Citi FINRA AML Fine: A Rollout Error Delayed 88 SARs

Citigroup's $250,000 FINRA AML Fine Turns on One Phrase

FINRA censured Citigroup Global Markets Inc. (CGMI) and fined it $250,000 in a Letter of Acceptance, Waiver, and Consent listed in FINRA's disciplinary database (Case ID 2023080495301; CGMI is CRD 7059) with an action date of November 6, 2026. FINRA found that from January 2022 through February 2023, CGMI violated FINRA Rules 3310(a) and 2010 by failing to establish and implement policies and procedures reasonably expected to detect and cause the reporting of suspicious transactions. CGMI consented without admitting or denying the findings.

This was not a case of a firm that never wrote the right policy. It was a case of a policy written correctly and implemented wrong. According to FX News Group's summary of the settlement, CGMI's AML Compliance Risk Management team proposed revisions in January 2022 calling for escalation of all potential fraud events regardless of value or confirmed loss. Because of an employee's error, the procedures actually implemented required escalation only "when there is confirmed fraud and/or losses."

The cost landed on the retail side of the business. The lapse involved CGMI's Personal Wealth Management division, and AdvisorHub reports that the delayed escalation caused the filing of 88 suspicious activity reports (SARs) to be delayed. Citi later filed those 88 SARs retroactively.

Designed Correctly, Implemented Wrong: The Distinction That Matters

FINRA Rule 3310(a) carries two verbs. As FINRA's 2025 oversight report section on AML describes it, the rule requires firms to establish and implement AML policies and procedures that can be reasonably expected to detect and cause the reporting of suspicious transactions. On the reported facts, the error arose when the revised procedures were implemented.

The mechanics show where. Per AltsWire, frontline staff, including registered representatives and support staff, performed the initial review of potential fraud events such as cyber-events, account takeovers, and identity thefts. Per FX News Group, they escalated to a Risk and Controls Team, which decided what to pass to the business units that file SARs. That team applied the incorrect standard, which FX News Group reports delayed escalation of 171 potential fraud events.

Why a loss filter is the wrong gate

AltsWire reports that the settlement cites October 2016 guidance from the Financial Crimes Enforcement Network that an otherwise reportable cyber-event should be reported even if it was unsuccessful.

For a broker-dealer, the lesson is operational. The written policy a compliance committee approves is not the control. The control is the version running in the desk procedure, the review queue, and the escalation logic.

What FINRA Credited, and What the Sources Do Not Quantify

The sanction reflects a firm that found its own problem. According to FX News Group's summary, FINRA considered that CGMI:

• Self-identified its failure to establish and implement appropriate AML policies and procedures.
• Initiated, prior to intervention by a regulator, a review to determine the scope of the failure.
• Took prompt action to remediate, including retroactively filing the 88 SARs, updating procedures, retraining personnel, and automating the escalation process.
• Provided FINRA with the results of its review.

CGMI discovered the error in February 2023 through a self-initiated review of fraud-event escalations, and AltsWire reports the firm self-reported the matter to FINRA. Per FX News Group, the division retrained employees, implemented a standard that no longer required confirmed fraud or losses, and published revised procedures in May 2023.

The sources reviewed do not say how much, if at all, that cooperation reduced the fine. What they do show is the sequence FINRA listed: detect internally, scope before a regulator asks, fix, then hand over the work product. Each step is a record a firm either has or does not have when the conversation with FINRA starts.

Key Takeaways

• A correct AML policy does not satisfy Rule 3310(a) on its own. The rule requires firms to establish and implement procedures, and CGMI's error arose in implementation, according to trade-press summaries of the AWC.
• One phrase delayed 88 SARs. Escalation only "when there is confirmed fraud and/or losses" replaced an intended standard of escalating all potential fraud events, per FX News Group.
• The settlement cites guidance on unsuccessful cyber-events. AltsWire reports the settlement cites October 2016 FinCEN guidance that an otherwise reportable cyber-event should be reported even if unsuccessful.
• Self-identification shaped the sanction factors. FINRA considered CGMI's self-initiated review, scoping work, remediation, and shared results, though no source reviewed quantifies the credit.
• The outcome was a censure and a $250,000 fine. CGMI consented without admitting or denying FINRA's findings in an AWC with a November 6, 2026 action date.

The common thread is that the gap sat between two documents the firm controlled.