COMMISSION BANCAIRE ET FINANCIERE
Prudential Supervision
Brussels, 1 September 1994.
CIRCULAR NO 94/3 TO CREDIT INSTITUTIONS

Madam,
Sir,

On 1 July 1994, the Basel Committee on Banking Supervision issued a text (“Risk management guidelines for derivatives”) containing guidelines for the sound management by credit institutions of risks associated with derivatives operations.

Upon examining this text, the Banking and Financial Commission noted that the Basel Committee's guidelines largely correspond to the standards it has previously imposed on credit institutions established in Belgium regarding the internal organization and control of operations on money and foreign exchange markets (cf. circulars of 17 April 1990 and 30 November 1992) as well as internal audit (circular of 6 April 1987), and that these guidelines constitute a useful complement to the aforementioned standards.

The Commission therefore aligns itself with the content of the Basel Committee's document, of which you will find the original English version and a French translation in the annex.

You will note that the subject matter of the Commission's current standards is broader than that of the Basel document, the latter concerning specifically derivatives operations, whereas the Commission's standards aim at both traditional operations and derivatives products.

However, given the current complexity of derivatives products, the Basel document also addresses, compared to the Commission's current standards, new points deserving particular attention. Thus, it notably highlights the importance of the following points:

• the presence of a risk management function exercised independently within the credit institution; this function includes the measurement, control, and monitoring of risks, and must be ensured by sufficiently qualified and trained personnel in derivatives products (points II.8 and II.9);
• a consolidated approach to risk monitoring (points III.2 and III.4);
• the implementation, where possible, of “real-time” monitoring for certain types of risks (point III.5);
• the existence of contingency plans, defining the procedures and communication lines that senior management will follow in the event of certain problem scenarios (points III.7 and V.19);
• the measurement of market risks, as part of their monitoring, based on market value (concept “value at risk” or similar methods) (point V.9);
• the identification and control of operational and legal risks (points V.16 to V.32).

The Basel document further adds several accents that fall within the extension of existing Commission standards, concerning notably the following points:

• internal policy must specify the risk tolerance thresholds accepted by senior management and clearly delimit the competencies and responsibilities regarding the management of risks associated with operations (point II.1);
• the document clearly indicates the concrete points requiring particular attention before undertaking new derivatives activities (point II.4);
• internal audits must be more intensive and frequent during significant modifications, deficiencies, or significant problems (point IV.2);
• internal audit must notably assess the speed of information transmission to senior management (point IV.3);
• the document formulates concrete suggestions regarding the monitoring of credit risks associated with derivatives (points V.2 to V.7);
• the document emphasizes the need to consider different possible scenarios when monitoring liquidity (point V.13).

The Basel document refers several times to the role of the board of directors of the credit institution. In the Belgian context (cf. Article 26 of the Law of 22 March 1993 on the status and control of credit institutions, as well as the protocols on the autonomy of the banking function), it evidently involves taking into account, where applicable, the respective competencies of the board of directors and the management committee.

The manner and extent to which a credit institution established in Belgium must satisfy the directives of the document depend - as for the compliance with the aforementioned Commission standards already in force - on the volume and nature of its activities in the field of derivatives, as well as on its organizational structures.

The approved auditor(s) of your institution have been invited to report, at the next opportunity, on the measures taken, where applicable, by your institution to comply with the aforementioned directives.

Please accept, Madam, Sir, the expression of my sentiments.

AVENUE LOUISE 99 - 1050 BRUSSELS Tel.: (02)535.22.11 . Fax: (02)535.23.23

BANKING AND FINANCIAL COMMISSION P. 2

GUIDELINES FOR THE MANAGEMENT OF RISKS ASSOCIATED WITH DERIVATIVES INSTRUMENTS BASEL COMMITTEE ON BANKING SUPERVISION July 1994

TABLE OF CONTENTS
Page
Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
I.
II.
III.
IV.
V.
Introduction and fundamental principles ......................................................................
Monitoring the risk management process ....................................................................
Internal control .................................................................................................
Senior management ..........................................................................................................
Establishment of the risk management function ..........................................................
The risk management process ..............................................................................
Risk measurement .............................................................................................................
Risk limits .............................................................................................................
Notification .....................................................................................................................
Evaluation and review by management ............................................................................
Internal controls and audits ..........................................................................................
Sound risk management practices for each type of risk ............................................................
Credit risk (including settlement risk) .............................................................................................
Market risk ............................................................................................................
Liquidity risk ........................................... T”“‘. ........................................................
Operational risk ........................................................................................................
Legal risk ..............................................................................................................
1
3
5
7
11
13
13
14
15
16
19

Guidelines for the Management of Risks Associated with Derivatives Instruments

1. In the framework of its constant action to address problems related to the supervision of banks operating internationally, the Basel Committee on Banking Supervision is currently pursuing several initiatives aimed at strengthening the prudential treatment of banking operations on derivatives instruments. One of them consisted of reconsidering the fundamental elements of risk management associated with derivatives products. In 1986, the Committee published a document titled “The management of off-balance sheet exposures of banks from the perspective of banking supervision”, which raised certain questions that it continued to deepen. Following this analysis, the Committee now distributes the attached document; it provides guidance for the sound management of risks associated with derivatives instruments, for the use of supervisory authorities and banking associations. In formulating these guidelines, the Committee took into account the principles followed in member countries as well as the recommendations formulated by the entire profession.

2. The Basel Committee distributes these guidelines to supervisory authorities worldwide, hoping that they will facilitate the continued development of a prudential approach to risk management associated with derivatives products. These officials may, if they wish, transmit this information to institutions under their jurisdiction, either in its integral form or adapted to local specificities. The Committee wishes to emphasize that sound internal risk management practices are essential for the prudent operation of banks and that prudential instruments, such as capital requirements, are not sufficient in themselves. Sound internal risk management is also indispensable to promote the stability of the financial system as a whole.

3. Neither derivatives instruments nor the various risks associated with them constitute a novelty. For some time, institutions have been using futures contracts, financial swaps, and options intensively and incur daily credit, market, liquidity, operational, and legal risks in their more traditional activities. However, the increase in the complexity, diversity, and volume of derivatives products, facilitated by rapid progress in technology and communications, poses growing challenges for the management of these risks. The adoption of sound practices in this regard constitutes an important element in addressing them.

4. The guidelines bring together in a single scheme the procedures currently applied by major international banks. Even if it is possible that this scheme is not faithfully followed by any bank, it could nevertheless serve as a reference for all institutions. The level of applicability of the guidelines depends on the importance and complexity of the institution's derivatives activities.

5. Supervisory authorities should take advantage of these guidelines by reevaluating their own methods and procedures currently used to see how banks manage risks on derivatives instruments. The specific approach adopted by various prudential officials to monitor activities on derivatives products depends on a large number of factors, including the powers conferred upon them by the legal framework, the use of existing control procedures and documents, and the share of external auditors in the exercise of supervision.

6. A significant characteristic of capital markets is the increasing use by major institutions of highly elaborate models as essential instruments for measuring and managing risks. Consequently, supervisory bodies (and external auditors) must ensure they have personnel with sufficient mathematical knowledge to properly understand the problems and must ensure that the reliability of models can be verified independently by external experts.

-2-

I. Introduction and Fundamental Principles

1. Derivatives instruments have taken an increasingly important place worldwide in the risk profile and profitability of banking institutions. In its broad definition, a derivatives product is a financial contract whose value depends on the values of one or more underlying assets or indices. Operations on these products cover a wide range of financial contracts, including futures contracts, forward financial instruments, financial swaps, and options. In addition, other traded products present characteristics of derivatives instruments, such as those associated with options. Although their structures can be, in some cases, quite complex, they can all be categorized into the fundamental categories of options and futures contracts or a combination of these two elements. The use of these fundamental groups in the creation of derivatives instruments allows transferring various financial risks to parties better disposed or prepared to assume or manage them.

2. Contracts on derivatives instruments are traded worldwide, on organized markets and within the framework of over-the-counter (OTC) arrangements. Those concluded on organized markets are usually standardized regarding maturity, amount, and delivery conditions. OTC contracts are “tailor-made” according to the institution's needs and often cover underlying products, instruments, or exchanges that are not offered on any organized market. This document covers both categories of banking activities.

3. Derivatives products are used by banking institutions both as risk management instruments and as sources of revenue. From a management perspective, they allow financial institutions and other participants to identify, isolate, and manage market risks on financial instruments and underlying products separately. Used prudently, they can offer banking executives efficient and valid methods to reduce certain risks through hedging operations. They can also help lower financing costs and increase the yield of certain assets. For a growing number of institutions, activities on these products have become a direct source of revenue within market making, position building, and risk arbitrage functions:

• market making functions involve executing transactions on derivatives products with clients and other market makers, while maintaining a generally balanced portfolio in the hope of earning commissions generated by buyer/seller spreads;
• position building, on the other hand, represents a search for profit by accepting the risk associated with taking positions in anticipation of price changes;
• arbitrageurs also seek to benefit from price variations but essentially focus on profiting from small price differences between similar instruments on different markets.

4. Participants in derivatives markets are generally subdivided into two categories, based primarily on their underlying economic motivations. Final users usually conclude operations of this nature to respond to specific hedging, financing, or position-building objectives within the normal course of their activities. This category includes diverse enterprises including, but not exclusively, a wide range of financial institutions (banks, brokerage firms, and insurance companies), institutional investors (pension funds, mutual funds, and specialized investment companies), and enterprises, local authorities, official and international organizations.

5. Intermediaries, sometimes called “operators,” satisfy the needs of final users by “making markets” in OTC derivatives instruments. In doing so, they hope to realize gains from commissions, buyer/seller spreads, and their own trading positions. Major intermediaries, or derivatives operators, include major banks and brokerage firms worldwide. As intermediaries, banks have always offered their clients foreign exchange and interest rate risk management products and generally consider derivatives instruments as a risk management financial service.

6. The fundamental risks associated with derivatives operations do not constitute a novelty for banking institutions. Generally, these are credit, market, liquidity, operational, and legal risks. As they facilitate the specific isolation and management of these risks, derivatives instruments have the potential to increase the security and solidity of financial institutions and allow a more efficient distribution of financial risks. Given, however, that they also combine these fundamental risks in combinations that can be quite complex, they can also threaten the security and solidity of institutions if they are not clearly understood and properly managed.

7. Recognizing the importance of sound risk management for the effective use of derivatives instruments, the following guidelines are intended to highlight the fundamental elements and basic principles of sound management practices, for both operators and final users of these products. These basic principles include:

8. appropriate monitoring by the board of directors and senior management of institutions;

9. an adequate risk management process involving prudent risk limits, established measurement procedures and information systems, continuous risk monitoring, and frequent reporting to management;

10. detailed internal controls and audit procedures.

II. Monitoring the Risk Management Process

1. According to common practice for most banking activities, an institution should have, in written form, strategies and procedures clearly defining its risk management guidelines for its derivatives operations. At a minimum, these strategies should specify the risk tolerance thresholds determined by the board of directors and clearly delimit the competencies and responsibilities in the management of risks associated with these activities. Personnel operating on derivatives instruments should have a thorough knowledge of all strategies and procedures corresponding to their specific duties.

Board of Directors

2. The board of directors should approve all major strategies relating to the risk management of the entire institution. These strategies, which should include those concerning derivatives products, should be compatible with the broader directions of the enterprise, the level of capital, management experience, and the overall willingness to assume risks. Consequently, directors should be regularly informed of the risks incurred by the institution and periodically evaluate major risk management strategies and procedures, giving particular importance to those defining the institution's tolerance regarding risks associated with these activities. The board of directors should also establish and encourage discussions among its members and senior management, as well as between the latter and other parties, on the risks incurred by the institution and the process of managing them.

3. Senior management should be responsible for ensuring that adequate strategies and procedures exist to execute derivatives operations, both from a long-term perspective and on a daily basis. This task involves ensuring the existence of well-defined responsibilities for risk management, appropriate systems for measuring them, well-structured risk limits, effective internal controls, and a detailed risk notification process.

4. Before undertaking derivatives activities, management should ensure that all appropriate approvals have been obtained and that operational procedures and risk control systems are adequate. Preliminary proposals for the execution of derivatives transactions should include, among other applicable elements:

• a description of the financial products, markets, and operational strategies concerned;
• the resources required to have established and efficient risk management systems and to attract and retain specialists with specific experience in derivatives transactions;

-3-

-6-

• an analysis of the appropriateness of the activities imposed relative to the institution's overall financial situation and level of own funds;
• an analysis of the risks that may arise from these activities;
• the procedures that the bank intends to use to measure, monitor, and control risks;
• the accounting procedures put in place;
• the relevant tax treatment;
• an analysis of any legal restrictions and regulations authorizing such activities.

6. General management must regularly evaluate the procedures put in place for risk management, in order to ensure that they are appropriate and reliable. It must also promote and conduct active discussions with administrators, risk management personnel, and operators regarding risk measurement and management procedures. It must also ensure that derivative activities have sufficient resources and personnel to manage and control risks.

7. From a general policy perspective, remuneration policies - particularly for risk management, control, and general management functions - must be structured in a manner sufficiently independent of the execution of trading activities, thereby avoiding potential incentives for excessive risk-taking that may occur if, for example, salaries are linked too closely to the profitability of derivative operations.

Independence of Risk Management Functions

8. Within the scope authorized by the bank's activities, the risk measurement, monitoring, and control process compatible with established strategies and procedures must be managed independently of the persons carrying out derivative activities, up to the highest levels of the institution. An autonomous system for reporting risk positions to both general management and the board of directors constitutes an important element of this process.

9. Personnel performing independent risk management functions must have a thorough knowledge of the risks associated with all of the bank's derivative activities. Consequently, the remuneration policies for these personnel must be defined adequately in order to attract and retain qualified personnel for the assessment of these risks.

The Risk Management Process

1. A sound risk management process is based on the following main elements:
   a comprehensive approach to risk measurement; a detailed structure of limits, reference criteria, and other parameters used to manage risk-taking; a reliable information system for management control, monitoring, and risk reporting. These elements are of fundamental importance for both derivative instrument activities and others. Furthermore, the underlying risks associated with these activities, such as credit, market, liquidity, operational, and legal risks, do not constitute a novelty for banking establishments, even if their measurement and management may prove more complex. Consequently, the risk management process for derivative operations should be integrated as much as possible into the institution's overall risk management system, using a common conceptual framework. This would allow the establishment to manage its risk positions more effectively, given that the various risks inherent in derivative transactions may sometimes be linked to each other and often fall outside the framework of specific markets.

2. As with all activities involving risk, the risks assumed by an institution on derivative instruments must be fully covered by adequate own fund allocation. The institution must ensure that its own fund situation is sufficiently robust to support all risks associated with derivatives on a fully consolidated basis and that an appropriate level of own funds is maintained in all entities of the group engaged in this activity.

Risk Measurement

3. The system for measuring the various risks on derivatives of an establishment must be both comprehensive and precise. Risk should be measured and consolidated on the broadest possible basis, taking into account the institution's trading and other activities as a whole.

4. If the adoption of a single measurement approach for risk management purposes may not be essential, the institution's procedures must nevertheless allow management to evaluate risk positions on a consolidated basis. The risk measurement process and its parameters must be sufficiently robust to accurately reflect the multiple categories of risks incurred by the institution. The risk measurement criteria must be well understood by the personnel concerned at all levels of competence - from simple executors to the board of directors - and provide a common reference framework for limiting and monitoring activities involving risk-taking.

5. Regarding the activity of operators, the valuation of derivative instrument positions at current market prices is fundamental so that risk measurement and reporting are carried out accurately and in a timely manner. An institution operating on foreign exchange, derivative instruments, and other negotiated products must have the ability to track credit risks, trading positions, and market movements on at least a daily basis. Certain establishments should also be able, or at least have as an objective, to monitor their most active products in real time.

6. The analysis of stress situations, such as the conjunction on the market of events that could affect the banking organization, also constitutes an important aspect of risk measurement. Sound risk measurement practices should include procedures designed to identify possible events or modifications in market sentiment likely to have a detrimental impact on the institution and to evaluate the institution's capacity to withstand them. These analyses should not only consider the probability of unfavorable events, but also "worst-case" scenarios. The idea is that such an analysis based on the most pessimistic hypotheses should be conducted across the entire institution, taking into account the consequences of unusual changes in prices or their volatility, a situation of market illiquidity, or the failure of a significant counterparty, both at the level of derivative instruments and cash trading portfolios and at the level of loan and investment portfolios.

7. Such stress tests should not be limited to quantitative exercises calculating potential losses or gains. They should also encompass more qualitative analyses of the actions management might take in specific situations. Emergency plans defining operational procedures and communication lines, both formal and informal, constitute important corollaries to such quantitative analyses.

Risk Limitation

8. A reliable system of limits and reference criteria for risk-taking, in a form integrated at the level of the establishment as a whole, constitutes an essential component of the risk management process. Such a system should set thresholds for risk-taking and also ensure that positions exceeding certain established levels are quickly brought to the attention of management. The limits system must be compatible with the efficiency of the overall risk management process as well as with the adequate level of the establishment's own funds. It should allow management to control risk positions, organize discussions on opportunities and risks, and monitor actual risk-taking against tolerances predetermined by the board of directors and general management.

9. Global limits must be provided for each major type of risk incurred within the framework of the institution's derivative activities. They must be compatible with the establishment's general risk measurement approach and integrated as much as possible into the limits imposed on risks related to other activities. If necessary, the limits system must be designed to allow the setting of limits down to the level of individual units of the establishment.

10. In the event of limit breaches, these facts must be reported to the knowledge of general management and can only be approved by authorized personnel. These positions should also trigger rapid discussions on the establishment's consolidated risk-taking activities or the entity operating on derivative instruments. The rigor of limit breaches depends largely on the approach adopted by management regarding their setting and the effective size of individual and global limits relative to the institution's capacity to assume risks. An establishment with relatively restrictive limits may allow more breaches than another with less rigorous limits.

Reporting

11. A precise, informative, and punctual reporting system to management is essential for the prudent conduct of derivative activities. Consequently, the quality of the management information system is an important factor in the overall efficiency of the risk management process. The department responsible for this management must monitor and transmit its risk measurements to the appropriate levels of general management and the board of directors. In the course of operations, risk positions and profits and losses must be reported at least daily to directors who supervise but do not themselves carry out these activities. Reports should become more frequent if market conditions require it. Reports to other levels of general management and the board of directors may be made less frequently, but they must provide these persons with adequate information to allow them to judge the changing nature of the institution's risk profile.

12. Management information systems should translate the measured risk for derivative instrument activities from a technical and quantitative formulation that can be easily read and understood by general managers and administrators, who do not necessarily have specialized and technical knowledge of derivative products. Risk positions on various derivative instruments should be reported to general management and administrators using a common conceptual framework for risk measurement and limitation.

Evaluation and Revision by Management

13. Management must ensure that the various components of the institution's risk management process are regularly subject to review and evaluation. This review must take into account changes occurring in the establishment's activities and the market environment, which may have generated risk positions requiring increased attention. Any significant modification of the risk management system must also be subject to review.

14. Risk management services must regularly evaluate the methodology, models, and hypotheses used to measure risk and limit positions. Adequate documentation of these elements of the risk measurement system is essential to carry out effective revisions. The review of limits structures should compare limits to actual positions and also see if existing risk parameters and limits are appropriate, in light of the results recorded by the institution and the current state of own funds.

15. The frequency and extent of the review of risk measurement methods and models depend in part on the specific risk positions generated by the institution's derivative instrument activities, the pace and nature of market modifications, and the speed of innovations relative to the measurement and management of risks. At a minimum, an institution with significant activity in derivative products must review at least annually the methodology underlying its own models - and more frequently if market conditions require it - to ensure that it is appropriate and consistent. Such internal evaluations can, in many cases, be supplemented by analyses conducted by external auditors or other qualified consultants, such as those with experience in highly technical risk management models and procedures. Hypotheses must be reconsidered permanently.

16. The institution must also establish an effective evaluation and revision process for risks inherent in products that are new either to it or to the market and of potential interest to the institution. The introduction of new instruments must also be done in a manner that reasonably limits potential losses and allows for testing of internal systems. An institution should not actively engage in a product until general management and all concerned personnel (including risk management, internal control, legal, accounting, and audit departments) have assimilated the product and are able to integrate it into the institution's risk measurement and control systems.

IV. Internal Controls and Audits

1. The strategies and related procedures for carrying out derivative instrument activities must be an extension of the institution's overall internal control structure and form an integral part of the usual workflow. A sound internal control system must promote effective and efficient operations, a reliable financial and regulatory reporting process, and compliance with regulatory prescriptions and the institution's policies in this area. In determining whether internal controls meet these objectives, the establishment must examine the overall control context, the risk identification, analysis, and management process, the appropriateness of management information systems, and the observation of control procedures such as approvals, confirmations, and reconciliations. Reconciliation verification is particularly important in the event of differences in the valuation methods or systems used by operators and the post-market.

2. An important step in the internal control review process lies in the frequency, scope, and results of observations made by independent internal and external auditors and in the ability of these persons to review the establishment's derivative instrument activities. Internal auditors must control and test the risk management process and internal controls on a periodic basis, the frequency of which would be based on a prudent assessment of risks. The intensity and frequency of internal audits should be increased if deficiencies and critical aspects are discovered or if significant modifications have occurred in product lines, model development methods, as well as in the risk monitoring process, internal controls, or the institution's overall risk profile. To facilitate the conduct of adequate controls, internal auditors must be integrated at the most advanced stage of product development.

3. It is the responsibility of internal auditors to evaluate the independence and overall effectiveness of the institution's risk management services. In this regard, they must thoroughly examine the effectiveness of internal controls related to risk measurement, reporting, and limitation. Internal auditors must assess the compliance of positions with risk limits as well as the reliability and promptness in transmitting information to general management and the board of directors of the establishment.

4. The evaluation by internal auditors of the adequacy of internal controls involves a process of understanding, documentation, appreciation, and verification of the institution's internal control system. This analysis must include a review of product lines or activities, which in turn must begin with an estimate of their organizational structures. For the activity of operators in particular, auditors must ensure the existence of appropriate task delimitation (especially between personnel performing the market maker function and those responsible for internal controls and risk management), adequate follow-up by a manager possessing the necessary technical skills, but without daily responsibilities in the work of operators, and the presence of reporting lines for personnel performing risk management and internal controls, on the one hand, and those performing the market maker function, on the other. The product-by-product examination of the structure must complement the overall judgment on the institution's organizational structure for derivative activities.

5. The institution must put in place internal controls for fundamental activities. For example, for the recording and processing of transactions, it must have, in written form, strategies and procedures for entering operations, evaluating the conformity of the trading domain with the establishment's policy, and analyzing the transaction processing cycle, including their settlement, to ensure the integrity and accuracy of these records and reports to management. It must examine the valuation process, in order to judge the adequacy of written strategies and policies for revaluing positions and creating possible revaluation reserves. It must review conformity with valuation strategies and procedures, the frequency of evaluations, and the independence and quality of information sources regarding market prices, particularly for instruments launched and negotiated on illiquid markets. All important internal controls associated with market risk management, such as the analysis of positions against established limits and the strategies and procedures for approving limit breaches, must also be re-examined. The institution must also reconsider the credit approval process, to ensure that risks of specific products are well taken into account and that this approach is followed for all transactions. In this regard, institutions must determine their overall credit risk toward a given counterparty regarding operations concluded throughout the bank.

• 13-
  V. Sound Risk Management Practices for Each Type of Risk

1. The following sections present sound management practices for each of the risks incurred by an institution within the framework of its derivative activities.

Credit Risk (including Settlement Risk)

2. Broadly defined, credit risk is the risk that a counterparty is unable to fulfill an obligation toward the institution. The institution must evaluate credit risk, both at settlement and before settlement, for the entire client base and range of products. On the day of settlement, the risk of counterparty default may correspond to the total value of cash flows or securities that the institution is entitled to receive. Before settlement, credit risk is measured by the sum of the replacement cost of the position, plus an estimate of the institution's potential future risk due to market modifications. The replacement cost must be determined using current market prices or a commonly accepted approach to estimate the present value of future payments required for each contract, under normal market conditions.

3. Potential credit risk is measured more subjectively than current risk and is essentially a function of the remaining time to maturity and the expected volatility of the price, rate, or index underlying the contract. Operators and major participants in derivative instruments must evaluate potential risk using simulation analysis or other elaborated techniques, which, if correctly designed and implemented, can provide estimates of potential risk taking into account both the specificities of the portfolio and normal market conditions. End users with a more modest scale can measure this risk using "add-ons" based on more general characteristics. In both cases, the fundamental hypotheses of the institution's risk measurement must be reasonable, and if it chooses, for this purpose, a portfolio approach, it must do so prudently.

4. An institution may resort to master netting agreements and various forms of credit enhancements, such as collateral or third-party guarantees, to reduce its counterparty risk. In these cases, the incurred credit risks must reflect these risk reduction characteristics only to the extent that the agreements and guarantee clauses are legally valid in all concerned jurisdictions. This legal validity must also apply to any bankruptcy procedure of the counterparty. The institution must be able to demonstrate that it has diligently evaluated the valid content of these contracts and that individual transactions were carried out in a manner to ensure adequate protection of the institution.

5. Credit limits for risks, both at settlement and before settlement, must be established for all counterparties with which the bank has a business relationship.

Risk management guidelines for derivatives

Preface

1. As part of its on-going efforts to address international bank supervisory issues, the Basle Committee on Banking Supervision¹ is currently engaged in several activities to strengthen the prudential supervision of banks’ derivatives operations. One of these activities has been a reassessment of the key elements of sound management of the risks involved in derivatives. In 1986, the Committee issued a document entitled “The management of banks’ off balance sheet exposures: a supervisory perspective”, and it has continued to consider the issues raised in that document. As a result, the Committee is now issuing the attached paper providing guidance on sound risk management of derivatives activities for use by supervisory authorities and banking organisations. In developing these guidelines, the Committee has drawn upon those established in member countries of the Committee and upon recommendations made by the financial industry.

2. The Basic Committee is distributing these guidelines to supervisors worldwide with the expectation that they will facilitate the further development of a prudent supervisory approach to the risk management of derivatives. Supervisors may wish to circulate the guidelines to the institutions under their jurisdiction, either in their entirety or as modified to take into account local conditions. The Committee wishes to emphasise that sound internal risk management is essential to the prudent operations of banks and that supervisory tools, such as capital requirements, are not by themselves sufficient. Sound internal risk management is also essential to promoting stability in the financial system as a whole.

3. Neither derivatives, nor the individual risks inherent in them are, by themselves, new. Institutions have been active for some time in forwards, swaps, and options and have routinely addressed credit, market, liquidity, operational and legal risks in their more traditional activities. However, the growing complexity, diversity and volume of derivatives products, facilitated by rapid advances in technology and communications pose increasing challenges to managing these risks. Sound risk management practices are an important element in meeting these challenges.

4. The guidelines bring together practices currently used by major international banks in a single framework. While no bank may follow the framework precisely, it could provide guidance to all banks. The applicability of the guidelines depends on the size and complexity of an institution’s derivatives activities.

5. Supervisors should find the guidelines useful in reassessing their own existing supervisory methods and procedures for monitoring how banks control risks in derivatives. The exact approach chosen by individual supervisors to supervise derivatives activities depends upon a host of factors, including their own legal authority, use of on-site and off-site supervisory techniques and the degree to which external auditors are also used in a supervisory function.

6. One outstanding feature of financial markets is the increasing use of sophisticated models by major institutions as their principal means of measuring and managing risk. As a consequence, supervisory agencies will need to assure that they (and external auditors) have staff with sufficient mathematical knowledge to understand the issues and that the reliability of models can be independently verified by external experts.

---

I. Introduction and basic principles

7. The guidelines are intended to provide a framework for sound risk management practices for derivatives activities. They are not intended to be prescriptive, but rather to provide guidance on the key elements of sound risk management. The guidelines are organized around the following principles:

   a. The board of directors should establish the institution’s risk management policies and ensure that senior management implements them. b. Senior management should establish an organizational structure that supports the risk management policies established by the board of directors.
   c. The institution should have independent risk management functions that are separate from the trading units.
   d. The institution should have a comprehensive risk measurement and management system that covers all material risks. e. The institution should have a system of internal controls and audits that provides reasonable assurance that the risk management policies and procedures are followed.

II. Oversight of the risk management process

Board of directors

8. The board of directors should establish the institution’s risk management policies and ensure that senior management implements them. The board should have a clear understanding of the risks involved in the institution’s derivatives activities and should ensure that the institution has the necessary resources to manage these risks. The board should also ensure that the institution has a system of internal controls and audits that provides reasonable assurance that the risk management policies and procedures are followed.

Senior management

9. Senior management should establish an organizational structure that supports the risk management policies established by the board of directors. Senior management should ensure that the institution has the necessary resources to manage the risks involved in its derivatives activities. Senior management should also ensure that the institution has a system of internal controls and audits that provides reasonable assurance that the risk management policies and procedures are followed.

Independent risk management functions

10. The institution should have independent risk management functions that are separate from the trading units. The independent risk management functions should be responsible for measuring, monitoring, and reporting on the institution’s derivatives risks. The independent risk management functions should also be responsible for ensuring that the institution’s derivatives activities are consistent with the risk management policies established by the board of directors.

III. The risk management process

Risk measurement

11. The institution should have a comprehensive risk measurement and management system that covers all material risks. The risk measurement system should be capable of measuring the institution’s exposure to credit, market, liquidity, operational, and legal risks. The risk measurement system should also be capable of measuring the institution’s exposure to concentration risks.

Limiting risks

12. The institution should have a system of limits that is consistent with the risk management policies established by the board of directors. The limits should be set at a level that is appropriate for the institution’s risk appetite and capital resources. The limits should be monitored and reported on a regular basis.

Reporting

13. The institution should have a system of reporting that provides senior management and the board of directors with timely and accurate information on the institution’s derivatives risks. The reporting system should provide information on the institution’s exposure to credit, market, liquidity, operational, and legal risks. The reporting system should also provide information on the institution’s exposure to concentration risks.

Management evaluation and review

14. The institution should have a system of management evaluation and review that provides senior management and the board of directors with a regular assessment of the institution’s derivatives risks. The management evaluation and review should assess the effectiveness of the institution’s risk management policies and procedures. The management evaluation and review should also assess the adequacy of the institution’s risk management resources.

IV. Internal controls and audits

15. The institution should have a system of internal controls and audits that provides reasonable assurance that the risk management policies and procedures are followed. The internal controls and audits should be designed to detect and prevent errors and fraud. The internal controls and audits should also be designed to ensure that the institution’s derivatives activities are consistent with the risk management policies established by the board of directors.

V. Sound risk management practices for each type of risk

Credit risk (including settlement risk)

16. Credit risk is the risk that a counterparty will fail to meet its obligations under a contract. Settlement risk is the risk that one party to a transaction will deliver the asset or cash but will not receive the corresponding asset or cash. The institution should have a system for measuring and managing credit risk and settlement risk. The system should be capable of measuring the institution’s exposure to credit risk and settlement risk. The system should also be capable of measuring the institution’s exposure to concentration risks.

17. The institution should have a system for approving counterparties. The system should be designed to ensure that the institution only enters into transactions with counterparties that have the financial capacity to meet their obligations. The system should also be designed to ensure that the institution’s exposure to any single counterparty is within the limits established by the board of directors.

18. The institution should have a system for monitoring credit risk and settlement risk. The system should be designed to provide timely and accurate information on the institution’s exposure to credit risk and settlement risk. The system should also be designed to provide timely and accurate information on the institution’s exposure to concentration risks.

19. The institution should have a system for managing credit risk and settlement risk. The system should be designed to ensure that the institution’s exposure to credit risk and settlement risk is within the limits established by the board of directors. The system should also be designed to ensure that the institution’s exposure to concentration risks is within the limits established by the board of directors.

Market risk

20. Market risk is the risk that the value of a portfolio will change due to changes in market prices. The institution should have a system for measuring and managing market risk. The system should be capable of measuring the institution’s exposure to market risk. The system should also be capable of measuring the institution’s exposure to concentration risks.

21. The institution should have a system for limiting market risk. The system should be designed to ensure that the institution’s exposure to market risk is within the limits established by the board of directors. The system should also be designed to ensure that the institution’s exposure to concentration risks is within the limits established by the board of directors.

22. The institution should have a system for monitoring market risk. The system should be designed to provide timely and accurate information on the institution’s exposure to market risk. The system should also be designed to provide timely and accurate information on the institution’s exposure to concentration risks.

23. The institution should have a system for managing market risk. The system should be designed to ensure that the institution’s exposure to market risk is within the limits established by the board of directors. The system should also be designed to ensure that the institution’s exposure to concentration risks is within the limits established by the board of directors.

Liquidity risk

24. Liquidity risk is the risk that the institution will be unable to meet its obligations as they fall due. The institution should have a system for measuring and managing liquidity risk. The system should be capable of measuring the institution’s exposure to liquidity risk. The system should also be capable of measuring the institution’s exposure to concentration risks.

25. The institution should have a system for limiting liquidity risk. The system should be designed to ensure that the institution’s exposure to liquidity risk is within the limits established by the board of directors. The system should also be designed to ensure that the institution’s exposure to concentration risks is within the limits established by the board of directors.

26. The institution should have a system for monitoring liquidity risk. The system should be designed to provide timely and accurate information on the institution’s exposure to liquidity risk. The system should also be designed to provide timely and accurate information on the institution’s exposure to concentration risks.

27. The institution should have a system for managing liquidity risk. The system should be designed to ensure that the institution’s exposure to liquidity risk is within the limits established by the board of directors. The system should also be designed to ensure that the institution’s exposure to concentration risks is within the limits established by the board of directors.

Operations risk

28. Operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. The institution should have a system for measuring and managing operational risk. The system should be capable of measuring the institution’s exposure to operational risk. The system should also be capable of measuring the institution’s exposure to concentration risks.

29. The institution should have a system for limiting operational risk. The system should be designed to ensure that the institution’s exposure to operational risk is within the limits established by the board of directors. The system should also be designed to ensure that the institution’s exposure to concentration risks is within the limits established by the board of directors.

30. The institution should have a system for monitoring operational risk. The system should be designed to provide timely and accurate information on the institution’s exposure to operational risk. The system should also be designed to provide timely and accurate information on the institution’s exposure to concentration risks.

31. The institution should have a system for managing operational risk. The system should be designed to ensure that the institution’s exposure to operational risk is within the limits established by the board of directors. The system should also be designed to ensure that the institution’s exposure to concentration risks is within the limits established by the board of directors.

Legal risk

32. Legal risk is the risk that a contract will not be legally enforceable. The institution should have a system for measuring and managing legal risk. The system should be capable of measuring the institution’s exposure to legal risk. The system should also be capable of measuring the institution’s exposure to concentration risks.

33. The institution should have a system for limiting legal risk. The system should be designed to ensure that the institution’s exposure to legal risk is within the limits established by the board of directors. The system should also be designed to ensure that the institution’s exposure to concentration risks is within the limits established by the board of directors.

34. The institution should have a system for monitoring legal risk. The system should be designed to provide timely and accurate information on the institution’s exposure to legal risk. The system should also be designed to provide timely and accurate information on the institution’s exposure to concentration risks.

35. The institution should have a system for managing legal risk. The system should be designed to ensure that the institution’s exposure to legal risk is within the limits established by the board of directors. The system should also be designed to ensure that the institution’s exposure to concentration risks is within the limits established by the board of directors.

---

¹ The Basle Committee on Banking Supervision is a Committee of banking supervisory authorities which was established by the central-bank Governors of the Group of Ten countries in 1975. It consists of senior representatives of bank supervisory authorities and central banks from Belgium, Canada, France, Germany, Italy, Japan, Luxembourg, Netherlands, Sweden, Switzerland, United Kingdom and the United States. It usually meets at the Bank for International Settlements in Basel.

July 1994

-3-

1. Introduction and basic principles
   I. Derivatives instruments have become increasingly important to the overall risk
   profile and profitability of banking organisations throughout the world. Broadly defined, a derivatives instrument is a financial contract whose value depends on the values of one or more underlying assets or indexes. Derivatives transactions include a wide assortment of financial contracts, including forwards, futures, swaps and options. In addition, other traded instruments incorporate derivatives characteristics, such as those with imbedded options. While some derivatives instruments may have very complex structures, all of them can be divided into the basic building blocks of options, forward contracts or some combination thereof. The use of these basic building blocks in structuring derivatives instruments allows the transfer of various financial risks to parties who are more willing, or better suited, to take or manage them.
2. Derivatives contracts are entered into throughout the world on organised
   exchanges and through over-the-counter (OTC) arrangements. Exchange-traded contracts are typically standardised as to maturity, contract size and delivery terms. OTC contracts are custom-tailored to an institution’s needs and often specify commodities, instruments and/or maturities that are not offered on any exchange. This document addresses banks’ activities in both OTC and exchange-traded instruments.
3. Derivatives arc used by banking organisations both as risk management tools and
   as a sodrcc of revenue. From a risk management perspective, they allow financial institutions and other participants to identify, isolate and manage separately the market risks in financial instruments and commodities. When used prudently, derivatives can offer managers efficient and effective methods for reducing certain risks through hedging. Derivatives may also be used to reduce financing costs and to increase the yield of certain assets. For a growing number of banking organisations, derivatives activities are becoming a direct source of revenue through “market-making” functions, position taking and risk arbitrage:
   “market-muking” functions involve entering into derivatives transactions with customers and with other market-makers while maintaining a generally balanced portfolio with the expectation of earning fees generated by a bid/offer spread;

• position-taking, on the other hand, represents efforts to profit by accepting the
  risk that stems from taking outright positions in anticipation of price movements; arbitrageurs also attempt to take advantage of price movements, but focus their efforts on trying to profit from small discrepancies in price among similar instruments in different markets.

4. Participants in the derivatives markets arc generally grouped into two categories
   based primarily on their motivations for entering into derivatives contracts. End-users typically enter into derivatives transactions to achieve specified objectives related to hedging,

. .
-4- financing or position taking on the normal course of their businesS operations. A wide variety of business enterprises are end-users. They include, but are not limited to, a broad range. of financial institutions such as banks, securities firms and insurance companies; institutional investors such as pension funds, mutual funds and specialised investment partnerships; and corporations, local and state governments, government agencies and international agencies.
5. Intemtediories, which are sometimes referred to as “dealers”, cater to the needs of
end-users by “making markets” in OTC derivatives instruments. In doing so, they expect to generate income from transaction fees, bid/offer spreads and their own trading positions.
Important intermediaries, or derivative dealers, include major banks and securities firms around the world. As intermediaries, banks have traditionally offered foreign exchange and interest rate risk management products to their customers and generally view derivatives products as a financial risk management service.
6. The basic risks associated with derivatives transactions are not new to banking
organisations. In general, these risks are credit risk, market risk, liquidity risk. operations risk and legal risk. Because they facilitate the specific identification and management of these risks, derivatives have the potential to enhance the safety and soundness of financial institutions and to produce a more efficient aliocation of financial risks. However, since derivatives also repackage these basic risks in combinations that can be quite complex, they can also threaten the safety and soundness of institutions if they are not clearly understood and properly managed.
I. Recognising the importance of sound risk management to the effective use of
derivatives instruments, the following guidance is intended to highlight the key elements and basic principles of sound management practice for both dealers and end-users of derivatives instruments. These basic principles include:

1. Appropriate oversight by boards of directors and senior management;
2. Adequate risk management process that integrates prudent risk limits, sound
   measurement procedures and information systems, continuous risk monitoring and frquent management reporting; and,
3. Comprehensive internal controls and audit procedures.

IL Oversight of the risk management process

1. AS is standard practice for most banking activities, an institution should maintain
   writien policies and procedures that clearly outline its risk management guidance for derivatives activities. At a minimum these policies should identify the risk tolerances of the board of directors and should clearly delineate lines of authority and responsibility for managing the risk of these activities. Individuals involved in derivatives activities should be fully aware of all policies and procedures that relate to their specific duties. Board of directors
2. The board of directors should approve all significant policies relating to the
   management of risks throughout the institution. These policies, which should include those \ related to derivatives activities, should be consistent with the organisation’s broader business strategies, capital strength, management expertise and overall willingness to take risk. Accordingly, the board should be informed regularly of the risk exposure of the institution and should regularly re-evaluate significant risk management policies and procedures with special emphasis placed on those defining the institution’s risk tolerance regarding these activities. The board of directors should also conduct and encourage discussions between its members and senior management, as well as between senior management and others in the institution, regarding the institution’s risk management process and risk exposure. Senior management
3. Senior management should be responsible for ensuring that there are adequate
   policies and procedures for conducting derivatives operations on both a long-range and dayto-day basis. This responsibility includes ensuring that there are clear delineations of lines of responsibility for managing risk, adequate systems for measuring risk, appropriately structured limits on risk taking, effective internal controls and a comprehensive risk-reporting process.
4. Before engaging in derivatives activities, management should ensure that all
   appropriate approvals are obtained and that adequate operational procedures and risk control systems are in place. Proposals to undertake derivatives activities should include, as applicable:
   a description of the relevant financial products, markets and business strategies; the resources required to establish sound and effective risk management systems and to attract and retain professionals with specific expertise in derivatives transactions; an analysis of the reasonableness of the proposed activities in relation to the institution’s overall financial condition and capital levels;

an analysis of the risks that may arise from the activities; the procedures the bank will use to measure, monitor and control risks; the relevant accounting guidelines; the relevant tax treatment; and an analysis of any legal restrictions and whether the activities are permissible.
5. After the institution’s initial entry into derivatives activities has been properly
approved, any significant changes in such activities or any new derivatives activities should be approved by the board of directors or by an appropriate level of senior management, as designated by the board of directors.
6. Senior management should regularly evaluate the procedures in place to manage
risk to ensure that those procedures are appropriate and sound. Senior management should also foster and participate in active discussions with the board, with staff of risk management functions and with traders regarding procedures for measuring and managing risk. Management must also ensure that derivatives activities are allocated sufficient resources and staff to manage and control risks.
7. As a matter of general policy, compensation policies - especially in the risk
management, control and senior management functions - should be structured in a way that is sufficiently independent of the performance of trading activities, thereby avoiding the potential incentives for excessive risk taking that can occur if, for example, salaries are tied too closely to the profitability of derivatives. Independent risk managementfunctions
8. To the extent warranted by the bank’s activities, the process of measuring,
monitoring and controlling risk consistent with the established policies and procedures should be managed independently of individuals conducting derivatives activities, up through senior levels of the institution. An independent system for reporting exposures to both senior-level management and to the board of directors is an important element of this process.
9. The personnel staffing independent risk management functions should have a
complete understanding of the risks associated with all of the bank’s derivatives activities.
Accordingly, compensation policies for these individuals should be adequate to attract and retain personnel qualified to assess these risks.

-7-
III. The risk management process
I. The primary components of a sound risk management process are the following: a
comprehensive risk measurement approach; a detailed structure of limits, guidelines and other parameters used to govern risk taking; and a strong management information system for controlling, monitoring and reporting risks. These components are fundamental to both derivatives and non-derivatives activities alike. Moreover, the underlying risks associated with these activities, such as credit, market, liquidity, operations and legal risk, are not new to banking, although their measurement and management can be more complex. Accordingly, the process of risk management for derivatives activities should be integrated into the institution’s overall risk management system to the fullest extent possible using a conceptual framework common to the institution’s other activities. Such a common framework enables the institution to manage its risk exposure more effectively, especially since the various individual risks involved in derivatives activities can, at times, be interconnected and can often transcend specific markets.
2. As is the case with all risk-bearing activities, the risk exposures an institution
assumes in its derivatives activities should be fully supported by an adequate capital position.
The institution should ensure that its capital position is sufficiently strong to support all derivatives risks on a fully consolidated basis and that adequate capital is maintained in all group entities engaged in these activities.
Risk measurement
3. An institution’s system for measuring the various risks of derivatives activities
should be both comprehensive and accurate. Risk should be measured and aggregated across trading and non-trading activities on an institution-wide basis to the fullest extent possible.
4. While the use of a single prescribed risk measurement approach for management
purposes may not be essential, the institution’s procedures should enable management to assess exposures on a consolidated basis. Risk measures and the risk measurement process should be sufficiently robust to reflect accurately the multiple types of risks facing the institution. Risk measurement standards should be understood by relevant personnel at all levels of the institution - from individual traders to the. board of directors - and should provide a common framework for limiting and monitoring risk taking activities.
5. With regard to dealer operations, the process of marking derivatives positions to
market is fundamental to measuring and reporting exposures accurately and on a timely basis.
An institution active in dealing foreign exchange, derivatives and other traded instruments should have the ability to monitor credit exposures, trading positions and market movements at least daily. Some institutions should also have the capacity, or at least the goal, of monitoring their more actively traded products on a real-time basis.

-8-
6. Analysing stress situations. including combinations of market events that could
affect the banking organisation, is also an important aspect of risk measurement. Sound &k measurement practices include identifying possible events or changes in market behaviour that could have unfavourable effects on the institution and assessing the ability of the institution to withstand them. These analyses should consider not only the likelihood of adverse events, reflecting their probability, but also “worst case” scenarios. Ideally, such worst case analysis should be conducted on an institution-wide basis by taking into account the effect of unusual changes in prices or volatilitics, market illiquidity or the default of a large counterparty across both the derivatives and cash trading portfolios and the loan and funding portfolios.
7. Such stress tests should not be limited to quantitative exercises that compute
potential losses or gains. They should also include more qualitative analyses of the actions management might take under particular scenarios. Contingency plans outlining operating procedures and lines of communication, both formal and informal, are important products of such qualitative analyses. Limiting risks
8. A sound system of integrated institution-wide limits and risk taking guidelines is
an essential component of the risk management process. Such a system should set boundaries for organisational risk-taking and should also ensure that positions that exceed certain predetermined levels receive prompt management attention. The limit system should be consistent with the effectiveness of the organisation’s overall risk management process and with the adequacy of its capital position. An appropriate limit system should permit management to control exposures, to initiate discussion about opportunities and risks and to monitor actual risk taking against predetermined tolerances, as determined by the board of directors and senior management.
9. Global limits should be set for each major type of risk involved in an institution’s
derivatives activities. These limits should be consistent with the institution’s overall risk measurement approach and should be integrated to the fullest extent possible with institutionwide limits on those risks as they arise in all other activities of the institution. Where appropriate, the limit system should provide the capability to allocate limits down to individual business units.
10. If limits are exceeded, such occurrences should be made known to senior
management and approved only by authorised personnel. These positions should also prompt discussions about the consolidated risk taking activities of the institution or the unit conducting the derivatives activities. The seriousness of limit exceptions depends in large part upon management’s approach toward setting limits and on the actual size of individual and organisational limits relative to the institution’s capacity to take risk. An institution with

-9- relatively conservative limits may encounter more exceptions to those limits than an institution with less restrictive limits.
Reporting
II. An accurate, informative and timely management information system is essential
to the prudent operation of derivatives activities. Accordingly, the quality of the management information system is an important factor in the overall effectiveness of the risk management process. The risk management function should monitor and report its measures of risks to appropriate levels of senior management and to the board of directors. In dealer operations, exposures and profit and loss statements should be reported at least daily to managers who supervise but do not, themselves, conduct those activities. More frequent reports should be made as market conditions dictate. Reports to other levels of senior management and the board may occur less frequently, but the frequency of reporting should provide these individuals with adequate information to judge the changing nature of the institution’s risk profile.
12. Management information systems should translate the measured risk for
derivatives activities from a technical and quantitative format to one that can be easily read and understood by senior managers and directors, who may not have specialised and technical knowledge of derivatives products. Risk exposures arising from various derivatives products should be reported to senior managers and directors using a common conceptual framework for measuring and limiting risks. Management evaluation and review
13. Management should ensure that the various components of the institution’s risk
management process are regularly reviewed and evaluated. This review should take into account changes in the activities of the institution and in the market environment, since the changes may have created exposures that require additional attention. Any material changes to the risk management system should also be reviewed.
14. The risk management functions should regularly assess the methodologies,
models and assumptions used to measure risk and to limit exposures. Proper documentation of these elements of the risk measurement system is essential for conducting meaningful reviews. The review of limit structures should compare limits to actual exposures and should also consider whether existing measures of exposure and limits are appropriate in view of the institution’s past performance and current capital position. IS. The frequency and extent to which an institution should re-evaluate its risk measurement methodologies and models depends, in part, on the specific risk exposures created by their derivatives activities, on the pace and nature of market changes and on the pace of innovation with respect to measuring and managing risks. At a minimum, an institution with significant derivatives activities should review the underlying methodologies of its models at least annually - and more often as market conditions dictate - to ensure they

-IOare appropriate and consistent. Such internal evaluations may, in many cases, be supplemented by reviews by external auditors or other qualified outside parties, such as consultants who have expertise with highly technica models and risk management techniques. Assumptions should be evaluated on a continual basis.
16. The institution should also have an effective process to evaluate and review the
risks involved in products that are either new to it, or new to the marketplace and of potential interest to the institution. It should also introduce new products in a manner that adequately limits potential losses and petmits the testing of internal systems. An institution should not become involved in a product at significant levels until senior management and all relevant personnel (including those in risk management, internal control, legal, accounting and auditing) understand the product and are able to integrate the product into the institution’s risk measurement and control systems.

-II -
IV. Internal controls and audits

1. Policies and related procedures for the operation of derivatives activities should
   be an extension of the institution’s overall structure of internal controls and should be fully integrated into routine work-flows. A sound system of internal controls should promote effective and efficient operations; reliable financial and regulatory reporting; and compliance with relevant laws, regulations and policies of the institution. In determining whether internal controls meet those objectives, the institution should consider the overall control environment of the organisation; the process for identifying, analysing and managing risk; the adequacy of management information systems; and adherence to control activities such as approvals, confirmations and reconciliations. Reconciliation control is particularly important where there are differences in the valuation methodologies or systems used by the front and back offices.
2. An important step in the process of reviewing internal controls is the frequency,
   scope and findings of independent internal and external auditors and the ability of those auditors to review the institution’s derivatives activities. Internal auditors should audit and test the risk management process and internal controls on a periodic basis, with the frequency based on a careful risk assessment. The depth and frequency of internal audits should be increased if weaknesses and significant issues are discovered, or if significant changes have. been made to product lines, modelling methodologies, the risk oversight process, internal controls or the overall risk profile of the institution. To facilitate the development of adequate controls, internal auditors should be brought into the product development process at the earliest possible stage.
3. Internal auditors are expected to evaluate the independence and overall
   effectiveness of the institution’s risk management functions. In this regard. they should thoroughly evaluate the effectiveness of internal controls relevant to measuring, reporting and limiting risks. Internal auditors should evaluate compliance with risk limits and the reliability and timeliness of information rcportcd to the institution’s senior management and board of directors.
4. The internal auditors’ assessment of the adequacy of internal controls involves a
   process of understanding, documenting, evaluating and testing an institution’s internal control system. This assessment should include product or business line reviews which, in turn,, should start with an assessment of the line’s organisational structure. Especially for dealer operations, the auditors should check for adequate separation of duties (particularly between market-making personnel and functions of internal control and risk management), adequate oversight by a knowledgeable manager without day-to-day responsibilities in the dealer operation and the presence of separate reporting lines for risk management and internal control personnel on one side and for market-making personnel on the other. Product-by-

product reviews of management structure should supplement the overall assessment of the organisational structure of the institution’s derivatives business.
5. The institution should establish internal controls for key activities. For example,
for transaction recording and processing, the institution should have written policies and procedures for recording trades, assess the trading area’s adherence to policy and analyse the transaction processing cycle, including settlement, to ensure the integrity and accuracy of its records and management reports, The institution should review the revaluation process in order to assess the adequacy of written policies and procedures for revaluing positions and for creating any associated revaluation reserves. The institution should review compliance with revaluation policies and procedures, the frequency of revaluation and the independence and quality of the sources of revaluation prices, especially of instruments originated and traded in illiquid markets. All significant internal controls associated with the management of market risk, such as position versus limit reports and approval policies and procedures for limit exceptions, should also be reviewed. The institution should also review the credit approval process to ensure that the risks of specific products are adequately captured and that credit approval procedures arc followed for all transactions. In this connection, institutions should recognise their combined credit exposure to a given counterpasty that arise from transactions conducted throughout the bank.

• 13-
  V. Sound risk management practices for each type of risk
  I. The following sections present sound practices for the specific components of an
  institution’s risk management process in the context of each ofthe risks involved in derivatives activities.
  Credit rirk (including sertfement risk)

2. Broadly defined, credit risk is the risk that a counterparty will fail to perform on
   an obligation to the institution. The institution should evaluate both settlement and presettlement credit risk at the customer level across all products. On settlement day, the exposure to counterparty default may equal the full value of any cash flows or securities the institution is to receive. Prior to settlement, credit risk is measured as the sum of the replacement cost of the position, plus an estimate of the institution’s potential future exposure from the instrument as a result of market changes. Replacement cost should be determined using current market prices or generally accepted approaches for estimating the present value of future payments required under each contract, given current market conditions.
3. Potential credit risk exposure is measured more subjectively than current exposure
   and is primarily a function of the time remaining to maturity and the expected volatility of the price, rate or index underlying the contract. Dcalcrs and large derivatives participants should assess potential exposure through simulation analysis or other sophisticated techniques, which, when properly designed and implemented can produce estimates of potential exposure that incorporate both portfolio-specific characteristics and current market conditions. Smaller end-users may measure this exposure by using “add-ons” based on more general characteristics. In either case, the assumptions underlying the institution’s risk measure should be reasonable and if the institution measures exposures using a portfolio approach, it should do so in a prudent manner.
4. An institution may use master netting agreements and various credit
   enhancements, such as collateral or third-party guarantees, to reduce its counterpatty credit risk. In such cases, an institution’s credit exposures should reflect these risk-reducing features only to the extent that the agreements and recourse provisions are legally enforceable in all relevant jurisdictions. This legal enforceability should extend to any insolvency proceedings of the counterpatty. The institution should be able to demonstrate that it has exercised due diligence in evaluating the enforceability of these contracts and that individual transactions have been executed in a manner that provides adequate protection to the institution.
5. Credit limits that consider both settlement and pre-settlement exposures should be
   established for all counterparties with whom the institution conducts business. As a matter of general policy, business with a counterpatty should not commence until a credit line has been approved. The structure of the credit-approval process may differ among institutions, reflecting the organisational and geographic structure of each institution. Nevertheless. in al1

• 14-
  cases, it is important that credit limits be determined by personnel who are independent of the derivatives function. that these personnel use standards consistent with those used for other activities and that counterparty credit lines are consistent with the organisation’s policies and consolidated exposures.

6. If credit limits are exceeded, exceptions should be resolved according to the
   institution’s policies and procedures. In addition, the institution’s reports should adequately provide traders and credit officers with relevant, accurate and timely information abont the credit exposures and approved credit lines.
7. Similar to bank loans, OTC derivatives products can have credit cxposurcs
   existing for an extended period. Given these potentially long-term exposures and the complexity associated with some derivatives instruments, an institution should consider the overall financial strength of its countcrparties and their ability to perform on their obligations. Market risk
8. Market risk is the risk to an institution’s financial condition resulting from adverse
   movements in the level or volatility of market prices. The market risks created - or hedged - by a future or swap are familiar, although not necessarily straightforward to manage. They are exposures to changes in the price of the underlying cash instrument and to changes in interest rates. By contrast, the value of an option is also affected by other factors, including the volatility of the price. of the underlying instrument and the passage of time. In addition, all trading activities are affected by market liquidity and by local or world political and economic events.
9. Market risk is increasingly measured by market participants using a value-at-risk
   approach, which measures the potential gain or loss in a position, portfolio or institution that is associated with a price movement of a given probability over a specified time horizon. The institution should revalue all trading portfolios and calculate its exposures at least daily. Although an institution may use risk measures other than value-at-risk. the measure used shouid be sufficiently accurate and rigorous, and the institution should ensure that it is adequately incorporated into its risk management process. IO. An institution should compare its estimated market risk exposures with actual behaviour. In particular, the output of any market risk models that require simulations or forecasts of future prices should be compared with actual results. If the projected and actual results differ materially, the assumptions used to derive the projections should be carefully reviewed or the models should be modified, as appropriate.
10. The institution should establish limits for market risk that relate to its risk
    measures and that are consistent with maximum exposures authorised by its senior management and board of directors. These limits should be allocated to business units and individual decision makers and be clearly understood by all relevant parties. Exceptions to limits should be detected and adequately addressed by management. In practice, some limit

-ISsystems may include additional elements such as stop-loss limits and guidelines that may p]ay an important role in controlling risks.
12. An institution whose derivatives activities are limited in volume and confined to
end-user activities may need less sophisticated risk measurement systems than those required by a dealer. Senior management at such an institution should ensure that a]] significant risks arising from its derivatives transactions can be quantified, monitored and controlled. At a minimum, risk management systems should evaluate the possible impact on the institution’s earnings and capital which may result from adverse. changes in interest rates and other market conditions that arc relevant to risk exposure and the effectiveness of derivatives transactions in the institution’s overall risk management. Liquidity risk
13. An institution faces two types of liquidity risk in its derivatives activities: one
related to specific products or markets and the other related to the genera] funding of the institution’s derivatives activities. The former is the risk that an institution may not be able to, or cannot easily, unwind or offset a particular position at or near the previous market price because of inadequate market depth or because of disruptions in the marketplace. Funding liquidity risk is the risk that the institution will be unable to meet its payment obligations on settlement dates or in the event of margin calls. Because neither type of liquidity risk is necessarily unique to derivatives activities, management should evaluate these risks in the broader context of the institution’s overall liquidity. When establishing limits, the institution should be aware of the size, depth and liquidity of the particular market and establish guidelines accordingly.
14. In developing guidelines for controlling liquidity risks, an institution should
consider the possibility that it could lose access to one or more markets, either because of concerns about the institution’s own creditworthiness. the creditworthiness of a major counterparty or because of generally stressful market conditions. At such times, the institution may have less flexibility in managing its market, credit and liquidity risk exposures. An institution that makes markets in over-the-counter derivatives or that dynamically hedges2 its positions requires constant access to financial markets and that need may increase in times of market stress. The institution’s liquidity plan should reflect the institution’s ability to turn to alternative markets, such as futures or cash markets, or to provide sufficient collateral or other credit enhancements in order to continue trading under a broad range of scenarios.
15. An institution that participates in over-the-counter derivatives markets should
assess the potential liquidity risks associated with the early termination of derivatives contracts. Many forms of standardised contracts for derivatives transactions allow

• l6-
  counterpatties to request collateral or to terminate their contracts early if the institution experiences an adverse credit event or a deterioration in its financial condition. In addition, under conditions of market stress. customers may ask for the early termination of some contracts within the context of the dealer’s market making activities. In such situations, an institution that owes money on derivatives transactions may be required to deliver collateral or settle a contract early and possibly at a time when the institution may face other funding and liquidity pressures. Early terminations may also open up additional, unintended, market positions. Management and directors should be aware of these potential liquidity risks and should address them in the institution’s liquidity plan and in the broader context of the institution’s liquidity management process. Operadons risk

16. Operations risk is the risk that deficiencies in information systems or internal
    controls will result in unexpected loss. This risk is associated with human error, system failures and inadequate procedures and controls. This risk can be exacerbated in the case of certain derivatives because of the complex nature of their payment structures and calculation of their values.
17. The board of directors and senior management should ensure the proper
    dedication of resources (financial and personnel) to support operations and systems development and maintenance. The operations unit for derivatives activities, consistent with other trading and investment activities, should report to an independent unit and should be managed‘indepmdently of the business unit. The sophistication of the systems support and operational capacity should be commensurate with the size and complexity of the derivatives business activity.
18. Systems support and operational capacity should bc adequate to accommodate the
    types of derivatives activities in which the institution engages. This includes the ability to i efficiently process and settle the volumes transacted through the business unit, to provide support for the complexity of the transactions booked and to provide accurate and timely input. Support systems and the systems developed to interface with the official databases should generate accurate information sufficient to allow business unit management and senior management to monitor risk exposures in a timely manner.
19. Systems needs for derivatives activities should be evaluated during the strategic
    planning process. Current and projected volumes should be considered together with the nature of the derivatives activity and the user’s expectations. Consistent with other systems plans, a written contingency plan for derivatives products should be in place.
20. With the complexity of derivatives products and the size and rapidity of
    transactions, it is essential that operational units be able to capture all relevant details of transactions, identify errors and process payments or move assets quickly and accurately. This requires a staff of sufficient size, knowledge and experience to support the volume and type

• l7-
  of transactions generated by the business unit. Management should develop appropriate hiring practices and compensation plans to recruit and retain high calibre staff.

21. Systems design and needs may vary according to the size and complexity ofthe
    derivatives business. However, each system should provide for accurate and timely processing and allow for proper risk exposure monitoring. Operational systems should be tailored to each institution’s needs. Limited end-users of derivatives may not require the same degree of automation needed by more active trading institutions. All operational systems and units should adequately provide for basic processing, settlement and control of derivatives transactions.
22. The more sophisticated the institution’s activity, the more need there. is to
    establish automated systems to accommodate the complexity and volume of the deals transacted, to report position data accurately and to facilitate efficient reconciliation.
23. Segregation of operational duties, exposure reporting and risk monitoring from
    the business unit is critical to proper internal control. Proper internal control should be provided over the entry of transactions into the database, transaction numbering, date and time notation and the confirmation and settlement processes. Operational controls should also be in place to resolve disputes over contract specifications. In this regard, an institution must ensure that trades are confirmed as quickly as possible. The institution should monitor the consistency between the terms of a transaction as they were agreed upon and the terms as they were subsequently contirmcd.
24. The operations department, or another unit or entity independent of the business
    unit, should be responsible for ensuring proper reconciliation of front and back office databases on a regular basis. This includes the verification of position data, profit and loss figures and transaction-by-transaction details.
25. The institution should ensure that the methods it uses to value its derivatives
    positions are appropriate and that the assumptions underlying those methods arc reasonable.
    The pricing procedures and models the institution chooses should be consistently applied and well-documented Models and supporting statistical analyses should be validated prior to use and as market conditions warrant.
26. Management of the institution should ensure that a mechanism exists whereby
    derivatives contract documentation is confirmed, maintained and safeguarded An institution should establish a process through which documentation exceptions are monitored and resolved and appropriately reviewed by senior management and legal counsel. The institution should also have approved policies that specify documentation requirements for derivatives activities and formal procedures for saving and safeguarding important documents that are consistent with legal requirements and internal policies.
27. Although operations risks are difficult to quantify, they can often be evaluated by
    examining a series of “worst-case” or “what it” scenarios, such as a power loss, a doubling of

• 18-
  transaction volume or a mistake found in the pricing software for-collateral management.
  They can also be assessed through periodic reviews of procedures, documentation requirements, data processing system-s, contingency plans and other operational practices.
  Such reviews may help to reduce the likelihood of errors and breakdowns in controls, improve the control of risk and the effectiveness of the limit system and prevent unsound marketing practices and the premature adoption of new products or lines of business. Considering the heavy reliance of derivatives activities on computerised systems, an institution must have plans that take into account potential problems with its normal processing procedures. Legal risk

28. Legal risk is the risk that contracts are not legally enforceable or documented
    correctly.~Legal risks should be limited and managed through policies developed by the institution’s legal counsel (typically in consultation with officers in the risk management process) that have been approved by the institution’s senior management and board of directors. At a minimum, there should be guidelines and processes in place to ensum the enforceability of counterparty agreements.
29. Prior to engaging in derivatives transactions, an institution should reasonably
    satisfy itself that its counterpart& have the legal and necessary regulatory authority to engage in those transactions. In addition to determinmg the authority of a counterparty to enter into a derivatives transaction, an institution should also reasonably satisfy itself that the terms of any contract governing its derivatives activities with a counterparty are legally sound.
30. An institution should adequately evaluate the enforceability of its agreements
    before individual transactions arc co nsummated. Participants in the derivatives markets have experienced significant losses because they were unable to recover losses from a defaulting counterparty when a court held the counterparty had acted outside of its authority in entering into such transactions. An institution should ensure that its counterparties have the power and authority to enter into derivatives transactions and that the counterpart&’ obligations arising from them are enforceable. Similarly, an institution should also ensure that its tights with respect to any margin or collateral received from a countcrparty are enforceable and exercisable.
31. The advantages of netting arrangements can include a reduction in credit and
    liquidity risks, the potential to do more business with existing counterparties within existing credit lines and a reduced need for collateral to support counterpatty obligations. The institution should ascertain that its netting agreements are adquately documented and that they have been executed properly. Only when a netting arrangement is legally enforceable in all relevant jurisdictions should an institution monitor its credit and liquidity risks on a net basis.

• 19-

32. The institution should have knowledge of rclcvant taxlaws and interpretations
    governing the use of derivatives instruments. Knowledge of these laws is ncccssary not only for the institution’s marketing activities but also for its own use of these products.
    Basic, July 1994