US regulators have fined Citigroup $136 million, citing what they called “insufficient progress” toward compliance with a consent order the bank entered into in 2020.

The penalty targets the pace of Citigroup's remediation work under that 2020 agreement, which required the bank to overhaul its internal controls and compliance infrastructure. Regulators concluded that the bank's advancement toward meeting its obligations under the order had fallen short of expectations.

The phrase at the heart of the enforcement action is direct: regulators penalised Citigroup for “insufficient progress”. That language signals that the fine does not rest on a new transactional violation but on the bank's failure to move quickly and thoroughly enough in satisfying commitments it had already made to its supervisors.

Why does a 2020 consent order still matter in 2024?

Consent orders are binding settlements between a financial institution and its regulators. When a bank accepts one, it agrees to a scheduled programme of reforms — typically covering governance, risk management, data controls and reporting — with defined milestones and deadlines.

A $136 million penalty for lagging performance under such an order tells compliance officers and in-house counsel several things at once:

• Regulators are actively monitoring execution, not just initial settlement.
• Missing remediation milestones carries independent financial consequences.
• The original 2020 obligations remain fully in force; the fine sits on top of them, it does not replace them.

For Citigroup, the practical effect is that the underlying work programme continues. The bank must still complete the reforms contemplated by the 2020 order, now under intensified supervisory scrutiny and with a demonstrated willingness by regulators to impose monetary sanctions for slow delivery.

What does the fine change for practitioners?

For legal and compliance teams at regulated banks, the decision reinforces a hard lesson: a consent order is a living obligation, and its enforcement clock does not stop. General counsel advising on negotiated settlements should structure remediation plans with realistic, verifiable milestones — and board-level reporting that documents progress against them.

The action also serves as a benchmark. A nine-figure penalty attached purely to remediation pace, rather than to a fresh compliance breach, shifts the risk calculus for any institution currently operating under an outstanding order. Delay is now demonstrably priced.

Regulated entities should expect supervisors to treat “insufficient progress” as an enforcement trigger in its own right. Documentation of remediation efforts, resourcing decisions and internal escalation paths will be the first line of defence if regulators question the tempo of reform.

The bigger picture

The $136 million sanction against one of the largest US banks underscores the post-2020 enforcement environment, in which regulators hold institutions to the letter and the timetable of their undertakings. For Citigroup, the fine represents both a financial cost and a public marker that its 2020 commitments remain unfinished business in the eyes of its supervisors.

The bank now faces a clear imperative: demonstrate measurable, milestone-driven progress, or risk further penalties as the consent order remains open and enforced.