Citibank 2013 Annual Report Download - page 84

66
changes to the U.S. tax system, including changes to the tax treatment of
foreign business income. It is uncertain whether or when any such tax
reform proposals will be enacted into law, and whether or how they will affect
Citi’s DTAs.
Citi’s Interpretation or Application of the Extensive Tax
Laws to Which It Is Subject Could Differ from Those of the
Relevant Governmental Authorities, Which Could Result in
the Payment of Additional Taxes and Penalties.
Citi is subject to the various tax laws of the U.S. and its states and
municipalities, as well as the numerous foreign jurisdictions in which
it operates. These tax laws are inherently complex and Citi must make
judgments and interpretations about the application of these laws to its
entities, operations and businesses. Citi’s interpretations and application
of the tax laws, including with respect to withholding tax obligations and
stamp and other transactional taxes, could differ from that of the relevant
governmental taxing authority, which could result in the potential for the
payment of additional taxes, penalties or interest, which could be material.
Citi Maintains Contractual Relationships with Various
Retailers and Merchants Within Its U.S. Credit Card
Businesses in NA RCB, and the Failure to Maintain Those
Relationships Could Have a Material Negative Impact on
the Results of Operations or Financial Condition of Those
Businesses.
Through its U.S. Citi-branded cards and Citi retail services credit card
businesses within North America Regional Consumer Banking (NA RCB),
Citi maintains numerous co-branding relationships with third-party
retailers and merchants in the ordinary course of business pursuant to which
Citi issues credit cards to customers of the retailers or merchants. These
agreements provide for shared economics between the parties and ways
to increase customer brand loyalty, and generally have a fixed term that
may be extended or renewed by the parties or terminated early in certain
circumstances. These agreements could be terminated due to, among
other factors, a breach by Citi of its responsibilities under the applicable
co-branding agreement, a breach by the retailer or merchant under the
agreement, or external factors outside of either party’s control, including
bankruptcies, liquidations, restructurings or consolidations and other similar
events that may occur. While various mitigating factors could be available in
the event of the loss of one or more of these co-branding relationships, such
as replacing the retailer or merchant or by Citi’s offering new card products,
the results of operations or financial condition of Citi-branded cards or Citi
retail services, as applicable, or NA RCB could be negatively impacted, and
the impact could be material.
Citi’s Operational Systems and Networks Have Been, and
Will Continue to Be, Subject to an Increasing Risk of
Continually Evolving Cybersecurity or Other Technological
Risks, Which Could Result in the Disclosure of Confidential
Client or Customer Information, Damage to Citi’s
Reputation, Additional Costs to Citi, Regulatory Penalties
and Financial Losses.
A significant portion of Citi’s operations relies heavily on the secure
processing, storage and transmission of confidential and other information
as well as the monitoring of a large number of complex transactions on a
minute-by-minute basis. For example, through its global consumer banking,
credit card and Transaction Services businesses, Citi obtains and stores an
extensive amount of personal and client-specific information for its retail,
corporate and governmental customers and clients and must accurately
record and reflect their extensive account transactions. With the evolving
proliferation of new technologies and the increasing use of the Internet and
mobile devices to conduct financial transactions, large, global financial
institutions such as Citi have been, and will continue to be, subject to an
increasing risk of cyber incidents from these activities.
Although Citi devotes significant resources to maintain and regularly
upgrade its systems and networks with measures such as intrusion and
detection prevention systems and monitoring firewalls to safeguard critical
business applications, there is no guarantee that these measures or any
other measures can provide absolute security. Citi’s computer systems,
software and networks are subject to ongoing cyber incidents such as
unauthorized access; loss or destruction of data (including confidential
client information); account takeovers; unavailability of service; computer
viruses or other malicious code; cyber attacks; and other events. These threats
may derive from human error, fraud or malice on the part of employees or
third parties, or may result from accidental technological failure. Additional
challenges are posed by external extremist parties, including foreign state
actors, in some circumstances as a means to promote political ends. If one
or more of these events occur, it could result in the disclosure of confidential
client information, damage to Citi’s reputation with its clients and the
market, customer dissatisfaction, additional costs to Citi (such as repairing
systems, replacing customer debit or credit cards, or adding new personnel
or protection technologies), regulatory penalties, exposure to litigation and
other financial losses to both Citi and its clients and customers. Such events
could also cause interruptions or malfunctions in the operations of Citi (such
as the lack of availability of Citi’s online banking system or mobile banking
platform), as well as the operations of its clients, customers or other third
parties. Given Citi’s global footprint and the high volume of transactions
processed by Citi, certain errors or actions may be repeated or compounded
before they are discovered and rectified, which would further increase these
costs and consequences.
Citi has been subject to intentional cyber incidents from external
sources, including (i) denial of service attacks, which attempted to interrupt
service to clients and customers; (ii) data breaches, which aimed to obtain
unauthorized access to customer account data; and (iii) malicious software