Citi’s audio preservation system deleted more than 2.77 million audio files, including recordings that were subject to a December 2017 CFTC subpoena.
The US CFTC (Commodity Futures Trading Commission) has issued an order filing and simultaneously settling charges against Citibank N.A., Citigroup Energy, and Citigroup Global Markets for failing to diligently supervise their audio preservation system.
Citibank operated and maintained the audio preservation system on behalf of all three Citi entities. It was the primary means of ensuring that audio recordings were maintained as required by CFTC regulations.
Although Citibank had assured the CFTC’s Division of Enforcement that recording were being preserved, a “design flaw” in the audio preservation system resulted in the deletion of more than 2.77 million audio files for 982 users, including recordings that were subject to a December 2017 CFTC subpoena.
The subpoena was initially deferred at Citi’s request, until October 2018, at which point the CFTC asked Citi to produce audio recordings for several dates. In November 2018, the CFTC asked again for the recordings. The next day, Citi submitted an audio collection request, only to discover that the audio recordings had been automatically deleted.
A 2014 internal memo to senior management had shown that a “design flaw” had been identified in the audio preservation system years earlier, and was labelled as a “ticking time bomb effect” that could lead to the automatic deletion of audio recordings.
While a Citi staffer attempted to mitigate the risk of inadvertently deleting audio recordings by increasing the Retention Rule to seven years and permitting the system to use additional available storage, a 2015 upgrade to a newer version of the system changed the Retention Rule back to two years, which resulted in the deletion of relevant audio recordings.
“Despite being on notice of the problem as of 2014, Citibank did not take timely and appropriate steps to mitigate the risk of the system’s design flaw,” the CFTC said. “Citibank further did not maintain adequate internal controls with respect to its preservation of audio and thus failed to diligently supervise matters related to its business as a CFTC registrant.”
According to the order, all three Citi entities violated CFTC regulations by failing to diligently supervise the operation of the audio preservation system.
The order, available here, requires the Citi entities to pay a USD 4.5 million civil monetary penalty.