FINRA imposes $250k fine on Citigroup Global Markets Inc

Citigroup Global Markets Inc (CGMI) has agreed to pay a fine of $250,000 as a part of a settlement with the Financial Industry Regulatory Authority (FINRA).

CGMI’s Personal Wealth Management (CPWM) division services retail customers and offers a range of financial planning services and investment products. The division assists retail investors with managing their portfolios by establishing investment accounts, through which the firm’s representatives can transact in equities, options, and other products on behalf of their retail clients. These accounts may be the target of cyber-events, account takeovers, identity thefts, and similar types of misconduct, which the firm terms “fraud events.”

From January 2022 to February 2023, potential fraud events for the CPWM division were reviewed initially by frontline staff, including registered representatives and support personnel. After this initial review, the staff escalated the events to the firm’s US Citigold/Citi Private Client Risk and Controls team (the Risk and Controls Team), which was responsible for reviewing and escalating potentially reportable events to the business units that handled SAR filings.

In January 2022, the firm’s AML Compliance Risk Management team proposed revisions to the Risk and Controls Team’s procedures for escalating potential fraud events.

However, due to an employee’s error, the revised procedures were not properly implemented. Specifically, the proposed revisions called for the escalation of all potential fraud events regardless of value or confirmed loss. But the implemented procedures required escalation only “when there is confirmed fraud and/or losses,” even if the events met or potentially could have met the legal criteria for a SAR filing.

As a result, the Risk and Controls Team’s personnel applied the incorrect standard when determining whether to escalate potential fraud events, including cyber-events, to the business units responsible for filing SARs, delaying the escalation of 171 potential fraud events and the filing of 88 SARs.

In February 2023, CGMI discovered the error in the Risk and Controls Team’s AML procedures as part of a self-initiated review of fraud-event escalations. CPWM promptly retrained its employees on the criteria for escalation, implemented a standard that no longer required confirmed fraud or losses, and published revised procedures in May 2023.

By failing to establish and implement policies and procedures reasonably designed to detect and cause the reporting of suspicious transactions, Respondent violated FINRA Rules 3310(a) and 2010.

In determining the appropriate sanctions in this matter, FINRA considered, among other factors, that CGMI: (i) self-identified its failure to establish and implement appropriate AML policies and procedures; (ii) initiated, prior to intervention by a regulator, a review to determine the scope of the failure; (iii) took prompt action to remediate the failure, including identifying and retroactively filing the 88 SARs, updating its procedures, retraining relevant personnel, and automating the escalation process; and (iv) provided FINRA with the results of its review.

The firm has agreed to a censure in addition to the $250,000 fine.