Hello,
citibanamex.com is a domain used by one of Mexico biggest bank to send email to customers. They send all their messages encoded in base64 which rspamd does not love and adds a lot of points making it difficult to make rules around it.
I see banamex.com domain is already in your lists, but this other domain is used by their emails as well.
Thanks for your help.