Circular 94/3: IOSCO Guidelines on Derivatives Instruments

Brussels, 8 December 1994.

CIRCULAR TO SECURITIES FIRMS
NO 94/3

Ladies and Gentlemen,

In July 1994, the Technical Committee of the International Organization of Securities Commissions (IOSCO) published a document setting out a series of guidelines concerning sound practices in the management and control of risks associated with derivatives activities.

IOSCO, an international organization composed of securities market supervisors, in which our country is represented by the Banking and Finance Commission, wished to highlight, through the publication of this document, the importance that market control authorities attach to sound risk management for the security of securities firms (investment firms) and, more generally, for the stability of the financial market. A similar document, specifically targeting credit institutions, was also published in parallel by the Basel Committee on Banking Supervision.

Follow-up no 1

These reports are addressed respectively to the supervisors of securities markets and credit institutions, with the objective that they widely disseminate recognized management control mechanisms so that they can be assimilated by intermediaries active in derivatives instruments, regardless of their country. Drafted in the form of recommendations, they do not have a binding normative character; each concerned intermediary is invited to evaluate these recommendations in light of the nature and importance of its own activities and its environment.

---

Upon reviewing this document, the Caisse d'intervention noted that while the work performed primarily concerns risks associated with over-the-counter (OTC) traded derivatives, many recommendations clearly apply to the generality of activities involving these instruments, whether traded on or off a regulated market, and thus concern all securities firms active in derivatives.

The Caisse d'intervention has therefore decided:

1. to integrate the IOSCO recommendations into its own reference framework for assessing the adequacy of the organization and internal control of securities firms active in derivatives, and to transmit the original document (in English) as well as a free translation of the recommendations (Part II of the document) to securities firms and their auditor(s), these documents being attached to the present circular;

2. to also emphasize the importance of adequate formalization of the firm's policy regarding its clients' derivatives operations and adequate control of these operations.

Indeed, a lack either in the formalization of the framework for a derivatives operation (absence or insufficiency of a contract), or in client information regarding the characteristics of the instrument, or in the monitoring and control process of operations, can be a source of conflicts and sometimes significant risks for the securities firm.

Generally, the Caisse d'intervention considers in this regard that a derivatives operation for the account of a client can only be accepted by a securities firm within the framework of:

a) a policy defined by the management bodies, determining in particular the nature of authorized operations, their scale, and the level of guarantees to be deposited by the client;

b) a contract with the client informing them of their rights and obligations and providing sufficient information on the nature and importance of risks associated with operations of this nature;

c) an organization ensuring appropriate monitoring of operations, valuation of these operations at market price, and control of the adequacy of margins and margin calls.

Remaining at your disposal for any additional information, we ask you to accept, Ladies and Gentlemen, the expression of our distinguished sentiments.

FREE TRANSLATION OF PART II OF THE IOSCO RECOMMENDATIONS

PART II: RISK MANAGEMENT MECHANISMS

1. THE RISK MANAGEMENT FRAMEWORK

The risk management framework (the rules, procedures, and management mechanisms) supervised by the board of directors or the equivalent management body of the firm must specifically cover over-the-counter (OTC) operations, clearly determine the persons responsible for its implementation, and provide reports to management that are accurate, informative, and timely. All interested persons must be informed of this framework, and it must be reviewed based on changes in the commercial environment and the market.

The board of directors or the equivalent management body of the firm must establish risk management rules and procedures for OTC derivatives operations by integrating them into the firm's overall management policy, and then disseminate them within the firm. These rules and procedures must in particular cover the following points: measurement of market risk and credit risk, including the overall risk position, based on risk tolerance objectives (position limits or capital exposed to risk); criteria for accepting counterparties, strategies, and products (hedging, writing covered options, risk management, taking positions, and other related legal risks); risk monitoring procedures and deviation notification criteria; personnel policy (particularly regarding competence, training, and remuneration); the separation of trading and risk management functions; the establishment of management and verification mechanisms for accounts, traders, personnel, and operational systems.

This framework should enable two-way communication between the board of directors and the persons responsible for implementing the rules established by the board.

2. DERIVATIVES POWERS

Powers regarding derivatives should be distributed subject to the ultimate supervision of the board of directors.

2. INDEPENDENT MARKET RISK MANAGEMENT

Management mechanisms must provide for independent market risk management within the firm in order to develop risk limit rules and monitor their application, to review and approve pricing models and valuation systems (including market-price-based valuation mechanisms) used by front office and back office personnel, to re-evaluate these systems as needed, to monitor significant variations in volatilities, and to conduct stress testing.

Management mechanisms must address the following elements: stress scenarios, confidence levels, credit assumptions, and market risk measurement methodologies; separation of back office functions, accounting, and regulatory compliance from the trading function; rules concerning risks and integration of accounting systems. Stress tests should verify the consequences of significant price movements on correlations and other risk assumptions.

3. INDEPENDENT CREDIT RISK MANAGEMENT

Management mechanisms must provide for independent credit risk management within the firm in order to establish credit risk position measurement standards, set credit limits and monitor compliance, and to review leverage, concentration, and risk reduction arrangements.

Controls must address the following elements: risk appetite, credit quality, degree of concentration, use of credit enhancements, measurement methodologies, and the separation of sales surveillance from exposure surveillance.

3. Controls must also address the risk related to failure to deliver or termination provisions, as applicable.

4. TECHNICAL COMPETENCE AND RESOURCES

Given the complexity of derivatives products and their rapid evolution, firms should dedicate sufficient resources to all aspects of risk management mechanisms, including back office systems, accounting, and surveillance. Firms should also make all necessary efforts to ensure that, at all levels of the firm, as well among traders and risk management personnel, there is sufficient knowledge of market developments to correctly assess and manage risks.

5. RISK REDUCTION TECHNIQUES

Firms should employ appropriate risk reduction techniques, including master agreements, netting agreements, the provision of collateral, and third-party credit enhancements, including letters of credit and guarantees. Firms should also examine risk reduction techniques to address operational risk, including an emergency plan.

Controls should address credit enhancements from the perspective of risk position and examine the use of master agreements to reduce documentation risk and to increase the ability to assign or otherwise unwind transactions. The legal capacity of counterparties to enter into transactions and the legal value of netting agreements must also be assessed.

6. ASSESSMENTS AND RISK POSITIONS

Firms should have the capacity, both at the firm level and at the group level, to perform an accurate daily assessment of the risk position, using an acceptable pricing method to value positions at market price and to identify concentrations.

Potential credit and market risk positions must also be calculated using appropriate methodologies. Risk positions may be netted provided that netting agreements are acceptable and enforceable.

Dynamic portfolios must be valued with sufficient frequency to account for risk positions, taking netting agreements into account.

Simulation results should be compared to actual results, then adjusted based on them.

7. SYSTEMS

Accounting, risk management, and information systems must ensure, within rapid timeframes and satisfactorily, the documentation, processing, confirmation, and approval as needed, and reconciliation of transactions and valuation systems used by the trading floor and back office, global risk assessment (at the firm level), accurate and timely notification to management, and the communication of information to the outside by management. An independent review of systems, internal or external, is required to verify if they function according to plan.

The dynamic nature and complexity of derivatives trading and derivatives portfolios require constant access to accurate and rapid information. Systems must be constantly revised to ensure they allow for the tracking and reporting of financial performance, as well as the implementation of management rules. Significant deficiencies in the design or operation of these systems that could negatively impact the firm's ability to record, process, summarize, or present financial data must be reported. These indications do not aim to define the scope of external financial audits.

6. LIQUIDITY, FINANCING AGREEMENTS, AND FINANCIAL PERFORMANCE

Firms must continuously monitor financial performance, including results, financing needs, resources, and cash flows.

Risk management personnel must take into account operating products and financing agreements in the design and implementation of risk management strategies. The liquidity plan should seek to predict changes in cash flows or financing needs and must provide, as needed, for portfolio rebalancing, increasing collateral, and managing defaults.

OPERATIONAL AND FINANCIAL
RISK MANAGEMENT CONTROL MECHANISMS
FOR OVER-THE-COUNTER DERIVATIVES ACTIVITIES OF REGULATED SECURITIES FIRMS INTERNATIONAL ORGANIZATION OF SECURITIES COMMISSIONS July 1994

Operational and Financial
Risk Management Control Mechanisms for Over-the-Counter Derivatives Activities of Regulated Securities Firms Issued by the Technical Committee of the International Organization of Securities Commissions (IOSCO) July 1994

FOREWORD

In this paper, the Technical Committee of IOSCO sets out a framework of management control mechanisms for regulators of securities firms doing over-the-counter (OTC) derivatives business.1 The purpose of this paper is to provide guidance to securities regulators as to those management control mechanisms which (as appropriate in the context of each regulator’s particular regulatory jurisdiction and approach) they should seek to promote or encourage for use by regulated securities intermediaries. The paper contains a flexible, non-exclusive approach to management controls intended to cooperatively reinforce regulators’ promotion of prudential practices while permitting those practices to continue to evolve.

This paper is being issued at the same time as a similar paper on management controls for derivatives being published by the Basel Committee on Banking Supervision. While the two papers differ in detail, the two Committees share the common objective of promoting sound risk management controls and the papers reflect that securities firms’ and banks’ derivatives activities give rise to similar risks and risk management concerns.

The papers confirm that both Committees attach great importance to prudential risk management on the part of financial institutions. The Committees expect to continue to consult as market and supervisory practices develop.

1 This paper was prepared by Working Party No. 3 of the Technical Committee of IOSCO. The members of the Working Party are set out in Appendix C.

PART 1 BACKGROUND

OTC Derivatives and Risk

1. Derivatives are financial instruments whose values are derived from, and reflect changes in, the prices of the underlying products. They are designed to facilitate the transfer and isolation of risk and may be used for both risk transference and investment purposes. As such, they play a valuable role for users of the marketplace. However, they also may increase risk. In view of the rapid growth of OTC derivatives business, numerous international groups and regulatory agencies have studied the risks arising from over-the-counter (“OTC”) derivatives trading.2 These risks include:

• Credit risk - the risk that a counterparty will fail to perform an obligation owed to the firm;
• Market risk - the risk that movements in prices or values will result in loss for the firm;
• Liquidity risk - the risk that a lack of counterparties will leave a firm unable to liquidate or offset a position (or unable to do so at or near the previous market price);
• Settlement risk - the risk that a firm will not receive funds or instruments from its counterparty at the expected time;
• Operations risk - the risk that a firm will suffer loss as a result of human error or deficiencies in systems or controls;
• Legal risk - the risk that a firm will suffer loss as a result of contracts being unenforceable or inadequately documented.

Such risks are not unique to OTC derivatives transactions, but are of special concern due to the volume, scope, and variety of OTC transactions, the degree of interrelatedness of participants, the opaqueness and uncertain liquidity of OTC “markets”, and the complexity of and potential leverage in such instruments.

Although it is possible to unbundle the risks of complex instruments into simpler elements, evolving portfolio and pricing technologies are permitting the engineering of increasingly complex financial instruments which have risk profiles that are more difficult to analyze than simpler, one-dimensional financial products. The financial risks of such complex instruments must be carefully assessed as a weakness at one market participant can have ramifications elsewhere in the system.

Importance of Management Controls

3. It is now generally acknowledged by financial services regulators, financial services providers and corporate users alike, that a key component of a robust framework for the management of the risks attaching to OTC derivatives business is a strong structure of risk management controls within firms active in this business.

4. The Technical Committee recognizes that market forces can provide significant incentives for firms to develop effective operational and financial risk control mechanisms. In order to safeguard their own position, firms may well terminate or restrict activities with market participants as to which there may be doubts as to the adequacy of their management controls. Moreover, a firm’s own commercial interests are likely to ensure that it checks that a counterparty (a) has the power to enter into a proposed transaction, (b) is represented by an officer with actual or ostensible authority, (c) is creditworthy, and (d) has access to appropriate payment systems.

5. Nonetheless, market forces may also lead firms to ignore or under-estimate risks, including those arising from known control deficiencies, where commercial pressures create an impetus towards entering into certain transactions, including innovative transactions. Furthermore, even the beneficial effects of market forces on controls are achieved by an evolutionary process and so may not address regulatory concerns sufficiently quickly or generally. The Technical Committee believes that the achievement of adequate operational and financial risk control mechanisms cannot be left solely to the influence of market forces.

6. The Technical Committee accordingly is publishing this paper by way of guidance to securities regulators (including self-regulators), intermediaries, and examiners of intermediaries as to the kinds of controls and operational practices that need to be considered in the development of a strong risk management structure. Although not directed at end-users, this guidance will nonetheless provide a reference point concerning procedures and controls that also may be relevant to effective risk management by end-users. Given the ease with which derivatives cross borders, and the degree to which OTC derivatives business is transnational, the Technical Committee considers that the articulation of this guidance on a transnational basis is particularly appropriate.

7. In developing this guidance in the context of OTC derivatives business, the Technical Committee recognizes that much of the guidance is likely to be of general application to the effective management by a firm of all of its risks. As a consequence, risk management control mechanisms for OTC derivatives should be integrated within a firm’s overall risk management framework.

The Technical Committee also recognizes that strong management controls are only one element of the management of financial exposures. In particular, they are not a substitute for adequate capital.

9. Part II of this paper identifies a number of specific management control mechanisms. These are nonexclusive. The control structure that should be established, and the practices that should apply, in the case of any particular institution must be appropriate to that institution relative to the scale, the risk profile and the complexity of its OTC derivatives activities. Accordingly, additional or different controls may be of importance in particular situations. The mechanisms are intended to form a framework within which regulators, self-regulators and firms may design, subject to national consultation or otherwise, more specific risk management practices and procedures as necessary and appropriate to address regulatory or managerial needs in a specific context.

10. Therefore, this document takes the form of guidance rather than normative standards. This reflects the view that:

• the structures, size and resources, and the business volume, diversity and complexity, of firms active in OTC derivatives business differ sufficiently that generically specified controls would not be adequately tailored to the environment in which they are likely to operate;
• a prescriptive approach may inadvertently not address significant risk at some firms or cause other firms to waste resources on operating controls which they do not need;
• a prescriptive approach may inadvertently hinder the market development of sophisticated control practices, which are constantly evolving;
• a prescriptive approach may not take adequate account of juridical differences or differences in the allocation of regulatory authority among national regulators;
• a non-prescriptive approach enables regulators to encourage individualized solutions to the desired objectives of management control mechanisms and to balance customer and systemic protection with the need to avoid impeding commercial activity; and
• a non-prescriptive approach, which establishes internationally agreed operational and financial risk management control objectives, may, if widely and publicly adopted by regulators and prominent firms, raise the consciousness of and otherwise influence non-regulated intermediaries and other market participants, as well as unregulated commercial end-users.

11. Although this paper takes the form of guidance, the Technical Committee attaches
    great importance to the achievement in practice of sound risk management controls.
    Individual regulators, therefore, need to explore the various means whereby they can promote high standards and the ways in which they can be given confidence that such high standards are in place and are being applied in practice.
12. The Technical Committee recognizes that there are a number of different possible
    regulatory approaches to the achievement by firms of satisfactory operational and financial control mechanisms. A number of options are briefly discussed in
    Appendix 6. Often, it will be appropriate to use a combination of approaches.
    Given variations in national regulatory styles and responsibilities, the Technical Committee does not envisage a common regulatory approach to achieving the objectives of the mechanisms. However, the Technical Committee, collectively, does believe that the mechanisms are important elements of an appropriate risk management framework.
13. In developing this guidance, the Technical Committee has been working in parallel
    with the Basle Committee on Banking Supervision, which also has been developing risk management guidelines for derivatives. The two Committees, while considering 7 it appropriate to examine their own needs in the first instance, have kept informal contact on their respective projects. There are some differences of perspective deriving from differences in the overall supervisory context of banks and non-banks, and some traditional differences of supervisory style and technique. However, it is apparent that both bank and securities supervisors believe that strong management controls are an essential element of managing OTC derivatives risk.

PART I/ 0 RISK MANAGEMENT CONTROL MECHANISMS
7. 0 Framework of Risk Management
.
The framework of risk management policies and procedures and management controls overseen by the board of directors or equivalent management body of the firm should specifically cover derivatives activity, clearly establish responsibility for its implementation, and provide for accurate, informative and timely reporting to management. This framework should be communicated to all concerned and should be reviewed as business and market circumstances change. The firm’s board of directors or other equivalent body should establish and communicate risk management policies and procedures for OTC derivatives activities that are integrated with the firm’s overall management policies. Such policies and procedures should address the measurement of market risk and credit risk including aggregate exposures against risk tolerance objectives (position limits or capital at risk); acceptability criteria for counterparties, strategies and products (hedging, covered writing, risk management, position taking and related legal risks); risk monitoring procedures and exception reporting criteria; personnel policies (including expertise, training and compensation policies); the separation of trading and risk management functions; and the establishment of management controls and checks over accounts, traders, operational staff and systems.

The framework should provide for two-way communication between the board and persons responsible for implementing board policies. Delineation of derivatives authority should be without prejudice to ultimate board supervisory responsibility.
2. 0 Independent Market Risk Management
Management controls should provide for independent market risk management at the firm to develop and monitor the application of risk limit policies, to review and approve pricing models and valuation systems (including mark-to-market mechanisms) for use by front and back office staff, to re-assess such systems from time to time as appropriate, to monitor for significant variances in the volatilities, and to carry out stress simulations. Controls should address stress scenarios, confidence levels, credit assumptions and market risk measurement methodologies, separation of back office, accounting and compliance functions from trading, risk policies and integration of accounting systems. Stress tests should test the consequences of severe price moves and changes in market behavior, including changes in correlations and other risk assumptions.

3. 0 Independent Credit Risk Management
   .
   Management controls should provide for independent credit risk management at the firm to consider credit exposure measurement standards, set and monitor credit limits, and to review leverage, concentration and risk reduction arrangements. Appetite for risk, quality of credits, level of concentration, reliance on credit enhancements, measurement methodologies and separation of sales supervision from exposure supervision should be subject to controls. Controls also should address the risk of failure to deliver or of termination provisions, as appropriate.
4. 0 In-House Expertise and Resources
   ,
   In view of the speed of evolution and complexity of derivatives products, firms should devote adequate resources to all aspects of risk management controls, including back office systems and accounting and supervision. Firms also should make every effort to ensure that knowledge at all levels of the firm, and of traders and risk managers is adequate in terms of market developments for the appropriate assessment and management of risks.
5. 0 Risk Reduction Techniques
   Firms should as appropriate use risk reduction techniques such as master agreements, netting arrangements, collateralization of transactions and third

party credit enhancements, including letters of credit and guarantees. firms also should consider risk reduction techniques to address operations risk, including contingency planning. Controls should address credit enhancements in terms of exposure and explore the use of master agreements to reduce documentation risk and to increase the potential to assign and/or otherwise unwind transactions. Legal capacity of counterparties to transact and legality of netting arrangements should be evaluated.
6. 0 Valuations and Exposures
firms on both an entity and a group basis should have the capability to make accurate risk valuations daily, using an acceptable pricing methodology to mark-to-market and to identify concentrations. Potential exposures to credit and market risk should also be calculated using appropriate methodologies. Exposuresmay beaggregatedprovidednettingarrangements are acceptable and enforceable. Arrangements should be made to value dynamic portfolios sufficiently frequently to address exposures taking into account legal netting arrangements. Outputs of simulations should be tested against actual results and adjusted accordingly.

7. 0 Systems
   Firms’ accounting risk management and information systems should ensure adequate and timely documenting processin& confirming approving as appropriate, and reconciling of trades and valuation systems used by front and back offices; assessing of risk on a global (firm-wide) basis; accurate and timely reporting to management; and external reporting by management. Internal or external independent systems reviews should be used to verify that such systems are operating as designed. The complexity and dynamic nature of derivatives trading activity and portfolios require that accurate and timely information is always available. Systems must be kept constantly under review to be certain that they permit tracking and reporting financial performance and effectuating management policies. Significant deficiencies in the design or operation of the systems that could adversely affect the entity’s ability to record, process, summarize, and report financial data should be reported upon. This is not intended to define the scope of external financial audits.

8. 0 liquidity, Funding Arrangements and Financial Performance
   Firms need to monitor on a continuing basis financial performance, including profit and los, funding requirements and sources and cash flows. Risk management personnel need to take account of revenues and the adequacy of funding arrangements in designing and implementing risk management strategies. Liquidity planning should attempt to anticipate changes in cash flow or funding requirements and should accommodate the possible need to rebalance portfolios, augment collateral, and permit the management of defaults.

APPENDIX A 0 OTC DERIVATIVES STUDIES AND
RELATED DOCUMENTS
Risk Management Guidelines for Derivatives, Basle Committee on Bank Supervision (July, 1994).
Detailed Questions About Derivatives, American Institute of Certified Public Accountants (June 15, 1994). financial Derivatives: Actions Needed to Protect the Financial System, United States General Accounting Office (May 1994). Questions and Answers for OCC Bulletin BC-277: Risk Management of Financial Derivatives, U.S. Office of the Comptroller of the Currency (00, (May 10, 1994). OTC Derivatives Oversight, Statement of the Securities and Exchange Commission, the Commodity Futures Trading Commission, and the Securities and Investments Board (March 15, 1994). Guidelines for Operations Practices, The International Swaps and Derivatives Association, Inc. (March 1994). Over-the-Counter Derivatives in Ontario, Ontario Securities Commission Staff Report, 17 OSCB 371 (January 28, 1994).

Memo to the Officer in Charge of Supervision at each Federal Reserve Bank re Evamining Risk Management and Internal Controls for Trading Activities of Banking Organisations, Division of Banking Supervision and Regulation, Board of Governors of the Federal Reserve System (December 20, 1993). Off-BalanceSheet Activities of German Banks, Deutsche Bundesbank Monthly Report (October 1993). OTC Derivative Markets and Their Regulation, The Report of the Commodity Futures ading Commission (October 1993). Risk Management of Financial Derivatives, Banking Circular No. 277, U.S. Office of the Comptroller of the Currency, Administrator of National Banks (October 27, 1993). Derivatives: Practices and Principles, Report prepared by the Global Derivatives Study Group of the Group of Thirty, Washington, D.C. (july 1993). Draft Report on Over-the-Counter Derivatives Markets, Australian Securities Commission (July 1993). Securities Exchange Act Release No. 32256, 58 FR 27466 (May 10, 1993)tU.S. Securities and Exchange Commission concept release on capital treatment of OTC derivatives). Derivatives: Report of an Internal Working Group, Bank of England (April 1993). Internal Control-Integrated Framework, Committee of Sponsoring Organizations (COSOKTreadway Committee) (September 1992).

Report of the Committee on Interbank Netting Schemes of the Central Banks of the Group of Ten Countries, Bank for International Settlements, Bade (November 1990). --

APPENDIX B 0 THE ROLE OF REGULATORS
Individual national regulators will need to determine how best to cause firms subject to their regulatory jurisdiction to develop control policies and procedures to meet the performance objectives set forth in this paper. Regulators may wish to consult further with appropriate industry groups for this purpose. with respect to regulated entities, a number of approaches to identifying appropriate management control mechanisms and ensuring that they are effectuated in practice are identified and briefly discussed below. A. 0 Adopt performance or design standards. Where they have appropriate jurisdiction, regulators could promulgate regulations setting performance or design standards. Regulators could mandate that firms engaging in OTC business have in place a system of operational and financial risk management controls which addresses the issues and meets the objectives specified in Part II above. Regulators could require report by self-audit or third-party audit of material inadequacies or deficiencies in such controls on a periodic basis & a condition that could inhibit the completion of transactions or result in a failure of an accounting or riskmanagement system). a E. below. The appropriate level of detail required to be specified in a system is a matter for discussion. Regardless of the specificity of the policies adopted, the need for management to articulate its system and policies should have a beneficial effect. In particular, such a review should cause management to focus on

potential risks and benefits of derivatives as a component of financial and funding activities in general.
Regulators could also consider devising new regulations specifically tailored to OTC derivatives activity. For example, regulators could enact rules expressly requiring regulated firms to supervise their OTC derivatives traders and risk managers and to obtain and maintain timely specified documentation and records of derivatives transactions & similar to underwriting logs, deal sheets, confirmations, etc.) or to follow other specific risk reduction methodologies & use master agreements, and document credit analyses). B. 0 Interpret existing rules to subsume management control requirements for OTC business. Many regulators currently measure compliance with certain supervisory or other prudential requirements by evaluating management control mechanisms of firms. For example, many jurisdictions interpret their supervisory requirements for regulated entities to apply to accounts, systems, and personnel and to reach up the chain of command to the person with the ultimate authority to hire or fire. Under this reading, certain members of the board of directors may be cited for supervisory failures relative to firm operational controls. Effective management controls generally are considered essential to meeting such supervision requirements. Other types of requirements could also be met through the implementation of management controls. For example, certain fiduciary requirements in some

jurisdictions preclude an intermediary from acting in conflictwith the interests of its customers. Further, most regulators impose various recordkeeping requirements on regulatees and/or require minimum capital levels and reporting of shortfalls immediately. This necessitates systems to produce the desired reports. These rules are not patticularized to OTC risks and, in some cases, would have to be extended by interpretation to cover such risks. Some jurisdictions also regard corporate board members and certain types of end-user management & pension funds) as fiduciaries and impose duties of care and financial responsibility or prudence that may need to beaddressed through adequate management and operational controls.
C. 0 Collect information on risks and risk management controls and
policies.
Rules also could be adopted which authorize regulators to collect specified . information on risks related to OTC derivatives activity undertaken in affiliates of regulated entities and on risk management policies of the regulated firms. Such rules have the beneficial effect of requiring risk analyses to be undertaken within firms by officers responsible for financial reports. In jurisdictions which require consolidated supervision, guidance could be issued as to how to achieve group controls.

D. 0 Require assessment of counterparties.
Regulators could mandate that regulated intermediaries inquire beforeentering into transactions with potential counterparties as to certain specified management controls h marking-to-market and documentation). Regulators also could consider making inquiries into the existence of management controls for representations as to their existence) relevant to socalled “suitability,” “know your customer,” “authority” or “access” determinations made by persons marketing OTC derivatives. E. 0 Require management assessments and regulatory examinations or auditor’s reports on controls - either by internal independent audit staffs or third-party auditors. Regulators could periodically examine firms’ practices and comment on controls in place or could issue rules or guidance compliance with which is established through routine audits conducted by regulators or relevant self- - regulating organisations (“SROs”). Regulators also could require management of regulated firms periodically to assess and to document their implementation of the firm’s risk management policies, and require the submission of reports on those policies (by independent internal audit staffs, or independent third parties) to regulators.

The discipline of self-assessment and independent auditing and reporting to regulators could be expected to heighten the attention of all levels of management and the board of directors as to the importance of such controls. A number of models for reporting to regulators by auditors and reporting accountants already exist. In addition to routine reporting arising from audits or specific regulatory assignments, regulators may wish to consider requiring ad hoc reporting by auditors of matters which become known to them in the course of their work. 2’ F. 0 Require Self-Regulatory Organization oversight by reference to industry standards. In addition to (or as an alternative to) rulemaking aimed directly at market participants, regulators may consider requiring industry SROs to adopt rules directing their members to employ specific management control mechanisms. Regulators also may wish to encourage SROs to implement procedures for ‘I SRO or other third-party review of individual firms’ management controls. Separately, SROs may seek to develop innovative means of ensuring their members meet management control objectives. Y See. e.g., E.C. Post-BCCI Directive; GAAS Guide, at 7.37, ouoting Statement of Auditing Standards - 60 (Communication of Internal Control Structure Related Matters Noted in an Audit); and Bulletin B., Mexican GAA.5.

C. 0 Require pre-clearance of systems and controls as part of fitness
determinations.
Controls could be reviewed as part of fitness determinations and qualifications to engage in specific types of business. H. 0 Limit OTC dealer activity to regulated intermediaries. In order to encourage appropriate use of management policies related to market, credit and other risks, regulators could require OTC dealing activity to be undertaken solely by regulated intermediaries, thus causing existing supervisory rules to pertain to all derivatives dealers. This approach is complicated by the fact that in most jurisdictions the intermediaries engaged in OTC business are subject to various regulatory regimes. For example, such activities could be conducted in a bank, a securities firm, a commodities intermediary firm, a pension fund or collective investment vehicle, or by a merchant or trader. To the extent activity is undertaken in an entity engaging in “dealing” (that is, “twc-way” market making) activities that are not regulated two questions arise: which regulator and which institutional model should be followed. This also raises questions about regulatory convergence between differently regulated institutions. Some jurisdictions consider it unlikely that this is a viable alternative.

1. 0 Nonregulated Market Participants
   While regulators cannot impose management control requirements directly over nonregulated entities, regulators may be able to influence the acceptance of best practice. Nonregulated firms do have significant economic incentives adequately to supervise employees and effectively to manage their derivatives risk. Regulators nevertheless could promote best practice by all potential counterparties by encouraging regulated intermediaries to use contractual or documentation practices that address certain of their customers’ management control mechanisms such as marking-to-market or specified documentation.

.
APPENDIX C 0 IOSCO WORKING PARTY NO. 3
PARTICIPANTS long Kong aly lexico etherlands lin witzerland nited Kingdom .S.A. rustralia :anada ‘lance Peter Clarke Rozanne Reszel Didier Davydoff Fran@s Champamaud Emmanuel Car&e hdrakn Securities Commission Canadian Investor Protection Fund Commission des Op6raUons de Bourse Commission Bancaire ier--lny Dr. Joachim Henke Werner Gehrtng Dr. Uwe Neumann Bundesministerium der Finanzen Deutsche Bundesbank Bundesaufsichtsamt fur das Kreditwesen Siva Singham Dr. M. Antonietta Scopelltti Carlo Eiancheri Securities end Futures Commission Commissione Nazionale per la Societa e la Eorsa Toru Shikfbu Kenta lchikawa Ministry of Finance Miguel Can0 Car-Jan Dasselaar Ester Martinez Cuesta R. Martinez-Pardo del Valle Comision National de Valores Securities Board of the Netherlands Comision National del Mercado de Valores Lennart Tomtensson Financial Supervisory Hans Bobq Authority Daniel Zuberbtihler Urs BrtIgger Swiss Federal Banking Commission Swiss Admission Board Martin Vile, Chairman Jane Coakley Peter Andrews Tony Smfth Securities and Investments Board Michael Macchiaroli Harry Melamed Andrea Corcoran Jane Kang Securities and Exchange Commission Commodity Futures Trading Commission