CFTC Staff Advisory 16-24: Risk Management Program Requirements for Futures Commission Merchants

Audience: Futures Commission Merchants
Topic: Risk Management Programs
I. Introduction and Background
On November 14, 2013, the Commodity Futures Trading Commission (“Commission”) issued rules for enhancing protections for customers of futures commission merchants (“FCMs” or “firms”).1 These customer protection rules include Regulation 1.11, which requires an FCM that accepts customer assets or extends credit to customers in lieu thereof, to establish a risk management program (“RMP”). 2 The RMP must be approved by the FCM’s governing body and submitted to the Commission and the FCM’s designated self-regulatory organization.3 As
part of the RMP, an FCM must establish and maintain a risk management unit (“RMU”) that
administers the RMP, is independent from the FCM’s business unit (“BU”) and reports directly to senior management of the FCM. 4 The Division of Swap Dealer and Intermediary Oversight (“DSIO” or “Division”) is issuing this advisory to (1) remind FCMs of the RMP regulatory requirements, and (2) share observed examples of practices in implementing an effective RMP. While the observed practices described herein may be useful to FCMs, this advisory does not mandate a specific approach. Each FCM should evaluate whether implementing any of these practices is appropriate based on its particular business and risk profile. 1 Enhancing Protections Afforded Customers and Customer Funds Held by Futures Commission Merchants and Derivatives Clearing Organizations, 78 Fed. Reg. 68506 (Nov. 14, 2013). Swap dealers and major swap participants are subject to similar requirements under Regulation 23.600. This advisory only addresses requirements of Regulation 1.11. DSIO may provide future guidance regarding Regulation 23.600. 2 17 C.F.R. §§ 1.11(a) and (c)(1). While the RMP is limited to the registered FCM’s activities requiring registration, the RMP must also account for risks posed by affiliates, all lines of business of the FCM, and all other trading activity engaged in by the FCM. See 17 C.F.R. § 1.11(e)(ii). 3 17 C.F.R. §§ 1.11(c)(3) and (5). 4 17 C.F.R. § 1.11(d). See 17 C.F.R. § 1.11(b)(1) for the definition of the term “business unit.” DIVISION OF SWAP DEALER AND INTERMEDIARY OVERSIGHT STAFF ADVISORY CFTC Staff Advisory No. 16-24 Advisory Other Written Communication March 2, 2016 Division of Swap Dealer and Intermediary Oversight

2
II. Certain Regulation 1.11 Provisions
Regulation 1.11(d) – Risk Management Unit
Pursuant to Regulation 1.11(d), each FCM that accepts customer assets or extends credit in lieu thereof must establish and maintain a RMU with sufficient authority, qualified personnel, and financial, operational and other resources to carry out the RMP. To demonstrate compliance with these requirements, an FCM should be able to identify all personnel in the firm’s RMU.5 DSIO has observed that many FCMs also demonstrate compliance with this requirement by developing an organizational chart identifying all members of the RMU, their respective risk management duties, and their reporting lines within the RMU.

An FCM may also want to consider describing the following in its RMP:

1. All committees responsible for risk management and the supervisory reporting lines of
   those committees.
2. How the independence of the RMU from the BU is maintained.
3. How frequently the FCM will consider the sufficiency of the RMU’s resources.
   Regulation 1.11(e) – Elements of the Risk Management Program Regulation 1.11(e) requires the RMP to account for market, credit, liquidity, foreign currency, legal, operational, settlement, segregation, technological, capital, and any other applicable risks of the FCM. The firm’s RMP should include a clear description of each applicable risk as it relates to the firm’s specific business activities. In addition, the RMP should identify the personnel or department responsible for managing each applicable risk.6

Many RMPs reviewed also include provisions addressing the following topics:

1. An overview of the risk framework for the FCM.
2. A description of risk tolerance limits, the methodology used to determine the risk
   tolerance limits for each risk type, and procedures for review and approval quarterly by senior management and annually by the governing body.
3. Written policies and procedures for risk tolerance limit exceptions addressing: (i) what
   exceptions are permitted; (ii) how exceptions are granted; (iii) who has the authority to grant exceptions; and (iv) how exception approvals are documented. 5 78 Fed. Reg. at 68519. 6 As the Commission has previously stated, Regulation 1.11 “does not require a registrant’s risk management unit to be a formal division in the registrant’s organizational structure,” and therefore the RMU may span several departments within a registrant. Id.

3
4. Written policies and procedures for risk limit breaches addressing: (i) what is considered
a breach; (ii) the procedures for identifying and addressing breaches; and (iii) the escalation and review process for any breach.
5. The procedures for monitoring applicable risks.
6. A description of the training program addressing segregation requirements, notice
requirements under Regulation 1.12 and procedures for reporting suspected limit breaches; identification of the unit responsible for implementing the training program; and the procedures for ensuring that training is completed in a timely manner.
7. A description of technical systems utilized (e.g., trading platforms, risk management
software, back office software, etc.) and how those systems interface for risk management purposes.
8. A description of the FCM’s capital requirements and liquidity needs and the potential
sources of funds available to meet those needs and remain in compliance with the capital requirements. Regarding risk tolerance limits, DSIO staff has observed that some FCMs use multiple limit thresholds for some or all risks. For example, intermediate limits serve as an early warning system that prompts review by the RMU. Higher limits are also established such that a breach thereof indicates a risk that may have a material impact on the FCM and may require escalation to senior management or the governing body. Finally, FCMs are reminded that Regulation 1.11(e) requires the RMP to take into account risks posed by affiliates, all lines of business of the FCM, and all other trading activity of the FCM and must describe with sufficient detail how the RMP has been integrated into risk management at the consolidated entity level. Regulation 1.11(e)(2) – Periodic Risk Exposure Reports DSIO staff observed that some quarterly risk exposure reports (“RERs”) did not address all risk exposures identified in the applicable RMPs. Some FCMs have indicated that certain of those risks are sometimes covered in separate reports provided to senior management and to the FCMs’ governing bodies, but not to the Commission. The Division expects each RER to address all of the applicable risk exposures of the FCM. Risk exposures discussed in multiple reports must be consolidated into the quarterly RER and delivered to the senior management, governing body and Commission. In addition, each RER must describe changes in the RMP policies and procedures as required by Regulation 1.11(e)(2). The Division observed the following in some RERs that FCMs may wish to consider including to provide greater context for the information in their RERs:

1. Disclose the actual risk exposures during the period for each risk metric rather than
   providing only limit breach information. For example, the maximum, minimum, mean, median, and standard deviation for risk exposures could be provided or shown graphically over the course of the quarter.

4
2. With respect to appropriate risks such as capital, liquidity, market, and segregation risks,
discuss the overall trend for the quarter, a prediction of future trends (i.e., improving, stable, deteriorating), and discuss historical trends such as quarter-by-quarter comparisons or a rolling 24 month analysis.
3. Describe how the stress testing undertaken during the quarter: (i) is consistent with the
firm’s risk and business strategy; (ii) takes into account limit moves over multiple days; and (iii) includes hypothetical worst case scenarios that could result from world or market events.
4. Include the date the RER was provided to senior management.
5. Define the material terms, abbreviations, methodologies, and metrics included in the
RER.
Regulation 1.11(f) – Review and Testing of the RMP The annual review of the RMP required under regulation 1.11(f) can be performed either by internal audit staff that are independent of the BU or by a qualified third party audit service that reports its findings to staff that are independent of the BU. The final report regarding the annual RMP review should indicate who performed the review. Regardless of who conducts the annual review, an FCM must ensure that the review analyzes the FCM’s adherence to the RMP and the RMP’s effectiveness, and provides any necessary recommendations for RMP modifications. Regulation 1.11(g) – Distribution of the RMP Regulation 1.11(g) requires an FCM to distribute its RMP to relevant supervisory personnel and keep records of its distribution. The Division observed two practices FCMs may wish to consider implementing in order to better evidence compliance with this regulation:

1. Describe in the RMP the procedures for distributing, and tracking the distribution of,
   copies of the RMP.
2. Identify in the RMP the personnel or department responsible for the maintenance and
   distribution of the RMP.