Risk Management Guidelines for Derivatives

CIRCULAR LETTER Series of 1994

TO : All Commercial Banks/Expanded Commercial Banks/Specialized Government Banks

Enclosed for your information and guidance is the 'RISK MANAGEMENT GUIDELINES FOR DERIVATIVES". This is part of the efforts of the Bangko Sentral ng Pilipinas to address supervisory issues related to sound management of risks.

The guidelines include principles on appropriate oversight by boards of directors and senior management; an adequate risk management process; accurate and reliable management information systems; and thorough audit and control procedures.

While the precise applicability of the Guidelines will depend on the size and complexity of an institution's derivative activities, the application of the basic principles embodied therein are very relevant even for risks inherent in more traditional activities.

ALBERTO V. REYES. Managing Director

RISK MANAGEMENT GUIDELINES FOR DERIVATIVES INTRODUCTION AND BASIC PRINCIPLES

1. Derivatives instruments have become increasingly important to the overall risk profile and profitability of banking organizations throughout the world. Broadly defined, a derivatives instrument is a financial contract whose value depends on the values of one or more underlying assets or indexes. Derivatives transactions include a wide assortment of financial contracts, including forwards, futures, swaps and options. In addition, other traded instruments incorporate derivatives characteristics, such as those with embedded options. While some derivatives instruments may have very complex structures, all of them can be divided into the basic building blocks of options, forward contracts or some combination thereof. The use of these basic building blocks in structuring derivatives instruments allows the transfer of various financial risk to parties who are more willing, or better suited, to take or manage them.

2. Derivatives are used by banking organizations both as risk management tools and a source of revenue. From a risk management perspective, they allow financial institutions and other participants to identify, isolate and manage separately the market risks in financial instruments and commodities. When used prudently, derivatives can offer managers efficient and effective methods for reducing certain risks through hedging. Derivatives may also be used to reduce financing costs and to increase the yield of certain assets. For a growing number of banking organizations, derivatives activities are becoming a direct source of revenue through "market-making" functions, position taking and risk arbitrage:

— "market-making" functions involved entering into derivatives transactions with customers and with other market-makers while maintaining a generally balanced portfolio with the expectation of earning fees generated by a bid/offer spread;

— position-taking, on the other hand, represents efforts to profit by accepting the risk that steps from taking outright positions in anticipation of price movements;

— arbitrageurs also attempt to take advantage of price movements, but focus their efforts on trying to profit from small discrepancies in price among similar instruments in different markets.

3. Participants in the derivatives markets are generally grouped into two categories based primarily on their motivations for entering into derivatives contracts. End-users typically enter into derivatives transactions to achieve specified objectives related to hedging, financing or position taking on the normal course of their business operations. A wide variety of business enterprises are end-users. They include, but are not limited to, a broad range of financial institutions such as banks, securities firms and insurance companies: institutional investors such as pension funds, mutual funds and specialized investment partnerships; and corporations, local and state government, government agencies and international agencies.

4. Intermediaries, which are sometimes referred to as "dealers", cater to the needs of end-users by "making markets" in OTC derivatives instruments. In doing so, they expect to generate income from transaction fees, bid/offer spreads and their own trading positions. Important intermediaries, or derivative dealers, include major banks and securities firms. As intermediaries, banks have traditionally offered foreign exchange and interest rate risk management products to their customers and generally view derivatives products as a financial risk management service.

5. The basic risks associated with derivatives transactions are not new to banking organizations. In general, these risks are credit risk, market risk, liquidity risk, operations risk and legal risk. Because they facilitate the specific identification and management of these risks, derivatives have the potential to enhance the safety and soundness of financial institutions and to produce a more efficient allocation of financial risks. However, since derivatives also repackage these basic risks in combinations that can be quite complex, they can also threaten the safety and soundness of institutions if they are not clearly understood and properly managed.

6. Recognizing the importance of sound risk management to the effective use of derivatives instruments, the following guidance is intended to highlight the key elements and basic principles of sound management practice for both dealers and end-users of derivatives instruments. These basic principles include;

a. Appropriate oversight by boards of directors and senior management; b. Adequate risk management process that integrates prudent risk limits, sound measurement procedures and information systems, continuous risk monitoring and frequent management reporting; and, c. Comprehensive internal controls and audit procedures.

OVERSIGHT OF THE RISK MANAGEMENT PROCESS

1. As is standard practice for most banking activities, an institution should maintain written policies and procedures that clearly outline its risk management guidance for derivatives activities. At a minimum, these policies should identify the risk tolerance of the board of directors or appropriate management committee and should clearly delineate lines of authority and responsibility for managing the risk of these activities. Individuals involved in a derivatives activities should be fully aware of all policies and procedures that relate to their specific duties.

Board of Directors and/or Management Committee

2. The board of directors or appropriate management committee should approve all significant policies relating to the management of risks throughout the institution. These policies, which should include those related to derivatives activities, should be consistent with the organization's broader business strategies, capital strength, management expertise and overall willingness to take risk. Accordingly, the board should be informed regularly of the risk exposure of the institutions and should regularly re-evaluate significant risk management policies and procedures with special emphasis placed on those defining the institution's risk tolerance regarding these activities. The board of directors or appropriate management committee should also conduct and encourage discussions between its members and senior management, as well as between senior management and others in the institution, regarding the institution's risk management process and risk exposure.

Senior Management

3. Senior management should be responsible for ensuring that there are adequate policies and procedures for conducting derivatives operations on both a long-range and day-to-day basis. This responsibility includes ensuring that these are clear delineations of lines of responsibility for managing risk, adequate systems for measuring risk appropriately structures limits on risk taking, effective internal control and a comprehensive risk-reporting process.

4. Before engaging in derivatives activities, management should ensure that all appropriate approvals are obtained and that adequate operational procedures and risk control systems are in place. Proposals to undertake derivatives activities should include, as applicable:

— a description of the relevant financial products, markets and business strategies; — the resources required to establish sound and effective risk management systems and to attract and retain professionals with specific expertise in derivatives transactions; — an analysis of the reasonableness of the proposed activities in relation to the institution's overall financial condition and capital levels; — an analysis of the risks that may arise from the activities; — the procedures the bank will use to measure, monitor and control risks; — the relevant tax treatment; and — the relevant treatment; and — an analysis of any legal restrictions and whether the activities are permissible.

5. After the institution's initial entry into derivatives activities has been properly approved, any significant changes in such activities or any new derivatives activities should be approved by the board of directors or by an appropriate level of senior management, as designed by the board of directors.

6. Senior management should regularly evaluate the procedures in place to manage risk to ensure that those procedures are appropriate and sound. Senior management should also foster and participate in active discussions with the board/management committee, with staff of risk management functions and with traders regarding procedures for measuring and managing risk. Management must also ensure that derivatives activities are allocated sufficient resources and staff to manage and control risks. 7. As a matter of general policy, compensation policies — especially in the risk management, control and senior management functions — should be structured in a way that is sufficiently independent of the performance of trading activities, thereby avoiding the potential incentives for excessive risk taking that can occur if, for example, salaries are tied too closely to the profitability of derivatives.

Independent Risk Management Function

8. To the extent warranted by the bank's activities, the process of measuring, monitoring and controlling risk consistent with the established policies and procedures should be managed independently of individuals conducting derivatives activities, up through senior levels of the institution. An independent system for reporting exposures to both senior-level management, to the board of directors or management committee is an important element of this process.

9. The personnel staffing independent risk management functions should have a complete understanding of the risks associated with all of the bank's derivatives activities. Accordingly, compensation policies for these individuals should be adequate to attract and retain personnel qualified to assess these risks.

THE RISK MANAGEMENT PROCESS

1. The primary components of a sound risk management process are the following: a comprehensive risk measurement approach detailed structure of limits, guidelines and other parameters used to govern risk taking; and a strong management information system for controlling, monitoring and reporting risks. These components are fundamental to both derivatives and non-derivatives activities alike. Moreover, the underlying risks associated with these activities, such as credit, market, liquidity, operations and legal risk, are not new to banking, although their measurement and management can be more complex. Accordingly, the process of risk management for derivatives activities should be integrated into the institution's overall risk management system to the fullest extent possible using a conceptual framework common to the institution's other activities. Such a common framework enables the institution to manage its risk exposure more effectively, especially since the various individual risks involved in derivatives activities can, at times, be interconnected and can often transcend specific markets.

2. As is the case with all risk-bearing activities, the risk exposures an institution assumes in its derivatives activities should be fully supported by an adequate capital position. The institution should ensure that its capital position is sufficiently strong to support all derivatives risks on a fully consolidated basis and that adequate capital is maintained in all group entities engaged in these activities.

Risk Measurement

3. An institution's system for measuring the various risks of derivatives activities should be both comprehensive and accurate. Risk should be measured and aggregated across trading and non-trading activities on an institution-wide basis to the fullest extent possible.

4. While the use of a single prescribed risk measurement approach for management purposes may be essential, the institution's procedures should enable management to assess exposures on a consolidated basis. Risk measures and the risk measurement process should be sufficiently robust to reflect accurately the multiple types of risks facing institution. Risk measurement standards should be understood by relevant personnel at all levels of the institution — from individual traders to the board of directors — and should provide a common framework for limiting and monitoring risk taking activities.

5. With regard to dealer operations, the process of marking derivatives positions to market is fundamental to measuring and reporting exposures accurately and on a timely basis. An institution active in dealing foreign exchange, derivatives and other traded instruments should have the ability to monitor credit exposures, trading positions and market movements at least daily. Some institutions should also have the capacity, or at least the goal, of monitoring their more actively traded products on a real-time basis.

6. Analyzing stress situations, including combinations of market events that could affect the banking organization, is also an important aspect of risk measurement. Sound risk measurement practices include identifying possible events or changes in market behavior that could have unfavorable effects on the institution and assessing the ability of the institution to withstand them. These analyses should consider not only the likelihood of adverse events, reflecting their probability, but also "worst case" scenarios. Ideally, such worst case analysis should be conducted on an institution-wide basis by taking into account the effect of unusual changes in prices or volatilities, market illiquidity or the default of a large counterparty across both the derivatives and cash trading portfolios and the loan and funding portfolios.

7. Such stress tests should not be limited to qualitative exercises that compute potential losses or gains. They should also include more qualitative analyses of the actions management might take under particular scenarios. Contingency plans outlining operating procedures and lines of communication, both formal and informal, are important products of such qualitative analyses.

Limiting Risks

8. A sound system of integrated institution-wide limits and risk taking guidelines is an essential component of the risk management process. Such a system should set boundaries for organizational risk-taking and should also ensure that positions that exceed certain predetermined levels receive prompt management attention. The limit system should be consistent with the effectiveness of the organization's overall risk management process and with the adequacy of its capital position. An appropriate limit system should permit management to control exposures, to initiate discussion about opportunities and risks and to monitor actual risk taking against predetermined tolerances, as determined by the board of directors/ management committee and senior management.

9. Limits should be set for each major type of risk involved in an institution's derivatives activities, these limits should be consistent with the institution's overall risk measurement approach and should be integrated to the fullest extent possible with institution-wide limits on those risks as they arise in all other activities of the institution. Where appropriate, the limit system should provide the capability to allocate limits down to individual business units.

10. If limits are exceeded, such occurrences should be made known to senior management and approved only by authorized personnel. These positions should also prompt discussions about the consolidated risk taking activities of the institution or the unit conducting the derivatives activities. The seriousness of limit exceptions depends in large part upon management's approach toward setting limits and on the actual size of individual and organizational limits relative to the institution's capacity to take risk. An institution with relatively conservative limits may encounter more exceptions to those limits than an institution with less restrictive limits.

Reporting

11. An accurate, informative and timely management information system is essential to the prudent operation of derivatives activities. Accordingly, the quality of the management information system is an important factor in the overall effectiveness of the risk management process. The risk management function should monitor and report its measures of risks to appropriate levels of senior management, management committee/the board of directors. In dealer operations, exposures and profit and loss statements should be reported at least daily to managers who supervise but do not, themselves, conduct those activities. More frequent reports should be made as market conditions dictate. Reports to other levels of senior management and the board may occur less frequently, but the frequency of reporting should provide these individuals with adequate information to judge the changing nature of the institution's risk profile.

12. Management information systems should translate the measured risk for derivatives activities from a technical and quantitative format to one than can be easily read and understood by senior managers and directors, who may not have specialized and technical knowledge of derivatives products. Risk exposures arising from various derivatives products should be reported to senior managers and directors using a common conceptual framework for measuring and limiting risks.

Management Evaluation and Review

13. Management should ensure that the various components of the institution's risk management process are regularly reviewed and evaluated. This review should take into account changes in the activities of the institution and in the market environment, since the changes may have created exposures that require additional attention. Any material changes to the risk management system should be reviewed.

14. The risk management functions should regularly assess the methodologies, models and assumptions used to measure risk and to limit exposures. Proper documentation of these elements of the risk measurement system is essential for conducting meaningful reviews. The review of limit structures should compare limits to actual exposures and should also consider whether existing measures of exposure and limits are appropriate in view of the institution's past performance and current capital position.

15. The frequency and extent to which an institution should re-evaluate its risk measurement methodologies and models depends, in part, on the specific risk exposures created by their derivatives activities, on the pace of innovation with respect to measuring and managing risks. At a minimum, an institution with significant derivatives activities should review the underlying methodologies of its models at least annually — and more often as market conditions dictate — to ensure they are appropriate and consistent. Such internal evaluations may, in many cases, be supplemented by reviews by external auditors or other …