Citi Retail Services Judgmental Review

What this models

This example runs on the Manual-underwriting-class with a taught screen and a compelled explanation network: 11 components and 26 pathways between them. Every context in the Lab is a stylized model, never a reconstruction of any actual deployment, and each assumption behind it carries a provenance label.

Evidence base: 1 assumed · 12 published baseline. In the Lab, the shaded evidence band behind each headline readout draws its width from the least-established class below.

• baseline

  This board models Citi Retail Services Judgmental Review as the Consumer Financial Protection Bureau found it in Consent Order 2023-CFPB-0013, together with the governance regime that order installed and the Bureau's October 2025 termination of it. The findings are the Bureau's, entered by consent: Citi executed the stipulation on 3 November 2023 without admitting or denying any finding of fact or conclusion of law, and every value here should be read that way.

• baseline

  Register discipline, binding on every node and edge: the record describes no model, no score, no algorithm, no rule engine and no screening vendor. The governed decision is manual underwriting by a human with approve and deny authority, and the discriminating artifact is an authored rule carried in training, supervision and performance management. Nothing here implies machine learning, training data, model risk or automated scoring, and the absence of an encoded artifact is the case rather than a gap in it — there was no artifact to review, which is one reason the practice ran for seven years.

• baseline

  No input source is drawn because none is documented. The two features the rule read are the applicant's last name and residential address, ordinary fields of the application form, requiring no data purchase and no inference — which is precisely what made the proxy near-costless and high-recall. The ordinary underwriting inputs a card decision also uses, such as credit-bureau data and applicant-supplied income and assets, are implied by the process but are not enumerated anywhere in the order, so no feed is drawn for them either.

• baseline

  No enforcement component and no queue is drawn. The five documented actions — deny, approve on less favourable terms, demand further income or asset verification, place a block or hold, and refer for potential freeze, credit-line decrease or account closure — are applied by people, so the fraud prevention function is drawn as the employee class the order defines rather than as an automatic downstream action system. Applications are referred for Judgmental Review, but the record gives no queue, backlog or throughput figure, and the allegation that apparently Armenian surnames were routed to a special manual-review unit comes from private complaints and is not a Bureau finding.

• baseline

  Demand reads 2 and capacity reads 3, and both come from an evidential constraint rather than an estimate. The public record carries no count of applications referred for Judgmental Review, no denial counts, no headcount for underwriters or fraud-prevention staff, no throughput and no share of the book manually underwritten, so the top demand rung would assert a strain nothing documents; what is documented is a nationwide card portfolio at an institution reporting $1.7 trillion in total assets, running the practice continuously for seven years. Capacity reads 3 because the human process here is not a counterfactual: removing the authored rule leaves the same manual underwriting the order describes, which means the failure this record documents is not a throughput failure and no amount of review time would have surfaced it.

• baseline

  The two reads into compliance review that are drawn at 0 are drawn there for different documented reasons, and the difference matters. The communications read is drawn at 0 because para 31 requires monitoring of the written and oral communications and training materials of Judgmental Review personnel going forward, which is the Bureau's own statement of what was there before, and because para 20's instruction directed that the basis stay out of writing and off recorded lines. The notice read is drawn at 0 for a structural reason instead: the reasons entered were ordinary, legitimate-looking underwriting reasons, so a sample of that store returns a clean file and certifies the practice rather than surfacing it.

• baseline

  The reconciliation of the stated reason against the decision it explains is drawn at 0. Para 31(e) lists correcting inaccurate or inadequate adverse-action notices, and correcting inaccurate consumer reporting, among the corrective actions the order contemplates once monitoring finds prohibited-basis discrimination — so the order itself treats both records as repairable. The public record establishes no instance of that reconciliation being performed, and the monitoring regime that would have triggered it ran roughly 23 of a designed 60 months before the Bureau terminated the order and expressly waived any alleged noncompliance. A waiver of alleged noncompliance is not a finding of compliance, and nothing here describes the regime as completed.

• baseline

  The underwriter's pathway into the practice is drawn at the lowest live rung rather than at 0, because the record documents employees who did not apply the rule and documents what met them: para 19 finds corrective action against employees who failed to identify and deny applications with -ian or -yan surnames and Glendale-area addresses, including action affecting an agent's performance rating, pay and authority to approve future applications. Deviation was the sanctioned act, which inverts the usual question about human override: there was no automated recommendation to defer to, and the discretion that remained was spent on which reason to record.

• baseline

  Three reviewers are drawn because the record documents three distinct review functions with different reads and different instruments, and each has a documented inbound pathway. The internal compliance layer named by paras 33 and 34 reads the decision record at the low rung and the notice and communications records at 0. The Bureau's examination reads the whole 2015 to 2021 portfolio of judgmental decisions as a distribution, which is the read that made the case. The private-claims channel reads the notice record, and its own check is drawn at 0 because arbitration was compelled in the lead putative class action in April 2024 and no public resolution of any private claim was located.

• assumed

  Thirteen pathways carry the privacySensitive flag under one stated rule: a pathway is marked where the flow itself carries an identified consumer's application, decision, stated reason or consumer-report entry. Pathways that carry the practice or the norm between people, and pathways that carry training material rather than consumer data, are not marked. The egress is marked because a furnished entry lands in stores the bank does not hold and outlives the decision that produced it. Where one pathway on this board now carries what the order describes as several flows, it is marked if any of them carried consumer data — which is why the referral to the fraud units is marked: it hands over the applicant's file.

• baseline

  Attribution split, and it is load-bearing. The Bureau's findings are carried as findings entered by consent. Citi's own position is an operator-tier characterization and is carried as such wherever it appears: the bank says a few employees took impermissible actions while it was trying to thwart what it calls a well-documented Armenian fraud ring, and that those employees circumvented its fraud detection protocols. The Bureau's 2026 Acting Director offers a third and later characterization, rogue conduct by a few underwriters at one location, which is in tension with the 2023 order's own basis in portfolio-wide statistically significant disparities. None of the three is treated as settled on this diagram; the tension is reported. It is carried on the practice itself rather than as a separate pathway, because the question it poses — one rule repeating across the desks, or a few people at one location — is a question about the practice's extent that the record leaves open.

• baseline

  Applicants and cardholders are boundary-only. No denial, account closure, credit outcome, or harm to any person is computed from anything drawn here; a decision, a notice and a furnished entry are institutional signals. The redress figures reported in May 2026 — $1,370,207.16 paid, 573 individuals sent checks, 126 uncashed and redistributed among the 447 who cashed theirs — are a recorded external observation attributed to the Acting Director's own letter, and 573 is the identified-and-payable cohort rather than an estimate of how many people were affected.

• baseline

  This board draws the deployment at the coarsest granularity at which every documented mechanism stays distinguishable, and it draws fewer separate things than the order enumerates. Affiliate personnel with authority to make credit decisions on Citi credit cards (para 31(h)) are carried inside the deciding class, because the order reaches them only through a training obligation and records nothing of their own process. Where the order describes one flow that an earlier drawing split in two or three — the referral to the fraud units and the file it hands over, the decision and reason the deciding desk writes, the compliance plan's reach into the practice, the annual portfolio analysis, the account event and the reported adverse action leaving for the agencies — it is drawn once and its parts are named on that pathway. The decision the order describes as the person's is drawn as the person's write; nothing about the practice, its concealment or its remedy was left out.

What this example does not show

• Litigation and regulatory posture, carried as the dossier states it. The Bureau issued Consent Order 2023-CFPB-0013 on 8 November 2023; Citi executed the stipulation on 3 November 2023 without admitting or denying any finding of fact or conclusion of law. The order was fully paid and then terminated early by the Bureau on 16 October 2025 with an express waiver of any alleged noncompliance, so the five-year monitoring, annual statistical-testing and quarterly root-cause reporting regime it created ran roughly 23 of 60 months. Congressional oversight of that termination was live as of May 2026; private federal and state-court claims were largely diverted into arbitration and no public resolution of them was located as of 28 August 2026, and a Los Angeles civil-rights inquiry opened in March 2025 has published no findings.
• This is not an algorithmic case and nothing here should be read as one. The consent order describes Judgmental Review — manual underwriting by a human — and names no model, score, algorithm, screening vendor or automated rule engine. The word system appears in the order once, in compliance management system, a governance term of art. A 2026 congressional letter asks the Bureau what changed in the bank's algorithmic screening; that is a question a legislator posed, not evidence that any algorithm existed.
• Three characterizations of the same conduct sit in this record and none is treated as settled. The Bureau's 2023 findings rest on portfolio-wide statistically significant disparities and locate the concealment instruction with supervisors and trainers. Citi says a few employees took impermissible actions and circumvented its fraud detection protocols while the bank was trying to thwart what it calls a well-documented Armenian fraud ring. The Bureau's 2026 Acting Director calls it rogue conduct by a few underwriters at one location and asserts the impact was not detectable in statistical analysis, which is in direct tension with the 2023 order's own paragraph 21. The tension is reported here, not resolved.
• The private cases are pleadings. Grigorian, 2:23-cv-09519, and Smbatian, 2:23-cv-09811, in the Central District of California, plus state-court mass-tort filings, are allegations; the most quotable of them — that applications with apparently Armenian surnames were routed to a special manual-review unit — is not in the consent order and is not used anywhere here to make the deployment sound more system-mediated than the findings support. The last publicly reported ruling located is the April 2024 order compelling arbitration in Grigorian.
• Volume data does not exist in the public record: no count of applications referred for Judgmental Review, no denial counts, no underwriter or fraud-unit headcount, no throughput and no share of the Retail Services book manually underwritten. Demand and capacity on this board are derived from what the record does establish — a nationwide portfolio at an institution reporting $1.7 trillion in total assets, and a manual process that is itself the human comparator — and no figure here should be read as a measured volume.
• The redress accounting is attributed, not adjudicated. $1,370,207.16 paid, 573 individuals sent checks, 126 uncashed and redistributed among the 447 who cashed theirs, and the assertion that more than 100 recipients were not Armenian, come from the Acting Director's May 2026 letter as reported — the letter of an official defending his own termination decision. It is carried here for the useful thing it shows about suffix matching cutting both ways, and 573 is the identified-and-payable cohort rather than an estimate of how many people were affected.
• The Los Angeles Civil Rights Department's March 2025 call for complaints concerns Armenian customers and major national banks generally, including complaints of conduct after the 2023 settlement. It is not a proceeding against Citi, it has published no findings, and it is not presented here as a second enforcement action. No source ties a Department of Justice referral to Citi by name and none is asserted.

Sources and evidence

What this example rests on, claim by claim. Every entry resolves to the same ledger the Evidence Registry publishes.

• In Consent Order 2023-CFPB-0013, issued 8 November 2023 against Citibank, N.A., the Consumer Financial Protection Bureau found that from at least 1 January 2015 through 31 December 2021 employees performing Citi Retail Services 'Judgmental Review' — defined in the order as the process by which a Citi employee or agent manually underwrites a credit-card application and approves, denies, or otherwise makes a credit decision — used an applicant's last name ending in -ian or -yan, especially with an address in or around Glendale, California, to identify applications they associated with Armenian national origin and to treat those applicants as presenting high fraud risk. The flag drove five documented actions: denial or approval on less favourable terms; additional scrutiny including verification of income or assets; a block or hold on the account; and referral to Citi's fraud prevention units for potential account freeze, credit-line decrease, or account closure. The order finds that Citi took corrective action against employees who FAILED to identify and deny such applications, including action that could affect an agent's performance rating, pay, and authority to approve future applications. The order names no model, score, algorithm, rule engine, or screening vendor; the Bureau's FY2023 Fair Lending Report records that Glendale is home to approximately 15 percent of the Armenian American population of the United States. Citi executed the stipulation on 3 November 2023 without admitting or denying any finding of fact or conclusion of law.

  empirical
  • Government Consent Order, In the Matter of Citibank, N.A., File No. 2023-CFPB-0013 (issued 8 November 2023; stipulation executed 3 November 2023) https://files.consumerfinance.gov/f/documents/cfpb_citibank-na_2023-cfpb-0013_consent-order_2023-11.pdf
  • Government Consumer Financial Protection Bureau (2024, June). Fair Lending Report of the Consumer Financial Protection Bureau, covering fiscal year 2023 https://files.consumerfinance.gov/f/documents/cfpb_fair-lending-report_fy-2023.pdf

• The order's second count is that the explanation channel itself was falsified: a failure to provide an accurate and adequate statement of the specific reasons for adverse action when an applicant was denied on a prohibited basis, under 15 U.S.C. 1691(d) and 12 C.F.R. 1002.9(a)-(b). Paragraph 25 documents one instance at the keystroke level — in 2016 an underwriter with approve and deny authority messaged a colleague asking for reasons to use for a decline, the colleague supplied several apparently pretextual reasons, and one second later the first employee recorded the application as declined due to possible credit abuse. The order states that Citi identified no legitimate, non-discriminatory explanation for the disparities and that any reasons it identified were pretextual justifications. The doctrinal frame is the Bureau's own: Circular 2022-03 states that the specific-reason requirement admits no exception for opaque or complex decision processes, and Circular 2023-03 states that a creditor may not rely on checklist sample-form reasons that do not reflect the actual basis for the decision. This record instantiates the second proposition in its deliberate form — the decision-maker knew the actual reason and entered a different one — so the applicant's only route to the real basis was closed by the notice itself.

  empirical
  • Government Consent Order, In the Matter of Citibank, N.A., File No. 2023-CFPB-0013 (issued 8 November 2023; stipulation executed 3 November 2023) https://files.consumerfinance.gov/f/documents/cfpb_citibank-na_2023-cfpb-0013_consent-order_2023-11.pdf
  • Government Consumer Financial Protection Bureau (2022). Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms; and (2023) Circular 2023-03: Adverse action notification requirements and the proper use of the CFPB's sample forms provided in Regulation B https://www.consumerfinance.gov/compliance/circulars/circular-2022-03-adverse-action-notification-requirements-in-connection-with-credit-decisions-based-on-complex-algorithms/
  • Regulatory Consumer Financial Protection Bureau (2022, 2023). Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms; and Circular 2023-03 on Regulation B sample forms. https://www.consumerfinance.gov/compliance/circulars/circular-2023-03-adverse-action-notification-requirements-and-the-proper-use-of-the-cfpbs-sample-forms-provided-in-regulation-b/

• The order finds that concealment was taught rather than improvised: Citi supervisors and trainers instructed employees to conceal their reliance on surname and address in the credit decision, including by telling employees not to discuss it in writing or on recorded phone lines, and the Bureau's FY2023 Fair Lending Report describes supervisors who conspired to hide the discrimination and employees who lied about the bases of denial by providing false reasons to denied applicants. An internal escalation reached management once and did not stop the practice: in 2018 a Citi employee emailed a group manager of Citi Retail Services and others asking how to document adverse-action reasons, writing that customers could not be told they were being declined because they are in Glendale, and the order records that the practice persisted after that concern was raised. What did reach the practice was external and statistical — regression analyses of Citi Retail Services credit-card data from 2015 through 2021, restricted to applications referred for Judgmental Review, showing denial-rate disparities for -ian and -yan surnames, larger when combined with a Glendale-area address, that were statistically significant.

  empirical
  • Government Consent Order, In the Matter of Citibank, N.A., File No. 2023-CFPB-0013 (issued 8 November 2023; stipulation executed 3 November 2023) https://files.consumerfinance.gov/f/documents/cfpb_citibank-na_2023-cfpb-0013_consent-order_2023-11.pdf
  • Government Consumer Financial Protection Bureau (2024, June). Fair Lending Report of the Consumer Financial Protection Bureau, covering fiscal year 2023 https://files.consumerfinance.gov/f/documents/cfpb_fair-lending-report_fy-2023.pdf

• The order imposed $24,500,000 in civil money penalty to the Bureau's Civil Penalty Fund and $1,400,000 reserved for consumer redress, both payable within ten days, and built a five-year governance regime around the surface that failed: monitoring of the written AND oral communications and training materials of Judgmental Review personnel; portfolio-wide statistical analysis of judgmental credit decisions at least annually; a 60-day root-cause-and-corrective-action window on any flag; at-least-quarterly reporting of every instance with its affected population, root cause, and corrective action; at least annual ECOA and Regulation B training for all Covered Personnel and for affiliate credit decision-makers, with training within 30 days for newly assigned personnel; and a corrective menu that names correcting inaccurate or inadequate adverse action notices and correcting inaccurate consumer reporting alongside remunerating consumers and extending credit previously denied, with the Board holding ultimate responsibility and the Chief Executive Officer and Board reviewing every submission. On 16 October 2025, roughly 23 months into that five-year term, the Bureau terminated the order under 12 U.S.C. 5563(b)(3), stating that Citibank had fulfilled certain obligations and that the Bureau also waives any alleged noncompliance therewith — a waiver of alleged noncompliance rather than a finding of compliance. A bicameral congressional letter of 23 April 2026 demanded the record by 7 May 2026; the reply reported on 14 May 2026 gave the first public redress accounting, $1,370,207.16 paid to 573 individuals with 126 checks uncashed and redistributed among the 447 who cashed theirs, characterized the conduct as rogue conduct by a few underwriters at one location, and asserted that more than 100 recipients were not Armenian, naming surnames such as Christian and Bryan. That characterization is the Acting Director's, is in tension with paragraph 21 of the 2023 order, and comes from an official defending his own termination decision; 573 is the identified-and-payable cohort rather than an estimate of how many people were affected.

  empirical
  • Government Consent Order, In the Matter of Citibank, N.A., File No. 2023-CFPB-0013 (issued 8 November 2023; stipulation executed 3 November 2023) https://files.consumerfinance.gov/f/documents/cfpb_citibank-na_2023-cfpb-0013_consent-order_2023-11.pdf
  • Government Order Terminating the Consent Order, In the Matter of Citibank, N.A., File No. 2023-CFPB-0013, Document 3 (filed 16 October 2025) https://files.consumerfinance.gov/f/documents/cfpb_citibank-n-a_termination-consent-order_2025-10.pdf
  • Government Enforcement action page: Citibank, N.A. (2023-CFPB-0013) https://www.consumerfinance.gov/enforcement/actions/citibank-n-a/
  • Government Office of U.S. Senator Adam Schiff (2026, April 23). Sen. Schiff, Colleagues Probe Consumer Financial Protection Bureau's Termination of Citibank's $25 Million Settlement for Discriminating Against Armenian Americans https://www.schiff.senate.gov/news/press-releases/news-sen-schiff-colleagues-probe-consumer-financial-protection-bureaus-termination-of-citibanks-25-million-settlement-for-discriminating-against/
  • Trade press Banking Dive (2026, May 14). CFPB's Vought defends terminating Citi consent order https://www.bankingdive.com/news/cfpb-vought-defends-terminating-citi-consent-order-armenian-american-discrimination/820220/
  • Trade press Yahoo Finance (2026), syndicating Banking Dive. CFPB's Vought defends terminating Citi consent order https://finance.yahoo.com/economy/policy/articles/cfpb-vought-defends-terminating-citi-085231077.html

• Three positions on this conduct sit in the public record and none is treated as settled. The Bureau's 2023 findings, which Citi neither admitted nor denied, rest on portfolio-wide statistically significant disparities and locate the concealment instruction with supervisors and trainers; then-Director Rohit Chopra said at announcement that Citi stereotyped Armenians as prone to crime and fraud and illegally fabricated documents to cover up its discrimination. Citi's own position is that in trying to thwart what it calls a well-documented Armenian fraud ring operating in certain parts of California a few employees took impermissible actions, that basing credit decisions on national origin is unacceptable, and that it apologises to any applicant evaluated unfairly by the small number of employees who circumvented its fraud detection protocols. Private claims followed immediately and were largely diverted out of court: Marine Grigorian v. Citibank, N.A., No. 2:23-cv-09519 (C.D. Cal., filed 10 November 2023, Judge Michael W. Fitzgerald) and Smbatian et al. v. Citibank, N.A. et al., No. 2:23-cv-09811 (C.D. Cal., filed 17 November 2023) were among several proposed class actions alongside state-court mass-tort filings reported to involve hundreds of customers, and in April 2024 the court compelled arbitration in Grigorian, rejecting the argument that the card agreement's arbitration clause was unenforceable under California's McGill rule on public injunctive relief. All allegations in those cases are allegations and not findings, including the plaintiff-side claim that applications with apparently Armenian surnames were routed to a special manual-review unit, which does not appear in the consent order. No public resolution of the arbitration, of Smbatian, or of the state-court filings was located. Separately, on 11 March 2025 the Los Angeles Civil Rights Department, working with the city attorney's office and the state attorney general, opened a call for complaints about anti-Armenian banking discrimination across major national banks; it is not a proceeding against Citi and has published no findings.

  empirical
  • Government Consent Order, In the Matter of Citibank, N.A., File No. 2023-CFPB-0013 (issued 8 November 2023; stipulation executed 3 November 2023) https://files.consumerfinance.gov/f/documents/cfpb_citibank-na_2023-cfpb-0013_consent-order_2023-11.pdf
  • news The Armenian Weekly (2023, November 14). Citibank fined for illegal discrimination against Armenian Americans https://armenianweekly.com/2023/11/14/citibank-fined-for-illegal-discrimination-against-armenian-americans/
  • Trade press ABA Banking Journal (2025). CFPB ends consent order against Citibank over Armenian discrimination allegations https://bankingjournal.aba.com/2025/11/cfpb-ends-consent-order-against-citibank-over-armenian-discrimination-allegations/
  • news Daily Journal (2024). Citibank's arbitration clause challenged in Armenian bias case (16 April 2024); and Judge approves arbitration in Citibank Armenian bias case (18 April 2024) https://www.dailyjournal.com/articles/378045-citibank-s-arbitration-clause-challenged-in-armenian-bias-case
  • Reference ClassAction.org (2023). Class Action Alleges Citibank Intentionally Discriminates Against Consumers of Armenian Descent (Smbatian et al. v. Citibank, N.A. et al., 2:23-cv-09811) https://www.classaction.org/news/class-action-alleges-citibank-intentionally-discriminates-against-consumers-of-armenian-descent
  • news Los Angeles Times (2025, March 11), accessed via Yahoo News syndication. L.A. investigating banking discrimination complaints against Armenians https://www.yahoo.com/news/l-investigating-banking-discrimination-complaints-220904915.html

Where this connects

Institutional pressures in this domain

• Vendor opacity — The deploying institution cannot inspect the model, data, or update pipeline it is accountable for.
• Compliance over substance — Paper controls (sign-offs, checklists) satisfy audits while the behavior they describe erodes.
• Data & policy drift — The world, the intake process, and the rules change under a system trained on how things used to be — two mechanisms with different remedies: the statistical properties of what the system processes move (concept drift), or the mixture of inputs arriving in deployment differs from the mixture it was trained on (covariate shift).
• Austerity & recovery incentives — Cost-cutting and overpayment-recovery targets tilt the system toward denial and enforcement errors.
• Reviewer bottleneck — One fixed-capacity checking stage sits between AI output and consequence; everything queues behind it.

All of them in context on the Lending & credit collections AI domain page.

Levers available here and the patterns behind them

• Gate record entries — Human-in-the-loop write gating
• Check copied records — Reconcile copied records
• Review on schedule — Oversight cadence & retrospectives
• Understand the system — Understand the system
• Assign a challenger — Structured dissent
• Peer sharing rules — Peer-edge governance

Documented case histories

• Citi Retail Services Judgmental Review & the Armenian surname screen
• Automated underwriting with its fair-lending testing on the record
• Cleared on the numbers but faulted on the explanation
• The governance an enforcement action had to write
• M-Shwari & Kenya's Digital Credit Market
• Santander Consumer USA subprime vehicle loan scoring
• Credit Acceptance Corporation's net-collections score
• Wells Fargo refinance underwriting & the bridge nobody could build
• Navy Federal mortgage underwriting & three readings of one gap
• Enova International servicing defects & the debits nobody authorised
• Equifax Online Model Server coding error (2022)
• TransUnion's OFAC Name Screen & the people who could not sue
• Dave ExtraCash: an advertised ceiling, an automated amount, and a case that never asks how the amount is set
• Hello Digit's automated-savings algorithm
• Oportun's legal-collections filing pipeline