Domain Atlas / Lending & credit collections AI
Citi Retail Services Judgmental Review & the Armenian surname screen
Explore this deployment in the PAN Lab ↗
In the PAN Lab, the readouts of this case's model organization carry a shaded evidence band whose width follows the least-established class among the modeling inputs the readings rest on.
The least-established input behind this case's model organization's readings is an assumption, not a measurement. Evidence base: 1 assumed · 11 published baseline.
In Consent Order 2023-CFPB-0013, issued 8 November 2023 against Citibank, N.A., the Consumer Financial Protection Bureau found that from at least 1 January 2015 through 31 December 2021 employees performing Citi Retail Services 'Judgmental Review' — defined in the order as the process by which a Citi employee or agent manually underwrites a credit-card application and approves, denies, or otherwise makes a credit decision — used an applicant's last name ending in -ian or -yan, especially with an address in or around Glendale, California, to identify applications they associated with Armenian national origin and to treat those applicants as presenting high fraud risk. The flag drove five documented actions: denial or approval on less favourable terms; additional scrutiny including verification of income or assets; a block or hold on the account; and referral to Citi's fraud prevention units for potential account freeze, credit-line decrease or account closure. The order finds that Citi took corrective action against employees who FAILED to identify and deny such applications, including action that could affect an agent's performance rating, pay and authority to approve future applications. The order names no model, score, algorithm, rule engine or screening vendor; the Bureau's FY2023 Fair Lending Report records that Glendale is home to approximately 15 percent of the Armenian American population of the United States. Citi executed the stipulation on 3 November 2023 without admitting or denying any finding of fact or conclusion of law.[2]
What happened
Citi Retail Services issues and manages private-label and co-branded consumer credit cards; the cards in this record were issued by Citibank, N.A. or by its former wholly owned subsidiary Department Stores National Bank. Some applications, and some requests to increase a credit line on an existing card, are referred for what the consent order calls "Judgmental Review" — defined in the order as the process by which a Citi employee or agent manually underwrites an application and approves, denies, or otherwise makes a credit decision. A person decides. There is no model in this record, no score, no algorithm, no rule engine and no screening vendor; the word "system" appears in the thirty-six-page order exactly once, in "compliance management system", a governance term of art.
What the Consumer Financial Protection Bureau found, in an order Citi neither admitted nor denied, is that from at least 1 January 2015 through 31 December 2021 the people performing that review used two fields already on the form. A last name ending in -ian or -yan, "especially if the applicant's address was in or around Glendale, California", was used to identify applications the reviewers associated with Armenian national origin, and those applicants were treated as presenting high fraud risk — referred to in internal language the order quotes as "bust outs" and, in some cases, as "Armenian bad guys" or the "Southern California Armenian Mafia". The Bureau's Fair Lending Report for fiscal 2023 records why the geographic half of the rule worked so well: Glendale, nicknamed "Little Armenia", is home to approximately 15 percent of the Armenian American population of the United States. Neither field cost anything to obtain. Neither required a data purchase or an inference. Both were already on the application.
The flag drove five documented actions, and two of them reach people who already hold a card rather than people asking for one: deny the application or approve it on less favourable terms; demand additional scrutiny, including verification of income or assets; place a block or a hold on the account; and refer the applicant to Citi's fraud prevention units for further review and potential account freeze, credit-line decrease or account closure.
Two findings give this case its shape, and neither is about a decision system.
The first is that the rule was enforced downward onto the people executing it. The order finds that Citi took corrective action against employees who FAILED to identify and deny applications with -ian or -yan surnames and Glendale-area addresses, including action that could affect an agent's performance rating, pay, and authority to approve future applications. Deviation from the discriminatory rule was the sanctioned act. That inverts the usual question about human oversight of an automated decision: there was no automated recommendation to defer to, the human was not rubber-stamping a machine, and the discretion that remained was spent on something else entirely.
The second is what it was spent on. The Equal Credit Opportunity Act and Regulation B compel a creditor to give a denied applicant a statement of the specific reasons for the adverse action, and that notice is the only channel through which a denied applicant can learn why. The order's second count is that the statement was false. Paragraph 25 documents an instance at the keystroke level: in 2016 an underwriter with approve and deny authority messaged a colleague — "it's been a while since I declined for possible credit abuse/YAN — gimme some reasons I can use, or do I need to not worry about it?" — the colleague supplied several apparently pretextual reasons, and one second later the first employee recorded the application as "declined due to possible credit abuse."
Concealment was taught rather than improvised. The order finds that supervisors and trainers instructed employees to conceal their reliance on surname and address in the credit decision, including by telling them not to discuss it in writing or on recorded phone lines; the Fair Lending Report describes supervisors who "conspired to hide the discrimination". The instruction worked on both halves of the institution's memory at once. The informal record was emptied, and the formal record was filled with reasons that looked exactly like ordinary underwriting. A compliance function sampling denial files would have found clean files. The more thoroughly the decisions were documented, the more the documentation certified the practice as lawful.
An internal escalation did fire, once, and did not stop it. In 2018 a Citi employee emailed a group manager of Citi Retail Services and others asking how to document adverse-action reasons, writing that "we can't tell [customers they are being declined] because they are in Glendale." The order records that the practice persisted after that concern was raised.
What finally reached the practice was statistical and came from outside. Paragraph 21 describes the method: regression analyses of Citi Retail Services credit-card data from 2015 through 2021, restricted to applications referred for Judgmental Review, showing denial-rate disparities for -ian and -yan surnames — larger still when combined with a Glendale-area address — that were statistically significant. The order states that Citi identified no legitimate, non-discriminatory explanation and that any reasons it did identify were pretextual justifications. The order issued on 8 November 2023 with three findings: a pattern or practice of discrimination on the basis of Armenian national origin under ECOA and Regulation B; a failure to give an accurate and adequate statement of the specific reasons for adverse action; and, by those ECOA violations, a violation of the Consumer Financial Protection Act. The money was $24,500,000 in civil money penalty to the Bureau's Civil Penalty Fund and $1,400,000 reserved for consumer redress, both due within ten days — $25.9 million in total, not deductible for tax and not indemnifiable by insurance. Then-Director Rohit Chopra's public characterization at announcement was that "Citi stereotyped Armenians as prone to crime and fraud. Citi illegally fabricated documents to cover up its discrimination." Citi's own statement, issued then and repeated in 2025, is that "in trying to thwart a well-documented Armenian fraud ring operating in certain parts of California, a few employees took impermissible actions", that basing credit decisions on national origin is unacceptable, and that the bank apologises "to any applicant who was evaluated unfairly by the small number of employees who circumvented our fraud detection protocols". Those two characterizations are the parties', not the record's, and the order's findings — which Citi neither admitted nor denied — instead locate the concealment instruction with supervisors and trainers and rest the discrimination finding on portfolio-wide disparities.
The remedy the order built is worth reading as an inventory of what was absent. It required monitoring of the written AND oral communications and the training materials of Judgmental Review personnel; portfolio-wide statistical analysis of judgmental credit decisions at least annually, designed to detect prohibited-basis discrimination; a sixty-day root-cause-and-corrective-action window whenever monitoring or analysis flags a potential problem; at-least-quarterly reporting of every such instance with its affected population, root cause and corrective action; at least annual ECOA and Regulation B training for all Covered Personnel and for affiliate personnel with credit-decision authority, and training within thirty days for anyone newly assigned; and a corrective menu that names, alongside remunerating consumers and extending credit previously denied, correcting inaccurate or inadequate adverse action notices and correcting inaccurate consumer reporting. The Board holds ultimate responsibility for compliance, and the Chief Executive Officer and the Board must review every plan, report and submission before it goes to the Bureau. The order was to run five years.
It ran about twenty-three months. On 16 October 2025 the Bureau, under Acting Director Russell Vought, terminated the order, stating that Citibank had "fulfilled certain obligations" — the penalty, the redress payments, and steps to implement injunctive relief — and that the Bureau "also waives any alleged noncompliance therewith". A waiver of alleged noncompliance is not a finding of compliance; the record does not establish that the annual statistical testing, the quarterly root-cause reporting and the communications monitoring ran for the full term, only that the Bureau chose not to pursue any alleged shortfall. Sen. Adam Schiff objected publicly the next day, and on 23 April 2026 led a bicameral letter with Sens. Padilla, Warren and Markey and Reps. Chu, Friedman, Rivas and Sherman demanding, by 7 May 2026, the justification for the termination, which obligations were and were not fulfilled, how many victims were paid and how many were not, and whether White House officials directed the decision. The reply, reported on 14 May 2026, gave the first public redress accounting: $1,370,207.16 paid to 573 individuals, of whom 126 did not cash their checks, the funds being redistributed among the 447 who did. The same letter characterizes the underlying conduct as "rogue conduct by a few underwriters at one location", says Citi terminated the employees involved in July 2020 when the Bureau issued its investigative demand, and asserts that more than 100 of the 573 recipients were not Armenian, naming surnames such as "Christian" and "Bryan" — a characterization in direct tension with the 2023 order's own paragraph 21, and one whose source is an official defending his own termination decision.
That last detail cuts in an instructive direction rather than a convenient one. The Bureau's redress cohort was itself built by matching name suffixes, and on the Acting Director's own account it over-included in exactly the way the discriminatory rule did. A suffix is a cheap proxy and a bad one, whichever end of the enforcement it is used at.
Private claims followed the order within days and mostly left the courts. Marine Grigorian v. Citibank, N.A., No. 2:23-cv-09519, was filed in the Central District of California on 10 November 2023 before Judge Michael W. Fitzgerald, and Smbatian et al. v. Citibank, N.A. et al., No. 2:23-cv-09811, on 17 November 2023; they were among several proposed class actions, alongside state-court mass-tort filings reported to involve hundreds of customers. In April 2024 the court granted Citi's motion to compel arbitration in Grigorian, rejecting the argument that the card agreement's arbitration clause was unenforceable under California's McGill rule on public injunctive relief. Everything pleaded in those cases is an allegation. The most quotable of them — that applications with apparently Armenian surnames were searched out of a customer database and routed to a special manual-review unit — is a plaintiff-side allegation and is NOT in the consent order; it describes a query over a record store rather than a model, and it is not used here to make the deployment sound more system-mediated than the findings support. No public resolution of the arbitration, of Smbatian, or of the state-court filings was located.
A separate thread remains open at the state and local level. On 11 March 2025 the Los Angeles Civil Rights Department, working with the city attorney's office and the state attorney general, opened a public call for complaints about banks discriminating against Armenian customers through account closures, denials and unfavourable credit terms — complaints of continuing conduct, across major national banks rather than Citi alone, after the 2023 settlement. It has published no findings and it is not a proceeding against Citi.
The sociotechnical reading
Every other lending case in this atlas turns on a model or a score, and the governance question is whether the model is fair. Here there is no model, and the question changes shape entirely: can an institution read its own decisions when the people making them have been instructed not to write down what they are doing?
The record answers that question, and the answer is that only outcome statistics could. That answer has three parts worth separating.
The first is that the absence of an artifact is a governance property, not a gap in the evidence. Documentation, validation, monitoring, explainability tooling — the whole model-governance toolkit assumes there is a thing to inspect. An authored rule carried in training, supervision and performance management presents no such thing. There was nothing to review, which is one plain reason a practice could run for seven years inside a supervised institution reporting $1.7 trillion in total assets.
The second is that the proxy was free. A two-character suffix and a postal geography sit on the application form. No inference, no data purchase, no vendor, no feed. Proxy discrimination is usually discussed as something a model discovers in correlated variables; this record shows it as something a person can simply read, which is why removing data from the pipeline is not an available remedy. A creditor cannot process an application without the applicant's name and address.
The third, and the one this case exists to carry, is that the explanation channel was the mechanism rather than a side effect. Regulation B already requires a specific reason for adverse action, and Bureau guidance is explicit on both sides of the duty: Circular 2022-03 says the requirement admits no exception for opaque or complex decision processes, and Circular 2023-03 says a creditor may not fall back on checklist sample-form reasons that do not reflect the actual basis for the decision. The rest of this domain's cases sit on the first proposition — a creditor who cannot explain a model still owes a real reason. This one sits on the second, in its deliberate form: the decision-maker knew the actual reason exactly and entered a different one.
Follow what that does to the detection problem. A falsified adverse-action notice writes a false reason into three places at once — the applicant's copy, the creditor's own decision record, and, where an account action followed, the consumer's credit file. The applicant's only route to the real reason is closed. The compliance function's sample comes back clean, because the pretextual reasons are legitimate-looking underwriting reasons; documenting the decisions more thoroughly makes the practice look more lawful, not less. The concealment instruction closes the informal record in the same move. What is left is the one signal nobody inside was suppressing and nobody inside was reading: the distribution of outcomes across seven years, which only a party holding the whole portfolio could see. An individually contestable decision had been converted into a statistically detectable one, and detectable by exactly one kind of reader.
The order's remedy is the same insight written as a decree. It orders monitoring of oral and written communications, annual portfolio-wide statistical testing, a root-cause window on any hit, AND the correction of inaccurate adverse-action notices and inaccurate consumer reporting. That last pair is the part governance discussions usually miss: the order treats the notice and the credit file as contaminated stores needing repair, not merely as evidence of a wrong that money settles.
And then the atlas gets something it has almost nowhere else — a control that existed, worked on paper, and was withdrawn. The five-year regime ran roughly twenty-three of sixty months before the agency that built it switched it off and waived any alleged noncompliance, leaving the annual testing and the quarterly reporting as a stated voluntary commitment rather than an obligation anyone must act on. Congressional oversight of that decision, rather than the bank's compliance function, is the live check as of May 2026. For a corpus that spends most of its time asking whether a remedy would work, this record is a reminder that a remedy's duration is a governable quantity too, and that it is governed by someone other than the party the remedy binds.
One honest limit on all of it. The order describes a pattern or practice and rests it on portfolio-wide disparities; the Bureau's current leadership describes rogue conduct by a few underwriters at one location; the bank describes a small number of employees circumventing its own protocols while it pursued what it calls a documented fraud ring. Nothing in the public record resolves that. What the record does establish is the shape of the failure, and the shape does not depend on how many hands were on it: a decision channel whose real input was deliberately kept out of the record of record, and whose only remaining detector was a regression run by someone else, seven years late.
The concepts used in this reading are defined in the Field Guide; the governance responses live in the Practice Library. The model organization for this case can be stress-tested in the PAN Lab.