SYSC 7

Risk control

SYSC 7.1

Risk control


[Note: ESMA has also issued guidelines under article 16(3) of the ESMA Regulation covering certain aspects of the MiFID compliance function requirements. See http://www.esma.europa.eu/content/Guidelines-certain-aspects-MiFID-compliance-function-requirements.]

SYSC 7.1.1

See Notes

handbook-guidance
SYSC 4.1.1 R requires a firm to have effective processes to identify, manage, monitor and report the risks it is or might be exposed to.

SYSC 7.1.2

See Notes

handbook-rule

A common platform firm must establish, implement and maintain adequate risk management policies and procedures, including effective procedures for risk assessment, which identify the risks relating to the firm's activities, processes and systems, and where appropriate, set the level of risk tolerated by the firm.

[Note: article 7(1)(a) of the MiFID implementing Directive, article 13(5) second paragraph of MiFID]

SYSC 7.1.2A

See Notes

handbook-guidance
Other firms should take account of the risk management policies and procedures rule (SYSC 7.1.2 R) as if it were guidance (and as if should appeared in that rule instead of must) as explained in SYSC 1 Annex 1.3.3 G.

SYSC 7.1.3

See Notes

handbook-rule

A common platform firm must adopt effective arrangements, processes and mechanisms to manage the risk relating to the firm's activities, processes and systems, in light of that level of risk tolerance.

[Note: article 7(1)(b) of the MiFID implementing Directive]

SYSC 7.1.4

See Notes

handbook-rule

The management body of a common platform firm must approve and periodically review the strategies and policies for taking up, managing, monitoring and mitigating the risks the firm is or might be exposed to, including those posed by the macroeconomic environment in which it operates in relation to the status of the business cycle.

[Note: article 76(1) of CRD]

SYSC 7.1.4A

See Notes

handbook-guidance
For a common platform firm included within the scope of SYSC 20 (Reverse stress testing), the strategies, policies and procedures for identifying, taking up, managing, monitoring and mitigating the risks to which the firm is or might be exposed include conducting reverse stress testing in accordance with SYSC 20. A common platform firm which falls outside the scope of SYSC 20 should consider conducting reverse stress tests on its business plan as well. This would further senior personnels understanding of the firm's vulnerabilities and would help them design measures to prevent or mitigate the risk of business failure.

SYSC 7.1.4B

See Notes

handbook-guidance
Other firms should take account of the risk management rules (SYSC 7.1.3 R and SYSC 7.1.4 R) as if they were guidance (and as if "should" appeared in those rules instead of "must") as explained in SYSC 1 Annex 1.3.3 G.

SYSC 7.1.5

See Notes

handbook-rule

A common platform firm must monitor the following:

  1. (1) the adequacy and effectiveness of the firm's risk management policies and procedures;
  2. (2) the level of compliance by the firm and its relevant persons with the arrangements, processes and mechanisms adopted in accordance with SYSC 7.1.3 R;
  3. (3) the adequacy and effectiveness of measures taken to address any deficiencies in those policies, procedures, arrangements, processes and mechanisms, including failures by the relevant persons to comply with such arrangements or processes and mechanisms or follow such policies and procedures.

[Note: article 7(1)(c) of the MiFID implementing Directive]

SYSC 7.1.6

See Notes

handbook-rule

A common platform firm must, where appropriate and proportionate in view of the nature, scale and complexity of its business and the nature and range of the investment services and activities undertaken in the course of that business, establish and maintain a risk management function that operates independently and carries out the following tasks:

  1. (1) implementation of the policies and procedures referred to in SYSC 7.1.2 R to SYSC 7.1.5 R; and
  2. (2) provision of reports and advice to senior personnel in accordance with SYSC 4.3.2 R.

[Note: MiFID implementing Directive Article 7(2) first paragraph]

SYSC 7.1.7

See Notes

handbook-rule

Where a common platform firm is not required under SYSC 7.1.6 R to maintain a risk management function that functions independently, it must nevertheless be able to demonstrate that the policies and procedures which it has adopted in accordance with SYSC 7.1.2 R to SYSC 7.1.5 R satisfy the requirements of those rules and are consistently effective.

[Note: article 7(2) second paragraph of the MiFID implementing Directive]

SYSC 7.1.7A

See Notes

handbook-guidance
Other firms should take account of the risk management rules (SYSC 7.1.5 R to SYSC 7.1.7 R) as if they were guidance (and as if should appeared in those rules instead of must) as explained in SYSC 1 Annex 1.3.3 G.

SYSC 7.1.7B

See Notes

handbook-guidance
In setting the method of determining the remuneration of employees involved in the risk management function, firms that SYSC 19A applies to will also need to comply with the Remuneration Code.

SYSC 7.1.7C

See Notes

handbook-guidance
Firms should also consider the additional guidance on risk-centric governance arrangements for effective risk management contained in SYSC 21.

SYSC 7.1.8

See Notes

handbook-guidance
  1. (1) [deleted]
  2. (2) The term 'risk management function' in SYSC 7.1.6 R and SYSC 7.1.7 R refers to the generally understood concept of risk assessment within a firm , that is, the function of setting and controlling risk exposure. The risk management function is not a controlled function itself, but is part of the systems and controls function (CF28).

SYSC 7.1.9

See Notes

handbook-rule

A BIPRU firm must base credit-granting on sound and well-defined criteria and clearly establish the process for approving, amending, renewing, and re-financing credits.

[Note: annex V paragraph 3 of the Banking Consolidation Directive]

SYSC 7.1.10

See Notes

handbook-rule

A BIPRU firm must operate through effective systems the ongoing administration and monitoring of its various credit risk-bearing portfolios and exposures, including for identifying and managing problem credits and for making adequate value adjustments and provisions.

[Note: annex V paragraph 4 of the Banking Consolidation Directive]

SYSC 7.1.11

See Notes

handbook-rule

A BIPRU firm must adequately diversify credit portfolios given its target market and overall credit strategy.

[Note: annex V paragraph 5 of the Banking Consolidation Directive]

SYSC 7.1.12

See Notes

handbook-guidance
The documentation maintained by a BIPRU firm under SYSC 4.1.3 R should include its policy for credit risk, including its risk appetite and provisioning policy and should describe how it measures, monitors and controls that risk. This should include descriptions of the systems used to ensure that the policy is correctly implemented.

SYSC 7.1.13

See Notes

handbook-rule

A BIPRU firm must address and control by means of written policies and procedures the risk that recognised credit risk mitigation techniques used by it prove less effective than expected.

[Note: annex V paragraph 6 of the Banking Consolidation Directive]

SYSC 7.1.14

See Notes

handbook-rule

A BIPRU firm must implement policies and processes for the measurement and management of all material sources and effects of market risks.

[Note: annex V paragraph 10 of the Banking Consolidation Directive]

SYSC 7.1.15

See Notes

handbook-rule

A BIPRU firm must implement systems to evaluate and manage the risk arising from potential changes in interest rates as they affect a BIPRU firm's non-trading activities.

[Note: annex V paragraph 11 of the Banking Consolidation Directive]

SYSC 7.1.16

See Notes

handbook-rule

A BIPRU firm must implement policies and processes to evaluate and manage the exposure to operational risk, including to low-frequency high severity events. Without prejudice to the definition of operational risk, BIPRU firms must articulate what constitutes operational risk for the purposes of those policies and procedures.

[Note: annex V paragraph 12 of the Banking Consolidation Directive]

SYSC 7.1.16A

See Notes

handbook-guidance

In meeting the general standard referred to in SYSC 7.1.16 R, a BIPRU firm that undertakes market-related activities should be able to demonstrate to the appropriate regulator:

  1. (1) in the case of a BIPRU firm calculating its ORCR using the basic indicator approach or standardised approach, that it has considered; or
  2. (2) in the case of a BIPRU firm with an AMA permission, compliance with

the Committee of European Banking Supervisors Guidelines on the management of operational risk in market-related activities, published in October 2010. These can be found at http://www.eba.europa.eu/documents/Publications/Standards---Guidelines/2010/Management-of-op-risk/CEBS-2010-216-(Guidelines-on-the-management-of-op-.aspx

SYSC 7.1.16B

See Notes

handbook-guidance
In meeting the general standards referred to in SYSC 7.1.16 R, a firm with AMA approval should be able to demonstrate to the appropriate regulator that it has considered and complies with Section III of the European Banking Authority's Guidelines on the Advanced Measurement Approach (AMA) - Extensions and Changes published in January 2012. These can be found at http://eba.europa.eu/cebs/media/Publications/Standards%20and%20Guidelines/2012/EBA-BS-2011-209-final-(EBA-GL-on-AMA-extensions-and-changes).pdf

Additional rules for CRR firms

SYSC 7.1.17

See Notes

handbook-rule
  1. (1) The management body of a CRR firm has overall responsibility for risk management. It must devote sufficient time to the consideration of risk issues.
  2. (2) The management body of a CRR firm must be actively involved in and ensure that adequate resources are allocated to the management of all material risks addressed in the rules implementing the CRD and in the EU CRR as well as in the valuation of assets, the use of external ratings and internal models related to those risks.
  3. (3) A CRR firm must establish reporting lines to the management body that cover all material risks and risk management policies and changes thereof.

[Note: article 76(2) of CRD]

SYSC 7.1.18

See Notes

handbook-rule
  1. (1) A CRR firm that is significant must establish a risk committee composed of members of the management body who do not perform any executive function in the firm. Members of the risk committee must have appropriate knowledge, skills and expertise to fully understand and monitor the risk strategy and the risk appetite of the firm.
  2. (2) The risk committee must advise the management body on the institution's overall current and future risk appetite and assist the management body in overseeing the implementation of that strategy by senior management.
  3. (3) The risk committee must review whether prices of liabilities and assets offered to clients take fully into account the firm's business model and risk strategy. Where prices do not properly reflect risks in accordance with the business model and risk strategy, the risk committee must present a remedy plan to the management body.

[Note: article 76(3) of CRD]

SYSC 7.1.18A

See Notes

handbook-guidance
In SYSC 7.1.18 R a 'CRR firm that is significant' means a deposit-taker or designated investment firm whose size, interconnectedness, complexity and business type gives it the capacity to cause some disruption to the UK financial system (and through that to economic activity more widely) by failing or by carrying on its business in an unsafe manner.

SYSC 7.1.19

See Notes

handbook-rule
  1. (1) A CRR firm must ensure that the management body in its supervisory function and, where a risk committee has been established, the risk committee have adequate access to information on the risk profile of the firm and, if necessary and appropriate, to the risk management function and to external expert advice.
  2. (2) The management body in its supervisory function and, where one has been established, the risk committee must determine the nature, the amount, the format, and the frequency of the information on risk which it is to receive.

[Note: article 76(4) of CRD]

SYSC 7.1.20

See Notes

handbook-rule

In order to assist in the establishment of sound remuneration policies and practices, the risk committee must, without prejudice to the tasks of the remuneration committee, examine whether incentives provided by the remuneration system take into consideration risk, capital, liquidity and the likelihood and timing of earnings.

[Note: article 76(4) of CRD]

SYSC 7.1.21

See Notes

handbook-rule
  1. (1) A CRR firm's risk management function (SYSC 7.1.6 R) must be independent from the operational functions and have sufficient authority, stature, resources and access to the management body.
  2. (2) The risk management function must ensure that all material risks are identified, measured and properly reported. It must be actively involved in elaborating the firm's risk strategy and in all material risk management decisions and it must be able to deliver a complete view of the whole range of risks of the firm.
  3. (3) A CRR firm must ensure that the risk management function is able to report directly to the management body in its supervisory function, independent from senior management and that it can raise concerns and warn the management body, where appropriate, where specific risk developments affect or may affect the firm, without prejudice to the responsibilities of the management body in its supervisory and/or managerial functions pursuant to the CRD and the CRR.

[Note: article 76(5) of CRD]

SYSC 7.1.22

See Notes

handbook-rule

The head of the risk management function must be an independent senior manager with distinct responsibility for the risk management function. Where the nature, scale and complexity of the activities of the CRR firm do not justify a specially appointed person, another senior person within the firm may fulfil that function, provided there is no conflict of interest. The head of the risk management function must not be removed without prior approval of the management body and must be able to have direct access to the management body where necessary.

[Note: article 76(5) of CRD]