I think one of the commenters on Twitter got it right. The fact that Citi did not back down after a CFBP tells me there is a SAR (Suspicious Activity Report) on the file, which the bank is not legally allowed to inform the customer about.