Citibank 2015 Annual Report Download - page 76

58
unavailability of service; computer viruses or other malicious code; cyber
attacks; and other events. These threats arise from numerous sources, not all
of which are in Citi’s control, including among others human error, fraud
or malice on the part of employees or third parties, accidental technological
failure, electrical or telecommunication outages, failures of computer
servers or other damage to Citi’s property or assets, natural disasters or
severe weather conditions, health emergencies or pandemics, or outbreaks of
hostilities or terrorist acts.
Additional challenges are posed by external parties, including extremist
parties and certain foreign state actors that engage in cyber activities as
a means to promote political ends. As further evidence of the increasing
and potentially significant impact of cyber incidents, during 2015, the
U.S. government as well as several multinational companies reported
cyber incidents affecting their computer systems that resulted in the data
of millions of customers and employees being compromised. In addition,
in recent years several U.S. retailers and financial institutions and other
multinational companies reported cyber incidents that compromised
customer data.
While Citi has not been materially impacted by these reported or other
cyber incidents, Citi has been subject to other intentional cyber incidents
from external sources over the last several years, including (i) denial of
service attacks, which attempted to interrupt service to clients and customers;
(ii) data breaches, which obtained unauthorized access to customer account
data; and (iii) malicious software attacks on client systems, which attempted
to allow unauthorized entrance to Citi’s systems under the guise of a client
and the extraction of client data. While Citi’s monitoring and protection
services were able to detect and respond to the incidents targeting its systems
before they became significant, they still resulted in limited losses in some
instances as well as increases in expenditures to monitor against the threat
of similar future cyber incidents. There can be no assurance that such cyber
incidents will not occur again, and they could occur more frequently and on
a more significant scale.
Although Citi devotes significant resources to implement, maintain,
monitor and regularly upgrade its systems and networks with measures
such as intrusion detection and prevention and firewalls to safeguard
critical business applications, there is no guarantee that these measures
or any other measures can provide absolute security. In addition, because
the methods used to cause cyber attacks change frequently or, in some
cases, are not recognized until launched, Citi may be unable to implement
effective preventive measures or proactively address these methods until they
are discovered.
If Citi were to be subject to a cyber incident, it could result in the
disclosure of personal, confidential or proprietary client information, damage
to Citi’s reputation with its clients and the market, customer dissatisfaction,
additional costs to Citi (such as repairing systems, replacing customer
payment cards or adding new personnel or protection technologies),
regulatory penalties, exposure to litigation and other financial losses to both
Citi and its clients and customers. Such events could also cause interruptions
or malfunctions in the operations of Citi (such as the lack of availability of
Citi’s online banking system or mobile banking platform), as well as the
operations of its clients, customers or other third parties. Given Citi’s global
footprint and the high volume of transactions processed by Citi, certain errors
or actions may be repeated or compounded before they are discovered and
rectified, which would further increase these costs and consequences.
Third parties with which Citi does business, as well as retailers and other
third parties with which Citi’s customers do business, may also be sources
of cybersecurity or other operational and technological risks, particularly
where activities of customers are beyond Citi’s security and control systems.
Citi outsources certain functions, such as processing customer credit card
transactions, uploading content on customer-facing websites, and developing
software for new products and services. These relationships allow for the
storage and processing of customer information by third-party hosting of or
access to Citi websites, which could result in service disruptions or website
defacements, a risk the confidentiality, privacy and security of data held by
third parties may be compromised and the potential to introduce vulnerable
code, resulting in security breaches impacting Citi customers. While Citi
engages in certain actions to reduce the exposure resulting from outsourcing,
such as performing onsite security control assessments and limiting third-
party access to the least privileged level necessary to perform job functions,
ongoing threats may result in unauthorized access, loss or destruction of data
or other cyber incidents with increased costs and consequences to Citi such
as those discussed above. Furthermore, because financial institutions are
becoming increasingly interconnected with central agents, exchanges and
clearing houses, including as a result of the derivatives reforms over the last
few years, Citi has increased exposure to operational failure or cyber attacks
through third parties.
While Citi maintains insurance coverage that may, subject to policy terms
and conditions including significant self-insured deductibles, cover certain
aspects of cyber risks, such insurance coverage may be insufficient to cover
all losses.
Citi’s Ability to Utilize Its DTAs, and Thus Reduce
the Negative Impact of the DTAs on Citi’s Regulatory
Capital, Will Be Driven by Its Ability to Generate
U.S. Taxable Income.
At December 31, 2015, Citi’s net DTAs were approximately $47.8 billion,
of which approximately $31.0 billion was excluded from Citi’s Common
Equity Tier 1 Capital, on a fully implemented basis, under the U.S. Basel III
rules (for additional information, see “Capital Resources—Components
of Citigroup Capital Under Basel III (Advanced Approaches with Full
Implementation)” above). In addition, of the net DTAs as of year-end 2015,
approximately $15.9 billion related to foreign tax credit carry-forwards
(FTCs). The carry-forward utilization period for FTCs is 10 years and
represents the most time-sensitive component of Citi’s DTAs. Of the FTCs at
year-end 2015, approximately $4.8 billion expire in 2018 and the remaining
$11.1 billion expire over the period of 2019-2025. Citi must utilize any FTCs
generated in the then-current year tax return prior to utilizing any carry-
forward FTCs.