Citi’s orders put data lineage on the safety and soundness agenda

The week

On October 7, 2020, the Office of the Comptroller of the Currency assessed a $400 million civil money penalty against Citibank and issued a cease-and-desist order. It cited long-standing deficiencies in enterprise risk management, compliance risk management, data governance and internal controls. The Federal Reserve issued a parallel order against Citigroup requiring improvements in risk management, data governance and internal controls.

The actions came weeks after an August 2020 operational error in which Citibank mistakenly sent roughly $900 million of its own funds to lenders of the cosmetics company Revlon. The episode became shorthand for weak controls around manual processes. The orders required remediation plans and, in the OCC’s case, prior approval before certain significant new acquisitions.

Earlier in this series we looked at the Capital One penalty, which was about sequencing a platform migration ahead of risk management. The Citi orders two months later reached a different layer: the data that flows through every platform. Supervisors had long raised data governance in examination letters and in reviews of regulatory reporting. In October 2020 they named it, alongside enterprise risk management and internal controls, in a cease-and-desist order with a $400 million penalty. For banks and credit unions of every size, the useful reading separates data governance into three parts that are often confused: lineage, controls on manual work, and accountability.

Lineage: knowing where numbers come from

A large bank reports thousands of data elements to supervisors, management and the board. Each figure travels from source systems through transformations, reconciliations and manual adjustments before it appears in a report. When that path is undocumented, nobody can say with confidence whether a number is right, and errors spread quietly into capital, liquidity and risk reports.

Lineage is the discipline of documenting and controlling that path. For each critical data element it answers three questions: where it originates, what happens to it along the way, and who is accountable at each step. Institutions with weak lineage tend to find problems through restatements or examiner findings rather than through their own controls.

Lineage work is expensive, so scoping matters. Few banks can trace every field. The practical approach starts with the elements that feed regulatory capital, liquidity, the allowance for credit losses and board risk reports. That is a bounded list. Tracing those end to end, and putting automated reconciliation at each handoff, covers most of the supervisory exposure.

Smaller institutions face the same logic at smaller scale. A credit union calculating its allowance, or a community bank preparing call report data, depends on a chain from core system to final figure. Often that chain passes through one person’s spreadsheet. If that person is on leave during an exam, or leaves the institution, the lineage leaves with them. Writing it down is cheap insurance against both.

Controls on manual work

In August 2020 Citibank mistakenly sent roughly $900 million of its own money to lenders of Revlon. The error was widely attributed to a manual step in a loan operations system, where an option did not behave as the people using it expected, and several reviewers approved the transaction. Whatever the precise mechanics, the pattern is common: complex legacy systems, human workarounds, and review steps that depend on screens few people fully understand.

Manual processes are not inherently dangerous. They become dangerous when undocumented, when they depend on one person’s knowledge, and when the review checks that a step happened rather than that it happened correctly. A reviewer who confirms that a box was ticked is not controlling the outcome. End-user computing tools, such as spreadsheets that feed financial or regulatory figures, sit in the same category.

Good practice is concrete. Keep an inventory of material manual processes and end-user tools. Rate each for impact and error likelihood. Design reviews around what can actually go wrong, for example by requiring the reviewer to confirm the economic result of a payment, not the form fields. Set a funded plan to automate or retire the highest-risk items, with dates.

Accountability: who owns the data

Data programs stall when data belongs to everyone and no one. Business lines create it, technology moves it, and finance and risk consume it. The Citi orders made clear that supervisors expect named accountability from the board down.

• Business data owners for critical elements, with authority to set quality standards and fix the processes that cause errors.
• Quality metrics with thresholds, such as completeness, timeliness and reconciliation breaks, reported to senior management, with breaches that trigger escalation.
• Remediation tracked as risk issues, with dates and owners, rather than as an open-ended technology backlog that competes with feature work.

Technology leaders sit in an awkward spot. They run the platforms data moves through, and they are often asked to fix quality problems that start in business processes they do not control. A clear division helps. Business owners define what correct means and fix process causes. Technology supplies lineage tooling, automated controls and monitoring. Risk and audit test whether the arrangement works. Without that division, data programs turn into technology projects that deliver catalogs and dashboards while the errors continue upstream.

The division also clarifies budgets. When data quality sits in the technology budget, it competes with every other project and loses to visible ones. When business owners carry quality metrics in their own scorecards, the cost of poor data shows up where it is created.

The standard the orders set applies at any size, scaled to complexity. The board and senior management should be able to explain how the institution knows its most important numbers are right, and produce the evidence on request.

With hindsight

Remediation proved slow. In July 2024 the OCC and the Federal Reserve again penalized Citi, a combined $135.6 million, for insufficient progress on the data management problems identified in 2020. The OCC also amended its order to require the bank to review and align its resources with the remediation work. Data governance programs at this scale take years, and supervisors measure them by outcomes, not plans.

The topic has grown in importance. Banks now want to apply AI and advanced analytics to the same data that feeds regulatory reports, and supervisors have been clear that model risk management expectations apply. An institution that cannot trace its data lineage will struggle to validate a model built on that data. The Citi orders read today as an early statement of a principle that now underpins both regulatory reporting and responsible use of AI: an institution has to know where its data came from.