Citi Evacuates Remote Model Risk Team from UAE as Iranian Strike Threats Escalate

Citigroup has pulled a team of model risk analysts out of the United Arab Emirates following escalating threats of Iranian military strikes in the region. The move, first reported by Business Insider in late March 2026, signals how geopolitical instability is now directly disrupting the offshoring strategies that major banks have relied on to cut costs for years.

The evacuated team was based in the UAE and worked on model validation — the critical process of stress-testing the quantitative models banks use for everything from credit risk to derivatives pricing. These aren’t back-office paper pushers. They’re specialized quants whose work underpins regulatory compliance and risk management across the institution.

Here’s the context. Tensions between Iran and several Gulf states, along with broader friction involving the U.S., have spiked in early 2026. Intelligence assessments pointing to potential Iranian strikes on UAE infrastructure forced Citi’s hand. The bank decided the physical safety of its employees outweighed the cost advantages of maintaining the remote operation.

Not a small decision.

Citi, like most global banks, has spent the past decade aggressively distributing operations across lower-cost hubs. The UAE — particularly Dubai and Abu Dhabi — became attractive not just for proximity to Middle Eastern clients but for its relatively stable business environment, favorable tax treatment, and access to a growing pool of technical talent. JPMorgan, Goldman Sachs, and Morgan Stanley have all expanded their Gulf footprints in recent years, according to reporting from Reuters and the Financial Times.

But stability is relative. And when it fractures, banks with distributed workforces face a problem their predecessors didn’t: how to maintain continuity on highly specialized, regulation-sensitive functions when the people doing the work are suddenly in a conflict zone.

Citi reportedly relocated the affected employees to other offices, though the bank hasn’t publicly confirmed the specific destinations. Business Insider’s sources indicated that some team members were moved to European hubs, while others were temporarily reassigned to U.S.-based offices. The transition wasn’t without friction — model risk work requires secure computing environments, access to proprietary systems, and alignment with specific regulatory frameworks that vary by jurisdiction.

The timing is particularly awkward. Banks are under intensifying scrutiny from regulators on model risk management. The Federal Reserve’s SR 11-7 guidance, which governs model risk for U.S. bank holding companies, demands rigorous independent validation. The Office of the Comptroller of the Currency has been pushing similar expectations. Any disruption to validation pipelines doesn’t just create operational headaches — it creates compliance exposure.

So what does this mean for the industry?

First, it’s a stress test for the distributed operations model itself. Banks have treated geographic diversification as a form of resilience. Spread your operations across enough cities and countries, the thinking goes, and no single disruption can cripple you. That logic holds when the risks are localized — a hurricane in one city, a power grid failure in another. It holds less well when an entire region becomes unstable.

Second, it raises uncomfortable questions about concentration risk in offshoring. The Gulf states have absorbed a significant share of financial services expansion over the past five years. If geopolitical conditions deteriorate further, multiple institutions could face simultaneous disruption. That’s correlated risk, and it’s the kind regulators tend to notice.

Third, it highlights the tension between cost optimization and operational resilience. Model risk teams are expensive to maintain onshore. Quants with the right credentials command high salaries in New York and London. Moving them to Dubai or Abu Dhabi offered meaningful savings. But those savings evaporate fast when you’re scrambling to relocate people, reconfigure secure systems, and manage regulatory reporting gaps during a crisis.

Citi declined to comment in detail on the evacuation. A spokesperson offered only a general statement about the bank’s commitment to employee safety, per Business Insider’s reporting.

Other banks with significant Gulf operations are watching closely. None have publicly announced similar evacuations, but contingency planning is reportedly underway at several institutions. The situation remains fluid — diplomatic channels are active, and a de-escalation could render the whole episode a footnote. Or not.

For technology and risk leaders at major financial institutions, the lesson is blunt: your business continuity plans need to account for geopolitical disruption at a regional scale, not just facility-level incidents. And your offshoring strategy needs a Plan B that can activate fast, without breaking regulatory compliance in the process.

The old assumption — that you could park critical quantitative functions in a low-cost hub and forget about them — just got a lot harder to defend.