Our Path to Transformation To e stablish a b aseline f or o ur t ransforma - tion s trategy, w e c onducted a g ap a nalysis exercise, s tarted i n 2 020 a nd c ompleted in 2 021, t o r eview t he i ssues r aised i n t he consent o rders a nd d efine t he g ap b etween where w e w ere a nd w here w e n eed t o b e. Following t he g ap a nalysis, w e d esigned a roadmap t o g et u s t o o ur t arget s tate. T he roadmap c omprises s everal d istinct a reas that f eed i nto C iti’s i ntegrated v ision o f transformation f or o ur c ompany. One o f t he fi rst a ctions w e u ndertook i n 2021 w as t o d evelop a nd r oll o ut a n ew Enterprise R isk M anagement F ramework t o assess risk across our enterprise. The inte - grated a pproach o f t he f ramework s eeks t o drive c onsistency a cross k ey a reas o f r isk, strengthening t he w ay t he fi rm i dentifies, measures a nd m onitors r isk s o t hat w e can i mplement a ppropriate c ontrols a nd reporting m echanisms. T he f ramework helps b ring c onsistency a nd s tructure t o the v aried t ypes o f r isks w e f ace a cross Citi — l eading t o b etter s cenario-planning, stress t esting a nd r oot-cause a nalyses across t he r isk l ifecycle. All c olleagues a re e mpowered t o a pply t he Enterprise R isk M anagement F ramework to t heir w ork a nd a re r esponsible f or promptly e scalating r isk-related c oncerns. We r olled o ut t raining o n t he n ew f rame - work t o a ll e mployees g lobally i n 2 021, a nd 98% c ompleted t he t raining b y t he e nd o f the y ear. We a re a lso d eveloping s tandards, p lans and t raining c urricula f or a m ore m odern, streamlined a pproach t o o ur c ontrol e nvi - ronment, w hich w e w ill b e i mplementing i n future y ears. F or e xample, w e a re e nsuring that w hen i ncidents a rise, o ur e mployees can c onduct r obust r oot-cause a nalyses and then apply the lessons learned hori - zontally a cross t he o rganization t o p revent similar i ssues f rom a rising e lsewhere. In a ddition, w e a re w orking t o s implify, streamline a nd a utomate o ur c ontrols — strengthening o ur a bility t o p revent i ssues, not j ust t o d etect t hem a fter t hey a rise. To e mpower o ur e mployees a nd i ncrease the e ffectiveness o f t heir d ay-to-day w ork, we a re u ndertaking a fu ll u pdate o f o ur policies to make them easier to under - stand a nd t ake a ction a gainst. W e’re a lso planning t o m igrate o ur p olicies t o a n ew platform i n 2 023, m aking t hem e asier t o access a nd n avigate. During 2021, we continued to build teams focused on transformation activities across the company. These teams are a hybrid of employees with a depth of institutional knowledge and newer employ - ees who bring diverse expertise and perspectives. Enterprise Risk Management Framework Risk Management Lifecycle Citi’s Approach to Managing Risk: • Culture • Enterprise Programs • Risk Management • Governance TALENT | TECHNOLOGY AND DATA | ANALYTICS MONITOR CONTROL REPORT IDENTIFY MEASURE Contents ESGatCiti SustainableFinance SustainableProgress Equitable&ResilientCommunities Talent&DEI RiskManagement&ResponsibleBusiness Appendices CITI 2021 ESG REPORT 105