Citigroup slammed with $400 million fine for 'longstanding failure' to resolve its risk and data systems

​Citigroup was fined $400 million on Thursday by US regulators for failing to resolve "several longstanding deficiencies" tied to its data and risk management systems.

The Office of the Comptroller of the Currency faulted the nation's third-largest bank for "unsafe or unsound banking practices for its long-standing failure to establish effective risk management and data governance programs and internal controls."

Under the order, Citigroup must seek the OCC's approval before making any new significant acquisitions. The regulator also reserves the right to make any significant changes in senior leadership, or the board, if it believes the bank has not complied in a timely manner with the order.

The Federal Reserve announced a separate enforcement action against Citigroup for not taking "prompt and effective actions to correct practices" previously noted in its risk and data quality management, and internal controls.

"We are disappointed that we have fallen short of our regulators' expectations, and we are fully committed to thoroughly addressing the issues identified in the Consent Orders," Citigroup said in a statement. The bank intends to make its risk and control environment a "strategic priority."

Thursday's fine is Citigroup's second penalty in recent weeks.

The Commodity Futures Trading Commission imposed a $4.5 million fine against the bank in late September for mass deletion of audio files, including trader recordings that were subpoenaed as part of a federal probe.

About a year ago, the Bank of England fined Citigroup £44 million($56 million) for inaccurate regulatory reporting about its capital and liquidity levels between June 2014 to December 2018.

In total, the bank has been charged with $25 billion in financial-related fines over the last 20 years, according to a Violation Tracker produced by the corporate research project of advocacy group Good Jobs First.