FMI Standard 3: Framework for the comprehensive management of risks

FMI STANDARD 3: FRAMEWORK FOR THE COMPREHENSIVE MANAGEMENT OF RISKS FS3

1 DOCUMENT VERSION HISTORY 1 March 2024 First issue date INTRODUCTION Application i. This standard applies to every operator of a designated FMI that was specified in its designation notice under section 29(2)(f) of Financial Market Infrastructures Act 2021 (the Act) as falling within one or more of the following classes of designated FMIs: (a) a pure payment system; or (b) a securities settlement system; or (c) a central securities depository; or (d) a central counterparty. Legal powers ii. Under section 8 of the Act the regulator is defined as the RBNZ and the FMA acting jointly (or the RBNZ acting on its own in relation to pure payment systems). iii. Section 12 of the Act provides the regulator’s functions. These include regulating designated FMIs, dealing with designated FMIs that are distressed, and other functions under the Act. iv. Subject to certain statutory prerequisites, section 31 of the Act empowers the regulator to make standards for designated FMIs. v. Section 34 sets out the matters that standards may deal with or otherwise relate to. Section 34(1)(e)(i) to (ix) provides that a standard may deal with, or otherwise relate to, the management by operators of one or more of: (a) general business risk; or (b) operational risk; or (c) credit risk; or (d) liquidity risks; or (e) custody and investment risk; or (f) legal risk; or (g) cybersecurity risk; or (h) risks arising out of interconnections (direct or indirect) between a designated FMI and other designated FMIs; or (i) risks arising out of interconnections (direct or indirect) between a designated FMI and other designated FMIs and activities in the financial system that are not activities under designated FMIs.

2 Interpretation vi. The words and phrases used in this standard have the same meaning as in the Act. vii. Internal systems means mechanisms within an FMI or operator to implement policies, procedures, or controls. Commencement viii. This standard comes into force on 1 March 2024. REQUIREMENTS

1. An operator must have a sound risk management framework pertaining to the FMI that sets out how the operator comprehensively manages legal, credit, liquidity, operational, and other relevant and material risks.
2. Further to clause (1) an operator must ensure that: a) it has, in relation to the FMI, risk management policies, procedures, and internal systems that enable the operator to identify, measure, monitor, and manage all risks that arise in, or are borne by, the FMI; and b) it reviews the risk management framework relating to the FMI on at least an annual basis, and whenever the risk to the FMI materially changes; and c) it provides incentives to FMI participants and, where relevant, their customers, to manage and contain the risks they pose to the FMI; and d) it reviews the material risks the FMI bears from and poses to other parties (such as other FMIs, settlement banks, liquidity providers, and service providers) as a result of interdependencies with other parties annually, or whenever the material risk changes, and develops appropriate risk management tools to address these risks. (See Standard 17A: ‘Contingency plans’ for further requirements and Guidance for Standard 3: ‘Framework for the comprehensive management of risks’, in Guidance for the FMI Standards for more detail).