One platform, many use cases: what Citi’s agent controls would have to prove in Europe

On Tuesday 22 September 2026, Citigroup published a profile on its website of David Griffiths, the bank’s Group Head of AI, to mark his inclusion in TIME magazine’s “Executives of the Year: Tech and Data” list the same day. According to the piece, Citi Stylus Workspaces, the bank’s in-house AI platform, has been rolled out to more than 180,000 employees. Staff in more than 87 countries and jurisdictions now have access to the bank’s AI tools, and since the rollout began in December 2024 Citi has counted more than 65 million interactions and puts the adoption rate above 87 per cent. Since April 2026 the bank has also run Arc, a platform on which AI agents are built and deployed across the group, in Citi’s words “with the same rigor and control applied to any critical system within the firm”.

Pieces like this tend to be read as a race for reach: which bank puts the tools in front of the most staff, and who gets agents into production first. More revealing is what the piece says about where control sits. David Griffiths says controls on Citi’s AI are automated at platform level, so that staff need not run lots of manual checks for approvals or reviews. Citi says the Arc agent platform is built to the same standard. Banking supervision at the European Central Bank (ECB) starts elsewhere. It expects material AI use cases to receive an appropriate assessment before launch and robust risk assessments by the second line of defence. Two Citi banks, in Ireland and Germany, sit under its direct supervision. What follows compares public statements with published supervisory texts. It passes no judgement on Citi’s internal controls, which nobody outside the bank and its supervisors can see.

Citi describes a control architecture, but names no mechanism

The key sentences on control appear in two texts. In the piece that introduced Arc on 30 April 2026, Citi wrote: “Every agent will be monitored, auditable and governed. We will know what agents are doing, how they are doing it and the value they deliver.” The bank also said it would open Arc first to developers for “specific, well-defined use cases” and widen access later. In the September profile, David Griffiths goes further, speaking about the use of AI across the firm. Citi has to deploy AI “in a uniform way”, he says, so that implementations in different parts of the world can talk to one another, and adds: “Controls are automated at the platform level, so colleagues do not have to conduct lots of manual checks for approvals or reviews.” The piece notes that Citi has controls across the whole AI lifecycle, “and a human is always in the loop”.

Neither text explains the mechanics behind these sentences. Citi has not publicly described an agent register, an approval procedure, the form of its logging or a shutdown at platform level, and it gives no figure for agents in production, either in these pieces or on its earnings calls. The most specific detail comes from an interview with the news site Axios on launch day: Arc acts as a central “operating system” for agents, and staff and managers can monitor agent behaviour “and stop tasks if needed”. In fairness, Citi is not alone, as many banks stay general on this in public. A few disclose more. In a post from its technology unit on 23 March 2026, JPMorganChase calls for controls “at the point of execution” with “tamper-evident, complete runtime records” and scales them to risk. At Bank of New York Mellon (BNY), the so-called digital employees have their own logins and human managers, according to Axios. Citi does not mention dedicated logins or managers for agents, though it does mention staff and managers monitoring agents and stopping tasks. In the same profile, David Griffiths says this degree of control, scale and flexibility is something “no other bank has at this level of maturity”. That claim is not evidenced in public.

The sentence is more carefully worded than it first appears. It does not say that use cases go unchecked, only that staff need not run “lots of manual checks”. Nor does the profile tie it to Arc: like the line that Citi’s AI team builds capabilities “without having to know every possible use case upfront”, it appears in the passage on AI in general. Citi does say, though, that Arc is built with “the same rigor and control applied to any critical system”. The April launch, with its clearly defined use cases, and the September profile therefore differ in subject and emphasis rather than marking a change of course. That difference matters to a supervisor, because supervision starts from the individual use case.

Reach is growing faster than individual cases can be checked by hand

The figures Citi uses to show the breadth of the rollout can be traced over almost two years. According to a Reuters report on 4 December 2024, around 140,000 employees in eight countries were given access to the first two tools at launch. In July 2025 Citi cited around 170,000 employees in 29 countries, in September 2025 more than 175,000 in 80 countries and jurisdictions, and in September 2026 more than 180,000 in more than 87. In the sources reviewed, Citi has given rates of regular use only since this spring. The Arc piece published on 30 April 2026 said more than 80 per cent of the 180,000 employees with access used the tools regularly. On the second-quarter earnings call on 14 July 2026, chief executive Jane Fraser spoke of “nearly nine out of ten of our people”, and by September the adoption rate stood above 87 per cent.

None of these figures counts agents. The 180,000 are employees with access, not active users, let alone users of agents. Going by the wording of the profile, the 65 million interactions and the rate above 87 per cent refer to “the firm’s AI tools” as a whole rather than to Stylus Workspaces alone, and Citi has not published how it calculates adoption. For the question of control, though, the order of magnitude matters more than the decimals. An organisation that takes its tools from eight to more than 87 countries in just under 22 months, and by its own account has released more than 26 versions of Stylus Workspaces, cannot have every extension approved by hand. Controls at that pace have to live in the infrastructure. To that extent, David Griffiths is describing a necessity.

Anyone who has run a trading book knows the distinction at stake. Limits on positions, counterparties and losses are checked automatically in the system before every trade, and no trader asks for a signature to clear them. A new product still does not go on the book until it has passed the new product approval process with risk control, compliance and finance. The two layers exist side by side, and neither replaces the other. What remains open for Arc is whether there is also a new product approval process for agents alongside the platform controls, and Citi’s texts do not answer it.

In the United States, Citi is measured against its own governance

In the United States, the supervisory benchmark for this question moved in April. On 17 April 2026, the Federal Reserve (Fed), the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) published new model risk management guidance, as SR 26-2 at the Fed and Bulletin 2026-13 at the OCC. It replaces SR 11-7, in force since 2011, and contains a footnote that frames the debate for agent platforms: “Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance.” The bank’s own risk management and governance practices are to guide it instead. Fed Governor Michelle Bowman confirmed this in a speech on 1 May 2026, saying the guidance makes clear “that it does not apply to generative or agentic AI”. For Arc, there is therefore no dedicated supervisory test in the United States. The test is Citi’s own governance.

Yet Citi is hardly left to write its own rules. Since 7 October 2020 it has been under consent orders from the Fed and the OCC which, in the Fed’s words, require Citigroup to enhance “its firm-wide risk management and internal controls”, with a focus on compliance risk management, data quality and internal controls. In July 2024 the two agencies imposed penalties totalling around USD 135.6 million because progress on data quality had fallen short. In December 2025 the OCC lifted only the 2024 amendment. The orders themselves remain in force, according to Citi’s 2025 annual report and its quarterly report for the second quarter of 2026. On 14 July, Jane Fraser said work remained “that relates to enhancing data governance, particularly for regulatory reporting”, and that the timing of any lifting was up to the regulators. The orders do not require AI controls. They do show that Citi’s control framework has been under particular scrutiny for six years, and a platform that automates controls moves exactly that framework into a new layer.

Citi’s annual report for 2025, filed with the Securities and Exchange Commission (SEC) on 20 February 2026, before Arc was launched, shows how differently two kinds of document can describe the same thing. Under the heading “The Development and Use of AI by Citi and Others Present Risks to Citi’s Businesses”, the bank names “autonomous agents” as a future capability that, “if improperly managed”, could raise risks and costs, and lists among the causes “insufficient testing and monitoring” and “insufficient or inadequate human oversight”. The report could not yet mention Arc, nor does it use the words “Stylus” or “agentic”. That is no contradiction, since a risk factor describes what could go wrong and a profile what is meant to succeed. For a reader on the supervisory side, though, the document that carries legal liability weighs more, and in it inadequate human oversight is named as a possible failing.

For the same platform, the ECB starts from each material use case

Citi says Arc is to be deployed in “every business line, geography and function”. Those geographies include the euro area. The list of institutions directly supervised by the European Central Bank (ECB), published in April 2026, includes two Citi entities: Citibank Europe plc in Ireland, in the EUR 150 to 300 bn size band for total assets, and Citigroup Global Markets Europe AG in Frankfurt, at EUR 30 to 50 bn. Once agents on the platform take on tasks there, the European benchmark applies to both. ECB Banking Supervision has set out that benchmark several times this year, and it starts in a different place from Citi’s sentence about automated controls. In Frankfurt on 24 February 2026, Pedro Machado of ECB Banking Supervision called for AI to be governed as a core business and risk issue.

The speech was addressed to all banks under ECB supervision, not to Citi. It does, however, name the exact point at which platform logic and supervisory logic can part ways. On this wording, the assessment before launch applies to each material use case, alongside risk assessments by the second line, meaning risk control and compliance. Patrick Montagner, a member of the ECB’s Supervisory Board, added in Brussels on 3 February 2026 that governance frameworks “cannot simply rely on initial testing and validation” and need ongoing monitoring and “human accountability for AI-driven decisions” for as long as a system runs. The ECB’s supervisory priorities for 2026 to 2028 state that supervision will remain “technology-neutral and focused on the use cases and risks”. None of these texts provides for an approval procedure for AI systems. The bank has to produce the evidence itself, when asked. Reading this as evidence per material use case is an inference from these texts, not the wording of any supervisor.

Germany’s Minimum Requirements for Risk Management (MaRisk), issued by the Federal Financial Supervisory Authority (BaFin), are of limited use for this comparison. Since the ninth revision, dated 30 June 2026, they no longer apply to significant institutions under ECB supervision, and so not to Citigroup Global Markets Europe AG either. For other German institutions, though, they show what evidence looks like. Section AT 4.3.4 expressly covers “künstliche Intelligenz”, artificial intelligence, and requires the adequacy and suitability of a model to be assessed “vor dem Einsatz”, before use, and reviewed regularly, together with sufficient explainability. Whether an agent that generates text or triggers actions counts as a model under MaRisk at all is left open, since the definition speaks of methods that turn input data into “quantitative estimates”. MaRisk does not require a model inventory. DORA does require an inventory, and for all institutions: Article 8 calls for information and communication technology (ICT) assets to be recorded with their configuration and dependencies and updated with every material change, and Article 9 requires changes to ICT systems to be recorded, tested and approved in a controlled way. Once a platform is in use at an EU institution, every new version is subject to these change-management requirements.

The gap is widest under the AI Act. The regulation classifies an AI system by its intended purpose rather than its technology, and a system used to assess the creditworthiness of natural persons is high-risk under Annex III. Article 25(1)(c) governs what happens when someone changes the intended purpose of a system so that it becomes high-risk: that party is then treated as the provider, with all the duties on documentation, risk management and human oversight. A platform built deliberately without knowing every future use case is compatible with this logic. It does, however, move classification to the moment a unit deploys an agent for a new purpose, and that moment needs a check. Citi’s line about a human always being in the loop also runs up against a stricter concept in the AI Act. Article 14 requires effective oversight, proportionate to the “level of autonomy”, alert to automation bias and able to interrupt operation with a “stop” button. Under the digital omnibus, these duties will apply to high-risk systems under Annex III from 2 December 2027. Sarah Breeden, Deputy Governor for Financial Stability at the Bank of England, voiced doubt in June that the formula holds in practice: “relying on a human in the loop for all agent actions is unlikely to be realistic.”

The platform is where the evidence is produced

The comparison could be turned into a contrast in which an American bank trusts automation and European supervisors rely on procedure. Industry practice points the other way. The AI Governance Framework of the industry body Fintech Open Source Foundation (FINOS) describes agent controls on two levels: identity, permissions and logging across the platform, and a depth of logging set per use case, “appropriate to the stakes and risk profile of their use case”. JPMorganChase combines both as well, with stricter requirements for agents that process untrusted input, access sensitive data and can act externally, and lighter ones for agents that only read. The cybersecurity agencies of the Five Eyes countries urged on 30 April 2026 that permissions be checked “at each invocation” rather than once when a system starts. These texts describe platform controls as one layer, tiered by risk, rather than as the sole evidence. Whether Citi uses the same tiering, its texts do not say.

Citi itself takes part in this industry work. In June 2025 FINOS launched a project on common controls for AI services together with banks including Citi, Morgan Stanley and Bank of America, and according to FINOS the underlying set of cloud controls was originally contributed by Citi. Citi’s two texts from April and September do not mention it. A bank that automates controls at platform level has not reduced what it must prove. It has a tool that makes evidence per use case cheaper to produce, because inventory, permissions and logs are generated anyway. Whether the tool is used that way is decided by the process around the platform. In Frankfurt and Dublin, supervisors are likely to ask about that process. The platform can supply the evidence, but it cannot stand in for the process.

Recommendations

Glossary