women globally is 81% of the median for men globally and the U.S. racial base pay gap is less than 1%. The adjusted pay gap is a true measure of pay equity, or &#8220;like for like,&#8221; that compares the compensation of women to men and U.S. minorities to non-minorities when adjusting for factors such as job function, title/level and geography.</span></div><div style="text-indent:18pt"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">Citi employs numerous initiatives in managing its workforce to drive a culture of excellence and accountability, reinforce its values, encourage career growth, foster pay transparency and equity and provide a wide range of benefits that support its employees&#8217; mental, social, physical and financial well-being.</span></div><div><span><br/></span></div><div><span><br/></span></div><div style="height:36pt;position:relative;width:100%"><div style="bottom:0;position:absolute;width:100%"><div style="text-align:center"><span style="color:#000000;font-family:'Times New Roman',serif;font-size:10pt;font-weight:400;line-height:120%">62 </span></div></div></div><div id="iffa471fccb154c4395823fdabb3bda1a_148"></div><hr style="page-break-after:always"/>