How does Citi govern AI and manage AI risk?
Citi governs AI from the board down and through one central platform. Since its 2024 proxy the board's Technology Committee has overseen 'policies, practices and standards related to' generative AI, and the 2026 proxy says the board receives reporting on 'risk management and controls over, and governance and employee adoption of, Generative AI'; its chair's letter calls 'governance and controls over Generative AI' 'a particular focus'. In April 2026 Citi moved Aida Filipovic from its central controls team to be head of responsible AI, with a team building an AI governance model, AI ethical principles and an AI command center; David Griffiths, group head of AI, leads strategy and governance. The operating rule, as former head of AI Shobhit Varshney described it in December 2025, is 'responsible AI principles, risk guardrails, controls across from ideation all the way to scale' enforced on 'one central Citi AI platform'. Suppliers are barred from using AI on Citi work or data unless the contract allows it, and must support regulator-requested algorithm audits. Since the 2023 10-K, Citi has flagged that AI 'without sufficient controls, governance and risk management' raises risk 'across all of Citi's risk categories'. The backdrop is the October 2020 OCC and Fed consent orders on risk management, data governance and controls: the OCC added a $75 million penalty in July 2024 over data, then ended that amendment in December 2025; the 2020 orders remain. Citi has not yet published its AI ethical principles.[1][2][3][4][5][6][7][8]
Data as of Oct 31, 2026 · Citi profile updated Oct 26, 2026 · 29 sources cited on this page · 141 banks profiled on this site · Markdown
Who oversees AI at Citi, from the board down?
'Disclosed' is from an SEC filing; 'Stated' is a named executive or a Citi publication.
| Body or role | What it does for AI | Status | Source date |
|---|---|---|---|
| Technology Committee (Board) | Oversees management's approach to, and 'policies, practices and standards related to', generative AI; members bring expertise in how AI intersects with financial services; met 6 times in 2025 | Disclosed | March 19, 2024; April 2, 2026[1][2] |
| Full board | Receives reporting on Citi's strategic approach to, risk management and controls over, and governance and employee adoption of generative AI; with the Risk Management Committee, 'oversaw the firm's responsible deployment of AI' | Disclosed | April 2, 2026[2] |
| Group head of AI | David Griffiths' team 'leads the firm's strategy, governance and approach to AI'; business lines have their own AI leaders | Stated | October 19, 2026[3] |
| Head of responsible AI | Aida Filipovic, moved from the central controls team in April 2026; her team develops an AI governance model, AI ethical principles and an AI command center | Stated | October 19, 2026[3] |
| Central AI platform | One platform exposes all generative AI; guardrails, security, policies and MCP servers are built once centrally and inherited by every use case; multi-provider, with some models run in-region for geographic constraints | Stated | December 15, 2025[4] |
| Model risk management | Citi's policies on emerging technologies include model risk management; model changes are validated by a model validation group within Model Risk Management | Disclosed | February 2024; February 2026[6][9] |
| Controls framework | The Manager's Control Assessment process 'redefined what good looks like across all controls firmwide', with continuous monitoring and testing that will evolve as AI changes processes | Stated | October 20, 2026[10] |
What has Citi disclosed about AI risk and responsible use, and when?
| Date | Item | What it says |
|---|---|---|
| February 23, 2024 | 2023 10-K | 'Failure to strategically embrace the potential of artificial intelligence (AI) may result in a competitive disadvantage'; AI 'without sufficient controls, governance and risk management may result in increased risks across all of Citi's risk categories'[6] |
| February 21, 2025 | 2024 10-K | Despite policies on emerging technologies, faulty generative AI practices by Citi or third parties could produce output 'based on biased, incomplete and/or inaccurate datasets'[11] |
| June 24, 2025 | FINOS AI governance framework | Citi among the banks and cloud providers drafting open-source common controls for AI services[12] |
| February 20, 2026 | 2025 10-K | Adds 'insufficient testing and monitoring, poorly structured or manipulated prompts or insufficient or inadequate human oversight' and autonomous agents to the generative AI risk list[9] |
| September 2026 | Supplier requirements, section 19 | No AI/ML in products, contract work or anything exposing Citi information unless agreed; breach is material; no training on Citi information without written approval; suppliers must help with regulator-requested algorithm audits[5] |
| October 13, 2026 | Q3 2026 call | Fraser's fourth AI lens is defense: 'hardening our systems and running challenging and disruptive scenarios' and working with peers and regulators on systemic risk[13] |
| October 19, 2026 | Griffiths memo | Next phase must uphold 'the highest standards of safety, responsibility and governance'[3] |
How do Citi's consent orders relate to its AI governance?
The OCC's October 7, 2020 cease-and-desist order against Citibank concerns 'deficiencies in enterprise-wide risk management, compliance risk management, data governance, and internal controls'; the Fed issued a parallel order to Citigroup, and the two fined the bank $400 million after the mistaken $900 million Revlon payment.[7][8]
On July 10, 2024 the OCC amended the order and fined Citibank $75 million for missed milestones and 'lack of processes to monitor the impact of data quality concerns on regulatory reporting'; the Fed added $60.6 million. Acting Comptroller Michael Hsu said 'certain persistent weaknesses remain, in particular with regard to data'. The OCC ended the amendment in December 2025; the 2020 OCC and Fed orders remain in place.[7][14][8]
No order mentions AI. Citi's own case is that the remediation is what makes AI safe to scale: COO Anand Selvakesari wrote in October 2026 that the transformation 'established trusted enterprise sources for trades and transactions' and strengthened 'the quality of the information that AI models require to perform effectively and responsibly'.[10]
What does the Citi profile record on this topic?
The rows below are the entries of the Citi AI strategy profile that bear on this page, as of Oct 26, 2026; the profile holds the full record of 48 dated moves, 21 use cases and 68 sources.
| Use case | What the record shows | Status | Source |
|---|---|---|---|
| Frontier-model testing | Has access to or is testing Anthropic's Mythos, per Reuters. | Pilot | [15] |
| Arc enterprise agent platform | Platform for building and scaling AI agents under one governance framework, starting with developers' internal use cases such as research and client preparation. | Rolling out | [16][17][18] |
| FX cash-flow forecasting with Ant International's FalconTST | Per Ant International, Citi combines the FalconTST 2.0 time-series AI model with its Fixed FX Rates solution for cash-flow forecasting and FX risk management, mainly for e-commerce platforms and airlines; the accuracy figure (above 93%) is Ant's own. | Announced | [19][20] |
| AI risk factor and board oversight | The 10-K's AI risk factor covers generative AI, autonomous agents, explainability, bias and third-party models; the board's Technology Committee reviews management's approach to generative AI. | In production | [9] |
| Feedzai payments fraud prevention (Treasury and Trade Solutions) | Feedzai quotes Manish Kohli, global head of payments and receivables at Citi Treasury and Trade Solutions, on Citi's 'strategic partnership with Feedzai', which he says helps it scale so clients can make payments 'securely, efficiently and without friction, across the globe'; Feedzai's 2021 funding release also named Citibank among users of its risk-management software. | In production | [21][22] |
| Intelligent document processing for onboarding | A Services platform that automates client onboarding and incoming documents, cutting review times by 80%; Services reports a pipeline of more than 50 AI use cases governed with risk and control teams. | In production | [23] |
| Cards controls monitoring | Cards uses AI as a 'smarter smoke detector' in controls, which Pam Habner said cuts the time to resolve customer issues by 95%. | In production | [23] |
| Date | Move | Detail | Source |
|---|---|---|---|
| Sep 20, 2026 | Fraser: a 'tsunami of patching' | The CEO says companies are racing to shore up defences as more powerful AI models raise cyber-attack risk. | [24] |
| Aug 19, 2026 | Ant International's FalconTST forecasting model paired with Citi's Fixed FX Rates | According to Ant International, Citi, Barclays, Deutsche Bank and Standard Chartered have integrated its Falcon Time-Series Transformer AI model into their FX hedging models for cash-flow forecasting and FX liquidity management, with Citi combining it with its own Fixed FX Rates solution, mainly for FX risk management on e-commerce platforms and airlines; all four have adopted version 2.0, which Ant says forecasts with more than 93% accuracy. Citi has not described the deployment itself. | [19][20] |
| Aug 6, 2026 | Q2 2026 10-Q: AI in the risk language | The 10-Q lists AI-enabled cyber exploitation, faulty generative-AI practices by Citi or third parties, AI-driven fraud and disinformation, and competitors deploying AI faster among its forward-looking risks. | [25] |
| May 7, 2026 | Investor day: Citi Sky, 400 advisors, new targets | AI wealth advisor for Citigold clients from the summer; Fraser: AI applied from onboarding and underwriting to virtual wealth advisers, cybersecurity and coding. | [26][27][28] |
| Apr 14, 2026 | Q1 2026 call: a four-bucket AI framework | Fraser sets out business strategies, end-to-end productivity, defensive capabilities (cyber, fraud, AML) and workforce implications as the structure for AI returns. | [29] |
| Feb 20, 2026 | 2025 10-K: a dedicated AI risk factor | Citi expects to integrate generative AI more broadly, 'including advanced AI capabilities, such as autonomous agents'; it also reports using AI to support governance of data in key regulatory reports and retiring 548 applications in 2025. | [9] |
| Jun 24, 2025 | Citi joins FINOS common controls for AI | FINOS launches an open-source effort to write common controls for AI services; Citi, Morgan Stanley, RBC and BMO work with AWS, Microsoft and Google Cloud, building on the cloud controls Citi led in 2023. | [12] |
Does Citi have published AI principles?
Not yet as a public document. Citi says it embeds 'responsible AI principles, risk guardrails, controls' from ideation to scale, and in April 2026 it created a head of responsible AI, Aida Filipovic, whose team is developing AI ethical principles, an AI governance model and an AI command center. Its supplier requirements do publish AI rules for vendors: legality, no merging of Citi data, and no training on Citi information without written approval.
Who is responsible for AI governance at Citi?
At board level, the Technology Committee oversees generative AI policies, practices and standards, and the full board receives reporting on AI risk management, controls, governance and adoption. In management, David Griffiths, group head of AI, leads AI strategy and governance; Aida Filipovic is head of responsible AI; business lines have their own AI leaders who build on the central platform.
How does Citi control the AI its vendors use?
Through section 19 of its supplier requirements (September 2026 version). Suppliers and subcontractors may not use AI or machine learning, including generative and agentic AI, in products or services for Citi, in performing a contract, or anywhere it could expose Citi information, unless the contract allows it; breach is a material breach. They may not train AI on Citi information without written approval and must help with algorithm audits if a regulator asks.
Are Citi's consent orders about AI?
No. The 2020 OCC and Federal Reserve orders concern enterprise risk management, compliance, data governance and internal controls; the OCC's July 2024 amendment and $75 million penalty, ended in December 2025, focused on data quality. Citi argues the same remediation, trusted data sources and firmwide control standards, is the foundation for scaling AI responsibly. The 2020 orders remain in force.
What AI risks does Citi disclose in its 10-K?
Since the 2023 10-K, that failing to embrace AI could leave Citi at a competitive disadvantage while AI without sufficient controls raises risk across all its risk categories. The 2024 and 2025 10-Ks add biased or inaccurate output, insufficient testing, manipulated prompts, inadequate human oversight and autonomous agents, AI-enabled fraud and cyberattacks, and the risk that AI productivity assumptions materialize more slowly than expected.
- Citigroup Inc. 2024 Proxy Statement (DEF 14A)
- Citigroup Inc. 2026 Proxy Statement (DEF 14A)
- Citi hires Google's director of engineering, shuffles AI leaders
- Citi Institute podcast: Evolution of AI at Google & Citi (Shobhit Varshney, Logan Kilpatrick), transcript
- Citi Requirements for Suppliers (September 2026 version), section 19: Artificial Intelligence/Machine Learning
- Citigroup Inc. Annual Report on Form 10-K for 2023
- OCC Amends Enforcement Action Against Citibank, Assesses $75 Million Civil Money Penalty
- Citi exits 2024 enforcement action, touts progress on risk management
- Citigroup Inc. Annual Report on Form 10-K for the year ended December 31, 2025
- What AI Runs On (Anand Selvakesari, Chief Operating Officer)
- Citigroup Inc. Annual Report on Form 10-K for 2024
- Banking industry, big tech unite to forge AI adoption guidelines
- Citi (C) Q3 2026 Earnings Call Transcript
- How much damage will Citi incur from its 'bad report card'?
- Banks in Asia brace for complex cyber threats from frontier AI
- Citi launches Arc to scale AI agents across the business
- A Competitive Differentiator: David Griffiths on Building the World's Most AI-empowered Financial Institution
- Citi, Ford, and Experian share their strategies for scaling AI agents
- Ant International's FalconTST Model 2.0 Achieves SOTA, Elevating Predictive AI Application in Finance to New Levels
- Major banks tap Ant International's forecasting platform FalconTST 2.0
- Introducing Feedzai Solutions - Packaged Fraud and AML Offerings
- Leading Financial Risk Management Platform Feedzai Raises $200 Million Growth Investment Led by KKR
- Citi 2026 Investor Day Transcript - Consolidated
- Citi CEO Sees 'Tsunami' of Patches in Race to Defend Against AI
- Citigroup Inc. Quarterly Report on Form 10-Q for the quarter ended June 30, 2026
- Citigroup targets stronger profitability as CEO Fraser drives overhaul
- To gain wallet share, Citi to add 400 U.S. advisors and personal bankers
- The AI Superfans Companies Count On to Convert the Skeptics
- Citi First Quarter 2026 Earnings Call transcript
When Citi moves on AI, you'll read it here first.
when one of the banks we cover moves on AI, it is in the next morning's brief · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning