US regulators fined Citigroup Inc. $400 million and ordered the nation’s third-largest bank to fix its risk-management systems, citing “significant ongoing deficiencies.”