Citibank 2011 Annual Report Download - page 86

64
Citi’s operational systems and networks have been, and
will continue to be, vulnerable to an increasing risk of
continually evolving cybersecurity or other technological
risks which could result in the disclosure of confidential
client or customer information, damage to Citi’s
reputation, additional costs to Citi, regulatory penalties
and financial losses.
A significant portion of Citi’s operations relies heavily on the secure
processing, storage and transmission of confidential and other information
as well as the monitoring of a large number of complex transactions on a
minute-by-minute basis. For example, through its global consumer banking,
credit card and Transaction Services businesses, Citi obtains and stores an
extensive amount of personal and client-specific information for its retail,
corporate and governmental customers and clients and must accurately
record and reflect their extensive account transactions. These activities have
been, and will continue to be, subject to an increasing risk of cyber attacks,
the nature of which is continually evolving.
Citi’s computer systems, software and networks have been and will
continue to be vulnerable to unauthorized access, loss or destruction
of data (including confidential client information), account takeovers,
unavailability of service, computer viruses or other malicious code, cyber
attacks and other events. These threats may derive from human error, fraud
or malice on the part of employees or third parties, or may result from
accidental technological failure. If one or more of these events occurs, it
could result in the disclosure of confidential client information, damage to
Citi’s reputation with its clients and the market, additional costs to Citi (such
as repairing systems or adding new personnel or protection technologies),
regulatory penalties and financial losses, to both Citi and its clients and
customers. Such events could also cause interruptions or malfunctions
in the operations of Citi (such as the lack of availability of Citi’s online
banking system), as well as the operations of its clients, customers or other
third parties. Given the high volume of transactions at Citi, certain errors
or actions may be repeated or compounded before they are discovered and
rectified, which would further increase these costs and consequences.
Citi has recently been subject to intentional cyber incidents from external
sources, including (i) data breaches, which resulted in unauthorized
access to customer account data and interruptions of services to customers;
(ii) malicious software attacks on client systems, which in turn allowed
unauthorized entrance to Citi’s systems under the guise of a client and the
extraction of client data; and (iii) denial of service attacks, which attempted
to interrupt service to clients and customers. While Citi was able to detect
these prior incidents before they became significant, they still resulted in
losses as well as increases in expenditures to monitor against the threat
of similar future cyber incidents. There can be no assurance that such
incidents, or other cyber incidents, will not occur again, and they could occur
more frequently and on a more significant scale.
In addition, third parties with which Citi does business may also be
sources of cybersecurity or other technological risks. Citi outsources
certain functions, such as processing of customer credit card transactions,
which results in the storage and processing of customer information by
third parties. While Citi engages in certain actions to reduce the exposure
resulting from outsourcing, such as limiting third-party access to the least
privileged level necessary to perform job functions and restricting third-party
processing to systems stored within Citi’s data centers, unauthorized access,
loss or destruction of data or other cyber incidents could occur, resulting in
similar costs and consequences to Citi as those discussed above. Furthermore,
because financial institutions are becoming increasingly interconnected
with central agents, exchanges and clearing houses, including through the
derivatives provisions of the Dodd-Frank Act, Citi has increased exposure to
operational failure or cyber attacks through third parties.
While Citi maintains insurance coverage that may, subject to policy terms
and conditions including significant self-insured deductibles, cover certain
aspects of cyber risks, such insurance coverage may be insufficient to cover
all losses.
Citi’s financial statements are based in part on
assumptions and estimates, which, if wrong, could cause
unexpected losses in the future, sometimes significant.
Pursuant to U.S. GAAP, Citi is required to use certain assumptions and
estimates in preparing its financial statements, including in determining
credit loss reserves, reserves related to litigation and regulatory exposures,
mortgage representation and warranty claims and the fair value of certain
assets and liabilities, among other items. If the assumptions or estimates
underlying Citi’s financial statements are incorrect, Citi may experience
significant losses. For additional information on the key areas for which
assumptions and estimates are used in preparing Citi’s financial statements,
see “Significant Accounting Policies and Significant Estimates” below, and
for further information relating to litigation and regulatory exposures, see
Note 29 to the Consolidated Financial Statements.
Citi is subject to a significant number of legal and
regulatory proceedings that are often highly complex, slow
to develop and are thus difficult to predict or estimate.
At any given time, Citi is defending a significant number of legal and
regulatory proceedings. The volume of claims and the amount of damages
and penalties claimed in litigation, arbitration and regulatory proceedings
against financial institutions remain high, and could further increase
in the future. See, for example, “—Citi is subject to extensive litigation,
investigations and inquiries pertaining to a myriad of mortgage-related
activities that could take significant time to resolve and may subject Citi to
extensive liability, including in the form of penalties and other equitable
remedies, that could negatively impact Citi’s future results of operations.”
Proceedings brought against Citi may result in judgments, settlements,
fines, penalties, disgorgement, injunctions, business improvement orders or
other results adverse to it, which could materially and negatively affect Citi’s
businesses, financial condition or results of operations, require material