Citi will pay $135.6 million for failing to make sufficient progress toward resolving nagging data quality, risk management and internal control issues, the Office of the Comptroller of the Currency and the Federal Reserve said Wednesday.

The new penalties serve as an addendum to a pair of enforcement actions the Fed and OCC leveled against Citi in October 2020, aimed at forcing the bank to modernize the patchwork of technological infrastructure it inherited through a series of acquisitions starting in the late 1990s.

“While the bank’s board and management have made meaningful progress overall, including taking necessary steps to simplify the bank, certain persistent weaknesses remain, in particular with regard to data,” the OCC’s acting chief, Michael Hsu, said in a statement Wednesday.

The OCC conducted exams last fall to assess whether Citi had made as much progress on data integrity as it claimed — and the bank failed those exams, Reuters reported in February.

Additionally, the Federal Reserve sent Citi three notices late last year, urging the bank to adjust how it measures default risk by counterparties in derivative transactions, the wire service reported.

Beyond that, Citi’s internal audit unit in December found some of the work meant to improve risk management was inadequate, Reuters reported. Among other findings, Citi did not ensure that its board or senior management receive comprehensive reports about risks across the company, the audit unit said.

Wednesday’s order “requires the bank to refocus its efforts on taking necessary corrective actions and ensuring appropriate resources are allocated,” Hsu said.

Citi spent $12.2 billion on technology last year — and more than half of that went toward modernization initiatives, the bank said in January. At the time, Citi CEO Jane Fraser said modernization was “proceeding at pace.”

In a statement Wednesday, Fraser said the bank is “committed to spending what is necessary to address our consent orders” as part of its “multi-year effort” to modernize its tech.

“We’ve always said that progress wouldn’t be linear, and we have no doubt that we will be successful in getting our firm where it needs to be in terms of our Transformation,” Fraser said.

Transformation — with a capital T — is the label Citi has given its tech modernization since regulators issued the 2020 orders — and Hsu referenced the term in his own statement Wednesday.

“Citibank must see through its transformation and fully address in a timely manner its longstanding deficiencies,” he said.

The OCC accounts for $75 million of the new penalties to which Citi agreed. The Fed will receive $60.6 million, the regulators said. By agreeing to pay the penalties, Citi neither admitted nor denied wrongdoing.

As part of the OCC’s order, Citi must submit a plan to the agency’s examiner-in-charge — before declaring dividends or approving capital distributions — detailing whether adequate resources are allocated toward “timely and sustainable compliance” with the regulator’s order. “Continuing noncompliance,” the OCC said, “constitutes unsafe and unsound practices.”

“Setbacks like this one today are visible and I know they can be disappointing,” Fraser wrote, according to Reuters. “But they absolutely cannot distract us from the work we’re doing in every corner of the bank … Efforts of this scale and importance are undeniably hard.”

Wednesday’s action marks “a reminder that [Citi’s] work to put its regulatory issues to rest represents a marathon rather than a sprint, with bumps along the way,” Scott Siefers, an analyst at Piper Sandler, wrote in a note seen by Banking Dive.

“This is a negative indictment of management and not surprising,” JPMorgan analysts led by Vivek Juneja said in a note seen by Bloomberg. “It is very surprising to see that the board, which is [composed] of three former regulators, has been lacking in its oversight.”

Citi’s aging tech went on full display in a high-profile gaffe in which a Citi employee manually — and mistakenly — transferred $900 million of the bank’s money to creditors of the cosmetics company Revlon, sparking a protracted legal battle.

But that isn’t the only courtroom action Citi has weathered in the effort to modernize its tech. Kathleen Martin, who served as a data transformation executive at the bank, sued Citi in May, alleging Chief Operating Officer Anand Selva asked her to hide information from the OCC because the data would make the bank “look bad.” In her lawsuit, Martin says she was fired for refusing to do so.

A Citi spokesperson told Banking Dive via email that Martin’s “lawsuit is without merit and we will vigorously defend against it.”