Citigroup Inc.

understanding or cause confusion across comparative financial statementperiods. For example, the FASB’s financial instruments and balance sheetoffsetting projects could, among other things, significantly change howCitigroup classifies, measures and reports financial instruments, determinesthe impairment on those assets, accounts for hedges, and determines whenassets and liabilities may be offset. In addition, the FASB’s leasing projectcould eliminate most operating leases and instead capitalize them, whichwould result in a gross-up of Citi’s balance sheet and a change in the timingof income and expense recognition patterns for leases.Moreover, the FASB continues its convergence project with theInternational Accounting Standards Board (IASB) pursuant to which U.S.GAAP and International Financial Reporting Standards (IFRS) are to beconverged. The FASB and IASB continue to have significant disagreements onthe convergence of certain key standards affecting Citi’s financial reporting,including accounting for financial instruments and hedging. In addition,the SEC has not yet determined whether, or when, U.S. companies will berequired to adopt IFRS. There can be no assurance that the transition toIFRS, if and when required to be adopted by Citi, will not have a materialimpact on how Citi reports its financial results, or that Citi will be able tomeet any transition timeline so adopted.Citigroup’s financial statements are based in part onassumptions and estimates, which, if wrong, could causeunexpected losses in the future, sometimes significant.Pursuant to U.S. GAAP, Citigroup is required to use certain assumptions andestimates in preparing its financial statements, including in determiningcredit loss reserves, reserves related to litigation and regulatory exposures,mortgage representation and warranty claims and the fair value of certainassets and liabilities, among other items. If the assumptions or estimatesunderlying Citigroup’s financial statements are incorrect, Citigroup mayexperience significant losses. For additional information on the key areasfor which assumptions and estimates are used in preparing Citi’s financialstatements, see “Significant Accounting Policies and Significant Estimates”below, and for further information relating to litigation and regulatoryexposures, see Note 29 to the Consolidated Financial Statements.Citigroup may incur significant losses as a result ofineffective risk management processes and strategies, andconcentration of risk increases the potential for such losses.Citigroup seeks to monitor and control its risk exposure across businesses,regions and critical products through a risk and control frameworkencompassing a variety of separate but complementary financial, credit,operational, compliance and legal reporting systems, internal controls,management review processes and other mechanisms. While Citigroupemploys a broad and diversified set of risk monitoring and risk mitigationtechniques, those techniques and the judgments that accompany theirapplication may not be effective and may not anticipate every economic andfinancial outcome in all market environments or the specifics and timing ofsuch outcomes. Market conditions over the last several years have involvedunprecedented dislocations and highlight the limitations inherent in usinghistorical data to manage risk.Concentration of risk increases the potential for significant losses. Becauseof concentration of risk, Citigroup may suffer losses even when economic andmarket conditions are generally favorable for Citigroup’s competitors. Theseconcentrations can limit, and have limited, the effectiveness of Citigroup’shedging strategies and have caused Citigroup to incur significant losses,and they may do so again in the future. In addition, Citigroup extends largecommitments as part of its credit origination activities. Citigroup’s inabilityto reduce its credit risk by selling, syndicating or securitizing these positions,including during periods of market dislocation, could negatively affect itsresults of operations due to a decrease in the fair value of the positions, aswell as the loss of revenues associated with selling such securities or loans.Although Citigroup’s activities expose it to the credit risk of many differententities and counterparties, Citigroup routinely executes a high volume oftransactions with counterparties in the financial services sector, includingbanks, other financial institutions, insurance companies, investment banksand government and central banks. This has resulted in significant creditconcentration with respect to this sector. To the extent regulatory or marketdevelopments lead to an increased centralization of trading activity throughparticular clearing houses, central agents or exchanges, this could increaseCitigroup’s concentration of risk in this sector.A failure in Citigroup’s operational systems orinfrastructure, or those of third parties, could impair itsliquidity, disrupt its businesses, result in the disclosure ofconfidential information, damage Citigroup’s reputationand cause losses.Citigroup’s businesses are highly dependent on their ability to process andmonitor, on a daily basis, a very large number of transactions, many ofwhich are highly complex, across numerous and diverse markets in manycurrencies. These transactions, as well as the information technology servicesCitigroup provides to clients, often must adhere to client-specific guidelines,as well as legal and regulatory standards. Due to the breadth of Citigroup’sclient base and its geographical reach, developing and maintainingCitigroup’s operational systems and infrastructure is challenging,particularly as a result of rapidly evolving legal and regulatory requirementsand technological shifts. Citigroup’s financial, account, data processing orother operating systems and facilities may fail to operate properly or becomedisabled as a result of events that are wholly or partially beyond its control,such as a spike in transaction volume, cyberattack or other unforeseencatastrophic events, which may adversely affect Citigroup’s ability to processthese transactions or provide services.In addition, Citigroup’s operations rely on the secure processing, storageand transmission of confidential and other information on its computersystems and networks. Although Citigroup takes protective measures tomaintain the confidentiality, integrity and availability of Citi’s and its clients’information across all geographic and product lines, and endeavors tomodify these protective measures as circumstances warrant, the nature ofthe threats continues to evolve. As a result, Citigroup’s computer systems,software and networks may be vulnerable to unauthorized access, loss ordestruction of data (including confidential client information), account79