Guideline on Risk Management of Derivatives and Other Traded Instruments

Ref. CB/POL/6/67 27 March 1996
The Chief Executive
All Authorized Institutions
Dear Sir/Madam,
Guideline on Risk Management of Derivatives and Other Traded Instruments The Monetary Authority (“MA”) issued in December 1994 a guideline on “Risk Management of Financial Derivatives Activities” to set out the basic principles of a prudent system to control the risks in derivatives activities. That guideline focused on high level controls. As indicated earlier, the MA is now issuing a further guideline which provides more detailed guidance on specific, in particular the operational, aspects of the process for managing the risks of authorized institutions' derivatives activities. Given that the derivatives market and risk management in this area are still rapidly evolving, the guideline is not yet being issued under section 7(3) of the Ordinance. The MA has finalized the operational guideline following consultation with the Hong Kong Association of Banks, the Deposit￾taking Companies Association, the Hong Kong Society of Accountants and the International Swap and Derivatives Association. The guideline has also been endorsed by the Banking Advisory Committee and the Deposit-taking Companies Advisory Committee. A copy of the guideline, entitled "Guideline on Risk Management of Derivatives and Other Traded Instruments" is enclosed. While the guideline is relevant to the trading of financial instruments in general, it concentrates particularly on the trading of derivatives. This reflects the rapid growth in these instruments, the opportunities for increased leverage which they offer and the complexity of some derivatives products which may complicate the task of risk management. The guideline is not intended to break new ground in the risk management of trading activities. It is mainly based on observations

from, and weaknesses identified in, the surveys and treasury visits conducted by the MA since December 1994; the findings of the review of internal controls systems in respect of trading activities carried out by authorized institutions in March 1995 in response to the MA’s request following Barings collapse; the recommendations of the Group of Thirty and the lessons learned from the cases of Barings and Daiwa having regard to the official reports on the Barings collapse issued in the UK and Singapore. The guideline covers the following specific areas:
. Risk management and corporate governance . Board and senior management oversight . Identification and measurement of risks . Limiting risks . Operational controls. All authorized institutions and the subsidiaries of all locally incorporated authorized institutions which engage in the trading of financial instruments are expected to follow the risk management practices set out in the guideline. The guideline acknowledges that the actual risk management processes that should be put in place should be commensurate with the nature, size and complexity of individual institutions’ trading activities. In general, institutions which are active dealers or active position-takers will require a more elaborate system of risk management. The MA will during the course of its supervision of institutions' trading activities, classify institutions into four categories :
active dealers, dealers, active position-takers and limited end-users. We will communicate the classification to the institutions concerned in due course and assess the adequacy of institutions' risk management system against this classification. Should you have any questions on the guideline, please feel free to contact Ms. Rose Luk (2878 8218) or Mr. Frederic Lau (2878 1620). Yours faithfully, ( D T R Carse ) for Monetary Authority

c.c. SFS (Attn. Mr. Albert Lam)
SFC (Attn. Mr. Siva Singham)
Hong Kong Society of Accountant (Attn. Mr. James Fawls) Auditors of authorized institutions

---

Enclosure - Guideline on Risk Management of Derivatives and Other Traded Instruments

GUIDELINE ON RISK MANAGEMENT OF DERIVATIVES AND OTHER TRADED INSTRUMENTS Introduction

1. The Monetary Authority (MA) issued in December 1994 a
   guideline on "Risk Management of Financial Derivative Activities" to set out the basic principles of a prudent system to control the risks in derivatives activities. These include:
   a) appropriate oversight by the board of directors and senior management; b) adequate risk management process that integrates prudent risk limits, sound measurement procedures and information systems, continuous risk monitoring and frequent management reporting; and c) comprehensive internal controls and audit procedures.

2. This Guideline supplements the December 1994 Guideline
   by providing additional guidance relating to specific aspects of the risk management process. It has taken account of observations from, and weaknesses identified in, the surveys and treasury visits conducted by the MA since December 1994; the findings of the review of internal control systems in respect of trading activities carried out by authorized institutions in March 1995 in response to the MA's request following the collapse of Barings; the recommendations of the Group of Thirty and the lessons learned from the cases of Barings and Daiwa Bank having regard in particular to the official reports on the Barings collapse issued in the UK and Singapore. While this Guideline is relevant to the trading of financial instruments in general, it concentrates particularly on the trading of derivatives. This reflects the rapid growth in these instruments, the opportunities for increased leverage which they offer and the complexity of some derivatives products which may complicate the task of risk management. The present guideline should be read in conjunction with the December 1994 Guideline.

3. It should be emphasized right at the outset that the
   problems of Barings and Daiwa Bank arose to a large extent from a failure of basic internal controls, such as lack of segregation of duties. The valuation and measurement challenges posed by complex derivatives products should not distract institutions from the need to ensure that the basic controls are in place.

4. This Guideline applies to all authorized institutions and to
   the subsidiaries of all locally incorporated authorized institutions which engage in trading activities. Trading in this context includes market￾making, position-taking, arbitrage and trading on behalf of customers. Broadly speaking, institutions which trade in derivatives can be classified into two main categories: dealers and end-users. Dealers market derivatives products to customers and usually also trade for their own account. This group can be further subdivided into dealers who provide quotes to other market professionals (as well as to customers) and other dealers who provide quotes only to customers or are less active. End-users trade only for their own account. They are divided into active position-takers who trade frequently for their own account and take large positions, and limited end-users who are characterised by smaller portfolios, less complex products, and lower transaction volume. The actual risk management processes that should be put in place should be commensurate with the nature, size and complexity of individual institutions' trading activities. An institution which is an active dealer or position-taker will require a more elaborate system of risk management. The MA will, during the course of its supervision of institutions' derivatives activities, classify institutions into the categories mentioned above (i.e. active dealers, dealers, active position-takers and limited end￾users) and will communicate this classification to the institutions concerned. It will assess the adequacy of institutions' risk management systems against this classification. Risk management and corporate governance

5. As the Barings case illustrated, the overall quality of risk
   management within an authorized institution cannot be divorced from the overall quality of its board and senior management, organizational structure and culture. It is particularly vital with potentially complex products such as derivatives that the board and senior management should understand the nature of the business which they are supposed to be controlling. This includes an understanding of the nature of the relationship between risk and reward, in particular an appreciation that it is inherently implausible that an apparently low risk business can generate high rewards. As in the case of Barings, unusually high reported profitability may be a sign that excessive risks are being taken (or that there may be false accounting).

6. The board and senior management also need to
   demonstrate through their actions and behaviour that they have a strong commitment to an effective control environment throughout the organization. This will be shown in part by the risk management policies which they approve (see paragraphs 12 to 15 below).

However, it is important to ensure that these policies do not simply exist on paper, but are also applied in practice. This will depend on such factors as the managerial and operational resources which are actually devoted to risk management within the institution, the support and back￾up which are given to internal audit and to the risk control unit (if it exists) and the action which is taken to deal with breaches of policies, procedures and limits. These are areas which are subject to examination by the MA.
7. The board and senior management should avoid giving
conflicting signals to employees by appearing to advocate prudent risk management while at the same time awarding large bonuses which are directly linked to short-term trading performance. This may encourage excessive risk-taking and at worse, deliberate falsification of positions and concealment of losses. In general, steady earnings from low risk positions are of higher quality than volatile earnings from high risk positions and should be awarded accordingly. Where bonuses are paid, management should consider how the possible adverse effects can be minimized, e.g. by relating bonuses to longer-term trading performance or risk adjusted performance, or by paying the bonuses over a period of time.
8. It is also the duty of the board and senior management to
ensure that the organization of the institution is conducive to managing risk. It is necessary to ensure that clear lines of responsibility and accountability are established for all business activities, including those which are conducted in separate subsidiaries.
9. A number of banks have adopted a system of "matrix
management" whereby their various business operations around the world report to product managers or function managers who have responsibility for products or particular business activities on a global or regional basis. This is combined with reporting to local country managers who should have an overview of the business as a whole within their particular geographical areas. Such a system was operated by Barings.
10. The matrix system can be helpful in ensuring that the risks
arising in the same product around the world are aggregated and centrally managed, thus making it easier to apply common standards and to manage the risks. However, if applied inappropriately, it can suffer from two main flaws, both of which were evident in the case of Barings:
a) it can result in confused reporting lines and blurred responsibilities where the local operation is reporting to a number of different product managers. This may lead to

lack of responsibility and control at the senior management level for the operation in question; and b) the local country manager may be either unwilling or unable (e.g. because of lack of a clear mandate) to exercise supervision over the business activities conducted within his jurisdiction.
11. Experience has shown that it is difficult to control a
trading operation from a distance. The central risk control function at the head office should ensure that there is sufficient awareness of the risks and the size of exposure of the trading activities conducted in overseas operations. The local country manager also needs to have sufficient understanding of the business in his territory and the formal authority to ensure that proper standards of control are applied (including segregation of duties between the front and back offices). This is also necessary so that he can communicate effectively with the local regulators. In the case of Hong Kong, the chief executive of the local branch of a foreign bank is fully accountable to the MA for the conduct of all the business conducted by the branch in Hong Kong, even if he is not functionally responsible for certain parts of the business. Board and senior management oversight
12. Consistent with its general responsibility for corporate
governance, the board should approve written policies which define the overall framework within which derivatives activities should be conducted and the risks controlled. The MA's observations over the last year are that a comprehensive set of such policies have been lacking in some institutions. This should be rectified if it has not already been done.
13. The policy framework for derivatives approved by the
board may be general in nature (with the detail to be filled in by senior management). But the framework should, among other things:
a) establish the institution's overall appetite for taking risk and ensure that it is consistent with its strategic objectives, capital strength and management capability. (Appetite for risk can be expressed in terms of the amount of earnings or capital which the institution is prepared to put at risk, and the degree of fluctuation in earnings, e.g. from position￾taking, which it is willing to accept);

b) towards this end, define the approved derivatives products and the authorized derivatives activities, e.g. market￾making, position-taking, arbitrage, hedging. (The nature of such exposure should be carefully defined to ensure, for example, that activities described as arbitrage do not in practice involve the taking of outright positions); c) detail requirements for the evaluation and approval of new products or activities. (This requires the board to approve the definition of what is meant by a "new" product, e.g. a change in the underlying instrument and hence in the risk, or a change in the capacity in which the institution trades the product, e.g. as dealer or end-user); d) provide for sufficient staff resources and other resources to enable the approved derivatives activities to be conducted in a prudent manner; e) ensure appropriate structure and staffing for the key risk control functions, including internal audit; f) establish management responsibilities; g) identify the various types of risk faced by the institution and establish a clear and comprehensive set of limits to control these; h) establish risk measurement methodologies which are consistent with the nature and scale of the derivatives activities; i) require stress testing of positions ; and j) detail the type and frequency of reports which are to be made to the board (or committees of the board).
14. The type of reports to be received by the board should
include those which indicate the levels of risk being undertaken by the institution, the degree of compliance with policies, procedures and limits, and the financial performance of the various derivatives and trading activities. Internal and external audit reports should be reviewed by a board level Audit Committee and significant issues of concern should be drawn to the attention of the board. More detailed information should be supplied to senior management, including that which splits risk exposure, positions and profitability by regions,

business units and products and which analyses exposure to the various market variables (interest rates, exchange rates etc.).
15. Branches of foreign banks which trade in derivatives in
Hong Kong should operate within policies and procedures which are approved by head office and which are consistent with those approved by the board for the bank as a whole. Regular reports on risk exposure, positions and profitability should be submitted to head office. The identification of risk
16. Institutions should identify the various types of risk to
which they are exposed in their derivatives activities. As set out in the December 1994 Guideline, the main types of risk are:
. credit risk
. market risk
. liquidity risk
. operational risk
. legal risk
Definitions of these are set out in Annex A.
17. Operational risk, involving the risk of loss from inadequate
systems of control, was a key feature of the Barings and Daiwa Bank cases. The Daiwa Bank case also demonstrated how an initial loss arising from failure of controls can be compounded by regulatory risk, i.e. the risk of loss arising from failure to comply with regulatory or legal requirements, and reputation risk, i.e. the risk of loss arising from adverse public opinion and damage to reputation. In this context, institution should promptly inform the MA of any fraud or trading malpractices by staff, particularly those which could result in financial or reputational loss by the institution concerned.

Reputation risk and appraisal of counterparties
18. The complexity of some derivatives products and the
amount of leverage involved (which increases the potential for loss as well as profit) may expose authorized institutions to an additional element of reputation risk if counterparties who have lost money on derivatives contracts complain publicly that they were misled about the risks or take legal action. The authorized institution may also be exposed to credit risk if the counterparty fails to meet his financial obligations under the contract. This risk can arise in respect of both corporate and personal customers (particularly in the private banking area). The MA has come across a number of the latter cases in 1995.
19. For the institution's own protection, the board should
approve clear written policies to address the issues of selection and appraisal of counterparties, risk disclosure and handling of disputes and complaints. Such policies and procedures were lacking in a number of authorized institutions whose controls were reviewed in 1995. The objective of such policies and procedures is prudential in nature : to protect an authorized institution against the credit, reputation and litigation risks that may arise from a counterparty's inadequate understanding of the nature and risks of the derivatives transaction. Such counterparties may not fully understand their obligations under the derivatives contracts and therefore may be unable to anticipate and plan for the risks these obligations entail. This gives rise to a higher than normal risk of default and a greater potential for litigation and damage to the authorized institution's reputation. As in the case of an ordinary credit facility, the MA expects that, as part of its credit analysis, an authorized institution will :
a) analyze the expected impact of the proposed derivatives transaction on the counterparty; b) identify whether the proposed transaction is consistent with the counterparty's policies and procedures with respect to derivatives transactions, as they are known to the institution; and c) ensure that the terms of the contract are clear and assess whether the counterparty is capable of understanding the terms of the contract and of fulfilling its obligations under the contract.
20. Where the institution considers that a proposed derivatives
transaction is inappropriate for a counterparty, it should inform the counterparty of its opinion. If the counterparty nonetheless wishes to

proceed, the institution should document its analysis and its discussions with the counterparty in its files to lessen the chances of litigation in case the transaction proves unprofitable to the counterparty. If the institution considers that the counterparty may be financially incapable of meeting its obligations, or that undue reputation risk may arise from adverse publicity if the counterparty loses money, the institution should consider very carefully whether it should enter into the transaction at all. Institutions should exercise extra care in respect of complicated derivatives transactions in view of the additional credit, reputation and litigation risks to which they may give rise.
21. It is important that the institution understands clearly the
nature of its relationship with the counterparty and the obligations which may flow from that. The issue of whether the transaction is an appropriate one for the counterparty to undertake does not generally arise in respect of transactions where the institution acts on the instructions of the client in the capacity of broker or agent. For transactions which the institution entered into on a principal-to-principal basis, it is recognized that the transaction is essentially on an arm's length basis and that counterparties are ultimately responsible for the transactions they choose to make. However, as noted in paragraph 19 above, the MA considers that internal policies and procedures are still required to guard against the credit risk that may arise from the counterparty's inadequate understanding of the nature and risks of the transaction and to protect the institution against complaints or litigation on the ground of misrepresentation in respect of any information which it chooses to provide to the counterparty. For transactions where an institution has agreed to assume the role of an advisor, the institution needs to be aware that it owes the client a duty to tender its advice fully, accurately and properly.
22. Authorized institutions should also be aware that the
degree of complexity of the transaction and the level of sophistication of the counterparty are factors which a court may take into account in considering whether the institution has in practice assumed an advisory role in relation to the counterparty (even if no explicit agreement to that effect has been entered into). A wider duty of care may be allowed by the courts in a case involving a highly sophisticated transaction and a relatively unsophisticated counterparty. In those circumstances, there is a possibility that the courts may be more likely to accept evidence that an authorized institution had assumed a responsibility to advise the counterparty on issues such as risk and suitability. It is also noted that where an institution provides information to enable its counterparties to understand the nature and risks of a transaction, it should:
a) ensure that the information is accurate;

b) ensure that information in any economic forecast is reasonable, based on proper research and reasonable grounds; and c) present the downside and upside of the proposal in a fair and balanced fashion.
23. To guard against the possibility of misunderstandings,
particularly with private banking customers, all significant communications between the institution and its customers should be in writing or recorded in meeting notes. Where it is necessary for an account manager to speak to the customer by telephone, such conversations should be tape-recorded.
24. Institutions should establish internal procedures for
handling customer disputes and complaints. They should be investigated thoroughly and handled fairly and promptly. Senior management and the Compliance Department/Officer should be informed of all customer disputes and complaints at a regular interval. Cases which are considered material, e.g. the amount involved is very substantial, should be reported to the board and the MA. Risk measurement
25. Having identified the various types of risk, the authorized
institution should as far as possible attempt to measure and aggregate them across all the various trading and non-trading activities in which it is engaged.
26. The risk of loss can be most directly quantified in relation
to market risk and credit risk (though other risks may have an equally or even greater adverse impact on earnings or capital if not properly controlled). These two types of risks are clearly related since the extent to which a derivatives contract is "in the money" as a result of market price movements will determine the degree of credit risk. This illustrates the need for an integrated approach to the risk management of derivatives. The methods used to measure market and credit risk should be related to:
a) the nature, scale and complexity of the derivatives operation; b) the capability of the data collection systems; and

c) the ability of management to understand the nature, limitations and meaning of the results produced by the measurement system.
27. The MA has observed that the risk measurement
methodologies of a number of authorized institutions are relatively simple and unsophisticated despite the fact that they are quite active market participants. In particular, the use of notional contract amounts to measure the size of market or credit risk (and to set limits) is insufficient in itself and should be confined to limited end-users (and even then only on a temporary basis until a more sophisticated risk measurement system has been devised). It should be noted however that although more sophisticated methodologies measure risk more accurately, they also introduce added assumption and model risk. In particular, the assumption in "value-at-risk" models (see below) that changes in market risk factors (such as interest rates) are normally distributed, may not hold good in practice. Mark-to-market
28. The measurement process starts with marking to market of
positions. This is necessary to establish the current value of positions and to record profits and losses in the bank's books. It is essential that the revaluation process is carried out by an independent risk control unit or by back office staff which are independent of the risk-takers in the front office, and that the pricing factors used for revaluation are obtained from a source which is independent of the front office or are independently verified. A number of authorized institutions have not adopted this practice. (Ideally, the methodologies and assumptions used by the front and back offices for valuing positions should be consistent, but if not there should be a means of reconciling differences.) For active dealers and active position-takers, positions should be marked to market on a daily basis. Where appropriate, intra-day or real-time valuation should be used for options and complex derivatives portfolios (this may be performed by dealing room staff provided that the end-of-day positions are subject to independent revaluations).
29. To ensure that trading portfolios are not overvalued, active
dealers and active position-takers should value their trading portfolios based on mid-market prices less specific adjustments for expected future costs such as close-out costs and funding costs. Limited end-users may use bid and offer prices, applying bid price for long positions and offer price for short positions.

Measuring market risk
30. The risk measurement system should attempt to assess the
probability of future loss in derivative positions. In order to achieve this objective, the system should attempt to estimate:
a) the sensitivity of the instruments in the portfolio to changes in the market factors which affect their value (e.g. interest rates, exchange rates, equity prices, commodity prices and volatilities); and b) the tendency of the relevant market factors to change based on past volatilities and correlations.
31. The common methodologies used by authorized
institutions in Hong Kong to measure market risk include notional amounts, month-million, duration and price value basis point. These methods generally fail fully to satisfy both the criteria specified in the previous paragraph. The approach which is best suited for this purpose is "value at risk" which is recommended by both the Group of Thirty and the Basle Committee. The value-at-risk approach measures the expected loss in a position or portfolio that is associated with a given probability and a specified time horizon. The above methodologies are summarized in Annex B.
32. Active dealers and active position-takers in derivatives are
recommended to adopt the value-at-risk approach, although it is recognized that it will take time to install the necessary systems. Institutions which trade derivatives in a different capacity (particularly limited end-users) may use less sophisticated methodologies but should adopt correspondingly more conservative trading strategies and limits.
33. Statistical models used to calculate value at risk may use a
variety of different approaches (e.g. variance/covariance, historical simulation, Monte Carlo simulation). The choice is a matter for the institution concerned, but where models are to be used for measuring capital adequacy for supervisory purposes, the Basle Committee has specified that common minimum standards should be adopted (including a 99% one-tailed confidence interval and a minimum holding period of 10 days). The Basle standards are summarized in the attached Annex C.
34. The MA will have regard to these standards in evaluating
the value-at-risk models used by authorized institutions in Hong Kong for managing their trading risk. It is recognized that models used for this purpose may incorporate assumptions which are different from those recommended by the Basle Committee. In particular, it is common to

use a holding period of only one day for the measurement of potential changes in position values. This assumption will however only hold good for liquid instruments in normal market conditions. For instruments or markets where there is significant concern about liquidity risk, a longer holding period should be used (e.g. 10 days) or more conservative limits should be adopted.
35. The assumptions and variables used in the risk
management method should be fully documented and reviewed regularly by the senior management, the independent risk management unit (if it exists) and internal audit. Stress tests
36. Regardless of the measurement system and assumptions
used to calculate risk on a day-to-day basis, institutions should conduct regular stress tests to evaluate the exposure under worst-case market scenarios (i.e. those which are possible but not probable). Stress tests need to cover a range of factors that could generate extraordinary losses in trading portfolios or make the control of risk in these portfolios very difficult. Stress scenarios may take account of such factors as the largest historical losses actually suffered by the institution and evaluation of the current portfolio on the basis of extreme assumptions about movements in interest rates or other market factors or in market liquidity. The results of the stress testing should be reviewed regularly by senior management and should be reflected in the policies and limits which are approved by the board of directors and senior management.
37. All institutions which are active in derivatives in Hong
Kong are recommended to conduct regular stress testing of their portfolios. This should be carried out both by local risk managers and on a consolidated basis by the head office risk control function. A significant number of institutions have not previously done so. Options
38. The measurement of the market risk in options involves
special considerations because of their non-linear price characteristics. This means that the price of an option does not necessarily move in a proportionate relationship with that of the underlying instrument, principally because of gamma and volatility risk. (A description of these risks and the other risks in options is given in Annex D.) Measurement of risk exposure of an options portfolio may therefore require the use of simulation techniques to calculate, for example, changes in the value of the options portfolio for various combinations of changes in the prices of the underlying instruments and changes in volatility. The risk exposure

would be calculated from that combination of price and volatility change that produced the largest loss in the portfolio. Other more elaborate simulation techniques may be used. In general, given the additional complexity of risk measurement and management of options, the MA would expect active trading in options to be confined to the more sophisticated authorized institutions. Measuring credit risk
39. The credit risks of derivatives products have two
components: pre-settlement risk and settlement risk. They should be monitored and managed separately. A number of authorized institutions have not done this in respect of settlement risk.
40. Pre-settlement risk is the risk of loss due to a counterparty
defaulting on a contract during the life of a transaction. It varies throughout the life of the contract and the extent of loss will only be known at the time of default. To measure pre-settlement risk, authorized institutions should not rely solely on the notional amounts of derivatives contracts which provide only an indication of the volume of business outstanding and bear little relation to the underlying risk of the exposure. That risk is conditional on the counterparty defaulting and the contract having positive mark-to-market value to the institution at the time of default. However, even contracts which presently have a zero or negative mark-to-market value to the institution (and where there is thus no current loss exposure) have potential credit risk because the value of the contract can become positive at any time prior to maturity as a result of market movements.
41. All authorized institutions are encouraged to calculate pre￾settlement risk by summing the current exposure of a contract (i.e. the
mark-to-market value, if positive) and an estimate of the potential change in value over the remaining life of the contract (the "add-on"). Where legally enforceable netting agreements are in place, the current exposure for a given counterparty may be calculated by netting contracts with that counterparty which have negative mark-to-market value against those which have positive value. The Guideline on Amendment to the 1988 Capital Accord for Bilateral Netting issued by the MA in February 1995 sets out the conditions under which the MA will be prepared to recognize netting arrangements for capital adequacy purposes.
42. Active dealers and active position-takers may use their
own simulation techniques to measure potential future exposure, or else may use the add-ons specified by the Basle Committee for capital adequacy purposes. A less sophisticated approach is to measure the total pre-settlement risk by multiplying the notional amount of the

contract by percentage factors which depend on the numbers of years of the contract (the "original exposure" method). This method is not recommended for authorized institutions.
43. Settlement risk arises where securities or cash are
exchanged and can amount to the full value of the amounts exchanged. In general, the time-frame for this risk is quite short and arises only where there is no delivery against payment. Limits
44. A comprehensive set of limits should be put in place to
control the market, credit and liquidity risk of the institution in derivatives and other traded instruments. These should be integrated as far as possible with the overall institution-wide limits for these risks. For example, the credit exposure for a particular counterparty arising from derivatives should be aggregated with all other credit exposures for that counterparty and compared with the credit limit for that counterparty. As noted earlier, the aggregate limits for the amount of risk to be incurred by the institution in its derivatives activity and the broad structure of the limits should be approved by the board. The aggregate limits can then be allocated and sub-allocated by management. The system of limits should include procedures for the reporting and approval of exceptions to limits. It is essential that limits should be rigorously enforced and that significant and persistent breaches of limits should be reported to senior management and fully investigated. Market risk limits
45. Market risk limits should be established at different levels
of the institution, i.e. the institution as a whole, the various risk-taking units, trading desk heads and individual traders. It may also be appropriate to supplement these with limits for particular products. In determining how market risk limits are established and allocated, management should take into account factors such as the following:
a) past performance of the trading unit; b) experience and expertise of the traders; c) level of sophistication of the pricing, valuation and measurement systems; d) the quality of internal controls;

e) the projected level of trading activity having regard to the liquidity of particular products and markets; and f) the ability of the operations systems to settle the resultant trades.
46. Some commonly used market risk limits are : notional or
volume limits, stop loss limits, gap or maturity limits, options limits and value-at-risk limits. These are described in Annex D. The selection of limits should have regard to the nature, size and complexity of the derivatives operation and to the type of risk measurement system. In general, the overall amount of market risk being run by the institution is best controlled by value-at risk limits. These provide senior management with an easily understood way of monitoring and controlling the amount of capital and earnings which the institution is putting at risk through its trading activities. The limits actually used to control risk on a day-to-day basis in the dealing room or at individual trading desks may be expressed in terms other than value at risk, but should provide reasonable assurance that the overall value-at-risk limits set for the institution will not be exceeded. Regular calculation of the value at risk in the trading portfolio should therefore be conducted to ensure that this is indeed the case.
47. It should be emphasized that no means of expressing limits
can give absolute assurance that greater than expected losses will not occur. Even the value-at-risk approach, while recommended for active dealers and active position-takers, has its own limitations in providing protection against unpredictable events. Limits set by the institution on this basis should therefore cater for such events, taking into account the results of the stress tests run by the institution (see above). Other types of limits are less sophisticated than value at risk and are generally not sufficient in isolation (unless only a limited and conservative trading strategy is being pursued), but they may be useful for certain purposes and when used in conjunction with other measures.
48. Stop loss limits may be useful for triggering specific
management action (e.g. to close out the position) when a certain level of unrealized losses are reached. They do not however control the potential size of loss which is inherent in the position or portfolio (i.e. the value at risk) and which may be greater than the stop loss limit. They will thus not necessarily prevent losses if the position cannot be exited (e.g. because of market illiquidity). Consideration must be given to the period of time over which the unrealised loss is to be controlled: too long a period (e.g. a year) may allow large unrealized losses to build up before management action is triggered. Limits for shorter periods may be advisable (e.g. on a monthly basis).

49. Limits based on the notional amount or volume of
    derivatives contracts do not provide a reasonable proxy for market (or credit) risk and thus should not generally be acceptable on a stand-alone basis. (A number of authorized institutions have been relying solely on notional limits.) Volume limits can however have some use in controlling operational risk (i.e. as regards the processing and settling of trades) and also liquidity and concentration risk. Such a risk might arise for example, as it did in the case of Barings, from having a substantial
    part of the open interest in exchange-traded derivatives (particularly in
    less liquid contracts.) The Barings case also illustrates that for activities such as arbitrage, it is necessary to set limits on the gross as well as the net positions in order to control over-trading and limit the amount of funding which is required for margin payments. (A number of authorized institutions have not been monitoring the growth of gross positions.)

50. It may be appropriate to set limits on particular products or
    maturities (as well as on portfolios) in order to reduce market and liquidity risk which would arise from concentrations in these. (Some institutions have not been doing this.) Similarly, options risk can be controlled by concentration limits based on strike price and expiration date. This reduces the potential impact on earnings and cash flow of a large amount of options being exercised at the same time. Credit limits

51. Institutions should establish both pre-settlement credit
    limits and settlement credit limits (not all have been doing this). The former should be based on the credit-worthiness of the counterparty in much the same way as for traditional credit lines. The size of the limits should take into account the sophistication of the risk measurement system: if notional amounts are used (which is not recommended), the limits should be correspondingly more conservative.

52. It is important that authorized institutions should establish
    separate limits for settlement risk. The amount of exposure due to settlement risk often exceeds the credit exposure arising from pre￾settlement risk because settlement of derivatives transactions may involve the exchange of the total value of the instrument or principal cash flow. Settlement limits should have regard to the efficiency and reliability of the relevant settlement systems, the period for which the exposure will be outstanding, the credit quality of the counterparty and the institution's own capital adequacy. Liquidity limits

53. The cash flow/funding liquidity risk in derivatives can be
    dealt with by incorporating derivatives into the institution's overall liquidity policy and, in particular, by including derivatives within the structure of the maturity mismatch limits. A particular issue is the extent to which institutions take account of the right which may have been granted to counterparties to terminate a derivatives contract under certain specified circumstances, thus triggering an unexpected need for funds. (The results of the MA's survey conducted in early 1995 suggested that a significant proportion of institutions do not take account of such early termination clauses in planning their liquidity needs.)

54. As the Barings' case demonstrates, it is also necessary for
    institutions to take into account the funding requirements which may arise because of the need to make margin payments in respect of exchange-traded derivatives. The institution should have the ability to distinguish between margin calls which are being made on behalf of clients (and monitor the resultant credit risk on the clients) and those which arise from proprietary trades. Where the institution is called upon to provide significant funding in respect of derivatives activities undertaken in a subsidiary, the institution should carefully monitor the amount involved against limits for that subsidiary and investigate rapid growth in the subsidiary's funding needs.

55. As noted earlier, the market or product liquidity risk that
    arises from the possibility that the institution will not be able to exit derivatives positions at a reasonable cost, can be mitigated by setting limits on concentrations in particular markets, exchanges, products and maturities. Independent risk control

56. There should be a means within each authorized institution
    of independently monitoring and controlling the various risks in derivatives (and other trading activities). The precise way in which the risk control function is organized in each institution will vary depending on the nature, size and complexity of its derivatives operation. Different types of risks may be monitored and controlled by different departments and units. For example, the credit risk in derivatives may be subject to the oversight of that department of the institution which monitors its credit risk as a whole. As noted earlier, however, the inter-relationship between the different types of risks needs to be taken into account. (An Asset and Liability Committee of the board may be a suitable forum for doing this.)

57. Institutions which are active dealers or active position￾takers in derivatives should maintain a separate unit which is responsible
    for monitoring and controlling the market risk in derivatives. This should report directly to the board (or Asset and Liability Committee) or to senior management who are not directly responsible for trading activities. Such management should have the authority to enforce both reductions of positions taken by individual traders and in the bank's overall risk exposure. Where the size of the institution or its involvement in derivatives activities does not justify a separate unit dedicated to derivative activities, the function may be carried out by support personnel in the back office (or in a "middle office") provided that such personnel have the necessary independence, expertise, resources and support from senior management to do the job effectively.

58. Whatever form the risk control function takes, it is
    essential that it is distanced from the control and influence of the trading function. In particular, it is unacceptable for risk control functions of the type described in paragraphs 59 and 60 to be carried out by dealing room staff (the MA has come across a number of cases where this has been the practice).

59. The minimum risk control functions which should be
    performed include the following:
    a) the monitoring of market risk exposures against limits and the reporting of exceptions to management outside the trading area; b) the marking-to-market of risk exposures and the performance of reconciliation of positions and profit/loss between the front and back offices; c) the preparation of management reports, including daily profit/loss results and gross and net positions; and d) the monitoring of credit exposures to individual counterparties against limits and the reporting of exceptions to management outside the trading area (as noted earlier this function may be performed by the credit department).

60. For institutions which are active traders in derivatives, and
    in particular those which wish to satisfy the Basle Committee's criteria for the use of internal models to measure the capital requirements for market risk, the risk control function should also be actively involved in the design, implementation and ongoing assessment of the institution's

risk management system, and particularly its internal model. This will typically be done at head office level (perhaps with the assistance of local risk managers) and will include the following:
a) the development of risk management policies (including policies to ensure system security) and limits for approval by the board and senior management; b) the design and testing of stress scenarios; c) the regular back-testing of the measure of market risk (e.g. that generated by the internal value-at-risk model) against actual daily changes in portfolio value; d) the review and approval of pricing and valuation models used by the front and back offices, and the development of reconciliation procedures if different systems are used; and e) the generation of reports for the board and senior management covering such aspects as trends in aggregate risk exposure, the adequacy of and compliance with policies and risk limits and risk/return information.
61. The risk management system and the effectiveness and
independence of the risk control unit should themselves be subject to regular review by internal audit. Operational controls
62. Operational risk arises as a result of inadequate internal
controls, human error or management failure. This is a particular risk in derivatives activities because of the complexity and rapidly evolving nature of some of the products. The nature of the controls in place to manage operational risk must be commensurate with the scale and complexity of the derivatives activity being undertaken. As noted earlier, volume limits may be used to ensure that the number of transactions being undertaken does not outstrip the capacity of the support systems to handle them. Segregation of duties

63. Segregation of duties is necessary to prevent unauthorized
    and fraudulent practices. This has a number of detailed aspects but the fundamental principle is that there should be clear separation, both functionally and physically, between the front office which is responsible for the conduct of trading operations and the back office which is responsible for processing the resultant trades. Institutions must avoid a situation where the back office becomes subordinate to the traders as was the case with Barings. This gave rise to the situation where the head trader of the Singapore futures operation was able both to initiate trades and to control the way in which they were recorded and settled.
64. The MA has come across a number of cases in authorized
    institutions where segregation of duties is incomplete. For example:
    a) the mark-to-market process is performed by the front office instead of the back office (or separate risk control unit); b) the data used for marking to market are not obtained from sources independent of the front office or are not independently verified; c) reconciliation of the back office position reports to the front office records are not reviewed by personnel independent of the front office operations; d) incoming confirmations of deals are received in the first instance by dealers instead of the back office; e) dealing reports and profit/loss reports are either prepared by dealers or routed via dealers to senior management; f) limit monitoring is not carried out by personnel who are independent of the dealing room; and g) there is a lack of physical separation of the front and back offices.
65. The MA considers that such practices are unacceptable
    and has requested the institutions concerned to take remedial measures. In some cases, it has been argued that the deficiencies are not high risk because of the existence of compensating human and other controls and because of conservative trading strategies. While this may be true under normal circumstances, the lack of proper systems controls does create loopholes which can be exploited by unscrupulous individuals. The

Barings and Daiwa Bank cases show that trust placed in key individuals may be abused and that it is dangerous to assume that a fundamental weakness in controls can be mitigated by other, more superficial, checks and balances. Shortages of physical space or skilled personnel should not be used as an excuse to override normal control considerations.
66. A basic and essential safeguard against abuse of trust by
an individual is to insist that all staff should take a minimum period of annual leave (say 2 weeks) each year. This makes it more difficult to conceal frauds in the absence of the individual concerned. All institutions are recommended to follow this practice. Policies and procedures
67. Policies and procedures should be established and
documented to cover the internal controls which apply at various stages in the work flow of processing and monitoring trades. Apart from segregation of duties, these include:
. trade entry and transaction documentation . confirmation of trades . settlement and disbursement . reconciliations . revaluation . exception reports . accounting treatment.
68. A checklist of some of the key controls under these
headings is given in Annex E. One important aspect of reconciliations as revealed by the Barings case is that major unreconciled differences (e.g. between margin payments paid to a futures exchange by the institution on behalf of clients and payments received from clients, or between the institution's balances/positions as recorded in its own accounts and in those of the exchange) should be fully and promptly investigated.
69. Some of the deficiencies identified by the post-Barings
review of institutions' internal controls by auditors and the MA's treasury visits include :
a) lack of formally documented procedures that cover all aspects of internal controls for both the front office and back office; b) no tape recording of telephone calls made by the dealers;

c) dealing slips were not pre-numbered or time stamped, and there was no record of the nature of each trade to provide an audit trail; d) no formal lists of authorized counterparties (and limits for such counterparties) and brokers; and e) reconciliation of daily positions to nostro bank statements was not documented. Contingency plan
70. Plans should be in place to provide contingency systems
and operations support in the case of a natural disaster or systems failure. These should include emergency back-up for dealing functions as well as critical support functions. Contingency plans should be reviewed and tested on a regular basis. Internal audit
71. Internal audit is an important part of the internal control
process. Among the tasks of the internal audit function should be:
a) to review the adequacy and effectiveness of the overall risk management system, including compliance with policies, procedures and limits; b) to review the adequacy and test the effectiveness of the various operational controls (including segregation of duties) and staff's compliance with the established policies and procedures; and c) to investigate unusual occurrences such as significant breaches of limits, unauthorized trades and unreconciled valuation or accounting differences.
72. The greater the size, complexity and geographical
coverage of the derivatives business, the greater the need for experienced internal auditors with strong technical abilities and expertise. The MA considers that some internal audit functions of authorized institutions have not possessed these qualities in relation to derivatives.
73. It is essential that the internal audit function should have
the necessary status within the organization for its recommendations to

carry weight. The head of internal audit should if necessary have direct access to the board, audit committee and the chief executive. Line management must not be able to water down the findings of internal audit reviews.
74. In preparing internal audit reports, major control
weaknesses should be highlighted and a management action plan to remedy the weaknesses should be agreed with a timetable. As the Barings case illustrates, it is essential that major weaknesses are remedied quickly (the dangers posed by the lack of segregation of duties in Singapore had been identified in an internal audit review carried out in mid-1994, but the situation had not been rectified by the time of the collapse). While implementation is the responsibility of management, internal audit should conduct follow-up visits within a short space of time in the case of significant weaknesses. Failure of management to implement recommendations within an agreed timeframe should be reported to the Audit Committee. Hong Kong Monetary Authority March 1996

Annex A
Types of derivatives risks

1. Credit risk
   Credit risk is the risk of loss due to a counterparty's failure to perform on an obligation to the institution. Credit risk in derivative products comes in two forms :
   Pre-settlement risk is the risk of loss due to a counterparty defaulting on a contract during the life of a transaction. The level of exposure varies throughout the life of the contract and the extent of losses will only be known at the time of default. Settlement risk is the risk of loss due to the counterparty's failure to perform on its obligation after an institution has performed on its obligation under a contract on the settlement date. Settlement risk frequently arises in international transactions because of time zone differences. This risk is only present in transactions that do not involve delivery versus payment and generally exists for a very short time (less than 24 hours).
2. Market risk
   Market risk is the risk of loss due to adverse changes in the market value (the price) of an instrument or portfolio of instruments. Such exposure occurs with respect to derivative instruments when changes occur in market factors such as underlying interest rates, exchange rates, equity prices, and commodity prices or in the volatility of these factors.
3. Liquidity risk
   Liquidity risk is the risk of loss due to failure of an institution to meet its funding requirements or to execute a transaction at a reasonable price. Institutions involved in derivatives activity face two types of liquidity risk : market liquidity risk and funding liquidity risk.

Market liquidity risk is the risk that an institution may not be able to exit or offset positions quickly, and in sufficient quantities, at a reasonable price. This inability may be due to inadequate market depth in certain products (e.g. exotic derivatives, long-dated options), market disruption, or inability of the bank to access the market (e.g. credit down-grading of the institution or of a major counterparty). Funding liquidity risk is the potential inability of the institution to meet funding requirements, because of cash flow mismatches, at a reasonable cost. Such funding requirements may arise from cash flow mismatches in swap books, exercise of options, and the implementation of dynamic hedging strategies.
4. Operational risk
Operational risk is the risk of loss occurring as a result of inadequate systems and control, deficiencies in information systems, human error, or management failure. Derivatives activities can pose challenging operational risk issues because of the complexity of certain products and their continual evolution.
5. Legal risk
Legal risk is the risk of loss arising from contracts which are not legally enforceable (e.g. the counterparty does not have the power or authority to enter into a particular type of derivatives transaction) or documented correctly.
6. Regulatory risk
Regulatory risk is the risk of loss arising from failure to comply with regulatory or legal requirements.
7. Reputation risk
Reputation risk is the risk of loss arising from adverse public opinion and damage to reputation.

Annex B
Risk measurement methodologies

1. Notional amount or volume of contracts
   This simply refers to the notional amount of the contract and is the most basic form of risk measurement. The main advantage of this measure is its simplicity which allows net and gross positions to be computed easily and quickly. It is useful as one of the means for limiting business volume, and liquidity and settlement risks. However, the notional amount only provides an indication of the volume of business outstanding and bear little relation to the underlying risks of the exposure as it does not take account of cash flows, price sensitivity or price volatility. Also, for sophisticated institutions, the nominal measurement method does not allow an accurate aggregation of risks across all instruments. This method should not be used on a stand-alone basis.
2. Month-million
   This is the product of the notional amount of the contract expressed in millions and the remaining term of the contract expressed in number of months. For example, the month-million of an interest rate contract with an amount of $60 million and a remaining term of three months is calculated as follows:
   3 months x $60 million = $180 month-million.
   This method is commonly used by market participants for measuring exposure in interest rate products. It is simple in nature and is better than the notional amount as it also takes account of the remaining maturity of the contract which is a relevant factor in assessing the market risk of interest rate products. However, similar to the nominal measurement method, it does not take account of the underlying instrument's cash flow, price sensitivity or price volatility. Furthermore, contracts with the same month-million may have significantly different risk exposures. For example, an interest rate contract with an amount of $60 million and a remaining term of three months (3 months x $60 million = $180 month-million) has the same month-million of another interest rate instrument with an amount of $3 million and a remaining term of five years (60 months x $3 million =

$180 month-million). Although these two instruments have the same month-million, their risk profiles (short-term vs long term) are quite different and should be managed differently. This method should not therefore be used on a stand-alone basis by active derivatives participants.
3. Duration
Duration is a measure of the sensitivity of the present value or price of a financial instrument to a change in interest rates. Conceptually, duration is the average time to the receipt of cash flows weighted by the present value of each of the cash flows in the series. This measurement technique calculates price sensitivities across different instruments and converts them to a common denominator. Duration analysis can estimate the impact of interest rate changes on the present value of the cash flows generated by a financial institution's portfolio. For example, if the modified duration (duration divided by 1+yield) of a security is 5, the price of the security will decrease by 5 percent approximately, if the related yield increases by one percent. The Price Value Basis Point (PVBP) measurement is a common application of the duration concept. This methodology assesses the change in present value of a financial instrument or a portfolio of instruments due to a one basis point change in interest rates. PVBP is calculated by multiplying the price of the instrument by its modified duration and then by a factor of 0.0001. For example, a one basis point increase in yield would decrease the price of a bond with a modified duration of 5 from 100 to 99.95. PVBP is a useful tool for sensitivity analysis of a position or a portfolio. It also provides a quick tool for traders to evaluate their profit and loss due to a basis point movement in interest rates. However, the duration method also has certain limitations. Duration methods focus on sensitivity analysis but not probability analysis. They do not tell how the value of a security or a portfolio of securities would be likely to change based on past experience. Also, for large rate movements (by more than one percent), duration tends to provide inaccurate results as the true relationship between a change in price and a change in interest rate is not linear. This can be remedied to some extent by combining duration measures with convexity measures (measuring the rate of change of duration as yield changes).

4. Value at risk
   This is a sophisticated method increasingly used by major market participants to assess the risk of their whole trading book. The "value at risk" (VAR) approach uses probability analysis based on historical price movements of the relevant financial instruments and an appropriate confidence interval to assess the likely loss that the institution may experience given a specified holding period. It combines both probability analysis and sensitivity analysis. The following is a simplified illustration of the concept:
   A bank has an open USD/DEM position of $1 million. The historical data indicates that the one-day volatility during an adverse USD/DEM exchange rate movement is 0.08 percent. The value at risk based on one standard deviation is:
   $1 million x 1(0.08 percent) = $800
   The value at risk based on three standard deviations is:
   $1 million x 3(0.08 percent) = $2,400 This example can be interpreted that there is an approximately 16 percent probability (one standard deviation) based on the past price movement experience that the bank may lose $800 or more overnight, and approximately 0.14 percent probability (three standard deviation) the bank may lose $2,400 or more. Additionally, the longer the holding period that is used, for example, five or ten days instead of overnight, the larger the value at risk. There are three main VAR approaches: variance/covariance, historical simulation and Monte Carlo simulation. Under the variance/covariance approach, an institution uses summary statistics on the magnitude of past price movements in the relevant market factors (interest rates, exchange rates, etc.), the estimated sensitivity of the positions/portfolio to movement in market factors, and correlations between price movements to estimate likely potential losses in its portfolio of trading book positions. Under the historical simulation approach, an institution bases its expectation of potential future losses on calculations of the losses that would have been sustained on that book in the past using data on past price movements. Under the Monte Carlo simulation approach, an institution uses models to generate many scenarios randomly in order to obtain the distribution of portfolio values to estimate the potential future losses.

To derive the value at risk, the institution needs to determine the confidence interval, minimum holding period and minimum sample period for calculating volatilities and correlations. The Basle Committee has specified the standards that should be adopted by banks which use internal models for calculating the capital requirements under its market risk regime. These are set out in Annex C.

Annex C
Minimum quantitative standards specified by the Basle Committee for models used to calculate market risk capital requirements

1. Quantitative standards
   . Value at risk (VAR) should be computed daily.
   . A 99 % one-tailed confidence interval should be used. . Minimum holding period ( or liquidation period) would be ten trading days. However, banks may use the VAR numbers calculated according to shorter holding periods scaled up to ten days. In the case of options positions or positions that display option-like characteristics, the scale-up approach is allowed as an interim measure only. Banks with such positions are expected to ultimately move towards the application of the minimum holding period of ten trading days. In allowing banks to use the scale-up approach for options positions, supervisory authorities may require these banks to adjust their capital measure for options risk through other methods, e.g. periodic simulations or stress testing. . The minimum sample period for calculating volatilities and correlations is one year. For banks that use a weighting scheme or other methods for the historical observation period, the “effective” observation period must be at least one year (i.e. the weighted average time lag of the individual observations cannot be less than six months). . Volatilities and correlations data should be updated at least quarterly and whenever market prices are subject to material changes. . Correlation may be used to offset VAR both within and across broad risk categories (e.g. interest rates, exchange rates, equity prices and commodity prices). . Options risk should be captured; risk associated with volatilities of the rates and prices (vega risk) should be accounted for. For complex option portfolios, term structures of volatilities should be used as the risk factors.

. Each bank must meet, on a daily basis, a capital requirement as the higher of (i) its previous day's VAR number and (ii) an average of the daily VAR of the preceding sixty business day multiplied by a multiplication factor (of at least 3) set by its supervisor. Separate capital charge to cover specific risk of traded debt and equity securities, to the extent that this risk is not incorporated into the models, is required.
2. Specification of market risk factors
An important part of a bank’s internal market measurement system is the specification of an appropriate set of market risk factors, i.e. the market rates and prices that affect the value of the bank’s trading positions. The risk factors used in the internal risk management model should be sufficient to capture the risks inherent in an institution’s portfolio of on￾and off-balance sheet trading positions. In specifying the risk factors, institutions should take into account the following:
Interest rate based instruments
. The yield curve should be divided into various maturity segments to capture the variation in the volatility of interest rates along the curve. . There will typically be one risk factor per segment. For exposures to interest rate movements in the major currencies and markets, a minimum of six risk factors (i.e. six maturity segments) is recommended. However, the number of risk factors should ultimately be driven by the nature of the institution’s trading strategies. . The system must incorporate separate risk factors to capture spread risk e.g. difference between bonds and swaps, at various points along the yield curve. Exchange rate based instruments . There should be one risk factor (i.e. the foreign exchange rate against the domestic currency) for each currency in which the bank has a significant exposure.

Equity based instruments
. There should be a risk factor corresponding to each equity market in which the bank holds significant positions. . The minimum standard is to have one broad-based equity index as a risk factor in a market, and use “beta-equivalents” to relate it to individual stocks. However, more than one index could be used (for example sector indices) in a single market. . The level of sophistication of the modelling technique should correspond to the bank’s exposure to the overall market as well as its concentration in individual equity issues in that market. Commodity based instruments . For limited positions in commodity-based instruments, it might be acceptable to use a single risk factor for a relatively broad class of commodities (e.g. a single risk factor for all class of oils). . For more active trading, the model must account for the variation in the “convenience yield” (i.e. the benefits from direct ownership of the physical commodity e.g. the ability to profit from temporary market shortages) between derivatives positions such as forwards and swaps and cash positions in the commodity.

Annex D
Commonly used market risk limits

1. Notional or volume limits
   Limits based on the notional amount of derivatives contracts are the most basic and simplest form of limits for controlling the risks of derivatives transactions. They are useful in limiting transaction volume, and liquidity and settlement risks. However, these limits cannot take account of price sensitivity and volatility and say nothing about the actual level of risk (in capital or earnings terms) faced by the institution. Derivatives participants should not therefore use these limits as a stand￾alone tool to control market risk.

2. Stop loss limits
   These limits are established to avoid unrealized loss in a position from exceeding a specified level. When these limits are reached, the position will either be liquidated or hedged. Typical stop loss limits include those relating to accumulated unrealized losses for a day, a week or a month. Some institutions also establish management action trigger (MAT) limits in addition to stop loss limits. These are for early warning purposes. For example, management may establish a MAT limit at 75 percent of the stop loss limit. When the unrealized loss reaches 75 percent of the stop loss limit, management will be alerted of the position and may trigger certain management actions, such as close monitoring of the position, reducing or early closing out the position before it reaches the stop loss limits. The above loss triggers complement other limits, but they are generally not sufficient by themselves. They are not anticipatory; they are based on unrealized losses to date and do not measure the potential earnings at risk based on market characteristics. They will not prevent losses larger than the stop loss limits if it becomes impossible to close out positions, e.g. because of market illiquidity.

3. Gap or maturity band limits
   These limits are designed to control loss exposure by controlling the volume or amount of the derivatives that mature or are repriced in a given time period. For example, management can establish gap limits for each maturity band of 3 months, 6 months, 9 months, one year, etc. to avoid maturities concentrating in certain maturity bands. Such limits can be used to reduce the volatility of derivatives revenue by staggering the maturity and/or repricing and thereby smoothing the effect of changes in market factors affecting price. Maturity limits can also be useful for liquidity risk control and the repricing limits can be used for interest rate management. Similar to notional and stop loss limits, gap limits can be useful to supplement other limits, but are not sufficient to be used in isolation as they do not provide a reasonable proxy for the market risk exposure which a particular derivatives position may present to the institution.

4. Value-at-risk limits
   These limits are designed to restrict the amount of potential loss from certain types of derivatives products or the whole trading book to levels (or percentages of capital or earnings) approved by the board and senior management. To monitor compliance with the limits, management calculates the current market value of positions and then uses statistical modeling techniques to assess the probable loss (within a certain level of confidence) given historical changes in market factors (details are set out in Annex B). The advantage of value-at-risk (VAR) limits is that they are related directly to the amount of capital or earnings which are at risk. Among other things, they are therefore more readily understood by the board and senior management. The level of VAR limits should reflect the maximum exposures authorized by the board and senior management, the quality and sophistication of the risk measurement systems and the performance of the models used in assessing potential loss by comparing projected and actual results. One drawback in the use of such models is that they are only as good as the assumptions on which they are based (and the quality of the data which has been used to calculate the various volatilities, correlations and sensitivities).

5. Options limits

These are specifically designed to control the risks of options. Options limits should include Delta, Gamma, Vega, Theta and Rho limits. Delta is a measure of the amount an option’s price would be expected to change for a unit change in the price of the underlying instrument. Gamma is a measure of the amount delta would be expected to change in response to a unit change in the price of the underlying instrument. Vega is a measure of the amount an option's price would be expected to change in response to a unit change in the price volatility of the underlying instrument. Theta is a measure of the amount an option's price would be expected to change in response to changes in the option’s time to expiration. Rho is a measure of the amount an option's price would be expected to change in response to changes in interest rates.

Annex E
Recommendations on operational controls This Annex sets out recommended best practices in the following major areas of operational controls:
A. Segregation of duties.
B. Trade entry and transaction documentation.
C. Confirmation procedures.
D. Settlement and disbursement procedures.
E. Reconciliation procedures.
F. Revaluation procedures.
G. Exceptions reports
H. Accounting procedures
A. Segregation of Duties
. There should be clear segregation, functionally and physically, between the front office and back office. . Job descriptions and reporting lines of all front office and back office personnel should support the principle of segregation of duties outlined in the institution's policies. . The process of executing trades should be separated from that of confirming, reconciling, revaluing, or settling these transactions or controlling the disbursement of funds, securities or other payments, such as margins, commissions, fees, etc. . Individuals initiating transactions should not confirm trades, revalue positions for profit and loss calculation, approve or make general ledger entries, or resolve disputed trades.

. Access to deal recording, trade processing and general ledger systems should be restricted by using physical access controls e.g. user ID and password codes and terminal access controls. . There should be a unit independent of the trading room responsible for reviewing daily reports to detect excesses in approved trading and credit limits. B. Trade Entry and Transaction Documentation . Management should ensure that procedures are in place to provide a clear and fully documented audit trail of derivatives transactions. These procedures should be adequate to inform management of trading activities and to facilitate detection of non-compliance with policies and procedures. The information on derivatives transactions should be in a format that can be readily reviewed by the institution’s management as well as by internal and external auditors. . There should be sufficient accounting and other records that capture and record on a timely basis and in an orderly fashion every transaction which the institution enters into to explain:
− its nature and purpose (e.g. trading or hedging); − any asset and/or liability, actual and contingent, which respectively arises or may arise from it; and − any income and/or expenditure, current and/or deferred, which arises from it. . All derivatives transactions should be sequentially controlled (e.g. the use of prenumbered dealing slips), timed and tracked by tape recording of dealers’ telephones to ensure that all deals are accounted for and to provide an audit trail for deals effected. Sequence of the prenumbered forms should be reviewed and accounted for periodically. Tape recording equipment should not be accessible by the dealers and should remain under the control of management. . To establish valid contracts, records of original entries should capture sufficient details, including:

− Time and date of execution.
− Name of dealer executing transactions.
− Name of staff entering transaction data (if different from dealer). − Name of counterparty. − Type of instrument, price, and amount. − Settlement or effective date. − Payment or settlement instructions. − Brokers' fees or commissions and other expenses. . Dealers should maintain a position sheet for each product traded and continuous position reports in the dealing room. Dealers’ position reports should be submitted to management for review at the end of each trading day. . Daily position report should be prepared from the institution’s processing system/general ledger by back office personnel. The reports should include all transactions and be reconciled daily to the dealer’s position reports. . Every transaction should be updated (i.e. mark to market) in the calculation of market and credit risk limits. . There should be sufficient transaction documentation to support limit reporting and a proper audit trail. A unit independent of the front office should be responsible for reviewing daily reports to detect excesses of approved trading limits. . There should be an approved list of brokers, counterparties and explicit policies and procedures for dispute resolution. . Dealers should adhere to stated limits. If limit excesses arise, management approval should be obtained and documented prior to execution of the transaction. There should be adequate records of limit excesses. . Deals should be transacted at market rates. The use of off￾market rates as a base for the renewal of maturing derivatives contracts should be on an exception basis and subject to the following conditions:

− it is permitted in accordance with stated policies and procedures of the institution and the justification and approval of such transactions are documented; − the customer had specifically requested it; − it was known to the institution that the customer did so with full internal authority, being aware of the possibility that a loss could be concealed thereby; and − the relevant contracts will be marked to market so that the discounted value of the contract and the loss arising from using the off-market rate can be shown in the institution’s accounts and its returns to the MA.
C. Confirmation Procedures
. The method of confirmation used should provide a documentation trail that supports the institution's position in the event of disputes. . Outgoing confirmations should be initiated no later than one business day after the transaction date. Any use of same-day telephone confirmations should be taped-recorded and followed with written confirmations. Oral confirmation will be accepted only if the lines are taped and agreed with counterparty in advance. . Outgoing confirmations should contain all relevant contract details and be delivered to a department independent of the trading unit of the counterparty. Follow-up confirmations should be sent if no corresponding, incoming confirmation is received within a limited number of days after the contract is effected. The accounting/filing system should be able to identify booked contracts for which no incoming confirmations have been received. Records of outstanding unconfirmed transactions should be kept and reviewed by management on a regular basis. . Incoming confirmations should be delivered to the designated personnel who are responsible for reconciling confirmations with trading records and not to trading personnel.

. All incoming confirmations should be verified with file copies of contracts/dealing slips and for authenticity. All discrepancies should be promptly identified and investigated by an officer independent of the trading function for resolution. They should also be tracked, aged, and reported to management. Trends by type should be identified and addressed. D. Settlement and Disbursement Procedures . Specific procedures should be established for the initiation of, and authority for, fund transfer. . No one person in a fund transfer operation (e.g. SWIFT) should be responsible for the processing, verifying and approving of a request. Only authorised persons with appropriate segregation of duties should have access to fund transmission systems, cash books, account information, and terminal facilities. . Reasons underlying requests for funds should be analysed and documented. Settlement staff should be alert to any unusual transactions and immediately report them to management. They should distinguish between payments made on behalf of the institution and those on behalf of clients. . Institutions must determine the authenticity of fund transfer requests before payments are released. This may include direct telephone confirmation with the counterparty in addition to the verification of test keys. . In case test keys are used to verify the authenticity of requests for transfer of funds, such test keys should be separated into two parts (fixed and variable) and reset with the counterparty on at least a yearly basis. Each part should be kept by a different staff. No test key holders should be allowed to access the telex room. . Payments should be properly authorised prior to disbursement of funds. Dual approvals should be required for large payments to help ensure validity and correctness, whether released manually or via SWIFT, tested telex or similar transmission systems. Access to the transmission system should be properly approved and granted on a need-to￾perform basis and periodically reviewed by line management.

In addition, adequate procedures should be established to control password maintenance, addition and deletion of operators, and other system changes. . Institutions should retain logs recording transfer request information, assign sequential numbers to incoming and outgoing messages, and copies of all messages received on fund transmission systems. At the end of each business day, request forms should be compared to the actual transfer to ensure that all transfers are properly authorised and carried out. . There should be clear policy on the appropriateness of accepting requests for “third-party payment, i.e. payment instructions to the account of an individual, institution or corporation other than that of the counterparty to the transaction. To ensure the accuracy and authenticity of all payment instructions for payments to and from counterparties, in particular those involving third party names, management may adopt various measures including:
− Requiring an authenticated confirmation of the payment instruction on the transaction date; − Requiring the counterparty to submit a list of individuals authorised to transact business and to confirm deals; − Confirming by telephone all deals on the settlement date directly with the counterparty; and − Rejecting payment instructions to account numbers without corresponding names. . Daily independent reconciliation of transferred funds with nostro accounts and general ledger is an essential control for detection of errors or misapplications of funds. E. Reconciliation Procedures . All pertinent data, reports, and systems should be reconciled on a timely basis to ensure that the institution’s official books agree with dealers’ records. At the minimum, the following reports should be reconciled:

− Dealer’s positions to operational database.
− Operational database to general ledger (including suspense accounts). − Dealer’s profit and loss statement to profit and loss account. − General ledger to regulatory reports. − For exchange traded products, brokers’ statements (or the exchange’s statements) to general ledger and the income statement. . The reconciliation of front office positions should be performed by an individual independent of dealing function. Internal auditors should be responsible for ensuring that reconciliation procedures are properly performed. . The frequency of the reconciliations should be commensurate with the scale, significance and complexity of the trading operation. Active dealers should reconcile dealer’s positions and profit and loss statements to the operational database and general ledger on a daily basis. . Unusual items and any items outstanding for an inordinately long period of time should be investigated. . There should be adequate audit trail to ensure that balances and accounts have been properly reconciled. Reconciliation records and documentation should be maintained and independently reviewed. Such record should be kept for an appropriate period of time prior to their destruction. F. Revaluation Procedures . The revaluation procedures should cover the full range of derivatives instruments included in the institution’s trading portfolio. . Revaluation rates should be obtained from or verified by a source (or different sources in the case of OTC derivatives) independent of the dealers, representative of the market levels and properly approved. Revaluation calculations should be independently checked.

. Revaluation of accounts should be performed at least monthly. For active market participants, revaluations should be performed on a daily basis. . Profits and losses resulting from revaluation should be posted to the general ledger at least once a month and positions should be marked-to-market regularly for risk control and MIS purposes. . If models are used to derive or interpolate specific market factors, assumptions and methodologies used should be consistent and reasonable, and should be reviewed periodically by the independent risk control unit. Any changes of the assumptions and methodologies should be justified and approved by management. . Revaluation rates and calculations should be fully documented. G. Exceptions Reports . To track errors, frauds and losses, the back office should generate management reports that reflect current status and trends for the following items:
− Outstanding general ledger reconciling items.
− Failed trades.
− Off-market trades.
− After-hours and off-premises trading.
− Aging of unconfirmed trades.
− Suspense items payable/receivable.
− Brokerage payments.
− Miscellaneous losses.
. The management information system/reporting system of the institution should enable the detection of unusual patterns of activity (i.e. increase in volume, new trading counterparties, etc.) for review by management. H. Accounting principles . Institutions should have written accounting policies relating to trading and hedging with derivatives instruments, which are in

conformity with generally accepted accounting principles and approved by senior management. . Transactions should be categorised according to whether they were entered into for trading purposes or whether they were entered into to hedge existing assets, liabilities, other off￾balance sheet positions or future cash flow. Adequate evidence of intention to hedge should be established at the outset of the hedging transaction and there should be clearly defined procedures in place for identifying such transactions. . Trading transactions should be marked to market. Hedging transactions should be valued on the same basis as the related assets, liabilities, positions or future cash flows. . The setting up and use of suspense accounts should be properly controlled. . Institutions should report derivatives transactions in regulatory reports and annual accounts in conforming with their established accounting policies. . For financial instruments which are netted for financial reporting and regulatory reporting, institutions should ensure that the relevant netting agreements conform with the criteria issued by the MA or other relevant authorities permitting such setoff.