Third-Party Risk Management Framework 

PUBLIC Page 1 of 7

Owner: Chief Risk Officer

Effective Date:

Document Type: Regulatory

Board Approval: Risk Committee

Rule Filed: Yes

I. EXECUTIVE SUMMARY

As a central counterparty, the Options Clearing Corporation (“OCC”) is exposed to risks arising from its 

Third-Party relationships. This Third-Party Risk Management Framework (“Framework”) outlines OCC’s 

approach to identify, measure, monitor, and manage risks arising from Third-Party relationships including:

• Clearing Members

• Clearing Banks, custodians, liquidity providers, and investment counterparties (“Financial Institutions”)

• Financial market utilities (“FMU”)1

• Exchanges2

• Vendors

This Framework is approved by the Risk Committee of OCC’s Board of Directors (“Risk Committee”) at 

least annually and implemented by the Management Committee (“MC”). 

II. RISK IDENTIFICATION

OCC faces risks associated with its Third-Party relationships, including:

Financial risks arising from a Clearing Member failing to meet its financial obligations to OCC including, 

but not limited to, obligations related to settlement, margin, and Clearing Fund. OCC may also face 

financial risks from other Third-Parties not meeting their obligations to OCC, including, but not limited to,

facilitating daily settlements, providing timely access to collateral, honoring liquidity draw requests, or 

meeting obligations under an agreement.

Operational risks arising from errors, disruptions, failures, or the inability of a Third-Party to fulfill its 

obligations to OCC. These risks include a disruption preventing OCC from completing trade processing, 

daily settlements, accessing collateral, or safeguarding OCC property, equipment, or personnel. 

Information Technology and Security risks arising when a Third-Party is unable to safeguard OCC 

data or maintain capabilities or services to support OCC’s operations.

Legal and Regulatory risks arising when a Third-Party fails to fulfill its obligations to OCC. These risks 

include exposure to potential litigation or regulatory compliance concerns.

1 FMUs may include any person that manages or operates a multilateral system for the purpose of transferring, clearing, or settling 

payments, securities, or other financial transactions among Financial Institutions or between Financial Institutions and the person. 2 Exchange relationships may include options exchanges, futures markets, OTC Trade Sources, or Loan Markets.

Exhibit 5a

File No. SR-OCC-2020-014 

Page 140 of 221
Third-Party Risk Management Framework 

PUBLIC Page 2 of 7

III. RELATIONSHIP LIFECYCLE

OCC’s relationship lifecycle is designed to identify, measure, monitor, and manage Third-Party risks. The

lifecycle consists of three stages. 

• On-Boarding – Third-Parties are evaluated to determine whether they can engage in or expand 

a relationship with OCC. After evaluation, OCC completes any operational tasks necessary to 

activate the relationship.

• Ongoing Monitoring – Third-Parties are monitored for compliance with standards, the presence 

of additional or increased risks, and fulfillment of contractual obligations. Ongoing monitoring is 

conducted based upon the nature of each relationship and is commensurate with the risks posed 

by the Third-Party. 

• Off-Boarding – Third-Parties or OCC may elect to terminate a relationship. Following the 

determination to terminate a relationship, OCC completes any operational tasks necessary to offboard the relationship.

Third-Parties that have multiple relationships with OCC are subject to the processes described below for 

each type of relationship. OCC recognizes that multiple relationships with a single entity may result in

additional risks (as identified in Section II) and incorporates this into its on-boarding and ongoing 

monitoring by reviewing affiliated relationships and their exposures at the Credit and Liquidity Risk 

Working Group.

As described below, risks identified throughout the relationship lifecycle are reported and escalated

through associated working groups. Working groups are cross-departmental and support OCC’s business 

as assigned by the MC. Each working group has a chair and designated MC member who are responsible 

to determine the matters to be escalated to the MC. The working groups identified in this Framework have

defined decision-making authority, functions and responsibilities as defined in the associated working 

group procedure. The working groups that support the activities described in this Framework are:

• Credit and Liquidity Risk Working Group (“CLRWG”)

• Exchange Working Group (“EWG”)

• Vendor Risk Working Group (“VRWG”)

IV. THIRD-PARTY RELATIONSHIP MANAGEMENT 

Clearing Members 

OCC’s membership standards are designed to be objective and risk-based, and are publicly disclosed in 

OCC’s Rules and By-Laws. Annually, Business Operations, Financial Risk Management (“FRM”), 

Treasury, and Third-Party Risk Management (“TPRM”) assess the adequacy of OCC’s membership 

standards to address the management of risks presented by Clearing Members and the processes used 

to monitor initial and ongoing compliance with those standards, in accordance with the Credit and 

Liquidity Risk Working Group Procedure. The review may contain recommendations to change the 

standards or monitoring processes. The results of the annual assessment are summarized for 

consecutive review and approval by the CLRWG, MC, Risk Committee, and if rule changes are 

necessary, the Board of Directors. 

File No. SR-OCC-2020-014 

Page 141 of 221
Third-Party Risk Management Framework 

PUBLIC Page 3 of 7

On-Boarding: Business Operations, FRM, and TPRM complete a risk-based evaluation of Clearing 

Member applicants by evaluating their financial resources, operational capacity, personnel, and facilities

against OCC’s membership standards. FRM presents the results of this evaluation to the CLRWG and 

other key stakeholders as identified within Article V, Section 2 of OCC’s By-Laws for review and approval. 

Ongoing Monitoring: Clearing Members are monitored for ongoing compliance with OCC’s membership 

standards. FRM, with support from Business Operations and TPRM, performs Watch Level reporting and 

ongoing monitoring of financial and operational risks. In addition to or in support of Watch Level reporting, 

Business Operations and FRM conduct the following processes to monitor Clearing Members: 

• Determining an internal credit rating to identify creditworthiness; 

• Performing periodic examinations to evaluate Clearing Member risk management policies, 

procedures, and practices; and 

• Evaluating material risks related to customers of Clearing Members. 

FRM provides informational Watch Level reporting at meetings of the CLRWG, MC, and Risk Committee

that summarizes the circumstances leading to violations of higher tier Watch Level criteria, additional risks 

observed, and any corrective measures taken by such Clearing Members.

Should a Clearing Member approach or no longer meet minimum membership standards, protective 

measures may be imposed to limit or eliminate OCC’s counterparty exposure. OCC maintains authorities

in its Rules (Chapter III, Chapter VI Rule 608, and Chapter VII Rules 704 and 707) to act to protect OCC,

given the facts and circumstances of the exposure presented by a Clearing Member, including but not 

limited to the imposition of additional monitoring, changes to margin requirements or composition, or 

suspension of some or all product and account approvals.

Business Operations, FRM, and TPRM provide reporting to the CLRWG, comprised of results from

ongoing monitoring and management of Clearing Member financial, operational, legal, and regulatory 

risks and may raise matters for consideration to the CLRWG. The CLRWG may take action or escalate 

the matter to the MC, in accordance with the functions and responsibilities assigned to the CLRWG by the 

MC in the Credit and Liquidity Risk Working Group Procedure. 

Off-Boarding: A Clearing Member may voluntarily terminate its membership. Upon request for 

termination, Business Operations and FRM ensure all financial exposures and operational capabilities are 

wound down and all obligations to OCC are satisfied before the relationship is terminated. In the event a 

Clearing Member is suspended by OCC, the suspension will be managed in accordance with the Default 

Management Policy.

Clearing Banks, Custodians, Liquidity Providers, and Investment Counterparties

OCC maintains relationships with Financial Institutions that facilitate clearance and settlement activities, 

manage collateral, provide liquidity, and serve as investment counterparties. 

On-Boarding: FRM and TPRM, with support as needed from Business Operations and Treasury, 

complete a risk-based evaluation of each entity by evaluating its financial resources and operational 

capacity. For custodians, the evaluation considers whether a relationship is structured to allow prompt 

access to OCC and Clearing Member assets and whether the custodian is a supervised and regulated 

institution that adheres to generally accepted accounting practices, maintains safekeeping procedures, 

and has controls that fully protect these assets. The results of the evaluation are presented to the 

File No. SR-OCC-2020-014 

Page 142 of 221
Third-Party Risk Management Framework 

PUBLIC Page 4 of 7

CLRWG for review and recommendation for approval prior to presentation to the Chief Executive Officer 

or Chief Operating Officer, each of whom has the authority to approve such relationships. 

Ongoing Monitoring: Business Operations, FRM, Treasury, and TPRM monitor the financial, 

operational, legal, and regulatory risks related to Financial Institution relationships. This monitoring 

includes Watch Level reporting, material agreement reviews, and ongoing monitoring of financial and 

operational risks. Should Watch Level reporting detect potential issues or trends that might indicate the 

deterioration of a Financial Institution’s ability to perform, protective measures that may be applied

include, but are not limited to, modifying the business relationship or termination of the relationship. 

Business Operations, FRM, Treasury, and TPRM provide reporting to the CLRWG, comprised of results 

from ongoing monitoring and management of a Financial Institution’s financial, operational, legal, and 

regulatory risks and may raise matters for consideration to the CLRWG. The CLRWG may take action or 

escalate the matter to the MC, in accordance with the functions and responsibilities assigned to the 

CLRWG by the MC in the Credit and Liquidity Risk Working Group Procedure. 

Off-Boarding: A Financial Institution relationship may be terminated by the Financial Institution or OCC, 

pursuant to applicable agreements. The Chief Executive Officer or Chief Operating Officer, each of whom 

has the authority, must approve the termination of a Financial Institution relationship initiated by OCC. 

OCC may terminate a relationship if risks rise to an unacceptable level or a relationship is no longer 

required. Business Operations, FRM, Treasury, and Legal perform activities necessary to off-board the 

relationship in accordance with the agreement between OCC and the applicable Financial Institution. 

Financial Market Utilities

FMUs provide OCC with a range of services, including custody, stock loan processing, cross-margin 

programs, and securities settlement. 

On-Boarding: Business Operations, FRM, Legal, and TPRM consider an FMU’s financial condition, 

operational capabilities, and any legal or regulatory risks associated with the relationship during the onboarding process. The CLRWG reviews this evaluation and recommends approval prior to presentation to 

the Chief Executive Officer or Chief Operating Officer, each of whom has the authority to approve such 

relationships. On-boarding of the relationship may be subject to completion of any necessary agreements 

or regulatory filings. 

Ongoing Monitoring: Business Operations, FRM and TPRM monitor the financial, operational, legal, and 

regulatory risks related to FMU relationships. This monitoring includes Watch Level reporting, material 

agreement reviews, and ongoing monitoring of financial and operational risks. 

Business Operations, FRM, and TPRM provide reporting to the CLRWG, comprised of results from 

ongoing monitoring and management of an FMU’s financial, operational, legal, and regulatory risks and 

may raise matters for consideration to the CLRWG. The CLRWG may take action or escalate the matter 

to the MC in accordance with the functions and responsibilities assigned to the CLRWG by the MC in the 

Credit and Liquidity Risk Working Group Procedure. 

Off-Boarding: An FMU relationship may be terminated by the FMU or OCC, pursuant to applicable 

agreements. The Chief Executive Officer or Chief Operating Officer, each of whom has the authority, 

must approve the termination of an FMU relationship initiated by OCC. Business Operations, FRM, Legal, 

File No. SR-OCC-2020-014 

Page 143 of 221
Third-Party Risk Management Framework 

PUBLIC Page 5 of 7

and TPRM coordinate the activities necessary to off-board the relationship, including, but not limited to, 

the wind down of all services with the FMU and, if necessary, revising OCC policies and procedures and 

filing rule changes with OCC’s regulators after receiving the appropriate internal approvals. 

Exchanges 

OCC provides clearing services for Exchanges pursuant to applicable agreements3. Under these 

agreements, OCC clears products including equity and index options, commodity contracts, treasury 

futures, security futures, and stock loan transactions.

On-Boarding: Product and Business Development, in coordination with stakeholders which may include, 

but are not limited to, FRM, Business Operations, and TPRM, completes an evaluation of proposed 

Exchange relationships, including assessing whether an Exchange meets OCC’s qualification 

requirements4. The due diligence performed for a proposed Exchange relationship is presented to the

EWG for review and subsequently to the MC for approval. A summary of due diligence and on-boarding 

activities are presented to the Board of Directors for approval to launch. 

Ongoing Monitoring: Business Operations and TPRM monitor the operational, legal and regulatory risks 

related to Exchange relationships. Such relationships are monitored for connectivity and trade activity on 

an ongoing basis. Exchange monitoring allows for internal escalation to Production Support and the 

EWG, and externally to Exchanges. 

Business Operations and TPRM conduct reviews to assess an Exchange’s operational performance, 

overall financial condition, and ability to meet contractual obligations. To assess operational performance, 

Business Operations executes testing activities throughout the year aimed at mitigating operational risk, 

including the requirement that all Exchanges must participate in annual disaster recovery tests. In 

addition, Business Operations supports external testing with all Exchanges upon request or related to 

OCC system changes and enhancements. TPRM monitors the financial condition of Exchanges and 

evaluates whether an Exchange’s operations meet its contractual obligations. Business Operations

facilitates annual meetings with each Exchange that include an operational performance review, 

communicate updates about upcoming OCC system enhancements and changes, and seek feedback. 

Business Operations and TPRM provide reporting to the EWG, comprised of results from ongoing 

monitoring and management of an Exchange’s financial, operational, legal and regulatory risks and may 

raise matters for consideration to the EWG. The EWG may take action or escalate the matter to the MC, 

in accordance with the functions and responsibilities assigned to the EWG by the MC in the Exchange 

Working Group Procedure.

Off-Boarding: An Exchange relationship may be terminated by the Exchange or OCC, pursuant to the 

applicable Exchange agreement. Upon request for termination by the Exchange, Business Operations 

notifies the EWG and the MC to discuss any immediate actions such as limiting connectivity with the 

Exchange to mitigate exposure to operational, legal, or regulatory risks and to determine a termination 

date. 

Additionally, Business Operations leads the development of a deployment plan to identify the

departments and required actions necessary to reduce any interim risk prior to termination, which may 

3 Exchange agreements are filed with OCC's regulators, as required.

4 See OCC By-Laws, Article VIIA – Equity Exchanges and Article VIIB – Non-Equity Exchanges for further detail. 

File No. SR-OCC-2020-014 

Page 144 of 221
Third-Party Risk Management Framework 

PUBLIC Page 6 of 7

include performing clearing system maintenance and limiting or removing connectivity to the Exchange. 

Business Operations and other supporting departments coordinate and perform activities necessary to 

off-board the relationship in accordance with the applicable Exchange agreement. 

Vendors 

OCC engages and maintains vendor relationships for various purposes, including to accomplish its 

strategic objectives, outsource operational activities, and assist in compliance with legal and regulatory 

obligations. All Third-Party relationships that are not Clearing Members, Financial Institutions, FMUs, or 

Exchanges are treated as vendor relationships. 

On-Boarding: During on-boarding, TPRM works with the business area requesting the vendor to assign 

a vendor relationship manager (“VRM”) who is obligated to manage the vendor relationship and execute 

the phases of the vendor relationship lifecycle. TPRM coordinates with the VRM to complete an 

evaluation of inherent risks posed by the vendor relationship. The evaluation of inherent risk results in a 

vendor risk tier which is used to inform the level of due diligence and frequency of monitoring for each 

vendor. Due diligence is based on the inherent risks identified and may include a review of financial 

health, operational capacity, and other standards based on the relationship. 

Any potential risk issues identified are presented to the VRM and OCC’s Legal Department for review. 

Potential risk issues may also be shared with the VRWG. An agreement that addresses control and 

business requirements is then negotiated with the vendor and executed by an OCC officer (an OCC Vice 

President or above). 

Ongoing Monitoring: VRMs and TPRM monitor vendors to assess whether they are delivering services 

as required by applicable agreements. The scope and frequency of monitoring is determined by the vendor 

risk tier and inherent risks identified during on-boarding. Monitoring may include reviewing a vendor’s 

financial health, operational capacity, and other standards based on the relationship’s inherent risks. 

TPRM provides reporting to the VRWG, comprised of results from ongoing monitoring and management of 

a vendor’s financial, operational, legal, and regulatory risks and may raise matters for consideration to the 

VRWG. The VRWG may take action (e.g., additional monitoring, require contingency plans, and additional 

contractual requirements) or escalate the matter to the MC, in accordance with the functions and 

responsibilities assigned to the VRWG by the MC in the Vendor Risk Working Group Procedure. 

Off-Boarding: A vendor relationship may be terminated by the vendor or OCC, pursuant to applicable 

agreements. OCC mitigates exposure to operational, legal, and regulatory risk and performs activities 

necessary to off-board the relationship in accordance with the applicable vendor agreement.

V. DEFINITIONS

Capitalized terms used and not defined below have the meaning set forth in OCC’s Rules and By-Laws.

Third-Party: A Clearing Member, Clearing Bank, custodian, liquidity provider, investment counterparty, 

financial market utility, Exchange, or vendor, which also has: 

(i) a relationship with OCC where products and/or services are exchanged; 

(ii) other ongoing business relationships with OCC; or 

(iii) responsibility for OCC associated records.

File No. SR-OCC-2020-014 

Page 145 of 221
Third-Party Risk Management Framework 

PUBLIC Page 7 of 7

Watch Level: OCC assigns a level of required monitoring and reporting (i.e., a “Watch Level”) based on 

the identification of events or trends that might signal the deterioration of an entity’s financial or 

operational ability to timely meet its future obligations to OCC. Watch Level is a tiered structure with 

financial (e.g., capital and profitability), operational (e.g., operational difficulties and late financial report 

submissions), and general business (e.g., risk management issues and business restrictions by another 

SRO) criteria at each tier. Reaching the criteria at higher tier levels signals a more material event or trend 

has been detected and an entity may require heightened risk management. The CLRWG may 

recommend changes to Watch Level criteria to the MC, which maintains approval authority for 

recommended changes. FRM is responsible for implementing all approved Watch Level criteria changes.

VI. REVISION HISTORY

The revision history reflects the three previous revision cycles. Previous revision history can be found in 

PolicyTech.

Ver. 

No.

Version 

Effective Date

Revision Summary

1.0 TBD Initial version

File No. SR-OCC-2020-014 

Page 146 of 221