The PRA has fined Citigroup Markets Limited, Citibank Europe Plc UK branch and Citibank N.A. London branch (together "Citi") £44 million, after a 30% settlement discount, for failings in respect of their internal controls and governance arrangements. These failings ultimately impacted Citi's compliance with PRA regulatory reporting requirements. Were it not for early settlement, Citi would have been fined £62 million.
The PRA found that between 19 June 2014 and 31 December 2018 ("Relevant Period") Citi failed to adequately design, implement or operate a suitable system to monitor and submit information relating to the capital adequacy, leverage and liquidity at the bank's UK operations. These failings resulted in regulatory returns submitted to the PRA which contained a "significant number of errors and misstatements".
Of significant concern to the PRA were the findings of a Skilled Person's Report, commissioned by Citi in 2017, which in part identified that Citi's capital position was worse than originally reported to the PRA and its liquidity position was better than originally reported. These errors meant that the returns submitted were unreliable and as a result the PRA did not have an accurate understanding of Citi's capital or liquidity position.
While the Report identified inaccuracies across all of the returns reviewed, the PRA made clear that Citi remained in surplus to liquidity and capital requirements at all times during the Relevant Period. Despite this, the regulator found that Citi's failures resulted in various breaches of the PRA Rulebook, including Fundamental Rule 6 (requirement that a firm organise and control its affairs responsibly and effectively) and Notifications Rule 6.1 (requirement that firms take reasonable steps to ensure the information they submit to the PRA is complete and accurate).
The PRA considered that "the pervasiveness of the errors and misstatements identified in the firm's returns raised fundamental concerns about the effectiveness of Citi's UK regulatory reporting control framework", particularly for an organisation of Citi's complexity, size and systemic importance. Above all, the inadequacies in Citi's systems and controls had a seriously detrimental impact on the PRA's ability to properly supervise the bank.
Comment
What is clear from the PRA's Final Notice, and indeed the historic size of the fine imposed, is that it is vital for regulated firms to have robust and operative systems and controls in place to manage the flow of "timely, complete and accurate data" to the PRA, particularly where that data allows the PRA to supervise the financial health of a firm and, ultimately, manage risk. Following this Final Notice, it will be interesting to see whether there are any future outcomes in respect of those senior individuals with responsibility for managing the regulatory reporting process and its surrounding controls.