DIVISION OF SWAP DEALER AND INTERMEDIARY OVERSIGHT

STAFF ADVISORY

CFTC Staff Advisory No. 16-24 

Advisory

Other Written Communication

March 2, 2016

Division of Swap Dealer and Intermediary Oversight

Audience: Futures Commission Merchants 

Topic: Risk Management Programs 

I. Introduction and Background

On November 14, 2013, the Commodity Futures Trading Commission (“Commission”) 

issued rules for enhancing protections for customers of futures commission merchants (“FCMs”

or “firms”).1 These customer protection rules include Regulation 1.11, which requires an FCM 

that accepts customer assets or extends credit to customers in lieu thereof, to establish a risk 

management program (“RMP”).

2

 The RMP must be approved by the FCM’s governing body 

and submitted to the Commission and the FCM’s designated self-regulatory organization.3

 As 

part of the RMP, an FCM must establish and maintain a risk management unit (“RMU”) that

administers the RMP, is independent from the FCM’s business unit (“BU”) and reports directly 

to senior management of the FCM.4

The Division of Swap Dealer and Intermediary Oversight (“DSIO” or “Division”) is issuing 

this advisory to (1) remind FCMs of the RMP regulatory requirements, and (2) share observed 

examples of practices in implementing an effective RMP.

While the observed practices described herein may be useful to FCMs, this advisory does not 

mandate a specific approach. Each FCM should evaluate whether implementing any of these 

practices is appropriate based on its particular business and risk profile. 

 

1

 Enhancing Protections Afforded Customers and Customer Funds Held by Futures Commission Merchants and 

Derivatives Clearing Organizations, 78 Fed. Reg. 68506 (Nov. 14, 2013). Swap dealers and major swap participants 

are subject to similar requirements under Regulation 23.600. This advisory only addresses requirements of 

Regulation 1.11. DSIO may provide future guidance regarding Regulation 23.600.

2

 17 C.F.R. §§ 1.11(a) and (c)(1). While the RMP is limited to the registered FCM’s activities requiring 

registration, the RMP must also account for risks posed by affiliates, all lines of business of the FCM, and all other 

trading activity engaged in by the FCM. See 17 C.F.R. § 1.11(e)(ii). 

3

 17 C.F.R. §§ 1.11(c)(3) and (5).

4

 17 C.F.R. § 1.11(d). See 17 C.F.R. § 1.11(b)(1) for the definition of the term “business unit.” 
2 

II. Certain Regulation 1.11 Provisions 

Regulation 1.11(d) – Risk Management Unit

 Pursuant to Regulation 1.11(d), each FCM that accepts customer assets or extends credit in 

lieu thereof must establish and maintain a RMU with sufficient authority, qualified personnel, 

and financial, operational and other resources to carry out the RMP. 

To demonstrate compliance with these requirements, an FCM should be able to identify all 

personnel in the firm’s RMU.5 DSIO has observed that many FCMs also demonstrate 

compliance with this requirement by developing an organizational chart identifying all members 

of the RMU, their respective risk management duties, and their reporting lines within the RMU. 

 

 An FCM may also want to consider describing the following in its RMP: 

1. All committees responsible for risk management and the supervisory reporting lines of 

those committees. 

2. How the independence of the RMU from the BU is maintained. 

3. How frequently the FCM will consider the sufficiency of the RMU’s resources. 

Regulation 1.11(e) – Elements of the Risk Management Program

 Regulation 1.11(e) requires the RMP to account for market, credit, liquidity, foreign 

currency, legal, operational, settlement, segregation, technological, capital, and any other 

applicable risks of the FCM. The firm’s RMP should include a clear description of each 

applicable risk as it relates to the firm’s specific business activities. In addition, the RMP should 

identify the personnel or department responsible for managing each applicable risk.6

 

Many RMPs reviewed also include provisions addressing the following topics: 

1. An overview of the risk framework for the FCM. 

2. A description of risk tolerance limits, the methodology used to determine the risk 

tolerance limits for each risk type, and procedures for review and approval quarterly by 

senior management and annually by the governing body. 

3. Written policies and procedures for risk tolerance limit exceptions addressing: (i) what

exceptions are permitted; (ii) how exceptions are granted; (iii) who has the authority to 

grant exceptions; and (iv) how exception approvals are documented. 

 

5

 78 Fed. Reg. at 68519.

6

 As the Commission has previously stated, Regulation 1.11 “does not require a registrant’s risk management unit 

to be a formal division in the registrant’s organizational structure,” and therefore the RMU may span several 

departments within a registrant. Id. 
3 

4. Written policies and procedures for risk limit breaches addressing: (i) what is considered 

a breach; (ii) the procedures for identifying and addressing breaches; and (iii) the 

escalation and review process for any breach. 

5. The procedures for monitoring applicable risks. 

6. A description of the training program addressing segregation requirements, notice 

requirements under Regulation 1.12 and procedures for reporting suspected limit 

breaches; identification of the unit responsible for implementing the training program; 

and the procedures for ensuring that training is completed in a timely manner. 

7. A description of technical systems utilized (e.g., trading platforms, risk management 

software, back office software, etc.) and how those systems interface for risk 

management purposes. 

8. A description of the FCM’s capital requirements and liquidity needs and the potential 

sources of funds available to meet those needs and remain in compliance with the capital 

requirements. 

Regarding risk tolerance limits, DSIO staff has observed that some FCMs use multiple limit 

thresholds for some or all risks. For example, intermediate limits serve as an early warning 

system that prompts review by the RMU. Higher limits are also established such that a breach 

thereof indicates a risk that may have a material impact on the FCM and may require escalation 

to senior management or the governing body. 

 Finally, FCMs are reminded that Regulation 1.11(e) requires the RMP to take into account 

risks posed by affiliates, all lines of business of the FCM, and all other trading activity of the 

FCM and must describe with sufficient detail how the RMP has been integrated into risk 

management at the consolidated entity level.

Regulation 1.11(e)(2) – Periodic Risk Exposure Reports

DSIO staff observed that some quarterly risk exposure reports (“RERs”) did not address all 

risk exposures identified in the applicable RMPs. Some FCMs have indicated that certain of 

those risks are sometimes covered in separate reports provided to senior management and to the 

FCMs’ governing bodies, but not to the Commission. The Division expects each RER to address 

all of the applicable risk exposures of the FCM. Risk exposures discussed in multiple reports

must be consolidated into the quarterly RER and delivered to the senior management, governing 

body and Commission. In addition, each RER must describe changes in the RMP policies and 

procedures as required by Regulation 1.11(e)(2). 

 The Division observed the following in some RERs that FCMs may wish to consider 

including to provide greater context for the information in their RERs: 

1. Disclose the actual risk exposures during the period for each risk metric rather than 

providing only limit breach information. For example, the maximum, minimum, mean, 

median, and standard deviation for risk exposures could be provided or shown 

graphically over the course of the quarter.
4 

2. With respect to appropriate risks such as capital, liquidity, market, and segregation risks, 

discuss the overall trend for the quarter, a prediction of future trends (i.e., improving, 

stable, deteriorating), and discuss historical trends such as quarter-by-quarter 

comparisons or a rolling 24 month analysis. 

3. Describe how the stress testing undertaken during the quarter: (i) is consistent with the 

firm’s risk and business strategy; (ii) takes into account limit moves over multiple days; 

and (iii) includes hypothetical worst case scenarios that could result from world or market 

events. 

4. Include the date the RER was provided to senior management. 

5. Define the material terms, abbreviations, methodologies, and metrics included in the 

RER. 

Regulation 1.11(f) – Review and Testing of the RMP

The annual review of the RMP required under regulation 1.11(f) can be performed either by 

internal audit staff that are independent of the BU or by a qualified third party audit service that 

reports its findings to staff that are independent of the BU. The final report regarding the annual 

RMP review should indicate who performed the review. Regardless of who conducts the annual 

review, an FCM must ensure that the review analyzes the FCM’s adherence to the RMP and the 

RMP’s effectiveness, and provides any necessary recommendations for RMP modifications.

Regulation 1.11(g) – Distribution of the RMP

 Regulation 1.11(g) requires an FCM to distribute its RMP to relevant supervisory personnel 

and keep records of its distribution. The Division observed two practices FCMs may wish to 

consider implementing in order to better evidence compliance with this regulation: 

1. Describe in the RMP the procedures for distributing, and tracking the distribution of, 

copies of the RMP. 

2. Identify in the RMP the personnel or department responsible for the maintenance and 

distribution of the RMP.