Citigroup (C)

Information Security and Continuity of Business

        Information security and the protection of confidential and sensitive customer data are a priority of Citigroup. The Company has implemented an Information Security Program that complies with the Gramm-Leach-Bliley Act and other regulatory guidance. The Information Security Program is reviewed and enhanced periodically to address emerging threats to customers' information.

        The Corporate Office of Business Continuity, with the support of senior management, continues to coordinate global preparedness and mitigate business continuity risks by reviewing and testing recovery procedures.

52

Table of Contents

Information Security and Continuity of Business

        Information security and the protection of confidential and sensitive customer data are a priority of Citigroup. The Company has implemented an Information Security Program that complies with the Gramm-Leach-Bliley Act and other regulatory guidance. The Information Security Program is reviewed and enhanced periodically to address emerging threats to customers' information.

        The Corporate Office of Business Continuity, with the support of Senior Management, continues to coordinate global preparedness and mitigate business continuity risks by reviewing and testing recovery procedures.

45

Table of Contents

Information Security and Continuity of Business

Information security and the protection of confidential and sensitive customer data are a priority of Citigroup. The Company has implemented an Information Security Program that complies with the Gramm-Leach-Bliley Act and other regulatory guidance. The Information Security Program is reviewed and enhanced periodically to address emerging threats to customers’ information.

The Corporate Office of Business Continuity, with the support of Senior Management, continues to coordinate global preparedness and mitigate business continuity risks by reviewing and testing recovery procedures.

Information Security and Continuity of Business

Information security and the protection of confidential and sensitive customer data are a priority of Citigroup. The Company has implemented an Information Security Program that complies with the Gramm-Leach-Bliley Act and other regulatory guidance. The Information Security Program is reviewed and enhanced periodically to address emerging threats to customers’ information.

The Corporate Office of Business Continuity, with the support of Senior Management, continues to coordinate global preparedness and mitigate business continuity risks by reviewing and testing recovery procedures.

Information Security and Continuity of Business

        Information security and the protection of confidential and sensitive customer data are a priority of Citigroup. The Company has implemented an Information Security Program that complies with the Gramm-Leach-Bliley Act and other regulatory guidance. The Information Security Program is reviewed and enhanced periodically to address emerging threats to customers' information.

        The Corporate Office of Business Continuity, with the support of senior management, continues to coordinate global preparedness and mitigate business continuity risks by reviewing and testing recovery procedures.

Information Security and Continuity of Business

        Information security and the protection of confidential and sensitive customer data are a priority of Citigroup. The Company has implemented an Information Security Program that complies with the Gramm-Leach-Bliley Act and other regulatory guidance. The Information Security Program is reviewed and enhanced periodically to address emerging threats to customers' information.

        The Corporate Office of Business Continuity, with the support of senior management, continues to coordinate global preparedness and mitigate business continuity risks by reviewing and testing recovery procedures.

Information Security and Continuity of Business

        Information security and the protection of confidential and sensitive customer data are a priority of Citigroup. The Company has implemented an Information Security Program that complies with the Gramm-Leach-Bliley Act and other regulatory guidance. The Information Security Program is reviewed and enhanced periodically to address emerging threats to customers' information.

        The Corporate Office of Business Continuity, with the support of senior management, continues to coordinate global preparedness and mitigate business continuity risks by reviewing and testing recovery procedures.

31

Information Security and Continuity of Business

Information security and the protection of confidential and sensitive customer data are a priority of Citigroup. The Company has implemented an Information Security Program that complies with the Gramm-Leach-Bliley Act and other regulatory guidance. The Information Security Program is reviewed and enhanced periodically to address emerging threats to customers’ information.

The Corporate Office of Business Continuity, with the support of Senior Management, continues to coordinate global preparedness and mitigate business continuity risks by reviewing and testing recovery procedures.

Information Security and Continuity of Business

        Citigroup continues to enhance a strategic framework for Information Security technology initiatives, and the Company is implementing enhancements to various Information Security programs across its businesses covering Information Security Risk Management, Security Incident Response and Electronic Transportable Media. The Company continues to implement tools to increase the effectiveness of its data protection and entitlement management programs. Additional monthly Information Security metrics were established to better assist the Information Technology Risk Officer in managing enterprise-wide risk. The Information Security Program complies with the Gramm-Leach-Bliley Act and other regulatory guidance.

        The Corporate Office of Business Continuity, with the support of Senior Management, continues to coordinate global preparedness and mitigate business continuity risks by reviewing and testing recovery procedures.

60

Information Security and Continuity of Business

During 2006, Citigroup continued to enhance a strategic framework for Information Security technology initiatives, and the Company began implementing enhancements to various Information Security programs across its businesses covering Information Security Risk Management, Security Incident Response and Electronic Transportable Media. The Company continues to implement tools to increase the effectiveness of its data protection and entitlement management programs. Additional monthly Information Security metrics were established to better assist the Information Technology Risk Officer in managing enterprise-wide risk. The Information Security Program complies with the Gramm-Leach-Bliley Act and other regulatory guidance.

The Corporate Office of Business Continuity, with the support of Senior Management, continues to coordinate global preparedness and mitigate business continuity risks by reviewing and testing recovery procedures.

Information Security and Continuity of Business

        During 2005 and continuing in 2006, Citigroup continues to enhance a strategic framework for Information Security technology initiatives, and the Company began implementing enhancements to various Information Security programs across its businesses covering Information Security Risk Management, Security Incident Response and Electronic Transportable Media. The Company also implemented tools to increase the effectiveness of its data protection and entitlement management programs. Additional monthly Information Security metrics were established to better assist the Information Technology Risk Officer in managing enterprise-wide risk. The Information Security Program complies with the Gramm-Leach- Bliley Act and other regulatory guidance.

        During 2005, Citigroup began implementing a new business continuity program that improves risk analysis and provides robust support in case of business interruption. The Corporate Office of Business Continuity, with the support of senior management, continues to coordinate global preparedness and mitigate business continuity risks by reviewing and testing recovery procedures.

65

COUNTRY AND CROSS-BORDER RISK
MANAGEMENT PROCESS

Information Security and Continuity of Business

        During 2005 and continuing in 2006, Citigroup created a strategic framework for Information Security technology initiatives, and the Company began implementing enhancements to various Information Security programs across its businesses covering Information Security Risk Management, Security Incident Response and Electronic Transportable Media. The Company also implemented tools to increase the effectiveness of its data protection and entitlement management programs. Additional monthly Information Security metrics were established to better assist the Information Technology Risk Officer in managing enterprise-wide risk. The Information Security Program complies with the Gramm-Leach-Bliley Act and other regulatory guidance.

        During 2005, Citigroup began implementing a new business continuity program that improves risk analysis and provides robust support in case of business interruption. The Corporate Office of Business Continuity, with the support of senior management, continues to coordinate global preparedness and mitigate business continuity risks by reviewing and testing recovery procedures.

62

COUNTRY AND CROSS-BORDER RISK MANAGEMENT PROCESS

Information Security and Continuity of Business

        During 2005 and continuing in 2006, Citigroup created a strategic framework for Information Security technology initiatives, and the Company began implementing enhancements to various Information Security programs across its businesses covering Information Security Risk Management, Security Incident Response and Electronic Transportable Media. The Company also implemented tools to increase the effectiveness of its data protection and entitlement management programs. Additional monthly Information Security metrics were established to better assist the Information Technology Risk Officer in managing enterprise-wide risk. The Information Security Program complies with the Gramm-Leach-Bliley Act and other regulatory guidance.

        During 2005, Citigroup began implementing a new business continuity program that improves risk analysis and provides robust support for business resiliency. The Corporate Office of Business Continuity, with the support of senior management, continues to coordinate global preparedness and mitigate business continuity risks by reviewing and testing recovery procedures.

59

COUNTRY AND CROSS-BORDER RISK MANAGEMENT PROCESS

Information Security and Continuity of Business

        In the fall of 2004, Citigroup created the function of Chief Information Technology Risk Officer to enhance risk management practices between information security and continuity of business. This enabled the Company to better manage and aggregate risk on an enterprise-wide basis.

        During 2005, Citigroup created a strategic framework for Information Security technology initiatives, and the Company began implementing enhancements to various Information Security programs across its businesses covering Information Security Risk Management, Security Incident Response and Electronic Transportable Media. The Company also implemented tools to increase the effectiveness of its data protection and entitlement management programs. Additional monthly Information Security metrics were established to better assist the Information Technology Risk Officer in managing enterprise-wide risk. The Information Security Program complies with the Gramm-Leach-Bliley Act and other regulatory guidance.

        During 2005, Citigroup began implementing a new business continuity program that improves risk analysis and provides robust support for business resiliency. The Corporate Office of Business Continuity, with the support of senior management, continued to coordinate global preparedness and mitigate business continuity risks by reviewing and testing recovery procedures.

74

Information Security and Continuity of Business

        In the fall of 2004, Citigroup created the function of Chief Information Technology Risk Officer to enhance risk management practices between information security and continuity of business. This is an important step in Citigroup's strategy to better manage and aggregate risk on an enterprise-wide basis.

        The Information Security Program complies with the Gramm-Leach-Bliley Act and other regulatory guidance. During 2004, the Citigroup Information Security Office conducted an end-to-end review of Company-wide risk management processes for mitigating, monitoring, and responding to information security risk.

        Citigroup continued to mitigate business continuity risks by reviewing and testing recovery procedures. The Corporate Office of Business Continuity with the support of the Global Senior Continuity of Business Committee monitors compliance with all internal and external regulatory standards to enhance Citigroup's resilience in the financial markets.

53

COUNTRY AND CROSS-BORDER RISK

Information Security and Continuity of Business

        In the fall of 2004, Citigroup created the function of Chief Information Technology Risk Officer to enhance risk management practices between information security and continuity of business. This is an important step in Citigroup's strategy to better manage and aggregate risk on an enterprise-wide basis.

        The Information Security Program complies with the Gramm-Leach-Bliley Act and other regulatory guidance. During 2004, the Citigroup Information Security Office conducted an end-to-end review of Company-wide risk management processes for mitigating, monitoring, and responding to information security risk.

        Citigroup continued to mitigate business continuity risks by reviewing and testing recovery procedures. The Corporate Office of Business Continuity with the support of the Global Senior Continuity of Business Committee monitors compliance with all internal and external regulatory standards to enhance Citigroup's resilience in the financial markets.

49

COUNTRY AND CROSS-BORDER RISK

Information Security and Continuity of Business

        In the fall of 2004, Citigroup created the function of Chief Information Technology Risk Officer to enhance risk management practices between information security and continuity of business. This is an important step in Citigroup's strategy to better manage and aggregate risk on an enterprise-wide basis.

        The Information Security Program complies with the Gramm-Leach-Bliley Act and other regulatory guidance. During 2004, the Citigroup Information Security Office conducted an end-to-end review of Company-wide risk management processes for mitigating, monitoring, and responding to information security risk.

        Citigroup continued to mitigate business continuity risks by reviewing and testing recovery procedures. The Corporate Office of Business Continuity with the support of the Global Senior Continuity of Business Committee monitors compliance with all internal and external regulatory standards to enhance Citigroup's resilience in the financial markets.

48

COUNTRY AND CROSS-BORDER RISK
MANAGEMENT PROCESS

Information Security and Continuity of Business

        In the fall of 2004, Citigroup created the function of Chief Information Technology Risk Officer to enhance risk management practices between information security and continuity of business. This is an important step in Citigroup's strategy to better manage and aggregate risk on an enterprise-wide basis.

        The Information Security Program complies with the Gramm-Leach-Bliley Act and other regulatory guidance. During 2004, the Citigroup Information Security Office conducted an end-to-end review of Company-wide risk management processes for mitigating, monitoring, and responding to information security risk.

        During 2004, Citigroup continued to mitigate business continuity risks by reviewing and testing recovery procedures. The Corporate Office of Business Continuity with the support of the Global Senior Continuity of Business Committee monitors compliance with all internal and external regulatory standards to enhance Citigroup's resilience in the financial markets.