Supervisory Policy Manual CR-G-13 Counterparty Credit Risk Management

Supervisory Policy Manual
Management
This module should be read in conjunction with the Introduction and with the Glossary, which contains an explanation of abbreviations and other terms used in this Manual. If reading on line, click on blue underlined headings to activate hyperlinks to the relevant module. ————————— Purpose To set out the approach which the HKMA will adopt in the supervision of AIs’ counterparty credit risk (“CCR”), and to provide guidance to AIs on the key elements of effective CCR management Classification A non-statutory guideline issued by the MA as a guidance note Previous guidelines superseded CR-G-13 “Counterparty Credit Risk Management” (V.1) dated 03.06.09 Application To all AIs Structure

1. Introduction
   1.1 Terminology
   1.2 Background
   1.3 Scope
   1.4 Implementation
2. Nature of CCR
   2.1 Pre-settlement risk versus settlement risk
   2.2 Characteristics of exposures to pre-settlement risk
3. Supervisory approach to CCR
   3.1 Risk-based supervision
   3.2 Capital adequacy framework (for locally incorporated AIs)

Supervisory Policy Manual
Management
3.3 Disclosure (for locally incorporated AIs)
3.4 Large exposure
4. Corporate governance
4.1 General
4.2 Firm-wide risk management approach
4.3 Risk management oversight
4.4 Risk management expertise
4.5 Risk management reporting
5. Risk management policies and procedures
5.1 General
5.2 Major elements
6. Credit assessment and review
6.1 General
6.2 Scope and key considerations
6.3 Assessment of credit protection providers
6.4 Assessment of parties involved in central clearing
6.5 Counterparty information
7. Risk measurement and valuation
7.1 General
7.2 Measuring counterparty default risk
7.3 Credit valuation adjustment
7.4 Settlement risk
7.5 Measurement of risk concentration
7.6 Other considerations
7.7 Valuation practices
7.8 Use of internal models
8. Limit setting
8.1 General
8.2 Counterparty default risk limits
8.3 Margin thresholds and minimum transfer amounts

Supervisory Policy Manual
Management
8.4 CVA limits
8.5 Settlement risk limits
9. Risk monitoring and control
9.1 General
9.2 Specific considerations
9.3 Monitoring of exposures against limits
9.4 CCR control function
9.5 Independence of the validation function
9.6 Collateral management function
10. Stress-testing
10.1 General
10.2 Scope and setting of stress scenarios
10.3 Use of stress-testing results
11. Management information system and reporting
11.1 Management information system
11.2 Management reports
12. CCR mitigating practices
12.1 General
12.2 Netting arrangements
12.3 Collateral and margining arrangements
12.4 Calculation of collateral margins / haircuts for non￾centrally cleared SFTs
12.5 Portfolio compression
12.6 CVA hedging
12.7 Other forms of CCR mitigation
12.8 Central clearing
13. Independent reviews and audits
13.1 General
13.2 Coverage of independent reviews and audits

Supervisory Policy Manual
Management
————————

1. Introduction
   1.1 Terminology
   1.1.1 Unless otherwise specified, abbreviations and terms
   used in this module follow those used in the Banking (Capital) Rules (“BCR”).
   1.1.2 For the purposes of this module—
   (a) “counterparty credit risk” (“CCR”) means counterparty default risk, CVA1 risk and settlement risk; (b) “CCR exposure” means an exposure to CCR; (c) “CCR-related activities” means activities, businesses, contracts, products or transactions that give rise to CCR, e.g. derivative contracts and hedging activities. (d) “current exposure”, in relation to counterparty default risk in respect of a transaction, is the amount that would be lost if the counterparty to the transaction defaults today. Current exposure is also referred to as replacement cost; (e) “expected exposure”, in relation to counterparty default risk measures based on statistical or simulation methodologies, is the average of the distribution of exposures to a counterparty at a date in the future; (f) “expected positive exposure”, in relation to counterparty default risk measures based on statistical or simulation methodologies, is the weighted average over time of expected exposures where the weights (for determining the weighted

1 To avoid doubt, “CVA” mentioned in this module, unless otherwise specified, means the CVA determined by an AI for its accounting and internal risk management purposes.

Supervisory Policy Manual
Management average) are the proportion that an individual expected exposure represents of the entire time interval concerned; (g) “general wrong-way risk” has the meaning given by §226E(3)(b) of the BCR. For example, increases in interest rates may affect the creditworthiness of a counterparty if the counterparty has a large amount of floating rate liabilities; (h) “haircut” or “margin”, in relation to a securities financing transaction (“SFT”) or a portfolio of SFTs entered into between two parties, means the minimum degree of over-collateralization in the SFT or the portfolio2 that has to be maintained as agreed by both parties; (i) “leverage” means the amplification of return (positive or negative) of a position by funding the position with debts. Leverage can exist when: (i) financial assets exceed capital; (ii) the change in value of a position can exceed the amount paid for it; or (iii) a position’s price volatility exceeds that of the underlying market factor (i.e. embedded leverage); (j) “long settlement transaction” (“LST”) has the meaning given by §2(1) of the BCR. “Market standard” referred to in the definition in the BCR means the standard settlement period for a particular type of transaction. For example, the market norm for the settlement of a spot FX contract in Hong Kong is T+2 business days. LSTs can be derivative contracts, SFTs, or other transactions with a CCR profile and risk drivers similar to those of derivative contracts or SFTs; (k) “over-the-counter derivative” (“OTC derivative”) is a derivative contract which is not traded on an exchange;

2 For example, the margin ratio defined in the Global Master Repurchase Agreement published by the International Capital Market Association.

Supervisory Policy Manual
Management
(l) “peak exposure”, in relation to counterparty default risk measures based on statistical or simulation methodologies, is a high percentile (typically 95 percent or 99 percent) of the distribution of exposures at any particular future date before the maturity date of the longest transaction in a netting set; and (m)“potential exposure”, in relation to counterparty default risk in respect of a transaction, is an estimate of the additional exposure (i.e. in excess of the current exposure) that an AI may assume during the life of the transaction as a result of the changes in the values of market factors. It is primarily a function of the remaining time to maturity and the expected volatility of the market factors (e.g. price, rate or index) relevant to the transaction.
1.2 Background
1.2.1 CCR is a major form of credit risk 3 arising from
derivative contracts, SFTs, and cash transactions 4 in securities, foreign exchange and commodities. With the continued growth of the derivative market in Hong Kong and AIs’ increasing use of financial instruments and structured products for yield enhancement and/or risk management purposes, it is essential for them to have the necessary systems and expertise for managing any CCR associated with those activities.
1.2.2 The importance of effective CCR management is also
underlined in major financial crises that happened in recent decades (e.g. the 1997/1998 Asian financial crisis, the 2007 U.S. sub-prime crisis5 , etc.). Credit risk, in particular CCR, characterised by concerns about the creditworthiness of counterparties or institutions in the affected markets, is often seen as a key factor affecting

3 Another common form of credit risk is lending risk. The key differences between CCR and lending risk are discussed in Section 2. 4 The CCR arises from cash transactions is basically settlement risk. 5 The 2007 U.S. sub-prime crisis referred to in this module includes the subsequent chain of events that developed into a global financial crisis.

Supervisory Policy Manual
Management the severity of those crises. Moreover, the close links between credit, market and liquidity risks, which tended to feed on each other during the crises, cannot be ignored in CCR management. In the 2007 U.S. sub￾prime crisis, for example, market concerns about the credit quality of sub-prime mortgages in the U.S. and the value of related mortgage-backed securities led to, among other things, the widening of credit spreads, massive write-downs in the value of structured transactions and the evaporation of market liquidity, which in turn eroded the funding liquidity of individual institutions, as well as market confidence in these institutions.
1.3 Scope
1.3.1 This module is intended to provide guidance on
measures and best practices that could be adopted by AIs in evaluating and ensuring effectiveness of their CCR management systems.
1.3.2 In developing this module, the HKMA has made
reference to—
(a) the sound practices for CCR management and other related provisions set out in the Basel regulatory capital framework; (b) the supervisory requirements of other major regulators concerning CCR management; (c) relevant recommendations and observations on risk management practices made by other international organizations or supervisory groups (e.g. the Financial Stability Board and the Senior Supervisors Group6 ) in the aftermath of the 2007 U.S. sub-prime crisis; and

6 The Senior Supervisors Group is made up of seven participating supervisory agencies from France, Germany, Switzerland, the United Kingdom and the United States.

Supervisory Policy Manual
Management
(d) industry standards and practices on CCR management7 .
1.3.3 This module should be read in conjunction with CR-G￾14 “Non-centrally Cleared OTC Derivatives
Transactions – Margin and Other Risk Mitigation Standards”, IC-1 “Risk Management Framework” and CR-G-1 “General Principles of Credit Risk Management”. The risk management criteria and sound practices contained in IC-1 and CR-G-1 are also applicable to effective CCR management.
1.4 Implementation
1.4.1 AIs are expected to have in place CCR management
policies, processes, systems and controls that are commensurate with the sophistication and complexity of their CCR-related activities.
1.4.2 AIs should assess their CCR management systems
against the revised risk management guidance laid down in this module and devise an action plan to address any gaps identified within a reasonable timeframe which should be no later than one year from the issue date of this module or such further period as may be agreed with the HKMA8 . The HKMA will monitor AIs’ progress in meeting the relevant standards in the course of ongoing supervision.
2. Nature of CCR
2.1 Pre-settlement risk versus settlement risk
2.1.1 CCR has two components, viz. pre-settlement risk and
settlement risk.

7 Among others, the recommendations related to CCR management set out in the reports issued by the Counterparty Risk Management Policy Group (“CRMPG”) in June 1999, July 2005 and August 2008 were taken into consideration. 8 Only existing AIs at the issue date of this module may approach the HKMA for extension of the implementation timeline. AIs making such request should provide justifications to support their requests.

Supervisory Policy Manual
Management
2.1.2 Pre-settlement risk, which comprises counterparty
default risk and CVA risk, is the risk of loss due to default, or deterioration of the credit quality, of the counterparty to a transaction before the final settlement of the transaction. The exposure amount varies throughout the life of the transaction and the extent of losses will only be known at the time of default or revaluation of the transaction.
2.1.3 Settlement risk is the risk of loss during the settlement
process due to a counterparty’s failure to perform its obligation after an AI has performed its obligation in a transaction at the settlement date. Failed settlement can be due to a number of reasons including counterparty default, operational problems and market liquidity constraints.
2.2 Characteristics of exposures to pre-settlement risk
2.2.1 This subsection provides some guidance to help identify
transactions that give rise to pre-settlement risk.
2.2.2 Pre-settlement risk may stem from transactions booked
in the banking book or trading book of AIs, irrespective of the types of counterparty concerned. Typical transactions that incur pre-settlement risk include derivative contracts and SFTs (including LSTs that are derivative contracts or SFTs). These transactions usually exhibit the following characteristics:
(a) they generate a current exposure or market value; (b) they have an associated random future market value based on market variables (i.e. potential exposure); (c) they generate an exchange of payments or an exchange of a financial instrument (including commodities) against payment; (d) they are undertaken with an identified counterparty against which a unique probability of default can be determined;

Supervisory Policy Manual
Management
(e) they are frequently valued (usually on a daily basis), according to changes in market variables; (f) their pre-settlement risk can be mitigated by a number of credit risk mitigating measures, such as collateral, margining, netting arrangements and credit derivatives; and (g) short-term financing may be a primary objective in that the transactions mostly consist of an exchange of one asset for another (cash or securities) for a relatively short period of time, usually for the business purpose of financing.
2.2.3 While exposures to pre-settlement risk and other credit
exposures (e.g. loans) have similar risk management considerations in many aspects, they have fundamental differences as highlighted below. Loan exposure Exposure to pre-settlement risk One-way risk of loss: only the lender is exposed to potential credit loss. Bilateral risk of loss: either party to a contract may suffer a loss, depending on whether the market value of the contract to a party is positive at the time of counterparty default or when the credit quality of the counterparty deteriorates. Exposure to the borrower is always positive. Exposure to the counterparty in respect of a contract can be positive or negative at a particular point of time during the life of the contract. An AI is exposed to pre-settlement risk only when the contract is “in the money”, i.e. having a positive value. Loan principal is always exchanged. Notional principal may or may not be exchanged.

Supervisory Policy Manual
Management
Loan exposure Exposure to pre-settlement risk Exposure at the time of default can be easily measured (e.g. a loan exposure generally amounts to the outstanding loan principal). Exposure at the time of default is contingent on the future value of the underlying assets and market factors, and can only be estimated (i.e. the sum of current exposure and potential exposure).
3. Supervisory approach to CCR
3.1 Risk-based supervision
3.1.1 CCR is basically a form of credit risk (the CVA risk can
also be considered a form of market risk) covered by the HKMA’s risk-based supervisory approach. AIs are required to establish a sound and effective system to manage CCR.
3.1.2 Continuous supervision of AIs in respect of their CCR
management framework is achieved through a combination of on-site examinations, off-site reviews and prudential meetings. The main objectives are to assess the adequacy and effectiveness of their CCR management, and the level and trend of their CCR exposures. See SA-1 “Risk-based Supervisory Approach” for details of the HKMA’s risk-based supervisory methodology.
3.1.3 In the case of locally incorporated AIs, the adequacy of
their capital relative to the level of their CCR exposures and the soundness of their CCR management will also be assessed as part of the HKMA’s supervisory review process (see CA-G-5 “Supervisory Review Process” for more details).
3.1.4 Where an AI is part of a locally incorporated banking
group with a centralised CCR management system, the HKMA will assess such system on a group basis. Where the banking group to which an AI belongs is

Supervisory Policy Manual
Management owned by an entity incorporated outside Hong Kong, the HKMA will take into account any group-wide CCR management policies, processes, systems and controls that may be applicable to the AI (and whether they have been tailored to suit local circumstances). Where appropriate, the HKMA may obtain relevant information or comments from the home supervisor of the AI’s head office or parent bank for reference.
3.1.5 In the above cases, the AI’s management should be
able to explain and demonstrate to the HKMA’s satisfaction that the relevant group-wide CCR management policies, processes, systems and controls are appropriate for controlling its CCR exposures. The AI should also provide the HKMA, where necessary, with any information, documentation or evidence that the HKMA may require for considering and ascertaining whether the relevant CCR management policies, processes, systems and controls are acceptable to the HKMA.
3.1.6 Results of the above assessments by the HKMA,
together with the assessment results for other inherent risks9 , will be used for determining the overall risk profile of, and the supervisory priorities for, AIs and, in the case of locally incorporated AIs, their minimum capital adequacy ratios.
3.1.7 In assessing the adequacy and effectiveness of an AI’s
CCR management, the HKMA will take into account the following factors:
(a) the nature, complexity and level of the AI’s CCR￾related activities and CCR exposures; (b) the adequacy and effectiveness of the AI’s corporate governance practices, including the level of oversight exercised by the Board and senior management on CCR-related activities;

9 These refer to the market, interest rate, liquidity, operational, legal, reputation and strategic risks.

Supervisory Policy Manual
Management
(c) the knowledge and ability of the AI’s management in identifying, assessing, monitoring and controlling CCR; (d) the adequacy of, and the extent of compliance with, the AI’s CCR management policies and procedures; (e) the appropriateness of the AI’s CCR measurement, monitoring and management information systems; (f) the adequacy and effectiveness of the AI’s internal risk limits for controlling CCR, stress-testing procedures and other risk mitigating practices; (g) the robustness of the AI’s systems for conducting internal reviews and audits of its CCR management policies, processes, systems and controls; (h) the adequacy and effectiveness of the AI’s CCR management practices and strategies, as evidenced from past and projected financial performance; and (i) the appropriateness of the AI’s level of CCR in relation to its earnings, capital and risk management systems.
3.1.8 If the risks or scale of AIs’ SFT activities warrant it, the
HKMA may consider requiring relevant AIs to provide information on their aggregate margin / haircut requirements on a number of archetypal portfolios, in order to identify any market-wide changes in levels of margin / haircut requirements for SFTs over time and/or any outlier AIs with unusually low margin / haircut requirements for SFTs.
3.1.9 Sections 4 to 13 below provide further guidance on the
above assessment factors.
3.2 Capital adequacy framework (for locally incorporated AIs)
3.2.1 As in the case of other credit exposures, CCR
exposures are subject to capital charges under the regulatory capital framework in Hong Kong. AIs are required to calculate and provide adequate capital for

Supervisory Policy Manual
Management their CCR exposures (regardless of whether the transactions giving rise to such exposures are booked in the banking book or trading book) in accordance with the requirements set out in the BCR.
3.2.2 At present, the BCR require AIs to provide capital for
the following types of CCR exposure:
(a) exposures to counterparty default risk; (b) exposures to CVA risk; (c) exposures to central counterparties (“CCPs”); and (d) exposures arising from failed settlement.
3.2.3 AIs should read the qualitative CCR requirements
specified in the BCR (e.g. Schedule 2A) in conjunction with this module for a better understanding of the expectation of the HKMA in respect of those requirements.
3.2.4 For AIs that have been granted an IMM(CCR) approval
under §10B of the BCR, the HKMA may require them to submit backtesting results of the relevant internal models for review. If the results indicate that the realised exposures are significantly different from the forecast distribution, this could indicate problem with the model or the underlying data. Under such circumstances, the HKMA may consider taking one or more of the measures set out in §10D of the BCR to contain the risk.
3.2.5 Where an AI has an exposure to a qualifying CCP
arising from default fund contributions, the HKMA may require the AI to provide information that will enable the HKMA to review the AI’s calculation of the capital charge for the exposure and to monitor the risk of the AI.
3.3 Disclosure (for locally incorporated AIs)
3.3.1 AIs are required to make qualitative and quantitative
disclosures on CCR in accordance with the requirements stipulated in the Banking (Disclosure)

Supervisory Policy Manual
Management
Rules (“BDR”), including any associated standard disclosure templates and tables specified by the MA under the BDR.
3.4 Large exposure
3.4.1 AIs are required to include, in the reporting of large
exposures to individual counterparties, their exposures to counterparty default risk. AIs should refer to the relevant rules and guidelines issued by the HKMA for the scope of application, calculation methodologies and reporting arrangement.
4. Corporate governance
4.1 General
4.1.1 Sound corporate governance is essential to effective
CCR management. General requirements and practices relating to corporate governance, including the oversight role and risk management responsibilities of the Board (or its delegated committee) and senior management of an AI, are set out in the SPM modules CG-1 “Corporate Governance of Locally Incorporated Authorized Institutions”, CG-5 “Guidelines on a Sound Remuneration System”, CG-6 “Competence and Ethical Behaviour”, IC-1 “Risk Management Framework” and CR-G-1 “General Principles of Credit Risk Management”.
4.1.2 This section focuses on some facets of corporate
governance that are particularly relevant to CCR management.
4.2 Firm-wide risk management approach
4.2.1 AIs should seek to ensure that their governance
structure and practices are conducive to a firm-wide approach to risk management. In particular, AIs should encourage an integrated approach to managing firm￾wide risks (e.g. credit, market and other major risks) and promote continuous dialogue and information sharing between business units and independent support and control functions (e.g. risk management,

Supervisory Policy Manual
Management legal and compliance, operations and audit) at the senior level in respect of risk profiles and exposures across the organization. This will help reduce the risk of individual units making decisions in isolation without gaining insights of other areas, and enable critical issues and developments to be given due management attention.
4.3 Risk management oversight
4.3.1 The Board and senior management of an AI should be
actively involved in the CCR management process, and should regard CCR management as an essential aspect of the business to which adequate resources need to be devoted. They should exercise sufficient oversight of the AI’s CCR management system to ensure that the system is consistent with the supervisory expectation set out in this module.
4.3.2 The CCR management strategies and risk appetite
should be approved by the Board and should be subject to regular review to ensure that they remain adequate in light of changing circumstances. The risk appetite should take into account quantitative risk metrics (including inputs from scenario analyses and stress￾testing) and qualitative factors such as compensation system, the quality of risk controls, and the point in the business cycle.
4.3.3 The Board and senior management should ensure that
business decisions made reflect an appropriate balance between risk appetite and risk controls. This could be achieved, for example, by— (a) implementing business strategies that align with the risk appetite; (b) ensuring that the risk management and control infrastructure is commensurate with, and can fully support, the pace of business growth (particularly in relation to complex structured products or other high risk activities); and

Supervisory Policy Manual
Management
(c) putting in place compensation or incentive schemes that discourage excessive risk-taking in the short￾run.
4.3.4 In order to sustain proper control environment across
business units, the Board and senior management should ensure that the risk management and other support and control functions are robust, truly independent from the business units (both in terms of decision-making and reporting structure), and have sufficient authority, resources and expertise to carry out their functions.
4.4 Risk management expertise
4.4.1 The Board and senior management should have an
adequate understanding of the AI’s CCR-related activities, the associated risks and the control systems involved (including the key assumptions and limitations of the various valuation and pricing methodologies and models employed in the systems). They should also put in place policies, procedures and controls to recruit and retain people who have sufficient product knowledge and expertise to manage the risks involved and to ensure that the staff members involved in CCR management remain competent for their role, taking into account changing circumstances including product innovation and changes in regulatory requirements.
4.4.2 The Board and senior management have a
responsibility to understand and act on emerging risks. This requires the Board members and senior executives to possess expertise that is necessary for them to discharge their respective responsibilities. It is also beneficial to set up a risk management committee comprising senior executives from the business side and the support and control side to assess and monitor CCR and related risks.
4.5 Risk management reporting
4.5.1 The Board and senior management of an AI should
ensure that the AI’s management information system and risk reporting framework are conducive to effective

Supervisory Policy Manual
Management
CCR management (see section 11 below for more information).
4.5.2 The Board and senior management are responsible for
determining their own risk reporting requirements. They should ensure that they receive timely and relevant information that will allow them to discharge their risk oversight responsibilities.
5. Risk management policies and procedures
5.1 General
5.1.1 AIs should have in place clearly defined CCR
management policies and procedures that are conceptually sound and consistent with the nature, complexity and level of their CCR-related activities and CCR exposures. These policies and procedures should be well documented, approved by the Board (or its delegated committee), communicated clearly to relevant staff members at all levels, and regularly reviewed and updated to reflect changing circumstances and developments in the AI concerned and the market environment in which it operates.
5.2 Major elements
5.2.1 AIs are expected to cover the following aspects in their
CCR management policies and procedures:
(a) definitions of CCR and its components for identifying CCR in different business activities10; (b) the AI’s risk appetite for various components of CCR, which should be consistent with its overall risk appetite and appropriate for its business objectives and financial capacity;

10 AIs are encouraged to examine their business activities and consider the need for extending the guidance of this module to activities beyond derivative contracts and SFTs (including LSTs that are derivative contracts or SFTs) set out in paragraph 2.2.2 where those activities are assessed to be associated with material CCR.

Supervisory Policy Manual
Management
(c) the governance and control structure, which defines the roles and responsibilities of various parties involved in CCR management and their reporting relationships, including the Board, firm-wide committees, senior management, business units, and independent support and control functions; (d) the approach to identifying, measuring, monitoring, controlling and reporting CCR exposures, which should, inter alia, include the following:
(i) the identification of, and approval for, new CCR-related activities (as well as the post￾approval review of such activities); (ii) the due diligence and counterparty approval process, including—

• the guidelines for determination of
  acceptable counterparties for complex transactions;
• the underwriting standards and controls for
  credit initiation, assessment, approval and review of counterparties (see also section 6 below); and
• the type and nature of information to be
  obtained from counterparties for credit assessment; (iii) legal, transaction and trading relationship documentation standards; (iv) risk measurement, including—
• the methodologies, models and standards
  used for measuring the CCR exposures arising from different types of CCR-related activities, taking into account associated risks (such as market, liquidity, legal and operational risks) and, to the extent practicable, their correlations; and

Supervisory Policy Manual
Management

• where applicable, the operation and
  validation of internal models, including the types of testing used to ensure model integrity and to identify violation of assumptions and possible understatement of risk measures, the criteria against which the internal models and the underlying assumptions are assessed, and the process by which unacceptable performance will be determined and remedied; (v) risk control and mitigation, including—
• the eligible CCR mitigation methodologies
  and related controls, such as acceptable types of CCR mitigants, policies and procedures for assessing appropriateness of engaging in portfolio compression, haircuts for collateral, margin policies and procedures, dispute resolution procedures, etc.;
• the CCR limit structure and monitoring of
  limit usage;
• the controls on, and escalation procedures
  for, exceptions such as limit excesses and transactions requiring special approval (e.g. when the collateral offered is not acceptable under the AI’s credit policies);
• the policies and procedures for managing
  legal and documentation risk (e.g. timely execution of contracts and related trading relationship documentation, use of standard documentation, enforceability of collateral and netting agreements, etc.), taking into account the nature and scope of the business concerned and the risk profile, as well as market practices; and
• the policies and procedures for trade
  confirmation and reconciliation;

Supervisory Policy Manual
Management
(e) the management reporting system on CCR exposures and compliance with established policies, limits and procedures; (f) the stress-testing procedures, and the methodologies and criteria for developing stress scenarios that are applicable to CCR exposures; (g) record and document retention policies for terminated, expired or assigned contracts / transactions; and (h) the framework for conducting independent reviews and audits on the AI’s CCR management system.
6. Credit assessment and review
6.1 General
6.1.1 AIs should not engage in CCR-related activities before
(i) assessing the creditworthiness of the counterparty concerned; (ii) taking sufficient account of both the pre￾settlement risk and settlement risk involved; and (iii) being aware of any associated wrong-way risks (see paragraphs 6.2.4 and 6.3.1 below). For established counterparty relationships, there should be an ongoing review process for assessing the CCR associated with, and any significant risks (e.g. market, legal and liquidity risks) emerging from, these relationships. As CCR is primarily a form of credit risk, AIs may refer to CR-G-2 “Credit Approval, Review and Records” for some general guidance in these respects.
6.2 Scope and key considerations
6.2.1 AIs should conduct their own due diligence on their
counterparties and assess the risks that affect or drive the associated CCR exposures based on sufficient credit and transaction information (see also subsection
6.5 below). Care should be taken not to rely unduly on
the credit assessment of, and credit ratings assigned by, external credit rating agencies.

Supervisory Policy Manual
Management
6.2.2 Traditional credit analysis may suffice for assessing the
credit quality of many types of counterparties. However, where an AI intends to deal with, or is dealing with, a counterparty to a financial instrument associated with, or that forms part of, a complex transaction11, it should be able to understand the risk profile and the business model (e.g. the use of leverage) of the counterparty, and analyse the effects of stressed events on the transaction as well as the capability of both the AI itself and the counterparty to withstand potential losses associated with the transaction (see also paragraph
9.1.2 below). Similarly, in assessing the credit quality of
a counterparty to a complex financial instrument (especially one that is tailored made for the counterparty by the AI), the AI should consider the purposes for which the financial instrument is entered into by the counterparty. The credit assessment should also take into consideration the complexity and leverage of the financial instrument and whether it may pose significant wrong-way risks to the AI (e.g. the wrong-way risk that arises when there is unfavourable correlation between the mark-to-market value of the instrument and the financial strength of the counterparty).
6.2.3 It is also important to conduct an adequate assessment
of a counterparty’s off-balance sheet exposures (including hedging positions and commitments (whether contractual or non-contractual)) to determine whether such exposures (including those arising from over￾hedging) pose a major risk to the counterparty. For example, a counterparty which has sponsored a number of special purpose vehicles may bear the risk of having to provide financial support beyond its contractual obligation to these vehicles should they get into financial trouble so as to protect the counterparty’s own reputation, market position or customer relationships.

11 For example, an interest rate swap entered into with a special purpose vehicle in a complex securitization transaction such as collateralised debt obligations, or derivative contracts entered into with a hedge fund that are used in the fund’s sophisticated trading strategies.

Supervisory Policy Manual
Management
6.2.4 AIs should ensure that the amount and the credit terms,
including pricing, collateral and margining arrangements, extended to counterparties are commensurate with their assessment of the credit quality of the counterparties, the risks underlying the transactions, and the adequacy of counterparty information obtained. AIs should also be cautious about whether the credit terms may create wrong-way risks, such as granting a credit line (e.g. for conducting OTC derivatives) to a company secured by the company’s own shares, as the risk of the “secured” portion of the CCR exposure is positively correlated with the probability of default of the company.
6.3 Assessment of credit protection providers
6.3.1 Equally vigorous credit assessment and review should
be conducted on financial guarantors and sellers of credit derivatives from whom an AI intends to purchase, or has purchased, credit protection, including whether the AI’s exposures to these credit protection providers could be or are subject to specific wrong-way risk. During the 2007 U.S. sub-prime crisis, concerns emerged on the ability of individual financial guarantors (particularly monoline insurers) to honour their obligations under structured transactions, and on the materiality of financial institutions’ exposures to the guarantors. As some of these guarantors were active in insuring exposures to securities backed by sub-prime mortgages, they were actually more vulnerable to the decline in the value of such securities than those institutions seeking protection. As a result, the creditworthiness of the guarantors was positively correlated with the valuation of the securities covered by their guarantees (an example of specific wrong-way risk). AIs should thus carefully assess and control any concentration risk arising from over-reliance on individual credit protection providers and guard against the build-up of specific wrong-way risk in their effort to mitigate CCR.

Supervisory Policy Manual
Management
6.4 Assessment of parties involved in central clearing
6.4.1 Adequate credit assessment and regular credit review
are also needed for the following parties if an AI has or will have a credit exposure to any of them due to central clearing:
(a) CCPs, where (i) an AI is, or intends to be, a CCP’s clearing member; or (ii) an AI uses, or intends to use, client clearing services (in particular those using a clearing model where a client has a direct legal / contractual relationship with the CCP); (b) clearing members, where an AI uses, or intends to use, client clearing services (in particular those using a clearing model (e.g. a principal model) where the client has no legal / contractual relationship with the CCP); and (c) customers to which an AI provides, or intends to provide, clearing services.
6.4.2 In the case of CCPs, the primary objective of the
assessment is to ascertain whether the CCP concerned is well-regulated and soundly managed. To this end, the assessment and review should evaluate the CCP’s risk management practices using the latest Principles for financial market infrastructures issued by the CPSS and IOSCO12 as a baseline. AIs may make use of the assessment methodology 13 issued by the CPSS and IOSCO to help develop their own assessment framework. The assessment should at a minimum covers— (a) a CCP’s risk management framework with respect to membership requirements, financial resources available for handling clearing member default (e.g.

12 CPSS means the Committee on Payment and Settlement Systems while IOSCO means the International Organization of Securities Commissions. 13 See “Principles for financial market infrastructures: Disclosure framework and Assessment methodology” issued by the CPSS and IOSCO in December 2012.

Supervisory Policy Manual
Management default fund14), margining practices, approaches to loss allocation and limits of liability to clearing members; (b) the soundness of the CCP’s risk management policies and procedures, including those for handling the default of a clearing member, the CCP’s obligations at post-default auctions, and post￾default assignment of positions15; (c) contingent liabilities of the AI concerned to the CCP (such as unfunded commitment of default fund contributions). In general, AIs should not expose themselves to an unlimited contingent liability to the CCP; and (d) (in the case of locally incorporated AIs that are clearing members) availability of timely and sufficient information to enable the AI to calculate the capital requirements for its exposures to the CCP concerned.
6.4.3 The general credit principles and the scope and key
considerations mentioned in subsections 6.1 and 6.2 apply equally to the credit assessment and review of clearing members and customers referred to in paragraphs 6.4.1(b) and 6.4.1(c). However, there are additional considerations for an AI that is a client of a clearing member, including— (a) the portability of the AI’s positions and the degree of protection of the collateral posted by the AI to the clearing member in the event of default by the clearing member and/or its clients; and (b) given the level of protection to the AI under the segregation arrangement concerned, whether the

14 The description given by a CCP to its mutualised loss sharing arrangements is not determinative of their status as a default fund (also known as clearing deposit or guaranty fund). The substance of such arrangements will govern their status. 15 Post-default auction and post-default assignment of positions refer respectively to the processes under which the CCP attempts to close out a defaulting clearing member’s positions by auctioning the positions, or assigning the positions, to other surviving clearing members.

Supervisory Policy Manual
Management default risk of the clearing member (including the credit quality of its CCR exposures, if information is available) is acceptable to the AI.
6.5 Counterparty information
6.5.1 AIs’ credit assessment and decision should be
supported by adequate information on the counterparties concerned. In the case of highly leveraged counterparties or transactions that may entail significant CCR exposure, more detailed counterparty information is warranted on top of general background and financial information. As recommended by the CRMPG16, such information may include— (a) material financing and counterparty relationships; (b) specific trading and investment strategies and asset allocations; (c) operating controls, including information on the procedures for valuation, trade verification and settlement, margin and collateral management; (d) information on risk management approach and controls, as well as risk management methods and risk measurements; (e) capital condition and market risk; (f) asset liquidity risk 17 and funding liquidity risk 18 assessments; and (g) material events that may affect the credit quality of the counterparty concerned (e.g. litigation or enforcement actions by supervisory authorities).

16 See the report “Improving Counterparty Risk Management Practices” issued by the CRMPG in June 1999 for more details. 17 Asset liquidity risk refers to the risk that an institution cannot easily offset or eliminate a position at the market price because of inadequate market depth or market disruption. 18 Funding liquidity risk is the risk that an institution will not be able to meet efficiently both expected and unexpected current and future cash flow and collateral needs without affecting either daily operations or its financial condition.

Supervisory Policy Manual
Management
6.5.2 More detailed information on the following may also be
useful in respect of a counterparty:
(a) credit risk (including CCR) concentration; (b) significant off-balance sheet activities (e.g. securitizations and use of conduits / SPVs); and (c) regulatory environment.
6.5.3 If the credit assessment is for entering into a complex or
bespoke transaction with a counterparty, specific information on the transaction should also be obtained to assess how the structure and the terms and conditions of the transaction may affect the CCR exposure involved. For example, if the transaction is an interest rate swap in a securitization transaction, an AI as a swap counterparty will need to consider in its credit assessment the credit quality of the assets to be securitised and also the priority of its claims on the SPV concerned.
6.5.4 During stress periods, additional information should be
obtained from major counterparties for an updated assessment and review.
7. Risk measurement and valuation
7.1 General
7.1.1 AIs’ CCR measurement systems should encompass all
significant CCR-related activities and has the capability to provide CCR measures across business lines and on a firm-wide basis. The sophistication of an AI’s CCR measurement system should be commensurate with the nature, complexity and level of the AI’s CCR exposures, its technical capabilities, as well as the ability of its management to understand the nature, limitations and implications of the results produced.
7.1.2 AIs should consider adopting more flexible risk
measurement processes and systems that permit rapid adaptation of methodologies or models (such as by varying assumptions and input parameters) to changes

Supervisory Policy Manual
Management in market conditions, thus supporting more responsive risk identification, analysis and control.
7.1.3 Where practicable, AIs should consider using a wider
range of risk measures and should not be too dependent on a single methodology or a limited set of tools. For instance, although it is not acceptable for AIs to use only the notional amount for risk measurement, this risk measure may be used as a supplementary tool for highlighting potential concentration or as a backstop during stressed market conditions where assumptions underlying other risk measures may no longer hold. Use of both gross and net risk measures as well as risk measures calibrated to stressed scenarios has similar benefits.
7.2 Measuring counterparty default risk
7.2.1 There are various methodologies for measuring
potential exposure, ranging from simple measures to sophisticated modelling techniques. The commonly used methodologies generally fall into one of the following categories:
(a) Conversion factors (such as those expressed as a percentage of the notional amount of a contract) - The conversion factors could be determined using more sophisticated approaches (e.g. analytical formulas) which take into account multiple variables such as volatility, correlation, maturity and non￾linear risk. In general, the conversion factors for different types of product, regardless of the degree of sophistication of the approach adopted to derive the conversion factors, should at a minimum reflect differences in the volatility of the underlying risk factors and in the tenor (or maturity) across products. The conversion factors should be reviewed periodically to ensure that they continue to provide adequate estimates of potential exposure. (b) Statistical or simulation methodologies - These methodologies estimate the probable values that a contract might reach over a specified time horizon

Supervisory Policy Manual
Management and typically involve internal models 19 (see also paragraphs. 7.8.1 and 7.8.2 below). The potential exposure estimated may be presented using different measures, such as peak exposure, expected exposure, expected positive exposure, etc.
7.2.2 In contrast, determination of the current exposure of a
contract is more straightforward. Current exposure generally amounts to the mark-to-market value (if positive) of the contract.
7.2.3 Collateral, margining and netting may be taken into
account in the current and potential exposure calculations, depending on the degree of sophistication of the methodologies used.
7.2.4 Different counterparty default risk measures may
provide different views of the risk, and thus may serve different risk management purposes. For example, an AI may— (a) use current exposure, gross and net of collateral, for re-margining purposes; (b) use peak exposure at both the counterparty and portfolio levels for limit setting and monitoring purposes; and (c) use expected exposure, together with probabilities of default, for pricing and valuation purposes.
7.3 Credit valuation adjustment
7.3.1 Large and complex AIs should adopt CVA
measurement that meets the following general standards:
(a) CVA calculation should include all products and counterparties, including margined counterparties;

19 The HKMA does not require or mandate any particular AI or groups of AIs to use internal models for risk management purposes. AIs are expected to choose the appropriate measurement method based on their individual circumstances, including the nature, complexity and level of CCR posed by their activities.

Supervisory Policy Manual
Management
(b) The method for incorporating counterparty credit quality into CVA calculation should be reasonable and subject to ongoing evaluation; (c) Inputs for CVA calculation, such as credit spreads, should be based on current market data when possible. AIs should not overly rely on non-market￾based probability of default estimates (such as those estimated under the IRB approach) when calculating CVA; (d) AIs should attempt to map credit quality to name￾specific spreads rather than spreads associated with broad credit categories. Where proxy spreads are used, the proxy spreads should reasonably capture the idiosyncratic nature of the counterparty and the liquidity profile; (e) The term structure of credit spreads should be reflected in the CVA calculation; (f) The CVA calculation should incorporate counterparty-specific netting agreements and margin terms (e.g. margin thresholds or minimum transfer amounts); (g) AIs should seek to incorporate specific wrong-way risk into their CVA calculation.
7.3.2 If the amount of CVA made to an AI’s portfolio is
substantial, the AI should measure the risk of loss associated with CVA on an ongoing basis using stress￾testing. AIs may also develop value-at-risk (“VaR”) models for CVA but the models should be used with great caution with sufficient recognition of the limitations and model risk involved as this area is still evolving.
7.3.3 AIs other than those mentioned above should, as a
minimum, maintain a CVA measurement system that is necessary for them to meet the accounting standards and regulatory capital requirements20 applicable to them.

20 In the case of AIs incorporated outside Hong Kong, “regulatory capital requirements” means those requirements imposed by the AIs’ home supervisors.

Supervisory Policy Manual
Management
They are encouraged to enhance their abilities in measuring CVA and take into account CVA when pricing derivative contracts.
7.4 Settlement risk
7.4.1 Where settlement on a delivery-versus-payment (“DvP”)
or payment-versus-payment (“PvP”) basis is not practicable, the settlement risk is generally the full value of the payment (either in the form of funds or financial instruments) made by an AI before its counterparty meets a counter-payment or delivery obligation plus replacement cost (if any). In the case of settlement on a DvP or PvP basis, the settlement risk is eliminated. However, there remains a risk of loss on the difference between the transaction concerned valued at the agreed settlement price and the transaction valued at current market price when the settlement fails.
7.5 Measurement of risk concentration
7.5.1 AIs’ CCR measurement systems should enable the
identification of large or concentrated positions, such as— (a) by groups of related counterparties; (b) by customer investment strategies; (c) by market and industry sectors; (d) by underlying market factors (e.g. interest rates and exchange rates); or (e) by any other ways specified by the regulatory requirements applicable to the AIs.
7.6 Other considerations
7.6.1 AIs should ensure that the risk measures for CCR
exposures capture both actual and contingent exposures (such as committed funding arrangements) and incorporate relevant risks that can be associated

Supervisory Policy Manual
Management with CCR (e.g. market and liquidity risks). This is because— (a) commitments, such as those for providing margin financing, may increase an AI’s total CCR exposure to a counterparty in future and therefore should be captured in the risk measures; (b) the CCR and the market risk associated with a transaction are closely intertwined. The CCR exposure of the transaction is dependent on the movements of the transaction’s underlying market factors (e.g. exchange rates, interest rates and credit spreads) during the life of the transaction. Thus, the volatility of these market factors, and the correlations among them and between the credit risk of the counterparty concerned and the general market factors (i.e. general wrong-way risk), all play an important part in CCR measurement; and (c) at times of market stress, the value of some financial instruments may plummet or become indeterminate due to evaporation of market liquidity.
7.6.2 To control liquidity risk arising from large positions and
concentration, AIs are recommended to adjust quantitative measures of potential exposure to margined counterparties to take into account exceptionally large positions, as well as concentration in less liquid instruments. The adjustment should anticipate potentially protracted periods required for unwinding positions and the risk of price gapping during the unwinding process.
7.7 Valuation practices
7.7.1 AIs’ valuation practices should be in line with the
guidance set out in the SPM module CA-S-10 “Financial Instrument Fair Value Practices”. Valuation of CCR exposures for the purposes of capital adequacy must be conducted in accordance with the calculation methods specified in the BCR (e.g. §4A and Part 6A of the BCR).

Supervisory Policy Manual
Management
7.7.2 There should also be a consistent and disciplined
approach to the application of estimated prices for different purposes (e.g. internal risk management and external reporting) and for instruments held by different business units within an AI both on a solo and a consolidated basis such that the same instrument is marked at the same price unless under exceptional circumstances.
7.7.3 AIs’ pricing policies and procedures should give special
consideration to tailor-made, structured or illiquid products, and assets that are difficult to price. It would be prudent for AIs to value their complex, large or less liquid positions with more conservative assumptions. If an AI has accumulated a material position in a complex product, it is recommended to trade a portion of the position, where possible, to promote price discovery and to narrow the potential for divergence between theoretical, model-derived prices and market prices. A robust monitoring process should be employed to track stale prices and escalate unresolved issues.
7.7.4 AIs should perform periodic review of the valuation
processes agreed with counterparties to take into account changes in market conditions and, where necessary, discuss with the counterparties for amendments of the relevant documentation accordingly.
7.7.5 For active market participants, revaluations should be
performed on both an intraday as well as a daily basis.
7.7.6 AIs should establish internal CCR cost allocation and
valuation practices that provide incentives for business units to manage proactively their CCR. These may include methods for recognising CCR costs in internal risk assessment or internal capital allocation, proactive adjustments to limits as well as tools for periodically evaluating the adequacy of CVA to asset carrying values.
7.8 Use of internal models
7.8.1 AIs using internal models for CCR management
purposes should ensure that the models are robust,

Supervisory Policy Manual
Management effective and capable of producing reliable risk estimates. Such models should be fully tested and validated prior to use, and the reliability of the models should be regularly reviewed through independent model validation procedures. AIs may draw reference from Schedule 2A to the BCR, which sets out some relevant controls on model design, development, validation, review and approval, and from the Sound practices for backtesting counterparty credit risk models issued by the Basel Committee on Banking Supervision in December 2010, which provides more information on the backtesting requirements set out in Schedule 2A.
7.8.2 Senior management should pay special attention to the
limitations and assumptions of the models and validation methodologies used and understand the impacts these could have on the reliability of model outputs. Senior management should also consider the uncertainties of the market environment (e.g. timing of realization of collateral) and operational issues (e.g. where proxy volatility data are used as a substitute for valuing instruments that do not have a long price history of their own) and be aware of how these are reflected in the models.
7.8.3 For locally incorporated AIs that use the IMM(CCR)
approach for the purpose of regulatory capital calculation, the AIs need not employ a single model. Moreover, there is no particular requirement with respect to the form of model. Both simulation models and analytical models are acceptable so long as they meet all of the relevant requirements set out in the BCR. The AIs should also conduct the backtesting referred to in §5(d)(v) of Schedule 2A to the BCR at regular intervals. The intervals could be specified by the HKMA if evidence suggests that the intervals chosen by an AI are not frequent enough to ensure the reliability of the models concerned.

Supervisory Policy Manual
Management
8. Limit setting
8.1 General
8.1.1 AIs should establish and enforce operating limits and
other risk control practices that maintain their CCR exposures within levels consistent with their established risk appetite, strategies and policies, and that accord with their approach to measuring and reporting CCR exposures, capital strength and risk management capabilities. In general, the CCR limits should be sublimits of an overall credit limit that covers all of an AI’s credit exposures to a counterparty.
8.1.2 CCR limits should be set on the amounts, tenors and
types of transaction for each counterparty and each group of related counterparties, with distinct limits for pre-settlement risk and settlement risk. Such limits should take into account the results of stress-testing (see section 10 below for details). Limits may also be established for specific products (e.g. forwards, options, swaps or SFTs), market or industry sectors (e.g. financial institutions or corporates), or underlying market factors (e.g. exchange rates and interest rates).
8.1.3 Established CCR limits should be clearly communicated
to, and well understood by, senior management as well as the relevant business units and the independent support and control functions so as to ensure rigorous compliance with the limits and adequate exposure monitoring and reporting. The limits should also be subject to periodic reviews by management with appropriate delegated authority. Ad hoc reviews of established limits should be performed at times of market distress or when AIs become aware of signs of deterioration in the credit quality of the counterparties concerned.
8.2 Counterparty default risk limits
8.2.1 AIs should, as appropriate, set limits for various
counterparty default risk exposure measures for more

Supervisory Policy Manual
Management granular control and monitoring of counterparty default risk exposures. Examples of such limits include— (a) Current exposure - measured at current market value, including the benefit of valid bilateral netting agreements (but before consideration of any related collateral); (b) Current net of collateral exposure - measured at current exposure minus the net value of collateral in respect of which there is a high level of confidence about legal enforceability and perfection of security interest; (c) Current liquidation exposure - measured as current net of collateral exposure based upon estimates of liquidity-adjusted contract replacement cost, the liquidation value of collateral received and the buy-in cost of collateral pledged. When estimating the liquidity-adjusted contract replacement cost, AIs should take into account: (i) potential adverse price movements over the period of liquidation; (ii) the specific liquidity characteristics of the contracts and collateral concerned under both normal and stressed conditions; and (iii) the potential for market illiquidity based on position size or transient shocks; and (d) Potential exposure - measured on the basis of potential future market moves adjusted for collateral rights, threshold agreements, optional unwind rights as well as the shorter timeframes these rights imply. Individual counterparty limit on potential exposure should be based on peak exposures rather than expected exposures.
8.2.2 AIs should set counterparty default risk limits for
individual counterparties (including CCPs) and groups of counterparties (e.g. which exhibit similar risk characteristics) based on the AIs’ own assessment of the counterparties’ creditworthiness (see section 6 for more information on credit assessment and review).

Supervisory Policy Manual
Management
8.3 Margin thresholds and minimum transfer amounts
8.3.1 If there is a margin agreement between an AI and its
counterparty, the AI should, where applicable and subject to any applicable regulatory margin requirements 21 , determine the margin threshold and minimum transfer amount based on its assessment of the counterparty’s credit quality to reflect the amount of unsecured exposure to the counterparty the AI is willing to assume.
8.4 CVA limits
8.4.1 It is considered sound practice for large and complex
AIs to set limits on CVA or CVA VaR so as to limit their exposures to CVA risk.
8.5 Settlement risk limits
8.5.1 The settlement risk limits should be determined having
regard to, apart from a counterparty’s credit quality, other factors such as the maximum possible amount of the payment obligations involved (bearing in mind that some derivative contracts involve exchanges of full notional amounts), the efficiency and reliability of the relevant settlement systems employed (e.g. the soundness of the settlement system’s operational risk management framework), the period for which the exposure will remain outstanding, and any associated collateral or netting arrangements.
9. Risk monitoring and control
9.1 General
9.1.1 CCR exposures should be managed as
comprehensively as practicable at the counterparty level (i.e. aggregating with other credit exposures to a counterparty), across business lines and on a consolidated basis to arrive at an aggregate credit

21 See SPM module CR-G-14 for regulatory requirements applicable to non-centrally cleared OTC derivatives entered into by AIs and the scope of application of these requirements.

Supervisory Policy Manual
Management exposure to a counterparty, with adjustments to reflect the effect of enforceable netting and collateral arrangements. Where possible, AIs which are active market participants may wish to assess their CCR exposures to a large counterparty not only based on their own exposures to the counterparty, but also considering any available data regarding other institutions’ exposures to the counterparty.
9.1.2 AIs should have procedures for controlling CCR
exposures. Such procedures should have regard to situations when the exposures become large, a counterparty’s credit standing weakens, or the market comes under stress. It is also important to be alert to adverse changes in prevailing market conditions (e.g. widening of credit spreads) that may increase the risks inherent in transactions (e.g. price risk). AIs should also strengthen the ongoing monitoring of CCR posed by large counterparties by adopting an integrated approach to evaluating the linkages between leverage, liquidity and market risk. For example, subject to information availability, AIs should monitor the risk arising from the counterparties’ use of leverage by considering, among other factors, the magnifying and interconnected effects of leverage, under normal and stress conditions, on the counterparties’ (i) market risk, (ii) funding arrangements and collateral requirements, and (iii) asset liquidity risk. AIs should also evaluate factors that may mitigate the effects of leverage (e.g. solid access to long-term unsecured funding sources).
9.1.3 The frequency with which CCR exposures are
monitored should depend on the size and nature of the exposures. For example, an AI which is actively engaged in derivatives activities should monitor its CCR exposures on a daily and on an intraday basis.
9.2 Specific considerations
9.2.1 AIs should have procedures to identify, monitor and
control transactions that give rise to a greater degree of general and/or specific wrong-way risks. There should be policies in place to govern the approval of new

Supervisory Policy Manual
Management transactions or new counterparties that will expose the AIs to significant wrong-way risks (e.g. when the counterparty to a credit default swap and the reference entity underlying the swap has a legal relationship). In general, AIs should try to avoid such transactions or counterparties. Specific wrong-way risk should be monitored and controlled from the inception of a transaction and throughout the life of the transaction.
9.2.2 Large and complex AIs should have the capacity to—
(a) conduct wrong-way risk analyses for derivative contracts and SFTs, and monitor general wrong-way risk by product, region, industry, or by other categories that are relevant to the AIs’ activities; (b) monitor risk concentration to asset classes and CCR exposures, both on a gross and net basis, to all institutional counterparties in a matter of hours, and generate effective and coherent reports on such exposures to high risk counterparties to enable senior management and other relevant personnel to make better and more informed judgements and respond timely to changing market conditions (particularly in times of stress when models and metrics are most prone to providing false signals); and (c) manage CVA volatility arising from market moves and incorporate CVA in the pricing of transactions.
9.2.3 AIs’ cash management policies should account
simultaneously for the liquidity risks of potential incoming margin calls in the context of exchanges of variation margin or other types of margin (e.g. initial margin or independent amount) under adverse market shocks, potential incoming calls for the return of excess collateral posted by counterparties, and calls resulting from a potential downgrade of the AIs’ own external credit rating.
9.2.4 Appropriate systems and controls should be put in
place to monitor, on a continuing basis, the risk that

Supervisory Policy Manual
Management membership of, and/or conduct of business through, a CCP or multiple CCPs may create and to manage such risk.
9.3 Monitoring of exposures against limits
9.3.1 There should be procedures for timely identification,
reporting, investigation and resolution (approval or rejection) of exceptions to limits.
9.3.2 Since transactions that are within an established limit
today could exceed the limit at any point in the future due to changing market conditions, AIs’ policy on CCR limits should not only define the circumstances where further transactions with a counterparty must be prohibited, but also define the circumstances under which existing positions must be adjusted when a limit is, or is close to be, exceeded due to market movements. Independent ongoing monitoring of exposures against established limits (including margin thresholds) is therefore needed to ensure that appropriate measures will be taken promptly when there is actual or potential limit excess.
9.4 CCR control function
9.4.1 AIs should have a CCR control function. Depending on
the nature, scale and complexity of an AI’s CCR-related activities, this function may be standalone or integrated with other support and control functions. 22 The CCR control function should be independent of the business units, reported directly to senior management, staffed with personnel of sufficient knowledge and expertise, and assigned with sufficient resources to discharge its risk control responsibilities across all relevant business units. The function should also be accorded adequate status and authority, relative to its counterpart in the

22 For some AIs, the CCR control function may be shared between the middle office for credit risk management (e.g. for credit assessment, approval and review of counterparties) and for market risk management (e.g. for validation and review of AIs’ valuation methodologies and models). In these cases, AIs should ensure that the party responsible for overseeing CCR is clearly designated so that CCR does not fall through the gap between credit and market risk management.

Supervisory Policy Manual
Management business units, so as to ensure its independence and effectiveness.
9.4.2 Generally, the CCR control function should be
responsible for—
(a) the independent credit assessment, approval (within delegated authorities) and review of counterparties; (b) the design or selection of the AI’s CCR management system; (c) the implementation of the CCR management system including:
(i) valuation of financial instruments and measurement of CCR exposures; (ii) daily monitoring of CCR exposures, usage of and compliance with established limits, and identification and resolution of exceptions; (iii) control of input data integrity and proper trade capture, including transaction terms and specifications such as notional amounts, maturity, reference assets, collateral thresholds, margining and netting arrangements; (iv) analysis of data and preparation of daily reports for daily CCR monitoring as well as management reports for monitoring by the Board and senior management of the AI’s CCR profile relative to its risk appetite; and (v) conducting stress-testing and reporting the results to the Board (or its delegated committee) and senior management (see section 10 below for details).
9.4.3 The CCR control function of an AI that uses internal
models in CCR management should also be responsible for producing and analysing daily reports on the output of the AI’s internal models, including an

Supervisory Policy Manual
Management evaluation of the relationship between measures of CCR exposure and trading limits.
9.4.4 The work of the CCR control function should be closely
integrated with the day-to-day credit risk management process of an AI. Its output should be an integral part of the process of planning, monitoring and controlling the AI’s credit and overall risk profile.
9.5 Independence of the validation function
9.5.1 As a general principle, validation and review of internal
models used in the CCR management system (including risk measures and risk factor predictions generated by the internal models) should be conducted by a validation function with sufficient degree of independence from the unit responsible for model design or development and the business units. Hence, large and complex AIs are generally expected to have a separate validation unit 23 with adequate and independent reporting lines. For smaller AIs, having a separate validation unit may be too costly or practically infeasible. However, as a minimum, the validation function must be performed by staff who is independent from the staff responsible for model design or development and for originating or renewing CCR exposures, with adequate compensating measures deployed where necessary. The degree of independence required must be commensurate with the nature and the scale of an AI’s CCR exposures and the complexity of the risks inherent in its business model.
9.6 Collateral management function
9.6.1 AIs must have a collateral management function that is
responsible for—
(a) revaluating collateral received from or posted to counterparties regularly;

23 The separate validation unit does not need to be set up only for CCR management. The validation of CCR models and systems can be conducted by an existing independent validation unit that is responsible for validation of internal rating models or market risk models.

Supervisory Policy Manual
Management
(b) calculating and making margin calls, and reporting levels of independent amounts, initial margins and variation margins accurately on a daily basis; (c) managing margin call disputes; (d) monitoring compliance with regulatory margin requirements and collateral agreements (including provisions (e.g. rating triggers) that will enable the AI or its counterparties to call for additional collateral or dispose of existing collateral); (e) controlling the integrity of the data used to make margin calls, and ensuring that such data are consistent and reconciled regularly with all relevant data sources within the AI; (f) tracking and controlling risks associated with margin agreements including volatility and liquidity of securities exchanged as collateral; (g) tracking and controlling the extent of reuse of collateral (both cash and non-cash) posted to the AI (including the potential liquidity shortfalls resulting from the reuse) and the rights ceded by the AI in respect of the collateral that it posts; (h) tracking and controlling concentration in individual types of collateral accepted by the AI; and (i) producing and maintaining appropriate collateral management information that is reported on a regular basis to senior management, including information on the type of collateral (both cash and non-cash) received and posted, categories of collateral reused and the terms of reuse (e.g. type, credit quality and maturity of instruments eligible for reuse), the size, aging and cause for margin call disputes, and the trends in the areas to which such information relates.
9.6.2 The senior management of an AI must allocate
sufficient resources to the collateral management function for its systems to (i) ensure an appropriate

Supervisory Policy Manual
Management level of operational performance, as measured by the timeliness and accuracy of outgoing margin calls and response time to incoming margin calls; (ii) process margin calls and disputes in a timely manner even under severe market crisis; and (iii) enable the AI to limit its number of large disputes caused by trade volumes.
9.6.3 In the case of other AIs whose scale of activities in
derivative contracts and SFTs is small, the above collateral management responsibilities, where applicable, may be performed by the CCR control function or other control functions (e.g. credit administration).
10. Stress-testing
10.1 General
10.1.1 AIs should have a formal, routine and rigorous stress￾testing programme in place to supplement the day-to￾day outputs of the CCR management systems. There
should be strong commitment and support from the Board, senior management and business managers on the use of stress-testing. Moreover, the CCR stress￾testing should be integrated into the firm-wide stress￾testing, risk management framework and risk culture of an AI. IC-5 “Stress-testing” provides general guidance to AIs on the use of stress tests for risk management purposes.
10.2 Scope and setting of stress scenarios
10.2.1 AIs should perform CCR stress-testing not only at
counterparty-specific level, but also across counterparties at both counterparty group (e.g. industry and region) and aggregate firm-wide levels.
10.2.2 In conducting stress-testing on CCR exposures, AIs
should develop stress scenarios that— (a) are forward looking and cover possible events or future changes in economic and market conditions

Supervisory Policy Manual
Management
(including extreme but plausible events) that could have unfavourable effects on an AI’s CCR exposures. The scenarios should include (i) economic or industry downturns, (ii) market-place events, (iii) decreased market liquidity and (iv) the liquidation of a large financial intermediary; (b) cover multiple risk factors (including, at a minimum, credit and market risk factors (given their close correlation)); (c) contain sound assumptions about the underlying markets and other parameters; and (d) probe for vulnerabilities within and across key portfolios (including trading, credit and investment portfolios), based on inputs from relevant business units and with particular analytical focus on the impact of stress events on large or relatively illiquid sources of risks.
10.2.3 The stress tests should be capable of assessing—
(a) the impact of severe shocks on an AI’s capital resources, capital requirements and earnings, and the AI’s ability to withstand stressed economic or market conditions; (b) the concentration risk to a single counterparty and groups of counterparties, to a given risk factor or product, or to specific directional sensitivities; (c) wrong-way risks and severe shocks (including shocks that occur when relationships between risk factors have changed); (d) material non-directional risks (e.g. yield curve exposure, basis risks, etc.); (e) the joint movement of CCR exposures and counterparty creditworthiness under stressed conditions; and

Supervisory Policy Manual
Management
(f) the risk that liquidating a counterparty’s positions could move the market and the impact of such move on the AI’s other positions.
10.2.4 The severity of factor shocks should be consistent with
the purpose of the stress test in question. When evaluating solvency under stress, factor shocks should be severe enough to capture historical extreme market environments and/or extreme but plausible stressed market conditions. For the purposes of day-to-day CCR management, AIs should also consider scenarios of lesser severity and higher probability.
10.2.5 AIs should ensure that major stress-testing
assumptions and the limitations of the methodologies or models used are adequately understood by the parties concerned including the Board and senior management.
10.2.6 AIs should consider applying reverse stress tests to
CCR exposures to identify extreme, but plausible, scenarios that could result in significant adverse outcomes to the AIs. Reverse stress tests may be included in the formalised stress-testing routines so that trends and developments in key factors and exposure amounts could be tracked and analysed.
10.3 Use of stress-testing results
10.3.1 The stress-testing results should be reviewed
periodically by the Board (or its delegated committee) and senior management. The results should cover the largest counterparty-level impacts across portfolios, material concentration within segments of a portfolio (such as industries or regions), and relevant portfolio￾and counterparty-specific trends. Senior management should ensure that the results are meaningful and proactively used to manage CCR. At a minimum, the results should be compared to the AI’s risk appetite and reflected in its CCR policies and limits. Moreover, the results of stress testing should be elevated for discussion and action when the results reveal excessive or concentrated risks, or particular vulnerability to a given set of circumstances. Senior management

Supervisory Policy Manual
Management should explicitly consider appropriate risk management strategies (e.g. by hedging or reducing the size of the AI’s CCR exposures) to address issues revealed by stress-testing.
11. Management information system and reporting
11.1 Management information system
11.1.1 AIs should ensure that their information systems and
processes allow for a robust and prompt assessment of CCR and provide comprehensive, timely, accurate, reliable and useful information, not only in normal times but also during periods of stress or crisis, to the Board and senior management to enable early investigation of signs of emerging risks and formulation of responsive strategies to deal with the changing risk landscape and to the front office and relevant support and control functions for daily risk monitoring.
11.1.2 More specifically, AIs should ensure complete trade
capture and exposure aggregation across all sources of CCR (not just OTC derivatives) at the counterparty￾specific level (and for large and complex AIs, at various levels of granularity) on a firm-wide basis. The information should be able to be generated on different bases and in a timeframe that are fit for different risk management or regulatory purposes, including— (a) meeting ad hoc CCR reporting requests or supervisory queries; (b) collateral management; and (c) supporting regular stress testing and scenario analyses.
11.2 Management reports
11.2.1 The management reports on CCR exposures should be
reviewed by a level of management with sufficient seniority and authority to enforce, where necessary, responsive actions (e.g. reduction of positions). The depth, coverage and frequency of reporting for CCR

Supervisory Policy Manual
Management management purposes should depend on the materiality of an AI’s CCR exposures and the volume and complexity of transactions.
11.2.2 Daily reports covering significant CCR limit usage,
exceptions to limits, collateral management information (including compliance with applicable regulatory margin / haircut requirements) and revaluation gains and losses (including losses due to mark-to-market changes in CVA) should be provided to the front office and relevant support and control functions for risk monitoring. Moreover, there should be reports (though not necessarily as frequent) on, for example, CCR exposures against risk appetite, tenor of CCR exposures, CCR concentration, wrong-way risks, trends in CCR exposures, trends in limit excesses and watch lists (such as those of counterparties whose exposures or credit quality are highly sensitive to specific market risk factors). More frequent and ad hoc reporting should be made as market conditions dictate.
11.2.3 Reports to the Board (or its delegated committee) and
other levels of senior management may occur less frequently, but the frequency and scope of reporting should be tailored to their needs and sufficient to highlight follow-on questions. In general, the reports should provide these individuals with adequate information on, and forward-looking assessment of, CCR (including exposures arising from trades cleared by CCPs and CCP membership obligations / commitments), such as summarised information on the AI’s CCR profile, assessment of significant issues related to the risk management aspects discussed in this module, steps taken or being taken to address issues or risks identified and stress-testing results.
11.2.4 Senior management should receive periodic information
on CCR exposures. Such reporting should generally observe the following standards:
(a) aggregates exposures on a firm-wide basis and to significant counterparties (including CCPs);

Supervisory Policy Manual
Management
(b) includes all on- and off-balance sheet exposures; (c) reports significant concentration, counterparties with the largest exposures and exposures to weak or problem counterparties; (d) highlights trends (e.g. growth) in CCR exposures over time; (e) measures exposures under conservative assumptions as to the efficacy of netting and collateral arrangements; (f) in the case of large counterparty default risk exposures— (i) measures current exposures and collateral values both at market and estimated liquidation values; (ii) uses potential exposure measures that are robust and appropriately reflect risk reduction and risk mitigating arrangements; and (iii) uses quantitative and qualitative analysis to identify counterparties for which large moves in specific market risk factors would result in large exposure levels, a material deterioration in credit quality, or both.
11.2.5 For AIs which are active market dealers, information
provided to senior management should highlight possible concentration of market and credit risks resulting from positive correlation among an AI’s own principal positions, counterparties’ positions with the AI and collateral received or posted.
11.2.6 Sufficient contextual information should also be
provided to senior management periodically for assessing the degree of reliance that can be placed on quantitative CCR management information, highlighting key judgements and assumptions involved in developing the quantitative CCR management information, and shedding additional light on an AI’s

Supervisory Policy Manual
Management overall risk profile. Examples of such information include information relating to data integrity and completeness, model assumptions and limitations, and legal enforceability of credit risk mitigating arrangements.
12. CCR mitigating practices
12.1 General
12.1.1 AIs should apply appropriate CCR mitigating measures
to control their CCR exposures to counterparties.
12.1.2 The use of CCR mitigating measures can reduce CCR
exposures but may at the same time create other risks such as liquidity and legal risks as discussed in more detail below. AIs therefore should consider carefully the pros and cons of each type of CCR mitigating measure and deploy appropriate policies and controls accordingly to manage the associated risks.
12.1.3 AIs should refer to CR-G-14 “Non-centrally Cleared
OTC Derivatives Transactions – Margin and Other Risk Mitigation Standards” for detailed guidance on margin requirements and risk mitigation standards for non￾centrally cleared OTC derivatives.
12.2 Netting arrangements
12.2.1 The common types of netting used by AIs are payment
netting24 and close-out netting (either across different product classes or within the same product class) 25 which reduces counterparty default risk.
12.2.2 Netting arrangements, particularly close-out netting, are
subject to legal risk in cases where a netting

24 Payment netting aims to reduce settlement risk by offsetting all payment obligations between two parties due on the same date and in the same currency to arrive at a single net payment to be paid by one of the parties. 25 Close-out netting is an arrangement which allows simultaneous and immediate terminations of all relevant contracts with a counterparty upon occurrence of one or more of the events of default defined under the netting arrangement. Amounts owed to the counterparty will be offset with those owed by the counterparty to arrive at a net obligation of, or claim on, the counterparty.

Supervisory Policy Manual
Management arrangement cannot be legally enforced in a particular jurisdiction. AIs should have adequate policies, procedures and controls to ensure that the netting arrangements are effective and legally enforceable. For example, when negotiating a netting agreement, an AI should ensure that the agreement will provide the non￾defaulting party the right to terminate and close-out in a timely manner all transactions under the agreement, and will allow for prompt liquidation or setoff of collateral, upon an event of default. Moreover, AIs’ systems of internal controls should be able to monitor and control risks associated with netting. Relevant measures include regular legal review to ensure continuing enforceability of the netting agreement, capability of determining, at any time, the net exposure to the counterparty under the netting agreement, and the monitoring and control of roll-off risks26. AIs may refer to the definitions of “valid bilateral netting agreement” and “valid cross-product netting agreement” in §2(1) and §226B of the BCR respectively for recommended control measures.
12.3 Collateral and margining arrangements
12.3.1 Collateral and margining arrangements can reduce an
AI’s counterparty default risk and settlement risk to its counterparties, provided that the collateral / margining arrangements are legally enforceable in all relevant jurisdictions and the AI has an effective collateral management function (see subsection 9.6 above).
12.3.2 AIs should be mindful that collateralization could
increase other risks including— (a) market risk associated with valuation and adverse changes in the market value of collateral when there is delay in receiving collateral or when liquidating existing collateral;

26 Roll-off risk, in relation to CCR measurement, is the risk of failing to capture future exposures that are large in magnitude but short in duration. Roll-off risk also refers to the risk of a sudden material increase in net exposures when short-term contracts that have been netted against longer term contracts either mature, are rescinded or are generally no longer available to offset the longer term contracts.

Supervisory Policy Manual
Management
(b) concentration and liquidity risks in collateral received; (c) legal risk relating to documentation and legal enforceability of the arrangements; (d) credit risk for collateral held by a third party in a manner that is not bankruptcy remote; and (e) operational risk in running a complex collateral management function (see subsection 9.6 above).
12.3.3 For counterparties with outsized positions relative to
market liquidity in a particular segment, AIs should consider collecting a higher initial margin or imposing higher haircuts on the collateral received to reflect the liquidity risk posed by the outsized positions to the counterparties. AIs should also have contingency plans to cater for the failure of their largest market counterparties, including in times of market stress. These plans should include how they would manage the collateral following default and the capabilities to liquidate it in an orderly manner.
12.3.4 For SFTs, AIs should only accept collateral types that
they are able, following a counterparty failure, to (i) hold for a period without breaching relevant laws or regulations; (ii) value; and (iii) manage the associated risks appropriately. Mark-to-market of collateral and lent securities and, where applicable, calls on variation margins, should be conducted at least on a daily basis. Settlement of variation margins should be completed within the market standard settlement period applicable to the type of asset concerned.
12.3.5 AIs should refer to CR-G-7 “Collateral and Guarantees”
for general guidance on collateral management and
section 7 of CR-S-4 “New Share Subscription and
Share Margin Financing” for guidance on collateral management specific to share margining.

Supervisory Policy Manual
Management
12.4 Calculation of collateral margins / haircuts for non-centrally
cleared SFTs
12.4.1 AIs engaging in SFTs should ensure that the
methodologies used by them to calculate margins / haircuts27 for non-centrally cleared SFTs are consistent with the standards set out below where applicable.
12.4.2 The standards are applicable to all non-centrally
cleared SFTs as long as the primary objective of the transactions is to obtain financing 28 . Hence, the following types of SFTs, if their primary objective is to borrow/lend specific securities, are not subject to the standards— (a) securities borrowing/lending where the lender of securities receives cash collateral and that cash collateral is reinvested in accordance with the minimum standards set out in Section 3.1 (Cash collateral reinvestment) of the report Strengthening Oversight and Regulation of Shadow Banking - Policy Framework for Addressing Shadow Banking Risks in Securities Lending and Repos issued by the Financial Stability Board in August 2013; (b) securities borrowing/lending where the lender of securities does not re-use non-cash collateral received; and (c) securities borrowing/lending where the borrower of the securities intends to use the received securities to meet a current or anticipated demand (e.g.

27 If an AI has the right to require the counterparty to provide additional collateral in order to maintain the degree of overcollateralization at the agreed level (i.e. making a margin call) and haircuts will be applied to the market values of the securities delivered by the counterparty for meeting the margin call, the haircuts applicable to the securities are also expected to be determined by using methodologies that are consistent with the standards set out below where applicable. 28 Intra-group transactions between an AI in a banking group and another entity in the same banking group can be excluded from the scope of application of the standards if both the AI and the entity are subject to adequate capital and liquidity regulations on a consolidated basis. To avoid doubt, if the AI enters into a SFT to provide financing to an entity that is not within the banking group to which the AI belongs, the standards are still applicable to the SFT even though the entity is subject to adequate capital and liquidity regulations on a consolidated basis. Adequate capital and liquidity regulations mean capital and liquidity regulations that are consistent with international norms.

Supervisory Policy Manual
Management delivery obligations, customer demand, segregation requirements).
12.4.3 Standards for calculation of haircuts29 on an individual
asset basis
(a) The methodologies should be designed to limit potential procyclical fluctuations in haircuts, that is, to moderate the extent to which the haircuts decline in benign market environments (e.g. when market volatility is low and asset prices are rising) and mitigate the magnitude of the potential increase in volatile markets. (b) Haircuts should be set to cover, at a high level of confidence, the maximum expected decline in market prices of collateral over a conservative liquidation horizon. In particular— (i) the methodologies should not be based on a rolling short window (e.g. two years or less) of recent price data. The maximum price decline used to derive the applicable haircut should be determined using a long time series of price data that cover at least one stress period. If such historical data are either unavailable or unreliable, stress simulations or data for other similar asset types as a proxy (which should also include at least one stress period and with prudent adjustments made as appropriate) should be used; (ii) where feasible, historical bid-ask spreads and pricing uncertainty should also be examined to consider the possibility that stressed market conditions may lead to a widening of bid-ask spreads and a reduction in the market liquidity of a given type of collateral; and

29 If margins are used at individual transaction level, the standards set out in paragraph 12.4.3 will apply to the calculation of margins as they apply to the calculation of haircuts.

Supervisory Policy Manual
Management
(iii) the assumed liquidation horizon before close￾out of a transaction should be conservative, reflecting the expected liquidity or illiquidity of the collateral concerned in stressed market conditions and the relevant market characteristics of the collateral, such as trading volumes and market depth. (c) In addition to the risk of fluctuations in collateral prices (i.e. market risk), other relevant factors should also be taken into account. For example— (i) the risk of liquidating large concentrated positions (liquidation risk); (ii) the “wrong-way risk” between collateral value and counterparty default; (iii) specific characteristics of the collateral concerned, including asset type, issuer creditworthiness, residual maturity, price sensitivity (e.g. modified duration), optionality, complexity of structure, expected liquidity in stressed periods, etc.; (iv) the frequency of collateral valuation and margining; (v) the creditworthiness of, and existing exposures to, the counterparties concerned (i.e. credit considerations relating to counterparties may lead to higher haircuts); (vi) the foreign exchange risk when there is a mismatch in the currency of denomination between the collateral and the exposure to a counterparty (e.g. cross-currency repos) (in such case, the historical volatility (including in stress periods) of the exchange rate for the relevant currency pair should be used to determine additional haircut required); and

Supervisory Policy Manual
Management
(vii) the correlation between securities accepted as collateral and securities loaned in SFTs, where relevant.
12.4.4 Additional guidance for methodologies which calculate
margins on a portfolio basis (where the portfolio may include long and short positions in securities and related derivative contracts) In addition to the standards set out in paragraph 12.4.3— (a) the methodologies should not be procyclical and should not lead to an automatic decline in margin requirements as the prices of assets in the portfolio increase or as the (actual or implied) volatility of asset prices in the portfolio decreases; (b) the following factors should also be considered when setting margin requirements for different counterparties and portfolios:
(i) the market risk of the portfolio concerned (as measured by, for example, the change in the value of the portfolio if market indices rise or fall by defined percentages); (ii) portfolio concentration, for example, by geographies, economic sectors and individual issuers; (iii) illiquidity of the portfolio (e.g. when positions are concentrated or large relative to either the outstanding amount or the average trading volume of the assets under the SFTs in the market); and (iv) risks arising from non-correlated price and spread relationships between lent securities and the assets in the collateral portfolio; (c) the methodologies should include robust stress testing of margin requirements against a range of historical and hypothetical stress scenarios. The

Supervisory Policy Manual
Management stress scenarios should be designed or selected with due consideration to the particular characteristics of the portfolios being stress-tested. Regular backtesting of margins should also be carried out; and (d) there should be appropriate and well-documented internal processes and procedures in place for margin calculation, which should be based on reliable prices and parameters and include robust controls to identify any weaknesses or deficiencies in the margin methodologies.
12.5 Portfolio compression
12.5.1 AIs are encouraged to reduce their CCR exposure and
other risks (e.g. operational risk) associated with a portfolio of OTC derivatives by terminating wholly or partially those derivative contracts which have substantially similar economic terms. In this connection, an AI should establish and implement policies and procedures that at a minimum meet the standards set out in subsections 2.2 and 4.5 of CR-G-14 “Non￾centrally Cleared OTC Derivatives Transactions – Margin and Other Risk Mitigation Standards”.
12.6 CVA hedging
12.6.1 Large and complex AIs should actively manage their
CVA risk. This may include CVA hedging which incorporates hedges of the market risk factors that drive the underlying counterparty default risk exposures and hedges of the credit spreads of counterparties. CVA hedging is a challenging task and could be highly complex as it involves a large number of variables which are correlated and some of them may be impossible to hedge. Additional market risk may also arise through the mark-to-market volatility of the hedging instruments used. Hence, AIs that are hedging, or intent to hedge, their CVA risk should design their hedging strategies carefully with sufficient understanding of the limitations involved, and assess the effectiveness of hedges regularly.

Supervisory Policy Manual
Management
12.7 Other forms of CCR mitigation
12.7.1 AIs may mitigate their CCR exposures by purchasing
credit protection in the form of credit derivatives or guarantees from a third party with stronger financial standing. However, concentration risk and wrong-way risk may be created.
12.7.2 For long-dated derivative contracts, AIs may consider
incorporating further risk mitigating measures, such as break clauses (or option-to-terminate) 30 and reset clauses 31 , in the master or bilateral agreements to address the issue of large potential exposure. Other risk mitigating measures include the rights of set-off32 and material-change triggers33, etc.
12.7.3 AIs may mitigate the settlement risk of securities
transactions and FX transactions by means of delivery￾versus-payment and CLS34 respectively. For the latter, AIs may draw reference from section 6 of TA-2 “Foreign Exchange Risk Management” for guidance on the management of settlement risk in FX transactions.
12.8 Central clearing
12.8.1 The CCR mitigating measures mentioned above are
typically used in containing CCR arising from bilateral transactions. CCR can also be mitigated by clearing transactions through a CCP that is subject to regulation

30 A break clause can be mandatory or optional. A mandatory break clause would terminate a transaction on specified future dates prior to the contractual maturity date. An optional break clause is typically bilateral and gives either party the right to terminate a transaction on specified future dates. 31 A reset clause resets a transaction to be more at-the-money by means of readjusting product￾specific parameters (e.g. the mark-to-market change is exchanged at each reset time in cash) so as to reduce the exposure. 32 In a termination or liquidation, set-off provisions allow obligations to offset each other. Despite the use of master agreements, parties may rely on post close-out set-off rights to net termination amounts attributable to (i) products beyond the scope of those master agreements or (ii) transactions involving non-parties to the master agreements (e.g. affiliates). 33 Material-change triggers convey the right to change the terms of, or to terminate, a contract if a pre￾specified event occurs such as a merger event. 34 CLS was established in 2002 by the private sector to mitigate settlement risk through the provision of multicurrency payment versus payment settlement services.

Supervisory Policy Manual
Management or oversight by a competent authority that implements the Principles for financial market infrastructures issued by the CPSS and the Technical Committee of the IOSCO or comparable rules. In addition to products that are required by laws or regulations to be cleared centrally, AIs are encouraged to make use of central clearing, whenever possible, to mitigate their CCR exposures.
12.8.2 Like other forms of CCR mitigating measures, the use
of central clearing may transform CCR into other risks. For example, centralizing transactions in a few CCPs may create concentration risk and collateral posted by an AI to a clearing member may be at risk in the event of the clearing member’s default or when the clearing member is able to use the collateral to offset the obligations of another defaulting client.
12.8.3 AIs therefore should have an appropriate risk
management framework to cover their activities as clearing members or clients, including assessment of the risks (financial, operational and reputational) that might arise from the activities and of the adequacy of capital (whether internal or regulatory) provided for the associated risks.
13. Independent reviews and audits
13.1 General
13.1.1 The Board and senior management should make use of
independent reviews and audits to ensure the integrity, accuracy and effectiveness of the CCR management system. Such reviews and audits can be conducted by an AI’s internal auditors or independent external parties (e.g. external auditors) that are qualified to do so, and may also take the form of ad hoc reviews on specified areas.

Supervisory Policy Manual
Management
13.2 Coverage of independent reviews and audits
13.2.1 An independent review or audit of the CCR
management system should be conducted regularly (ideally not less than once a year) to cover the activities of both the business units and the units responsible for CCR control, collateral management, and, if applicable, model validation, and, among other things, the following aspects where applicable:
(a) the adequacy of the CCR management system and process and compliance with regulatory requirements (such as those on mandatory clearing and reporting, margin and haircuts for non-centrally cleared transactions, and risk mitigation) applicable to the AI; (b) the organization of the units that perform the functions of CCR control, collateral management, and, if applicable, model validation; (c) the scope of CCR captured by the risk measurement system, the appropriateness of CCR measures adopted, and the integration of such CCR measures into daily risk management; (d) the validation, review and approval processes for models and valuation methodologies used for measuring CCR, including any subsequent material changes to those models and methodologies; (e) the accuracy, completeness, consistency, timeliness, reliability and integrity of data and data sources (including the independence of the data sources) used in the CCR management system; (f) the accuracy and methodologies of valuation and CCR calculations, and the accuracy and appropriateness of model assumptions (e.g. volatility and correlation assumptions); and (g) the integrity of the management information system.

Supervisory Policy Manual
Management
13.2.2 The results of such review or audit, including any issues
and weaknesses identified, should be promptly and directly reported to the Board (or the Audit Committee) and the senior management for early remedial actions, where necessary. ————————— Contents Glossary Home Introduction