Notice SFA 03AA-N02 Financial Market Infrastructure Standards for CSDs

Monetary Authority of Singapore SECURITIES AND FUTURES ACT (CAP. 289) NOTICE ON FINANCIAL MARKET INFRASTRUCTURE STANDARDS FOR CENTRAL SECURITIES DEPOSITORIES

Notice No.: SFA 03AA-N02 Issue Date: 16 June 2016 NOTICE ON FINANCIAL MARKET INFRASTRUCTURE STANDARDS FOR CENTRAL SECURITIES DEPOSITORIES 1 Introduction 1.1 This Notice is issued pursuant to section 81SV of the Securities and Futures Act (Cap. 289) (“SFA”) and applies to a Regulated CSD. 1.2 MAS administers the SFA in respect of the supervision and oversight of trade repositories, clearing houses and central securities depositories in accordance with the CPMI￾IOSCO Principles for Financial Market Infrastructures (“PFMI”), as set out under the Monograph on Supervision of Financial Market Infrastructures. This Notice sets out the principles in the PFMI that a Regulated CSD has to comply with. 2 Definitions 2.1 For the purpose of this Notice— “authorities” include regulatory authorities and central banks; “central securities depository” means an entity that provides securities accounts, central safekeeping services, and asset services, which may include the administration of corporate actions and redemptions, and plays an important role in helping to ensure the integrity of securities issues (that is, ensure that securities are not accidentally or fraudulently created or destroyed or their details changed), and includes a Regulated CSD. “Regulated CSD” has the same meaning as “Depository" in section 81SF of the SFA. “Financial Market Infrastructure” or “FMI” means a multilateral system among participating institutions, including the operator of the system, used for the purposes of clearing, settling, or recording payments, securities, derivatives, or other financial transactions. 2.2 Any expression used in this Notice shall, except where expressly defined in this Notice or where the context requires, have the same meaning as in the SFA.

3 Standards applicable to a Regulated CSD 3.1 Legal risk management A Regulated CSD shall: 3.1.1 have an enforceable legal basis for each material aspect of its activities, to provide a high degree of legal certainty for such activities. 3.1.2 have rules, procedures, and contracts that are clear, understandable, and consistent with laws and regulations applicable to its activities and operations. 3.1.3 be able to articulate the legal basis for its activities to authorities, participants, and, where relevant, participants’ customers, in a clear and understandable way. 3.1.4 have rules, procedures, and contracts that are enforceable in all relevant jurisdictions1 . The Regulated CSD shall ensure a high degree of certainty that actions taken by the Regulated CSD under such rules and procedures will not be voided, reversed, or subject to stays. 3.1.5 identify and mitigate the risks arising from any potential conflict of laws when conducting business in multiple jurisdictions. 3.2 Governance arrangements A Regulated CSD shall: 3.2.1 have governance arrangements that place a high priority on the safety and efficiency of the Regulated CSD and support financial stability and other relevant public interest considerations. 3.2.2 document its governance arrangements for its board of directors (or equivalent) [“board”] and such arrangements shall provide clear and direct lines of responsibility and accountability between management and the board. The Regulated CSD shall disclose its arrangements to its owners, authorities, participants, and, at a more general level, the public. 3.2.3 specify the roles and responsibilities of its board clearly in its governance arrangements, and there shall be documented procedures for its functioning, including procedures to identify, address, and manage member conflicts of interest. The Regulated CSD shall ensure that its board reviews the overall performance of the board and the performance of the individual board members regularly. 3.2.4 ensure that its board contains suitable members with the appropriate skills and incentives to fulfil its multiple roles. This typically requires the inclusion of non-executive board member(s).

1 These jurisdictions could include (a) those where a Regulated CSD is conducting business (including through linked FMIs); those where its participants are incorporated, located or otherwise conducting business for the purposes of participation; (c) those where collateral is located or held; and (d) those indicated in relevant contracts.

3.2.5 specify the roles and responsibilities of management clearly in its governance arrangements. The Regulated CSD shall ensure that its management has the appropriate experience, a mix of skills, and the integrity necessary to discharge their responsibilities for the operation and risk management of the Regulated CSD. 3.2.6 ensure that its board establishes a clear, documented risk-management framework that includes the Regulated CSD’s risk-tolerance policy, assigns responsibilities and accountability for risk decisions, and addresses decision making in crises and emergencies. The Regulated CSD shall also ensure that the governance arrangements provide for the risk-management and internal control functions to have sufficient authority, independence, resources, and access to the board. 3.2.7 require its board to ensure that the Regulated CSD’s design, rules, overall strategy, and major decisions reflect appropriately the legitimate interests of its direct and indirect participants and other relevant stakeholders. The Regulated CSD shall clearly disclose major decisions relating to the relevant stakeholders and, where the decision has a broad market impact, the public. 3.3 Framework for the comprehensive management of risks A Regulated CSD shall: 3.3.1 have risk-management policies, procedures, and systems that enable it to identify, measure, monitor, and manage the range of risks that arise in or are borne by the Regulated CSD. A Regulated CSD shall regularly review its risk management framework. 3.3.2 provide incentives2 to participants and, where relevant, their customers to manage and contain the risks they pose to the Regulated CSD. 3.3.3 regularly review the material risks it bears from and poses to, other entities (such as other FMIs, settlement banks, liquidity providers, and service providers) as a result of interdependencies and develop appropriate risk-management tools to address these risks. 3.3.4 identify scenarios that may potentially prevent it from being able to provide its critical operations and services as a going concern and assess the effectiveness of a full range of options for recovery3 or orderly wind-down. A Regulated CSD shall prepare appropriate plans for its recovery or orderly wind-down based on the results of that assessment. Where applicable, the Regulated CSD shall also provide relevant authorities with the information needed for purposes of resolution planning. 3.4 to 3.9 [This section is intentionally left blank]

2 For example, a Regulated CSD could issue reprimands, impose restrictions or conditions on participants and/or terminate the participant. 3 Recovery could include recapitalising, replacing management, merging with another FMI, revising business strategies (including cost or fee structures), or restructuring services provided.

3.10 Physical deliveries A Regulated CSD shall: 3.10.1 have rules which clearly state its obligations with respect to the delivery of physical instruments. 3.10.2 identify, monitor, and manage the risks and costs associated with the storage and delivery of physical instruments. 3.11 Central securities depositories A Regulated CSD shall: 3.11.1 have appropriate rules, procedures, and controls, including robust accounting practices, to safeguard the rights of securities issuers and holders, prevent the unauthorised creation or deletion of securities, and conduct periodic and at least daily reconciliation of securities it maintains. 3.11.2 prohibit overdrafts and debit balances in securities accounts maintained with it. 3.11.3 maintain securities in an immobilised or dematerialised form for their transfer by book entry. 3.11.4 protect securities maintained with it against custody risk through appropriate rules and procedures consistent with its legal framework. 3.11.5 employ a robust system that ensures segregation between the Regulated CSD’s own assets and the securities of its participants and segregation among the securities of participants. The Regulated CSD shall also support operationally the segregation of securities belonging to a participant’s customers on the participant’s books and facilitate the transfer of customer holdings. 3.11.6 identify, measure, monitor, and manage its risks from other activities 4 that it may perform. 3.12 [This section is intentionally left blank] 3.13 Participant-default rules and procedures A Regulated CSD shall: 3.13.1 have default rules and procedures that enable the Regulated CSD to continue to meet its obligations in the event of a participant default and that address the replenishment of resources following a default.

4 This includes services other than central safekeeping and administration of securities.

3.13.2 be well prepared to implement its default rules and procedures, including any appropriate discretionary procedures provided for in its rules. The Regulated CSD shall design its rules and procedures to ensure that the Regulated CSD can take timely action to contain losses and liquidity pressures and continue to meet its obligations. 3.13.3 publicly disclose key aspects of its default rules and procedures. 3.13.4 involve its participants and other stakeholders in the testing and review of the Regulated CSD’s default procedures, including any close-out procedures. Such testing and review shall be conducted at least annually or following material changes to the rules and procedures to ensure that they are practical and effective. 3.14 [This section is intentionally left blank] 3.15 General business risk A Regulated CSD shall: 3.15.1 have robust management and control systems to identify, monitor, and manage general business risks, including losses from poor execution of business strategy, negative cash flows, or unexpected and excessively large operating expenses. 3.15.2 hold liquid net assets funded by equity (such as common stock, disclosed reserves, or other retained earnings) so that it can continue operations and services as a going concern if it incurs general business losses. The amount of liquid net assets funded by equity the Regulated CSD shall hold shall be determined by its general business risk profile and the length of time required to achieve a recovery or orderly wind-down, as appropriate, of its critical operations and services if such action is taken. 3.15.3 maintain a viable recovery and orderly wind-down plan and should hold sufficient liquid net assets funded by equity to implement this plan. At a minimum, a Regulated CSD shall hold liquid net assets funded by equity equal to at least six months of current operating expenses, which shall be in addition to resources held to cover participant defaults or other risks covered under the financial resources principles. However, equity held under international risk-based capital standards can be included where relevant and appropriate to avoid duplicate capital requirements. 3.15.4 ensure that assets held to cover general business risk should be of high quality and sufficiently liquid in order to allow the Regulated CSD to meet its current and projected operating expenses under a range of scenarios, including in adverse market conditions. 3.15.5 maintain a viable plan for raising additional equity should its equity fall close to or below the amount needed. The Regulated CSD shall ensure that this plan is approved by the board and updated regularly.

3.16 Custody and investment risks A Regulated CSD shall: 3.16.1 hold its own and its participants’ assets at regulated entities that have robust accounting practices, safekeeping procedures, and internal controls that fully protect these assets. 3.16.2 have prompt access to its assets and the assets provided by participants, when required. 3.16.3 evaluate and understand its exposures to its custodian banks, taking into account the full scope of its relationships with each. 3.16.4 ensure that its investment strategy is consistent with its overall risk-management strategy and fully disclosed to its participants, and investments shall be secured by, or be claims on, high-quality obligors. These investments shall allow for quick liquidation with little, if any, adverse price effect. 3.17 Operational risks A Regulated CSD shall: 3.17.1 establish a robust operational risk-management framework with appropriate systems, policies, procedures, and controls to identify, monitor, and manage operational risks. 3.17.2 require its board to clearly define the roles and responsibilities for addressing operational risk and endorse the Regulated CSD’s systems, operational policies, procedures, and controls to identify, monitor and manage operational risks (“operational risk management framework”). The Regulated CSD shall, periodically and after significant changes, review, audit and periodically test its operational risk management framework. 3.17.3 have clearly defined objectives on the reliability of its operations and shall have policies in place that are designed to achieve those objectives. 3.17.4 ensure that it has scalable capacity adequate to handle increasing stress volumes and to achieve its service-level objectives. 3.17.5 have comprehensive policies on physical and information security that address all potential vulnerabilities and threats. 3.17.6 have a business continuity plan that addresses events posing a significant risk of disrupting operations, including events that could cause a wide-scale or major disruption. The plan shall incorporate the use of a secondary site and shall be designed to ensure that critical information technology (IT) systems can resume operations within two hours following disruptive events. The Regulated CSD shall design a plan to enable it to complete settlement by the end of the day of the disruption, even in case of extreme circumstances. The Regulated CSD shall regularly test these plans. 3.17.7 identify, monitor, and manage the risks that key participants, other FMIs, and service and utility providers might pose to its operations. In addition, the Regulated CSD shall identify, monitor, and manage the risks its operations might pose to other FMIs.

3.18 Access and participation requirements A Regulated CSD shall: 3.18.1 allow for fair and open access to its services, including by direct and, where relevant, indirect participants and other FMIs, based on reasonable risk-related participation requirements 5 . 3.18.2 when imposing participation requirements be able to justify such requirements in terms of the safety and efficiency of the Regulated CSD and the markets it serves, and have requirements which are tailored to and commensurate with the Regulated CSD’s specific risk. The Regulated CSD shall publicly disclose its participation requirements. Subject to maintaining acceptable risk control standards, the Regulated CSD shall endeavor to set requirements that have the least-restrictive impact on access that circumstances permit. 3.18.3 monitor compliance with its participation requirements on an ongoing basis and have clearly defined and publicly disclosed procedures for facilitating the suspension and orderly exit of a participant that breaches, or no longer meets, the participation requirements. 3.19 Tiered participation arrangements6 A Regulated CSD shall: 3.19.1 ensure that its rules, procedures, and agreements allow it to gather basic information about indirect participation in order to identify, monitor, and manage any material risks to the Regulated CSD arising from such tiered participation arrangements. 3.19.2 identify material dependencies between direct and indirect participants that might affect the Regulated CSD. 3.19.3 identify indirect participants responsible for a significant proportion of transactions processed by the Regulated CSD and indirect participants whose transaction volumes or values are large relative to the capacity of the direct participants through which they access the Regulated CSD, in order to manage the risks arising from these transactions. 3.19.4 regularly review risks arising from tiered participation arrangements and shall take mitigating action when appropriate.

5 Risk-related participation requirements shall be adequate to ensure that the Regulated CSD’s participants meet appropriate operational, financial and legal requirements to allow them to fulfil their obligations to the Regulated CSD, including other participants, on a timely basis. 6 “Tiered participation arrangements” in relation to a CSD, means arrangements where indirect participants rely on the services provided by direct participants to use the CSD’s facilities for transactions.

3.20 CSD links A Regulated CSD: 3.20.1 before entering into a link arrangement with other FMI(s) and on an ongoing basis once the link is established, shall identify, monitor and manage all potential sources of risk arising from the link arrangement with the other FMI(s). A Regulated CSD shall only have link arrangements which are designed such that each FMI participating in the arrangement is able to comply with the other principles in the PFMI. 3.20.2 shall ensure that the link has a well-founded legal basis that supports its design and provides adequate protection to the FMIs involved in the link.7 3.20.3 that has established a link to a central securities depository shall measure, monitor, and manage the credit and liquidity risks arising from the link with the central securities depository. The Regulated CSD shall ensure that any credit extensions granted to a central securities depository are fully covered by high-quality collateral and subject to limits.8 3.20.4 shall not make any provisional transfers of securities to a central securities depository to which it is linked. 3.20.5 that acts as an investor central securities depository9 shall only establish a link with an issuer central securities depository10 if the arrangement provides a high level of protection for the right of the Regulated CSD’s participants. 3.20.6 that acts as an investor central securities depository and uses an intermediary to operate a link with an issuer central securities depository shall measure, monitor, and manage the additional risks (including custody, credit, legal and operational risks) arising from the use of the intermediary. 3.21 Efficiency and effectiveness A Regulated CSD shall: 3.21.1 design its operations to meet the needs of its participants and the markets it serves, in particular, with regard to choice of a clearing and settlement arrangement; operating structure; scope of products cleared, settled, or recorded; and use of technology and procedures, where appropriate.

7 Legal risk from cross-border links may arise from differences between the laws and contractual rules governing the linked FMIs and their participants, including those relating to rights and interest, collateral arrangements, settlement finality, and netting arrangements. 8 Such limits should balance the usefulness of credit to facilitate settlement against the Regulated CSD’s credit exposures. 9 An “investor central securities depository” means a central securities depository or a third party acting on behalf of the investor central securities depository which opens an account in another central securities depository (the issuer central securities depository) so as to enable the cross-system settlement of securities transactions. 10 An “issuer central securities depository” is a central securities depository in which securities are issued (or immobilized). The issuer central securities depository opens accounts allowing investors (in a direct holding system) and intermediaries (including investor central securities depositories) to hold these securities.

3.21.2 have clearly defined goals and objectives that are measurable and achievable, such as in the areas of minimum service levels, risk-management expectations, and business priorities. 3.21.3 have established mechanisms for the regular review of its efficiency and effectiveness. 3.22 Communication procedures and standards A Regulated CSD shall: 3.22.1 use, or at a minimum accommodate, internationally accepted communication procedures and standards. 3.23 Disclosure of rules, key procedures, and market data A Regulated CSD shall: 3.23.1 adopt clear and comprehensive rules and procedures that are fully disclosed to participants. The Regulated CSD shall also publicly disclose rules and key procedures that govern its activities and operations. 3.23.2 disclose, to its participants and authorities, clear descriptions of the system’s design and operations, as well as the Regulated CSD’s and participants’ rights and obligations, so that participants can assess the risks they would incur by participating in the Regulated CSD. 3.23.3 provide all necessary and appropriate documentation and training to facilitate participants’ understanding of the Regulated CSD’s rules and procedures and the risks they face from participating in the Regulated CSD. 3.23.4 publicly disclose its fees at the level of individual services it offers as well as its policies on any available discounts. The Regulated CSD shall provide clear descriptions of priced services for comparability purposes. 3.23.5 complete regularly and publicly disclose responses to the CPSS-IOSCO Disclosure framework for FMIs. The CSD also shall, at a minimum, disclose basic data on transaction volumes and values. 3.24 [This section is intentionally left blank] 4 Effective Date 4.1 This Notice shall take effect on 16 June 2016.