CITIGROUP INC

The following discussion presents what management currently believes could be the material risks and uncertainties that could impact Citi’s businesses, results of operations and financial condition. As a large, global financial institution, Citi faces particularly complex, diverse and rapidly changing risks and uncertainties. Other risks and uncertainties, including those not currently known to Citi or its management, could also negatively impact Citi’s businesses, results of operations and financial condition. Thus, the following should not be considered a complete discussion of all of the risks and uncertainties that Citi may face. For additional information about risks and uncertainties that could impact Citi, see “Executive Summary,” “Citi’s Multiyear Transformation” and each respective business’s results of operations above and “Managing Global Risk” below. The following headings and risk factors generally align with Citi’s risk categorization, although in certain instances the risk factors may not directly correspond with how Citi categorizes or manages its risks.

MARKET-RELATED RISKS

Macroeconomic, Geopolitical and Other Challenges and Uncertainties Could Continue to Have a Negative Impact on Citi.

Citi has experienced, and could experience in the future, negative impacts to its businesses, cost of credit, results of operations and financial condition as a result of various macroeconomic, geopolitical and other challenges, uncertainties and volatility. These include, among other things:

•increases in unemployment rates, recessions or slowing economic growth in the U.S., Europe and other regions or countries

•deterioration in consumer and corporate confidence

•elevated inflation

•significant volatility and disruptions in financial markets

•government fiscal or monetary actions (see the changes to interest rates risk factor below)

For example, substantial new import tariffs and a significant increase in the U.S. effective tariff rate occurred in 2025. There can be no assurance that there will not be additional significant changes in tariff or trade policies. Potential impacts in the U.S. and globally related to trade or tariff policies could include heightened market volatility, increased economic uncertainty, adverse impacts to inflation and global economic activity, disruptions in global supply chains and trade flows, impacts on corporate profitability and credit losses, and other adverse impacts.

Additional areas of uncertainty include, among others, geopolitical challenges, tensions and conflicts, such as those related to the Russia–Ukraine war (see the emerging markets risk factor below) and conflicts in the Middle East and in other regions; economic and geopolitical challenges related to China, including weak economic growth, related policy actions, challenges in the Chinese real estate sector, banking and credit markets, trade restrictions, and tensions or conflicts

between China and Taiwan and/or China and the U.S.; high and rising government debt levels in the U.S. and other countries; sanctions; natural disasters; and pandemics.

Changes to Interest Rates Could Adversely Affect Citi’s Results of Operations.

Central banks’ decisions on key interest rates directly affect borrowing and investment costs, loan and investment returns, and the valuation of financial assets. U.S. and global interest rate levels can significantly affect Citi’s results of operations.

Interest rates on loans Citi makes are typically based off or set at a spread over a benchmark interest rate and would likely decline or rise as benchmark rates decline or rise, respectively. While interest Citi earns on its assets and pays on its liabilities generally tends to move in the same direction as changes in benchmark rates, one can decline or rise faster than the other, thereby decreasing or increasing Citi’s net interest income.

A decline in interest rates would generally be expected to result in lower net interest income for Citi, although Corporate Treasury has various tools to manage Citi’s total interest rate risk position (see “Managing Global Risk— Market Risk—Market Risk of Non-Trading Portfolios” below). Central banks’ prematurely or disproportionately lowering benchmark interest rates could result in a resurgence of inflation.

Higher interest rates can negatively impact the economy, resulting in higher unemployment and lower growth. Increases in interest rates can also adversely impact the fair value of available-for-sale (AFS) and held-to-maturity (HTM) debt securities held by Citi, and thereby Citi’s capital levels and regulatory liquidity position. Interest rate movements, as well as pricing and product competition, can also impact depositor behavior and thereby affect net interest income.

In addition, Citi’s net interest income could be adversely affected due to a flattening (a lower spread between shorter-term versus longer-term interest rates) or inversion (shorter-term interest rates exceeding longer-term interest rates) of the interest rate yield curve, as Citi typically pays interest on deposits based on shorter-term interest rates and earns money on loans based on longer-term interest rates. For additional information on Citi’s interest rate risk, see the liquidity risk factor and “Managing Global Risk—Market Risk—Banking Book Interest Rate Risk” below.

STRATEGIC RISKS

Citi’s Ability to Return Capital to Common Shareholders Substantially Depends on Regulatory Capital Requirements, Including the Results of the FRB’s Stress Testing and CCAR Regimes, and Other Factors.

Citi’s ability to return capital to its common shareholders consistent with its capital planning efforts and targets, whether through its common stock repurchase program or its common stock dividend, substantially depends, among other things, on its regulatory capital requirements. Citi is required to hold regulatory capital buffers, including a Global Systemically Important Bank (GSIB) surcharge and a Stress Capital Buffer (SCB) based upon the results of the annual CCAR process required by the FRB. For additional information on these regulatory capital buffers, see “Capital Resources—Regulatory Capital Buffers” above.

Changes in regulatory capital rules, requirements or interpretations can impact Citi’s required regulatory capital. U.S. banking regulators have proposed a number of changes to the U.S. regulatory capital framework, including significant revisions to the U.S. Basel III, GSIB and supervisory stress test rules. These changes will affect Citi’s regulatory capital requirements and position and the amount of capital Citi will be able to return to shareholders (see “Capital Resources—Regulatory Capital Standards and Developments” above).

Citi’s ability to return capital also depends on a variety of other factors, including, but not limited to, the following:

•its results of operations and financial condition

•any impact to capital from its remaining divestitures

•its ability to maintain an effective capital planning process and management framework, which takes into account forecasts of expected macroeconomic conditions and their associated impacts to the level of Citi’s regulatory capital and risk-weighted assets under both the Standardized Approach and the Advanced Approaches, as well as the Supplementary Leverage ratio (SLR)

•deferred tax asset (DTA) utilization (see the ability to utilize DTA risk factor below)

All firms subject to CCAR requirements, including Citi, are subject to a rigorous regulatory evaluation of capital planning practices and other reviews and examinations. Citi’s ability to return capital may be adversely impacted if a regulatory evaluation or examination were to result in negative findings regarding absolute capital levels or other aspects of Citi’s or any of its subsidiaries’ operations, including as a result of the imposition of additional capital buffers, limitations on capital distributions or otherwise. For information on limitations on Citi’s ability to return capital to common shareholders, as well as the CCAR process, supervisory stress test requirements and GSIB surcharge, see “Capital Resources—Current Regulatory Capital Standards,” “—Regulatory Capital Buffers” and “—Stress Testing Component of Capital Planning” above and the risk management and legal and regulatory proceedings risk factors below.

Citi Faces Ongoing Regulatory and Legislative Uncertainties and Changes in the U.S. and Globally.

Citi, its management and its businesses continue to face regulatory and legislative uncertainties and changes, both in the U.S. and globally. While the ongoing regulatory and legislative uncertainties and changes facing Citi are numerous and subject to change, examples include, but are not limited to, the following:

•potential changes to U.S. laws or regulations with respect to credit cards, including a possible cap on interest rates

•potential changes to various aspects of the U.S. regulatory capital framework and requirements applicable to Citi (see the capital return risk factor and “Capital Resources—Regulatory Capital Standards and Developments” above)

•potential fiscal, monetary, tax, sanctions and other changes promulgated by the U.S. federal government and other governments (see the macroeconomic challenges and uncertainties and changes to interest rates risk factors above)

References to “regulatory” refer to both formal regulation and the views and expectations of Citi’s regulators in their supervisory and enforcement roles, which, as they change over time, can have a major impact.

Additionally, U.S. and international regulatory and legislative initiatives have not always been undertaken or implemented on a coordinated basis, and areas of divergence have developed and continue to develop with respect to their scope, interpretation, timing, structure or approach, leading to inconsistent or even conflicting requirements, including within a single jurisdiction.

Further, ongoing regulatory and legislative uncertainties and changes make Citi’s long-term business, balance sheet and strategic planning difficult, subject to change, and potentially more costly and may impact its results of operations. U.S. and other regulators globally continue to discuss various changes to regulatory requirements, which require ongoing assessment by management as to the impact to Citi, its businesses and business planning. Business planning must necessarily be based on possible or proposed rules or outcomes, which can change significantly upon finalization, or upon implementation or interpretive guidance from numerous regulatory bodies worldwide, and such guidance can change. Regulatory and legislative changes have also significantly increased Citi’s compliance risks and costs (see the implementation and interpretation of regulatory

scrutiny and changes risk factor below) and can adversely affect Citi’s competitive position, as well as its businesses, revenues, results of operations and financial condition.

Citi May Be Unable to Achieve Its Objectives from Its Simplification, Transformation and Enhanced Business Performance Priorities.

Citi has been pursuing overall simplification initiatives to enhance its client focus and reduce expenses. Citi’s simplification initiatives, including completing its divestiture of Banamex, involve various execution challenges, may take longer than expected and may result in higher expenses, or lower than expected expense savings, CTA and other losses or other negative financial or strategic impacts, which could be material, and litigation and regulatory scrutiny (for information about CTA impacts, see the changes in or incorrect assumptions risk factor below).

As part of its multiyear transformation, Citi also continues to make significant investments and undertake substantial actions across the Company to modernize its data and

technology infrastructure, further strengthen its risk and controls environment and further enhance safety and soundness (see “Citi’s Multiyear Transformation” above and the legal and regulatory proceedings risk factor below).

Moreover, Citi continues to make business-led investments, as part of the execution of its strategic priorities. For example, Citi has been making technology and other investments across the Company, including hiring employees in key strategic markets and businesses; enhancing product capabilities and platforms to grow key businesses, improve client digital experiences and add scalability; and implementing new capabilities and partnerships.

Citi’s simplification, transformation and enhanced business performance priorities involve significant complexities and uncertainties. In addition, there is inherent risk that these initiatives will not be as productive or effective as Citi expects, or at all. Conversely, failure to adequately invest in and upgrade Citi’s technology and processes could result in Citi’s inability to be sufficiently competitive, meet regulatory expectations, serve clients effectively and avoid disruptions to its businesses, and operational errors (see the operational processes and systems and legal and regulatory proceedings risk factors below).

Citi’s ability to achieve its expected returns, including underlying expense savings, revenue growth and capital return objectives, as well as related operational improvements depends, in part, on factors that it cannot control, including, among others, macroeconomic challenges and uncertainties; customer, client and competitor actions; and ongoing regulatory requirements or changes.

Further, Citi’s simplification, transformation and enhanced business performance priorities may continue to evolve as its business strategies, including with respect to organic or inorganic growth, the market environment and regulatory expectations change, which could make the initiatives more costly and more challenging to implement, and limit their effectiveness.

Climate Change Presents Various Financial and Non-Financial Risks to Citi.

Climate change presents both immediate and long-term risks to Citi, with the risks expected to increase over time. Climate risks can arise from both physical risks and transition risks. Physical and transition risks can manifest differently across Citi’s risk categories in the short, medium and long terms.

Physical risks include acute risks, such as wildfires, tropical cyclones, heat waves, floods and droughts, as well as consequences of chronic changes in climate. For example, physical risks could have adverse financial, operational and other impacts on Citi, both directly on its business and operations, and indirectly as a result of impacts to Citi’s clients, customers, vendors and other counterparties. These impacts can include the following:

•destruction, damage or impairment of owned or leased properties and other assets

•destruction or deterioration of the value of collateral, such as real estate

•disruptions to business operations and supply chains

•reduced availability or increases in the cost of insurance

Physical risks can also impact Citi’s credit risk exposures, for example, in its mortgage and commercial real estate lending businesses.

Transition risks may arise from changes in regulations or market preferences toward low-carbon industries or sectors, which in turn could have negative impacts on asset values, results of operations or the reputations of Citi and its customers and clients, and lead to a loss of market share, lower revenues and higher credit costs.

Diverging legislative and regulatory changes and uncertainties regarding climate-related risk management and disclosures can increase Citi’s regulatory and compliance risks and costs. Furthermore, Citi may face heightened scrutiny and litigation risks stemming from its climate and sustainability commitments, disclosures and marketing.

Even as some regulators seek to mandate additional disclosure of climate-related information, Citi’s ability to comply with such requirements and conduct more robust climate-related risk analyses may be hampered by lack of information and reliable data. Data on climate-related risks is limited in availability, often based on estimated or unverified figures, collected and reported on a time-lag, and variable in quality. Modeling capabilities to analyze climate-related risks and interconnections continue to evolve.

Citi’s approach to supporting clients in their efforts to decarbonize may lead to both continued exposure to carbon-intensive activity and increased reputation risks from stakeholders with divergent points of view. Additionally, if Citi is unable to achieve some of its objectives or commitments relating to climate change, its businesses, reputation and attractiveness to certain investors or clients may suffer.

For additional information, see “Sustainability” and “Managing Global Risk—Strategic Risk—Climate Risk” below.

Citi’s Ability to Utilize Its DTAs, and Thus Reduce the Negative Impact of the DTAs on Citi’s Regulatory Capital, Will Be Driven by Its Ability to Generate U.S. Taxable Income.

At December 31, 2025, Citi’s net DTAs were $29.5 billion, net of a valuation allowance of $5.0 billion, of which $13.1 billion was deducted from Citi’s CET1 Capital under the U.S. Basel III rules. Of this deducted amount,$10.8 billion related to net operating losses, foreign tax credit and general business credit carry-forwards, with$3.1 billion related to temporary differences in excess of the 10%/15% regulatory limitations, reduced by $0.8 billion of deferred tax liabilities, primarily associated with goodwill and certain other intangible assets that were separately deducted from capital.

Citi’s ability to realize its DTAs will primarily be dependent upon its ability to generate U.S. taxable income in the relevant reversal periods. Failure to realize any portion of the net DTAs would have a corresponding negative impact on Citi’s net income and financial returns.

The accounting treatment for realization of DTAs is complex and requires significant judgment and estimates regarding future taxable earnings in the jurisdictions in which the DTAs arise and available tax planning strategies. Forecasts of future taxable earnings will depend upon various factors, including, among others, macroeconomic conditions.

For additional information on Citi’s DTAs, including FTCs, see “Significant Accounting Policies and Significant Estimates—Income Taxes” below and Notes 1 and 10.

Citi Is Subject to Complex Tax Laws, Which May Change, and Citi’s Interpretation or Application of These Complex Tax Laws Could Differ from Those of Governmental Authorities, Which Could Result in Litigation or Examinations and the Payment of Additional Taxes, Penalties or Interest.

Citi is subject to various tax laws of the U.S. and its states and municipalities, as well as the numerous non-U.S. jurisdictions in which it operates. These tax laws are inherently complex, and Citi must make judgments and interpretations about the application of these laws to its entities, operations and businesses. Moreover, these tax laws and related regulations may change, which could result in additional tax liability for Citi.

Additionally, Citi is subject to litigation or examinations with U.S. and non-U.S. tax authorities regarding tax matters. While Citi has appropriately reserved for such matters where there is a probable loss, and has disclosed reasonably possible losses, the outcome of the matters may be different than Citi’s expectations.

Citi’s interpretations or application of the tax laws, including with respect to withholding, stamp, service and other non-income taxes, as well as in connection with asset dispositions, divestitures or similar transactions, could differ from that of the relevant governmental taxing authority, which could result in the requirement to pay additional taxes, penalties or interest, the reduction of certain tax benefits or the requirement to make adjustments to amounts recorded, which could be material. See Note 30 for additional information on how Citi accrues for potential losses from tax matters.

A Deterioration in or Failure to Maintain Citi’s Co-Branding or Private Label Credit Card Relationships Could Have a Negative Impact on Citi.

Citi has co-branding and private label relationships with various retailers and merchants through its Branded Cards and Retail Services credit card businesses, whereby in the ordinary course of business Citi issues credit cards to consumers, including customers of the retailers or merchants. The five largest relationships across both businesses constituted an aggregate of approximately 12% of Citi’s revenues in 2025 (see “U.S. Personal Banking” above). Citi’s co-branding and private label agreements often provide for shared economics between the parties and generally have a fixed term.

Competition among credit card issuers, including Citi, for these relationships is significant, and Citi may not be able to maintain such relationships on existing terms or at all. Citi’s co-branding and private label relationships could also be negatively impacted by, among other things, the general economic environment, including the impacts stemming from potential increases in unemployment, inflation or interest rates or lower economic growth rates, as well as a risk of recession; changes in consumer sentiment, spending patterns and credit card usage behaviors; a decline in sales and revenues, partner store closures, any reduction in air and business travel, or other operational difficulties of the retailer or merchant;

changes in partner business strategies, including changes in products and services offered; termination or non-renewal of partner agreements, including early termination due to a contractual breach or exercise of other early termination rights; or other factors, including bankruptcies, liquidations, restructurings, consolidations or other similar events, whether due to a challenging macroeconomic environment or otherwise.

These events, particularly early termination and bankruptcies or liquidations, could negatively impact the results of operations or financial condition of Branded Cards, Retail Services or Citi as a whole, including as a result of loss of revenues, increased expenses, higher cost of credit, impairment of purchased credit card relationships and contract-related intangibles or other losses (see Note 17 for information on Citi’s credit card-related intangibles generally).

The Application of U.S. Resolution Plan Requirements May Pose a Greater Risk of Loss to Citi’s Debt and Equity Securities Holders, and Citi’s Inability in Its Resolution Plan Submissions to Address Any Shortcomings or Deficiencies or Guidance Could Subject Citi to More Stringent Capital, Leverage or Liquidity Requirements, or Restrictions on Its Growth, Activities or Operations, and Could Eventually Require Citi to Divest Assets or Operations.

Every two years, Title I of the Dodd-Frank Act requires Citi to prepare and submit a plan to the FRB and the FDIC for the orderly resolution of Citigroup (the bank holding company) and its significant legal entities under the U.S. Bankruptcy Code in the event of future material financial distress or failure.

Under Citi’s preferred “single point of entry” resolution plan strategy, only Citigroup, the parent holding company, would enter into bankruptcy, while Citigroup’s material legal entities (as defined in the public section of its 2025 resolution plan, which can be found on the FRB’s and FDIC’s websites) would remain operational outside of any resolution or insolvency proceedings. As a result, Citigroup’s losses and any losses incurred by its material legal entity subsidiaries would be imposed first on holders of Citigroup’s equity securities and thereafter on its unsecured creditors, including holders of eligible long-term debt and other debt securities.

In addition, a wholly owned, direct subsidiary of Citigroup serves as a resolution funding vehicle (the intermediate holding company, or IHC) to which Citigroup has transferred, and has agreed to transfer on an ongoing basis, certain assets. The obligations of Citigroup and of the IHC, respectively, under the amended and restated secured support agreement, are secured on a senior basis by the assets of Citigroup (other than shares in subsidiaries of the parent company and certain other assets), and the assets of the IHC, as applicable. As a result, claims of the operating material legal entities against the assets of Citigroup with respect to such secured assets are effectively senior to unsecured obligations of Citigroup. Citi’s single point of entry resolution plan strategy and the obligations under the amended and restated secured support agreement may result in the recapitalization of and/or provision of liquidity to Citi’s operating material legal entities, and the commencement of bankruptcy proceedings by Citigroup at an earlier stage of financial stress than might otherwise occur without such mechanisms in place.

In line with the FRB’s total loss-absorbing capacity (TLAC) rule, Citigroup’s shareholders and unsecured creditors—including its unsecured long-term debt holders—would bear any losses resulting from Citigroup’s bankruptcy. Accordingly, any value realized by holders of its unsecured long-term debt may not be sufficient to repay the amounts owed to such debt holders in the event of a bankruptcy or other resolution proceeding of Citigroup. For additional information on Citi’s single point of entry resolution plan strategy and the IHC and secured support agreement, see “Managing Global Risk—Liquidity Risk” below.

On November 22, 2022, the FRB and FDIC issued feedback on the resolution plans filed on July 1, 2021 by the eight U.S. GSIBs, including Citigroup. The FRB and FDIC jointly identified one shortcoming in Citigroup’s 2021 resolution plan. The shortcoming related to data integrity and data quality management issues, specifically, weaknesses in Citi’s processes and practices for producing certain data that could materially impact its resolution capabilities. On June 20, 2024, the FRB and FDIC issued feedback on the resolution plans filed on July 1, 2023 by the eight U.S. GSIBs, including Citigroup. The FRB and FDIC jointly identified one shortcoming in Citigroup’s 2023 resolution plan regarding Citi’s derivatives unwind capabilities. If a shortcoming is not satisfactorily explained or addressed before, or in, the submission of the next resolution plan, the shortcoming may be found to be a deficiency in the next resolution plan (see discussion below). Citi submitted a targeted resolution plan on July 1, 2025.

Under Title I, if the FRB and the FDIC jointly determine that Citi’s resolution plan is not “credible” (which, although not defined, is generally understood to mean the regulators do not believe the plan is feasible or would otherwise allow Citi to be resolved in a way that protects systemically important functions without severe systemic disruption), or would not facilitate an orderly resolution of Citi under the U.S. Bankruptcy Code, and Citi fails to resubmit a resolution plan that remedies any identified deficiencies, Citi could be subjected to more stringent capital, leverage or liquidity requirements, or restrictions on its growth, activities or operations. If within two years from the imposition of any such requirements or restrictions Citi has still not remediated any identified deficiencies, then Citi could eventually be required to divest certain assets or operations. Any such restrictions or actions would negatively impact Citi’s reputation, market and investor perception, operations and strategy.

Citi’s Performance Could Be Negatively Impacted if It Is Not Able to Hire and Retain Qualified Employees.

Citi’s performance and the performance of its individual businesses largely depend on the talents and efforts of its highly qualified employees. Specifically, Citi’s continued ability to compete in each of its lines of business, grow and manage its businesses effectively, as well as to execute its strategic priorities, depends on its ability to hire new employees and to retain and motivate its existing employees. If Citi is unable to continue to hire, retain and motivate highly

qualified employees, Citi’s performance, including its competitive position, the achievement of its priorities and its results of operations could be negatively impacted.

Citi’s ability to attract, retain and motivate employees depends on numerous factors, some of which are outside of Citi’s control. For example, the competition for talent continues to be particularly intense due to various factors, such as changes in worker expectations, concerns and preferences. Also, the banking industry generally is subject to more comprehensive regulation of employee compensation than other industries, including deferral and clawback requirements for incentive compensation, which can make it unusually challenging for Citi to compete in labor markets against businesses, including, for example, technology companies, that are not subject to such regulation.

Other factors that could impact Citi’s ability to attract, retain and motivate employees include, among other things, Citi’s presence in a particular market or region, the professional and development opportunities it offers and its reputation. For information on Citi’s employee and workforce management, see “Human Capital Resources and Management” below.

Citi Faces Potential Disruptions from an Evolving

Business Environment, Including Competitive Challenges and Emerging Technologies.

Citi operates in an increasingly evolving and competitive business environment, which includes both financial and non-financial services firms, such as banks and private credit, financial technology and digital asset companies, among others.

Certain competitors may be subject to different and, in some cases, less stringent legal, regulatory and supervisory requirements, whether due to size, jurisdiction, entity type or other factors, placing Citi at a competitive disadvantage. To the extent that Citi is not able to compete effectively with other financial services companies, including private credit, financial technology and digital asset companies, and non-financial services firms, or adequately assess the competitive landscape, Citi could be placed at a competitive disadvantage, which could result in loss of customers and market share, and its businesses, results of operations and financial condition could suffer. For additional information on Citi’s competitive risks, see the co-branding and private label credit cards and qualified employees risk factors above and the AI risk factor and “Supervision, Regulation and Other—Competition” below.

Citi competes with other financial services companies in the U.S. and globally that have grown rapidly over the last several years or have introduced new products and services. Mergers and acquisitions involving traditional financial services companies, such as regional banks or credit card issuers, as well as networks and merchant acquirers, may also increase competition. Non-traditional financial services firms, such as private credit, financial technology and digital asset companies, are less regulated and supervised and continue to expand their offerings of services traditionally provided by financial institutions.

Additionally, emerging technologies have the potential to accelerate disruption and intensify competition in the financial services industry. These emerging technologies, such as artificial intelligence (AI) and digital assets (including tokenized deposits, cryptocurrencies, stablecoins and other assets and products that use distributed ledger or blockchain technology) and changes in the payments space (e.g., instant and 24/7 payments) are accelerating, and, as a result, certain of Citi’s products and services could become less competitive (see the AI risk factor below).

Increased competition and emerging technologies could require Citi to change or adapt its products and services, as well as invest in and develop related infrastructure, to attract and retain customers or clients.

The U.S. administration and Congress have been

supportive of the growth and use of digital assets, including

passing legislation such as the GENIUS Act and pursuing a

more favorable regulatory approach, although the legal and

regulatory landscape remains highly uncertain. As digital

assets continue to evolve, customer demand for enhanced

offerings may increase. Failure to strategically adopt emerging

technologies may result in a competitive disadvantage to Citi.

Citi also may not be able to provide the same or similar

products and services for legal or regulatory reasons, which

may be exacerbated by rapidly evolving and conflicting

regulatory requirements.

Moreover, as Citi develops new products and services leveraging emerging technologies, new risks may emerge that, if not designed and governed adequately, may result in control gaps and in Citi operating outside of its risk appetite. For example, the use or development of emerging technologies, such as AI or digital assets, without sufficient controls, governance and risk management may result in increased risks across various risk categories (for additional information, see the AI, operational processes and systems and cybersecurity risk factors below). As another example, instant and 24/7 payments products could be accompanied by challenges to forecasting and managing liquidity, as well as increased operational and compliance risks.

Citi relies on third parties to support certain of its product and service offerings, which may put Citi at a disadvantage to competitors who may directly offer a broader array of products and services. Citi’s businesses, results of operations and reputation may suffer if any third party is unable to provide adequate support for such product and service offerings, whether due to operational incidents or otherwise (see the operational processes and systems and cybersecurity risk factors below).

The Development and Use of AI by Citi and Others Present Risks to Citi’s Businesses.

Citi has used AI and machine learning tools for many years and has more recently begun to broadly deploy Generative AI, including within its technology platforms and services. In the future, Citi expects to more broadly integrate Generative AI tools within its systems, businesses and functions, including advanced AI capabilities, such as autonomous agents and sophisticated user interactions, which if improperly managed, could result in increased risks and costs.

While Citi has policies that govern the use of emerging technologies, including in model risk management, ineffective, inadequate or faulty Generative AI development or deployment practices by Citi or third parties, including insufficient testing and monitoring, poorly structured or manipulated prompts or insufficient or inadequate human oversight, could result in adverse consequences, such as AI algorithms that produce inaccurate or incomplete output or output based on biased, incomplete and/or inaccurate datasets, infringe on intellectual property rights of others, involve data exfiltration risks, including release of confidential or proprietary information, or cause other issues, concerns or deficiencies. The complexity of AI models, particularly Generative AI models, can make it challenging to understand why particular outputs are generated, which can increase the risk of erroneous and/or biased output and complying with regulations requiring documentation, explainability or auditability on the basis of AI-influenced decisions.

Citi may also rely on AI models developed by third parties and be exposed to risks arising from their development and training methods, including potential inclusion of unauthorized material in the training data or limitations in their risk mitigation strategies, over which Citi may have limited visibility or control (see also the operational processes and systems risk factor below). While Citi may provide restrictions on use of certain data in third-party AI applications or models, a third party could breach those terms, which could expose Citi to legal and reputations risks. Citi is also exposed to risks related to the use of AI technologies by counterparties, clients and vendors, where interconnected AI systems could amplify failures and threats of cyber infiltration, as well as cause widespread disruptions.

Moreover, the use of increasingly sophisticated AI technologies by malicious actors and others has increased the risk of fraud, including identity theft and bypassing of verification controls, and exposure to cyberattacks (see the cybersecurity risk factor below), as well as disinformation and market manipulation campaigns, and failure to effectively manage such risks could result in misappropriation of funds, unauthorized transactions, exposure of sensitive client or Company information, reputational harm and increased litigation and regulatory risk.

Citi also faces competition risks to the extent that competitors may be faster and more successful in developing and deploying AI technologies to improve processes, productivity, efficiency, products and services, and thereby gain competitive advantages over Citi (see the competition risk factor above).

In addition, compliance with new or changing laws, regulations or industry standards relating to AI may impose additional operational risks and costs. Failure to sufficiently manage these risks could expose Citi to adverse legal, regulatory or reputational consequences.

OPERATIONAL RISKS

A Disruption or Failure of Citi’s Operational Processes or Systems Could Negatively Impact Its Reputation, Customers, Clients, Businesses or Results of Operations and Financial Condition.

Citi’s global operations rely heavily on its technology systems and infrastructure, including the accurate, complete, timely and secure processing, management, storage and transmission of data, including confidential transactions, and other information, as well as the monitoring of a substantial amount of data and complex transactions in real time. Citi obtains and stores an extensive amount of personal and client-specific information for its consumer and institutional customers and clients, and must accurately record and reflect their account transactions.

With the proliferation of emerging technologies, including AI and digital assets, and the use of the internet, mobile devices and cloud services to conduct financial transactions, and customers’ and clients’ increasing use of online banking and trading systems and other platforms, large global financial institutions such as Citi have been, and will continue to be, subject to an ever-increasing risk of operational loss, failure or disruption. For example, Citi’s involvement in digital assets,

including custody, asset tokenization and facilitation of clients’ digital assets activities, exposes Citi to increased operational risks due to the unique technological requirements for securing these assets.

Although Citi has continued to upgrade its technology, including systems to automate processes and gain efficiencies, operational incidents are unpredictable and can arise from numerous sources, not all of which are fully within Citi’s control. These include, among others, operational or execution failures or deficiencies by third parties that provide products or services to Citi (e.g., cloud service providers), including such third parties’ downstream service providers, as well as other Citi counterparties and market participants, which could be exacerbated by the concentration of third-party providers across the financial services industry; deficiencies in processes or controls; inadequate management of data governance practices, data controls and monitoring mechanisms that may adversely impact internal or external reporting and decision-making; cyber or information security incidents (see the cybersecurity risk factor below); human error, such as manual transaction processing errors (e.g., erroneous payments to lenders or manual errors by traders that cause system and market disruptions or losses), which can be exacerbated by staffing challenges and processing backlogs; fraud or malice on the part of employees or third parties; insufficient (or limited) straight-through processing between legacy or bespoke systems and any failure to design and effectively operate controls that mitigate operational risks associated with those legacy or bespoke systems, leading to potential risk of errors and operating losses; accidental system or technological failure; electrical or telecommunication outages; failures of or cyber incidents involving computer servers or infrastructure, including software updates and cloud services; or other similar losses or damage to Citi’s property or assets (see also the climate change risk factor above). Additionally, Citi’s ability to effectively maintain and upgrade systems and infrastructure

can become more challenging as the speed, frequency, volume, interconnectivity and complexity of transactions continue to increase.

For example, operational incidents can arise due to failures by third parties with which Citi does business, such as failures by internet, mobile technology and cloud service providers or other vendors to adequately follow procedures or processes, safeguard their systems or prevent system disruptions or cyberattacks. Failure by Citi to develop, implement and operate a third-party risk management program commensurate with the level of risk, complexity and nature of its third-party relationships can also result in operational incidents. In addition, Citi has experienced and could experience further losses associated with manual transaction processing errors, including erroneous payments to lenders or manual errors by Citi traders that cause system and market disruptions and losses for Citi and its clients. Irrespective of the sophistication of the technology utilized by Citi, there will always be a risk of human and other errors. In view of the large transactions in which Citi engages, such errors have in the past resulted, and could result, in significant losses. While Citi has change management processes in place to appropriately upgrade its operational processes and systems to ensure that any changes introduced do not adversely impact security and operational continuity, such change management can fail or be ineffective. Furthermore, when Citi introduces new products, systems or processes, new operational risks that may arise from those changes may not be identified, or adequate controls to mitigate the identified risks may not be appropriately implemented or operate as designed.

Incidents that impact information security, technology operations or other operational processes may cause disruptions and/or malfunctions within Citi’s businesses (e.g., the temporary loss of availability of Citi’s online banking system or mobile banking platform), as well as the operations of its clients, customers or other third parties. In addition, operational incidents could involve the failure or ineffectiveness of internal processes or controls. Given Citi’s global footprint and the high volume of transactions processed by Citi, certain failures, errors or actions may be repeated or compounded before they are discovered and rectified, which would further increase the consequences and costs.

Operational incidents could result in financial losses and other costs as well as misappropriation, corruption or loss of confidential and other information or assets, which could significantly negatively impact Citi’s reputation, customers, clients, employees, businesses or results of operations and financial condition, or the potential for systemic disruption due to interconnected systems and dependencies. Additionally, any unavailability or failure of backup systems could impact business continuity in the event of an operational incident. Cyber-related and other operational incidents can also result in legal and regulatory actions or proceedings, fines and other costs (see the legal and regulatory proceedings risk factor below).

Failure by Citi to continue to increase its operational resilience, and ensure that important business services and their impact tolerance time and severity scales are clearly defined, could expose Citi to service disruptions, leading to harms to Citi clients, market integrity, Citi’s reputation, financial stability or safety and soundness.

For information on Citi’s management of operational risk, see “Managing Global Risk—Operational Risk” below.

Citi’s and Third Parties’ Computer Systems and Networks Continue to Be Susceptible to an Increasing Risk of Evolving, Sophisticated Cybersecurity Incidents That Could Result in the Theft, Loss, Non-Availability, Alteration, Misuse or Disclosure of Confidential Information, Damage to Citi’s Reputation, Regulatory Penalties, Legal Exposure and Financial Losses.

Citi’s computer systems, software and networks are subject to ongoing attempted cyberattacks, as attempts to effectuate unauthorized access to, theft or destruction of data (including confidential client information), account takeovers, and disruptions of service, using techniques including phishing, malware, ransomware, computer viruses or other malicious code, exploitation of vulnerabilities, and others. These threats can arise from external parties, including cyber criminals, cyber terrorists, hacktivists and nation-state actors, as well as insiders who knowingly or unknowingly engage in or enable malicious cyber activities. For example, nation-state actors have recently targeted critical U.S. infrastructure with cyberattacks. Some cyber and information security incidents may also occur as a result of unintentional conduct on the part of employees, customers or suppliers.

Citi develops its own software and relies on third-party applications and software, which are susceptible to vulnerability exploitations. Software leveraged in financial services and other industries continues to be impacted by an increasing number of zero-day vulnerabilities, thus increasing inherent cyber risk to Citi.

The increasing use of cloud and new and emerging technologies (such as AI and digital assets), as well as connectivity solutions to facilitate remote working for Citi’s employees, all increase Citi’s exposure to cybersecurity risks. Citi is also susceptible to cyberattacks given, among other factors, its size and scale, high-profile brand, global footprint and prominent role in the financial system. Additionally, Citi continues to operate in multiple jurisdictions in the midst of geopolitical unrest or uncertainties, including, among others, those affected by the Russia–Ukraine war and the conflicts in the Middle East, which could expose Citi to heightened risk of insider threat, cyber threats from nation-state actors, hacktivism or other cyber incidents.

Citi continues to experience increased exposure to cyberattacks through third parties. Third parties with which Citi does business, as well as retailers and other third parties with which Citi’s customers do business, and any such third parties’ downstream service providers, also pose cybersecurity risks, particularly where activities of customers are beyond Citi’s security and control systems. For example, Citi outsources certain functions, such as processing customer credit card transactions, uploading content on customer-facing websites and developing software for new products and services. These relationships allow for the storage and processing of customer information by third-party hosting of, or access to, Citi websites. This could lead to compromise or the potential to introduce vulnerable or malicious code,

resulting in security breaches or business disruptions impacting Citi customers, employees or operations. While many of Citi’s agreements with third parties include indemnification provisions, Citi may not be able to recover sufficiently under these provisions, or at all, to adequately offset any losses and other adverse impacts Citi may incur from third-party cyber incidents.

Citi and some of its third-party partners have been subjected to attempted and sometimes successful cyberattacks over the last several years, including the following:

•denial of service attacks, which attempt to interrupt service to clients and customers

•hacking and malicious software installations intended to gain unauthorized access to information systems or to disrupt those systems and/or impact availability or privacy of confidential data, with objectives including, but not limited to, extortion payments or causing reputational damage

•data breaches due to unauthorized access to customer accounts or other data

•malicious software attacks on client systems, in attempts to gain unauthorized access to Citi systems or client data under the guise of normal client transactions

While Citi’s cyber and information security program has historically generally succeeded in detecting, thwarting and/or responding to attacks targeting its systems before they become significant, certain past incidents resulted in limited losses, as well as increases in expenditures to monitor against the threat of similar future cyber incidents. There can be no assurance that such cyber incidents will not occur again, and they could occur more frequently, via novel tactics, including leveraging of tools made possible by emerging technologies, and on a more significant scale.

Because the techniques used to initiate cyberattacks change frequently or, in some cases, are not recognized until deployed, Citi may be unable to implement effective preventive measures or otherwise proactively address these risks. In addition, cyber threats and cyberattack techniques change, develop and evolve rapidly, including from emerging technologies such as AI and quantum computing. Given the frequency and sophistication of cyberattacks, the determination of the severity and potential impact of a cyber incident may not become apparent for a substantial period of time following detection of the incident. Also, while Citi strives to implement measures to reduce the exposure resulting from outsourcing risks, such as performing security control assessments of third-party vendors and limiting third-party access to the least privileged level necessary to perform service functions, these measures cannot prevent all third-party-related cyberattacks or data breaches.

Cyber incidents can result in the disclosure of personal, confidential or proprietary customer, client or employee information; damage to Citi’s reputation with its clients, other counterparties and the market; customer dissatisfaction; and additional costs to Citi, including expenses such as repairing or replacing systems, replacing customer payment cards, credit monitoring or adding new personnel or protection technologies. Cyber incidents can also result in regulatory penalties, loss of revenues, deposit outflows, exposure to litigation and regulatory action and other financial losses, including loss of funds to both Citi and its clients and customers, and disruption to Citi’s operational systems (see the operational processes and systems risk factor above).

Moreover, the increasing risk of cyber incidents has resulted in increased legislative and regulatory action on cybersecurity, including, among other things, scrutiny of firms’ cybersecurity programs, laws and regulations to enhance protection of consumers’ personal data and mandated disclosure on cybersecurity matters and of certain cybersecurity incidents.

While Citi maintains insurance coverage that may, subject to policy terms and conditions including significant self-insured deductibles, transfer certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses and may not take into account reputational harm, the costs of which are impossible to quantify.

For additional information about Citi’s management of cybersecurity risk, see “Managing Global Risk—Operational Risk—Cybersecurity Risk” below.

Changes in or Incorrect Accounting Assumptions, Judgments or Estimates, or the Application of Certain Accounting Principles, Could Result in Significant Losses or Other Adverse Impacts.

U.S. GAAP requires Citi to use certain assumptions, judgments and estimates in preparing its financial statements, including, among other items, the estimate of the ACL; reserves related to litigation, regulatory and tax matters; valuation of DTAs; the fair values of certain assets and liabilities; and the assessment of goodwill and other assets for impairment. These assumptions, judgments and estimates are inherently limited because they involve techniques, including the use of historical data, that cannot anticipate or model every economic and financial outcome in the markets in which Citi operates, nor can they anticipate the specific impact and timing of such outcomes. For example, many models used by Citi include assumptions about correlation or lack thereof among prices of various asset classes or other market indicators that may not hold in times of market stress, limited liquidity or other unforeseen circumstances.

If Citi’s assumptions, judgments or estimates underlying its financial statements are incorrect or differ from actual or subsequent events, Citi could experience unexpected losses or other adverse impacts, some of which could be significant. Citi could also experience declines in its stock price, be subject to legal and regulatory proceedings and incur fines and other losses. For additional information on the key areas for which assumptions and estimates are used in preparing Citi’s financial statements, see “Significant Accounting Policies and Significant Estimates” below and Notes 1 and 16.

For example, the CECL methodology requires that Citi provide reserves for a current estimate of lifetime expected credit losses for its loan portfolios and other financial assets at the time those assets are originated or acquired. This estimate is adjusted each period for changes in expected lifetime credit losses. Citi’s ACL estimate is subject to judgments and depends upon its CECL models and assumptions, including forecasted macroeconomic conditions, which can be more

challenging to forecast during times of significant market volatility and uncertainty. These model assumptions and forecasted macroeconomic conditions will change over time, resulting in variability in Citi’s ACL and, thus, impact its results of operations and financial condition, as well as regulatory capital (see the capital return risk factor above). For additional information on Citi’s ACL, see “Significant Accounting Policies and Significant Estimates” below and Notes 1 (“Allowance for Credit Losses (ACL)”) and 16.

Moreover, Citi has incurred losses related to its foreign operations that are reported in the CTA components of Accumulated other comprehensive income (loss) (AOCI). In accordance with U.S. GAAP, a sale or other deconsolidation event of any foreign operation that results in a substantially complete liquidation of an investment in a foreign entity, such as those related to Citi’s remaining divestitures or legacy businesses, would result in reclassification of any CTA component of AOCI related to that entity, including amounts associated with related hedges and taxes, into Citi’s earnings. For example, during the quarter in which a deconsolidation of Banamex occurs, Citi would incur a CTA loss of approximately ($9) billion, attributable to Banamex and its consolidated subsidiaries as of December 31, 2025, recognized through earnings, although the cumulative impact of the CTA would be regulatory capital neutral (for additional information, see “All Other” above). For additional information on Citi’s accounting policy for foreign currency translation and its foreign CTA components of AOCI, see Notes 1 (“Foreign Currency Translation”) and 21.

Changes to Financial Accounting and Reporting Standards or Interpretations Could Have a Material Impact on How Citi Records and Reports Its Financial Condition and Results of Operations.

Changes to financial accounting or reporting standards or interpretations, whether promulgated or required by the Financial Accounting Standards Board (FASB), the SEC, U.S. banking regulators or others, could present operational challenges and could require Citi to change certain of the assumptions or estimates it previously used in preparing its financial statements, which could negatively impact how it records and reports its financial condition and results of operations generally and/or with respect to particular businesses. For example, the FASB issues financial accounting and reporting standards that govern key aspects of Citi’s financial statements or interpretations thereof when those standards become effective, including those areas where Citi is required to make assumptions or estimates. See “Significant Accounting Policies and Significant Estimates” below and Note 1 for additional information on Citi’s accounting policies (“Summary of Significant Accounting Policies”) and changes in accounting (“Accounting Changes”), including the expected impacts on Citi’s results of operations and financial condition.

If Citi’s Risk Management and Other Processes or Strategies Are Deficient or Ineffective, Citi May Incur Significant Losses and Its Regulatory Capital and Capital Ratios Could Be Negatively Impacted.

Citi utilizes a broad and diversified set of risk management and other processes and strategies, including the use of models, in analyzing and monitoring the various risks Citi assumes in conducting its activities. Citi also relies on data to assess and manage various risk exposures. Unexpected losses can result from untimely, inaccurate or incomplete risk management processes and data.

In addition, Citi’s risk management and other processes and strategies, including models, are inherently limited because they involve techniques, including the use of historical data in many circumstances, assumptions and judgments that cannot anticipate every economic and financial outcome in the markets in which Citi operates, particularly given various macroeconomic, geopolitical and other challenges and uncertainties (see the macroeconomic challenges and uncertainties risk factor above), nor can they anticipate the specifics and timing of such outcomes. For example, many models used by Citi include assumptions about correlation or lack thereof among prices of various asset classes or other market indicators that may not necessarily hold in times of market stress, limited liquidity or other unforeseen circumstances, or identify changes in markets or client behaviors not yet inherent in historical data.

Citi could incur significant losses, receive negative regulatory evaluation or examination findings or be subject to additional enforcement actions, and its regulatory capital, capital ratios and ability to return capital could be negatively impacted, if Citi’s risk management and other processes, including its ability to manage and aggregate data in a timely and accurate manner, strategies or models are deficient or ineffective (for additional information, see the capital return risk factor above and the regulatory scrutiny and changes and the legal and regulatory proceedings risk factors below). Such deficiencies or ineffectiveness could also result in inaccurate financial, regulatory or risk reporting.

Moreover, Citi’s Basel III regulatory capital models, including its credit, market and operational risk models, are subject to ongoing regulatory review and approval, which may result in refinements, modifications or enhancements (required or otherwise) to these models. Modifications or requirements resulting from these ongoing reviews, as well as any future changes or guidance provided by the U.S. banking regulators regarding the U.S. regulatory capital framework applicable to Citi, including, but not limited to, potential revisions to the U.S. Basel III rules (see the capital return risk factor and “Capital Resources—Regulatory Capital Standards and Developments” above), have resulted, and could continue to result, in significant changes to Citi’s risk-weighted assets. These changes can impact Citi’s capital ratios and its ability to meet its regulatory capital requirements.

CREDIT RISKS

Credit Risk and Concentrations of Risk Can Increase the Potential for Citi to Incur Significant Losses.

Citi has credit exposures to consumer, corporate and public sector borrowers and other counterparties in the U.S. and various countries and jurisdictions globally, including:

•end-of-period consumer loans of $409 billion

•end-of-period corporate loans of $344 billion at December 31, 2025

A default by or a significant downgrade in the credit ratings of a consumer or corporate borrower or other counterparty, or a decline in the credit quality or value of any underlying collateral, exposes Citi to credit risk. Additionally, despite Citi’s target client strategy, various macroeconomic, geopolitical, market and other factors, among other things, can increase Citi’s consumer and corporate credit risk and credit costs, particularly for vulnerable sectors, industries or countries (see the macroeconomic challenges and uncertainties and co-branding and private label credit cards risk factors above and the emerging markets risk factor below). For example, a weakening of economic conditions, including increases in unemployment rates, can adversely affect borrowers’ ability to repay their obligations, as well as result in Citi’s inability to liquidate the collateral it holds or forced to liquidate the collateral at prices that do not cover the full amount owed to Citi.

For additional information on Citi’s corporate and consumer loan portfolios, see “Managing Global Risk—Corporate Credit” and “—Consumer Credit” below. For information on Citi’s credit and country risk, see also each respective business’s results of operations above and

and Notes 15 and 16.

Citi is also a member of various central clearing counterparties and could incur financial losses as a result of defaults by other clearing members due to the requirements of clearing members to share losses. Additionally, systemic risks, including from leveraged finance, non-bank financial institutions, private credit and AI, could increase Citi’s credit costs.

While Citi provides reserves for expected losses for its credit exposures, as applicable, such reserves are subject to judgments and estimates that could be incorrect or differ from actual future events. For additional information, including on the CECL methodology, see the changes in or incorrect assumptions risk factor above.

Concentrations and/or high correlation of risk to clients or counterparties engaged in the same or related industries or doing business in a particular geography, or to a particular product or asset class, especially credit and market risks, can also increase Citi’s risk of significant losses. For example, due to the interconnectedness among financial institutions, concerns about the creditworthiness of or defaults by a financial institution could spread to other financial market participants and result in market-wide losses and disruption. Citi also routinely executes a high volume of securities, trading, derivative and foreign exchange transactions with non-U.S. sovereigns and with counterparties in the financial services industry, including banks, insurance companies, investment banks, governments, central banks and other financial institutions. Moreover, Citi has indemnification obligations in connection with various transactions that expose it to concentrations of risk, including credit risk from hedging or reinsurance arrangements related to those obligations (see Note 28). A rapid deterioration of a large borrower or other counterparty or within a sector or country in which Citi has large exposures or indemnifications or unexpected market dislocations could lead to concerns about the creditworthiness of other borrowers or counterparties in a certain geography and in related or dependent industries, and such conditions could cause Citi to incur significant losses.

LIQUIDITY RISKS

Citi’s Businesses, Results of Operations and Financial Condition Could Be Negatively Impacted if It Does Not Effectively Manage Its Liquidity.

As a large, global financial institution, adequate liquidity and sources of funding are essential to Citi. Citi’s liquidity, sources of funding and costs of funding can be significantly and negatively impacted by factors it cannot control, such as general disruptions in the financial markets; changes in fiscal and monetary policies; regulatory requirements, including changes in regulations; negative investor or counterparty perceptions of Citi’s creditworthiness; deposit outflows or unfavorable changes in deposit mix; unexpected increases in cash or collateral requirements; credit ratings; and the consequent inability to monetize available liquidity resources.

Additionally, Citi competes with other banks and non-bank financial institutions for both institutional and consumer deposits, which represent Citi’s most stable and lowest cost source of long-term funding. The competition for deposits has continued to increase in recent years, including as a result of fixed income alternatives for customer funds.

Citi’s costs to obtain and access wholesale funding are directly related to changes in interest and currency exchange rates and its credit spreads. Changes in Citi’s credit spreads are driven by both external market factors and factors specific to Citi, such as negative views by investors of the financial services industry or Citi’s financial prospects, and can be highly volatile. For additional information on Citi’s primary sources of funding, see “Managing Global Risk—Liquidity Risk” below.

Citi’s ability to obtain funding may be impaired and its cost of funding could also increase if other market participants are seeking to access the markets at the same time or to a greater extent than expected, or if market appetite for corporate debt securities declines, as is likely to occur in a liquidity stress event or other market crisis. In such circumstances, Citi’s ability to sell assets may also be impaired if other market participants are seeking to sell similar assets at the same time or a liquid market does not exist for such assets. Additionally, unexpected changes in client needs due to idiosyncratic events or market conditions could result in greater than expected drawdowns from off-balance sheet committed facilities. A sudden drop in market liquidity could also cause a temporary or protracted dislocation of capital

markets activity. In addition, clearing organizations, central banks, clients and financial institutions with which Citi interacts may exercise the right to require additional collateral during challenging market conditions, which could further impair Citi’s liquidity. If Citi fails to effectively manage its liquidity, its businesses, results of operations and financial condition could be negatively impacted.

Limitations on the payments that Citigroup Inc. receives from its subsidiaries could also impact its liquidity. As a holding company, Citigroup Inc. relies on interest, dividends, distributions and other payments from its subsidiaries to fund dividends as well as to satisfy its debt and other obligations. Several of Citi’s U.S. and non-U.S. subsidiaries are or may be subject to capital adequacy or other liquidity, regulatory or contractual restrictions on their ability to provide such payments, including any local regulatory stress test requirements and inter-affiliate arrangements entered into in connection with Citigroup Inc.’s resolution plan. Citigroup Inc.’s broker-dealer and bank subsidiaries are subject to restrictions on their ability to lend or transact with affiliates, as well as restrictions on their ability to use funds deposited with them in brokerage or bank accounts to fund their businesses.

A bank holding company is also required by law to act as a source of financial and managerial strength for its subsidiary banks. As a result, the FRB may require Citigroup Inc. to commit resources to its subsidiary banks even if doing so is not otherwise in the interests of Citigroup Inc. or its shareholders or creditors, reducing the amount of funds available to meet its obligations.

A Ratings Downgrade Could Adversely Impact Citi’s Funding and Liquidity.

The credit rating agencies, such as Fitch Ratings, Moody’s Ratings and S&P Global Ratings, continuously evaluate Citi and certain of its subsidiaries. Their ratings of Citi and its rated subsidiaries’ long-term debt and short-term obligations are based on firm-specific factors, including the financial strength of Citi and such subsidiaries, as well as factors that are not entirely within the control of Citi and its subsidiaries, such as the agencies’ proprietary rating methodologies and assumptions, potential impact from negative actions on U.S. sovereign ratings and conditions affecting the financial services industry and markets generally.

A ratings downgrade could result from, among other factors, declines in profitability, reductions in regulatory capitalization levels, deterioration in Citi’s funding structure or liquidity, significant increases in risk appetite, delays or missteps in Citi’s transformation efforts, public statements by Citi’s management or regulators or control failures.

A ratings downgrade could negatively impact Citi and its rated subsidiaries’ ability to access the capital markets and other sources of funds as well as increase credit spreads and the costs of those funds. A ratings downgrade could also have a negative impact on Citi and its rated subsidiaries’ ability to obtain funding and liquidity due to reduced funding capacity and the impact from derivative triggers, which could require Citi and its rated subsidiaries to meet cash obligations and collateral requirements or permit counterparties to terminate certain contracts. In addition, a ratings downgrade could have a negative impact on other funding sources such as secured financing and other margined transactions for which there may be no explicit triggers.

Furthermore, a credit ratings downgrade could have impacts that may not be currently known to Citi or are not possible to quantify. Some of Citi’s counterparties and clients could have ratings limitations on their permissible counterparties, of which Citi may or may not be aware. Certain of Citi’s corporate customers and trading counterparties, among other clients, could re-evaluate their business relationships with Citi and limit the trading of certain market instruments, and limit or withdraw deposits placed with Citi in response to ratings downgrades. Changes in customer and counterparty behavior could impact not only Citi’s funding and liquidity but also the results of operations of certain Citi businesses. For additional information on the potential impact of a reduction in Citi’s or Citibank’s credit ratings, see “Managing Global Risk—Liquidity Risk—Potential Impacts of Ratings Downgrades” below.

COMPLIANCE RISKS

Regulatory Expectations and Scrutiny in the U.S. and Globally as well as Ongoing Interpretation and Implementation of Regulatory and Legislative Requirements and Changes Subject Citi to Significant Compliance, Regulatory and Other Risks and Costs.

Large financial institutions, such as Citi, face significant regulatory and supervisory expectations and scrutiny in the U.S. and globally, including with respect to, among other things, infrastructure, data and risk management practices and controls. These regulatory and supervisory expectations extend to employees and agents and also include, among other things, those related to anti-money laundering; increasingly complex sanctions regimes; customer and client protection; market practices; and various disclosure and regulatory reporting requirements.

Citi is also continually required to interpret and implement extensive and frequently changing regulatory and legislative requirements within the U.S. and in other jurisdictions in which it does business, which may overlap or conflict across jurisdictions, resulting in substantial compliance, regulatory and other risks and costs.

A failure to comply with regulatory requirements or expectations, even if inadvertent, or resolve any identified deficiencies in a timely and sufficiently satisfactory manner to regulators, could result in increased regulatory oversight; material restrictions, including, among others, imposition of additional capital buffers and limitations on capital distributions; enforcement proceedings; penalties; and fines (see the capital return risk factor above and legal and regulatory proceedings risk factor below).

Moreover, over the past several years, Citi has been required to implement a large number of regulatory, supervisory and legislative changes, including new regulatory, supervisory or legislative requirements or regimes, across its businesses and functions, and these changes continue. The changes themselves may be complex and subject to interpretation, and result in changes to Citi’s businesses. In addition, the changes require continued substantial technology and other investments. In some cases, Citi’s implementation of

a regulatory or legislative requirement is occurring simultaneously with changing or conflicting regulatory guidance from multiple jurisdictions (including various U.S. states) and regulators, legal challenges or legislative action to modify or repeal existing rules or enact new rules.

Examples of regulatory or legislative changes that have resulted in increased compliance risks and costs include (i) the U.S. regulatory capital framework and requirements, which have continued to evolve (see the capital return risk factor and “Capital Resources” above); and (ii) various laws relating to the limitation of cross-border data movement and/or collection and use of customer information, including data localization and protection and privacy laws, which also can conflict with or increase compliance complexity with respect to other laws, including anti-money laundering laws.

Citi Is Subject to Extensive Legal and Regulatory Proceedings, Examinations, Investigations, Consent Orders and Related Compliance Efforts and Other Inquiries That Have in the Past and Could in the Future Result in Large Monetary Penalties, Supervisory or Enforcement Orders, Business Restrictions, Limitations on Dividends, Changes to Directors and/or Officers and Collateral Consequences Arising from Such Outcomes.

Citi’s regulators have broad powers and discretion under their prudential and supervisory authority, and have pursued active inspection and investigatory oversight. At any given time, Citi is a party to a significant number of legal and regulatory proceedings and is subject to numerous governmental and regulatory examinations. Additionally, Citi remains subject to governmental and regulatory investigations, consent orders (see discussion below) and related compliance efforts, and other inquiries. Citi could also be subject to enforcement proceedings and negative regulatory evaluation or examination findings not only because of violations of laws and regulations, but also due to failures, as determined by its regulators, to remedy deficiencies on a timely basis (see also the capital return and resolution plan risk factors above). Under U.S. banking law, Citi is prohibited from disclosing confidential supervisory information, and may therefore be unable to disclose even potentially material regulatory or supervisory matters. Citi could face further scrutiny and consequences from regulators for failing to timely resolve open regulatory issues or having repeat regulatory issues.

As previously disclosed, the 2020 FRB Consent Order and the 2020 OCC Consent Order require Citigroup and Citibank, respectively, to implement extensive targeted action plans and submit quarterly progress reports on a timely and sufficient basis detailing the results and status of improvements relating principally to various aspects of enterprise-wide risk management, compliance, data quality management related to governance, and internal controls. These improvements will require continued significant investments by Citi during 2026 and beyond, as an essential part of Citi’s broader transformation efforts (see the simplification, transformation and enhanced business performance priorities risk factor above). Further, in 2024, the FRB entered into a Civil Money Penalty Consent Order with Citigroup, and the OCC entered into a Civil Money Penalty Consent Order with Citibank. The FRB found that Citigroup had ongoing deficiencies related to its data quality management program and had inadequate measures for managing and controlling its data quality risks. The OCC found that Citibank had failed to make sufficient and sustainable progress toward achieving compliance with its 2020 Consent Order. There can be no assurance that efforts by Citi to address the deficiencies and resolve the OCC and FRB Consent Orders will occur in a manner satisfactory, in both timing and sufficiency, to the FRB and OCC. (For additional information, see “Citi’s Multiyear Transformation” above.)

Although there are no restrictions on Citi’s ability to serve its clients, the OCC Consent Order requires Citibank to obtain prior approval of any significant new acquisition, including any portfolio or business acquisition, excluding ordinary course transactions.

Moreover, the OCC Consent Order provides that the OCC has the right to assess future civil money penalties or take other supervisory and/or enforcement actions. Such actions by the OCC could include imposing business restrictions, including possible additional limitations on the declaration or payment of dividends by Citibank and changes in directors and/or senior executive officers. More generally, the OCC and/or the FRB could again take enforcement or other actions if the regulatory agency believes that Citi has not met regulatory expectations regarding compliance with the consent orders.

Large financial institutions face a challenging global judicial, regulatory and political environment. The complexity of the federal and state regulatory and enforcement regimes in the U.S., coupled with the global scope of Citi’s operations, also means that a single event or issue may give rise to a large number of overlapping investigations and regulatory proceedings, either by multiple federal and state agencies and authorities in the U.S. or by multiple regulators and other governmental entities in foreign jurisdictions, as well as multiple civil litigation claims in multiple jurisdictions. Violations of law by other financial institutions may also result in regulatory scrutiny of Citi. Responding to regulatory inquiries and proceedings can be time consuming and costly, and divert management attention from Citi’s businesses.

U.S. and non-U.S. regulators have focused on the culture of financial services firms, including Citi, as well as “conduct risk,” a term used to describe the risks associated with behavior by employees and agents, including third parties, that could harm clients, customers, employees or the integrity of the markets, such as improperly creating, selling, marketing or managing products and services, failures to safeguard a party’s personal information or failures to identify and manage conflicts of interest.

Scrutiny and expectations from regulators could lead to investigations and other inquiries, as well as remediation requirements, regulatory restrictions, structural changes, more regulatory or other enforcement proceedings, civil litigation and higher compliance and other risks and costs. For additional information, see the capital return and regulatory scrutiny and changes risk factors above. Further, while Citi takes numerous steps to prevent and detect conduct by employees and agents that could potentially harm clients, customers, employees or the integrity of the markets, such behavior may not always be deterred or prevented.

Moreover, the severity of the remedies sought in legal and regulatory proceedings to which Citi is subject has remained elevated. Citi may be required to accept or be subject to remedies, consent orders, sanctions, substantial fines and penalties, remediation and other financial costs or other requirements in the future, including for matters or practices not yet known to Citi, any of which could materially and negatively affect Citi’s businesses, business practices, financial condition or results of operations, require material changes in Citi’s operations or cause Citi substantial reputational harm.

Additionally, many large claims—both private civil and regulatory—asserted against Citi are highly complex, slow to develop and may involve novel or untested legal theories. The outcome of such proceedings is difficult to predict or estimate until late in the proceedings. Although Citi establishes accruals for its legal and regulatory matters according to accounting requirements, Citi’s estimates of, and changes to, these accruals involve significant judgment and may be subject to significant uncertainty, and the amount of loss ultimately incurred in relation to those matters may be substantially higher than the amounts accrued (see the changes in or incorrect assumptions risk factor above). In addition, certain settlements are subject to court approval and may not be approved. Furthermore, regulators may be more likely to pursue investigations or proceedings against financial institutions, such as Citi, that have previously been the subject of other regulatory actions.

For further information on Citi’s legal and regulatory proceedings, see Note 30.

OTHER RISKS

Citi’s Emerging Markets Presence Subjects It to Various Risks as well as Increased Compliance and Regulatory Risks and Costs.

During 2025, emerging markets revenues accounted for approximately 25% of Citi’s total revenues. Citi’s presence in the emerging markets subjects it to various risks.

Citi’s emerging markets risks include, among others, limitations or unavailability of hedges on foreign investments; foreign currency volatility, including devaluations; central bank interest rate and other monetary policies; macroeconomic, geopolitical and domestic political challenges, uncertainties and volatilities; foreign exchange controls, including an inability to access indirect foreign exchange mechanisms; cyberattacks; restrictions arising from retaliatory laws and regulations; sanctions or asset freezes; sovereign debt volatility; fluctuations in commodity prices; limitations on foreign investment; sociopolitical instability; nationalization or loss of licenses; potential criminal charges; closure of branches or subsidiaries; and confiscation of assets; and these risks can be exacerbated in the event of a deterioration in the relationship between the U.S. and an emerging market country.

For example, Citi operates in several countries that have strict capital controls, currency controls and/or sanctions that limit its ability to convert local currency into U.S. dollars and/or transfer funds outside of those countries. As a result, Citi might need to record additional translation losses due to these or other currency controls. Moreover, Citi could be required to adjust its reserves for expected losses for its credit exposures based on the transfer risk associated with exposures outside the U.S., driven by safety and soundness considerations under U.S. banking law (see “Significant Accounting Policies and Significant Estimates” below and Note 1).

Moreover, the Russia–Ukraine war could have further negative impacts on macroeconomic conditions, financial markets and commodities prices, adversely impacting Citi and its customers, clients or employees. For additional information about these Russia-related risks, see the macroeconomic challenges and uncertainties and cybersecurity risk factors above.

Emerging markets risks may adversely impact Citi’s businesses, results of operations and financial condition in those countries where Citi operates and have required, and may continue to require, management time and attention and other resources.

SUSTAINABILITY

Citi and its clients face escalating global environmental and social challenges, including climate change and the energy transition. Citi’s net zero approach and sustainable finance activity include the Company’s work to support clients in financing their transition to low-carbon business models, as well as broader energy security priorities, including access to affordable energy in emerging markets. Citi recognizes that energy transition, energy security and economic growth are not mutually exclusive and must be addressed simultaneously.

The “Citi Climate Report” provides additional information on Citi’s continued progress to manage climate risk and its net zero approach, including information on financed and facilitated emissions and 2030 interim emissions reduction targets. Citi’s “Sustainability Report” provides information on its $1 Trillion Sustainable Finance Goal, including sustainable finance products and services that Citi provides to its clients to support their sustainability objectives. For additional information on Citi’s environmental and social policies and priorities, click on “Our Impact” on Citi’s website at www.citigroup.com. Climate and sustainability reporting and any other environmental and social governance-related reports and information included elsewhere on Citi’s website are not incorporated by reference into, and do not form any part of, this Form 10-K.

For information regarding Citi’s management of climate risk, see “Managing Global Risk—Strategic Risk—Climate Risk” below.

HUMAN CAPITAL RESOURCES AND MANAGEMENT

At December 31, 2025, Citi had approximately 226,000 full-time employees, compared to approximately 229,000 at December 31, 2024. Citi has employees in over 90 countries, across all of its segments. Approximately 31% are based in the U.S.

Attracting and retaining highly qualified and motivated employees is a strategic priority. Citi seeks to enhance the competitive strength of its workforce through:

•continuously innovating its efforts to recruit, train, develop, compensate, promote and engage employees

•actively seeking and listening to diverse perspectives at all levels of the organization

•providing compensation programs that are competitive in the market and aligned to strategic objectives

Citi values pay transparency and has introduced market-based salary structures and bonus opportunity guidelines in various countries worldwide, and posts salary ranges on all external U.S. job postings, which align with Citi’s commitment to pay equity and transparency. In addition, Citi has focused on measuring and addressing pay equity within the organization. Citi’s annual pay equity analysis for 2025 determined that on an adjusted basis, global gender and U.S. racial base pay gaps are in each case less than 1%. The raw pay gap analysis determined that the median base pay for women globally is 81% of the median for men globally and the U.S. racial base pay gap is less than 1%. The adjusted pay gap is a true measure of pay equity, or “like for like,” that compares the compensation of women to men and U.S. minorities to non-minorities when adjusting for factors such as job function, title/level and geography.

Citi employs numerous initiatives in managing its workforce to drive a culture of excellence and accountability, reinforce its values, encourage career growth, foster pay transparency and equity and provide a wide range of benefits that support its employees’ mental, social, physical and financial well-being.

(1) For additional information regarding certain credit risk, market risk and other quantitative and qualitative information, refer to

Citi’s Pillar 3 Basel III Advanced Approaches Disclosures, as required by the U.S. Basel III disclosure requirements, on Citi’s

Investor Relations website. These Pillar 3 disclosures are not incorporated by reference into, and do not form any part of, this

Form 10-K.

For Citi, effective risk management is of primary importance to its overall operations. Accordingly, Citi has established an Enterprise Risk Management (ERM) Framework to ensure that Citi’s risks are managed appropriately and consistently across the Company and at an aggregate, enterprise-wide level. Citi’s culture drives a strong risk and control environment and is at the heart of the ERM Framework, underpinning the way Citi conducts business. The activities that Citi engages in, and the risks those activities generate, must be consistent with Citi’s Mission and Value Proposition (see below) and the key Leadership Principles that support it, as well as Citi’s risk appetite. As discussed above, Citi also continues its efforts to comply with the 2020 FRB and OCC Consent Orders, relating principally to various aspects of risk management, compliance, data quality management related to governance, and internal controls (see “Citi’s Multiyear

Transformation—FRB and OCC Consent Orders

Compliance” and “Risk Factors—Compliance Risks” above).

Under Citi’s Mission and Value Proposition, which was developed by its senior leadership and distributed throughout the Company, Citi strives to serve its clients as a trusted partner by responsibly providing financial services that enable growth and economic progress while earning and maintaining the public’s trust by constantly adhering to the highest ethical standards. As such, Citi asks all employees to ensure that their decisions pass three tests: they are in Citi’s clients’ best interests, create economic value and are always systemically responsible.

Citi has designed Leadership Principles that represent the qualities, behaviors and expectations all employees must exhibit to deliver on Citi’s mission of enabling growth and economic progress. The Leadership Principles inform Citi’s ERM Framework and contribute to creating a culture that drives client, control and operational excellence. Citi employees share a common responsibility to uphold these Leadership Principles and hold themselves to the highest standards of ethics and professional behavior in dealing with Citi’s clients, business colleagues, shareholders, communities and each other.

Citi’s ERM Framework details the principles used to support effective enterprise-wide risk management across the end-to-end risk management lifecycle. The underlying pillars of the framework encompass:

•Culture—the core principles and behaviors that underpin a strong culture of risk awareness, in line with Citi’s Mission and Value Proposition, and Leadership Principles;

•Governance—the committee structure and reporting arrangements that support the appropriate oversight of risk management activities at the Board and Executive Management Team levels and Citi’s Lines of Defense model;

•Risk Management—the end-to-end risk management cycle including the identification, measurement, monitoring, controlling and reporting of all material risks; and

•Enterprise Programs—the key risk management programs performed across the risk management lifecycle for all risk categories.

Each of these pillars is underpinned by supporting capabilities covering people, infrastructure and tools that are in place to enable the execution of the ERM Framework. Controls are established to mitigate the risks associated with the execution of these pillars and supporting capabilities.

Citi’s approach to risk management requires that its risk-taking be consistent with its risk appetite. Risk appetite is the aggregate level of risk that Citi is willing to tolerate in order to achieve its strategic objectives and business plan. Risk limits and thresholds represent allocations of Citi’s risk appetite to businesses and risk categories. Concentration risks are controlled through a subset of these limits and thresholds.

Citi’s risks are generally categorized and summarized as follows:

•Credit risk is the risk of loss resulting from the decline in credit quality (or downgrade risk) or failure of a borrower, counterparty, third party or issuer to honor its financial or contractual obligations.

•Liquidity risk is the risk that Citi will not be able to efficiently meet its financial obligations as they become due without adversely impacting its daily operations or overall financial condition. This risk can be exacerbated by the Company’s inability to access necessary funding sources or to monetize assets in a timely and orderly manner.

•Market risk(trading and non-trading): Market risk of trading portfolios is the risk of economic or trading loss arising from changes in the value of Citi’s assets and liabilities resulting from changes in market variables, such as interest rates, equity and commodity prices, foreign exchange rates or credit spreads. Market risk of non-trading portfolios is the impact of adverse changes in market variables such as interest rates, foreign exchange rates, credit spreads and equity prices on positions accounted for as part of Citi’s net interest income, economic value of equity or AOCI.

•Operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. Operational risk includes legal risk, but excludes strategic and reputation risks (see below).

•Compliance risk is the risk to current or projected financial conditions and resilience arising from violations of laws, rules or regulations, or from non-conformance with prescribed practices, internal policies and procedures or ethical standards.

•Reputation risk is the risk to current or projected financial conditions and resilience from negative opinion held by stakeholders. This risk may impair Citi’s competitiveness by affecting its ability to establish new relationships or services or continue servicing existing relationships.

•Strategic risk is the risk of a sustained impact to Citi’s core strategic objectives as measured by impacts on anticipated earnings, market capitalization or capital, arising from the external factors affecting the Company’s operating environment, as well as the risks associated with defining and executing the strategy.

Additionally, Citi categorizes and summarizes risks that span the above risk categories, such as concentration risk, country risk and climate risk.

Citi uses a lines of defense model as a key component of its ERM Framework to manage its risks. As discussed below, the lines of defense model brings together risk-taking, risk oversight and risk assurance under one umbrella and provides an avenue for risk accountability of the first line of defense, a construct for effective challenge by the second line of defense (Independent Risk Management and Independent Compliance Risk Management), and empowers independent risk assurance by the third line of defense (Internal Audit). In addition, the lines of defense model includes organizational units tasked with supporting a strong control environment (enterprise support functions).

First Line of Defense

Citi’s first line of defense owns the risks and associated controls inherent in, or arising from, the execution of its business activities and is responsible for identifying, measuring, monitoring, controlling and reporting those risks consistent with Citi’s strategy, Mission and Value Proposition, Leadership Principles and risk appetite.

The first line of defense is composed of Citi’s operating segments (i.e., Services, Markets, Banking, Wealth, U.S. Personal Banking as of December 31, 2025), as well as International, North America and All Other (including certain corporate functions (i.e., Chief Operating Office, Enterprise Services and Public Affairs, Finance, Technology and Business Enablement). First line of defense may also contain organizations that are enterprise support functions—see “Enterprise Support Functions” below.

Second Line of Defense

The second line of defense is independent of the first line of defense. It is responsible for overseeing the risk-taking activities of the first line of defense and challenging the first line of defense in the execution of its risk management responsibilities. It is also responsible for independently identifying, measuring, monitoring, controlling and reporting aggregate risks and for setting standards for the management and oversight of risk. The second line of defense is composed of Independent Risk Management (IRM) and Independent Compliance Risk Management (ICRM), which are led by the Group Chief Risk Officer (CRO) and Group Chief Compliance Officer (CCO), respectively, who have unrestricted access to the Board and its Risk Management Committee to facilitate the ability to execute their specific responsibilities pertaining to escalation to the Board.

Independent Risk Management

The IRM organization sets risk and control standards for the first line of defense and actively manages and oversees aggregate credit, market (trading and non-trading), liquidity, strategic, operational and reputation risks across Citi, including risks that span categories, such as concentration risk, country risk and climate risk. The CRO reports directly to both

the Board’s Risk Management Committee and the Citigroup CEO.

Independent Compliance Risk Management

The ICRM organization actively oversees compliance risk across Citi, sets compliance standards for the first line of defense to manage compliance risk and promotes business conduct and activity that is consistent with Citi’s Mission and Value Proposition and the compliance risk appetite, and is committed to maintaining an enterprise-wide compliance risk

management framework across Citi. The CCO reports to Citi’s Chief Legal Officer, and ICRM is organizationally part of Global Legal Affairs and Compliance. In addition, the CCO has matrix reporting into the CRO.

Third Line of Defense

Internal Audit is independent of the first line, second line and enterprise support functions. The role of Internal Audit is to provide independent, objective, reliable, valued and timely assurance to the Board, its Audit Committee, Citi senior management and regulators over the effectiveness of governance, risk management and controls that mitigate current and evolving risks and enhance the control culture within Citi. The Citi Chief Auditor manages Internal Audit and reports functionally to the Chair of the Citi Audit Committee and administratively to Citi’s CEO. The Citi Chief Auditor has unrestricted access to the Board and the Board Audit Committee.

Enterprise Support Functions

Enterprise support functions engage in activities that support safety and soundness across Citi. These functions provide advisory services and/or design, implement, maintain and oversee Company-wide programs that support Citi in maintaining an effective control environment.

Enterprise support functions are composed of Human Resources and Global Legal Affairs and Compliance (exclusive of ICRM, which is part of the second line of defense). Organizations noted under the first line of defense may also contain enterprise support functions (e.g., the Controllers Group within Finance).

Enterprise support functions are subject to the relevant Company-wide independent oversight processes specific to the risks for which they are accountable (e.g., operational risk and compliance risk).

Risk Governance

Citi’s ERM Framework encompasses risk management processes to address risks undertaken by Citi through identification, measurement, monitoring, controlling and reporting of all risks. The ERM Framework integrates these processes with appropriate governance to complement Citi’s commitment to maintaining strong and consistent risk management practices.

Board Oversight

The Board is responsible for oversight of Citi and holds the Executive Management Team accountable for implementing the ERM Framework and meeting strategic objectives within Citi’s risk appetite.

Executive Management Team

The Citigroup CEO directs and oversees the day-to-day management of Citi as delegated by the Board of Directors. The CEO leads the Company through the Executive Management Team and provides oversight of group activities, both directly and through authority delegated to committees established to oversee the management of risk, to ensure continued alignment with Citi’s risk strategy.

Board and Executive Management Governance Committees

The Board executes its responsibilities either directly or through its committees. The Board has delegated authority to the following Board standing committees to help fulfill its oversight and risk management responsibilities:

•Audit Committee (Board Audit Committee) provides oversight of financial statement integrity, internal controls, audits and regulatory compliance. Its responsibilities include holding management accountable for the effectiveness of Citigroup’s control environment and corrective actions, approving independent auditor selection/compensation, key policies and 10-K filings. It also has responsibilities regarding the approval, replacement and compensation of the Chief Auditor.

•Compensation, Performance Management and Culture Committee provides oversight of employee compensation, corporate culture and compliance with bank regulatory guidance governing Citi’s incentive compensation. Its responsibilities include reviewing Citi’s management resources, assessing the performance of senior management, determining the compensation of Citigroup’s CEO and approving executive compensation and incentive compensation structures.

•Nomination, Governance and Public Affairs Committee provides oversight of corporate governance, Board effectiveness and public affairs, including sustainability matters, and nominates directors for the Board and its committees. Its responsibilities include leading the annual review of the Board’s performance, reviewing the adequacy of Board committee charters and reviewing relationships with external constituencies and issues that impact Citi’s reputation, as well as advising management on the foregoing matters.

•Risk Management Committee (Board RMC) provides oversight of Citigroup’s risk management framework and risk culture, including significant policies and practices for risk management and capital management, and oversees the performance of Citi’s Credit Risk Review function. This Committee reviews Citigroup’s aggregate risk profile and ensures the adequacy of the Company’s risk management functions. Its responsibilities include approving the Enterprise Risk Management Framework (ERMF) and key risk policies, reviewing the risk appetite statement and recommending it to the Board. Additionally, this Committee has responsibilities regarding the approval, replacement and compensation of the Chief Risk Officer.

•Technology Committee provides oversight of Citigroup’s technology strategy, operating model, architecture and technology-based risk management (including cyber

security), technology resource and talent planning, and technology third-party management policies. Its responsibilities include reviewing and assessing significant technology investments and expenditures, overseeing and reviewing information from management regarding Citi’s approach to Generative AI and reviewing reports on technology and data quality-related matters.

In addition to the above, the Board has established the following ad hoc committee:

•Transformation Oversight Committee provides oversight of the actions of Citi’s management to develop and execute a transformation of Citi’s risk and control environment pursuant to the FRB and OCC Consent Orders (see “Citi’s Multiyear Transformation—FRB and OCC Consent Orders Compliance” above).

The Citigroup CEO has established four standing Executive Management Governance Committees that cover the primary risks to which Citi is exposed. These consist of the following:

•Citigroup Asset and Liability Committee (ALCO)oversees liquidity risk and market risk on the accrual book, and monitors and influences the balance sheet, investment securities and capital management activities of Citigroup. Its responsibilities include approving relevant policies and

programs and reviewing balance sheet trends, liquidity levels, capital metrics, interest rate risk, foreign exchange risk and significant risk management concerns.

•Business Risk and Control Committee oversees operational and compliance risks and the overall control environment. Its responsibilities include approving operational and compliance risk-related initiatives, and monitoring Issues, Managers Control Assessment, Operational Risk Events and Escalations.

•Reputation Risk Committee oversees Citigroup’s reputation risk program. It governs the processes by which material reputation risks are managed, in line with Company-wide strategic objectives, risk appetite and regulatory expectations, while promoting a culture of risk awareness. Its responsibilities include reviewing, challenging and resolving, as needed, reputation risk matters.

•Risk Management Committee oversees the execution of the Enterprise Risk Management Framework and monitors Citi’s risk profile against approved risk appetite. Its responsibilities include discussing and providing review and challenge of risk matters, including material and emerging risks facing Citi. It also provides comprehensive coverage of credit risk, market risk (trading) and strategic risk.

In addition to the Executive Management Governance Committees listed above, management may establish ad-hoc committees in response to regulatory feedback or to manage additional activities when deemed necessary.

The figure below illustrates the reporting lines between the Board and Executive Management Governance Committees:

CREDIT RISK

Credit risk is the risk of loss resulting from the decline in credit quality of a client, customer or counterparty (or downgrade risk) or the failure of a borrower, counterparty, third party or issuer to honor its financial or contractual obligations. For example, credit risk can arise from a deterioration in (i) the operating and financial performance of a borrower or (ii) a decline in the quality or value of any underlying collateral, both of which may also be impacted by adverse changes in macroeconomic, geopolitical, market and other factors. Credit risk is one of the most significant risks Citi faces as an institution (see “Risk Factors—Credit Risks” above). Credit risk arises in many of Citigroup’s business activities, including:

•consumer, commercial and corporate lending;

•capital markets derivative transactions;

•structured finance; and

•securities financing transactions (margin loans, repurchase and reverse repurchase agreements and securities loaned and borrowed).

Credit risk also arises from clearing and settlement activities, when Citi transfers an asset in advance of receiving its counter-value or advances funds to settle a transaction on behalf of a client, as well as through its investment securities portfolio and cash placed with banks. Concentration risk, within credit risk, is the risk associated with having credit exposure concentrated within a specific client, industry, region or other category.

Citi has an established framework in place for managing credit risk across all businesses that includes a defined risk appetite, credit limits and credit policies. Citi’s credit risk management framework also includes policies and procedures to manage problem exposures.

To manage concentration risk, Citi has in place a framework consisting of industry limits, single-name concentrations for each business and across Citigroup and a specialized product limit framework.

Credit exposures are generally reported in notional terms for accrual loans, reflecting the value at which the loans as well as other off-balance sheet commitments are carried on the Consolidated Balance Sheet. Credit exposure arising from capital markets activities is generally expressed as the current mark-to-market, net of margin, reflecting the net value owed to Citi by a given counterparty.

Citi’s loans are reported in two categories: corporate and consumer. These categories are classified primarily according to the operating segment, reporting unit and component that manage the loans in addition to the nature of the obligor, with corporate loans generally made for corporate institutional and public sector clients around the world and consumer loans to retail and small business customers.

The credit risk associated with Citi’s credit exposures is a function of the idiosyncratic creditworthiness of the obligor, as well as the terms and conditions of the specific obligation. Citi assesses the credit risk associated with its credit exposures not carried at fair value on a regular basis through its allowance

for credit losses (ACL) process (see “Significant Accounting Policies and Significant Estimates—Allowance for Credit Losses” below and Notes 1 (“Allowance for Credit Losses (ACL)”) and 16), as well as through regular stress testing at the company, business, geography and product levels. These stress-testing processes typically estimate potential incremental credit costs that would occur as a result of either downgrades in the credit quality or defaults of the obligors or counterparties. See Notes 15 and 16 for additional information on Citi’s credit risk management.

Average Loans

The table below details average loans, by segment and All Other, and the total Citigroup end-of-period loans for each of the periods indicated:

Average loans increased 7% year-over-year and 2% sequentially. The year-over-year increase was primarily driven by growth in Markets, USPBand Services, partially offset by declines in Banking.

Year-over-year average loans for:

•Services increased 10%, driven by demand in TTS for working capital loans as well as export and agency finance.

•Markets increased 25%, primarily driven by asset-backed financing and commercial warehouse lending in Spread Products.

•Banking decreased 6%, due to lower aggregate customer demand for funded loans.

•Wealth increased 1%, with growth in margin lending primarily offset by the transfers of certain relationships and associated mortgage loans to USPB from Wealth.

•USPB increased 5%, driven by growth in Retail Banking, largely due to transfers of certain relationships and associated mortgage loans to USPB from Wealth, as well as growth in Branded Cards.

•All Other increased 13%, driven by growth in Mexico Consumer/SBMM (including the impact of Mexican peso appreciation), partially offset by the continued wind-downs in Asia Consumer within Legacy Franchises (including the impact of moving HFS loans to Other assets).

CORPORATE CREDIT

Consistent with its overall strategy, Citi’s corporate clients are typically corporations that value the depth and breadth of Citi’s global network. Citi aims to establish relationships with these clients whose needs encompass multiple products, including cash management and trade services, foreign exchange, lending, capital markets and M&A advisory.

Corporate Credit Portfolio

The following table details Citi’s corporate credit portfolio across Services, Markets, Bankingand the Mexico SBMM portion of All Other—Legacy Franchises, and before consideration of collateral or hedges, by remaining tenor or expiration for the periods indicated:

(1) Includes drawn loans, overdrafts, bankers’ acceptances and leases.

(2) Excludes loans carried at fair value of $6.8 billion and HFS of $5.2 billion as of December 31, 2025.

(3) Includes unused commitments to lend, letters of credit and financial guarantees.

(4) Includes lending-related commitments carried at fair value and HFS as of December 31, 2025.

Portfolio Mix—Geography and Counterparty

Citi’s corporate credit portfolio is diverse across geographies and types of counterparties. The following table presents the percentages of this portfolio across North America and the clusters within International based on the country of risk of the obligor (for additional information on Citi’s international exposures, see “Other Risks—Country Risk—Top 25 Country Exposures” below):

The maintenance of accurate and consistent risk ratings across the corporate credit portfolio facilitates the comparison of credit exposure across all lines of business, geographies and products. Counterparty risk ratings reflect an estimated probability of default for a counterparty, and internal risk ratings are derived by leveraging validated statistical models and scorecards in combination with consideration of factors specific to the obligor or market, such as management experience, competitive position, regulatory environment and commodity prices. Facility risk ratings are assigned that reflect the probability of default of the obligor and factors that affect the loss given default of the facility, such as parental support or collateral. Internal ratings that generally correspond to BBB and above are considered investment grade, while those below are considered non-investment grade.

The following table presents the corporate credit portfolio by facility risk rating as a percentage of the total corporate credit portfolio:

Note: Total exposure includes direct outstandings and unfunded lending commitments.

In addition to the obligor and facility risk ratings assigned to all exposures, Citi may classify exposures in the corporate credit portfolio. These classifications are consistent with Citi’s interpretation of the U.S. banking regulators’ definition of criticized exposures, which may categorize exposures as special mention, substandard, doubtful or loss.

Risk ratings and classifications are reviewed regularly and adjusted as appropriate. The credit review process incorporates quantitative and qualitative factors, including financial and non-financial disclosures or metrics, idiosyncratic events or changes to the competitive, regulatory or macroeconomic environment.

Citi believes the corporate credit portfolio to be appropriately rated and classified as of December 31, 2025. Citi has applied management judgment to adjust internal ratings and classifications of exposures as both the macroeconomic environment and obligor-specific factors have changed, particularly where additional stress has been observed.

Obligor risk ratings may be downgraded, reflecting the increase in the probability of default. Downgrades of obligor risk ratings tend to result in a higher provision for credit losses. In addition, appetite per obligor is reduced consistent with the ratings, and downgrades may result in the purchase of additional credit derivatives or other risk/structural mitigants to hedge the incremental credit risk, or may result in Citi seeking to reduce exposure to an obligor or an industry sector. Citi will continue to review exposures to ensure that the appropriate probability of default is incorporated into all risk assessments.

See Note 15 for additional information on Citi’s corporate credit portfolio.

Portfolio Mix—Industry

Citi’s corporate credit portfolio is diversified by industry. The industry classifications are generally based on the clients’ primary business activity. The following table details the allocation of Citi’s total corporate credit portfolio by industry:

(1) As of the periods in the table, Citi had less than 1% exposure to securities firms. See corporate credit portfolio by industry, below.

The following table details Citi’s corporate credit portfolio by industry as of December 31, 2025:

(1) Represents gross credit exposures excluding any purchased credit protection.

(2) Funded excludes loans carried at fair value of $6.8 billion and HFS of $5.2 billion as of December 31, 2025.

(3) Unfunded includes lending-related commitments carried at fair value and HFS as of December 31, 2025.

(4) Includes non-accrual loan exposures and related criticized unfunded exposures.

(5) Represents the amount of purchased credit protection in the form of derivatives to economically hedge funded and unfunded exposures. Of the $40.6 billion of purchased credit protection, $37.5 billion represents the total notional amount of purchased credit derivatives on individual reference entities. The remaining $3.1 billion represents the first loss tranche of portfolios of purchased credit derivatives with a total notional amount of $27.3 billion, where the protection seller absorbs the first loss on the referenced loan portfolios.

(6) Autos total credit exposure includes securitization financing facilities secured by auto loans and leases, extended mainly to the finance company subsidiaries of global auto manufacturers, bank subsidiaries and independent auto finance companies, of approximately $19.2 billion ($10.6 billion of which was funded exposure with 100% rated investment grade) as of December 31, 2025.

(7) In addition to this exposure, Citi has energy-related exposure within the public sector (e.g., energy-related state-owned entities) and the transportation and industrials sector (e.g., offshore drilling entities) included in the table above. As of December 31, 2025, Citi’s total exposure to these energy-related entities was approximately $4.4 billion, of which approximately $1.7 billion consisted of direct outstanding funded loans.

(8) Includes $0.7 billion and $0.1 billion of funded and unfunded exposure at December 31, 2025, respectively, primarily related to commercial credit card delinquency-managed loans.

Exposure to Commercial Real Estate

As of December 31, 2025 and 2024, Citi’s total credit exposure to commercial real estate (CRE) was $78.4 billion and $65 billion, including $6.3 billion and $6 billion of exposure related to office buildings, respectively. This total CRE exposure consisted of approximately $69.5 billion and $56 billion, respectively, related to corporate clients, included in the real estate category in the tables above and below. Total CRE exposure also includes approximately $8.9 billion and $9 billion, respectively, related to Wealth clients, not included in the tables above as they are not considered corporate exposures.

In addition, as of December 31, 2025, approximately 81% of Citi’s total CRE exposure was rated investment grade and more than 77% was to borrowers in the U.S. (compared to approximately 78% rated investment grade and more than 75% to borrowers in the U.S. as of December 31, 2024).

As of December 31, 2025, the percentage of the ACLL attributed to the total funded CRE exposure (including Wealth) was approximately 1.4%, and there were $659 million of non-accrual CRE loans. As of December 31, 2024, the percentage of the ACLL attributed to the total funded CRE exposure (including Wealth) was approximately 1.6%, and there were $574 million of non-accrual CRE loans.

The following table details Citi’s corporate credit portfolio by industry as of December 31, 2024:

(1) Represents gross credit exposures excluding any purchased credit protection.

(2) Funded excludes loans carried at fair value of $7.8 billion and HFS of $3.6 billion as of December 31, 2024.

(3) Unfunded includes lending-related commitments carried at fair value and HFS as of December 31, 2024.

(4) Includes non-accrual loan exposures and related criticized unfunded exposures.

(5) Represents the amount of purchased credit protection in the form of derivatives to economically hedge funded and unfunded exposures. Of the $37.8 billion of purchased credit protection, $34.8 billion represents the total notional amount of purchased credit derivatives on individual reference entities. The remaining $3 billion represents the first loss tranche of portfolios of purchased credit derivatives with a total notional amount of $22.9 billion, where the protection seller absorbs the first loss on the referenced loan portfolios.

(6) Autos total credit exposure includes securitization financing facilities secured by auto loans and leases, extended mainly to the finance company subsidiaries of global auto manufacturers, bank subsidiaries and independent auto finance companies, of approximately $17.5 billion ($10.5 billion of which was funded exposure with 100% rated investment grade) as of December 31, 2024.

(7) In addition to this exposure, Citi has energy-related exposure within the public sector (e.g., energy-related state-owned entities) and the transportation and industrials sector (e.g., offshore drilling entities) included in the table above. As of December 31, 2024, Citi’s total exposure to these energy-related entities was approximately $4.4 billion, of which approximately $2.1 billion consisted of direct outstanding funded loans.

(8) Includes $0.6 billion and $0.1 billion of funded and unfunded exposure at December 31, 2024, respectively, primarily related to commercial credit card delinquency-managed loans.

Credit Risk Mitigation

As part of its overall risk management activities, Citi uses credit derivatives, both partial and full term, and other risk mitigants to economically hedge portions of the credit risk in its corporate credit portfolio, in addition to outright asset sales. In advance of the expiration of partial-term economic hedges, Citi will determine, among other factors, the economic feasibility of hedging the remaining life of the instrument. The results of the mark-to-market and any realized gains or losses on credit derivatives are reflected primarily in Principal transactions in the Consolidated Statement of Income in Banking.

At December 31, 2025, September 30, 2025 and December 31, 2024, Banking had economic hedges on the corporate credit portfolio of $40.6 billion, $39.5 billion and $37.8 billion, respectively. Citi’s expected credit loss model used in the calculation of its ACL does not include the favorable impact of credit derivatives and other mitigants that are marked-to-market. In addition, the reported amounts of direct outstandings and unfunded lending commitments in the tables above do not reflect the impact of these hedging transactions. The purchased credit protection was economically hedging underlying Banking corporate credit portfolio exposures with the following risk rating distribution:

Rating of Hedged Exposure

Loan Maturities and Fixed/Variable Pricing of Corporate Loans

(1) North America includes the U.S., Canada and Puerto Rico. Mexico is included in offices outside North America. The classification between offices in North America and outside North America is based on the domicile of the booking unit. The differences between the domicile of the booking unit and the domicile of the managing unit are not material.

(2) Loans secured primarily by real estate.

(3) Corporate loans are net of unearned income of $(1.1) billion. Unearned income on corporate loans primarily represents loan origination fees, net of certain direct origination costs, that are deferred and recognized as Interest income over the lives of the related loans.

(4) Excludes $17 million of unallocated portfolio-layer cumulative basis adjustments at December 31, 2025.

(5) Based on contractual terms. Repricing characteristics may effectively be modified from time to time using derivative contracts. See Note 24.

(6) Other includes installment and other and loans to government and official institutions.

This page intentionally left blank.

CONSUMER CREDIT

Citi's consumer credit risk management framework is designed for a variety of environments. Underwriting and portfolio management policies are calibrated based on risk-return trade-offs by product and segment and changes are made based on performance against benchmarks as well as environmental stress. As warranted, Citi adjusts underwriting criteria to address consumer credit risks and macroeconomic challenges and uncertainties.

As of December 31, 2025, USPB provided credit cards, consumer mortgages, personal loans, small business banking and other retail lending, and Wealth provided consumer mortgages, margin lending, credit cards and other lending products to customer segments that range from the affluent to ultra-high net worth through the Private Bank, Citigold and Wealth at Work. USPB’s retail banking products included a generally prime portfolio built through well-defined lending parameters within Citi’s risk appetite framework.

All Other—Legacy Franchises also provides such products in its remaining markets through Mexico Consumer and Asia Consumer (Poland and Korea).

Consumer Credit Portfolio

The following table presents Citi’s quarterly end-of-period consumer loans(1):

(1)End-of-period loans include interest and fees on credit cards.

(2)Consists of $95.9 billion, $97.9 billion, $98.0 billion, $96.7 billion and $98.0 billion of loans in North America as of December 31, 2025, September 30, 2025, June 30, 2025, March 31, 2025 and December 31, 2024, respectively. For additional information on the credit quality of the Wealth portfolio, see Note 15.

(3)Consists of $54.1 billion, $53.5 billion, $52.7 billion, $50.6 billion and $49.5 billion of loans outside North America as of December 31, 2025, September 30, 2025, June 30, 2025, March 31, 2025 and December 31, 2024, respectively.

(4)See Note 15 for details on loan-to-value ratios for the mortgage portfolios and FICO scores for the U.S. portfolio.

(5)Effective January 1, 2025, USPB changed its reporting for certain installment lending products that were transferred from Retail Banking to Branded Cards to reflect where these products are managed. Prior periods were conformed to reflect this change.

(6)Asia Consumer loan balances, reported within All Other—Legacy Franchises, include the three remaining Asia Consumer loan portfolios—Korea, Poland (through the first quarter of 2025) and Russia until the completion of its consumer loan portfolio wind-down in the second quarter of 2025. Asia Consumer loan balances exclude approximately $2 billion of loans ($1 billion of retail banking loans and $1 billion of credit card loan balances) for the second, third and fourth quarters of 2025. These loans were reclassified to held-for-sale (HFS) (Other assetson the Consolidated Balance Sheet) as a result of Citi’s agreement to sell its Poland consumer banking business (expected to close by mid-2026). See “Agreement to Sell Poland Consumer Banking Business” in Note 2.

(7)Consists of certain North America consumer mortgages.

For information on changes to Citi’s consumer loans, see “Credit Risk—Loans” above.

Consumer Credit Trends

U.S. Personal Banking

USPB includes Branded Cards, Retail Services and Retail Banking. Branded Cards includes proprietary credit card portfolios (Value, Rewards and Cash), co-branded card portfolios (including Costco and American Airlines) and personal installment loans. Retail Services includes co-brand and private label relationships (including, among others, The Home Depot, Best Buy and Macy’s). Retail Banking includes traditional banking services, including deposits, mortgages and other lending products, to retail and small business customers concentrated in six key U.S. metropolitan areas. Retail Banking also provides mortgages through correspondent channels.

As of December 31, 2025, approximately 75% of USPBEOP loans consisted of Branded Cards and Retail Services credit card loans, of which 70% represented Branded Cards loans and 30% represented Retail Services loans. Branded Cards and Retail Services credit card loans generally drive the overall credit performance of USPB, as Branded Cards and Retail Services card net credit losses represented approximately 94% of USPB’s total net credit losses for the fourth quarter of 2025.

As presented in the chart above, the fourth quarter of 2025 net credit loss rate for USPB decreased quarter-over-quarter, primarily driven by seasonality, and decreased year-over-year, reflecting improvements in portfolio performance (see “Branded Cards—Credit Cards” and “Retail Services” below).

The 90+ days past due delinquency rate was broadly stable quarter-over-quarter, and decreased year-over-year, reflecting improvements in portfolio performance in cards.

Branded Cards—Credit Cards

USPB’s Branded Cards portfolio consists of both proprietary Citi branded cards portfolios (Value, Rewards and Cash) and co-branded cards portfolios (including Costco and American Airlines) and personal installment loans. Citi’s Branded Cards portfolio has a diverse combination of credit card products.

As presented in the chart above, the fourth quarter of 2025 net credit loss rate for Branded Cards’ credit cards decreased quarter-over-quarter, primarily driven by seasonality, and decreased year-over-year, reflecting improvements in portfolio performance.

The 90+ days past due delinquency rate increased quarter-over-quarter, driven by seasonality, and was broadly stable year-over-year.

Retail Services

USPB’s Retail Services partners with more than 20 retailers and dealers to offer private label and co-brand cards. Retail Services’ target market focuses on select industry segments such as home improvement, specialty retail, consumer electronics and fuel.

As presented in the chart above, the fourth quarter of 2025 net credit loss rate for Retail Services increased quarter-over-quarter, driven by seasonality, and decreased year-over-year, reflecting improvements in portfolio performance.

The 90+ days past due delinquency rate was broadly stable quarter-over-quarter, and decreased year-over-year, reflecting improvements in portfolio performance.

For additional details on provisions for credit losses, loan delinquency and other information for Citi’s cards portfolios, see USPB’s results of operations above and Note 15.

Retail Banking

USPB’s Retail Banking portfolio consists primarily of consumer mortgages (including home equity) and unsecured lending products, such as small business loans and revolving products. The portfolio is generally delinquency managed, where Citi evaluates credit risk based on FICO scores, delinquencies and the value of underlying collateral. The consumer mortgages in this portfolio have historically been extended to high credit quality customers, generally with loan-to-value ratios that are less than or equal to 80% on first and second mortgages. For additional information, see “Loan-to-Value (LTV) Ratios” in Note 15.

As presented in the chart above, the fourth quarter of 2025 net credit loss rate for Retail Banking increased quarter-over-quarter, driven by consumer overdraft losses, and was broadly stable year-over-year.

The 90+ days past due delinquency rate decreased quarter-over-quarter, driven by the transfer of certain relationships and associated mortgage loans to Retail Banking from Wealth, and increased year-over-year, driven by consumer mortgages enrolled in forbearance programs related to the California wildfires.

Wealth

As of December 31, 2025, Wealth provided consumer mortgages, margin lending, credit cards and other lending products to customer segments that range from affluent to ultra-high net worth through the Private Bank, Citigold and Wealth at Work businesses. These customer segments represent a target market that is characterized by historically low default rates and delinquencies and includes loans that are delinquency managed or classifiably managed. The delinquency-managed portfolio consists primarily of mortgages and credit cards.

As of December 31, 2025, approximately $48 billion, or 32%, of the portfolios were classifiably managed and primarily consisted of margin loans, commercial real estate loans, personal and small business loans and other lending programs. These classifiably managed loans are primarily evaluated for credit risk based on their internal risk rating, of which 69% were rated investment grade. The 90+ days past due delinquency rates shown in the chart above were calculated only for the delinquency-managed portfolio, while the net credit loss rates were calculated using net credit losses for both the delinquency and classifiably managed portfolios.

As presented in the chart above, the fourth quarter of 2025 net credit loss rate in Wealth decreased quarter-over-quarter, primarily driven by write-downs of mortgage loans to their collateral value due to the impact of the California wildfires in the previous quarter, and was broadly stable year-over-year.

The 90+ days past due delinquency rate decreased quarter-over-quarter, largely driven by the resumption of payments on consumer mortgages exiting forbearance programs related to the California wildfires. The 90+ days past due delinquency rate increased year-over-year, driven by consumer mortgages that enrolled in forbearance programs related to the California wildfires. The low net credit loss and 90+ days past due delinquency rates continued to reflect the strong credit profiles of the portfolios.

Mexico Consumer

Mexico Consumer provides credit cards, consumer mortgages and small business and personal loans. Mexico Consumer serves a mass-market segment in Mexico and focuses on developing multiproduct relationships with customers.

As of December 31, 2025, approximately 40% of Mexico Consumer’s EOP loans consisted of credit card loans, which largely drives the overall credit performance of the Mexico Consumer portfolios, as the cards net credit losses represented approximately 60% of total Mexico Consumer net credit losses for the fourth quarter of 2025.

As presented in the chart above, the fourth quarter of 2025 net credit loss rate in Mexico Consumer increased quarter-over-quarter and year-over-year, driven by the ongoing normalization of loss and delinquency rates from post-pandemic lows.

The 90+ days past due delinquency rate increased quarter-over-quarter, largely driven by seasonality and the ongoing normalization of loss and delinquency rates from post-pandemic lows. The 90+ days past due delinquency rate increased year-over-year, primarily driven by the ongoing normalization of loss and delinquency rates from post-pandemic lows.

For additional details on provisions, loan delinquency and other information for Citi’s consumer loan portfolios, see the results of operations for USPB, Wealthand All Other above and Note 15.

U.S. Cards FICO Distribution

The following tables present the current FICO score distributions for Citi’s Branded Cards and Retail Services portfolios based on end-of-period receivables. FICO scores are updated as they become available.

Branded Cards

Retail Services

(1)Excludes immaterial balances for Canada and for customers for which no FICO scores are available.

The FICO distribution of both Branded Cards and Retail Services portfolios remained largely unchanged quarter-over-quarter and year-over-year. The FICO distribution continued to reflect the strong underlying credit quality of the portfolios. See Note 15 for additional information on FICO scores.

Additional Consumer Credit Details

Consumer Loan Delinquencies Amounts and Ratios

(1)End-of-period (EOP) loans include interest and fees on credit cards.

(2)The ratios of 90+ days past due and 30–89 days past due are calculated based on EOP loans, net of unearned income.

(3)Excludes EOP classifiably managed Private Bank loans. These loans are not included in the delinquency numerator, denominator and ratios.

(4)These loans are evaluated for non-accrual status and write-off primarily based on their internal risk classification and not solely on their delinquency status, and, therefore, delinquency metrics are excluded from this table. As of December 31, 2025, 2024 and 2023, 69%, 72% and 85% of Wealth classifiably managed loans were rated investment grade. For additional information on the credit quality of the Wealth portfolio, including classifiably managed portfolios, see “Consumer Credit Trends” above.

(5)The 90+ days past due and 30–89 days past due and related ratios for Retail Banking exclude loans guaranteed by U.S. government-sponsored agencies since the potential risk of loss predominantly resides with the U.S. government-sponsored agencies. The amounts excluded for loans 90+ days past due and (EOP loans) were $61 million ($0.4 billion), $69 million ($0.5 billion) and $63 million ($0.5 billion) at December 31, 2025, 2024 and 2023, respectively. The amounts excluded for loans 30–89 days past due (the 30–89 days past due EOP loans have the same adjustments as the 90+ days past due EOP loans) were $60 million, $66 million and $73 million at December 31, 2025, 2024 and 2023, respectively. The EOP loans in the table include the guaranteed loans.

(6)The 90+ days past due balances for Branded Cards and Retail Services are generally still accruing interest. Citi’s policy is generally to accrue interest on credit card loans until 180 days past due, unless notification of bankruptcy filing has been received earlier.

(7)Asia Consumer loan balances and the related delinquencies, reported within All Other—Legacy Franchises, include the three remaining Asia Consumer loan portfolios: Korea, Poland (through the first quarter of 2025) and Russia until the completion of its consumer loan portfolio wind-down in the second quarter of 2025. During the second quarter of 2025, Citi’s Poland consumer banking business was classified as HFS as a result of Citi’s agreement to sell the business. Accordingly, the Poland consumer loans are recorded in Other assetson the Consolidated Balance Sheet. As a result, the Poland consumer loans and related delinquencies are not included in this table for 2025. See “Agreement to Sell Poland Consumer Banking Business” in Note 2.

(8)The 90+ days past due and 30–89 days past due and related ratios exclude U.S. mortgage loans that are primarily related to U.S. mortgages guaranteed by U.S. government-sponsored agencies since the potential risk of loss predominantly resides with the U.S. agencies. The amounts excluded for 90+ days past due and (EOP loans) were $65 million ($0.2 billion), $66 million ($0.2 billion) and $67 million ($0.2 billion) at December 31, 2025, 2024 and 2023, respectively. The amounts excluded for loans 30–89 days past due (the 30–89 days past due EOP loans have the same adjustments as the 90+ days past due EOP loans) were $29 million, $34 million and $36 million at December 31, 2025, 2024 and 2023, respectively. The EOP loans in the table include the guaranteed loans.

Consumer Loan Net Credit Losses (NCLs) and Ratios

(1)Average loans include interest and fees on credit cards.

(2)The ratios of net credit losses are calculated based on average loans, net of unearned income.

(3)All Other (managed basis) excludes divestiture-related impacts (Reconciling Items) related to (i) Citi’s divestitures of its Asia Consumer businesses and (ii) the

ongoing divestiture of Banamex, within Legacy Franchises. The Reconciling Items are reflected in Citi’s Consolidated Statement of Income. See “All Other—Divestiture-Related Impacts (Reconciling Items)” above.

(4)Asia Consumer NCLs and average loan balances, reported within All Other—Legacy Franchises, include the three remaining Asia Consumer loan portfolios: Korea, Poland (through the first quarter of 2025) and Russia until the completion of its consumer loan portfolio wind-down in the second quarter of 2025. Citi’s Poland consumer banking business was classified as HFS during the second quarter of 2025 as a result of Citi’s agreement to sell the business. In accordance with

HFS accounting treatment, the Poland consumer average loans of approximately $1 billion in 2025 are recorded in Other assetson the Consolidated Balance Sheet, and the related NCLs of approximately $1 million in 2025 are recorded as a reduction to Other revenue. Other Asia Consumer businesses classified as HFS in Other assets and Other liabilities on the Consolidated Balance Sheet include approximately $0 million and $25 million in NCLs recorded as reductions to Other revenuein 2024 and 2023, respectively. Accordingly, these NCLs are not included in this table. See Note 2.

Loan Maturities and Fixed/Variable Pricing of Consumer Loans

Loan Maturities

(1)Credit card loans with maturities greater than one year represent loan modifications to borrowers experiencing financial difficulty and are at fixed interest rates.

Fixed/Variable Pricing

(1)Credit card loans with maturities greater than one year represent loan modifications to borrowers experiencing financial difficulty and are at fixed interest rates.

ADDITIONAL CONSUMER AND CORPORATE CREDIT DETAILS

Loans Outstanding

(1) North America includes the U.S., Canada and Puerto Rico. Mexico is included in offices outside North America. The classification of corporate loans between offices in North America and outside North America is based on the domicile of the booking unit. The difference between the domicile of the booking unit and the risk-based country view is not material for the purposes of classification of corporate loans between offices in North America and outside North America.

(2) Loans secured primarily by real estate.

(3) Consumer loans are net of unearned income of $971 million, $889 million, $802 million, $712 million and $629 million at December 31, 2025, 2024, 2023, 2022 and 2021, respectively. Unearned income on consumer loans primarily represents loan origination fees, net of certain direct origination costs, that are deferred and recognized as Interest income over the lives of the related loans, except for credit cards (see Note 5).

(4) Installment and other includes loans to SPEs and TTS commercial cards.

(5) Corporate loans include Mexico SBMM loans and are net of unearned income of $(1.1) billion, $(969) million, $(917) million, $(797) million and $(770) million at December 31, 2025, 2024, 2023, 2022 and 2021, respectively. Unearned income on corporate loans primarily represents loan origination fees, net of certain direct origination costs, that are deferred and recognized as Interest income over the lives of the related loans.

(6) Because loans carried at fair value do not have an ACLL, they are excluded from the ACLL ratio calculation.

Details of Credit Loss Experience

(1)On January 1, 2023, Citi adopted Accounting Standards Update (ASU) 2022-02, Financial Instruments—Credit Losses (Topic 326): TDRs and Vintage Disclosures. The ASU eliminated the accounting and disclosure requirements for TDRs, including the requirement to measure the ACLL for TDRs using a discounted cash flow (DCF) approach. On January 1, 2023, Citi recorded a $352 million decrease in the Allowance for loan losses, along with a $290 million after-tax increase to Retained earnings. See “Accounting Changes” in Note 1.

(2)Includes all adjustments to the allowance for credit losses, such as changes in the allowance from acquisitions, dispositions, securitizations, FX translation, purchase accounting adjustments, etc.

(3)2025 includes an approximate $29 million reclass related to Citi’s agreement to sell its Poland consumer banking business. That ACLL was transferred to Other assets.2025 also includes an increase of approximately $273 million related to FX translation.

(4)2024 includes an approximate $300 million decrease related to FX translation, as well as an initial allowance for credit losses on newly purchased credit-deteriorated assets during the year.

(5)2023 includes an approximate $175 million increase related to FX translation.

(6)2022 includes an approximate $350 million reclass related to the announced sales of Citi’s consumer banking businesses in Thailand, India, Malaysia, Taiwan, Indonesia, Bahrain and Vietnam. Also includes a decrease of approximately $100 million related to FX translation.

(7)2021 includes an approximate $280 million reclass related to Citi’s agreement to sell its Australia consumer banking business and an approximate $90 million reclass related to Citi’s agreement to sell its Philippines consumer banking business. Those ACLL were reclassified to Other assets during 2021. 2021 also includes a decrease of approximately $134 million related to FX translation.

(8)December 31, 2025, 2024, 2023, 2022 and 2021 exclude $6.9 billion, $8.0 billion, $7.6 billion, $5.4 billion and $6.1 billion, respectively, of loans that are carried at fair value.

(9)Represents additional credit reserves recorded as Other liabilities on the Consolidated Balance Sheet.

(10)The ACLL represents management’s estimate of expected credit losses in the portfolio and troubled debt restructurings. See “Significant Accounting Policies and Significant Estimates” below. Attribution of the allowance is made for analytical purposes only and is available to absorb probable credit losses inherent in the overall portfolio.

Allowance for Credit Losses on Loans (ACLL)

The following tables detail information on Citi’s ACLL, loans and coverage ratios:

(1)Excludes loans carried at fair value, since they do not have an ACLL and are excluded from the ACLL ratio calculation.

(2)Includes both Branded Cards and Retail Services. As of December 31, 2025, the $13.3 billion of ACLL represented approximately 24 months of coincident net credit loss coverage (based on fourth quarter of 2025 NCLs). As of December 31, 2025, Branded Cards ACLL as a percentage of EOP loans was 6.3% and Retail Services ACLL as a percentage of EOP loans was 10.8%. As of December 31, 2024, the $13.6 billion of ACLL represented approximately 22 months of coincident net credit loss coverage (based on fourth quarter of 2024 NCLs). As of December 31, 2024, Branded Cards ACLL as a percentage of EOP loans was 6.4% and Retail Services ACLL as a percentage of EOP loans was 11.3%.

(3)Includes residential mortgages, retail loans and personal, small business and other loans, including those extended through the Private Bank network.

(4)The above corporate loan classifications are broadly based on the loan’s collateral, purpose and type of borrower, which may be different from the following industry table. For example, commercial and industrial, financial institutions, and installment and other loan classifications include various forms of loans to borrowers across multiple industries, whereas mortgage and real estate includes loans secured primarily by real estate.

The following table details Citi’s corporate credit ACLL by industry exposure:

(1) Funded exposure excludes loans carried at fair value of $6.8 billion that are not subject to the ACLL.

(2) As of December 31, 2025, the portion of the ACLL attributed to the total funded CRE exposure (including the Private Bank) was approximately 1.4%.

(3) Includes $0.7 billion of funded exposure at December 31, 2025, primarily related to commercial credit card delinquency-managed loans.

(4) Includes the impact of FX translation on the ACLL that is not allocated to individual industries.

(5) As of December 31, 2025, the ACLL above reflects coverage of 0.3% of funded investment-grade exposure and 2.6% of funded non-investment-grade exposure.

The following table details Citi’s corporate credit ACLL by industry exposure:

(1) Funded exposure excludes loans carried at fair value of $7.8 billion that are not subject to the ACLL.

(2) As of December 31, 2024, the portion of the ACLL attributed to the total funded CRE exposure (including the Private Bank) was approximately 1.6%.

(3) Includes $0.6 billion of funded exposure at December 31, 2024, primarily related to commercial credit card delinquency-managed loans.

(4) Includes the impact of FX translation on the ACLL that is not allocated to individual industries.

(5) As of December 31, 2024, the ACLL above reflects coverage of 0.4% of funded investment-grade exposure and 2% of funded non-investment-grade exposure.

Non-Accrual Loans and Assets

There is a certain amount of overlap among non-accrual loans and assets. The following summary provides a general description of non-accrual loans and assets:

•Corporate and consumer (including commercial banking) non-accrual status is based on the determination that payment of interest or principal is doubtful.

•A corporate loan may be classified as non-accrual and still be current on principal and interest payments under the terms of the loan structure.

•Consumer non-accrual status is generally based on aging, i.e., the borrower has fallen behind on payments, including borrowers who have enrolled in forbearance programs.

•Consumer mortgage loans, other than Federal Housing Administration (FHA)–insured loans, are classified as non-accrual within 60 days of notification that the borrower has filed for bankruptcy. Uninsured consumer mortgage loans are classified as non-accrual if the loan is 90 days or more past due. In addition, home equity loans are classified as non-accrual if the related residential first mortgage loan is 90 days or more past due.

•With the exception of certain international portfolios, credit card loans are not included because, under industry standards, they accrue interest until such loans are charged off, which typically occurs at 180 days of contractual delinquency.

Non-Accrual Loans

The table below summarizes Citigroup’s non-accrual loans (NAL) as of the periods indicated. Non-accrual loans may still be current on interest payments. In situations where Citi reasonably expects that none or only a portion of the principal owed will ultimately be collected, all payments received are reflected as a reduction of principal and not as interest income. For all other non-accrual loans, cash interest receipts are generally recorded as revenue.

The increase in corporate non-accrual loans at December 31, 2025 was driven by idiosyncratic credit downgrades. The increase in consumer non-accrual loans at December 31, 2025 was driven by residential mortgage loans impacted by the California wildfires and higher loan balances and the impact of FX translation in Mexico Consumer.

(1)Corporate loans are placed on non-accrual status based on a review by Citigroup’s risk officers. Corporate non-accrual loans may still be current on interest payments. With limited exceptions, the following practices are applied for consumer loans: consumer loans, excluding credit cards and mortgages, are placed on non-accrual status at 90 days past due and are charged off at 120 days past due; residential mortgage loans are placed on non-accrual status at 90 days past due and written down to net realizable value at 180 days past due. Consistent with industry conventions, Citigroup generally accrues interest on credit card loans until such loans are charged off, which typically occurs at 180 days contractual delinquency. As such, the non-accrual loan disclosures do not include credit card loans, with the exception of certain international portfolios. The balances above represent non-accrual loans within Corporate loansand Consumer loans on the Consolidated Balance Sheet.

(2)Approximately 70%, 61%, 50%, 50% and 56% of Citi’s corporate non-accrual loans remain current on interest and principal payments at December 31, 2025, 2024, 2023, 2022 and 2021, respectively.

(3)The December 31, 2025 total corporate non-accrual loans represented 0.58% of total corporate loans.

(4) Asia Consumer includes the three remaining consumer loan portfolios: Korea, Poland (through the first quarter of 2025) and Russia until the completion of its consumer loan portfolio wind-down in the second quarter of 2025.

The changes in Citigroup’s non-accrual loans were as follows:

The table below summarizes Citigroup’s other real estate owned (OREO) assets. OREO is recorded on the Consolidated Balance Sheet within Other assets. This represents the carrying value of all real estate property acquired by foreclosure or other legal proceedings when Citi has taken possession of the collateral:

(1)The International OREO details by cluster are not provided due to the immateriality of such amounts.

(2)The ACLL includes the allowance for Citi’s credit card portfolios and purchased credit-deteriorated loans, while the non-accrual loans exclude credit card balances (with the exception of certain international portfolios).

LIQUIDITY RISK

Adequate and diverse sources of funding and liquidity are essential to Citi’s businesses. Funding and liquidity risks arise from several factors, many of which are largely outside of Citi’s control, such as disruptions in the financial markets, changes in key funding sources, credit spreads, changes in Citi’s credit ratings and macroeconomic, geopolitical and other conditions. For additional information, see “Risk Factors—Liquidity Risks” above.

Citi’s funding and liquidity management objectives are aimed at:

•funding its existing asset base;

•growing its core businesses;

•maintaining sufficient liquidity, structured appropriately, so that Citi can operate under a variety of adverse circumstances, including potential Company-specific and/or market liquidity events in varying durations and severity; and

•satisfying regulatory requirements, including, but not limited to, those related to resolution planning (see “Resolution Plan” and “Total Loss-Absorbing Capacity (TLAC)” below).

Citigroup’s primary liquidity objectives are established by entity, and in aggregate, across two major categories:

•Citibank (including Citibank Europe plc, Citibank Singapore Ltd. and Citibank (Hong Kong) Ltd.); and

•Citi’s non-bank and other entities, including the parent holding company (Citigroup Inc.), Citi’s primary intermediate holding company (Citicorp LLC), Citi’s broker-dealer subsidiaries (including Citigroup Global Markets Inc., Citigroup Global Markets Limited and Citigroup Global Markets Japan Inc.) and other bank and non-bank subsidiaries that are consolidated into Citigroup (including Banamex).

At an aggregate Citigroup level, Citi’s goal is to maintain sufficient funding in amount and tenor to fully fund customer assets and to provide an appropriate amount of cash and high-quality liquid assets (as discussed below), even in times of stress, in order to meet its payment obligations as they come due. Citi’s liquidity risk management framework provides that, in addition to the aggregate requirements, certain entities be self-sufficient or net providers of liquidity, including in conditions established under their designated stress tests.

Citi’s primary funding sources include the following:

•corporate and consumer deposits via Citi’s bank subsidiaries, including Citibank, N.A. (Citibank)

•long-term debt (primarily senior and subordinated debt) mainly issued by Citigroup Inc., as the parent, and Citibank

•stockholders’ equity

These sources are supplemented by short-term borrowings, primarily in the form of secured funding transactions.

Citi’s funding and liquidity framework, working in concert with overall asset/liability management, helps ensure that there is sufficient liquidity and tenor in the overall liability structure (including funding products) of the Company relative to the liquidity and tenor of Citi’s assets. This reduces the risk that liabilities will become due before assets mature or are monetized. The Company holds excess liquidity, primarily in the form of high-quality liquid assets (HQLA), as presented in the table below. Citi’s liquidity is managed centrally by Corporate Treasury, reported within Corporate/Other in All Other, in conjunction with cluster and in-country treasurers with oversight provided by Independent Risk Management and various Asset and Liability Committees (ALCOs) and Country Coordinating Committee at the individual entity, cluster, country and business levels. Pursuant to this approach, Citi’s HQLA are managed with emphasis on asset/liability management and entity-level liquidity adequacy throughout Citi.

Citi’s CRO and CFO co-chair Citigroup’s ALCO, which includes Citi’s Treasurer and other senior executives. The ALCO sets the strategy of the liquidity portfolio and monitors portfolio performance (see “Risk Governance—Board and Executive Management Committees” above). Significant changes to portfolio asset allocations are approved by the ALCO. Citi also has other ALCOs, which are established at various organizational levels to ensure appropriate oversight for individual entities, countries, franchise businesses and regions, serving as the primary governance committees for managing Citi’s balance sheet and liquidity.

As a supplement to Citigroup’s ALCO, Citi’s Funding and Liquidity Risk Committee (FLRC) is focused on funding and liquidity risk matters. The FLRC reviews and discusses the funding and liquidity risk profile of, as well as risk management practices for, Citigroup and Citibank and reports its findings and recommendations to each relevant ALCO as appropriate.

Liquidity Monitoring and Measurement

Stress Testing

Liquidity stress testing is performed for each of Citi’s major entities, operating subsidiaries and countries. Stress testing and scenario analyses are intended to quantify the potential impact of an adverse liquidity event on the balance sheet and liquidity position, in order to have sufficient liquidity on hand to manage through such an event. These scenarios include assumptions about significant changes in key funding sources, market triggers (such as credit ratings), potential uses of funding and macroeconomic, geopolitical and other conditions. These conditions include expected and stressed market conditions as well as Company-specific events.

Liquidity stress tests are performed to ascertain potential mismatches between liquidity sources and uses over a variety of time horizons and over different stressed conditions. To monitor the liquidity of an entity, these stress tests and potential mismatches are calculated on a daily basis.

Given the range of potential stresses, Citi maintains contingency funding plans on a consolidated basis and for individual entities. These plans specify a wide range of readily available actions for a variety of adverse market conditions or idiosyncratic stresses.

High-Quality Liquid Assets (HQLA)

(1) Foreign government debt includes securities issued or guaranteed by foreign sovereigns, agencies and multilateral development banks. Foreign government debt securities are held largely to support local liquidity requirements and Citi’s local franchises and principally include government bonds from Japan, Mexico, Korea, the United Kingdom and China.

The table above includes average amounts of HQLA held at Citigroup’s operating entities that are eligible for inclusion in the calculation of Citigroup’s consolidated LCR, pursuant to the U.S. LCR rules. These amounts include the HQLA needed to meet the minimum requirements at these entities as well as any amounts in excess of these minimums that are available to be transferred to other entities within Citigroup. Citigroup’s average HQLA increased quarter-over-quarter as of the fourth quarter of 2025, primarily driven by an increase in average deposits in Services.

As of December 31, 2025, Citigroup had approximately $1.0 trillion of available liquidity resources to support client and business needs, including end-of-period HQLA ($610 billion) included in Citi’s LCR calculation; additional unencumbered HQLA, including excess liquidity held at bank entities that is non-transferable to other entities within Citigroup ($275 billion); and unused borrowing capacity from available assets not already accounted for within Citi’s HQLA to support additional advances from the Federal Home Loan Bank (FHLB) and the Federal Reserve Bank discount window ($164 billion).

Short-Term Liquidity Measurement: Liquidity Coverage Ratio (LCR)

Citi monitors its liquidity by reference to the LCR in addition to internal 30-day liquidity stress testing performed for Citi’s major entities, operating subsidiaries and countries.

The LCR is calculated by dividing HQLA by estimated net outflows assuming a stressed 30-day period, with the net outflows determined by standardized stress outflow and inflow rates prescribed in the LCR rule. The outflows are partially offset by contractual inflows from assets maturing within 30 days. Similar to outflows, the inflows are calculated based on prescribed factors to various asset categories, such as retail loans as well as unsecured and secured wholesale lending. The minimum LCR requirement is 100%.

The table below details the components of Citi’s LCR calculation and HQLA in excess of net outflows for the periods indicated:

Note: The amounts are presented on an average basis.

As of December 31, 2025, Citigroup’s average LCR remained unchanged from the quarter ended September 30, 2025. The increase in average HQLA was offset by an increase in net outflows from unsecured and secured wholesale funding.

Long-Term Liquidity Measurement: Net Stable Funding Ratio (NSFR)

The NSFR measures the availability of an institution’s stable funding against the required stable funding in accordance with U.S. NSFR rules. The ratio of available stable funding to required stable funding must be greater than 100%.

In general, an institution’s available stable funding includes portions of equity, deposits and long-term debt, while its required stable funding is based on the liquidity characteristics of its assets, derivatives and commitments. Standardized weightings are required to be applied to the various asset and liability classes.

For the quarter ended December 31, 2025, Citigroup’s consolidated NSFR was compliant with the 100% minimum requirement of the rule. (For additional information, see the Consolidated Citigroup NSFR Disclosure for the quarterly periods ended December 31, 2025 and September 30, 2025, on Citi’s Investor Relations website. The Consolidated Citigroup NSFR Disclosure on Citi’s Investor Relations website is not incorporated by reference into, and does not form any part of, this Form 10-K).

Deposits

The table below details average deposits, by segment and/or business, and the total Citigroup end-of-period deposits for each of the periods indicated:

On an average basis, total deposits increased 8% year-over-year and 3% sequentially, both driven by corporate deposits. Year-over-year, average deposits for:

•Services increased 11%, driven by both TTS and Securities Services, reflecting growth in International and North America, largely driven by an increase in operational deposits.

•Wealth increased 1%, driven by client transfers from USPB and net new deposits, largely offset by outflows, including a shift from deposits to higher-yielding investments.

•USPB increased 2%, as net new deposits growth was primarily offset by the transfer of certain relationships and the associated deposits to Wealth.

•All Other decreased 8%, reflecting a decrease in corporate certificates of deposit in Corporate/Other, as continued wind-downs in Asia Consumer within Legacy Franchises (including the impact of moving HFS deposits to Other liabilities) were offset by growth in Legacy Franchises Mexico deposits (including the impact of Mexican peso appreciation).

The majority of Citi’s $1.4 trillion of end-of-period deposits are institutional (approximately $934 billion) and span approximately 90 countries. A large majority of these institutional deposits are within TTS, and of these, over 70% are from clients that use all three TTS integrated services: payments and collections, liquidity management and working capital solutions. In addition, approximately 80% of TTS deposits are from clients that have a longer than 15-year relationship with Citi.

Citi also has a strong consumer and wealth deposit base, with $413 billion of USPB and Wealth end-of-period deposits, which are diversified across the Private Bank, Citigold and Wealth at Work within Wealth, as well as Retail Banking within USPB.

As of year end, approximately 65% of Wealth’s U.S. Citigold clients have been with Citi for more than 10 years and approximately 38% of Private Bank ultra-high net worth

clients have been with Citi for more than 10 years. In addition, USPB’s Retail Banking deposits are spread across six key metropolitan areas in the U.S.

Long-Term Debt (LTD)

LTD (generally defined as debt with original maturities of one year or more) represents the most significant component of Citi’s funding for the Citigroup parent company and Citi’s non-bank subsidiaries and is a supplementary source of funding for the bank entities.

The following table presents Citi’s end-of-period total LTD outstanding for each of the dates indicated:

Note: Amounts represent the current value of LTD on Citi’s Consolidated Balance Sheet that, for certain debt instruments, includes consideration of fair value, hedging impacts and unamortized discounts and premiums.

(1) Non-bank includes LTD issued to third parties by the parent holding company (Citigroup) and Citi’s non-bank subsidiaries (including broker-dealer subsidiaries) that are consolidated into Citigroup. As of December 31, 2025, non-bank included $101.5 billion of LTD issued by Citi’s broker-dealer and other subsidiaries that are consolidated into Citigroup. Certain Citigroup consolidated hedging activities are also included in this line.

(2) Primarily structured notes, which contain an embedded derivative component that adjusts each security’s risk-return profile. See Note 27 for the fair value component of these issuances.

(3) Local country and other includes debt issued by Citi’s affiliates in support of their local operations. Within non-bank, certain secured financing is also included.

(4) Predominantly credit card securitizations, primarily backed by Branded Cards receivables.

For information about changes in Citi’s end-of-period long-term debt, see “Balance Sheet Overview” above.

As part of its liability management, Citi has considered, and may continue to consider, opportunities to redeem or repurchase its LTD pursuant to open market purchases, tender offers or other means. Such redemptions and repurchases help reduce Citi’s overall funding costs. During 2025, Citi redeemed or repurchased an aggregate of $63.3 billion of its outstanding LTD.

LTD Issuances and Maturities

The table below details Citi’s LTD issuances and maturities (including repurchases and redemptions) during the periods presented:

The table below details Citi’s aggregate LTD maturities (including repurchases and redemptions) in 2025, as well as its aggregate remaining LTD maturities by year as of December 31, 2025:

Resolution Plan

Citigroup is required under Title I of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (Dodd-Frank Act) and the rules promulgated by the FDIC and FRB to periodically submit a plan for Citi’s rapid and orderly resolution under the U.S. Bankruptcy Code in the event of material financial distress or failure. For additional information on risks related to the application of resolution plan requirements, see “Risk Factors—Strategic Risks” above. Citigroup alternates between submitting a full resolution plan and a targeted resolution plan on a biennial cycle.

Under Citi’s preferred “single point of entry” resolution plan strategy, only Citigroup, the parent holding company, would enter into bankruptcy, while Citigroup’s material legal entities (as defined in the public section of its 2025 resolution plan, which can be found on the FRB’s and FDIC’s websites) would remain operational outside of any resolution or insolvency proceedings. Citigroup’s resolution plan has been designed to minimize the risk of systemic impact to the U.S. and global financial systems, while maximizing the value of the bankruptcy estate for the benefit of Citigroup’s creditors, including its unsecured LTD holders.

In addition, in line with the FRB’s total loss-absorbing capacity (TLAC) rule, Citigroup’s shareholders and unsecured creditors—including its unsecured LTD holders—bear any losses resulting from Citigroup’s bankruptcy. Accordingly, any value realized by holders of its unsecured LTD may not be sufficient to repay the amounts owed to such debt holders in the event of a bankruptcy or other resolution proceeding of Citigroup.

The FDIC has also indicated that it was developing a single point of entry strategy to implement the Orderly Liquidation Authority under Title II of the Dodd-Frank Act, which provides the FDIC with the ability to resolve a firm when it is determined that bankruptcy would have serious adverse effects on financial stability in the U.S.

As previously disclosed, in response to feedback received from the FRB and FDIC, Citigroup took the following actions:

•Citicorp LLC (Citicorp), an existing wholly owned subsidiary of Citigroup, was established as an intermediate holding company (an IHC) for certain of Citigroup’s operating material legal entities.

•Citigroup executed an inter-affiliate agreement with Citicorp, Citigroup’s operating material legal entities and certain other affiliated entities pursuant to which Citicorp is required to provide liquidity and capital support to Citigroup’s operating material legal entities in the event that Citigroup were to enter bankruptcy proceedings (Citi Support Agreement).

•pursuant to the Citi Support Agreement:

•Citigroup made an initial contribution of assets, including certain high-quality liquid assets and inter-affiliate loans (Contributable Assets), to Citicorp, and Citicorp became the business-as-usual funding vehicle for Citigroup’s operating material legal entities;

•Citigroup will be obligated to continue to transfer Contributable Assets to Citicorp over time, subject to certain amounts retained by Citigroup to, among other things, meet Citigroup’s near-term cash needs; and

•in the event of a Citigroup bankruptcy, Citigroup will be required to contribute most of its remaining assets to Citicorp.

•The obligations of both Citigroup and Citicorp under the Citi Support Agreement, as well as the Contributable Assets, are secured pursuant to a security agreement.

Total Loss-Absorbing Capacity (TLAC)

As a U.S. GSIB, Citi is required to maintain minimum levels of TLAC and eligible LTD, each set by reference to the GSIB’s consolidated risk-weighted assets (RWA) and total leverage exposure. The intended purpose of the requirements is to facilitate the orderly resolution of U.S. GSIBs under the U.S. Bankruptcy Code and Title II of the Dodd-Frank Act. For additional information, including Citi’s TLAC and LTD amounts and ratios, see “Capital Resources—Current Regulatory Capital Standards” above.

SECURED FUNDING TRANSACTIONS AND SHORT-TERM BORROWINGS

Citi supplements its primary sources of funding with short-term financings that generally include:

•secured funding transactions consisting of securities loaned or sold under agreements to repurchase, i.e., repos

•short-term borrowings consisting of commercial paper issuances and borrowings from the FHLB and other market participants

Secured Funding Transactions

Secured funding is primarily accessed through Citi’s broker-dealer subsidiaries, with a smaller portion executed through Citi’s bank entities to efficiently fund both (i) secured lending activity and (ii) a portion of the securities inventory held in the context of market making and customer activities. Secured funding transactions are predominantly collateralized by government debt securities. Generally, changes in the level of Citi’s secured funding are primarily due to fluctuations in secured lending activity in the matched book (as described below), and changes in securities inventory and eligible counterparty balance sheet netting. In order to maintain reliable funding under a wide range of market conditions, Citi manages risks related to its secured funding by establishing secured funding limits and conducting daily stress tests that account for risks related to capacity, tenor, haircut, collateral type, counterparty and client actions.

As of the quarter ended December 31, 2025, secured funding on an average basis was $385 billion. For

information about changes in Citi’s end-of-period securities

loaned and sold under agreements to repurchase, see “Balance Sheet Overview” above.

The portion of secured funding in the broker-dealer subsidiaries that funds secured lending is commonly referred to as “matched book” activity and is primarily secured by high-quality liquid securities such as U.S. Treasury securities, U.S. agency securities and foreign government debt securities. Other “matched book” activity is secured by less liquid securities, including equity securities, corporate bonds and asset-backed securities, the tenor of which is generally equal to or longer than the tenor of the corresponding assets. As indicated above, the remaining portion of secured funding is used to fund securities inventory held in the context of market making and customer activities.

Short-Term Borrowings

See Note 19 for further information on Citigroup’s and its affiliates’ outstanding short-term borrowings.

CREDIT RATINGS

Citigroup’s funding and liquidity, funding capacity, ability to access capital markets and other sources of funds, the cost of these funds and its ability to maintain certain deposits are partially dependent on its credit ratings.

The table below presents the ratings for Citigroup and Citibank as of December 31, 2025. While not included in the table below, the current long-term and short-term ratings of Citigroup Global Markets Holdings Inc. (CGMHI) were A+/F1 at Fitch Ratings, A2/P-1 at Moody’s Ratings and A/A-1 at S&P Global Ratings as of December 31, 2025.

Ratings as of December 31, 2025

Potential Impacts of Ratings Downgrades

Ratings downgrades by Fitch, Moody’s or S&P could negatively impact Citigroup’s and/or Citibank’s funding and liquidity due to reduced funding capacity, including derivative triggers, which could take the form of cash obligations and collateral requirements.

The following information is provided for the purpose of analyzing the potential funding and liquidity impact to Citigroup and Citibank of a hypothetical simultaneous ratings downgrade across all three major rating agencies. This analysis is subject to certain estimates, estimation methodologies, judgments and uncertainties. Uncertainties include potential ratings limitations that certain entities may have with respect to permissible counterparties, as well as general subjective counterparty behavior. For example, certain corporate customers and markets counterparties could re-evaluate their business relationships with Citi and limit transactions in certain contracts or market instruments with Citi. Changes in counterparty behavior could impact Citi’s funding and liquidity, as well as the results of operations of certain of its businesses. The actual impact to Citigroup or Citibank is unpredictable and may differ materially from the potential funding and liquidity impacts described below. For additional information on the impact of credit rating changes on Citi and its applicable subsidiaries, see “Risk Factors—Liquidity Risks” above.

Citigroup Inc. and Citibank—Potential Derivative Triggers

As of December 31, 2025, Citi estimates that a hypothetical one-notch downgrade of the senior debt/long-term rating across all three major rating agencies could impact funding and liquidity due to derivative triggers by approximately $0.1 billion, unchanged from September 30, 2025, for Citigroup Inc., and $0.1 billion, unchanged from September 30, 2025, for Citibank. Other funding sources, such as secured financing transactions and other margin requirements, for which there are no explicit triggers, could also be adversely affected.

In total, as of December 31, 2025, Citi estimates that a one-notch downgrade of Citigroup Inc. and Citibank across all three major rating agencies could result in increased aggregate cash obligations and collateral requirements of approximately $0.2 billion, unchanged from September 30, 2025. As detailed under “High-Quality Liquid Assets (HQLA)” above, Citigroup has various liquidity resources available to its bank and non-bank entities in part as a contingency for the potential events described above.

In addition, a broad range of mitigating actions are currently included in Citigroup’s and Citibank’s contingency funding plans. For Citigroup, these mitigating factors include, but are not limited to, accessing surplus funding capacity from existing clients, tailoring levels of secured lending and adjusting the size of select trading books and collateralized borrowings at certain Citibank subsidiaries. Mitigating actions available to Citibank include, but are not limited to, selling or financing highly liquid government securities, tailoring levels of secured lending, adjusting the size of select trading assets, reducing loan originations and renewals, raising additional deposits or borrowing from the FHLB or central banks. Citi believes these mitigating actions could substantially reduce the funding and liquidity risk, if any, of the potential downgrades described above.

Citibank—Additional Potential Impacts

In addition to the above derivative triggers, Citi believes that a potential downgrade of Citibank’s senior debt/long-term rating across any of the three major rating agencies could also have an adverse impact on the commercial paper/short-term rating of Citibank. Citibank has provided liquidity commitments to consolidated asset-backed commercial paper (ABCP) conduits, primarily in the form of asset purchase agreements. As of December 31, 2025, Citibank had liquidity commitments of approximately $10.0 billion to ABCP conduits (compared to $15.0 billion at December 31, 2024) (see Note 23).

In addition to the above-referenced liquidity resources of certain Citibank entities, Citibank could reduce the funding and liquidity risk, if any, of the potential downgrades described above through mitigating actions, including repricing certain commitments to commercial paper conduits. In the event of the potential downgrades described above, Citi believes that certain corporate customers could reduce borrowing through these conduits, which would result in a reduced amount of ABCP issuance.

MARKET RISK

Market risk is the potential for losses arising from changes in the value of Citi’s assets and liabilities resulting from changes in market variables such as interest rates, foreign exchange rates, equity prices, commodity prices and credit spreads, as well as their implied volatilities. Market risk arises from both Citi’s trading and non-trading portfolios. For additional information on market risk and market risk management at Citi, see “Risk Factors” above.

Each business is required to establish, with approval from Citi’s market risk management, a market risk limit framework for identified risk factors that clearly defines approved risk profiles and is within the parameters of Citi’s overall risk appetite. These limits are monitored by the Risk organization, including various regional, legal entity and business Risk Management committees, Citi’s country and business Asset and Liability Committees and the Citigroup Risk Management and Asset and Liability Committees. In all cases, the businesses are ultimately responsible for the market risks taken and for remaining within their defined limits.

MARKET RISK OF NON-TRADING PORTFOLIOS

Market risk from non-trading portfolios stems predominantly from the potential impact of changes in interest rates and foreign exchange rates on Citi’s net interest income and on Citi’s Accumulated other comprehensive income (loss) (AOCI) from its investment securities portfolios. Market risk from non-trading portfolios also includes the potential impact of changes in foreign exchange rates on Citi’s capital invested in foreign currencies.

Banking Book Interest Rate Risk

For interest rate risk purposes, Citi’s non-trading portfolios are referred to as the Banking Book. Management of interest rate risk in the Banking Book is governed by Citi’s Non-Trading Market Risk Policy. Citigroup’s Asset and Liability Committee (ALCO) establishes Citi’s risk appetite and related limits for interest rate risk in the Banking Book, which are subject to approval by Citigroup’s Board of Directors.

Corporate Treasury is responsible for the day-to-day management of Citi’s Banking Book interest rate risk as well as periodically reviewing it with the ALCO. Citi’s Banking Book interest rate risk management is also subject to independent oversight from the second line of defense team reporting to the Chief Risk Officer.

Changes in interest rates impact Citi’s net income, AOCI and CET1. These changes primarily affect Citi’s Banking Book through net interest income, due to a variety of risk factors, including:

•differences in timing and amounts of the maturity or repricing of assets, liabilities and off-balance sheet instruments;

•changes in the level and/or shape of interest rate curves;

•client behavior in response to changes in interest rates (e.g., mortgage prepayments, deposit betas); and

•changes in the maturity of instruments resulting from changes in the interest rate environment.

As part of their ongoing activities, Citi’s businesses generate interest rate-sensitive positions from their client-facing products, such as loans and deposits. Interest rate risk is transferred via Citi’s funds transfer-pricing process to Treasury. Treasury uses various tools to manage the total interest rate risk position within the established risk appetite and target Citi’s desired risk profile, including its investment securities portfolio, company-issued debt and interest rate derivatives.

In addition, Citi uses multiple metrics to measure its Banking Book interest rate risk. Interest Rate Exposure (IRE) is a key metric that analyzes the impact of a range of scenarios on Citi’s Banking Book net interest income versus a base case. IRE does not represent a forecast of Citi’s net interest income.

The scenarios, methodologies and assumptions used in Citi’s IRE analysis are periodically evaluated and enhanced in response to changes in the market environment, changes in Citi’s balance sheet composition, enhancements in Citi’s modeling and other factors.

Citi utilizes the most recent quarter-end balance sheet, assuming no changes to its composition and size over the forecasted horizon (holding the balance sheet static). The forecasts incorporate expectations and assumptions of deposit pricing, loan spreads and mortgage prepayment behavior implied by the interest rate curves in each scenario. The base case scenario reflects the market-implied forward interest rates, and sensitivity scenarios assume instantaneous shocks to the base case. The forecasts do not assume Citi takes any risk-mitigating actions in response to changes in the interest rate environment. Certain interest rates are subject to flooring assumptions in downward rate scenarios. Deposit pricing sensitivities (i.e., deposit betas) are informed by historical and expected behavior. Actual deposit pricing could differ from the assumptions used in these forecasts.

Citi’s IRE analysis primarily reflects the impacts from the following Banking Book assets and liabilities: loans, client deposits, Citi’s deposits with other banks, investment securities, LTD, any related interest rate hedges and the funds transfer pricing of positions in total trading and credit portfolio value at risk (VaR). It excludes impacts from any positions that are included in total trading and credit portfolio VaR.

In addition to IRE, Citi analyzes economic value sensitivity (EVS) as a longer-term interest rate risk metric. EVS is a net present value (NPV)–based measure of the lifetime cash flows of Citi’s Banking Book. It estimates the interest rate sensitivity of the Banking Book’s economic value from longer-term assets being potentially funded with shorter-term liabilities, or vice versa. Citi manages EVS within risk limits approved by Citigroup’s Board of Directors that are aligned with Citi’s risk appetite.

Interest Rate Risk of Investment Portfolios—Impact on AOCI

Citi measures the potential impacts of changes in interest rates on the value of its AOCI, which can in turn impact Citi’s common equity and tangible common equity. This will impact Citi’s CET1 and other regulatory capital ratios. Citi seeks to manage its exposure to changes in the market level of interest rates, while limiting the potential impact on its AOCI and regulatory capital position.

AOCI at risk is managed as part of the Company-wide interest rate risk position. AOCI at risk considers potential changes in AOCI (and the corresponding impact on the CET1 Capital ratio) relative to Citi’s capital generation capacity.

Citi uses 100 basis point (bps) shocks in each scenario to reflect its net interest income sensitivity to unanticipated changes in market interest rates, as potential monetary policy decisions and changes in economic conditions may be reflected in current market-implied forward rates.

The following table presents the 12-month estimated impact to Citi’s net interest income, AOCI and the CET1 Capital ratio, each assuming an unanticipated parallel instantaneous 100 bps increase in interest rates:

(1)Excludes trading book and fair value option banking book portfolios and replaces them with the associated transfer pricing.

(2)Includes the effect of changes in interest rates on AOCI related to investment securities, cash flow hedges and pension plans.

(3)Excludes the effect of changes in interest rates on AOCI related to cash flow hedges, as those changes are excluded from CET1 Capital.

As presented in the table above, Citi’s balance sheet is asset sensitive (assets reprice faster than liabilities), resulting in higher net interest income in increasing interest rate scenarios. The estimated impact to Citi’s net interest income in a 100 bps upward and downward rate shock scenario as of December 31, 2025 remained relatively stable year-over-year. At progressively higher interest rate levels, the marginal net interest income benefit is lower, as Citi assumes it will pass on a larger share of rate changes to depositors (i.e., higher betas), reducing Citi’s IRE sensitivity. At current rate levels Citi assumes it will be unable to pass on a larger share of initial rate declines to depositors, increasing Citi’s IRE sensitivity to a 100 bps downward shock. Currency-specific interest rate changes and balance sheet factors may drive quarter-to-quarter volatility in Citi’s estimated IRE for a 100 bps upward rate shock.

In a 100 bps upward rate shock scenario, Citi expects that the approximate $2.6 billion initial negative impact to AOCI could potentially be offset in shareholders’ equity through the forecasted interest income and paydowns from Citi’s investment portfolio over a period of approximately 14 months.

Scenario Analysis

The following table presents the estimated impact to Citi’s net interest income and AOCI under eight different interest rate scenarios for the U.S. dollar and all other currencies as of December 31, 2025. The 100 bps and 200 bps downward rate scenarios potentially may be impacted by the low level of interest rates in several countries and the assumption that market interest rates, as well as rates paid to depositors and charged to borrowers, do not fall below zero (i.e., the “flooring assumption”). The interest rate scenarios are also impacted by convexity related to mortgage products and deposit pricing.

These scenarios include the following:

•a parallel shift involving changes to both short-term and long-term rates by an equal amount

•a steeper yield curve involving holding short-term rates constant and increasing long-term rates or holding long-term rates constant and decreasing short term rates

•a flatter yield curve involving increasing short-term rates and holding long-term rates constant or holding short-term rates constant and decreasing long-term rates

Note: Each scenario assumes that the rate change will occur instantaneously. Changes in interest rates for maturities between the overnight rate and the 10-year rate are interpolated. The interest rate exposure in the table above assumes no change in deposit size or mix from the baseline forecast included in the different interest rate scenarios presented. As a result, in higher interest rate scenarios, customer activity resulting in a shift from non-interest-bearing and low interest rate deposit products to higher-yielding deposits would reduce the expected benefit to net interest income. Conversely, in lower interest rate scenarios, customer activity resulting in a shift from higher-yielding deposits to non-interest-bearing and low interest rate deposit products would reduce the expected decrease to net interest income.

(1)The “parallel shift” impact of $1,402 million consists of the following top five non-U.S. dollar currencies as of December 31, 2025 by absolute size: approximately $(0.4) billion from the euro, approximately $0.2 billion each from the British pound sterling and Swiss franc and $0.1 billion each from the Singapore dollar and Hong Kong dollar. The remaining balance is spread across more than 30 additional currencies.

(2)Includes the effect of changes in interest rates on AOCI related to investment securities, cash flow hedges and pension plans.

As presented in the table above, the estimated impact to Citi’s net interest income is larger in the short end compared to the long end as Citi’s Banking Book has relatively higher interest rate exposure to the short end of the yield curve. For the U.S. dollar, exposure to downward rate shocks is larger in magnitude than to upward rate shocks. This is because of the lower benefit to net interest income from Citi’s deposit base at higher rate levels, as well as the prepayment effects on mortgage loans and mortgage-backed securities.

The magnitude of the impact to AOCI is greater in the short end compared to the long end. This is because Citi’s investment portfolio is more sensitive to shorter-term rates and pension liabilities are more sensitive at intermediate-term maturities.

Changes in Foreign Exchange Rates—Impacts on AOCI

and Capital

As of December 31, 2025, Citi estimates that a parallel instantaneous 5% appreciation of the U.S. dollar against all of the other currencies in which Citi has invested capital could reduce Citi’s tangible common equity (TCE) by approximately $1.7 billion, or 1.0%, as a result of changes to Citi’s CTA in AOCI, net of hedges. This reduction in the TCE would be primarily driven by depreciation of the euro, Mexican peso and Singapore dollar.

This reduction in the TCE does not reflect any mitigating actions Citi may take, including ongoing management of its foreign currency translation exposure. TCE is used as a simplified metric to manage CET1 capital ratio volatility. Specifically, as currency movements change the value of Citi’s net investments in foreign currency-denominated capital, these movements also change the value of Citi’s RWA

denominated in those same currencies. This, coupled with Citi’s foreign currency hedging strategies, such as foreign currency borrowings, foreign currency forwards and other currency hedging instruments, lessens the impact of foreign currency movements on Citi’s CET1 Capital ratio. Changes in these hedging strategies, as well as hedging costs, divestitures and tax impacts, can further affect the actual impact of changes in foreign exchange rates on Citi’s capital compared to an unanticipated parallel shock, as described above.

The effect of Citi’s ongoing management strategies with respect to quarterly changes in foreign exchange rates (versus the U.S. dollar), and the quarterly impact of these changes on Citi’s TCE and CET1 Capital ratio, are presented in the table below. See Note 21 for additional information on the changes in AOCI.

(1) FX spot rate change is a weighted average based on Citi’s quarterly average GAAP capital exposure to foreign countries. A negative change in FX spot rate represents foreign currency depreciation versus the U.S. dollar.

(2) Includes $2,243 million related to the Banamex equity interest sale. See “Sale of 25% Equity Stake in Banamex” in Note 2.

Interest Income/Expense and Net Interest Margin (NIM)

(1)Interest income and Net interest income include the taxable equivalent gross-up adjustments (TEGU) primarily related to the tax-exempt bond portfolio and certain tax-advantaged loan programs of $106 million, $94 million and $101 million for 2025, 2024 and 2023, respectively.

(2)Interest expense associated with certain hybrid financial instruments, which are classified as Long-term debtand accounted for at fair value, is reported together with any changes in fair value as part of Principal transactionsin the Consolidated Statement of Income and is therefore not reflected in Interest expensein the table above.

(3) The average rate on interest income and NIM reflects TEGU. See footnote 1 above.

(4) Citi’s NIM is calculated by dividing net interest income (including TEGU) by average interest-earning assets.

Non-Markets Net Interest Income

(1)Interest income and Net interest income include TEGU discussed in the table above.

Citi’s net interest income in the fourth quarter of 2025 was $15.7 billion, on both a reported and taxable equivalent basis, an increase of 14%, or $1.9 billion, from the prior-year period. The growth was due to a 53%, or $1.0 billion, increase in Marketsnet interest income and an 8%, or $0.9 billion, increase in non-Marketsnet interest income.

Citi’s Markets business is primarily evaluated on a total revenue basis. See “Markets” above for additional information.

The increase in non-Marketsnet interest income was largely driven by:

•higher average deposit balances and deposit spreads in Servicesand Wealth; and

•higher loan spreads and higher interest-earning balances in Branded Cards in USPB, as well as higher deposit spreads and average deposit balances in Retail Banking in USPB;

•lower interest-earning loan balances and spreads in Retail Services in USPB,

•lower mortgage spreads in Wealth, and

•a lower benefit from cash and securities reinvestment in All Other—Corporate/Other, driven by actions taken over the last few quarters to reduce Citi’s asset sensitivity in a declining interest rate environment.

Citi’s net interest margin was 2.49% on a taxable equivalent basis in the fourth quarter of 2025, an increase of nine basis points from the prior quarter, largely driven by higher Marketsnet interest income and a favorable asset mix-shift in balances.

Citi’s net interest income for 2025 increased 11%, or $5.7 billion, to $59.8 billion ($59.9 billion on a taxable equivalent basis) versus 2024. The increase was driven by a 43%, or $3.0 billion, increase in Marketsnet interest income and a 6%, or $2.7 billion, increase in non-Marketsnet interest income.

The increase in non-Marketsnet interest income was largely driven by:

•higher average deposit balances and spreads in Services;

•higher loan spreads and interest-earning balances in Branded Cards, as well as higher deposit spreads in Retail Banking; and

•higher deposit spreads in Wealth;

•lower interest-earning loan balances and spreads in Retail Services,

•lower mortgage spreads and lower average deposit balances in Wealth, and

•a lower benefit from cash and securities reinvestment in All Other—Corporate/Other, driven by actions taken over the last few quarters to reduce Citi’s asset sensitivity in a declining interest rate environment.

In 2025, Citi’s net interest margin increased to 2.47% on a taxable equivalent basis, compared to 2.40% in 2024, driven by higher Marketsnet interest income and a favorable asset mix-shift due to higher interest-earning balances in cards, partially offset by the impact of FX translation.

Additional Interest Rate Details

Average Balances and Interest Rates—Assets(1)(2)(3)

Taxable Equivalent Basis

(1)Interest income and Net interest income include TEGU of $106 million, $94 million and $101 million for 2025, 2024 and 2023, respectively.

(2)Interest rates and amounts include the effects of risk management activities associated with the respective asset categories.

(3)Monthly or quarterly averages have been used by certain subsidiaries where daily averages are unavailable.

(4)Average rates reflect prevailing local interest rates, including inflationary effects and monetary corrections in certain countries.

(5)Average volumes of securities borrowed or purchased under agreements to resell are reported net pursuant to ASC 210-20-45. However, Interest income excludes the impact of ASC 210-20-45.

(6)The fair value carrying amounts of derivative contracts are reported net, pursuant to ASC 815-10-45, in Non-interest-earning assets and Other non-interest-bearing liabilities.

(7)Interest expense on Trading account liabilities of Services, Markets and Banking is reported as a reduction of Interest income. Interest incomeand Interest expense on cash collateral positions are reported in interest on Trading account assets and Trading account liabilities, respectively.

(8)Net of unearned income. Includes cash-basis loans.

(9)Includes Brokerage receivables.

Average Balances and Interest Rates—Liabilities and Equity, and Net Interest Income(1)(2)(3)

Taxable Equivalent Basis

(1)Interest income and Net interest income include TEGU discussed in the table above.

(2)Interest rates and amounts include the effects of risk management activities associated with the respective liability categories.

(3)Monthly or quarterly averages have been used by certain subsidiaries where daily averages are unavailable.

(4)Consists of other time deposits and savings deposits. Savings deposits are composed of insured money market accounts and other savings deposits.

(5)Average rates reflect prevailing local interest rates, including inflationary effects and monetary corrections in certain countries.

(6)Average volumes of securities sold under agreements to repurchase are reported net pursuant to ASC 210-20-45. However, Interest expense excludes the impact of ASC 210-20-45.

(7)The fair value carrying amounts of derivative contracts are reported net, pursuant to ASC 815-10-45, in Non-interest-earning assetsand Other non-interest-bearing liabilities.

(8)Interest expense on Trading account liabilities of Services, Markets and Banking is reported as a reduction of Interest income. Interest income and Interest expense on cash collateral positions are reported in interest on Trading account assets and Trading account liabilities, respectively.

(9)Includes Brokerage payables.

(10)Excludes hybrid financial instruments and beneficial interests in consolidated VIEs that are classified as Long-term debt, as the changes in fair value for these obligations are recorded in Principal transactions.

(11)Includes non-interest-bearing deposits in both the U.S. and outside of the U.S.

(12)Includes allocations for capital and funding costs based on the location of the asset.

Analysis of Changes in Interest Revenue(1)(2)(3)

(1)Interest income and Net interest income include the taxable equivalent adjustments discussed in the table above.

(2)Rate/volume variance is allocated based on the percentage relationship of changes in volume and changes in rate to the total net change.

(3)Changes in average rates reflect changes in prevailing local interest rates, including inflationary effects and monetary corrections in certain countries.

(4)Interest expense on Trading account liabilities of Services, Markets and Bankingis reported as a reduction of Interest income. Interest income and Interest expense on cash collateral positions are reported in interest on Trading account assetsand Trading account liabilities, respectively.

(5)Includes cash-basis loans.

(6)Includes Brokerage receivables.

Analysis of Changes in Interest Expense and Net Interest Income(1)(2)(3)

(1)Interest income and Net interest income include the taxable equivalent adjustments discussed in the table above.

(2)Rate/volume variance is allocated based on the percentage relationship of changes in volume and changes in rate to the total net change.

(3)Changes in average rates reflect changes in prevailing local interest rates, including inflationary effects and monetary corrections in certain countries.

(4)Interest expense on Trading account liabilities of Services, Markets and Banking is reported as a reduction of Interest income. Interest income and Interest expense on cash collateral positions are reported in interest on Trading account assetsand Trading account liabilities, respectively.

(5)Includes Brokerage payables.

MARKET RISK OF TRADING PORTFOLIOS

Trading portfolios include the following:

•positions resulting from market-making activities

•hedges of certain available-for-sale (AFS) debt securities

•the CVA relating to derivative counterparties and all associated hedges

•fair value option loans

•hedges of the loan portfolio within capital markets origination

Management of the market risk of Citi’s trading portfolio is governed by the Mark-to-Market Risk Policy and the Markets Risk Management Committee.

The market risk of Citi’s trading portfolios is monitored using a combination of quantitative and qualitative measures, including, but not limited to, factor sensitivities, value at risk (VaR) and stress testing. Each trading portfolio across Citi’s businesses has its own market risk limit framework encompassing these measures and other controls, including

trading mandates, new product approval, permitted product lists and pre-trade approval for larger, more complex and less liquid transactions. These controls enable the monitoring and management of Citi’s top market risks.

The following chart of total daily trading-related revenue (loss) captures trading volatility and shows the number of days in which revenues for Citi’s trading businesses fell within particular ranges. Trading-related revenue includes trading, net interest and other revenue associated with Citi’s trading businesses. It excludes DVA, FVA and CVA adjustments incurred due to changes in the credit quality of counterparties, as well as any associated hedges of that CVA. In addition, it excludes fees and other revenue associated with capital markets origination activities. Trading-related revenues are driven by both customer flows and the changes in valuation of the trading inventory. As presented in the chart below, Citi achieved positive trading-related revenue for 98.9% of the trading days in 2025.

Daily Trading-Related Revenue (Loss)(1)—12 Months Ended December 31, 2025

In millions of dollars

(1) Reflects the effects of asymmetrical accounting for economic hedges of certain AFS debt securities. Specifically, the change in the fair value of hedging derivatives is included in trading-related revenue, while the offsetting change in the fair value of hedged AFS debt securities is included in AOCI and not reflected above.

Factor Sensitivities

When managing market risk for its trading portfolios, Citi uses factor sensitivities to measure the change in value of a position for a defined change in a market risk factor, such as a change in the value of a U.S. Treasury bond for a one-basis-point change in interest rates. Citi’s Global Market Risk function, within the Independent Risk Management organization, works to ensure that factor sensitivities are calculated, monitored and limited for all material risks taken in the trading portfolios.

Value at Risk (VaR)

VaR estimates, at a 99% confidence level, the potential decline in the value of a position or a portfolio under normal market conditions assuming a one-day holding period. VaR statistics, which are based on historical data, can be materially different across firms due to differences in portfolio composition, VaR methodologies and model parameters. As a result, Citi believes VaR statistics can be used more effectively as indicators of trends in risk-taking within a firm, rather than as a basis for inferring differences in risk-taking across firms.

Citi uses a single, independently approved Monte Carlo simulation VaR model (see “VaR Model Review and Validation” below), which has been designed to capture material risk sensitivities (such as first- and second-order sensitivities of positions to changes in market prices) of various asset classes/risk types (such as interest rate, credit spread, foreign exchange, equity and commodity risks).

Citi uses the VaR model to create views of risk for internal purposes (Risk Management VaR), which may differ from the Regulatory VaR definition (described in “VaR Model Review and Validation” below) used for regulatory capital requirements. “Trading VaR” includes positions that are measured at fair value or mark-to-market and does not include investment securities classified as AFS, HTM or other accrual positions. See Note14 for information on these securities. “Trading and Credit VaR” additionally includes mark-to-market positions associated with non-trading business units plus the CVA relating to derivative counterparties, all associated CVA hedges and market-sensitive FVA hedges.

Citi believes its VaR model is conservatively calibrated to incorporate fat-tail scaling and the greater of short-term (approximately the most recent month) and long-term (18 months for commodities and three years for others) market volatility. The Monte Carlo simulation involves approximately 550,000 market factors, making use of approximately 480,000 time series, with sensitivities updated daily, volatility parameters updated intra-monthly and correlation parameters updated monthly. As of December 31, 2025, Citi estimates that the conservative features of the VaR calibration contribute an approximate 14% add-on to what would be a VaR estimated under the assumption of normally distributed markets.

As presented in the table below, Citi’s average trading VaR decreased $6 million from 2024 to 2025 due to inventory changes and volatility updates. Citi’s average trading and credit portfolio VaR decreased $7 million, in line with the decline in average trading VaR.

Total Citi—Year-end and Average Trading VaR and Trading and Credit Portfolio VaR

(1)Covariance adjustment (also known as diversification benefit) equals the difference between the total VaR and the sum of the VaRs tied to each risk type. The benefit reflects the fact that the risks within individual and across risk types are not perfectly correlated and, consequently, the total VaR on a given day will be lower than the sum of the VaRs relating to each risk type. The determination of the primary drivers of changes to the covariance adjustment is made by an examination of the impact of both model parameter and position changes.

(2) The total trading VaR includes mark-to-market and certain fair value option trading positions with the exception of hedges of the loan portfolio, fair value option loans and all CVA exposures. Available-for-sale and accrual exposures are not included.

(3) The specific risk-only component represents the level of equity and fixed income issuer-specific risk embedded in VaR.

(4) The credit portfolio is composed of mark-to-market positions associated with non-trading business units, with the CVA relating to derivative counterparties, all associated CVA hedges and market sensitivity FVA hedges. FVA and DVA are not included. The credit portfolio also includes hedges of the loan portfolio, fair value option loans and hedges of the leveraged finance pipeline within capital markets origination.

The table below provides the range of market factor VaRs associated with total Citi trading VaR, inclusive of specific risk:

Note: No covariance adjustment can be inferred from the above table as the high and low for each market factor will be from different close-of-business dates.

The following table provides the VaR only for Markets, excluding the CVA relating to derivative counterparties, hedges of CVA, fair value option loans and hedges of the loan portfolio:

Markets VaR

VaR Model Review and Validation

Generally, Citi’s VaR review and model validation process entails reviewing the model framework, major assumptions and implementation of the mathematical algorithm. In addition, product-specific back-testing on portfolios is periodically completed as part of the ongoing model performance monitoring process and reviewed with Citi’s U.S. banking regulators. Furthermore, Regulatory VaR back-testing (as described below) is performed against buy-and-hold profit and loss on a monthly basis for multiple sub-portfolios across the organization (trading desk level and total Citigroup) and the results are shared with U.S. banking regulators.

Material VaR model and assumption changes must be independently validated within Citi’s Independent Risk Management organization. All model changes, including those for the VaR model, are validated by the model validation group within Citi’s Model Risk Management. In the event of significant model changes, parallel model runs are undertaken prior to implementation. In addition, significant model and assumption changes are subject to the periodic reviews and approval by Citi’s U.S. banking regulators.

Citi uses the same independently validated VaR model for both Regulatory VaR and Risk Management VaR and, as such, the model review and validation process for both purposes is as described above.

Regulatory VaR, which is calculated in accordance with Basel III, differs from Risk Management VaR because certain

positions included in Risk Management VaR are not eligible for market risk treatment in Regulatory VaR. The composition of Risk Management VaR is discussed under “Value at Risk” above. The applicability of the VaR model for positions eligible for market risk treatment under U.S. regulatory capital rules is periodically reviewed and approved by Citi’s U.S. banking regulators.

In accordance with Basel III, Regulatory VaR includes all trading book-covered positions and all foreign exchange and commodity exposures. Pursuant to Basel III, Regulatory VaR excludes positions that fail to meet the intent and ability to trade requirements and are therefore classified as non-trading book and categories of exposures that are specifically excluded as covered positions. Regulatory VaR excludes CVA on derivative instruments and DVA on Citi’s own fair value option liabilities. CVA hedges are excluded from Regulatory VaR and included in credit risk-weighted assets as computed under the Advanced Approaches for determining risk-weighted assets.

Regulatory VaR Back-Testing

In accordance with Basel III, Citi is required to perform back-testing to evaluate the effectiveness of its Regulatory VaR model. Regulatory VaR back-testing is the process in which the daily one-day VaR, at a 99% confidence interval, is compared to the buy-and-hold profit and loss (i.e., the profit and loss impact if the portfolio is held constant at the end of the day and re-priced the following day). Clean buy-and-hold profit and loss represents the daily mark-to-market profit and loss attributable to price movements in covered positions from the close of the previous business day. Buy-and-hold profit and loss excludes realized trading revenue, net interest, fees and commissions, intra-day trading profit and loss and changes in reserves.

Based on a 99% confidence level, Citi would expect two to three days in any one year where buy-and-hold losses exceed the Regulatory VaR. Given the conservative calibration of Citi’s VaR model (as a result of taking the greater of short- and long-term volatilities and fat-tail scaling of volatilities), Citi would expect fewer exceptions under normal and stable market conditions. Periods of unstable market conditions could increase the number of back-testing exceptions.

The following graph presents the daily buy-and-hold profit and loss associated with Citi’s covered positions compared to Citi’s one-day Regulatory VaR during 2025.

During 2025, no back-testing exceptions were observed at the Citigroup level.

The difference between the 67.6% of days with buy-and-hold gains for Regulatory VaR back-testing and the 98.9% of days with trading, net interest and other revenue associated with Citi’s trading businesses, presented in the histogram of daily trading-related revenue, reflects, among other things, that a significant portion of Citi’s trading-related revenue is not generated from daily price movements on these positions and exposures, as well as differences in the portfolio composition of Regulatory VaR and Risk Management VaR.

Regulatory Trading VaR and Associated Buy-and-Hold Profit and Loss(1)—12 Months Ended December 31, 2025

In millions of dollars

(1) Buy-and-hold profit and loss, as defined by the banking regulators under Basel III, represents the daily mark-to-market revenue movement attributable to the trading position from the close of the previous business day. Buy-and-hold profit and loss excludes realized trading revenue and net interest intra-day trading profit and loss on new and terminated trades, as well as changes in reserves. Therefore, it is not comparable to the trading-related revenue presented in the chart of daily trading-related revenue above.

Stress Testing

Citi uses a comprehensive Enterprise Stress Testing framework in its risk management, capital adequacy assessment and strategic planning processes to assess the potential impact of various adverse economic and financial market events on the Company’s financial condition. The results of these tests are a critical input for evaluating Citi’s risk profile and capital adequacy, and for informing the Company’s risk appetite and strategic business decisions.

Citi’s market risk stress testing program includes routine stress loss assessments, as well as ad-hoc analyses of emerging risks and market events. The scenarios used within this framework are designed to be severe and relevant to Citi’s trading portfolios and vulnerabilities, and include a combination of historical market crises and hypothetical events. These scenarios are applied to the portfolios to calculate the potential profit and loss impact under stressed conditions. The outputs of the stress tests are reviewed by senior management and relevant risk committees. The results directly inform risk management actions, including the setting and monitoring of the Company’s risk limits, the approval process for certain transactions and ongoing capital and strategic planning. This ensures that the insights gained from stress testing are actively used to manage risk and maintain financial resilience.

OPERATIONAL RISK

Operational risk is the risk of loss resulting from inadequate or failed internal processes, human error or systems errors, or external events. As discussed further below, operational risk includes cybersecurity risk. It also includes legal risk, which is the risk of loss (including litigation costs, settlements and regulatory fines) resulting from the failure of Citi to comply with laws, regulations, prudent ethical standards and contractual obligations in any aspect of its businesses, but excludes strategic and reputation risks. Citi also recognizes the impact of operational risk on the reputation risk associated with Citi’s business activities.

Operational risk is inherent in Citi’s global business activities, as well as related support functions, and can result in losses. Citi maintains a comprehensive Company-wide risk taxonomy to classify operational risks that it faces using standardized definitions across Citi’s Operational Risk Management Framework (see discussion below). This taxonomy also supports regulatory requirements and expectations inclusive of those related to U.S. Basel III, Comprehensive Capital Analysis and Review (CCAR), Heightened Standards for Large Financial Institutions and Dodd-Frank Act Stress Testing (DFAST).

Citi manages operational risk consistent with the overall framework described in “Managing Global Risk—Overview” above. Citi’s goal is to keep operational risk at appropriate levels relative to the characteristics of its businesses, the markets in which it operates, its capital and liquidity and the competitive, economic and regulatory environment. This includes effectively managing operational risk and

maintaining or reducing operational risk exposures within Citi’s operational risk appetite.

Citi’s Operational Risk Management group has established a global Operational Risk Management Framework with policies and practices for identification, measurement, monitoring, controlling and reporting operational risks and the overall operating effectiveness of the internal control environment. As part of this framework, Citi has defined its operational risk appetite and established the minimum requirements of the Manager’s Control Assessment (MCA) process managed by the first line of defense for self-identification of significant operational risks, assessment of the performance of key controls and mitigation of residual risk above acceptable levels.

Each Citi operating segment must implement operational risk management processes consistent with the requirements of this framework. This includes:

•understanding and assessing the operational risks they are exposed to;

•designing, executing and testing controls that mitigate identified risks;

•establishing key indicators;

•monitoring and reporting whether the operational risk exposures are in or out of their operational risk appetite;

•having processes in place to bring operational risk exposures within acceptable levels;

•periodically estimating and aggregating the operational risks they are exposed to; and

•ensuring that sufficient resources are available to actively improve the operational risk environment and mitigate emerging risks.

Citi considers operational risks that result from the introduction of new or changes to existing products, or result from significant changes in its organizational structures, systems, processes and personnel.

Citi has a governance structure for the oversight of operational risk exposures through Business Risk and Controls Committees (BRCCs), which are focused at the group, business or function level. BRCCs provide channels to inform and escalate to senior management about operational risk exposures, control issues and operational risk events, and allow them to take and document decisions around the mitigation, remediation or acceptance of operational risk exposures.

In addition, Independent Risk Management, including the Operational Risk Management group, works proactively with Citi’s businesses and functions to drive a strong and embedded operational risk management culture and framework across Citi. The Operational Risk Management group actively challenges business and functions implementation of the Operational Risk Management Framework requirements and the quality of operational risk management practices and outcomes.

Information about businesses’ key operational risks, historical operational risk losses and the control environment is reported by each major business segment and functional area at relevant governance forums. Citi’s operational risk profile and related information is summarized and reported to senior management, as well as to the Audit and Risk Committees of Citigroup’s Board of Directors by the Head of Operational Risk Management.

Operational risk is measured through Operational Risk Capital and Operational Risk Regulatory Capital for the Advanced Approaches under Basel III. Projected operational risk losses under stress scenarios are estimated as a required part of the FRB’s CCAR process.

For additional information on Citi’s operational risks, see “Risk Factors—Operational Risks” above.

Cybersecurity Risk

Cybersecurity risk is the operational risk associated with the threat posed by a cyberattack, cyber breach or the failure to protect Citi’s most vital business information assets or operations, resulting in a financial or reputational loss (see the operational processes and systems and cybersecurity risk factors in “Risk Factors—Operational Risks” above). With an evolving threat landscape, ever-increasing sophistication of threat actor tactics, techniques and procedures, ongoing and emerging geopolitical conflicts, and the availability of new technologies, including those enabled by artificial intelligence and machine learning capabilities, to conduct financial transactions, Citi and its clients, customers and third parties (and fourth parties, etc.) continue to be at risk from cyberattacks and information security incidents. Citi leverages a threat-focused, industry-standard-aligned, defense-in-depth strategy that ensures that multiple controls work in tandem against various threats to increase the likelihood that malicious activity will be prevented, detected and mitigated.

Citi has a mature and comprehensive cybersecurity threat identification and management program that relies on an industry-aligned, risk-based, defense-in-depth approach, including an internal cybersecurity intelligence center, participation in industry and government information-sharing programs, vulnerability assessment and scanning tools, intrusion detection and prevention systems, security incident and event management systems, defensive architecture, penetration testing, adversary emulation exercises, data management (including classification, encryption, and identity and access management), multi-factor authentication requirements and other logical, physical and technical controls designed to prevent, deter, mitigate and respond to cybersecurity threats.

Citi’s cyber and information security program is supported by comprehensive governance, including policies, standards and procedures that dictate requirements and best practices around various program aspects, including, but not limited to, third-party risk management, data management, asset management, information security practices, security incident management and regulatory compliance. Citi’s Chief Information Security Organization’s risks and controls are measured against its Cybersecurity Risk Appetite Statement, which was initially approved by the Risk Management Committee of the Board of Directors and is reapproved annually by Citi’s Risk Committee, chaired by Citi’s Chief Risk Officer. Citi’s Cybersecurity Risk Appetite Statement leverages key risk indicators to establish enterprise risk

tolerance and define risk management strategy with respect to cyber and information security. Further, Citi actively participates in financial industry, government and cross-sector knowledge-sharing groups to enhance individual and collective cybersecurity preparedness and resilience.

Cybersecurity Risk Management and Governance

Citi’s technology and cybersecurity risk management program is built on Citi’s three lines of defense, each of which is integrated into Citi’s overall risk management systems and processes.

Citi’s Chief Information Security Organization, which is led by Citi’s Head of Foundational Services and Chief Information Security Officer (CISO), serves as the first line of defense. This office provides frontline business, operational and technical controls and capabilities to (i) protect against cybersecurity risks, and (ii) respond to cyber incidents, including data breaches. Citi manages cybersecurity threats through its state-of-the-art fusion centers, which serve as central commands for monitoring and coordinating responses to cyber threats.

Citi’s Chief Information Security Organization is responsible for application and infrastructure defense and security controls, performing vulnerability assessments and third-party information security assessments (including cybersecurity risk assessments associated with Citi’s use of products and services from vendors and other third-party providers), employee awareness and training programs, and security incident management. In each case, the enterprise information security team works in coordination with a network of information security officers who are embedded within Citi’s global businesses and functions, consistent with Citi’s philosophy that all Citi stakeholders have a responsibility in managing cyber and information security risks.

Citi’s Technology and Cyber Compliance and Operational Risk Office (TCCORO) serves as the second line of defense. This office independently evaluates and challenges Citi’s risk mitigation practices and capabilities, from a fused operational risk and compliance lens. It functions as a joint second line of defense and in accordance with Citi’s Cybersecurity Risk Appetite Statement. TCCORO also advises first line partners in CISO, supporting enterprise-wide efforts to proactively identify and remediate cybersecurity risks before they materialize as incidents that negatively affect business operations.

To address evolving cybersecurity risks and corresponding regulations, TCCORO monitors cybersecurity legal and regulatory requirements, identifies and defines emerging risks, executes strategic cybersecurity threat assessments, performs new product and initiative reviews, performs data management risk oversight and conducts cybersecurity risk assurance reviews (inclusive of third-party assessments). In addition, this office oversees and challenges metrics related to cybersecurity and technology and ensures they remain aligned with Citi’s overall operational risk management framework to effectively track, identify and manage risk. TCCORO presents an independent viewpoint on enterprise cybersecurity risk posture, and oversees CISO’s cybersecurity risk identification, measurement and enterprise-wide governance of cybersecurity risk.

Internal Audit serves as Citi’s third line of defense and provides independent assurance to the Audit Committee of the Board on the effectiveness of controls operated by the first and second lines of defense to manage cybersecurity risk.

Citi recognizes the risks associated with outsourcing services to, sharing data with, and/or technologically interacting with third parties. Citi has built a robust third-party information security risk management program that governs third-party engagements from selection, to the establishment of legal agreements that govern the relationship, to ongoing monitoring through the duration of the relationship. Third-party risk management includes reliance on contractual requirements around, among other things, data and cybersecurity, vulnerability assessments, third-party information security assessments performed at intervals determined by risk level, governance to manage end-of-life and end-of-vendor-support risks, and third-party incident response protocols.

Management Governance

Citi’s Head of Technology and Business Enablement, who reports directly to Citi’s CEO, has overall responsibility for Citi’s first line of defense cyber and information security and technology programs. Citi’s Head of Technology and Business Enablement has over 30 years of experience in the financial services industry. For additional information, see “Corporate Information—Executive Officers” below.

Citi’s Head of Foundational Services and CISO, who reports directly to Citi’s Head of Technology and Business Enablement, has primary responsibility to assess and manage Citi’s material risks from cybersecurity threats. Citi’s CISO has decades of experience in managing cybersecurity risks from prior financial services industry and government roles. The CISO is supported by a team of subject matter experts in security operations, network architecture, cyber and information security governance and cybersecurity operations. Citi employs approximately 3,400 individuals to manage its cybersecurity program.

Citi’s Chief Technology Officer (CTO) and Head of Emerging Technology and Strategic Partnerships, who also reports to Citi’s Chief Technology Officer, has primary responsibility for technology policy, innovation enablement and strategy. Citi’s CTO has held senior roles at Citi in technology, including engineering and architecture since 2012, and previously worked in equity linked technology in the financial services industry.

Multiple management committees and functions also support Citi’s cyber and information security management.

The Chief Information Officer Committee (CIOC), which consists of, among others, the Head of Technology and Business Enablement, Citi’s Chief Information Officers (who report to the Head of Technology and Business Enablement), the CISO, and the Head of TCCORO (who reports both to Citi’s Head of Operational Risk within the Risk organization and its Head of Global Functions Compliance within the Global Legal and Compliance organization), serves as an escalation forum for items requiring the attention of technology senior management, including approval of policies,

and reports items requiring further escalation to the Technology Committee of the Board of Directors, as appropriate.

The Information Security Risk Operating Committee (ISROC) is chaired by the CISO and comprises senior members of the Chief Information Security Office and representatives from partner organizations. This committee sets the direction and prioritization for the implementation of the cyber and information security program across Citi. The committee reports and escalates to the CIOC, including for intermediary review and approval of policies escalated from the Information Technology Policy Council (see below).

The Security Architecture Council, which reports to the ISROC, is an oversight and decision-making body focused on ensuring that the target level of security architectural maturity is attained. This council is co-chaired by two representatives from the security architecture and cybersecurity services organizations.

Citi’s Information Technology Policy Council provides a centralized review to oversee consistency in the formation of information technology policies and standards. This council maintains oversight of policy document requirements to ensure that information technology policy documents meet Citi’s objectives as established internally and are in line with laws and regulations as identified and communicated by ICRM.

In addition, Citi regularly engages third parties globally to assess, audit and/or exercise Citi’s cyber and information security program, which is ISO-27001 certified. ISO-27001 is an international standard for information security management systems. Citi is regulated by bodies across the globe that also regularly examine and audit Citi’s cyber and information security program against local laws, regulations and industry best practices.

Board Governance

Citigroup’s Board of Directors and its committees provide oversight of senior management’s efforts to mitigate cybersecurity risk and respond to cybersecurity incidents. Citi’s Board includes members with cybersecurity expertise and experience.

Citigroup’s full Board is briefed annually on cybersecurity risks and receives updates as needed on Citi’s cyber and information security program, including changes to the threat landscape and a roadmap for progress around addressing related risks. Additionally, Citigroup’s Board participates in cybersecurity exercises to improve preparedness to address cybersecurity incidents.

The Board’s Technology Committee receives quarterly updates from the Chief Information Security Office on the cybersecurity threat landscape, regulatory landscape, posture, and strategy and engages in discussions throughout the year with senior management and subject matter experts on the effectiveness of Citi’s overall cybersecurity program.

The Board’s Risk Management Committee (RMC) approved a standalone Cybersecurity Risk Appetite Statement against which Citi’s performance is measured quarterly. In addition, the RMC oversees Citi’s risk profile, which includes cybersecurity risk, and monitors whether Citi is operating within its cybersecurity risk appetite under its mandate to review key operational risks, including steps taken by management to control such risks.

In the event of a potentially material cybersecurity incident impacting Citi, the Board would be made aware of such incident via lines of communication that run from the Chief Information Security Office to senior management and also to the Board. This contemporaneous reporting on significant cyber events includes information and discussion around incident response, legal obligations (including disclosure), and outreach and notification to regulators and customers when needed.

For additional information on the Board’s oversight of cybersecurity risk management, see Citi’s upcoming 2026 Annual Meeting Proxy Statement to be filed with the SEC in April 2026.

COMPLIANCE RISK

Compliance risk is the risk to current or projected financial condition and resilience arising from violations of laws, rules or regulations, or from non-conformance with prescribed practices, internal policies and procedures or ethical standards. Compliance risk exposes Citi to fines, civil money penalties, payment of damages and the voiding of contracts. Compliance risk can result in diminished reputation, harm to Citi’s customers, limited business opportunities and lessened expansion potential. It encompasses the risk of noncompliance with all laws and regulations, as well as prudent ethical standards and some contractual obligations. It could also include exposure to litigation (known as legal risk) from all aspects of traditional and non-traditional banking.

Citi seeks to operate with integrity, maintain strong ethical standards and adhere to applicable policies and regulatory and legal requirements. Citi must maintain and execute a proactive Compliance Risk Management (CRM) Framework (as set forth in the CRM Policy) that is designed to manage compliance risk effectively across Citi, with a view to fundamentally strengthen the compliance risk management culture across the lines of defense taking into account Citi’s risk governance framework and regulatory requirements.

Independent Compliance Risk Management’s (ICRM) primary objectives are to:

•drive and embed a culture of compliance and control throughout Citi;

•maintain and oversee an integrated CRM Framework that facilitates enterprise-wide compliance with local, national or cross-border laws, rules or regulations, Citi’s internal policies, standards and procedures and relevant standards of conduct;

•assess compliance risks and issues across product lines, functions and geographies, supported by globally consistent systems and compliance risk management processes; and

•provide compliance risk data aggregation and reporting capabilities.

Citi carries out its objectives and fulfills its responsibilities through the CRM Framework, which is composed of the following integrated key activities, to holistically manage compliance risk:

•management of Citi’s compliance with laws, rules and regulations by identifying and analyzing changes, assessing the impact and implementing appropriate policies, processes and controls

•developing and providing compliance training to ensure employees are aware of and understand the key laws, rules and regulations

•monitoring the Compliance Risk Appetite, which is articulated through qualitative compliance risk statements describing Citi’s appetite for certain types of risk and quantitative measures to monitor the Company’s compliance risk exposure

•executing Compliance Risk Assessments, the results of which inform Compliance Risk Monitoring and testing of compliance risks and controls in assessing conformance with laws, rules, regulations and internal policies

•issue identification, escalation and remediation to drive accountability, including measurement and reporting of compliance risk metrics against established thresholds in support of the CRM Policy and Compliance Risk Appetite

To anticipate, control and mitigate compliance risk, Citi has established the CRM Policy to achieve standardization and centralization of methodologies and processes, and to enable more consistent and comprehensive execution of compliance risk management.

Citi has a commitment, as well as an obligation, to identify, assess and mitigate compliance risks associated with its businesses and functions. ICRM is responsible for oversight of Citi’s CRM Policy, while all businesses and global control functions are responsible for managing their compliance risks and operating within the Compliance Risk Appetite.

As discussed above, Citi is working to address the FRB and OCC Consent Orders, which include improvements to Citi’s CRM Framework and its enterprise-wide application (see “Citi’s Multiyear Transformation—FRB and OCC Consent Orders Compliance” above).

REPUTATION RISK

Citi’s reputation is a vital asset in building trust, and Citi is diligent in enhancing and protecting its reputation with its key stakeholders. To support this, Citi has developed a reputation risk framework. Under this framework, Citigroup and Citibank, N.A. have implemented a risk appetite statement and related key indicators to monitor corporate activities and operations relative to Citi’s risk appetite. The framework also requires that business segments escalate potential material reputation risks that require review or mitigation through the applicable business Management Forum or Group Reputation Risk Committee.

The Group Reputation Risk Committee and Management Forums, which are composed of Citi’s senior executives, govern the process by which material reputation risks are identified, measured, monitored, controlled, escalated and reported. The Group Reputation Risk Committee and Management Forums determine the appropriate actions to be taken in line with risk appetite and regulatory expectations, while promoting a culture of risk awareness and high standards of integrity and ethical behavior across the

Company, consistent with Citi’s Mission and Value Proposition. The Group Reputation Risk Committee may escalate reputation risks to the Nomination, Governance and Public Affairs Committee or other appropriate committee of the Citigroup Board of Directors.

Every Citi employee is responsible for safeguarding Citi’s reputation, guided by Citi’s Code of Conduct. Employees are expected to exercise sound judgment and common sense in decisions and actions. They are also expected to promptly escalate all issues that present material reputation risk in line with policy.

STRATEGIC RISK

As discussed above, strategic risk is the risk of a sustained impact (not episodic impact) to Citi’s core strategic objectives as measured by impacts on anticipated earnings, market capitalization or capital, arising from external factors affecting the Company’s operating environment, as well as the risks associated with defining and executing the strategy, which are identified, measured and managed as part of the Strategic Risk Framework at the enterprise level.

In this context, external factors affecting Citi’s operating environment are the economic environment, geopolitical/political landscape, industry/competitive landscape, environmental, customer/client behavior, regulatory/legislative environment and trends related to investors/shareholders. Material strategic risks that Citi is monitoring include the impacts of adverse changes in inflation and interest rates in the U.S., as well as macroeconomic uncertainties driven by weak global growth, tariffs, geopolitical issues and changing regulatory requirements. AI has added competitive pressure while productivity assumptions tied to AI-driven operation model changes may materialize more slowly than expected or require additional unforeseen upfront investment. In addition to external factors affecting Citi’s operating environment, Citi also monitors risks related to the execution of its strategy, with heightened focus on delivering the transformation of its risk and control environment pursuant to the 2020 FRB and OCC Consent Orders.

Citi’s Executive Management Team is responsible for the development and execution of Citi’s strategy. This strategy is translated into forward-looking plans (collectively Citi’s Strategic Plan) that are then cascaded across the organization. Citi’s Strategic Plan is presented to the Board on an annual basis, and is aligned with risk appetite thresholds and includes a risk assessment as required by internal frameworks. It is also aligned with limit requirements for capital allocation. Governance and oversight of strategic risk is facilitated by internal committees on a group-wide basis.

Citi works to ensure that strategic risks are adequately considered and addressed across its various risk management activities, and that strategic risks are assessed in the context of Citi’s risk appetite. Citi conducts a top-down, bottom-up risk identification process to identify risks, including strategic risks. Business segments undertake a quarterly risk identification process to systematically identify and document all material risks faced by Citi. Independent Risk Management oversees the risk identification process through regular reviews and coordinates identification and monitoring of top risks. In addition, Citi performs a quarterly Risk Assessment

of the Plan (RAOP) and continuously monitors risks associated with its execution of strategy. Independent Risk Management also manages strategic risk by monitoring risk appetite thresholds in conjunction with its Global Strategic Risk Committee, which is part of the governance structure that Citi has in place to manage its strategic risks.

For additional information on Citi’s strategic risks, see “Risk Factors—Strategic Risks” above.

Climate Risk

Climate change presents both immediate and long-term risks to Citi, with the risks expected to increase over time. Climate risk can arise from both physical risks and transition risks.

Climate risk is an overarching risk that can act as a driver of other categories of risk, such as credit risk from obligors exposed to high climate risk, strategic risks if Citi fails to consider transition risk in client selection, reputational risk from increased stakeholder concerns about financing or failing to finance high-carbon industries and operational risk from physical risks to Citi’s facilities. Citi continues to make progress toward embedding climate-related considerations into its overarching risk management approach, driven by the materiality of the financial and strategic risk considerations. For additional information on climate risk, see “Risk Factors—Strategic Risks” above.

Citi continues to develop globally consistent principles and approaches for managing climate risk across the Company through its Climate Risk Management Framework (Climate RMF). The Climate RMF provides information on the governance, roles and responsibilities, and principles to support the identification, measurement, monitoring, controlling and reporting of climate risks.

Citi continues to enhance its methodologies for quantifying how climate risks could impact the individual credit profiles of its clients across various sectors. Citi has developed and embedded climate risk assessments in its credit underwriting process for certain sectors that have been identified as higher climate risk. Such climate risk assessments are designed to incorporate publicly available client disclosures and data from third-party providers and facilitate conversations with clients on their most material climate risks and management plans for adaptation and mitigation. These assessments help Citi to better understand its clients’ businesses and climate-related risks, and support their financial needs.

Furthermore, Citi conducts internal scenario analysis to measure and assess potential financial risks from climate change across a range of scenarios. Citi also continues to engage with regulators on climate risk developments.

Citi reviews factors related to climate risk associated with financed projects and clients in certain sectors under its Environmental and Social Risk Management (ESRM) Policy. Citi’s ESRM Policy describes sector approaches to certain high-carbon sectors, including thermal coal mining and power.

For additional information about sustainability at Citi, see “Sustainability” above.

OTHER RISKS

Country Risk

Country risk is the risk of loss from economic, financial, political, legal or social conditions in the various countries and jurisdictions that Citi is exposed to. Country risk may impair the value of Citi’s franchise within a country or jurisdiction or adversely affect Citi’s ability to enforce the obligations of its obligors. Citi is exposed to country risk through its business activities such as lending, payments, investing and market-making activities, whether cross-border or locally funded, and including activities with corporations, governments and other institutions in a country or jurisdiction.

Citi manages country risk through a comprehensive risk framework supported by governance committees and councils that oversee country risk exposures, including but not limited to relevant limits, concentrations, metrics and frameworks, stress testing, significant country developments and risk mitigation actions. This is supported by tools and processes designed to facilitate the objective, consistent and ongoing assessments of individual countries and jurisdictions and the risks that may arise from Citi’s business activities within them.

Top 25 Country Exposures

The following table presents Citi’s top 25 exposures by country (excluding the U.S.) as of December 31, 2025. (Citi’s combined top 25 exposures by country together with the U.S. represent 93% of Citi’s exposure to all countries as of December 31, 2025.)

Citi’s top 25 exposures by country may change from period to period due to a variety of factors, including client activity, market flows, FX fluctuations and Citi’s liquidity management activities.

For purposes of the table, amounts are reflected based on the country of risk of the obligor. Additionally, the table does not include cumulative currency translation adjustment (CTA) gains and losses.

The country of risk will generally be the same as the country of incorporation of the obligor, except in certain situations, such as where the source of repayment is concentrated in a different country or jurisdiction or where the obligor is guaranteed by a parent entity incorporated in a different country or jurisdiction (e.g., a Swiss-incorporated subsidiary that is guaranteed by a Chinese-incorporated parent would be reflected as China risk).

Investment securities and trading account assets are generally categorized based on the domicile of the issuer of the security of the underlying reference entity.

(1) Other funded includes other direct exposures such as loans HFS, other loans in Corporate/Other and investments accounted for under the equity method.

(2) Unfunded commitments include unfunded corporate lending commitments, letters of credit and other contingencies, including clearing house guarantee funds.

(3) Net counterparty exposure includes mark-to-market (MTM) exposures on OTC derivatives, carrying amounts of securities lending/borrowing transactions (repos) and margin loan balances. This exposure is also net of collateral and inclusive of CVA.

(4) Investment securities include AFS debt securities, recorded at fair market value, and HTM debt securities, recorded at amortized cost.

(5) Trading account assets are represented on a net basis and include issuer risk on both long and short debt and equity securities and derivative exposure.

Russia

Sale of AO Citibank

Financial Impacts in 2025

On December 29, 2025, Citi’s Board of Directors approved a plan to sell AO Citibank, which conducted Citi’s remaining operations in Russia. As a result of this approval:

•Citi reported its remaining businesses in Russia as held-for-sale (HFS) as of the fourth quarter of 2025.

•The HFS accounting treatment resulted in a pretax loss on sale for the fourth quarter of 2025 of approximately $1.2 billion ($1.1 billion after-tax), recognized as a reduction in Other revenue through a valuation allowance. See the “Loss on Sale by Segment and All Other” table below.

•The loss on sale consisted of:

•approximately $1.6 billion related to the currency translation adjustment (CTA) losses that will also remain in Accumulated other comprehensive income (AOCI) until closing;

•an approximate $0.2 billion of expected benefit from the 2026 derecognition of its fully reserved investment, and

•an approximate $0.2 billion of expected proceeds of the 2026 sale.

Loss on Sale by Segment and All Other

Financial Impacts in 2026

On February 18, 2026, Citi signed and closed the sale of AO Citibank to Renaissance Capital (RenCap):

•At the close of the sale, Citi’s direct Russia-related exposures were fully extinguished. Citi’s clients’ Russia-related exposures ($12.5 billion as of December 31, 2025) were assumed by RenCap. Of this $12.5 billion, approximately $1.5 billion is owed to Citi by RenCap based on the December 31, 2025 amounts. These amounts, in turn, are owed by Citi to its clients and are subject to further changes based on corporate dividends received by RenCap and owed to Citi. Citi’s clients’ exposures consist of corporate dividends that cannot be remitted due to restrictions imposed by the Russian government.

•The divestiture of the remaining business operations is expected to provide an estimated benefit to Citi’s CET1 capital in the first quarter of 2026 of approximately $4.0 billion, primarily driven by the deconsolidation of associated risk-weighted assets, a reduction in disallowed DTAs and the release of associated CTA loss. While a benefit in the first quarter of 2026, the cumulative impact of the $1.6 billion CTA loss is regulatory capital neutral to Citi.

Ukraine

Citi has continued to operate in Ukraine throughout the war through its Services, Marketsand Banking businesses, serving the local subsidiaries of multinationals, along with local financial institutions and the public sector. Citi employs approximately 215 people in Ukraine and their safety is Citi’s top priority. All of Citi’s domestic operations in Ukraine are conducted through a subsidiary of Citibank, which uses the Ukrainian hryvnia as its functional currency. As of December 31, 2025, Citi had $1.9 billion of direct exposures related to Ukraine (compared to $1.7 billion at September 30, 2025).

Argentina

Citi operates in Argentina through its Services, Markets and Banking businesses. As of December 31, 2025, Citi’s net investment in its Argentine operations, inclusive of associated reserves, was approximately $1.3 billion (compared to $1.4 billion at September 30, 2025). Citi uses the U.S. dollar (USD) as the functional currency for its operations in countries such as Argentina that are deemed highly inflationary in accordance with GAAP. Citi uses Argentina’s official market exchange rate to remeasure its net Argentine peso (ARS)–denominated assets into USD, with the impact of exchange rate fluctuations recorded directly in earnings. As of December 31, 2025, the official ARS exchange rate was 1455, which devalued by 5.4% against the USD during the fourth quarter of 2025.

The Central Bank of Argentina (BCRA) has generally maintained certain capital and currency controls that have broadly restricted Citi’s ability to access USD in Argentina and remit earnings from its Argentine operations.

During the second quarter of 2025, Citi subscribed to approximately $340 million of par value of the latest series of certain USD-denominated bonds (BOPREALs) issued by the BCRA, which provided a mechanism for Argentine companies to pay dividends by selling the bonds and remitting the proceeds. Citi completed the sale of the BOPREALs during

2025 and remitted the total proceeds of approximately $262

million from its Argentine operations, thereby reducing its net

investment in the country.

Of the $1.3 billion net investment in Argentina as of December 31, 2025, Citi’s net ARS exposure (net of the associated reserves) was approximately $0.9 billion (compared to $0.8 billion at September 30, 2025). As of December 31, 2025, Citi hedged approximately $0.4 billion of its ARS exposure through offshore hedges and was unable to hedge its remaining exposure, due to illiquidity in the offshore derivatives market. Given the historical capital and currency controls, certain indirect foreign exchange mechanisms continue to exist that some Argentine entities may use to obtain USD, often at rates higher than the official exchange rate. Citibank Argentina is generally precluded from accessing these alternative mechanisms, and under U.S. GAAP, these exchange mechanisms cannot be used to remeasure Citi’s net monetary assets into USD. If Argentina’s official exchange rate further converges with the approximate rate implied by the indirect foreign exchange mechanisms, Citi could incur additional translation losses on its net investment in Argentina.

To the extent that Citi is unable to hedge its ARS exposure in the future, Citi may incur additional translation losses on its net investment in Argentina.

For additional information on Citi’s emerging markets risks, including those related to its Argentina exposures, see “Risk Factors—Other Risks” above.

Citi continually evaluates its economic exposure to its Argentine counterparties and reserves for changes in credit risk and records mark-to-market adjustments for relevant market risks associated with its Argentine assets. Citi believes it has established an appropriate ACL on its Argentine loans, and appropriate fair value adjustments on Argentine assets and liabilities measured at fair value, for credit and sovereign risks under U.S. GAAP as of December 31, 2025. For additional information on Citi’s emerging markets risks, including those related to its Argentine exposures, see “Risk Factors—Strategic Risks” above.

SIGNIFICANT ACCOUNTING POLICIES AND SIGNIFICANT ESTIMATES

This section contains a summary of Citi’s most significant accounting policies. Note 1 contains a summary of all of Citigroup’s significant accounting policies. These policies, as well as estimates made by management, are integral to the presentation of Citi’s results of operations and financial condition. While all of these policies require a certain level of management judgment and estimates, this section highlights and discusses the significant accounting policies that require management to make highly difficult, complex or subjective judgments and estimates at times regarding matters that are inherently uncertain and susceptible to change (see also “Risk Factors—Operational Risks” above). Management has discussed each of these significant accounting policies, the related estimates and its judgments with the Audit Committee of the Citigroup Board of Directors.

Valuations of Financial Instruments

Citigroup holds debt and equity securities, derivatives, retained interests in securitizations, investments in private equity and other financial instruments. A portion of these assets and liabilities is reflected at fair value on Citi’s Consolidated Balance Sheet as Trading account assets, Available-for-sale securitiesand Trading account liabilities.

Citi purchases securities under agreements to resell (reverse repos or resale agreements) and sells securities under agreements to repurchase (repos), a substantial portion of which is carried at fair value. In addition, certain loans, short-term borrowings, long-term debt and deposits, as well as certain securities borrowed and loaned positions that are collateralized with cash, are carried at fair value. Citigroup holds its investments, trading assets and liabilities, and resale and repurchase agreements on Citi’s Consolidated Balance Sheet to meet customer needs and to manage liquidity needs, interest rate risks and private equity investing.

When available, Citi generally uses quoted market prices to determine fair value and classifies such items within Level 1 of the fair value hierarchy established under ASC 820-10, Fair Value Measurement. If quoted market prices are not available, fair value is based on internally developed valuation models that use, where possible, current market-based or independently sourced market parameters, such as interest rates, currency rates and option volatilities. Such models are often based on a discounted cash flow analysis. In addition, items valued using such internally generated valuation techniques are classified according to the lowest level input or value driver that is significant to the valuation. Thus, an item may be classified under the fair value hierarchy as Level 2 if the significant inputs are observable or Level 3 if there are some significant inputs that are not readily observable.

Citi is required to exercise subjective judgments relating to the applicability and functionality of internal valuation models, the significance of inputs or drivers to the valuation of an instrument and the degree of illiquidity and subsequent lack of observability in certain markets. The fair value of these instruments is reported on Citi’s Consolidated Balance Sheet with the changes in fair value recognized in either the Consolidated Statement of Income or in AOCI.

Losses on available-for-sale securities whose fair values are less than the amortized cost, where Citi intends to sell the security or could more-likely-than-not be required to sell the security prior to recovery, are recognized in earnings. Where Citi does not intend to sell the security nor could more-likely-than-not be required to sell the security, any portion of the loss that is attributable to credit is recognized as an allowance for credit losses with a corresponding provision for credit losses, and the remainder of the unrealized loss is recognized in AOCI. Such credit losses are capped at the difference between the fair value and amortized cost of the security.

For equity securities carried at cost or under the measurement alternative, decreases in fair value below the carrying value are recognized as impairment in the Consolidated Statement of Income. Moreover, for certain equity method investments, decreases in fair value are only recognized in earnings in the Consolidated Statement of Income if such decreases are judged to be an other-than-temporary impairment (OTTI). Assessing if the fair value impairment is temporary is also inherently judgmental.

The fair value of financial instruments incorporates the effects of Citi’s own credit risk and the market view of counterparty credit risk, the quantification of which is also complex and judgmental. For additional information on Citi’s fair value analysis, see Notes 1 (“Fair Value” and “Fair Value Hedges”), 6, 26 and 27.

Citi’s Allowance for Credit Losses (ACL)

The table below presents Citi’s allowance for credit losses on loans (ACLL) and total ACL as of December 31, 2025 and 2024, as well as builds and releases during 2025. For information on the drivers of Citi’s ACL net build in the fourth quarter of 2025, see below. See Note 1 for additional information on Citi’s accounting policy on accounting for credit losses under Topic 326.

(1) Includes Legacy Franchises corporate loans activity related to Mexico SBMM and the Assets Finance Group (AFG), as well as other Legacy Holdings Assets corporate loans.

(2) As of December 31, 2025, in USPB, Branded Cards ACLL/EOP loans was 6.3% and Retail Services ACLL/EOP loans was 10.8%.

(3) See footnote 4 in “U.S. Personal Banking” above for the description of a change in reporting.

(4)All Other (managed basis) excludes divestiture-related impacts (Reconciling Items) related to (i) Citi’s divestitures of its Asia Consumer businesses and (ii) the ongoing divestiture of Banamex, within Legacy Franchises. The Reconciling Items are reflected in Citi’s Consolidated Statement of Income. See “All Other—Divestiture-Related Impacts (Reconciling Items)” above.

(5) Includes ACL on Other assets, primarily related to transfer risk associated with exposures outside the U.S. and Held-to-maturity debt securities. As of December 31, 2025, the reduction in the Other ACL was driven by the reclassification of AO Citibank to held-for-sale, including the related ACL, resulting from Citi’s planned sale of AO Citibank (which was sold on February 18, 2026), partially offset by ACL builds and changes in FX during the year. See “Sale of AO Citibank” in Note 2.

Citi’s reserves for expected credit losses on funded loans and for unfunded lending commitments, standby letters of credit and financial guarantees are reflected on the Consolidated Balance Sheet in the Allowance for credit losses on loans (ACLL) and Other liabilities(for Allowance for credit losses on unfunded lending commitments (ACLUC)), respectively. In addition, Citi’s reserves for expected credit losses on other financial assets carried at amortized cost, including held-to-maturity securities, reverse repurchase agreements, securities borrowed, deposits with banks and other financial receivables, are reflected in Other assets, including transfer risk associated with exposures outside the U.S. These reserves, together with the ACLL and ACLUC, are referred to as the ACL. Changes in the ACL are reflected in Provision for credit losses in the Consolidated Statement of

Income for each reporting period. Citi’s ability to estimate expected credit losses is based on the ability to forecast economic activity over a reasonable and supportable (R&S) timeframe. The R&S forecast period is eight quarters.

The ACL is composed of quantitative and qualitative management adjustment components. The quantitative component uses three forward-looking macroeconomic forecast scenarios—base, upside and downside. The qualitative management adjustment component includes risks that are not fully captured in the quantitative component. Both the quantitative and qualitative components are further discussed below.

Quantitative Component

Citi estimates expected credit losses for its quantitative component using the following:

•its comprehensive internal data on loss and default history

•internal credit risk ratings

•external credit bureau and rating agencies information

•R&S forecasts of macroeconomic conditions

For its consumer and corporate portfolios, Citi’s expected credit losses are determined primarily by utilizing models that consider the borrowers’ probability of default (PD), loss given default (LGD) and exposure at default (EAD). The loss likelihood and severity models used for estimating expected credit losses are sensitive to changes in macroeconomic variables, including unemployment rate, real GDP and housing prices, and cover a wide range of geographic, industry, product and business segments.

In addition, Citi’s models determine expected credit losses based on portfolio characteristics, including loan delinquencies, changes in portfolio size, default frequency, risk ratings and loss recovery rates, as well as other credit trends.

Qualitative Component

The qualitative management adjustment component includes risks that are not fully captured in the quantitative component. These may include but are not limited to portfolio characteristics, idiosyncratic events, factors not within historical loss data or the economic forecast, uncertainty in the credit environment and other factors as required by banking supervisory guidance for the ACL. The primary examples of risks that are not fully captured in the quantitative component are the following:

•potential impacts on vulnerable industries and regions due to emerging macroeconomic risks and uncertainties, including those related to a potential global recession, inflation, interest rates and commodity prices

•transfer risk associated with exposures outside the U.S.

As of the fourth quarter of 2025, Citi’s qualitative component of the ACL decreased quarter-over-quarter, driven by the reclassification of AO Citibank to held-for-sale, including the related ACL, resulting from Citi’s planned sale of AO Citibank (which was sold on February 18, 2026).

Macroeconomic Variables

As further discussed below, Citi considers various global macroeconomic variables for the base, upside and downside probability-weighted macroeconomic scenario forecasts it uses to estimate the quantitative component of the ACL. The forecasts of the U.S. unemployment rate and U.S. real GDP growth rate represent the key macroeconomic variables that most significantly affect its estimate of the ACL.

The tables below present the forecasted quarterly average U.S. unemployment rate and year-over-year U.S. real GDP growth rate used in determining the base macroeconomic forecast for Citi’s ACL at each quarterly reporting period from the fourth quarter of 2024 to the fourth quarter of 2025:

(1) Represents the average unemployment rate for the rolling, forward-looking eight quarters in the forecast horizon.

(1) The year-over-year growth rate is the percentage change in the real (inflation adjusted) GDP level.

Scenario Weighting

Citi’s ACL is estimated using three probability-weighted macroeconomic scenarios—base, upside and downside. The macroeconomic scenario weights are estimated using a statistical model, which, among other factors, takes into consideration (i) key macroeconomic drivers of the ACL, (ii) the severity of the scenario and (iii) other sources of macroeconomic uncertainties and risks. Citi evaluates scenario weights on a quarterly basis.

Citi’s downside scenario incorporates more adverse macroeconomic assumptions than the weighted scenario assumptions or the base scenario. For example, compared to the base scenario, Citi’s downside scenario reflects a recession, including an elevated average U.S. unemployment rate of 6.9% over the eight-quarter R&S period, with a peak difference of 3.5% in the second quarter of 2027. The weighted-average U.S. unemployment rate that considers all three probability-weighted scenarios is 5.2%. The downside scenario also reflects a year-over-year U.S. real GDP contraction in 2026 of 1.8%, with a peak quarter-over-quarter difference to the base scenario of 1.2%.

Citi’s ACL is sensitive to the various macroeconomic scenarios that drive the quantitative component of expected credit losses. Citi’s downside scenario incorporates more adverse macroeconomic assumptions than the weighted scenario assumptions. To demonstrate this sensitivity, if Citi applied 100% weight to the downside scenario as of December 31, 2025 to reflect the most severe economic deterioration forecast in the macroeconomic scenarios, there would have been a hypothetical incremental increase in the ACL of approximately $5.0 billion related to lending exposures, except for loans individually evaluated for credit losses and other financial assets carried at amortized cost.

This analysis does not incorporate any impacts or changes to the qualitative component of the ACL, which could change the outcome of the sensitivity analysis based on historical experience and current conditions at the time of the assessment. Given the uncertainty inherent in macroeconomic forecasting, Citi continues to believe that its ACL estimate based on a three probability-weighted macroeconomic scenario approach combined with the qualitative component remains appropriate as of December 31, 2025.

4Q25 Changes in the ACL

As further discussed below, Citi’s ending ACL balance for the fourth quarter of 2025 was $21.4 billion, a decrease of $2.4 billion from September 30, 2025, driven by the reclassification of AO Citibank to held-for-sale, including the related ACL, resulting from Citi’s planned sale of AO Citibank (which was sold on February 18, 2026). Citi believes its analysis of the ACL reflects the forward view of the economic environment as of December 31, 2025. See Notes 2 (“Sale of AO Citibank”) and 16 for additional information.

Consumer Allowance for Credit Losses on Loans

Citi’s consumer ACLL is primarily driven by U.S. cards (Branded Cards and Retail Services) in USPB. Citi’s total consumer ACLL net release was less than $0.1 billion in the fourth quarter of 2025 compared to the prior quarter, driven by changes in credit quality including seasonal improvement, offset by higher volume and changes in the macroeconomic outlook. This resulted in a December 31, 2025 ACLL balance of $16.2 billion, or 3.96% of total funded consumer loans.

For U.S. cards, the level of reserves relative to total funded loans decreased to 7.67% at December 31, 2025, compared to 8.01% at September 30, 2025. For the remaining consumer exposures, the level of reserves relative to total funded loans was 1.22% at December 31, 2025, compared to 1.20% at September 30, 2025.

Corporate Allowance for Credit Losses on Loans

Citi had a corporate ACLL net build of $0.1 billion in the fourth quarter of 2025 compared to the prior quarter, driven by changes in credit quality in Banking, largely offset by a refinement of loss assumptions for certain portfolios in Spread Products in Markets. This resulted in a December 31, 2025 ACLL balance of $3.1 billion, or 0.91% of total funded corporate loans.

ACLUC

Citi’s ACLUC balance, included in Other liabilities, was $1.8 billion at December 31, 2025, unchanged from September 30, 2025.

ACL on Other Financial Assets

Citi had an ACL release of less than $0.1 billion on other financial assets carried at amortized cost for the fourth quarter of 2025 compared to the prior quarter. The Other ACL reserve balance decreased by $2.5 billion to $0.3 billion at December 31, 2025 from September 30, 2025, driven by the reclassification of AO Citibank to held-for-sale, including the related ACL, resulting from Citi’s planned sale of AO Citibank (which was sold on February 18, 2026). See Notes 2 (“Sale of AO Citibank”) and 16 for additional information.

Regulatory Capital Impact

Citi elected the modified CECL transition provision for regulatory capital purposes provided by the U.S. banking agencies’ final rule. Accordingly, the Day One regulatory capital effects resulting from the adoption of CECL, as well as the ongoing adjustments for 25% of the change in CECL-based allowances in each quarter between January 1, 2020 and December 31, 2021, started to be phased in on January 1, 2022 and were fully reflected in Citi’s regulatory capital as of January 1, 2025.

See Notes 1 (“Allowance for Credit Losses (ACL)”) and 16 for further descriptions of the ACL and related accounts.

Citi tests for goodwill impairment annually as of October 1 (the annual test) and conducts interim assessments between annual tests if an event occurs or circumstances change that would more-likely-than-not reduce the fair value of a reporting unit below its carrying amount. These events or circumstances include, among other things, a significant adverse change in the business climate, a decision to sell or dispose of all or a significant portion of a reporting unit or a sustained decrease in Citi’s stock price.

Citigroup’s activities were conducted through the reportable operating segments: Services, Markets, Banking, Wealthand USPB, with the remaining operations recorded in All Other, which includes activities not assigned to a specific operating segment as well as discontinued operations.

Goodwill impairment testing is performed at the level below the operating segment (referred to as a reporting unit).

During the third quarter of 2025, Citi performed an interim goodwill impairment test, in connection with the agreed-upon bid received for Banamex. The test resulted in an impairment of $726 million ($714 million after-tax) to the Mexico Consumer/SBMM reporting unit within All Other—Legacy Franchises. The remaining goodwill within All Other—Legacy Franchises is attributable to the Mexico Consumer/SBMM reporting unit, which was not deemed to be impaired. No other events or circumstances were identified to indicate that the fair values of Citi’s other reporting units were more-likely-than-not reduced below their respective carrying amounts, and no further impairment was recognized as of September 30, 2025.

During the fourth quarter of 2025, Citi performed its annual goodwill impairment test, which resulted in no further impairment to any of Citi’s reporting units’ goodwill. No additional triggering events were identified and no goodwill was impaired during the fourth quarter of 2025. For each of the Company’s reporting units, except for the Mexico Consumer/SBMM reporting unit, the fair value exceeded carrying value by at least 10%.

Reporting units used for goodwill assessment at the Citigroup consolidated level may differ from the reporting units of its subsidiaries.

Citi utilizes allocated tangible common equity as a proxy for the carrying value of its reporting units for purposes of goodwill impairment testing. The allocated equity in the reporting units is determined based on the capital the business would require if it were operating as a standalone entity, incorporating sufficient capital to be in compliance with both current and expected regulatory capital requirements, including capital for specifically identified goodwill and intangible assets. The capital allocated to the reporting units is incorporated into the annual budget process, which is approved by Citigroup’s Board of Directors.

Goodwill impairment testing involves management judgment, requiring an assessment of whether the carrying value of a reporting unit can be supported by its fair value using widely accepted valuation techniques, such as the market approach (earnings multiples and/or transaction multiples) and/or the income approach (discounted cash flow (DCF) method). In applying these methodologies, Citi utilizes a number of factors, including actual operating results, future business plans, economic projections and market data.

Citi estimates fair value of the reporting units based on a balanced weighting of fair values estimated using both an income approach and a market approach, which are intended to reflect Company performance and expectations as well as external market conditions. The income approach employs a capital asset pricing model in estimating the discount rate and utilized discount rates that Citi believes adequately reflected the risk and uncertainty in the financial markets in the internally generated cash flow projections. The market approach utilizes observable market data from comparable publicly traded companies, such as price-to-earnings or price- to-tangible book value ratios, to estimate a reporting unit’s fair value. Management uses judgment in the selection of comparable companies and includes those with the most similar business activities.

Since none of the Company’s reporting units are publicly traded, individual reporting unit fair value determinations cannot be directly correlated to Citigroup’s common stock price. The aggregate fair value of Citi’s reporting units exceeded Citi’s market capitalization as of October 1, 2025. In evaluating this comparison, the factors contributing to the differences include the following:

•control premiums

•execution risk present at the Citigroup level, but not at the reporting unit level

•market volatility and other factors that do not directly affect the value of individual reporting units

Unanticipated declines in business performance, increases in credit losses, increases in capital requirements and adverse regulatory or legislative changes, as well as deterioration in economic or market conditions, as well as circumstances related to Citi’s strategic refresh, are factors that could result in a material impairment loss to earnings in a future period related to some portion of the associated goodwill. See Notes 1 (“Goodwill”) and 17 for additional information on goodwill, including the changes in the goodwill balance year-over-year and the segments’ and All Other’s goodwill balances as of December 31, 2025.

Litigation Accruals

See the discussion in Note 30 for Citi’s policies on establishing accruals for litigation and regulatory contingencies.

Income Taxes

Citi is subject to the income tax laws of the U.S., its states and local municipalities and the non-U.S. jurisdictions in which Citi operates. These tax laws are complex and are subject to differing interpretations by the taxpayer and the relevant governmental taxing authorities. Disputes over interpretations of the tax laws may be subject to review and adjudication by the court systems of the various tax jurisdictions or may be settled with the taxing authority upon audit.

In establishing a provision for income tax expense, Citi must make judgments and interpretations about the application of these inherently complex tax laws. Citi must also make estimates about when in the future certain items will affect taxable income in the various tax jurisdictions, both domestic and foreign. Deferred taxes are recorded for the future consequences of events that have been recognized in the financial statements or tax returns, based on enacted tax laws and rates. Deferred tax assets (DTAs) are recognized subject to management’s judgment that realization is more-likely-than-not. For example, if it is more-likely-than-not that a carry-forward would expire unused, Citi would set up a valuation allowance against that DTA. Citi has established valuation allowances as described below.

Citi is taxed on income generated by its U.S. operations at a federal tax rate of 21%. Citi’s income from U.S. operations is also taxed by U.S. state and local governments at an average marginal rate of approximately 3%.

Citi’s non-U.S. branches and subsidiaries are subject to tax at their local tax rates. Non-U.S. branches also continue to be subject to U.S. taxation. The impact of this on Citi’s earnings depends on the level of branch pretax income, the local branch tax rate, and allocations of overall domestic loss (ODL) and expenses for U.S. tax purposes to branch earnings. Citi expects no residual U.S. tax on such earnings. With respect to non-U.S. subsidiaries, dividends from these subsidiaries will be excluded from U.S. taxation. While the majority of Citi’s non-U.S. subsidiary earnings are classified as global intangible low-taxed income (GILTI), Citi’s non-U.S. subsidiaries’ local tax rates exceed, on average, the effective 13.125% GILTI tax rate. As a result, Citi expects to owe limited residual U.S. tax on non-U.S. subsidiary earnings, resulting entirely from the allocation of expenses for U.S. tax purposes to such earnings (which is no longer required starting in 2026—see discussion of OBBBA below).

The OECD Pillar 2 framework, first published in 2021, contemplates a 15% global minimum tax with respect to earnings in each country. The majority of EU member states and many other non-U.S. countries have adopted the OECD Pillar 2 rules. Under these rules, Citi will be required to pay a “top-up” tax to the extent that Citi’s effective tax rate in any given country is below 15%. In 2024, countries that adopted the OECD Pillar 2 rules were able to collect the top-up tax only with respect to earnings of entities in their jurisdiction or subsidiaries of such entities. In 2025, all countries that adopted the OECD Pillar 2 rules were able to collect a share of the top-up tax owed with respect to any member of the Pillar 2 multinational group. In early 2026, the OECD announced an agreement recognizing that the U.S. tax system will exist “side by side” with the Pillar 2 framework, and subsidiaries and branches of U.S. multinationals will only be subject to the top-up tax in countries that have adopted the OECD Pillar 2 rules (effectively returning to the 2024 approach). This agreement has not yet been fully implemented in all of the relevant countries. While Citi does not currently expect the OECD Pillar 2 rules to have a material impact on its earnings, many aspects of the application of the rules and their implementation remain uncertain and the scope and applicability of the rules are still evolving. Citi is closely monitoring developments relating to the Pillar 2 rules to determine their potential impact.

On July 4, 2025, the U.S. fiscal year 2025 budget reconciliation legislation (commonly known as the One Big Beautiful Bill Act (OBBBA)) was signed into law, containing a number of tax law changes, most of which are effective starting in 2026. The OBBBA removed the requirement to allocate expenses to non-U.S. subsidiary earnings, which is expected to eliminate Citi’s residual U.S. tax on these earnings. The Act also limited deductibility of corporate charitable contributions that do not exceed 1% of total taxable income, which is expected to make all of Citi’s charitable giving non-deductible. Finally, the OBBBA made prospective changes to the transferability of certain clean energy tax credits, which may impact Citi’s investments in these credits going forward. The OBBBA’s effect on Citi’s state tax rate is dependent upon how and when the individual states that have not yet addressed the federal tax law changes choose to conform to the various new provisions of the U.S. Internal Revenue Code.

Deferred Tax Assets and Valuation Allowances (VA)

At December 31, 2025, Citi had net DTAs of $29.5 billion. In the fourth quarter of 2025, Citi’s DTAs decreased by $0.0 billion, primarily due to improvement in U.S. pretax earnings offset by an increase in withholding/other taxes related to Citi’s geographical footprint. On a full-year basis, Citi’s DTAs decreased by $0.3 billion from $29.8 billion at December 31, 2024.

Of Citi’s total net DTAs of $29.5 billion as of December 31, 2025, $13.1 billion, primarily related to tax carry-forwards, was deducted in calculating Citi’s regulatory capital. Net DTAs arising from temporary differences are also deducted from regulatory capital if in excess of the 10%/15% limitations (see “Capital Resources” above). For the quarter and year ended December 31, 2025, Citi had $3.1 billion of disallowed temporary difference DTAs (included in the $13.1 billion above). The remaining $16.4 billion of net DTAs as of December 31, 2025 was not deducted in calculating regulatory capital pursuant to Basel III standards and was appropriately risk weighted under those rules.

Citi’s total VA at December 31, 2025 was $5.0 billion, an increase of $0.7 billion from $4.3 billion at December 31, 2024. The increase was primarily driven by the reduction of U.S. residual DTL related to its non-U.S. branches, partially offset by the reduction in prior-year FTCs in the branch basket. Citi’s VA of $5.0 billion is composed of $2.3 billion on its FTC branch basket carry-forwards, $1.6 billion on its U.S. residual DTA related to its non-U.S. branches, $0.6 billion on federal and state DTA related to business exits, $0.4 billion on local non-U.S. DTAs and $0.1 billion on state net operating loss carry-forwards.

As stated above with regard to the impact of non-U.S. branches on Citi’s earnings, the level of branch pretax income, the local branch tax rate and the allocations of ODL and expenses for U.S. tax purposes to the branch basket are the main factors in determining the branch VA. Additional ODL was created in 2025 due to domestic losses.

Recognized FTC carry-forwards in the general basket comprised approximately $0.3 billion of Citi’s DTAs as of December 31, 2025, compared to approximately $0.7 billion as of December 31, 2024. The decrease in FTCs year-over-year was primarily due to current-year usage. The FTC carry-forward period represents the most time-sensitive component of Citi’s DTAs.

Citi had an ODL of approximately $10.3 billion at December 31, 2025, which allows Citi to elect a percentage between 50% and 100% of future years’ domestic source income to be reclassified as foreign source income. (See Note 10 for a description of the ODL.)

The majority of Citi’s U.S. federal net operating loss carry-forward and all of its New York State and City net operating loss carry-forwards are subject to a carry-forward period of 20 years. This provides enough time to fully utilize the net DTAs pertaining to these existing net operating loss carry-forwards. This is due to Citi’s forecast of sufficient U.S. taxable income and the continued taxation of Citi’s non-U.S. income by New York State and City.

Although realization is not assured, Citi believes that the realization of its recognized net DTAs of $29.5 billion at December 31, 2025 is more-likely-than-not, based on management’s expectations as to future taxable income in the jurisdictions in which the DTAs arise, as well as available tax planning strategies (as defined in ASC Topic 740, Income Taxes). Citi has concluded that it has the necessary positive evidence to support the realization of its net DTAs after taking its VAs into consideration.

See Note 10 for additional information on Citi’s income taxes, including its income tax provision, tax assets and liabilities and a tabular summary of Citi’s net DTAs balance as of December 31, 2025 (including the FTCs and applicable expiration dates of the FTCs). For information on Citi’s ability to use its DTAs, see “Risk Factors—Strategic Risks” above and Note 10.

Accounting Changes

See “Accounting Changes” in Note 1 for a discussion of changes in accounting standards.

DISCLOSURE CONTROLS AND PROCEDURES

Citi’s disclosure controls and procedures are designed to ensure that information required to be disclosed under the Securities Exchange Act of 1934, as amended, is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms, including without limitation that information required to be disclosed by Citi in its SEC filings is accumulated and communicated to management, including the Chief Executive Officer (CEO) and Chief Financial Officer (CFO), as appropriate, to allow for timely decisions regarding required disclosure.

Citi’s Disclosure Committee assists the CEO and CFO in their responsibilities to design, establish, maintain and evaluate the effectiveness of Citi’s disclosure controls and procedures. The Disclosure Committee is responsible for, among other things, the oversight, maintenance and implementation of the disclosure controls and procedures, subject to the supervision and oversight of the CEO and CFO.

Citi’s management, with the participation of its CEO and CFO, has evaluated the effectiveness of Citigroup’s disclosure controls and procedures (as defined in Rule 13a-15(e) under the Securities Exchange Act of 1934) as of December 31, 2025. Based on that evaluation, the CEO and CFO have concluded that at that date Citigroup’s disclosure controls and procedures were effective.

MANAGEMENT’S ANNUAL REPORT ON INTERNAL CONTROL OVER FINANCIAL REPORTING

Citi’s management is responsible for establishing and maintaining adequate internal control over financial reporting. Citi’s internal control over financial reporting is designed to provide reasonable assurance regarding the reliability of its financial reporting and the preparation of financial statements for external reporting purposes in accordance with U.S. generally accepted accounting principles. Citi’s internal control over financial reporting includes those policies and procedures that:

•pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of Citi’s assets;

•provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles and that Citi’s receipts and expenditures are made only in accordance with authorizations of Citi’s management and directors; and

•provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of Citi’s assets that could have a material effect on its financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect all misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions or that the degree of compliance with the policies or procedures may deteriorate.

Citi’s management assessed the effectiveness of Citigroup’s internal control over financial reporting as of December 31, 2025 based on the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in Internal Control—Integrated Framework (2013). Based on this assessment, management has concluded that, as of December 31, 2025, Citi’s internal control over financial reporting was effective. In addition, there were no changes in Citi’s internal control over financial reporting during the fiscal quarter ended December 31, 2025 that materially affected, or are reasonably likely to materially affect, Citi’s internal control over financial reporting.

The effectiveness of Citi’s internal control over financial reporting as of December 31, 2025 has been audited by KPMG LLP, Citi’s independent registered public accounting firm, as stated in their report below, which expressed an unqualified opinion on the effectiveness of Citi’s internal control over financial reporting as of December 31, 2025.

FORWARD-LOOKING STATEMENTS

Certain statements in this report, including but not limited to statements included within the Management’s Discussion and Analysis of Financial Condition and Results of Operations, are “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. In addition, Citigroup may make forward-looking statements in its other documents filed or furnished with the SEC, and its management may make forward-looking statements orally to analysts, investors, representatives of the media and others.

Generally, forward-looking statements are not based on historical facts but instead represent Citigroup’s and its management’s beliefs regarding future events. Such statements may be identified by words such as believe, expect, anticipate, intend, estimate, may increase, may fluctuate, target, outlook, guidance and illustrative, and similar expressions or future or conditional verbs such as will, should, would and could.

Such statements are based on management’s current expectations and are subject to risks, uncertainties and changes in circumstances. Actual results of operations and financial conditions, including capital and liquidity, may differ materially from those included in these statements due to a variety of factors, including without limitation (i) the precautionary statements included within the “Executive Summary,” “Citi’s Multiyear Transformation” and each business’s discussion and analysis of its results of operations and (ii) the factors described under “Risk Factors” above.

Any forward-looking statements made by or on behalf of Citigroup speak only as to the date they are made, and Citi does not undertake to update forward-looking statements to reflect the impact of circumstances or events that arise after the date that the forward-looking statements were made.