The majority of the identified breaches occurred between February and November 2022, a timeframe characterized by a surge in global sanctions that overwhelmed the bank’s internal compliance infrastructure. According to the regulator, these failures were not intentional but represented material lapses across various business systems that struggled to adapt to the rapidly shifting legal landscape.

While the bank ultimately self-reported the bulk of the violations, the watchdog maintained that the aggregate scale of the errors necessitated formal action. The incident highlights the logistical strain placed on major financial institutions tasked with monitoring complex, high-volume transactions against an expanding blacklist of entities and individuals. Citibank has yet to issue a formal response regarding the penalty.