Risk Management Guidelines for Derivatives

Guideline No. 12.1
Our Ref: CB/POL/6/67
19 December 1994
The Chief Executive
All Authorised Institutions
Dear Sir / Madam,
Risk Management of Financial Derivatives Activities The Basle Committee issued in July 1994 a paper which provides guidance on sound risk management of financial derivatives business. The industry Associations have been consulted on the paper and on the extent to which it should be adopted as a formal guideline for authorised institutions. The industry Associations have indicated support for the general principles and procedures outlined in the Basle paper and have agreed that they should be adopted as an indication of best practice. In the light of the positive response, the Monetary Authority has decided to adopt in full the Basle paper, together with an introductory note by the Monetary Authority, as a guideline for authorised institutions (attached at Annex A). Pending further study of the appropriate supervisory regime for derivatives (see below), the guideline will not be issued under Section 7(3) of the Banking Ordinance for the time being. The introductory note by the Monetary Authority sets out the key risk management practices which the Monetary Authority regards as particularly important. We agree with the industry Associations that the actual controls that should be put in place by authorised institutions in accordance with the general principles set out in the Basle paper should have regard to the nature, size and complexity of individual institutions' derivatives activities. The Monetary Authority will take into account these factors in assessing the adequacy of institutions' systems for managing the risks arising from their derivatives transactions.

The Basle paper focuses on high level controls. The Monetary Authority intends to study further the more operational aspects of the risk management of derivatives and will issue a further guideline on this subject in 1995. To facilitate the preparation of this guideline, we intend to conduct a series of visits to the treasury departments of institutions which are more active in derivatives activities. Survey on Risk Management Practices In order to establish the extent to which institutions are already complying with the guidelines set out in the Basle paper and to assist in future assessment of risk management practices, the Monetary Authority has prepared a questionnaire which is attached at Annex B. In order to reduce the reporting burden on institutions, this is designed to be completed by ticking boxes. We intend to publish the results of this survey in aggregate form in our Quarterly Bulletin. Only those institutions with a material volume of derivatives business have been selected to participate in the survey. Your institution is not one of those which have been selected. You may nonetheless wish to study (and complete) the questionnaire for your own purposes as a self-assessment. Client selection and appraisal Recent events have demonstrated the credit, legal and reputational risks that can arise for banks or other financial institutions that engage in derivatives transactions with customers who do not fully understand the risks involved or for whom such transactions may be inappropriate. An added complication arises if the customer does not have the necessary legal or regulatory authority to engage in the transactions. It is not the intention of the Monetary Authority to impose a "suitability" requirement on authorised institutions with respect to derivatives or other banking transactions in which they engage with their customers. Nonetheless, we consider that institutions should, for their own protection, have policies and procedures to reasonably ensure that their customers have the capability to understand the nature and risks of derivatives transactions into which they enter, particularly those which involve complex structured products; and that customers should be provided with sufficient information (such as sensitivity analyses) to help them to understand the risks. It is, of course, essential that the institution establishes that the customer has the power and authority to enter into the transaction in the first place. Yours faithfully,

D T R Carse
Deputy Chief Executive (Banking) c.c. SFS (Attn: Mrs Erika Hui) SFC (Attn: Mr Siva Singham) HKSA (Attn: Mr James Fawls) Auditors of authorised institutions

---

Annex A - Risk Management Guidelines for Derivatives issued by Hong Kong Monetary Authority

Annex A
RISK MANAGEMENT GUIDELINES FOR DERIVATIVES
Hong Kong Monetary Authority
December 1994

RISK MANAGEMENT GUIDELINES FOR DERIVATIVES
INTRODUCTORY NOTE

1. This introductory note and the accompanying Risk Management Guidelines for
   Derivatives issued by the Basle Committee on Banking Supervision (“ Basle Guidelines”) together constitute a guideline issued by the Monetary Authority which is applicable to derivatives activities conducted by authorised institutions. “Derivatives” are defined for this purpose as financial contracts whose value depends on the value of one or more underlying assets or indices.

2. Sound risk management is essential to promoting stability in both individual
   institutions and in the system as a whole. This is true in all aspects of an institution’s business, but it is particularly so in relation to derivatives. While the nature of the risks involved in the derivatives activity are not new, the complexity of certain of these products makes the risks involved difficult to measure, monitor and control.

3. The Monetary Authority considers that the attached Basle Guidelines should have
   relevance to all institutions which engage in derivatives activity in one form or another. It is recognised however that not all institutions participate to the same degree. Some may be only occasional end-users of straightforward products for hedging purposes. At the other extreme, some institutions may be active developers of , and dealers in , complex structured products.

4. It is accepted that the manner in which the Basle Guidelines are translated
   into actual controls depends on the size and complexity of an institution’s derivatives activities. In general, therefore, institutions are expected to have risk management systems and controls in place with are commensurate with the nature of their derivatives business and the size of risk that they are incurring. The Monetary Authority will take these factors into account in assessing the adequacy of institutions’ systems for management the risk arising from their derivatives activities. However, what is basis to all institutions is that, as with all other aspects of their activities, there should be “appropriate oversight by the board of directors and senior management”.

5. This latter point also recognize that the risk management practices
   advocated by the Basle Committee and supported by the Monetary Authority are applicable to all types of products, not just derivatives. The Guidelines therefore recommend that the “the process of risk management for derivatives activities should be integrated into the institution’s overall risk management system”. Summary of Basle Guidelines

6. The points summarized below are those to which the Monetary Authority
   would wish institutions to devote particular attention. Institutions should however study carefully the Basle Guidelines as a whole.
   I. Overseeing the risk management process
   l Written policies approved by the Board of Directors: Risk management policies ( including those related to derivatives ) should be consistent with the institution’s broder business strategies, capital strength, management expertise and the risk tolerances of the Board. The Board ( or a committee of the Board ) should be informed regularly of the risk exposure of the institution, and should regularly re-evaluate significant risk management policies and procedures. l Senior management to ensure adequate risk management measures:
   These include clear delineation of lines of responsibilities for managing risk, adequate systems for measuring risk, appropriately structured limits on risk taking, effective internal controls and a comprehensive risk-reporting process. l Proper risk evaluation before entering into derivatives business: The evaluation should cover the issues set out in the preceding paragraph and related legal, accounting and tax issues. Before engaging in derivatives activities, management should ensure that all appropriate approvals are obtained and that adequate operational procedures and risk controls systems are in place, along with the necessary staff and resources. l Remuneration policies to avoid encouraging excessive risk taking:
   They should be structured to avoid for example trying salaries too closely to the profitability of derivatives. l Independent risk management functions: To the extent warranted by the institution’s activities, the risk management functions for measuring, monitoring and controlling risk should be managed independently of individuals conducting derivatives activities. There should be an independent reporting line to the Board and senior management. Staff involved in risk management should have the appropriate expertise. II The risk management process l An integrated approach to risk management: The risk management process for derivatives activities should be integrated into the overall risk management system of the institution to the fullest extent possible. A common framework should be used to enable management to assess individual risks involved in derivatives and non￾derivatives activities on a consolidated basis. l Adequate awareness of risk measurement standards: risk measures and the risk measurement process should be sufficiently robust to reflect accurately the

multiple types of risks facing the institution. These should be understood by all relevant personnel at all levels of the institution. l Timely marking to market: An institution should revalue all derivatives trading portfolios and calculate its exposures at least daily. This is particularly important for an institution which is active in dealing in derivatives. l Stress tests and contingency plans: These should assess the impact of ( and the ability of the institution to withstand) “worst case” scenarios which take into account adverse market events such as unusual changes in prices or volatilities, market illiquidity or the default of a major counterparty. Actions and procedures to deal with such situations should be outlines. l Accurate, informative and timely management information system:
Such information should be easily understood and enable senior management and the Board to judge the changing nature of the institution’s risk profile. In dealer operations, exposures and profit and loss statements should be reported at least daily to managers who do not themselves conduct such operations. l Regular management evaluation and review: Risk management models, methodologies and assumptions used to measure risk and to limit exposures should be regularly assessed and documented. Institutions with significant derivatives activities should review the underlying methodologies of their modals at least annually.
III. Internal controls and audits
l Internal controls for key activities: Such controls should promote effective and efficient operations; reliable financial and regulatory reporting; and compliance with relevant laws regulations and policies of the institution. Segregation of operational duties, exposure reporting and risk monitoring from the business unit is particularly critical. l Internal auditors should audit and test the risk management process on a periodic basis: They should evaluate the independence and overall effectiveness of internal controls relevant to measuring, reporting and limiting risks, compliance with risk limits and the reliability and timeliness of information reported to senior management and the Board. Internal audit staff should have the appropriate expertise. IV Sound risk management practices for each type of risk l Credit risk: The institution should evaluate both settlement and pre￾settlement risk at the customer level across all products. Credit limits should be established for all customers. The capability of customers to understand the nature and risks of derivatives transactions should be carefully assessed.

l Market risk: Exposure in the trading portfolio should be calculated at least daily by using the value-at-risk approach or other appropriate measures. Limits should be establishes for market risk consistent with the maximum exposures authorised by senior management/ the Board. l Liquidity risk: The institution should take account of the liquidity risks associated with specific products and with the general need to fund derivatives activities. These should be evaluated in the broader context of the institution’s overall liquidity, in both normal and stress conditions. Account should be taken of the need to fund margin payments and of the impact of early termination of derivatives contracts. l Operations risk: Systems support and operational capacity should be able to adequately accommodate the types of derivatives activities in which the institution engages, particularly bearing in mind the complexity of certain derivatives. l Legal risk: The institution should ensure that its counterparties have the power and authority to enter into derivatives transactions and that the counterparties’ obligations arising from them are enforceable. Only netting agreements which are legally enforceable in all relevant jurisdictions should be used. Hong Kong Monetary Authority December 1994

---

Annex B - Risk Management Guidelines for Derivatives issued by Basle Committee on Banking Supervision

RISKS MANAGEMENT GUIDELINES FOR DERIVATIVES
Basle Committee on Banking Supervision
July 1994

TABLE OF CONTENTS
Page
I. Introduction and basic principles 1
II Oversight of the risk management process 2
Board of directors 3
Senior management 3
Independent risk management functions 4
III The risk management process 4
Risk measurement 5
Limiting risks 6
Reporting 6
Management evaluation and review 7
IV Internal controls and audits 7
V Sound risk management practices for each type of risk 9 Credit risk 9 Market risk 10 Liquidity risk 11 Operations risk 12 Legal risk 14

Risk management guidelines for derivatives
I. Introduction and basis principles

1. Derivatives instruments have become increasingly important to the overall
   risk profile and profitability of banking organizations throughout the world. Broadly defined, a derivatives instrument is a financial contracts whose value depends on the values of one or more underlying assets or indexes. Derivatives transactions include a wide assortment of financial contract, including forwards, futures, swaps and options. In addition, other traded instrument incorporate derivatives characteristics, such as those with imbedded options. While some derivatives instruments may have very complex structures, all of them can be divided into basic building blocks in structuring derivatives instruments allows the transfer of various financial risks to parties who are more willing, or better suited, to take or manage them.
2. Derivatives contracts are entered into through the world on organized
   exchanges and through over-the-counter (OTC) arrangements. Exchange-traded contracts are typically standardized as to maturity, contract size and delivery terms. OTC contracts are custom-tailored to an institution’s needs and often specify commodities, instruments and /or maturities that are not offered on any exchange.
3. Derivatives are used by banking organizations both as risk management
   tools and as a source of revenue. From a risk management perspective, they allow financial institutions and other participants to identify, isolate and manage separately the market risks in financial instruments and commodities. When used prudently, derivatives can offer managers efficient and effective methods for reducing certain risks through hedging. Derivatives may also be used to reduce financing costs and to increase the yield of certain assets. For a growing number of banking organizations, derivatives activities are becoming a direct source of revenue through “market-making” functions, position taking and risk arbitrage. “Market-making” functions involve entering into derivatives transactions with customers and with other market-makers while maintaining a generally balanced portfolio with the expectation of earning fees generated by a bid/ offer spread. Position taking, on the other hand, represents efforts to profit by accepting the risk that stems from taking outright positions in anticipation of price movements. Arbitragers also attempt to take advantage of price movements, but focus their efforts on trying to profit from small discrepancies in price among similar instruments in different markets.
4. Participants in the derivatives markets are generally grouped into two
   categories based primarily on their motivations of entering into derivatives contracts. End-user typically enter into derivatives transactions to achieve specified objectives related to hedging, financing or position taking on the normal course of their business operations. A wide variety of business enterprises are end-users. They include, but are not limited to, a myriad of financial institutions such as banks, securities firms and insurance companies; institutional investors such as pension funds, mutual funds and specialized

investment partnerships; and corporations, local and state governments , government agencies and international agencies.
5. Intermediaries, which are sometimes referred to as “dealer”, cater to the
needs of end-user by “making markets” in OTC derivatives instruments. In doing so, they expect to generate income from transaction fees, bid/offer spreads and their own trading positions. Important intermediaries, or derivatives dealers, include major banks and securities firms around the world. As intermediaries, banks have traditionally offered foreign exchange and interest rate risk management products to their customers and generally view derivatives products as a financial risk management service.
6. The basis risk associated with derivatives transactions are not new to
banking organizations. In general, these risks are credit risk, market risk, liquidity risk, operations risk and legal risk. Because they facilities the specific identification and management of these risks, derivatives have the potential to enhance the safety and soundness of financial institutions and to produce a more efficient allocation of financial risks. However, since derivatives also repackage these basis risks in combinations that can be quite complex, they can also threaten the safety and soundness of institutions if they are not clearly understood and properly managed.
7. Recognizing the importance of sound risk management to the effective use
of derivatives instruments, the following guidance is intented to highlight the key elements and basic principles of sound management practice for both dealers and end￾users of derivatives instruments. These basic principles include:

1. Appropriate oversight by boards of directors and senior management;
2. Adequate risk management process that integrates prudent risk limits,
   sound measurement procedures and information systems, continuous risk monitoring and frequent management reporting; and
3. Comprehensive internal controls and audit procedures.
   II. Oversight of the risk management process
4. As is standard practice for most banking activities, an institution should
   maintain written policies and procedures that clearly outline its risk management guidance for derivatives activities. At a minimum these policies should identify the risk tolerances of the board of directors and should clearly delineate lines of authority and responsibility for managing the risk of these activities. Individuals involved in derivatives activities should be fully aware of all policies and procedures that related to their specific duties.
5. Board if directors. The board of directors should approve all significant
   policies relating to the management of risks throughout the institution. These policies, which should include those related to derivatives activities, should be consistent with the

organization’s broder business strategies, capital strength, management expertise and overall willingness to take risk. Accordingly, the border should be informed regularly of the risk exposure of the institution and should regularly re-evaluate significant risk management policies and procedures with special emphasis placed on those defining the institution’s risk tolerance regarding these activities. The board of directors should also conduct and encourage discussions between its members and senior management, as well as between senior management and others in the institution, regarding the institution’s risk management process and risk exposure.
3. Senior management. Senior management should be responsible for
ensuring that there are adequate policies and procedures for conducing derivatives operations on both a long-range and day-to-day basis. This responsibility includes ensuring that there are clear delineation of lines of responsibility for managing risk, adequate systems for measuring risk, appropriately structured limits on risk taking, effective internal controls and a comprehensive risk-reporting process.
4. Before engaging in derivatives activities, management should ensure that
all appropriate approvals are obtained and that adequate operational procedures and risk control systems are in place. Proposals to undertake derivatives activities should include, as applicable:

• a description of the relevant financial products, markets and business
  strategies;
• the resources required to establish sound and effective risk management
  systems and to attract and retain professionals with specific expertise in derivatives transactions;
• an analysis of the reasonableness of the proposed activities in relation to
  the institution’s overall financial condition and capital levels;
• an analysis of the risks that may arise from the activities;
• the procedures the bank will use to measure, monitor and control risks;
• the relevant accounting guidelines;
• an analysis of any legal restrictions and whether the activities are
  permissible.

5. After the institution’s initial entry derivatives has been properly approved,
   any significant changes in such activities or any new derivatives should be approved by the board of directors or by an appropriate level of senior management, as designated by the board of directors.

6. Senior management should regularly evaluate the procedures in place to
   manage risk to ensure that those procedures are appropriate and sound. Senior management should also foster and participate in active discussions with the board, with staff of risk management functions and with traders regarding procedures for measuring and managing risk. Management must also ensure that derivatives activities are allocated sufficient resources and staff to manage and control risks.

7. As a matter of general policy, compensation policies - especially in the
   risk management, control and senior management functions - should be strutted in a way that is sufficiently independent for the performance of trading activities, thereby avoiding the potential incentives for expressive risk taking that can occur if, for example, salaries are ties too closely to the profitability of derivatives.

8. Independent risk management functions. To the extent warranted by the
   bank’s activities, the process of measuring, monitoring and controlling risk consistent with the established policies and procedures should be managed independently of individuals conducting derivatives activities, up through senior levels of the institution. An independent system for reporting exposure to both senior-level management and the board of directors is an important element of this process.

9. The personnel staffing independent risk management functions should
   have a complete understanding of the risks associated with all of the bank’s derivatives activities. Accordingly, compensation policies for these individuals should be adequate to attract and retain personnel qualified to access these risks.
   III. The risk management process

10. The primary components of a sound risk management process are the
    following: a comprehensive risk measurement approach; a detailed structure of limits, guidelines and other parameters used to govern risk taking; and a strong management information system for controlling, monitoring and reporting risks. These components are fundamental to both derivatives and non-derivatives activities alike. Moreover, the underlying risks associated with these activities, such as credit, market, liquidity, operations and legal risks, are not new to banking, although their measurement and management can be more complex. Accordingly, the process of risk management for derivatives activities should be integrated into the institution’s overall risk management system to the fullest extent possible using a conceptual framework common to the institution’s other activities. Such a common framework enables the institution to manage its risk exposure more effectively, especially since the various individual risk involved in derivatives activities can, at times, be interconnected and can often transcend specific markets.

11. As the case with all risk-bearing activities, the risk exposures an institution
    assumes in its derivatives activities should be fully supported by an adequate capital position. The institution should ensure that its capital position is sufficiently strong to support all derivatives risks on a fully consolidated basis and that adequate capital is maintained in all group entities engaged in these activities.

12. Risk measurement. An institution’s system for measuring the various risks
    of derivatives activities should be both comprehensive and accurate. Risk should be measured and aggregated across trading and non-trading activities on an institution-wide basis to the fullest extent possible.

13. While the use of single prescribed risk measurement approach for
    management purposes may not be essential, the institution’s procedures should enable management to assess exposures on a consolidated basis. Risk measures and the risk measurement process should be sufficiently robust to reelect accurately the multiple types of risks facing the institution. Risk measurement standards should be understood by relevant personnel at all levels of the institution - from individual traders to the board of directors - and should provide a common framework for limiting and monitoring risk taking activities.

14. With regard to dealer operations, the process of making derivatives
    positions to market is fundamental to measuring and reporting exposures accurately and on a timely basis. An institution active in dealing foreign exchange, derivatives and other traded instruments should have the ability to monitor credit exposures, trading positions and market movements at least daily. Some institutions should also have the capacity, or at least the goal, of monitoring their more actively traded products on a real-time basis.

15. Analyzing stress situations, including combinations of market events that
    could affect the banking organization, is also an important aspect of risk measurement. Sound risk measurement practices include identifying possible events or changes in market behavior that could have unfavorable effects on the institution and assessing the ability of the institution to withstand them. These analyses should consider not only the likelihood of adverse events, reflecting their probability, but also “ worst case” scenarios. Ideally, such worst case analysis should be conducted on an institution - wide basis by taking into account the effect of unusual changes in prices or volatilities, market illiquidity or the default of a large counterparty across both the derivatives and cash trading portfolios and the loan and funding portfolios.

16. Such stress test should not be limited to quantitative that compute
    potential losses or gains. They should also include more qualitative analyses of the actions management might take under particular scenarios. Contingency plans outlining operating procedures and lines of communication, both format and informal, are important products of such qualitative analyses.

17. Limiting risks. A sound systems of integrated institution-wide limits and
    risk taking guideline is an essential component of the risk management process. Such a system should set boundaries for organizational risk-taking and should also ensure that positions that exceed certain predetermined levels receive prompt management attention. The limit system should be consistent with the effectiveness of the organization’s overall risk management process and with the adequacy of its capital position. An appropriate limit system should permit management to control exposures, to initiate discussion about opportunities and risks and to monitor actual risk taking against predetermined tolerances, as determined by the board of directors and senior management.

18. Global limits should be set for each major type of risk involved in an
    institution’s derivatives activities. These limits should be consistent with the institution’s overall risk measurement approach and should be integrated to the fullest extent possible

with institution-wide limits on those risks as they arise in all other activities of the institution. Where appropriate, the limit system should provide the capability to allocate limits down to individual business units.
10. If limits are exceeded, such occurrences should be made known to senior
management and approved only by authorised personnel. These positions should also prompt discussions about the consolidated risk taking activities of the institution or the unit conducting the derivatives activities. The seriousness of limit exceptions depends in large part upon management ‘s approach toward setting limits and on the actual size of individual and organizational limits relative to the institution’s capacity to take risk. An institution with relatively conservative limits may encounter more exceptions to those limits than an institution with less restrictive limits.
11. Reporting. An accurate, informative and timely management information
system is essential to the prudent operation of derivatives activities. Accordingly, the quality of the management process. The risk management function should monitor and report its measures of risks to appropriate levels of senior management an to the board of directors. In dealer operations, exposures and profit and loss statements should be reported at least daily to managers who supervise but so not , themselves, conduct those activities. More frequent reports should be made as market conditions dictate. Reports to other levels of senior management and the board may occur less frequently, but the frequency of reporting should provide these individuals with adequate information to judge the changing nature of the institution’s risk profile.
12. Management information systems should translate the measured risk for
derivatives activities from a technical and quantitative format to one that can be easily read and understood by senior managers and directors, who may not have specialized and technical knowledge of derivatives products, Risk exposures arising from various derivatives products should be reported to senior managers and directors using a common conceptual framework for measuring and limiting risks.
13. Management evaluation and review. Management should ensure that the
various components of the institution’s management process are regularly reviewed and evaluated. This review should take into account changes in the activities of the institution and in the market environment, since the changes may have created exposures that required additional attention. Any material changes may have created exposures that required addition attention. Any material changes to the risk management system should also be reviewed.
14. The risk management functions should regularly assess the methodologies,
models and assumptions used to measure risk and to limit exposures. Proper documentation of these elements of the risk measurement system is essential for conducing meaningful reviews. the review of limit structures should compare limits are appropriate in view of the institution’s past performance and current capital position.

15. The frequency and extent to which an institution should re-evaluate its risk
    measurement methodologies and models depends, in part, on the specific risk exposures created by their derivatives activities, on the pace and nature if market changes and on the pace if innovation with respect to measuring and managing risks. At minimum, an institution with significant derivatives activities should review the underlying methodologies of its models at least annually - and more often as market conditions dictate - to ensure they are appropriate and consistent. such internal evaluations may, in many cases, be supplemented by reviews by external auditors or other qualified outside parties, such as consultants who have expertise with highly technical models and risk management techniques. Assumptions should be evaluated on a continual basis.
16. The institution should also have an effective process to evaluate and
    review the risks involved in products that are either new to it, or new to the marketplace and of potential interest to the institution. It should also introduce new products in a manner that adequately limits potential losses and permits the testing of internal system. An institution should not become involved in a product at significant levels until senior management and all relevant personnel ( including those in risk management, internal control, legal, accounting and auditing ) understand the product and are able to integrate the product into the institution’s risk measurement and control systems.
    IV. Internal controls and audits
17. Policies and related procedures for the operation of derivatives activities
    should be an extension of the institution’s overall structure of an controls and should be fully integrated into routine work-flows. A sound system of internal controls should promote effective and efficient operations; reliable financial and regulatory reporting; and compliance with relevant laws, regulations and policies of the institution. In determining whether internal controls meet those objectives, the institution should consider the overall control environment of the organization; the process for identifying, analyzing and managing risk, the adequacy of management information systems; and adherence to control activities such as approvals, confirmations and recitations. Reconciliation control is particularly important where there are differences in the valuation methodologies or systems used by the front and back offices.
18. An important step in the process of reviewing internal controls is the
    frequency, scope and findings of independent internal and external auditors and the ability of those auditors to review the institution’s derivatives activities. Internal auditors should audit and teat the risk management process and internal controls on a periodic basis, with the frequency based on a careful risk assessment. The depth and frequency of internal audits should be increased if weakness and significant issues are discovered, or if significant changes have been made to product lines, modeling methodologies, the risk oversight process, internal controls or the overall risk profile of the institution. To facilitate the development of adequate controls, internal auditors should be brought into the product development process at the earliest possible stage.
19. Internal auditors are expected to evaluate the independence and overall
    effectiveness of the institution’s risk management function. In this regard, they should

thoroughly evaluate the effectiveness of internal controls relevant to measuring, reporting and limiting risks. Internal auditors should evaluate compliance with risk limits and the reliability and timeliness of information reported to the institution reported to the institution’s senior management and board of directors.
4. The internal auditors’ assessment of the adequacy of internal controls
involves a process of understanding, documenting, evaluating and testing an institution’s internal control system. This assessment should include product or business line reviews which, in turn, should start with an assessment of line’s organizational structure. Especially for dealer operations, the auditors should check for adequate separation of duties ( particularly between market personnel and functions of internal control and risk management ), adequate oversight by a knowledgeable manager without day-to-day responsibilities in the dealer operation and the presence of separate reporting lines for risk management and internal control personnel on one side and for market making personnel on the other. Product-by-product reviews of management structured should supplement the overall assessment of the organizational structure of the institution’s derivatives business.
5. The institution should establish internal controls for key activities. For
example, for transaction recording and processing, the institution should have written policies and procedures for recording trades, assess the trading area’s adherence to policy and analyze the transaction processing cycle, including settlement, to ensure the integrity and accuracy of its records and management reports. The institution should review the revaluation process in order to assess the adequacy of written policies and procedures for revaluing positions and for creating any associated revaluation reserves. The institution should review compliance with revaluation policies and procedures, the frequency of revaluation and the independence and quality of the sources of revaluation prices, especially of instruments originated and traded in illiquid markets. All significant internal controls associated with the management of market risk, such as position versus limit reports and approval policies and procedures for limit exceptions, should also be reviewed. The institution also should review the credit approval process to ensure that the risks of specific products are adequately captured and that credit approval procedures are followed for all transactions. In this connection, institutions should recognize their combined credit exposure to given counterparty that arise from transactions conducted throughout the bank.
V. Sound risk management practices for each type of risk

1. The following sections present sound practices for the specific
   components of an institution’s risk management process in the context of each of the risk involved in derivatives activities.
2. Credit risk. Boardly defined, credit risk is the risk that a counterparty will
   fail to perform on an obligation to the institution. The institution should evaluate both settlement and pre-settlement credit risk at the customer level across all products. On settlement day, the exposure to counterparty default may equal the full value of any cash flows or securities the institution is to receive. Prior to settlement, credit risk is measured

as the sum of the replacement cost of the position, plus an estimate of the institution’s potential future exposure from the instrument as a result of market changes. Replacement cost should be determined using current market prices or generally accepted approaches for estimating the present value of future payments required under each contract, given current market conditions.
3. Potential credit risk exposure is measured more subjectively than current
exposure and is primarily a function of the time remaining to maturity and the expected volatility of the price, rate or index underlying the contract. dealers and large derivatives participants should assess potential exposure through simulation analysis or other sophisticated techniques, which, when properly, designed and implemented can produce estimates of potential exposure that incorporate both portfolio-specific characteristics and current market conditions. Smaller end-user may measure this exposure by using “add￾ons” based on more general characteristics. In either case, the assumptions underlying the institution’s risk measure should be reasonable and if the institution measures exposures using a portfolio approach, it should do so in a prudent manner.
4. An institution can use the master netting agreements and various credit
enhancements, such as collateral or third-party guarantees, to reduce its counterparty credit risk. In such cases, an institution’s credit exposures should reflect these risk￾reducing features only to the extent that the agreements and resource provisions are legally enforceable in all relevant jurisdictions. This legal enforceability should extend to any insolvency proceedings of the counterparty. The institution should be able to demonstrate that it has exercised due diligence in evaluating the enforceability of these contracts and that individual transactions have been executed in a manner that provides adequate protection to the institution.
5. Credit limits that consider both settlement and pre-settlement exposure
should be established for all counterparties with whom the institution conducts business, As a matter of general policy, business with a counterparty should not be commerce until a credit line has been approved. The structure of the credit-approval process may differ among institutions, reflecting the organizational and geographic structure of each institution. Nevertheless, in all cases, it is important that credit limits be determined by personnel who are independent of the derivatives function, that these personnel use standards consistent with those used for other activities and that counterparty credit lines are consistent with the organisation’s policies and consolidated exposures.
6. If credit limits are exceeded, exceptions should be resolved according to
the institution’s policies and procedures. In addition, the institution’s report should adequately provide traders and credit officers with relevant, accurate and timely information about the credit exposures and approved credit lines.
7. Similar to bank loans, over-the-counter derivatives products can have
credit exposures that can exist for an extended period. Given these potentially long-term exposures and the complexity associated with some derivatives instruments, an institution

should consider the overall financial strength of its counterparties and their ability to perform on their obligations.
8. Market risk. Market risk to an institution’s financial condition resulting
from adverse movements in the level or volatility of market prices. The market risks created-or hedged- by a future or swap are similar, although not necessarily straightforward to manage. They are exposures to changes in the underlying cash instrument and to changes in interest rates. By contrast, the value of an option is also affected by other factors, including the volatility of the price of the underlying instrument and the passage of time. In addition, all trading activities are affected by market liquidity and by local or world political and economic events.
9. Market risk is increasingly measured by market participants using a value￾at-risk approach, which measures the potential gain or loss in a position, portfolio or
institution that is associated with a price movement of a given probability over a specified at least daily. Although an institution may use risk measures other than value at risk, the measure used should be sufficiently accurate and rigorous, and the institution should ensures that it is adequately incorporated into its risk management process.
10. An institution should compare its estimated market risk exposures with
actual behavior. In particular, the output of any market risk models that require simulations or forecasts of future prices should be compared with actual results. If the projected and actual results differ materially, the assumptions used to derive the projections should be carefully reviewed or the models should be modified, as appropriate.
11. The institution should establish limits for market risk that related to its risk
measures and that are consistent with maximum exposure authorised by its senior management and board of directors. These limits should be allocated to business units and individual decision makers and be clearly understood by all relevant parties. Exceptions to limits should be detected and adequately addressed by management. In practice, some limit systems may include additional elements such as stop-loss limits and guidelines that may play an important role in controlling risks.
12. An institution whose derivatives activities are limited in volume and
confined to end-user activities may need less sophisticated risk measurement systems than those required by a dealer. Senior management at such an institution should ensure that all significant risks arising from its derivatives transactions can be quantified, monitored and controlled. At a minimum, risk management systems should evaluate the possible impact on the institution’s earnings and capital which may result from adverse changes in interest rates and other markets conditions that are relevant to risk exposure and the effectiveness of derivatives transactions in the institution’s overall risk management.
13. Liquidity risk. An institution faces two types of liquidity risk in its
derivatives activities: one related to specific products or markets and the other related to

the general funding of the institution’s derivatives activities. The former is the risk that an institution may not be able to, or cannot easily, unwind or offset a particular position at or near the previous market price because of inadequate market depth or disruptions in the marketplace. Funding liquidity risk is the risk that the institution will be unable to meet its payment obligations on settlement dates or in the event of margin calls. Because neither type of liquidity risk is necessary risk is necessarily unique to derivatives activities, management should evaluate these risks in the broder context of the institution’s overall liquidity. When establishing limits, the institution should be aware of the size, depth and liquidity of the particular market and establish guidelines accordingly.
14. In developing guidelines for controlling liquidity risks, an institution
should consider the possibility that it could lose access to one or more markets, either because of concerns about the institution’s own creditworthiness, the creditworthiness of a major counterparty or because of generally stressful market conditions. At such times, the institutionmay have less flexibility in managing its market, credit and liquidity risk exposures. An institution that makes markets in over-the-counter derivatives or that dynamically hedges its positions required constants access to financial markets and that need may increase in times of market stress. The institution’s liquidity plan should reflect the institution’s ability to return to alternative markets, such as future or cash market, or to provide sufficient collateral or other credit enhancernments in order to continue trading under a board range of scenarios.
15. An institution that participates in over-the-counter derivatives markets
should assess the potential liquidity risks associated with the early termination of derivatives contracts. Many forms of standardised contracts for derivatives transactions allow counterparties to request collateral or to terminate their early if the institution experiences an adverse credit event or a deterioration in its financial condition. In addition, under conditions of markets stress, customers may ask for the early termination of some contracts within the context of the dealer’s market making activities. In such situations, an institution that owes money on derivatives transactions may be required to deliver collateral or settle a contract early and possibly at a time when the institution may face other funding and liquidity pressures. Early terminations also may open up additional, unintended, market positions. Management and directors should be aware of these potential liquidity risks and should address them in the institution’s liquidity plan and in the broader context of the institution’s liquidity management process.
16. Operations risk. Operations risk is the risk that deficiencies in information
systems or internal controls will result in unexpected loss. This risk associated with human error, system failures and inadequate procedures and controls. This risk can be exacerbated in the case of certain derivatives because of the complex nature of their payment structures and calculation of their values.
17. The board of directors and senior management should ensure the proper
dedication of resources ( financial and personnel) to support operations and systems development and maintenance. The operations unit for derivatives activities, consistent with other trading and investment activities, should report to an independent unit and

should be managed independently of the business unit. The sophistication of the systems support and operational capacity should be commensurate with the size and complexity of the derivatives business activity.
18. Systems support and operational capacity should be able to adequately
accommodate the types of derivatives activities in which the institution engages. This includes the ability to efficiently process and settle the volumes transacted through the business unit, to provide support for the complexity of the transactions booked and to provide accurate and timely input. support systems and the systems developed to interface with the official databases should general accurate information sufficient to allow business unit management and senior management to monitor risk exposures in a timely manner.
19. Systems needs for derivatives activities should be evaluated during the
strategic planning process. current and projected volumes should be considered together with the nature if the derivatives activity and the user’s expections. Consistent with other systems plans, a written contingency plan for derivatives products should be in place.
20. with the complexity of derivatives products and the size and rapidity of
transactions, it is essential that operational units be able to capture all relevant details of transactions, identify errors and process payments or move assets quickly and accurately. This required a staff of sufficient size, knowledge and experience to support the volume and type of transactions generated by the business unit. Management should develop appropriate hiring practices and compensation plans to recruit and retain high caliber staff.
21. Systems design and needs may vary according to the size and complexity
of the derivatives business. However, each system should provide for accurate and timely processing and allow for proper risk exposure monitoring. Operational systems should be tailored to each institution’s needs. Limited end-user of derivatives may not required the same degree of automation needed by more active institutions. All operational systems and units should adequately provide for basis processing, settlement and control of derivatives transactions.
22. The more sophisticated the institution’s activity, the more need there is to
establish automated systems to accommodate the complexity of the deals transacted, to accommodate the volume of trades conducts and to reconcile more efficiently and report position information accurately,
23. segregation of operational duties, exposure reporting and risk monitoring
from the business unit is critical to proper internal control. Proper internal control should be provided over the entry of transactions into the database, transaction numbering, date and item notation and the confirmation and settlement process. Operational controls also should be in place to resolve disputes over contract specifications. In this regard, an institution should ensure that trades are confirmed as quickly as possible. The institution

should monitor the consistency between the terms of a transaction as they were agreed upon and the terms as they wee subsequently confirmed.
24. The operations department , or other unit or entity independent of the
business unit, should be responsible for ensuring proper reconciliation of format and back office databases on a regular basis. This includes the verification of position data, profit and loss figures and transaction-by-transaction details.
25. The institution should ensure that the methods it uses to value its
derivatives positions are appropriate and that assumptions underlying those methods are reasonable. The pricing procedures and models the institution chooses should be consistently applied and well-documented. Models and supporting statistical analyses should be validated prior to use and as market conditions warrant.
26. Management of the institution should ensure that a mechanism exists
whereby derivatives contract documentation is confirmed, maintained and safeguarded, An institution should establish a process through which documentation exceptions are monitored and resolved and appropriately reviewed by senior management and legal counsel. The institution also should have approved policies that specify documentation requirements for derivatives activities and formal procedures for saving and safeguarding important documents that are consistent with legal requirement and internal policies.
27. Although operations risks are difficult to quantify, they can often be
evaluated by examining a series of “worst-case” or “what if” scenarios, such as a power loss, doubling of transaction volume or a mistakes found in the pricing software for collateral management. They also can be assessed through periodic reviews of procedures, documentation requirements, data processing systems, contingency plans and other operational practices. Such reviews may help to reduce the likelihood of errors and breakdowns in controls, improve the control of risk and the effectiveness of the limit system and prevent unsound marketing practices and the premature adoption of new products or lines of business.
28. Legal risk. Legal risk is the risk that contracts are not legally enforceable
or documented correctly. Legal risks should be limited and managed through policies developed by the institution’s legal counsel ( typically in consultation with officers in the risk management process) that have been approved by the institution’s senior management and board of directors. At a minimum, there should be guidelines and process in place to ensure the enforceability of counterparty agreements.
29. Prior to engaging in derivatives transactions, an institution should
reasonably satisfy itself that its counterparties have the legal and necessary regulatory authority to engage in those transaction, an institution also should reasonably satisfy itself that the terms of any contract governing its derivatives activities with a counterparties are legally sound.

30. An institution should adequately evaluate the enforceability of its
    agreements before individual transactions are consummated. Participants in the derivatives markets have experienced significant losses because they were unable to recover losses from a defaulting counterparty when a court held the counterparty had acted outsides of its authority in entering into such transactions. An institution should ensure that it is counterparties have the power and authority to enter into derivatives transactions and that the counterparties’ obligations arising from them are enforceable. Similarly, an institution also should ensure that its rights with respect to any margin or collateral received from a counterparty are enforceable and exercised.
31. The advantages of netting arrangements can included a reduction in credit
    and liquidity risks, the potential to do more business with existing counterparties within existing credit lines and a reduced need for collateral to support counterparty obligations. The institution should ascertain that its netting agreements are adequately documented and that they have been executed properly. Only when a netting arrangement is legally enforceable in all relevant jurisdictions should an institution monitor its credit and liquidity risks on a net basis.
32. The institution should have knowledge of relevant tax laws and
    interpretations governing the use of derivatives instruments. Knowledges of these laws is necessary not only for the institution’s marketing activities but also for its own use of these products. Basle, July 1994