Citibank 2015 Annual Report Download - page 79

61
COMPLIANCE, CONDUCT AND LEGAL RISKS
Ongoing Implementation and Interpretation of Regulatory
Changes and Requirements in the U.S. and Globally Have
Increased Citi’s Compliance Risks and Costs.
As referenced above, over the past several years, Citi has been required to
implement a significant number of regulatory changes across all of its
businesses and functions, and these changes continue. In some cases, Citi’s
implementation of a regulatory requirement is occurring simultaneously
with changing or conflicting regulatory guidance, legal challenges or
legislative action to modify or repeal final rules. Moreover, in many cases,
these are entirely new regulatory requirements or regimes, resulting in much
uncertainty regarding regulatory expectations as to what is definitely required
in order to be in compliance with the requirements. Accompanying this
compliance uncertainty is heightened regulatory scrutiny and expectations
in the U.S. and globally for the financial services industry with respect to
governance and risk management practices, including its compliance and
regulatory risks (for a discussion of heightened regulatory expectations on
“conduct risk” at, and the overall “culture” of, financial institutions such as
Citi, see “Legal Risks” below). All of these factors have resulted in increased
compliance risks and costs for Citi.
Examples of regulatory changes that have resulted in increased
compliance risks and costs include:
• The Volcker Rule required Citi to develop an extensive global compliance
regime, including developing and maintaining detailed trading and
permitted activity mandates for businesses, submitting extensive trading
information to regulatory agencies, conducting independent testing and
audit, training, recordkeeping and similar requirements and governance,
including an annual CEO attestation, beginning on March 31, 2016, with
respect to the global processes Citi has in place to achieve compliance
with the rules.
• Numerous aspects of the U.S. derivatives reform regime require extensive
compliance systems and processes to be maintained by Citi on a global
basis, including electronic recordkeeping, real-time public transaction
reporting and external business conduct requirements (e.g., required swap
counterparty disclosures).
• A proliferation of data protection and “onshoring” requirements adopted
by various non-U.S. jurisdictions, such as in Russia, South Korea,
Vietnam and Indonesia, require Citi to take measures to ensure client
data is stored or processed within national borders. These requirements
could conflict with anti-money laundering and other requirements in
other jurisdictions.
Extensive compliance requirements can result in increased reputational
and legal risks, as failure to comply with regulations and requirements, or
failure to comply as expected, can result in enforcement and/or regulatory
proceedings (for additional discussion, see “Legal Risks” below). In addition,
increased and ongoing compliance requirements and uncertainties have
resulted in higher costs for Citi. For example, Citi employed approximately
30,000 regulatory and compliance staff as of year-end 2015, out of a total
employee population of 231,000, compared to approximately 14,000 as of
year-end 2008 with a total employee population of 323,000. These higher
regulatory and compliance costs also offset Citi’s ongoing cost reduction
initiatives. For example, data protection and “onshoring” requirements
often require redundant investments in local data storage and security and
thus impede or potentially reverse Citi’s centralization or standardization
efforts, which provide expense efficiencies. Higher compliance costs may also
require management to reallocate resources, including potentially away from
ongoing business investment initiatives.
Citi Is Subject to Extensive Legal and Regulatory
Proceedings, Investigations and Inquiries That Could
Result in Significant Penalties and Other Negative Impacts
on Citi, Its Businesses and Results of Operations.
At any given time, Citi is defending a significant number of legal and
regulatory proceedings and is subject to numerous governmental and
regulatory examinations, investigations and other inquiries. The frequency
with which such proceedings, investigations and inquiries are initiated
have increased substantially over the last few years, and the global judicial,
regulatory and political environment generally remains hostile to large
financial institutions. For example, under recent guidance by the U.S.
Department of Justice (DOJ), a corporation (such as Citi) is required to
identify all individuals involved in or responsible for perceived misconduct
at issue and provide all related facts and circumstances in order to qualify
for any cooperation credit in civil and criminal investigations of corporate