Risk Management Guidelines for Derivatives Annex A

Annex A RISK MANAGEMENT GUIDELINES FOR DERIVATIVES Hong Kong Monetary Authority December 1994

RISK MANAGEMENT GUIDELINES FOR DERIVATIVES INTRODUCTORY NOTE

1. This introductory note and the accompanying Risk Management Guidelines for Derivatives issued by the Basle Committee on Banking Supervision (“ Basle Guidelines”) together constitute a guideline issued by the Monetary Authority which is applicable to derivatives activities conducted by authorised institutions. “Derivatives” are defined for this purpose as financial contracts whose value depends on the value of one or more underlying assets or indices.

2. Sound risk management is essential to promoting stability in both individual institutions and in the system as a whole. This is true in all aspects of an institution’s business, but it is particularly so in relation to derivatives. While the nature of the risks involved in the derivatives activity are not new, the complexity of certain of these products makes the risks involved difficult to measure, monitor and control.

3. The Monetary Authority considers that the attached Basle Guidelines should have relevance to all institutions which engage in derivatives activity in one form or another. It is recognised however that not all institutions participate to the same degree. Some may be only occasional end-users of straightforward products for hedging purposes. At the other extreme, some institutions may be active developers of , and dealers in , complex structured products.

4. It is accepted that the manner in which the Basle Guidelines are translated into actual controls depends on the size and complexity of an institution’s derivatives activities. In general, therefore, institutions are expected to have risk management systems and controls in place with are commensurate with the nature of their derivatives business and the size of risk that they are incurring. The Monetary Authority will take these factors into account in assessing the adequacy of institutions’ systems for management the risk arising from their derivatives activities. However, what is basis to all institutions is that, as with all other aspects of their activities, there should be “appropriate oversight by the board of directors and senior management”.

5. This latter point also recognize that the risk management practices advocated by the Basle Committee and supported by the Monetary Authority are applicable to all types of products, not just derivatives. The Guidelines therefore recommend that the “the process of risk management for derivatives activities should be integrated into the institution’s overall risk management system”. Summary of Basle Guidelines

6. The points summarized below are those to which the Monetary Authority would wish institutions to devote particular attention. Institutions should however study carefully the Basle Guidelines as a whole. I. Overseeing the risk management process l Written policies approved by the Board of Directors: Risk management policies ( including those related to derivatives ) should be consistent with the institution’s broder business strategies, capital strength, management expertise and the risk tolerances of the Board. The Board ( or a committee of the Board ) should be informed regularly of the risk exposure of the institution, and should regularly re-evaluate significant risk management policies and procedures. l Senior management to ensure adequate risk management measures: These include clear delineation of lines of responsibilities for managing risk, adequate systems for measuring risk, appropriately structured limits on risk taking, effective internal controls and a comprehensive risk-reporting process. l Proper risk evaluation before entering into derivatives business: The evaluation should cover the issues set out in the preceding paragraph and related legal, accounting and tax issues. Before engaging in derivatives activities, management should ensure that all appropriate approvals are obtained and that adequate operational procedures and risk controls systems are in place, along with the necessary staff and resources. l Remuneration policies to avoid encouraging excessive risk taking: They should be structured to avoid for example trying salaries too closely to the profitability of derivatives. l Independent risk management functions: To the extent warranted by the institution’s activities, the risk management functions for measuring, monitoring and controlling risk should be managed independently of individuals conducting derivatives activities. There should be an independent reporting line to the Board and senior management. Staff involved in risk management should have the appropriate expertise. II The risk management process l An integrated approach to risk management: The risk management process for derivatives activities should be integrated into the overall risk management system of the institution to the fullest extent possible. A common framework should be used to enable management to assess individual risks involved in derivatives and non￾derivatives activities on a consolidated basis. l Adequate awareness of risk measurement standards: risk measures and the risk measurement process should be sufficiently robust to reflect accurately the

multiple types of risks facing the institution. These should be understood by all relevant personnel at all levels of the institution. l Timely marking to market: An institution should revalue all derivatives trading portfolios and calculate its exposures at least daily. This is particularly important for an institution which is active in dealing in derivatives. l Stress tests and contingency plans: These should assess the impact of ( and the ability of the institution to withstand) “worst case” scenarios which take into account adverse market events such as unusual changes in prices or volatilities, market illiquidity or the default of a major counterparty. Actions and procedures to deal with such situations should be outlines. l Accurate, informative and timely management information system: Such information should be easily understood and enable senior management and the Board to judge the changing nature of the institution’s risk profile. In dealer operations, exposures and profit and loss statements should be reported at least daily to managers who do not themselves conduct such operations. l Regular management evaluation and review: Risk management models, methodologies and assumptions used to measure risk and to limit exposures should be regularly assessed and documented. Institutions with significant derivatives activities should review the underlying methodologies of their modals at least annually. III. Internal controls and audits l Internal controls for key activities: Such controls should promote effective and efficient operations; reliable financial and regulatory reporting; and compliance with relevant laws regulations and policies of the institution. Segregation of operational duties, exposure reporting and risk monitoring from the business unit is particularly critical. l Internal auditors should audit and test the risk management process on a periodic basis: They should evaluate the independence and overall effectiveness of internal controls relevant to measuring, reporting and limiting risks, compliance with risk limits and the reliability and timeliness of information reported to senior management and the Board. Internal audit staff should have the appropriate expertise. IV Sound risk management practices for each type of risk l Credit risk: The institution should evaluate both settlement and pre￾settlement risk at the customer level across all products. Credit limits should be established for all customers. The capability of customers to understand the nature and risks of derivatives transactions should be carefully assessed.

l Market risk: Exposure in the trading portfolio should be calculated at least daily by using the value-at-risk approach or other appropriate measures. Limits should be establishes for market risk consistent with the maximum exposures authorised by senior management/ the Board. l Liquidity risk: The institution should take account of the liquidity risks associated with specific products and with the general need to fund derivatives activities. These should be evaluated in the broader context of the institution’s overall liquidity, in both normal and stress conditions. Account should be taken of the need to fund margin payments and of the impact of early termination of derivatives contracts. l Operations risk: Systems support and operational capacity should be able to adequately accommodate the types of derivatives activities in which the institution engages, particularly bearing in mind the complexity of certain derivatives. l Legal risk: The institution should ensure that its counterparties have the power and authority to enter into derivatives transactions and that the counterparties’ obligations arising from them are enforceable. Only netting agreements which are legally enforceable in all relevant jurisdictions should be used. Hong Kong Monetary Authority December 1994