1

ICE Clear Europe Limited

Registered in England No.06219884

Registered office: Milton Gate, 60 Chiswell Street, London EC1Y 4SA

October 4, 2022

Mr. Christopher J. Kirkpatrick

Office of the Secretariat

Commodity Futures Trading Commission

Three Lafayette Centre

1155 21st Street, NW

Washington, DC 20581

Re: ICE Clear Europe Self-Certification Pursuant to Commission Rule 40.6 –

Operational Risk and Resilience Policy

Dear Mr. Kirkpatrick:

ICE Clear Europe Limited (“ICE Clear Europe” or the “Clearing House”), a registered 

derivatives clearing organization under the Commodity Exchange Act, as amended (the 

“Act”), hereby submits to the Commodity Futures Trading Commission (the 

“Commission”), pursuant to Commission Rule 40.6 for self-certification, amendments 

to its Operational Risk Management Policy, which will now be known as the 

Operational Risk and Resilience Policy (the “Operational Risk and Resilience Policy” 

or “Policy”)1 discussed herein. The amendments will become effective on the first 

business day following the tenth business day after submission, or such later date as

ICE Clear Europe may determine. 

Concise Explanation and Analysis

ICE Clear Europe is renaming its existing Operational Risk Management Policy to the 

Operational Risk and Resilience Policy and making certain amendments thereto to 

address operational resilience as well as operational risk. The amendments, as set forth 

herein, expand the description of the framework under which the Clearing House 

manages operational risk and operational resilience, describe the lines of defense 

maintained by the Clearing House against such risks and the roles and responsibilities 

1 Capitalized terms used but not defined herein have the meanings specified in the ICE Clear Europe 

Clearing Rules and the Operational Risk and Resilience Policy.
2

ICE Clear Europe Limited

Registered in England No.06219884

Registered office: Milton Gate, 60 Chiswell Street, London EC1Y 4SA

of Clearing House committees, personnel and the Board in respect of the framework. 

The amendments are designed to update the documentation of ICE Clear Europe’s 

practices in this regard to be consistent with requirements of the Bank of England 

(“BoE”) for central counterparties to establish an operational resilience framework by 

March 31, 2022 that identifies and prioritises “important business services,” sets out 

impact tolerances in respect of such services, identifies and maps dependencies for such 

important business services and establishes a scenario testing program with respect to 

such recovery of such services following disruption.2 Other non-substantive drafting 

and similar improvements have also been made to the Policy. 

The amendments provide that the purpose of the document is to set out the Operational 

Risk and Resilience management framework, including identifying and managing 

relevant risks. (The amendments remove certain unnecessary references to 

“operational” risk throughout the Policy as the entire Policy addresses operational risk.) 

The Policy applies to all of the Clearing House’s departments and functions. 

The amendments add a new subsection which describes the Clearing House’s existing 

three lines of defense models for managing risks; the first line of defense (or risk owner) 

(First Line) is responsible for managing risks to within the defined Board risk appetite 

and for ensuring adherence to the requirements of the Policy. The First Line includes

business departments except for the Risk Oversight Department and Internal Audit. 

The Risk Oversight Department (ROD) and Enterprise Risk Management (ERM) is the 

second line of defense (Second Line) and is responsible for challenging the first line 

and monitoring adherence to the requirement of the Policy. The third line of defense 

(Third Line) is the Internal Audit function which provides independent and objective 

assurance to the Board. The three lines of defense model is currently used within the 

Clearing House’s risk management, and the proposed amendments are intended to 

formally document that model, with its existing roles and responsibilities, in the Policy.

The amendments specifically include Operational Resilience policies as part of the 

architecture of the documentation which supports the Policy. The amendments define 

“operational resilience” as the ability to prevent, respond to, recover and learn from 

operational service disruption events. 

In a new subsection describing in more detail the Clearing House’s operational risk and 

resilience framework, the Clearing House describes the purpose of the framework as to 

reduce the likelihood of an operational disruption event within acceptable tolerance and 

mitigate and quickly recover from operational disruption events. The framework is 

comprised of the following set of complementary policies (certain of which are ICE 

Clear Europe policies and others are ICE group-wide policies): (i) the Policy, which is 

intended to ensure that the risk of operational failure of important processes is 

minimized, (ii) Incident Management Policy, which is intended to provide a cohesive 

2 The BoE requires central counterparties to establish an operational resilience framework which shall, 

among other requirements, identify important business services and set impact tolerances for such 

services. See Bank of England, Supervisory Statement: Operational Resilience—Central 

Counterparties” (March 2021), available at: Operational Resilience: Central Counterparties Supervisory 

Statement March 2021 (bankofengland.co.uk) (the “Supervisory Statement”). See also Bank of 

England Prudential Regulation Authority, Statement of Policy: Operational Resilience (March 2021), 

available at SoP 'Operational resilience' (bankofengland.co.uk).
3

ICE Clear Europe Limited

Registered in England No.06219884

Registered office: Milton Gate, 60 Chiswell Street, London EC1Y 4SA

framework for the communication, resolution and recording of incidents and to ensure 

that incidents are resolved in a planned and controlled manner in order to resolve any 

interruptions quickly and restore service, (iii) Business Continuity & Disaster Recovery 

Policy, which is intended to ensure that appropriate plans are in place to recover from 

a business continuity or disaster recover incident, (iv) Information Security and Cyber 

Security Strategy, which outlines the responsibilities of users and the steps they must 

take to protect ICE information and information systems, (v) Outsourcing Policy, which 

governs outsourcing arrangements to ensure that the Clearing House’s minimum 

operational resilience are met by outsourced service providers, and (vi) Vendor 

Management Policy, which ensures that requisite due diligence is performed and 

ensures that vendors have the capacity, resiliency and capability to fully support the 

Clearing House. (Other than the Policy, the listed policies are were not amended in 

connection with this submission.) 

The amendments add a new subsection which describes the Clearing House’s important 

business services. A business service is considered important if a prolonged disruption 

of such service will significantly disrupt the orderly functioning of a market which the 

Clearing House serves, thereby impacting financial stability. Important business 

services will be required to be identified and documented, and such identification will

help prioritization of these services from an operational resilience viewpoint. For each 

important business service, dependencies relating to people, processes, technology, 

facilities, and underlying information will be identified. Identified business services 

will be required to be reviewed at least annually by the First Line, overseen by the 

Second Line and approved by an appropriate Board-level Committee. These 

amendments do not reflect a substantive change in the Clearing House’s existing risk 

management approach but rather formally address relevant services already identified 

by the Clearing House as being critical in light of the requirement described above 

under the Supervisory Statement that a central counterparty document its framework 

for identifying and documenting “important business services”.

The amendments include a new subsection which describes the Clearing House’s 

impact tolerances, which are defined as the maximum tolerable level of disruption for 

an important business service, whereby further disruption will pose a significant impact 

to the market(s) serve by the Clearing House. For each important business service an 

appropriate impact tolerance will be established, considering the duration of any outage 

and additional relevant metrics, such as the magnitude of the impact. Additionally, the 

Clearing House is required to ensure that appropriate controls and recovery procedures 

are in place for important business services in order to aid with recovery in the case of 

service disruption. Monitoring of impact tolerances will need to be in place, with any 

breach escalated to the Clearing House’s Executive Risk Committee and Board. 

Breaches to impact tolerances will be reviewed by the First Line and a remediation plan 

established for any identified weakness. Such review outcome and remediation plan 

must be agreed with the Second Line before presentation to the Board. Impact 

tolerances must be reviewed at least annually by the First Line, overseen by the Second 

Line and approved by appropriate Board-level Committee. Such amendments are 

intended to implement the requirement under the Supervisory Statement that the 

Clearing House identify impact tolerances in consideration of business services 

identified as “important business services. Although this requirement is new, the 

Clearing House’s implementation builds on its existing risk management framework 
4

ICE Clear Europe Limited

Registered in England No.06219884

Registered office: Milton Gate, 60 Chiswell Street, London EC1Y 4SA

which already covers incident management based on levels on levels of severity linked 

to financial, reputational, operational and regulatory impacts.”

Also further to the requirement under the Supervisory Statement, the amendments add 

a new subsection addressing scenario analysis and testing to identify any operational 

resilience weakness. Such analysis or testing must be conducted on important business 

services to determine if the Clearing House can remain within the impact tolerances 

under a range of extreme but plausible disruption scenarios and must include scenarios 

which disrupt more than one important business service simultaneously and take into 

account dependencies. The First Line and Second Line will have to agree on any 

remediation line for weaknesses identified related to extreme but plausible scenarios. 

Scenario analysis and testing results will be reported to the ERC and the Board. Such 

amendments do not represent a substantive change from the Clearing House’s existing 

risk management practices and are intended to document those practices in light of the 

Supervisory Statement, reflecting existing roles and responsibilities.

The section formerly titled “The Policy for Operational Risk Management” has been

renamed “Risk and Control Assessments” in order to more clearly reflect the 

information contained in the subsection. Other stylistic changes have been made in the 

Policy to improve clarity and readability. Certain non-substantive fixes have also been

made, including providing that risk assessments (and not “risks”) are documented in 

the Enterprise Risk Register, reflecting that the correct name of Appendix A to the 

Policy is “Enterprise Risk Register”, and correcting internal section references.

In respect of risk monitoring, the amendments provide that the ERM will coordinate 

with the First and Third Lines (and not the Second Line) to develop control monitoring 

plans for Key Controls. This change is to reflect the Clearing House’s current practice. 

In line with other Clearing House policies, the amendments provide that the Policy is 

subject to at least annual review (rather than biennial review) or earlier in the event of 

a material change. 

Compliance with the Act and CFTC Regulations

The amendments to the Delivery Procedures are potentially relevant to the following 

core principles: (D) Risk Management and (O) Governance, and the applicable 

regulations of the Commission thereunder. 

• Risk Management. The changes to the Policy are designed to strengthen ICE 

Clear Europe’s tools to manage the risk of losses resulting from operational 

errors or failures. The amendments formally extend the Policy to cover 

operational resilience as well as operational risk. The amendments more 

clearly tie together existing policies and procedures relevant to operational risk 

and resilience, as required by the Supervisory Statement as described herein. 

The amendments also address important business services, and the procedures 

to be used by the Clearing House to identify such services and address related 

risks and dependencies and implement adequate controls. The Policy 

addresses impact tolerances and scenario analyses and testing. Taken 

together, the Policy is designed to augment the Clearing House’s ability to 

manage operational risk. The amendments to the Policy facilitate ongoing 
5

ICE Clear Europe Limited

Registered in England No.06219884

Registered office: Milton Gate, 60 Chiswell Street, London EC1Y 4SA

identification of operational risks, enhancement of resilience in the face of 

such risks and mitigation of the impact of such risks through improved 

procedures and controls. In ICE Clear Europe’s view, as set out above, the 

Policy facilitates the Clearing House’s overall management of operational risk. 

As such, ICE Clear Europe believes the amendments are consistent with the 

requirements of Core Principle D and Commission Rule 39.13.

• Governance. As discussed above, the amendments to the Policy clarify and 

describe the responsibilities of the Clearing House’s lines of defense and 

relevant committees, management and the Board in relation the Clearing 

House’s operational resilience framework and the Policy. In ICE Clear

Europe’s view, the amendments are therefore consistent with the requirements 

of Core Principle O and CFTC Rule 39.24.

As set forth herein, the amendments consist of the amendments to the Operational Risk 

and Resilience Policy. ICE Clear Europe has requested confidential treatment with 

respect to the amendments, which have been submitted concurrently with this selfcertification submission. 

ICE Clear Europe hereby certifies that the amendments comply with the Act and the 

Commission’s regulations thereunder. 

ICE Clear Europe received no substantive opposing views in relation to the 

amendments. 

ICE Clear Europe has posted a notice of pending certification and a copy of this 

submission on its website concurrent with the filing of this submission. 

If you or your staff should have any questions or comments or require further 

information regarding this submission, please do not hesitate to contact the undersigned 

at George.milton@theice.com or +44 20 7429 4564. 

Very truly yours,

George Milton

Head of Regulation & Compliance