I think PCI is more of a reactive legal tool than it is an effective, proactive way to prevent security breaches. In theory it should catch security vulnerabilities, but I don't know how thorough the compliance checks really are...

Yeah, Citi's greater punishment will likely be in the form of a weakened reputation then it will be in actual damages paid.