Citigroup Inc. · Risk factors

Prior heading: Macroeconomic, Geopolitical and Other Challenges and Uncertainties Could Continue to Have a Negative Impact on Citi.

Citi has experienced, and could experience in the future, negative impacts to its businesses, results of operations and financial condition as a result of various macroeconomic, geopolitical and other challenges, uncertainties and volatility. These include, among other things, significantly elevated levels of inflation, higher interest rates, global supply shocks government fiscal and lower economic growth monetary actions or expected actions, including continued high interest rates, as well as an increasing risk of recession reductions in Europe, central bank balance sheets, or other restrictive interest rate or other monetary policies; potential recessions in the U.S. U.S., Europe and other countries. regions or countries; and elevated levels of inflation. For example, in 2022, 2023, the U.S., the U.K., the EU and other economies experienced significantly higher continued to experience elevated levels of widespread inflation. As a result, the Federal Reserve Board (FRB) and other central banks have substantially raised interest rates, reduced the size of their balance sheets and taken took other actions in an aggressive effort to curb inflation. These actions are expected may continue to adversely impact certain sectors sensitive to interest rates and consumer discretionary spending. They may also slow economic growth, increase the risk of recession and increase the unemployment rate in the U.S. and other countries, all of which would likely adversely affect Citi’s consumer and institutional clients, businesses and results of operations. Elevated levels of In addition, inflation are also expected to may continue to result in higher labor and other costs, thus putting further pressure on Citi’s expenses. expenses. More recently, the FRB has signaled that it expects to reduce the benchmark U.S. interest rate in 2024. If the FRB were to reduce interest rates prematurely, inflation could resurge. Interest rates on loans Citi makes are typically based off or set at a spread over a benchmark interest rate and would likely decline or rise as benchmark rates decline or rise, respectively. While Citi expects its For example, while a decline in interest rates would generally be expected to result in lower overall net interest income income, it could improve Citi’s funding costs. Although higher interest rates would generally increase due be expected to higher increase overall net interest rates, income, higher rates could adversely affect its funding costs, levels of deposits in its consumer and institutional businesses and certain business or product revenues. In addition, Citi’s net interest income could be adversely affected due to a flattening (a lower spread between shorter-term versus longer-term interest rates) or longer lasting or more severe inversion (shorter-term interest rates exceeding longer-term interest rates) of the interest rate yield curve, as Citi, similar to other banks, Citi typically pays interest on deposits based on shorter-term interest rates and earns money on loans based on longer-term interest rates. For additional information on Citi’s interest rate risk, see “Managing Global Risk—Market Risk—Banking Book Interest Rate Risk” below. Additionally, Citi’s balance sheet includes interest-rate sensitive fixed-rate assets such as U.S. Treasuries, U.S. agency securities and residential mortgages, among others, whose valuation would be adversely impacted in a rising-rate higher-rate environment and/or whose hedging costs may increase. Additional areas of uncertainty include, among others, geopolitical challenges, tensions and conflicts, including those related to Russia’s war in Ukraine (see discussion below), as well as a persistent and/or escalating conflict in the Middle East, particularly if the conflict were to widen to involve additional combatants, countries or regions; economic and other geopolitical challenges related to China, including weak economic growth, related policy actions, challenges in the Chinese real estate sector, banking and credit markets, and tensions or conflicts between China and Taiwan and/or China and the U.S.; significant disruptions and volatility in financial markets, including foreign currency volatility and devaluations and continued strength in the U.S. dollar; protracted or widespread trade tensions; natural disasters; new pandemics, including new COVID-19 variants; and political polarization, election outcomes and the effects of divided government, such as with respect to any extended government shutdown in the U.S. For example, Citi’s market-making businesses can suffer losses resulting from the widening of credit spreads due to unanticipated changes in financial markets. Moreover, adverse developments or downturns in one or more of the world’s larger economies would likely have a significant impact on the global economy or the economies of other countries because of global financial and economic linkages. Russia’s war in Ukraine has caused supply shocks in energy, food and other commodities markets, worsened inflation, increased cybersecurity risks, increased the risk of recession in Europe and heightened geopolitical tensions. Actions by Russia, and any further measures taken by the U.S. or its allies, could continue to have negative impacts on regional and global energy and other commodities and financial markets and macroeconomic conditions, adversely impacting jurisdictions where Citi operates and Citi’s has customers, clients and employees. Citi’s ability to continue to reduce its operations and exposure in Russia, including completion of the wind-down of its consumer and local commercial banking operations and nearly all of its institutional banking services in the country, may be negatively impacted by macroeconomic challenges and uncertainties, local market conditions, and sanctions and other governmental regulations or actions. Moreover, employees. Citi’s remaining operations in Russia subject Citi to various other risks, among which are foreign currency volatility, including appreciations or devaluations; restrictions arising from retaliatory Russian laws and regulations on the conduct of its business, remaining businesses, including, without limitation, its provision to its customers of certain securities services; sanctions or asset freezes; and other deconsolidation events. Examples of triggers that may result in deconsolidation of Citi’s subsidiary bank in Russia, AO Citibank, include voluntary or forced sale of ownership or loss of control due to actions of relevant governmental authorities, including expropriation (i.e., the entity becomes subject to the complete control of a government, court, administrator, trustee or regulator); revocation of banking license; and loss of ability to elect a board of directors or appoint members of senior management. In the event of a loss of control of AO Citibank, Citi would be required to write off its net investment in the entity, recognize a CTA loss through earnings and recognize a loss on intercompany liabilities owed by AO Citibank to other Citi entities outside of Russia. In the sole event of a substantial liquidation, as opposed to a loss of control, Citi would be required to recognize the CTA loss through earnings and would evaluate its remaining net investment as circumstances evolve. Additionally, Citi may incur reputational harm if its actions are perceived to be misaligned with Citi’s announced reductions of its operations and exposure in Russia. For additional information about these risks, see the operational processes and systems, cybersecurity and emerging markets risk factors and “Managing Global Risk—Other Risks—Country Risk—Russia” below. COVID-19 is expected to continue to adversely affect global health and could negatively impact macroeconomic conditions in 2023. The extent of the impact remains uncertain and will largely depend on future developments in China, the U.S. and other countries, such as the severity and duration of the public health consequences, including the course of variants; the public response; and government actions. COVID-19 could again disrupt supply chains, worsen inflation and reduce economic activity. These factors could adversely impact Citi’s businesses and results of operations and financial condition. Additional areas of uncertainty include, among others, economic and geopolitical challenges related to China, including related policy actions, distress in Chinese real estate finance and other credit markets, tensions or conflicts between China and Taiwan and/or between China and the U.S.; significant disruptions and volatility in financial markets, including foreign currency volatility and devaluations and continued strength in the U.S. dollar; other geopolitical tensions and conflicts; protracted or widespread trade tensions; financial market, other economic and political disruption driven by populist movements and governments; natural disasters; other pandemics; and election outcomes, including the effects of divided government in the U.S., such as with respect to raising of the federal debt limit. For example, Citi’s market-making businesses can suffer losses resulting from the widening of credit spreads due to unanticipated changes in financial markets. Moreover, adverse developments or downturns in one or more of the world’s larger economies would likely have a significant impact on the global economy or the economies of other countries because of global financial and economic linkages.below.

Added · Removed · word-level comparison of the two filings

Prior heading: Citi’s Ability to Return Capital to Common Shareholders Substantially Depends on Regulatory Capital Requirements, Including the Results of the CCAR Process and Dodd-Frank Act Regulatory Stress Tests.

Citi’s ability to return capital to its common shareholders consistent with its capital planning efforts and targets, whether through its common stock dividend or through a share repurchase program, substantially depends, among other things, on its regulatory capital requirements, including the annual recalibration of the Stress Capital Buffer (SCB), which is based upon the results of the CCAR process required by the FRB, and recalibration of the GSIB surcharge. surcharge,as well as the supervisory expectations and assessments regarding individual institutions. The FRB’s annual stress testing requirements are integrated into ongoing regulatory capital requirements. Citi’s SCB equals the maximum projected decline in its CET1 Capital ratio under the supervisory severely adverse scenario over a nine-quarter CCAR measurement period, plus four quarters of planned common stock dividends as a percentage of Citi’s risk-weighted assets, subject to a minimum requirement of 2.5%. The SCB is calculated by the FRB using its proprietary data and modeling of each firm’s results. Accordingly, Citi’s SCB may change annually, based on the supervisory stress test results, thus potentially resulting in variability in the calculation of Citi’s required regulatory CET1 Capital ratio under the Standardized Approach. On October 1, 2023, Citi’s required regulatory CET1 Capital ratio increased to 12.3% from 12% under the Standardized Approach, reflecting the increase in the SCB requirement to 4.3% from 4.0%. In addition, a breach of the SCB and other regulatory capital buffers may result in gradual limitations on capital distributions and discretionary bonus payments to executive officers. For additional information on the SCB, see “Capital Resources—Regulatory Capital Buffers” above. Moreover, changes in regulatory capital rules, requirements or interpretations could materially increase Citi’s required regulatory capital. For example, the U.S. banking regulators have proposed a number of changes to the U.S. regulatory capital framework, including, but not limited to, significant revisions to the U.S. Basel III rules, known as the Basel III Endgame (capital proposal); changes to the method for calculating the GSIB surcharge; and changes to aspects of the total loss-absorbing capacity (TLAC) requirements. The capital proposal would replace the Advanced Approaches with a new Expanded Risk-based Approach for calculating risk- weighted assets. Under the capital proposal, a single capital buffer, including the SCB, would apply to a firm’s risk-based capital ratios, regardless of whether the applicable ratios result from the Expanded Risk-based Approach or the Modified Standardized Approach. Additionally, the capital proposal would make various changes to the calculations of credit risk, market risk and operational risk components of risk-weighted assets (see “Capital Resources—Regulatory Capital Standards and Developments” above). All of these potential changes, if adopted as proposed, would likely materially impact Citi’s regulatory capital position and substantially increase Citi’s regulatory capital requirements, and thus adversely impact the extent to which Citi is able to return capital to shareholders. Citi’s ability to return capital also depends on its results of operations and financial condition, including the capital impact related to its remaining divestitures, such as, among other things, any temporary capital impact from CTA losses (net of hedges) between transaction signings and closings and achievement of the expected capital benefits from the divestitures (for additional information, see “Executive Summary” above and (see the continued investments and the incorrect assumptions or estimates risk factor factors below); Citi’s effectiveness in planning, managing and calculating its level of regulatory capital and risk-weighted assets under both the Advanced Approaches and the Standardized Approach, as well as the Supplementary Leverage ratio (SLR) and GSIB surcharge; (SLR); its implementation and maintenance of an effective capital planning process and management framework; forecasts of macroeconomic conditions; and deferred tax asset (DTA) utilization (see the ability to utilize DTA risk factor below). Changes in regulatory below). The FRB could also limit or prohibit capital rules, requirements actions, such as paying or interpretations could continue to have a material impact on Citi’s regulatory capital. For example, on October 1, 2022, Citi’s required regulatory CET1 Capital ratio increased to 11.5% from 10.5% increasing dividends or repurchasing common stock due to an increase in the SCB requirement (see below for information on calculation of the SCB). In addition, on January 1, 2023, Citi’s required regulatory CET1 Capital ratio further increased to 12% from 11.5% under the Standardized Approach, as the current GSIB surcharge increased to 3.5% from 3.0%. Due to these increases as well as macroeconomic uncertainty, Citi paused common share repurchases beginning as of the third quarter disruptions or events, some of 2022. In addition, the U.S. banking agencies are considering which occurred for a number period of changes to the U.S. regulatory capital framework in the future, including, but not limited to, revisions to the U.S. Basel III rules, and potential changes to time during the GSIB surcharge, SLR and discretionary Countercyclical Capital Buffer. All of these potential changes could negatively impact Citi’s regulatory capital position or increase Citi’s regulatory capital requirements. COVID-19 pandemic. All firms subject to CCAR requirements, including Citi, will continue to be subject to a rigorous regulatory evaluation of capital planning practices, practices and other reviews and examinations, including, but not limited to, to data quality, which is a key regulatory focus, governance, risk management, data quality management and internal controls. Citi’s ability to return capital may be adversely impacted if such an evaluation of Citi results in negative findings. The For example, the FRB has stated that it expects capital adequacy practices to continue to evolve and to likely be determined by its yearly cross-firm review of capital plan submissions. Similarly, the FRB has indicated that, as part of its stated goal to continually evolve its annual stress testing requirements, several parameters of the annual stress testing process may continue to be altered, including the number and severity of the stress test scenario, scenarios, the FRB modeling of Citi’s balance sheet, pre-provision net revenue and stress losses, and the addition of components deemed important by the FRB. Additionally, Citi’s ability to return capital may be adversely impacted if a regulatory evaluation or examination results in negative findings regarding absolute capital levels or other aspects of Citi’s operations, including as a result of the imposition of additional capital buffers, limitations on capital distributions or otherwise. For information on limitations on Citi’s ability to return capital to common shareholders, as well as the CCAR process, supervisory stress test requirements and GSIB surcharge, see “Capital Resources—Overview” and “Capital Resources—Stress Testing Component of Capital Planning” above and the risk management risk factor below. Beginning January 1, 2022, Citi was required to phase into regulatory capital, at 25% per year, the changes in retained earnings, DTAs and ACL determined upon the January 1, 2020 CECL adoption date, as well as subsequent changes in the ACL through In December 31, 2021. The 2023, the FRB has stated announced that it plans to will maintain its current framework for calculating allowances on loans in the supervisory stress test through the 2023 supervisory 2024 stress test cycle, while continuing to evaluate appropriate future enhancements to this framework. The impacts on Citi’s capital adequacy of the FRB’s any potential incorporation by the FRB of CECL into its supervisory stress tests on an ongoing basis, in future stress test cycles, and of other potential regulatory changes in the FRB’s stress testing methodologies, remain unclear. For additional information regarding the CECL methodology, including the transition provisions related to the adverse regulatory capital effects resulting from adoption of the CECL methodology, see “Capital Resources—Current Regulatory Capital Standards—Regulatory Capital Treatment—Modified Transition of the Current Expected Credit Losses Methodology” above and Note 1. In addition, the annual stress testing requirements are integrated into ongoing regulatory capital requirements. Citi’s SCB equals the maximum decline in its CET1 Capital ratio under the supervisory severely adverse scenario over a nine-quarter CCAR measurement period, plus four quarters of planned common stock dividends, subject to a minimum requirement of 2.5%. The SCB is calculated by the FRB using its proprietary data and modeling of each firm’s results. Accordingly, Citi’s SCB may change annually, based on the supervisory stress test results, thus potentially resulting in additional volatility in the calculation of Citi’s required regulatory CET1 Capital ratio under the Standardized Approach. Similar to the other regulatory capital buffers, a breach of the SCB may result in graduated limitations on capital distributions. For additional information on the SCB, see “Capital Resources—Regulatory Capital Buffers” above. Although various uncertainties exist regarding the extent of, and the ultimate impact to Citi from, these changes to the FRB’s regulatory capital, results from the FRB’s stress testing and CCAR regimes, and regulatory evaluation or examination findings, these changes could increase the level of capital Citi is required or elects to hold, including as part of Citi’s management buffer, thus potentially adversely impacting the extent to which Citi is able to return capital to shareholders.

Added · Removed · word-level comparison of the two filings

Prior heading: Citi Must Continually Review, Analyze and Successfully Adapt to Ongoing Regulatory and Legislative Uncertainties and Changes in the U.S. and Globally.

Citi, its management and its businesses continue to face ongoing regulatory and legislative uncertainties and changes, both in the U.S. and globally. While the areas of ongoing regulatory and legislative uncertainties and changes facing Citi are too numerous to list completely, examples include, but are not limited to (i) potential fiscal, monetary, tax, sanctions and other changes promulgated by the U.S. federal government and other governments, including as a result of priority shifts depending on individuals, political parties and other groups in governmental positions; (ii) potential changes to various aspects of the U.S. regulatory capital framework and requirements applicable to Citi, including including, among others, significant revisions to the U.S. Basel III rules (see rules, known as the Basel III Endgame (for information about the Basel III Endgame, see the capital return risk factor and “Capital Resources—Regulatory Capital Standards Developments” above); (ii) potential fiscal, monetary, tax, sanctions and other changes promulgated by the U.S. federal government and other governments, including potential changes in regulatory requirements relating to interest rate risk management; and (iii) rapidly evolving legislative and regulatory requirements and other government initiatives in the EU, the U.S. and globally related to climate change and other ESG areas that vary, and may conflict, across jurisdictions, including any new disclosure requirements (see the climate change and heightened regulatory scrutiny and ongoing interpretation of regulatory changes risk factor factors below). References to “regulatory” refer to both formal regulation and the views and expectations of Citi’s regulators in their supervisory roles. roles, which, as they change over time, can have a major impact. In particular, the U.S. regulators have indicated that the level of their expectations is increasing and prompt negative examination findings/ratings and enforcements actions are more likely. For example, in February 2023, the Consumer Financial Protection Bureau (CFPB) proposed significant changes to the maximum amounts on credit card late fees, which, if adopted as proposed, would reduce credit card fee revenues in Branded cards Cards and Retail services Services in PBWM. USPB. In addition, U.S. and international regulatory and legislative initiatives have not always been undertaken or implemented on a coordinated basis, and areas of divergence have developed and continue to develop with respect to their scope, interpretation, timing, structure or approach, leading to inconsistent or even conflicting requirements, including within a single jurisdiction. For example, in 2019, the European Commission adopted, as part of Capital Requirements Directive V (CRD V), a new requirement for major banking groups headquartered outside the EU (which would include Citi) to establish an intermediate EU holding company where the foreign bank has two or more institutions (broadly meaning banks, broker-dealers and similar financial firms) established in the EU. While in some respects the requirement mirrors an existing U.S. requirement for non-U.S. banking organizations to form U.S. intermediate holding companies, the implementation of the EU holding company requirement could lead to additional complexity with respect to Citi’s resolution planning, capital and liquidity allocation and efficiency in various jurisdictions. jurisdiction. Further, ongoing regulatory and legislative uncertainties and changes make Citi’s and its management’s long-term business, balance sheet and strategic budget planning difficult, subject to change and potentially more costly and may impact its results of operations. U.S. and other regulators globally have implemented and continue to discuss various changes to certain regulatory requirements, which would require ongoing assessment by management as to the impact to Citi, its businesses and business planning. For example, while the Basel III regulatory reforms and revised market risk framework have been finalized at the international level, there remain significant uncertainties with respect to the integration of these revisions into the U.S. regulatory capital framework. Business planning is required to must necessarily be based on possible or proposed rules or outcomes, which can change dramatically significantly upon finalization, or upon implementation or interpretive guidance from numerous regulatory bodies worldwide, and such guidance can change. Regulatory and legislative changes have also significantly increased Citi’s compliance risks and costs (see the implementation and interpretation of regulatory changes risk factor below) and can adversely affect Citi’s competitive position, as well as its businesses, results of operations and financial condition.

Added · Removed · word-level comparison of the two filings

Prior heading: Citi’s Continued Investment and Other Initiatives as Part of Its Transformation and Strategic Refresh May Not Be as Successful as It Projects or Expects.

As part of its transformation and other strategic initiatives, Citi continues to make significant investments to improve its risk and control controls environment, modernize its data and technology infrastructure and further enhance safety and soundness (for additional information on these investments, see (see “Executive Summary” above and the legal and regulatory proceedings risk factor below). Citi also continues to make business-led investments, as part of the execution of its strategic refresh. initiatives. For example, Citi has been making investments across the Company, including, for example, including hiring front office colleagues in key strategic markets and businesses; enhancing product capabilities and platforms to grow key businesses, improve client digital experiences and add scalability scalability; and implementing new capabilities and partnerships. These business-led investments are designed to grow revenues as well as result in retention and efficiency improvements. Additionally, Citi has also been pursuing productivity improvements through various technology overall simplification initiatives that include management and digital initiatives, organizational operating model changes and actions to enhance focus on clients and reduce expenses. Citi’s simplification actions also include divestiture of the Mexico Consumer/SBMM operations and location strategies. completing other exits and wind-downs in order to streamline Citi and assist in optimizing its allocation of resources. These overall simplification initiatives involve various execution challenges and may result in higher than expected expenses, litigation and regulatory scrutiny, CTA and other losses or other negative financial or strategic impacts, which could be material (for information about potential CTA impacts, see the capital return risk factor above and the incorrect assumptions or estimates risk factor below). Citi’s multiyear transformation initiatives transformation, as well as its simplification initiatives, involve significant execution complexity, complexities and uncertainties. In addition, there is inherent risk that these Citi’s transformation and simplification initiatives will not be as productive or effective as Citi expects, or at all. Conversely, failure to properly adequately invest in and upgrade Citi’s technology and processes or properly implement its enterprise-wide simplification could result in Citi’s inability to meet regulatory expectations, be sufficiently competitive, serve clients effectively and avoid disruptions to its businesses and operational errors (for additional information, see (see the operational processes and systems and legal and regulatory proceedings risk factors below). Moreover, Citi’s ability to achieve expected returns on its investments and productivity operational improvements depends, in part, on factors that it cannot control, including, among others, macroeconomic challenges and uncertainties; customer, client and competitor actions; and ongoing regulatory requirements or changes. Citi’s strategic refresh also includes the divestiture of its remaining consumer banking businesses in Legacy Franchises, including Mexico Consumer/SBMM, in order to simplify the Company and enhance its allocation of resources. These divestitures involve significant uncertainty and execution complexity, and may result in additional CTA or other losses, charges or other negative financial or transformation, strategic impacts, which could be material (for information about risks related to Citi’s operations in Russia, see the macroeconomic challenges and uncertainties risk factor above and “Managing Global Risk—Other Risks—Country Risk—Russia” below). For additional information about CTA losses, see “Executive Summary” and the capital return risk factor above and the incorrect assumptions or estimates risk factor below. Citi’s investment and other initiatives may continue to evolve as its business strategies, the market environment and regulatory expectations change, which could make the initiatives more costly and more challenging to implement, and limit their effectiveness.

Added · Removed · word-level comparison of the two filings

Prior heading: Climate Change Presents Various Financial and Non-Financial Risks to Citi and its Customers and Clients.

Climate change presents both immediate and long-term risks to Citi and its customers and clients, with the risks expected to increase over time. Climate risks can arise from both physical risks (those risks related to the physical effects of climate change) and transition risks (risks related to regulatory, market, technological, stakeholder and legal changes from a transition to a low-carbon economy). Physical and transition risks can manifest themselves differently across Citi’s risk categories in the short, medium and long terms. terms. Physical risks from climate change include acute risks, such as hurricanes hurricanes, floods and floods, droughts, as well as consequences of chronic changes in climate, such as rising sea levels, prolonged droughts and systemic changes to geographies and any resulting population migration. Such For example, physical risks could have adverse financial, operational and other impacts on Citi, both directly on its business and operations, and indirectly as a result of impacts to Citi’s clients, customers, vendors and other counterparties. These impacts can include destruction, damage or impairment of owned or leased properties and other assets, destruction or deterioration of the value of collateral, such as real estate, disruptions to business operations and supply chains and reduced availability or increase in the cost of insurance. Physical risks can also impact Citi’s credit risk exposures, for example, in its mortgage and commercial real estate lending businesses. Transition risks may arise from changes in regulations or market preferences toward low-carbon industries or sectors, which in turn could have negative impacts on asset values, results of operations or the reputations of Citi and its customers and clients. For example, Citi’s corporate credit exposures include oil and gas, power and other industries that may experience reduced demand for carbon-intensive products due to the transition to a low-carbon economy. Failure to adequately consider transition risk in developing and executing on its business strategy could lead to a loss of market share, lower revenues and higher credit costs. Additionally, if Citi’s response to climate change is perceived to be ineffective or insufficient or Citi is unable to achieve its objectives or commitments relating to climate change, its businesses, reputation, attractiveness to certain investors costs. Transition risks also include potential increased operational, compliance and efforts energy costs driven by government policies to recruit promote decarbonization. Moreover, increasing legislative and retain employees may suffer. For example, the need regulatory changes and uncertainties regarding climate-related risk management and disclosures are likely to decarbonize result in a gradual increased regulatory, compliance, credit, reputational and orderly way, while promoting energy security, may lead to continued exposure to carbon-intensive activity other risks and costs for Citi. New regulations have been enacted and/or are expected in several jurisdictions, including the EU’s Corporate Sustainability Reporting Directive (CSRD), the SEC climate-related disclosures that could require disclosure of climate-related information and the State of California’s legislation enacted in turn may raise such reputational risks. October 2023 requiring broad disclosure of greenhouse gas emissions and other climate-related information largely beginning in 2026. In addition, Citi could face increased regulatory scrutiny and reputation and litigation risks as a result of its climate risk, sustainability and other ESG-related commitments and disclosures. Even as some regulators seek to mandate additional disclosure of climate-related information, Citi’s ability to comply with such requirements and conduct more robust climate-related risk analyses may be hampered by lack of information and reliable data. Data on climate-related risks is limited in availability, often based on estimated or unverified figures, collected and reported on a lag, time-lag, and variable in quality. Modeling capabilities to analyze climate-related risks and interconnections are improving, but remain incomplete. Moreover, U.S. and non-U.S. banking regulators and others are increasingly focusing on the issue of climate risk at financial institutions, both directly and with respect to their clients. For example, in December 2022, October 2023, the FRB requested comment on draft FRB, FDIC and OCC jointly released principles that would provide a high-level framework for the safe and sound management of exposures to climate-related financial risks risks, including physical and transition risks, for FRB-supervised financial institutions with more than $100 billion in assets. Legislative and regulatory changes Additionally, if Citi’s response to climate change is perceived to be ineffective or insufficient or Citi is unable to achieve its objectives or commitments relating to climate change, its businesses, reputation, attractiveness to certain investors and uncertainties regarding climate-related risk management efforts to recruit and disclosures are likely retain employees may suffer. For example, Citi's approach to result supporting client decarbonization in higher regulatory, compliance, credit, reputational and other risks and costs for Citi (for additional information, see the ongoing regulatory a gradual and legislative uncertainties orderly way, while promoting energy security, may lead to both continued exposure to carbon-intensive activity and changes risk factor above). In addition, Citi could face increased regulatory, reputational and legal scrutiny as a result reputation risks from stakeholders with divergent points of its climate risk, sustainability and other ESG-related commitments and disclosures. view. Citi also faces potentially conflicting anti-ESG initiatives challenges from certain U.S. state and other governments that may impact its ability to conduct certain business within those jurisdictions, as well as from Congress. jurisdictions. For information on Citi’s climate and other sustainability initiatives, see “Sustainability “Climate Change and Other ESG Matters” Net Zero” below. For additional information on Citi’s management of climate risk, see “Managing Global Risk—Strategic Risks—Climate Risk—Climate Risk” below.

Added · Removed · word-level comparison of the two filings

Prior heading: Citi’s Ability to Utilize Its DTAs, and Thus Reduce the Negative Impact of the DTAs on Citi’s Regulatory Capital, Will Be Driven by Its Ability to Generate U.S. Taxable Income.

At December 31, 2022, 2023, Citi’s net DTAs were $27.7 $29.6 billion, net of a valuation allowance of $2.4 $3.6 billion, of which $10.9 $12.8 billion was deducted from Citi’s CET1 Capital under the U.S. U.S. Basel III rules, primarily relating rules. Of this deducted amount, $12.1 billion related to net operating losses, foreign tax credit and general business credit carry-forwards. Of the net DTAs at December 31, 2022, $1.9 carry-forwards, with $2.3 billion related to foreign tax credit (FTC) carry-forwards, net temporary differences in excess of a valuation allowance. The carry-forward utilization period for FTCs is 10 years and represents the most time-sensitive component 10%/15% regulatory limitations, reduced by $1.6 billion of deferred tax liabilities, primarily associated with goodwill and certain other intangible assets that were separately deducted from capital. Citi’s DTAs. The FTC carry-forwards at December 31, 2022 expire over the period of 2025–2029. Citi must utilize any FTCs generated overall ability to realize its DTAs will primarily be dependent upon Citi’s ability to generate U.S. taxable income in the then-current-year tax return prior relevant reversal periods. Failure to utilizing realize any carry-forward FTCs. portion of the net DTAs would have a corresponding negative impact on Citi’s net income and financial returns. The accounting treatment for realization of DTAs, including FTCs, DTAs is complex and requires significant judgment and estimates regarding future taxable earnings in the jurisdictions in which the DTAs arise and available tax planning strategies. Forecasts of future taxable earnings will depend upon various factors, including, among others, macroeconomic conditions. In addition, any future increase in U.S. corporate tax rates could result in an increase in Citi’s DTA, DTAs, which may subject more of Citi’s existing DTA DTAs to exclusion from regulatory capital while improving Citi’s ability to utilize its FTC carry-forwards. Citi’s overall ability to realize its DTAs will primarily be dependent upon its ability to generate U.S. taxable income in the relevant tax carry-forward periods. Although utilization of FTCs in any year is generally limited to 21% of foreign source taxable income in that year, overall domestic losses (ODL) that Citi has incurred in the past allow it to reclassify domestic source income as foreign source. Failure to realize any portion of the net DTAs would have a corresponding negative impact on Citi’s net income and financial returns. capital. Citi has not been and does not expect to be subject to the Base Erosion Anti-Abuse Tax base erosion anti-abuse tax (BEAT), which, if applicable to Citi in any given year, would have a significantly adverse effect on both Citi’s net income and regulatory capital. capital. For additional information on Citi’s DTAs, including FTCs, see “Significant Accounting Policies and Significant Estimates—Income Taxes” below and Notes 1 and 9.10.

Added · Removed · word-level comparison of the two filings

Prior heading: Citi’s Interpretation or Application of the Complex Tax Laws to Which It Is Subject Could Differ from Those of Governmental Authorities, Which Could Result in Litigation or Examinations and the Payment of Additional Taxes, Penalties or Interest.

Citi is subject to various income-based tax laws of the U.S. and its states and municipalities, as well as the numerous non-U.S. jurisdictions in which it operates. These tax laws are inherently complex, and Citi must make judgments and interpretations about the application of these laws to its entities, operations and businesses. For example, the Organization for Economic Cooperation and Development (OECD) Pillar 2 initiative contemplates a 15% global minimum tax with respect to earnings in each separate country. EU member states are were required to adopt the OECD Pillar 2 rules in 2023, with an effective date of January 1, 2024 (unless an exception applied), and other non-U.S. countries have similarly adopted or are expected to follow suit. adopt the rules. Under these rules, Citi will be required to pay a “top-up” tax to the extent that Citi’s effective tax rate in any given country is below 15%. The U.S. is not expected to pass Beginning in 2024, countries that adopted the OECD Pillar 2 legislation rules in the near term, but 2023 can collect the top-up tax only with respect to earnings of entities in their jurisdiction or subsidiaries of such entities. Beginning in 2025, all countries that have adopted the OECD Pillar 2 rules can be collected by other countries. While many aspects collect a share of the application top-up tax owed with respect to any member of the rules remain uncertain, Pillar 2 multinational group. While Citi does not currently expect the rules to have a material effect to impact on its earnings. In addition, earnings, many aspects of the application of the rules remain uncertain. Additionally, Citi is subject to litigation or examinations with U.S. and non-U.S. tax authorities regarding non-income-based tax matters. While Citi has appropriately reserved for such matters where there is a probable loss, and has disclosed, as disclosed reasonably possible, matters that are more-likely-than-not, possible losses, the outcome from of the matters may be different than Citi’s expectations. Citi’s interpretations or application of the tax laws, including with respect to withholding, stamp, service and other non-income taxes, could differ from that of the relevant governmental taxing authority, which could result in the requirement to pay additional taxes, penalties or interest, the reduction of certain tax benefits or the requirement to make adjustments to amounts recorded, which could be material. See Note 29 30 for additional information on litigation and examinations involving non-U.S. tax authorities.

Added · Removed · word-level comparison of the two filings

Prior heading: Citi’s Inability in Its Resolution Plan Submissions to Address Any Shortcomings or Deficiencies or Guidance Provided Could Subject Citi to More Stringent Capital, Leverage or Liquidity Requirements, or Restrictions on Its Growth, Activities or Operations, and Could Eventually Require Citi to Divest Assets or Operations.

Title I of the Dodd-Frank Act requires Citi to prepare and submit a plan to the FRB and the FDIC for the orderly resolution of Citigroup (the bank holding company) and its significant legal entities under the U.S. Bankruptcy Code in the event of future material financial distress or failure. failure. Under Citi’s preferred “single point of entry” resolution plan strategy, only Citigroup, the parent holding company, would enter into bankruptcy, while Citigroup’s material legal entities (as defined in the public section of its 2023 resolution plan, which can be found on the FRB’s and FDIC’s websites) would remain operational outside of any resolution or insolvency proceedings. As a result, Citigroup’s losses and any losses incurred by its material legal entity subsidiaries would be imposed first on holders of Citigroup’s equity securities and thereafter on its unsecured creditors, including holders of eligible long-term debt and other debt securities. In addition, a wholly owned, direct subsidiary of Citigroup serves as a resolution funding vehicle (the IHC) to which Citigroup has transferred, and has agreed to transfer on an ongoing basis, certain assets. The obligations of Citigroup and of the IHC, respectively, under the amended and restated secured support agreement, are secured on a senior basis by the assets of Citigroup (other than shares in subsidiaries of the parent company and certain other assets), and the assets of the IHC, as applicable. As a result, claims of the operating material legal entities against the assets of Citigroup with respect to such secured assets are effectively senior to unsecured obligations of Citigroup. Citi’s single point of entry resolution plan strategy and the obligations under the amended and restated secured support agreement may result in the recapitalization of and/or provision of liquidity to Citi’s operating material legal entities, and the commencement of bankruptcy proceedings by Citigroup at an earlier stage of financial stress than might otherwise occur without such mechanisms in place. In line with the FRB’s TLAC rule, Citigroup’s shareholders and unsecured creditors—including its unsecured long-term debt holders—would bear any losses resulting from Citigroup’s bankruptcy. Accordingly, any value realized by holders of its unsecured long-term debt may not be sufficient to repay the amounts owed to such debt holders in the event of a bankruptcy or other resolution proceeding of Citigroup. For additional information on Citi’s single point of entry resolution plan strategy and the IHC and secured support agreement, see “Managing Global Risk—Liquidity Risk” below. On November 22, 2022, the FRB and FDIC issued feedback on the resolution plans filed on July 1, 2021 by the eight U.S. GSIBs, including Citi. The FRB and FDIC identified one shortcoming, but no deficiencies, in Citi’s 2021 resolution plan. The shortcoming related to data integrity and data quality management issues, specifically, weaknesses in Citi’s processes and practices for producing certain data that could materially impact its resolution capabilities. If a shortcoming is not satisfactorily explained or addressed before, or in, the submission of the next resolution plan, the shortcoming may be found to be a deficiency in the next resolution plan. For additional information on Citi’s plan (see discussion below). Citi submitted its 2023 resolution plan submissions, see “Managing Global Risk—Liquidity Risk” below. in June 2023. More generally, data continues to be a subject of regulatory focus, and Citi continues to work on enhancing its data availability and quality. Under Title I, if the FRB and the FDIC jointly determine that Citi’s resolution plan is not “credible” (which, although not defined, is generally believed understood to mean the regulators do not believe the plan is feasible or would otherwise allow Citi to be resolved in a way that protects systemically important functions without severe systemic disruption), or would not facilitate an orderly resolution of Citi under the U.S. Bankruptcy Code, and Citi fails to resubmit a resolution plan that remedies any identified deficiencies, Citi could be subjected to more stringent capital, leverage or liquidity requirements, or restrictions on its growth, activities or operations. If within two years from the imposition of any such requirements or restrictions Citi has still not remediated any identified deficiencies, then Citi could eventually be required to divest certain assets or operations. Any such restrictions or actions would negatively impact Citi’s reputation, market and investor perception, operations and strategy.

Added · Removed · word-level comparison of the two filings

Prior heading: Citi’s Performance and Its Ability to Effectively Execute Its Transformation and Other Strategic Initiatives Could Be Negatively Impacted if It Is Not Able to Compete for, Retain and Motivate Highly Qualified Colleagues.

Recent employment conditions and inflationary pressures have made the competition to hire and retain qualified employees significantly more challenging and costly. Citi’s performance and the performance of its individual businesses largely depend on the talents and efforts of its diverse and highly qualified colleagues. Specifically, Citi’s continued ability to compete in each of its lines of business, to manage its businesses effectively and to execute its transformation and other strategic and other initiatives, including, for example, hiring front office colleagues to grow businesses or hiring colleagues to support Citi’s transformation of its risk, controls, data and finance infrastructure strategic and compliance, other initiatives, depends on its ability to attract new colleagues and to retain and motivate its existing colleagues. If Citi is unable to continue to attract, retain and motivate the most highly qualified colleagues, Citi’s performance, including its competitive position, the execution of its transformation and other strategic and other initiatives and its results of operations could be negatively impacted. Citi’s ability to attract, retain and motivate colleagues depends on numerous factors, some of which are outside of its Citi’s control. For example, the competition for talent recently has been continues to be particularly intense, and attrition rates have risen intense due to factors such as low unemployment, a strong job market with a large number of open positions, unemployment and changes in worker’s worker expectations, concerns and preferences, in part due to the pandemic, including an increased demand for remote work options and other job flexibility. Also, the banking industry generally is subject to more comprehensive regulation of employee compensation than other industries, including deferral and clawback requirements for incentive compensation, which can make it unusually challenging for Citi to compete in labor markets against businesses, including including, for example example, technology companies, that are not subject to such regulation. In addition, in 2023 Citi announced plans to reduce management layers from 13 to a median of eight as part of organizational simplification initiatives that also involve significant reductions in functional roles, which could also impact its ability to attract and retain colleagues. Other factors that could impact its ability to attract, retain and motivate colleagues include, among other things, Citi’s presence in a particular market or region, the professional and development opportunities and employee benefits it offers, opportunities, its reputation and its diversity. For information on Citi’s colleagues and workforce management, see “Human Capital Resources and Management” below.

Added · Removed · word-level comparison of the two filings

Prior heading: Citi Faces Increased Competitive Challenges, Including from Financial Services and Other Companies and Emerging Technologies.

Citi operates in an increasingly evolving and competitive business environment, which includes both financial and non-financial services firms, such as traditional banks, online banks, private credit and financial technology companies and others. These companies compete on the basis of, among other factors, size, reach, quality and type of products and services offered, price, technology and reputation. Certain competitors may be subject to different and, in some cases, less stringent legal and regulatory requirements, whether due to size, jurisdiction, entity type or other factors, placing Citi at a competitive disadvantage. For example, Citi competes with other financial services companies in the U.S. and globally that continue to develop have grown rapidly over the last several years or have developed and introduce introduced new products and services. In recent years, non-traditional Potential mergers and acquisitions involving traditional financial services companies such as regional banks or credit card issuers, as well as networks and merchant acquirers, may also increase competition and impact Citi’s ability to offer competitive pricing and rewards. Non-traditional financial services firms, such as private credit and financial technology companies, have begun are less regulated and continue to offer expand their offerings of services traditionally provided by financial institutions, such as Citi, and have sought bank charters to provide institutions. The growth of certain of these services. These firms attempt to use technology competitors has increased market and mobile platforms to enhance counterparty credit risks, particularly in a more challenging macroeconomic environment (see the ability of companies and individuals to borrow, save risk factor on credit and invest money. Emerging concentrations of risk below). In addition, emerging technologies have the potential to intensify competition and accelerate disruption in the financial services industry. For example, despite recent difficulties and turmoil in faced by the digital asset market, there is sustained interest from market in recent years, clients and investors have exhibited a sustained interest in digital assets. Financial services firms and other market participants have begun to offer services related to those assets. However, Citi may not be able to provide the same or similar services for legal or regulatory reasons reasons, which may be exacerbated by rapidly evolving and conflicting regulatory requirements, and due to increased compliance and other risks. In addition, Further, changes in the payments space (e.g., instant and 24x7 payments) are accelerating, and, as a result, certain of Citi’s products and services could become less competitive. Increased competition and emerging technologies have required and could require Citi to change or adapt its products and services services, as well as invest in and develop related infrastructure, to attract and retain customers or clients or to compete more effectively with competitors, including new market entrants. Simultaneously, as Citi develops new products and services leveraging emerging technologies, new risks may emerge that, if not designed and governed adequately, may result in control gaps and in Citi operating outside of its risk appetite. For example, failure to strategically embrace the potential of artificial intelligence (AI) may result in a competitive disadvantage to Citi. At the same time, as a new technology, use of AI without sufficient controls, governance and risk management may result in increased risks across all of Citi’s risk categories. As another example, instant and 24x7 payments products could be accompanied by challenges to forecasting and managing liquidity, as well as increased operational and compliance risks. Moreover, Citi relies on third parties to support certain of its product and service offerings, which may put Citi at a disadvantage to competitors who may directly offer a broader array of products and services. Also, Citi’s businesses, results of operations and reputation may suffer if any third party is unable to provide adequate support for such product and service offerings, whether due to operational incidents or otherwise (for additional information, see (see the operational processes and systems, cybersecurity and emerging markets risk factors below). To the extent that Citi is not able to compete effectively with financial services companies, including private credit and financial technology companies companies, and other non-financial services firms, Citi could be placed at a competitive disadvantage, which could result in loss of customers and market share, and its businesses, results of operations and financial condition could suffer. For additional information on Citi’s competitors, see the co-brand and private label cards and qualified colleagues risk factors above and “Supervision, Regulation and Other—Competition” below.

Added · Removed · word-level comparison of the two filings

Prior heading: A Failure or Disruption of Citi’s Operational Processes or Systems Could Negatively Impact Its Reputation, Customers, Clients, Businesses or Results of Operations and Financial Condition.

Citi’s global operations rely heavily on its technology, technology systems and infrastructure, including the accurate, timely and secure processing, management, storage and transmission of data, including confidential transactions, data and other information information, as well as the monitoring of a substantial amount of data and complex transactions in real time. Citi obtains and stores an extensive amount of personal and client-specific information for its consumer and institutional customers and clients, and must accurately record and reflect their extensive account transactions. Citi’s operations must also comply with complex and evolving laws and laws, regulations and heightened regulatory expectations in the countries in which it operates. operates (see the implementation and interpretation of regulatory changes and legal proceedings risk factors below). With the evolving proliferation of new technologies and the increasing use of the internet, mobile devices and cloud technologies services to conduct financial transactions and customers’ and clients’ increasing use of online banking and trading systems and other platforms, large global financial institutions such as Citi have been, and will continue to be, subject to an ever-increasing risk of operational loss, failure or disruption, including as a result of cyber or information security incidents (for additional information, see the cybersecurity risk factor below). disruption. Although Citi has continued to upgrade its technology, including systems to automate processes and enhance gain efficiencies, operational incidents are unpredictable and can arise from numerous sources, not all of which are fully within Citi’s control. These include, among others, operational or execution failures, or deficiencies by third parties, including third parties that provide products or services to Citi (e.g., cloud service providers), other market participants or those that otherwise have an ongoing partnership or business relationship with Citi; deficiencies in processes or controls; inadequate management of data governance practices, data controls and monitoring mechanisms that may adversely impact internal or external reporting and decision-making; cyber or information security incidents (see the cybersecurity risk factor below); human error, such as manual transaction processing errors, errors (e.g., erroneous payments to lenders or manual errors by traders that cause system and market disruptions or losses), which can be exacerbated by staffing challenges and processing backlogs; fraud or malice on the part of employees or third parties; operational or execution failures or deficiencies by third parties; insufficient (or limited) straight-through processing between legacy or bespoke systems and any failure to design and effectively operate controls that mitigate operational risks associated with those legacy systems or bespoke systems, leading to potential risk of errors and operating losses; accidental system or technological failure; electrical or telecommunication outages; failures of or cyber incidents involving computer servers or infrastructure; infrastructure, including cloud services; or other similar losses or damage to Citi’s property or assets (see also the climate change risk factor above). For example, operational incidents can arise as a result of failures by third parties with which Citi does business, such as failures by internet, mobile technology and cloud service providers or other vendors to adequately follow procedures or processes, safeguard their systems or prevent system disruptions or cyberattacks. Failure by Citi to develop, implement and operate a third-party risk management program commensurate with the level of risk, complexity and nature of its third-party relationships can also result in operational incidents. In addition, Citi has experienced and could experience further losses associated with manual transaction processing errors, including erroneous payments to lenders or manual errors by Citi traders that cause system and market disruptions and losses for Citi and its clients. Irrespective of the sophistication of the technology utilized by Citi, there will always be some room for human error. and other errors. In view of the large transactions in which Citi engages, such errors could result in significant losses. While Citi has change management processes in place to appropriately upgrade its operational processes and systems to ensure that any changes introduced do not adversely impact security and operational continuity, such change management can fail or be ineffective. Operational incidents can also arise as a result of failures by third parties with which Furthermore, when Citi does business, such as failures by internet, mobile technology and cloud service providers or other vendors to adequately follow procedures introduces new products, systems or processes, safeguard their systems new operational risks that may arise from those changes may not be identified, or prevent system disruptions adequate controls to mitigate the identified risks may not be appropriately implemented or cyberattacks. operate as designed. Incidents that impact information security and/or security, technology operations or other operational processes may cause disruptions and/or malfunctions within Citi’s businesses (e.g., the temporary loss of availability of Citi’s online banking system or mobile banking platform), as well as the operations of its clients, customers or other third parties. In addition, operational incidents could involve the failure or ineffectiveness of internal processes or controls. Given Citi’s global footprint and the high volume of transactions processed by Citi, certain failures, errors or actions may be repeated or compounded before they are discovered and rectified, which would further increase the consequences and costs. Operational incidents could result in financial losses and other costs as well as misappropriation, corruption or loss of confidential and other information or assets, which could significantly negatively impact Citi’s reputation, customers, clients, businesses or results of operations and financial condition. Cyber-related and other operational incidents can also result in legal and regulatory actions or proceedings, fines and other costs (see the legal and regulatory proceedings risk factor below). For information on Citi’s management of operational risk, see “Managing Global Risk—Operational Risk” below.

Added · Removed · word-level comparison of the two filings

Prior heading: Citi’s and Third Parties’ Computer Systems and Networks Will Continue to Be Susceptible to an Increasing Risk of Continually Evolving, Sophisticated Cybersecurity Incidents That Could Result in the Theft, Loss, Misuse or Disclosure of Confidential Client or Customer Information, Damage to Citi’s Reputation, Additional Costs to Citi, Regulatory Penalties, Legal Exposure and Financial Losses.

Citi’s computer systems, software and networks are subject to ongoing cyber incidents, attempted cyberattacks, such as unauthorized access, loss or destruction of data (including confidential client information), account takeovers, disruptions of service, phishing, malware, ransomware, computer viruses or other malicious code, cyberattacks code and other similar events. These threats can arise from external parties, including cyber criminals, cyber terrorists, hacktivists (individuals or groups using cyberattacks to promote a political or social agenda) and nation-state actors, as well as insiders who knowingly or unknowingly engage in or enable malicious cyber activities. activities. Citi develops its own software and relies on third-party applications and software, which are susceptible to vulnerability exploitations. Software leveraged in financial services and other industries continues to be impacted by an increasing number of zero-day vulnerabilities, thus increasing inherent cyber risk to Citi. The increasing use of mobile and other digital banking platforms and services, cloud technologies and connectivity solutions to facilitate remote working for Citi’s employees all increase Citi’s exposure to cybersecurity risks. Citi’s Citi is also susceptible to cyberattacks given, among other things, its size and scale, high-profile brand, global footprint and prominent role in the financial system, as well as the ongoing wind-down of its businesses in Russia could also increase its susceptibility to cyberattacks (for additional information about Citi’s exposures related to its Russia operations, see (see the macroeconomic and geopolitical risk factor above and “Managing Global Risk—Other Risks—Country Risk—Russia” below). below). Additionally, Citi continues to operate in multiple jurisdictions in the midst of geopolitical unrest, including active conflicts in Ukraine and the Middle East, which could expose Citi to heightened risk of insider threat, politically motivated hacktivism or other cyber threats. Citi continues to experience increased exposure to cyberattacks through third parties, in part because financial institutions are becoming increasingly interconnected with central agents, exchanges and clearing houses. Third parties with which Citi does business, as well as retailers and other third parties with which Citi’s customers do business, may and any such third parties’ downstream service providers, also be sources of pose cybersecurity risks, particularly where activities of customers are beyond Citi’s security and control systems. For example, Citi outsources certain functions, such as processing customer credit card transactions, uploading content on customer-facing websites and developing software for new products and services. These relationships allow for the storage and processing of customer information by third-party hosting of, or access to, Citi websites, which websites. This could lead to compromise or the potential to introduce vulnerable or malicious code, resulting in security breaches or business disruptions impacting Citi customers. Furthermore, because financial institutions are becoming increasingly interconnected with central agents, exchanges and clearing houses, including as a result of derivatives reforms over the last few years, Citi has increased exposure to cyberattacks through third parties. customers, employees or operations. While many of Citi’s agreements with third parties include indemnification provisions, Citi may not be able to recover sufficiently, or at all, under these provisions to adequately offset any losses and other adverse impacts Citi may incur from third-party cyber incidents. Citi and some of its third-party partners have been subject subjected to attempted and sometimes successful cyberattacks from external sources over the last several years, including (i) denial of service attacks, which attempt to interrupt service to clients and customers; (ii) hacking and malicious software installations intended to gain unauthorized access to information systems or to disrupt those systems; systems and/or impact availability or privacy of confidential data, with objectives including, but not limited to, extortion payments or causing reputational damage; (iii) data breaches due to unauthorized access to customer account or other data; and (iv) malicious software attacks on client systems, in attempts to gain unauthorized access to Citi systems or client data under the guise of normal client transactions. transactions. While Citi’s monitoring and protection services were able to detect and respond have historically generally succeeded in detecting, thwarting and/or responding to the incidents attacks targeting its systems before they became become significant, they still certain past incidents resulted in limited losses in some instances losses, as well as increases in expenditures to monitor against the threat of similar future cyber incidents. There can be no assurance that such cyber incidents will not occur again, and they could occur more frequently, via novel tactics tactics, including leveraging of tools made possible by emerging technologies, and on a more significant scale. Further, although Citi devotes scale. Despite the significant resources Citi allocates to implement, maintain, monitor and regularly upgrade its systems and networks with measures such as intrusion detection and prevention systems and firewalls to safeguard critical business applications, there is no guarantee that these measures or any other measures can provide absolute sufficient security. Because the techniques used to initiate cyberattacks change frequently or, in some cases, are not recognized until launched or even later, Citi may be unable to implement effective preventive measures or otherwise proactively address these methods. In addition, given the evolving nature of cyber threat actors threats and cyberattack techniques change, develop and evolve rapidly, including from emerging technologies such as artificial intelligence, cloud computing and quantum computing. Given the frequency and sophistication of the cyber activities they carry out, cyberattacks, the determination of the severity and potential impact of a cyber incident may not become apparent for a substantial period of time following discovery detection of the incident. Also, while Citi engages in certain actions strives to implement measures to reduce the exposure resulting from outsourcing, outsourcing risks, such as performing security control assessments of third-party vendors and limiting third-party access to the least privileged level necessary to perform job functions, these actions measures cannot prevent all third-party-related third-party related cyberattacks or data breaches. breaches. In addition, the risk of insider threat may be elevated in the near term due to Citi’s overall simplification initiatives, including streamlining its global staff functions. Cyber incidents can result in the disclosure of personal, confidential or proprietary customer, client or employee information, information; damage to Citi’s reputation with its clients clients, other counterparties and the market, market; customer dissatisfaction dissatisfaction; and additional costs to Citi, including expenses such as repairing or replacing systems, replacing customer payment cards, credit monitoring or adding new personnel or protection technologies. Cyber incidents can also result in regulatory penalties, loss of revenues, deposit flight, exposure to litigation and other financial losses, including loss of funds, funds to both Citi and its clients and customers customers, and disruption to Citi’s operational systems (for additional information on the potential impact of operational disruptions, see (see the operational processes and systems risk factor above). Moreover, the increasing risk of cyber incidents has resulted in increased legislative and regulatory action on cybersecurity, including, among other things, scrutiny of firms’ cybersecurity protection services and calls for additional services, laws and regulations to further enhance protection of consumers’ personal data. data and mandated disclosure on cybersecurity matters. For example, in July 2023, the SEC finalized new rules requiring timely disclosure of material cybersecurity incidents as well as other annual cyber-related disclosures (see “Managing Global Risk—Operational Risk—Cybersecurity Risk” below). While Citi maintains insurance coverage that may, subject to policy terms and conditions including significant self-insured deductibles, cover certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses and may not take into account reputational harm, the costs of which are impossible to quantify. For additional information about Citi’s management of cybersecurity risk, see “Managing Global Risk—Operational Risk—Cybersecurity Risk” below.

Added · Removed · word-level comparison of the two filings

Prior heading: If Citi’s Risk Management Processes, Strategies or Models Are Deficient or Ineffective, Citi May Incur Significant Losses and Its Regulatory Capital and Capital Ratios Could Be Negatively Impacted.

Citi utilizes a broad and diversified set of risk management and mitigation other processes and strategies, including the use of models in enacting processes and strategies as well as in analyzing and monitoring the various risks Citi assumes in conducting its activities. For example, Citi uses models as part of its comprehensive stress testing initiatives across the Company. Citi also relies on data to aggregate, assess and manage various risk exposures. Management of these risks is and the reliability of the data are made more challenging within a large, global financial institution institution, such as Citi, particularly given the due to complex, diverse and rapidly changing financial markets and conditions in which Citi operates as well as that operates. Unexpected losses can occur unintentionally result from untimely, inaccurate or incomplete processes and data. As discussed below, in October 2020, Citigroup and Citibank entered into consent orders with the FRB and OCC that require Citigroup and Citibank to make improvements in various aspects of enterprise-wide risk management, compliance, data quality management and governance governance, and internal controls (see “Citi’s Consent Order Compliance” above and the legal and regulatory proceedings risk factor below). Citi’s risk management and other processes, strategies and models are inherently limited because they involve techniques, including the use of historical data in many circumstances, assumptions and judgments that cannot anticipate every economic and financial outcome in the markets in which Citi operates, particularly given various macroeconomic, geopolitical and other challenges and uncertainties (see the macroeconomic challenges and uncertainties risk factor above), nor can they anticipate the specifics and timing of such outcomes. For example, many models used by Citi include assumptions about correlation or lack thereof among prices of various asset classes or other market indicators that may not necessarily hold in times of market stress, limited liquidity or other unforeseen circumstances. circumstances, or identify changes in markets or client behaviors not yet inherent in historical data. Citi could incur significant losses, receive negative regulatory evaluation or examination findings or be subject to additional enforcement actions, and its regulatory capital, capital ratios and ability to return capital ratios could be negatively impacted, if Citi’s risk management and other processes, including its ability to manage and aggregate data in a timely and accurate manner, strategies or models are deficient or ineffective. For additional information, see the capital return risk factor above and the heightened regulatory scrutiny and ongoing interpretation of regulatory changes risk factor below. Such deficiencies or ineffectiveness could also result in inaccurate financial, regulatory or risk reporting. Moreover, Citi’s Basel III regulatory capital models, including its credit, market and operational risk models, currently remain subject to ongoing regulatory review and approval, which may result in refinements, modifications or enhancements (required or otherwise) to these models. Citi is required to notify and obtain preapproval from both the OCC and FRB prior to implementing certain risk-weighted asset treatments, as well as certain model changes, resulting in a more challenging environment within which Citi must operate in managing its risk-weighted assets. Modifications or requirements resulting from these ongoing reviews, as well as any future changes or guidance provided by the U.S. banking agencies regulators regarding the U.S. regulatory capital framework applicable to Citi, including, but not limited to, potential revisions to the U.S. Basel III rules, known as the Basel III Endgame (for information about the Basel III Endgame, see the capital return risk factor and “Capital Resources—Regulatory Capital Standards Developments” above), have resulted in, and could continue to result in, significant changes to Citi’s risk-weighted assets. These changes can negatively impact Citi’s capital ratios and its ability to achieve meet its regulatory capital requirements.

Added · Removed · word-level comparison of the two filings

Prior heading: Citi’s Businesses, Results of Operations and Financial Condition Could Be Negatively Impacted if It Does Not Effectively Manage Its Liquidity.

As a large, global financial institution, adequate liquidity and sources of funding are essential to Citi’s businesses. Citi’s liquidity and liquidity, sources of funding and costs of funding can be significantly and negatively impacted by factors it cannot control, such as general disruptions in the financial markets, governmental markets (e.g., the failure of regional banks and other banking stresses in the first half of 2023); changes in fiscal and monetary policies, policies and regulatory changes or requirements; negative investor perceptions of Citi’s creditworthiness, creditworthiness; deposit outflows or unfavorable changes in deposit mix; unexpected increases in cash or collateral requirements requirements; credit ratings; and the consequent inability to monetize available liquidity resources. resources. In addition, Citi competes with other banks and financial institutions for both institutional and consumer deposits, which represent Citi’s most stable and lowest cost source of long-term funding. The competition for deposits has continued to increase in recent years, increase, including as a result of online banks and digital banking quantitative tightening by central banks, the current higher interest rate environment and fixed income alternatives for customer funds. Furthermore, it is expected that the market for deposits will become more competitive in the current higher interest rate environment. funds. Further, Citi’s costs to obtain and access wholesale funding are directly related to changes in interest and currency exchange rates and its credit spreads. For example, during 2022, interest rates in the U.S. increased significantly, thus, affecting Citi’s cost of funding. Changes in Citi’s credit spreads are driven by both external market factors and factors specific to Citi, such as negative views by investors of the financial services industry or Citi’s financial prospects, and can be highly volatile. For additional information on Citi’s primary sources of funding, see “Managing Global Risk—Liquidity Risk” below. Citi’s ability to obtain funding may be impaired and its cost of funding could also increase if other market participants are seeking to access the markets at the same time or to a greater extent than expected, or if market appetite for corporate debt securities declines, as is likely to occur in a liquidity stress event or other market crisis. Citi’s ability to sell assets may also be impaired if other market participants are seeking to sell similar assets at the same time or a liquid market does not exist for such assets. Additionally, unexpected changes in client needs due to idiosyncratic events or market conditions could result in greater than expected drawdowns from off-balance sheet committed facilities. A sudden drop in market liquidity could also cause a temporary or protracted dislocation of underwriting and capital markets activity. In addition, clearing organizations, central banks, clients and financial institutions with which Citi interacts may exercise the right to require additional collateral during challenging market conditions, which could further impair Citi’s liquidity. If Citi fails to effectively manage its liquidity, its businesses, results of operations and financial condition could be negatively impacted. In addition, as Limitations on the payments that Citigroup Inc. receives from its subsidiaries could also impact its liquidity. As a holding company, Citigroup Inc. relies on interest, dividends, distributions and other payments from its subsidiaries to fund dividends as well as to satisfy its debt and other obligations. Several of Citi’s U.S. and non-U.S. subsidiaries are or may be subject to capital adequacy or other liquidity, regulatory or contractual restrictions on their ability to provide such payments, including any local regulatory stress test requirements and inter-affiliate arrangements entered into in connection with Citigroup Inc.’s resolution plan. Citigroup Inc.’s broker-dealer and bank subsidiaries are subject to restrictions on their ability to lend or transact with affiliates, as well as restrictions on their ability to use funds deposited with them in brokerage or bank accounts to fund their businesses. Limitations on the payments that Citigroup Inc. receives from its subsidiaries could also impact its liquidity. businesses. A bank holding company is also required by law to act as a source of financial and managerial strength for its subsidiary banks. As a result, the FRB may require Citigroup Inc. to commit resources to its subsidiary banks even if doing so is not otherwise in the interests of Citigroup Inc. or its shareholders or creditors, reducing the amount of funds available to meet its obligations.

Added · Removed · word-level comparison of the two filings

Prior heading: Credit Rating Agencies Continuously Review the Credit Ratings of Citi and Certain of Its Subsidiaries, and a Ratings Downgrade Could Adversely Impact Citi’s Funding and Liquidity.

The credit rating agencies, such as Fitch Ratings, Moody’s Investors Services Service and S&P Global Ratings, continuously evaluate Citi and certain of its subsidiaries. Their ratings of Citi and its rated subsidiaries’ long-term debt and short-term obligations are based on several firm-specific factors, including the financial strength of Citi and such subsidiaries, as well as factors that are not entirely within the control of Citi and its subsidiaries, such as the agencies’ proprietary rating methodologies and assumptions, potential impact from negative actions on U.S. sovereign ratings and conditions affecting the financial services industry and markets generally. Citi and its subsidiaries may not be able to maintain their current respective ratings and outlooks. Rating downgrades could negatively impact Citi and its rated subsidiaries’ ability to access the capital markets and other sources of funds as well as increase credit spreads and the costs of those funds. A ratings downgrade could also have a negative impact on Citi and its rated subsidiaries’ ability to obtain funding and liquidity due to reduced funding capacity and the impact from derivative triggers, which could require Citi and its rated subsidiaries to meet cash obligations and collateral requirements. requirements or permit counterparties to terminate certain contracts. In addition, a ratings downgrade could have a negative impact on other funding sources such as secured financing and other margined transactions for which there may be no explicit triggers, and on contractual provisions and other credit requirements of Citi’s counterparties and clients that may contain minimum ratings thresholds in order for Citi to hold third-party funds. triggers. Furthermore, a credit ratings downgrade could have impacts that may not be currently known to Citi or are not possible to quantify. Some of Citi’s counterparties and clients could have ratings limitations on their permissible counterparties, of which Citi may or may not be aware. Certain of Citi’s corporate customers and trading counterparties, among other clients, could re-evaluate their business relationships with Citi and limit the trading of certain contracts or market instruments instruments, and limit or withdraw deposits placed with Citi in response to ratings downgrades. Changes in customer and counterparty behavior could impact not only Citi’s funding and liquidity but also the results of operations of certain Citi businesses. For additional information on the potential impact of a reduction in Citi’s or Citibank’s credit ratings, see “Managing Global Risk—Liquidity Risk” below.

Added · Removed · word-level comparison of the two filings

Prior heading: Ongoing Interpretation and Implementation of Regulatory and Legislative Requirements and Changes and Heightened Regulatory Scrutiny and Expectations in the U.S. and Globally Have Increased Citi’s Compliance, Regulatory and Other Risks and Costs.

Large financial institutions, such as Citi, face significantly heightened regulatory expectations and scrutiny in the U.S. and globally, including with respect to, among other things, governance, infrastructure, data and risk management practices and controls. These regulatory expectations extend to their employees and agents and also include, among other things, those related to customer and client protection, market practices, anti-money laundering, increasingly complex sanctions and disclosure regimes and various regulatory reporting requirements. U.S. financial institutions also face increased expectations and scrutiny in the wake of the failures of several regional banks and other banking stresses in the first half of 2023. In addition, Citi is continually required to interpret and implement extensive and frequently changing regulatory and legislative requirements in the U.S. and other jurisdictions in which it does business, which may overlap or conflict across jurisdictions, resulting in substantial compliance, regulatory and other risks and costs. In addition, there are heightened regulatory scrutiny and expectations in the U.S. and globally for large financial institutions, as well as their employees and agents, with respect to governance, infrastructure, data, climate and risk management practices and controls. These requirements and expectations also include, among other things, those related to customer and client protection, market practices, anti-money laundering and increasingly complex sanctions and disclosure regimes. costs. A failure to comply with these requirements expectations and expectations, requirements, even if inadvertent, or resolve any identified deficiencies, deficiencies in a timely and sufficiently satisfactory manner to regulators, could result in increased regulatory oversight and oversight; material restrictions, including, among others, imposition of additional capital buffers and limitations on capital distributions; enforcement proceedings, penalties proceedings; penalties; and fines (for additional information on such regulatory consequences, see (see the capital return risk factor above and legal and regulatory proceedings risk factor below). Over the past several years, Citi has been required to implement a significant large number of regulatory and legislative changes, including new regulatory or legislative requirements or regimes, across its businesses and functions, and these changes continue. The changes themselves may be complex and subject to interpretation, and will require continued investments result in changes to Citi’s global operations and businesses. In addition, the changes require continued substantial technology solutions. and other investments. In some cases, Citi’s implementation of a regulatory or legislative requirement is occurring simultaneously with changing or conflicting regulatory guidance, guidance from multiple jurisdictions (including various U.S. states) and regulators, legal challenges or legislative action to modify or repeal existing rules or enact new rules. rules. Examples of regulatory or legislative changes that have resulted in increased compliance risks and costs include (i) the U.S. regulatory capital framework and requirements, which have continued to evolve (see the capital return risk factor and “Capital Resources” above); (ii) various laws relating to the limitation of cross-border data movement and/or collection and use of customer information, including data localization and protection and privacy laws, which also can conflict with or increase compliance complexity with respect to other laws, including anti-money laundering laws; and (ii) (iii) the U.S. banking agencies’ regulatory capital rules and requirements, EU’s Corporate Sustainability Reporting Directive, which have continued may overlap but also diverge from climate-related disclosure requirements expected to evolve (for additional information, see come into effect in other jurisdictions, including in the capital return risk factor and “Capital Resources” above). U.S. In addition, certain U.S. regulatory agencies and states and non-U.S. authorities have prioritized issues of social, economic and racial justice, and are in the process of considering ways in which these issues can be mitigated, including through rulemaking, supervision and other means, even while Congress is signaling, and certain U.S. state and other governments are pursuing potentially conflicting anti-ESG priorities.and signaling challenges that may conflict with corporate ESG initiatives.

Added · Removed · word-level comparison of the two filings

Prior heading: Citi’s Emerging Markets Presence Subjects It to Various Risks as well as Increased Compliance and Regulatory Risks and Costs.

During 2022, 2023, emerging markets revenues accounted for approximately 37% 40% of Citi’s total revenues (Citi generally defines emerging markets as countries in Latin America, Asia (other than Japan, Australia and New Zealand), and central and Eastern Europe, the Middle East and Africa in EMEA). Africa). Citi’s presence in the emerging markets subjects it to various risks, such as risks. Emerging market risks include, among others, limitations or unavailability of hedges on foreign investments; foreign currency volatility, including devaluations and continued strength in the U.S. dollar; sustained increases in elevated interest rates; sovereign debt volatility; election outcomes, regulatory changes rates and political events; quantitative tightening; elevated inflation and hyperinflation; foreign exchange controls, including an inability to access indirect foreign exchange mechanisms; macroeconomic and macroeconomic, geopolitical challenges and domestic political challenges, uncertainties and volatility, including with respect to Russia and China (see the macroeconomic and geopolitical risk factor above and “Managing Global Risk—Other Risks—Country Risk—Russia” and “—Ukraine” below); cyberattacks; restrictions arising from retaliatory laws and regulations; sanctions or asset freezes; sovereign debt volatility; fluctuations in commodity prices; election outcomes; regulatory changes, including potential conflicts among regulations with other jurisdictions where Citi does business; limitations on foreign investment; sociopolitical instability (including from hyperinflation); instability; civil unrest; crime, corruption and fraud; nationalization or loss of licenses; restrictions arising from retaliatory Russian laws and regulations on the conduct of its business; sanctions or asset freezes; potential criminal charges; closure of branches or subsidiaries; and confiscation of assets, assets; and these risks can be exacerbated in the event of a deterioration in relationships the relationship between the U.S. and an emerging market country. For example, Citi operates in several countries that have, or have had in the past, strict capital controls, currency controls and/or sanctions, such as Argentina and Russia, that limit its ability to convert local currency into U.S. dollars and/or transfer funds outside of those countries. For instance, Citi may need to record additional translation losses due to currency controls in Argentina, Citi faces a risk of devaluation on its unhedged Argentine peso-denominated assets, which continue to increase (for additional information on Argentina-related risks, see Argentina (see “Managing Global Risk—Other Risks—Country Risk—Argentina” below). Moreover, if the economic situation in a country in which Citi operates were to deteriorate below a certain level, U.S. regulators through the Interagency Country Exposure Review Committee (ICERC) may impose mandatory loan loss or other reserve requirements on Citi, which would increase need to record additional reserves for expected losses for its credit costs exposures based on the transfer risk associated with exposures outside the U.S., driven by safety and decrease its earnings. soundness considerations under U.S. banking law (see “Managing Global Risk—Other Risks—Country Risk—Argentina” and “—Russia” and “Significant Accounting Policies and Significant Estimates” below). In addition, political turmoil and instability and instability; geopolitical challenges, tensions and conflicts (such (including those related to Russia’s war in Ukraine as well as a persistent and/or escalating conflict in the Russia–Ukraine war) Middle East); terrorism; and other instabilities have occurred in various regions and emerging market countries across the globe globe, which impact Citi’s businesses, results of operations and financial conditions in affected countries and have required, and may continue to require, management time and attention and other resources, such as monitoring managing the impact of sanctions and their effect on Citi’s operations in certain emerging market economies as well as impacting Citi’s businesses, results of operations countries. For additional information, see the macroeconomic challenges and financial conditions in affected countries.uncertainties risk factor above.

Added · Removed · word-level comparison of the two filings