The FTC has ruled previously that applying a material change in a privacy policy to information collected under a prior policy, without customer consent, constitutes an unfair or deceptive trade practice in violation of the FTC Act.
Citi's revised clawback policy recoups pay where executives are responsible for material financial or reputational harm, either through their own actions or in failing to supervise others.