1 

ICE Clear Europe Limited 

Registered in England No.06219884 

Registered office: Milton Gate, 60 Chiswell Street, London EC1Y 4SA 

 August 09, 2023 

Mr. Christopher J. Kirkpatrick 

Office of the Secretariat 

Commodity Futures Trading Commission 

Three Lafayette Centre 

1155 21st Street, NW 

Washington, DC 20581 

Re: ICE Clear Europe Self-Certification Pursuant to Commission Rule Rule 40.6 

– Outsourcing and Third Party Risk Management Policy Amendments 

Dear Mr. Kirkpatrick: 

ICE Clear Europe Limited (“ICE Clear Europe” or the “Clearing House”), a registered 

derivatives clearing organization under the Commodity Exchange Act, as amended (the 

“Act”), hereby submits to the Commodity Futures Trading Commission (the 

“Commission”), pursuant to Commission Rule 40.6 for self-certification, amendments 

to its Outsourcing Policy (to be renamed the Outsourcing and Third Party Risk 

Management Policy) (the “Outsourcing Policy” or “Policy”) to broaden the coverage 

of the Policy to address third party service provider arrangements that may not 

technically constitute outsourcing, to enhance third party risk management, to add the 

execution of risk assessments and to update the Document Governance and Exception 

Handling language, among other changes discussed herein.1 The amendments will 

become effective on the first business day following the tenth business day after 

submission, or such later date as ICE Clear Europe may determine. 

Concise Explanation and Analysis 

ICE Clear Europe is amending its Outsourcing Policy (to be renamed the Outsourcing 

and Third Party Risk Management Policy) to extend coverage of the policy to include 

risk management of third party arrangements that may not constitute outsourcing. The 

1

 Capitalized terms used but not defined herein have the meanings specified in the Outsourcing Policy 

or, if not defined therein, the ICE Clear Europe Clearing Rules. 
2 

ICE Clear Europe Limited 

Registered in England No.06219884 

Registered office: Milton Gate, 60 Chiswell Street, London EC1Y 4SA 

purpose of the Policy reflects this change by clarifying that the Policy will generally 

extend to arrangements in which services are provided by third parties to the Clearing 

House, whether or not such services are considered outsourcing, including assessing 

the risks of such services. 

The Outsourcing Policy will clarify its definition of outsourcing in the introduction 

section to be the use of third party service providers (which could be an external party 

or an affiliate), either directly or through sub-outsourcing, to provide a service that 

would otherwise be performed by ICE Clear Europe itself and is therefore subject to 

the Board’s oversight. The amendments will further clarify that the Clearing House 

will remain responsible for discharging its obligations with respect to the outsourced 

activities, the outsourcing arrangement will not result in the delegation of the Clearing 

House’s responsibility, and the outsourced activities will conform to the same standards 

that would be required if the activities were completed internally. The amendments will 

also clarify the distinction between an outsourcing and a purchasing arrangement, 

which will not involve an arrangement otherwise performed by the Clearing House and 

therefore will not typically be subject to Board oversight. 

The amendments will also clarify the distinction between external third party providers 

of services and affiliated providers. The Policy will add a definition for third party, 

which will cover any organization (whether or not affiliated) that has entered into a 

relationship or contract with the Clearing House to provide products, services, 

processes, activities or business functions. Use of external third parties (i.e., those not 

affiliated with the Clearing House) will be managed consistently at the group level 

through the existing Vendor Management Policy (“VMP”). It will further clarify that 

outsourcing through the Clearing House’s affiliates presents a lower residual risk 

profile because, among listed reasons in the existing Policy, the affiliates will have a 

similar higher standard of operational resilience generally (as opposed to referring only 

to business continuity) and the Clearing House will also have greater influence (as well 

as control) over the operation of the affiliate’s services. These amendments are 

intended to more clearly describe current practice under the existing Policy. 

The amendments will revise statements in the existing Policy relating to objectives, 

assessments of service providers in various situations (including regulated parties and 

parties in different jurisdictions), management of outsourcing, conflicts of interest and 

audit to also extend to other third party service arrangements. The amendments will 

reference the Clearing House’s outsourcing operating manual (renamed to reflect the 

broader goal of third party risk management as well of outsourcing). As so revised, the 

Policy will state that contracting with third parties is covered consistently at a group 

level under the VMP. The amendments will clarify, consistent with current practice, 

that ICE Clear Europe will use the VMP process as an input for the risk-based 

assessment of each service provider. The amendments will also provide that the 

Clearing House will make the third parties aware of relevant internal policies to gain a 

better understanding of the obligations and services expected. For contracting with 

affiliates, the amendments will clarify that the relevant assessment will be made by ICE 

Clear Europe, in accordance with its ordinary governance practices (and not necessarily 

by the senior management). The revised Policy will state that ICE Clear Europe will 

follow its Conflicts of Interest Policy when managing any potential conflicts of interests 

as a result of its service arrangements. (This reflects current practice but will add an 
3 

ICE Clear Europe Limited 

Registered in England No.06219884 

Registered office: Milton Gate, 60 Chiswell Street, London EC1Y 4SA 

appropriate reference in the Policy to the Conflicts of Interest Policy.) With respect to 

cloud outsourcing, the amendments will add that ICE Clear Europe will consider any 

risks related to the Clearing Members connecting to the Clearing House through cloud 

service providers. 

The Policy will also include a new Risk Assessments section that will set out the 

proportional risk assessment that will be performed on a service provider in order to 

identify, measure and mitigate risks. The section will include certain considerations 

(although not limited to those listed) that include whether the service is a critical or 

important function or a dependence to the delivery of one of ICE Clear Europe’s 

services, whether the activity is outsourcing, whether the service relies on cloud-based 

technology that may pose new or additional risks, whether the service provider is an 

external third party or an affiliate, the legal jurisdiction of the service provider, conflicts 

of interest, operational resilience considerations, data security, exit plans, contractual 

terms, and availability of alternative or back-up providers, among others. For 

outsourced or critical non-outsourced services, this assessment will be performed at 

least annually and on an ad-hoc basis following a material incident or service disruption 

event or material service agreement breach. This will include comparing the 

performance of the service provider against the agreed service levels. The 

responsibilities of risk assessments and related testing will be overseen by the Clearing 

House’s Chief Operating Officer or delegate, with ownership of each service and the 

related resiliency arrangements resting with the relevant Head of Department. 

The amendments will clarify and expand certain provisions relating to identification of 

critical or important functions, including to extend the existing provisions to apply to 

acquired services generally and not only outsourcing. In identifying critical or 

important functions the amendments will add that the Clearing House will consider 

continuity of ICE Clear Europe’s important business services or operation as a CCP 

that could in turn threaten the Clearing House’s financial stability or impact its 

resolvability. A third party will be treated as critical if it is contracted to perform such 

a critical function. Criticality will be reassessed on at least an annual basis. 

The revised Policy will also acknowledge that any outsourcing of critical or important 

functions could have an effect on the operational resilience measures of the Clearing 

House more generally (and not merely the narrower category of business continuity). 

The revised Policy further clarifies that exit plans for critical and important functions 

will be periodically tested. As part of its operational resilience framework, the Clearing 

House will examine purchased services as well as outsourced or sub-outsourced 

services that are a dependence for the Clearing House’s important business services. In 

addition, the operational resilience framework will include extreme but plausible test 

scenarios resulting from the disruption of critical third party services. 

The Policy will also make various amendments to the discussion of additional important 

considerations for the Clearing House to ensure that considerations will be given to 

important business services and critical functions that are affected by third party service 

arrangements, including with respect to business continuity arrangements, incident 

management responsiveness and reporting, independent assurances, redundancies, 

notice periods and exit strategies. The amendments will add a new section on 

Contractual Agreements. The section will add that for outsourcing arrangements in 
4 

ICE Clear Europe Limited 

Registered in England No.06219884 

Registered office: Milton Gate, 60 Chiswell Street, London EC1Y 4SA 

particular, the Clearing House’s legal team will review any written service agreements 

to confirm the inclusion of all relevant contractual safeguards so that ICE Clear Europe 

could monitor relevant risks, regulatory requirements and expectations. The aim will 

be for the agreements to outline the rights, obligations, and responsibilities of all the 

parties, and include provisions associated with data security, access, audit and 

information rights, sub-outsourcing, service resilience, service levels, incident 

management, termination and exit plans. Arrangements for purchased services should 

be similarly reviewed, but the Policy will acknowledge that some purchased services 

may be subject to non-negotiable terms set by the third party. This situation will be 

considered during the pre-execution risk assessment phase. The Outsourcing Policy will 

also set out that ICE Clear Europe will periodically exercise its audit rights under 

agreements relating to outsourcing arrangements, perform audits as appropriate which 

can include on-site visits. 

Provisions relating to Board oversight will be revised to provide that the Board must 

approve new or materially amended outsourcing arrangements. Certain clarifications 

will be made to the requirements for the annual outsourcing assessment report to be 

prepared by the Chief Operating Officer, including the addition of a summary of critical 

non-outsourcing services received. A new provision will be added setting out that ICE 

Clear Europe will engage with regulatory authorities before executing or materially 

amending a critical service arrangement with regard to the relevant regulatory 

requirements or expectations. 

Finally, the amendments will make changes to the Policy’s document governance, 

breach management and exception handling, to make it generally consistent with other 

ICE Clear Europe policies. The document owner identified by the Clearing House will 

be responsible for ensuring that the Policy remains up-to-date and reviewed in 

accordance with the Clearing House’s governance processes. Document review will be 

conducted by the document owner and related staff, with sign off by the head of 

department and the Chief Risk Officer (or their respective delegates). Document 

reviews will encompass at the minimum regulatory compliance, documentation and 

purpose, implementation, use and open items from previous validations or reviews. 

Results of the review will have to be reported to the Executive Risk Committee or in 

certain cases to the Model Oversight Committee. The document owner will also aim to 

remediate the findings, complete internal governance and receive regulatory approvals 

before the following annual review is due. The document owner will also be responsible 

for reporting any material breaches or deviations to the Head of Department, Chief Risk 

Officer and Head of Regulation and Compliance in order to determine if further 

escalation is required. The amendments will state explicitly that changes to the Policy 

will have to be approved in accordance with the Clearing House’s governance process 

and will take effect following completion of required internal and regulatory approvals. 

Exceptions to the Policy will also be approved in accordance with the governance 

processes for approvals of changes to the Policy. 

Compliance with the Act and CFTC Regulations 
5 

ICE Clear Europe Limited 

Registered in England No.06219884 

Registered office: Milton Gate, 60 Chiswell Street, London EC1Y 4SA 

The amendments to the Outsourcing Policy are potentially relevant to the following 

core principles: (D) Risk Management and (O) Governance, and the applicable 

regulations of the Commission thereunder. 

 Risk Management. The amendments to the Outsourcing Policy are intended to 

better document and to enhance the Clearing House’s practices that relate to 

management of the Clearing House’s use of outsourcing and other third party 

service providers, as set forth above. In particular, the changes to the 

Outsourcing Policy aim to extend certain Clearing House risk management 

practices to third party service arrangements that may not be covered by 

existing outsourcing practices. The amendments also add new requirements 

around risk assessments, identification of critical functions, operational 

resilience, and review of contractual arrangements with service providers. In 

ICE Clear Europe’s view, the Policy as amended will facilitate overall risk 

management with respect to third party services. As such, ICE Clear Europe 

believes the amendments are consistent with the requirements of Core 

Principle D and Commission Rule 39.13. 

 System Safeguards. As stated above, the amendments extend the coverage of 

the Outsourcing Policy to third party services that may not be considered 

outsourcing. The amendments also enhance oversight of outsourcing 

generally, including as to risk assessment, identification of critical services 

and operational resilience. The amendments also address testing (as part of 

the Clearing House’s operational resiliency framework) of extreme but 

plausible test scenarios that may result from the disruption of critical third 

party services. Collectively, these changes facilitate the Clearing House’s 

ability to supervise third party service providers in providing services to meet 

the Clearing House’s requirements and to apply the same level of testing over 

outsourced resources as it does with its own resources. Therefore, in ICE Clear 

Europe’s view, the amendments are consistent with the requirements of Core 

Principle I and Commission Rule 39.18. 

 Governance. As discussed, the amendments to the Outsourcing Policy update 

the provisions relating to Board oversight, including by stating that the Board 

must approve new or materially amended outsourcing arrangements. The 

amendments will also state more clearly requirements around document 

governance, regulatory engagement, and exception handling, generally in a 

manner consistent with other ICE Clear Europe policies. The Policy will 

describe the responsibilities of the document owner and appropriate escalation 

and notification requirements for responding to exceptions and deviations 

from the Policy. In ICE Clear Europe’s view, the amendments are therefore 

consistent with the requirements of Core Principle O and CFTC Rule 39.24. 

As set forth herein, the amendments consist of the amendments to the Outsourcing 

Policy, a copy of which is attached hereto. ICE Clear Europe has requested confidential 

treatment with respect to the amendments, which have been submitted concurrently 

with this self-certification submission. 
6 

ICE Clear Europe Limited 

Registered in England No.06219884 

Registered office: Milton Gate, 60 Chiswell Street, London EC1Y 4SA 

ICE Clear Europe hereby certifies that the amendments comply with the Act and the 

Commission’s regulations thereunder. 

ICE Clear Europe received no substantive opposing views in relation to the 

amendments. 

ICE Clear Europe has posted a notice of pending certification and a copy of this 

submission on its website concurrent with the filing of this submission. 

If you or your staff should have any questions or comments or require further 

information regarding this submission, please do not hesitate to contact the undersigned 

at George.milton@theice.com or +44 20 7429 4564. Very truly yours, 

George Milton 

Head of Regulation & Compliance