Citigroup fined £61m for system breach

UK regulators fined Citigroup £61.6 million for controls failings in its trading operations, one of the biggest sanctions for systems breaches, which in one case saw the Wall Street firm cause a sudden fall in European stocks.

The Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA), the markets watchdog, both probed and fined Citigroup over the failings that spanned from April 2018 through May 2022, they said in a statement on Wednesday outlining the findings of the investigation.

The bank's London unit, Citigroup Global Markets Limited, had a series of failings that "crystallised into trading incidents", the most striking of which was a mistaken $444 billion (£348.70bn) order in May 2022.

"Firms involved in trading must have effective controls in place in order to manage the risks involved," said Sam Woods, CEO of the PRA and the Bank of England's deputy governor for prudential regulation. "CGML failed to meet the standards we expect in this area, resulting in today’s fine.

Citi on May 2, 2022 processed the $444 billion order that was meant to amount to just $58m (£45.55m), prompting $1.4bn (£1.10bn) in mistaken sell orders, according to the regulators' findings.

The PRA said the immediate cause of the trading error was a trader's mistake, known as a "fat-finger" error, but "primary control failings" resulted in Citi's electronic trading system generating erroneous orders.

The regulator said that the mistake coincided "with a material short term movement" in several European indices before the trade was cancelled.

"In particular the absence of certain preventative hard blocks and the inappropriate calibration of other controls" were behind the blunder, it said.

Citi had received "repeated supervisory communication" from the PRA to improve but weaknesses persisted and Citi's own systems had also identified problems while a series of incidents highlighted deficiencies, the regulator said.

A Citi spokesperson said the bank was "pleased to resolve this matter from more than two years ago, which arose from an individual error that was identified and corrected within minutes."

"We immediately took steps to strengthen our systems and controls, and remain committed to ensuring full regulatory compliance," the spokesperson said via email.

No hard block

Under CEO Jane Fraser, Citi has been seeking to address longstanding and widespread deficiencies in its risk management, data governance and internal controls. The failings have prompted regulatory notices in the United States from the Federal Reserve and the Office of the Comptroller of the Currency.

The main way Citi in London was set up to prevent a trader inputting an error was through a "hard block" when the system prevents a trade from going through once a certain threshold is hit. But Citi's order management system in Europe had too few of these in place, the PRA said, pointing out that Citi's equivalent trading desk in New York had hard blocks that would have prevented the order going through.

The May 2, 2022 order generated 711 alerts, 65 of which were hard blocks and the remainder "soft blocks" that traders can override - and which that day were overridden, the PRA said.

Citi also failed to monitor effectively the trades which had generated suspensions and the alerts. That was because the "first line of defence", its algorithmic system, missed them, PRA said. Then a separate Citi monitoring team was forced to hand over responsibility to another group because of staff absences, but that cover team failed to react to the alerts.

"It was in fact the trader who discovered the error and cancelled the order, approximately 15 minutes after they had entered the order. Consequently, the risk management function providing real-time monitoring of the Firm’s trades was ineffective," the PRA said.

The PRA fined Citi £33.9m for failings in its trading systems and controls, a penalty that was reduced by 30 per cent after Citi agreed to resolve the issue. The FCA said it fined Citi £27.8m.