Basel Committee on Banking Supervision

Counterparty credit risk (CCR) is a multidimensional form of risk, affected by both the exposure to a counterparty as well as the credit quality of the counterparty, both of which can be sensitive to highly dynamic and fast-moving changes in financial markets. CCR is also affected by the interaction of these risks, for example the correlation between an exposure and the probability of default of the counterparty, or the correlation of exposures among the bank’s counterparties. Constructing an effective CCR management framework requires a combination of risk management techniques across credit, market, operational and liquidity risk disciplines.

Events such as the default of Archegos Capital Management, highlighted broad-based weaknesses in areas of banks’ CCR management related to due diligence, risk measurement, risk management and governance. These issues are particularly acute for high-risk counterparties, such as institutions with material concentrations, opaque business activities, limited transparency or high leverage. The risks posed by these weak practices may be exacerbated when competitive pressures in the industry drive a race to the bottom in activities that mitigate risk, such as margining.

CCR management techniques have evolved rapidly over the past decade along with the complexity of derivatives and securities financing transaction (SFT) products, concurrent with the growth in – and banks’ interlinkages with – non-bank financial intermediaries (NBFIs), including highly-leveraged institutions.

The following terms are used throughout this chapter and have the meaning given below:

1. Counterparty Credit Risk (CCR): is the risk that the counterparty to a transaction could default before the final settlement of a transaction’s cash flows (see also CRE50.1).
2. Credit risk mitigants: are tools that are necessary for banks to effectively manage their CCR.
3. General wrong-way risk (GWWR): arises when the probability of default of counterparties is positively correlated with general market risk factors.
4. Margin period of risk (MPOR): is the time period from the last exchange of collateral covering a netting set of transactions with a defaulting counterparty until that counterparty is closed out and the resulting market risk is re-hedged.
5. Potential future exposure (PFE): is a risk metric calibrated on current/recent market conditions that quantifies, over a defined future horizon and at a specified confidence level, how sizeable the CCR exposure of a given counterparty’s portfolio may become given the applicable contractual terms and credit risk mitigants. PFE is predominantly computed based on scenarios generated with Monte Carlo simulations,1 considering multiple forecasting horizons (typically up to the life of the contract) and a high percentile (eg 95% or 99%) of the simulated portfolio exposures distribution (alternatively, expected shortfall measures linked to such confidence levels are used).
6. Securities financing transactions (SFTs): are transactions such as repurchase agreements, reverse repurchase agreements, security lending and borrowing, and margin lending transactions, where the value of the transactions depends on market valuations and the transactions are often subject to margin agreements.
7. Specific wrong-way risk (SWWR): arises when the exposure to a particular counterparty is positively correlated with the probability of default of the counterparty due to the nature of the transactions with the counterparty.

These guidelines set out critical aspects of effective management of banks’ CCR and sound practices regarding what constitutes a robust CCR management framework. They aim to take account of market developments in CCR management, address CCR management failings, and lay out sound practices for CCR management and robust supervisory expectations.

The guidelines are intended to be applicable to a diverse range of banks and should be applied on a proportionate basis depending on the size, complexity and materiality of the counterparty credit risk profile of banks. While the guidelines are formulated with a view towards application to large internationally active banks with material CCR exposures in BCBS member jurisdictions, the framework for managing risk in the guidelines is broadly applicable to all banks with CCR exposures. In all jurisdictions, smaller banks and banks with less material CCR exposures can benefit from the application of the guidelines. Banks and supervisors are encouraged to use the guidelines to identify potential areas of improvement in CCR management practices.

The guidelines should be used to manage banks’ CCR exposures to all types of counterparties. Certain requirements are intended to be applied specifically to selected types of non-bank entities whose leverage could potentially pose financial stability risks, including hedge funds and other leveraged investments funds, insurance companies and pension funds.

The greatest potential benefits in terms of improvements in CCR management are expected to be in cases where banks have high-risk exposures to NBFI counterparties.2 Banks and supervisors are encouraged to take a risk-based and proportional approach in the application of the guidelines, taking into account the degree of CCR generated by banks’ lines of business and their trading and financing activities, as well as the complexity of such CCR exposure. In the case of small and non-complex CCR exposure, when adapting the guidelines, supervisors and banks should reflect the lower riskiness and complexity of the respective CCR exposure. All provisions in these guidelines should be interpreted in this way, including paragraphs where the principle of proportionality is not specifically mentioned.

Thorough counterparty credit risk due diligence is the starting point of a bank’s CCR relationship with its clients and is therefore critical to risk management. Due diligence encompasses a wide range of processes conducted by a bank as it collects information on its counterparty, assesses the level of risk that the counterparty and its activities pose to the bank, and analyses information to make credit decisions. Although aspects of due diligence will differ depending on whether the counterparty is being onboarded for the first time or a review is taking place for the continuation of an existing relationship, a few key sound practices are broadly applicable.

Sound management of CCR requires both a strong initial assessment and an ongoing understanding of the counterparty’s risk profile in both business-as-usual (BAU) and stressed market conditions. The credit approval process should begin with a comprehensive collection and review of financial and non-financial information, including legal, regulatory, reputational and operational risks, as well as other relevant risks, leveraging available information from across the bank to build a clear picture of a counterparty’s risk profile and risk management standards. Additionally, banks should understand the rationale and economics of underlying exposures and of the key drivers of the counterparty’s performance and growth. Banks should be particularly wary of any mechanisms for conducting due diligence and managing material counterparties purely on a portfolio basis, without due consideration of individual counterparties and the risks they pose to the bank. Ongoing monitoring of counterparties requires updated information about material developments such as changes in trading activities and leverage taken, profit and loss developments and significant changes to how the counterparty measures and manages their risks.

Credit standards should clearly dictate initial and ongoing due diligence expectations for different counterparty types and should conform to the bank’s stated risk appetite. Standards should be appropriately informative, having regard to the product and industry, and be commensurate with the bank’s risk profile and business model in that space. Due diligence standards should discuss the frequency and intensity of credit reviews and be updated as business strategy changes. In some cases, rating scorecards may, with appropriate guidance, serve as a means of stratifying due diligence expectations by counterparty risk.

Information disclosure

Effective due diligence processes rely upon sound information disclosures. To ensure a robust process across the institution, banks should establish a risk-based disclosure framework that includes minimum standards on counterparty disclosures, taking into account the counterparty sector3 and risk profile of the counterparty, as well as an exceptions management process.

While defining minimum standards is important, banks should also directly incorporate the quality of counterparties’ disclosures into the assessment of the internal risk rating, setting the level of margin requested and setting limits on exposure to the counterparties. In general, the more exposure and risk a bank has with regard to its counterparty, and the riskier that counterparty is, the more visibility the bank should have into the counterparty. Ultimately, a counterparty’s failure to provide information commensurate with their risk profile should lead to a more conservative approach to risk rating, limit setting, margining and other forms of credit risk mitigation, or even the rejection or offboarding of the client.

Before onboarding and throughout the ongoing relationship with a client, banks should collect sufficient information to understand the client’s overall risk profile. In some cases, the collection of financial statements alone is insufficient to assess the riskiness of a counterparty. For example, risky and complex counterparties such as hedge funds should provide additional disclosures and risk metrics – such as value-at-risk or stress test results – so that banks have visibility into the counterparty’s own assessment of their underlying leverage and risk profile. When counterparties share internal risk reports produced on a regular basis, the bank should use these reports to gauge the quality of the counterparty’s risk management capabilities and practices. Banks should ensure that the frequency, granularity and quality of disclosure they receive increase as their relationship with the counterparty grows in size, complexity and risk. Where practicable and reasonable, banks may also benefit by obtaining additional information on key metrics – such as unencumbered cash, cash equivalents and other unencumbered liquid assets eligible as collateral under the CSA agreement – from their counterparties during times of stress.

Banks should monitor the timeliness and quality of financial statements and risk information provided by the client on an ongoing basis and track exceptions to established standards at the counterparty level as well as at aggregated portfolio levels. As information from the client is received, banks should also ensure that adequate proof, assurance or verification – where relevant and practicable – is applied as part of their due diligence processes. This type of practice helps ensure that credit risk decisions are not made based solely on unverified or verbal information. In some cases, banks may benefit from engaging third-party information verification services.

In the onboarding process, banks should ensure that they have a holistic view of a counterparty’s potential activities and risks throughout the banking organisation. This process should ensure that onboarding and managing a counterparty’s risks across different trading and lending products, and through multiple entities and jurisdictions, is transparent with clear lines of accountability. Economically equivalent risks should be onboarded similarly, regardless of onboarding platform, business or legal entity. For example, central and remote booking should follow the same due diligence process, with clear oversight and accountability.

Before onboarding a counterparty, banks should inquire about its past and present reputation and creditworthiness, for example by accessing credit registers, evaluating legal status, considering the level of regulatory oversight and available regulatory reviews, and becoming knowledgeable about the individuals responsible for managing the institution, including considering any previous supervisory sanctions against the counterparty or the managers. Banks should also assess qualitative factors such as strategy, quality of risk management practices, and staff composition and turnover. However, a bank should not grant credit solely because the counterparty or key members of its management are familiar to the bank or are perceived to be highly reputable. Similarly, banks should not unduly rely on profitability considerations when deciding on the onboarding of a new client.

Banks should recognise that, although their initial onboarding decision may be binary, their full credit risk decision-making process can be a spectrum of how much credit and exposure the bank is willing to extend to the counterparty, including the terms of margining used to control the amount of leverage in the trading relationship and transactions with the counterparty. As a result, banks should demonstrate thoughtful and clear linkages between information analysed during onboarding due diligence and their CCR decisions, including but not limited to risk ratings, limits, contractual terms and risk mitigants (eg collateral and guarantees).

Banks should ensure, at the point of onboarding, that their processes consider and assess non-financial risks as part of the credit risk decision-making process. Banks should also establish an escalation process and clear communication channels for the review of non-financial risks. For instance, banks should appropriately characterise the intersection between CCR and geopolitical or country risk. This is a process that may benefit from consultation with the legal department at the point of onboarding. In some cases, risks such as reputational risk may not directly affect the counterparty’s capacity to repay – ie probability of default – or immediate financial performance but may introduce other non-quantifiable risks that could have a material impact on the overall riskiness of the counterparty. These non-quantifiable risks can transform into CCR over the longer term, even in cases where no direct impact on the probability of default can be seen.

Banks may leverage upstream processes, such as those that may already exist in compliance and operational risk management frameworks (eg know-your-customer), to inform and drive assessments performed in the credit risk decision-making process, rather than replicate capabilities across functions. Banks should ensure that the established processes are effective in directing or channelling relevant and material considerations – including those regarding non-financial risks – to credit risk analysis and to the decision-making process. They should also ensure that credit risk management processes adequately evidence analysis and outcomes in decisions.

The credit process should identify the purpose and structure of the transactions for which approval is requested and provide a forward-looking analysis of repayment capacity based on the creditworthiness of the counterparty and available credit protections. Banks should also consider idiosyncratic scenarios and circumstances that could present material risks to the client’s creditworthiness. For certain types of counterparties, banks should have a good understanding of key assumptions made about a counterparty’s risk profile – such as their level and sources of liquidity and how the orderly liquidation of underlying positions might occur – when establishing a relationship with them in order to facilitate a deeper understanding of the inherent riskiness of the underlying trades with the counterparty, including market directional risk, excessive concentration risk, idiosyncratic risks and wrong-way risk (WWR) arising from the dependency between client default and its underlying exposure.

Banks are expected to review proposed trading positions or sample portfolios to assess the underlying risks inherent in the activity that the bank will be financing. When deemed necessary, banks should apply this review when onboarding new clients or new funds or approving new types of trading activity for existing clients. This analysis should span at least the main internal metrics used for risk monitoring, including BAU and stressed exposures. In the case of new trading positions of existing clients, the incremental impact of the new positions should be assessed against the existing risk limits for the counterparty. Sound due diligence practices incorporate specialised evaluation and technical knowledge of industries such as commodities, where terms vary significantly depending on the type of product being traded and collateral obtained.

The due diligence obligations do not end following the initial onboarding of a counterparty. Instead, banks should recognise the need to continually receive and assess information that sheds light on a counterparty’s risk profile. For example, banks should obtain information about material counterparty developments such as changes in the direction of their trading activities and performance (eg net asset value (NAV)), profit and loss developments, significant changes to leverage, alterations to their risk management procedures or their risk measurement processes, and changes in key personnel. Banks should rigorously explore whether high returns shown in a counterparty’s portfolio are associated with higher risks that have not been properly considered or whether they represent unknowns and cannot be substantiated without overreliance on the client’s representations.

Following the characterisation of the counterparty’s risk profile at onboarding (such as through proposed trading positions or sample portfolios noted earlier in this section), deviations from the risk profile should be tracked and lead to adjustments in the ongoing monitoring process as appropriate. Banks should also establish a frequency for ongoing monitoring and predefined triggers for metrics such as performance, volatility, liquidity, management quality and concentration, which should be commensurate with the risk presented by the client under normal and stressed market conditions. The frequency of ongoing monitoring should also take into account the assessment of a counterparty’s non-financial risks.

An internal risk rating system used to assess and monitor quality both of individual counterparties and across the portfolio should be suitable for and commensurate with the nature, size and complexity of a bank’s activities. For counterparties with CCR exposures, due consideration should be given to the dynamic nature of these relationships, as mark-to-market (MTM) exposures can change materially over short time frames that may require updated credit risk assessment and decisions. The frequency of internal risk rating reviews for counterparties should account for their inherent risk as well as the dynamic nature of their positions. Ultimately, the risk rating process should ensure that any material change in the counterparty’s risk profile triggers a revised assessment. These revisions should include but are not limited to: the risk rating score, products allowed for the relationship, margining terms, and exposures and concentration limits.

As part of ongoing monitoring, banks should track non-standard contractual terms that are outside their credit policy standards and assess the potential need for adjustments to terms, where necessary, to further enhance their credit risk mitigation. Notwithstanding these practices, banks should not rely solely on strong contractual terms and the ability to close out transactions with a client to negate the need to conduct proper risk management. Similarly, covenants should facilitate the timely monitoring of a counterparty’s risk profile so that banks are aware of adverse financial events and take actions to adjust or mitigate the exposure before the need arises to close out the client relationship.

Margin is the primary component of risk mitigation for CCR exposures, and, in some cases, banks may also choose to rely on other risk mitigants to support credit risk management decisions. These mitigants can range from contractual terms to cross-collateralisation and written guarantees, all of which can provide additional risk mitigation. In many cases, margin is necessary but may not be entirely sufficient to mitigate risk without due consideration of other factors such as the creditworthiness of the counterparty, the frequency and reliability of the disclosures, the level of transparency in the overall risk profile of the counterparty and the riskiness of the counterparty’s positions relative to market depth and conditions.

Bank policies and procedures should determine the range of allowable credit risk mitigants where possible. These policies should ensure that the usage of mitigants is controlled and monitored appropriately across the bank’s portfolio. Furthermore, the assessment of such mitigants should closely relate to the creditworthiness of the counterparty and the riskiness of the underlying exposures.

Regardless of the credit risk mitigants, bank policies and procedures should determine:

1. the necessary and allowable contractual provisions that govern counterparty relationships and which affect CCR (including, for example, early termination rights, margin lock-up agreements and default notification periods) and ensure that contractual terms are clearly considered when setting limits and risk appetite for trading with a counterparty; and
2. the circumstances under which these clauses may be reviewed.

These legally binding and enforceable contractual arrangements – coupled with the bank’s limit frameworks – determine the size of the credit exposure assumed by the bank. It is therefore paramount that, in calibrating these contractual terms, there be close consideration of their enforceability under various conditions, the nature and creditworthiness of the counterparty, the riskiness of its underlying exposure to the bank, and the overall transparency of the counterparty with respect to its positions and trading strategy. For example, banks should request higher margin when faced with a lack of disclosure and should frequently monitor margin sufficiency and shortfall vis-à-vis the underlying risks.

Banks should develop and implement a transparent and robust margining framework that is consistent across all trading products and onboarding platforms. Such practices are reflective of underlying risks and the bank’s risk appetite. At a minimum, the margin framework should adequately capture the risks associated with the counterparty’s underlying exposure (including valuation risks), the quality of collateral received and the credit risk associated with the counterparties.

Margin levels should account for the market risk of the portfolio and be calibrated to ensure adequacy of margin through various mechanisms including, charging upfront margin. It is best practice that margin levels be sensitive to changes to the counterparty’s risk profile, underlying risk characteristics and credit quality. For example, the preference is that margin for a counterparty’s exposure be sensitive to the implementation of new trading strategies, as well as changes in portfolio directionality, concentration, leverage, or other idiosyncratic risks. If margin is not risk-sensitive or dynamic, such as independent amounts (IA) based on a per-trade notional amount, banks should ensure margin sufficiency and rely on other risk mitigation tools, such as limits or contractual terms, to manage exposure effectively. Other factors to consider include market conditions affecting the underlying trading activity, such as increased volatility, crowdedness, liquidation and market liquidity.

The sophistication of margining frameworks should be commensurate with the complexity and materiality of banks’ portfolios. The computed margins for a particular counterparty should be reflective of its specific portfolio vulnerabilities and exposures and capture material risks at the counterparty’s portfolio level. Banks should also require margin levels that reflect material risks arising from other contractual terms such as early termination, margin lock-up and frequency of margin resets, among others.

The margining framework should be informed by and reflective of the bank’s assessment of the overall risk profile of the counterparty based on available information, including financial statements and, where appropriate, NAV trends and volatility. Banks could, for example, use disclosed information such as NAV growth, volatility, etc to infer risk taken outside of their portfolio.

Banks should avoid opaque margining frameworks that lack effective oversight and fail to ensure that adequate and sufficient margins are charged on trades or portfolios both at the inception of the relationship and on an ongoing basis. Additionally, banks should preferably not engage in margin customisation or deviate from approved margin policies to accommodate commercial or competitive pressures. Where they do so, appropriate governance should be in place and support should be provided by margin sufficiency benchmarking and analysis.

Banks should have systems, policies and procedures to monitor the effectiveness of their margining frameworks and methodologies, which should be periodically reported to banks’ senior management. Margin frameworks should be subject to ongoing monitoring and governance related to margin sufficiency, underlying assumptions, contractual terms, limit setting and risk appetite. Monitoring should be undertaken on both the counterparty level and on an adequate portfolio aggregation level. House margin frameworks should undergo a level of governance and scrutiny proportionate to their materiality. As part of this, margin frameworks should be assessed for adequacy and sufficiency using benchmarking and quantitative testing. For details on risk reporting, refer to the section titled “Management reporting” in this chapter.

Where applicable, banks should establish a formal risk framework for deviations from their margin terms and monitor exposures against it. This governance framework should include clear escalation and approval requirements for material deviations.

Initial margin (IM) requirements are a particularly important part of a margining framework. They represent the amount of collateral necessary to absorb potential losses in relation to a particular trade or portfolio of trades that may arise in the time between the last exchange of variation margin and the liquidation or hedging of the positions. Such margin is either static or re-evaluated and adjusted over time (ie dynamic) to reflect changes in a portfolio’s risk. When adopted, static margin should be set appropriately and sufficiently so as to cover unexpected changes in underlying exposure due to market value and riskiness.

Variation margin (VM) is another important component of a margining framework and is generally defined as the amount of collateral necessary to cover the current portfolio exposure, accounting for changes in the MTM valuation of the positions on a contractually agreed frequency. Banks should have rigorous and robust margin (IM and VM) dispute resolution procedures in place with their counterparty and, to the extent possible, apply daily VM to all material counterparties where thresholds and small minimum transfer amounts are set in line with the banks’ risk tolerance.

When banks agree to two-way collateral provisions, they should make sure that the resulting additional exposure – of the posted collateral – is monitored and fully integrated into the overall risk management and measurement processes. Banks should ensure that contractual terms stipulating two-way VM do not exacerbate risk by increasing the counterparty’s leverage and credit exposure. In granting two-way margining and rehypothecation rights, banks should give due consideration to the credit quality of the counterparty and the riskiness of the underlying exposure, including collateral. This guidance does not supersede any regulatory requirements to enter into two-way margin agreements with certain counterparties.

Banks should assess the need for margin based on the risks and vulnerabilities of the traded positions. For example, banks should assess the margin sufficiency – ie the estimated margin based on underlying risks versus the margin posted by a counterparty – of all traded products, regardless of product type and whether the exposure is cleared or non-cleared, and should consider the risk of potential delay in margin delivery as well as substitution of collateral, if contractually permissible.

In managing the risk of counterparties at low risk of default, banks cannot have a double benefit from collateral in the measurement of both default and exposure risks. Regardless of the likelihood of a counterparty’s default, banks should assess margin needs based on the riskiness of the underlying exposure, including collateral being posted. Similarly, default risk should not be assessed based solely on the lower risk of the underlying exposure to counterparties due, for example, to perceived diversification or market neutrality in long/short types of exposure.

Banks should establish policies and methodological frameworks that define eligible collateral and quantify the collateral haircuts to be applied to SFT exposures. Banks should also ensure that collateral haircuts and VM for SFTs reflect the underlying risks of the counterparty and riskiness of the exposure and that IM is applied consistently across similar products. When deemed necessary, banks should make SFT collateral haircuts dependent on both the riskiness of the security and on the riskiness of the counterparty.

Banks should assess the legal enforceability of all credit risk mitigants and incorporate potential delays in accessing collateral when measuring exposure and margin. This review should consider not just differences in relevant jurisdictions, but also differences across products and collateral types.4 For example, this practice should determine the criteria under which the protections provided by the legal framework are enforceable to the benefit of the creditor.

When acting as agents for derivatives transactions, banks should make their own assessment of the adequate margin levels for their counterparties. For certain types of counterparties, banks should not simply pass on the clearing house or regulatory margins to their counterparties but rather determine margin sufficiency based on their internal risk assessment. For certain types of counterparties, banks should have processes to determine if and when they may need to consider applying margin multipliers.

Banks should pay particular attention to concentration and WWR in which margin and collateral established to cover counterparty credit exposures may be significantly reduced if the probability of the counterparty’s default is negatively correlated with the value of the collateral or positively correlated with the market value of the contracts.

The contractual terms of specific trades have significant impact on their risk profile, as certain trades can either generate additional risk or mitigate risk based on the features of the trade. For example, banks should be aware of the use of derivatives such as a bullet swap, which, if left thinly margined or unmargined, can present elevated risks when compared with a similar resetting swap.

In situations in which a bank has CCR exposure to a counterparty that – as a standalone legal entity – is not a creditworthy entity, the bank may seek a guarantee. Banks should assess the credit quality of the guarantor in order to ensure that they can rely primarily on written guarantees that contractually obligate a guarantor to support the obligations of the bank’s counterparty.

In other situations, there could be a support provider without an explicit written guarantee. In such cases, banks should establish a robust framework for assessing the likelihood, willingness and capacity of a support provider to step in and provide support. In all cases, banks should ensure that implied support is not considered equivalent to written guarantees and appropriately discount the strength of implied support when making decisions about other risk mitigants that should be obtained. This is especially important when a bank has significant trading activity with subsidiaries which rely on parental support to substantiate credit risk decisions.

Banks may obtain written guarantees that are capped, limiting the amount of exposure guaranteed by the guarantor. In the context of CCR exposures, which can increase rapidly as the market environment changes, banks should ensure that they have processes in place for assessing the use of capped guarantees, including guidelines for sizing and monitoring current or potential exceeding of the cap.

CCR default losses are often driven by tail events, such as large and sudden asset moves or the unforeseen occurrence of unusual market scenarios, which can have a dramatic impact on the solvency and portfolio performance of certain counterparties. Moreover, CCR is by nature multi-dimensional, involving up to several thousand counterparties and a much higher number of underlying assets, combined in portfolios of trades spanning all sorts of risk configurations: linear and non-linear, concentrated and diversified, hedged and directional.

Dealing with this plethora of different risk profiles – and specifically with their tail behaviour – requires banks, in managing CCR, to rely holistically on a variety of non-equivalent risk metrics that assess all the material dimensions of CCR. Such metrics should provide a complementary and comprehensive view of risk, covering for both BAU and stressed market conditions as well as for any material vulnerability to specific idiosyncratic risks. The signal of these metrics should be calibrated with a sufficient level of conservatism, aimed at compensating for the inherent model risk of the quantitative methods used.

CCR exposure metrics for a given counterparty should be computed with appropriate consideration for the level of aggregation embedded in the calculation. Exposure metrics should be produced frequently and in a timely manner and include all trades giving rise to CCR, across product types (eg bilateral, centrally cleared and exchange-traded derivatives and SFTs), as well as across business lines and legal entities. In addition, the risk monitoring process should be fully informed of any additional credit exposure with the counterparty, such as loans outstanding or unused credit commitments.

CCR exposure metrics should be comprehensive in covering banks’ material risks at portfolio, counterparty and a more granular level, as appropriate. For every counterparty, exposure metrics should account for the contractual terms – and for their inherent risks, eg related to netting and collateral enforceability – and be consolidated across product types, desks and books. Overall, this suite of metrics should provide a holistic view of the characteristics of the entire distribution of CCR exposures, including average, high quantiles and residual tail risks. Residual tail risks can be very significant for counterparties such as highly leveraged institutions in which solvency, liquidity or both closely depend on portfolio performance.

Exposure metrics should be actionable and embedded in the different stages of the CCR management process, including: (i) the pricing and setting of contractual margins (eg x-value adjustment (XVA) and IM methodologies); (ii) risk monitoring (eg potential future exposure (PFE) and stress testing); and (iii) capital assessment (eg standardised approach for counterparty credit risk (SA-CCR), internal models method (IMM), when applicable, and stress testing). Such metrics should supply the bank with an ongoing, timely and accurate view of the counterparty’s exposures. When relevant changes occur either in the portfolio or the risk profile of a specific counterparty, such changes should be promptly reflected in the exposure metrics.

The metrics used to quantify risk at any stage of CCR management should undergo the appropriate level of internal governance and independent review applicable to the models used, irrespective of any perceived analytical simplicity. This should include the initial and ongoing review by an independent validation unit. As part of the challenge process for the metrics, end users – including senior risk officers – could be actively involved by reviewing parallel runs, impact studies and concrete examples based on existing and/or historical portfolios. Stakeholders should maintain a sound understanding of: (i) the risks captured by each of these risk metrics; and (ii) the inherent limitations of these risk metrics.

Related to the previous paragraph, end users and key stakeholders should be provided with a clear and actionable taxonomy of the supported CCR metrics – including their range of applicability and known limitations – across counterparty groups, product types and contractual arrangements. Such taxonomy, given its central role within the CCR management process, should be subject to appropriate senior management oversight and reviewed by an independent validation function for the appropriateness and scope of usage of its main modelling components.

The exposure metrics should, collectively, provide complementary risk capture and give banks visibility of material drivers of exposure under current and stressed market conditions. Such drivers should account for the potential structural risks and vulnerabilities of the positions – considering factors such as leverage, concentration, liquidity and WWR – even when they cannot be fully characterised because of partial information regarding the true risk profile of the counterparty. In a similar fashion, exposure metrics should account for the possibility that perceived risk mitigants or diversification benefits may not work as intended. For example, PFE, as well as IMM and CVA EE profiles, generally produce hardly any actionable signal for over-collateralised counterparties (such as hedge funds or other highly leveraged institutions) since they are often computed ignoring (at least general) WWR and the possibility of margin-driven defaults.5 Therefore, such metrics should be complemented by additional metrics that better capture the residual risks.

In measuring exposure, banks should properly identify, evaluate and capture idiosyncratic risks such as excessive concentration to a single name or single risk factor, material dispersion or basis risk between long and short positions, lack of liquidity due to limited trading volume, the presence of complex or bespoke positions in the portfolio, or simply the sheer position size. When deemed necessary, banks should directly consider how such idiosyncratic risks may affect portfolio correlations and the accuracy of the valuations used to determine margins. They should also consider how such risks may exacerbate WWR and ultimately magnify closeout losses. In this context, the overall risk profile of the counterparty should be assessed conservatively, giving due consideration to scenarios such as horizontal hoarding6 or crowding that can materially skew the exposures distribution.

Beside PFE and stress-based exposures (see the next two sections), banks should monitor their aggregated CCR position and the risk profiles of their counterparties using simple and intuitive risk metrics that are model-free, ie based solely on the structural features of the portfolios. These metrics should provide indicative CCR losses in extreme market scenarios, such as a sudden breakdown in asset correlations, a major liquidity dry-up or other idiosyncratic events in specific trade underlying, or country/regional turmoil directly affecting the solvency of local counterparties.

The metrics described in the previous paragraph and monitored by banks – either at the counterparty or bank’s portfolio level – should include for example: (i) gross notional amount or gross market value (a tool for identifying a vulnerability to the breakdown of specific long/short hedges within a counterparty’s portfolio); (ii) gross trades’ delta exposure (a tool for identifying, either at the counterparty or bank’s portfolio level, a potential exposure concentration in specific risk factors); (iii) received and posted collateral composition (a tool for identifying, at the bank’s portfolio level, a potential concentration in specific collateral assets); and (iv) country or regional gross exposure (a tool for identifying, at the bank’s portfolio level, potential exposure concentration with regard to countries or regions with significant geopolitical risk).

Banks should have a dedicated WWR framework in place that is integrated into the general risk assessment framework and gives due consideration to both general wrong-way risk (GWWR) and specific wrong-way risk (SWWR). The WWR framework should be commensurate with the risk appetite and be designed to effectively allow for the identification, measurement, monitoring, regular reporting, limit setting and explicit treatment of exposures giving rise to WWR. Such a framework should explicitly account for relevant risk factors, going beyond mere compliance with regulatory requirements. This is specifically relevant for counterparties whose business strategy is particularly vulnerable to certain market risk scenarios, including those with high leverage and other specific structural features of their portfolio.

To identify and monitor GWWR, banks should have clear definitions in place in terms of the risk categories applicable to their portfolios, including industry, region, business areas, products and any additional relevant dimension. The regular GWWR identification process should be supported by well-defined stress testing, based on scenarios of credible severity, that are reported with appropriate frequency to senior management.

Banks’ processes and methodologies for SWWR assessment and monitoring should be well defined and documented. They should enable the identification of relationships between a counterparty’s creditworthiness and the CCR exposure to the counterparty. The SWWR classification should be based on a clear definition of legal connection that considers legal frameworks on ownership, including control or consolidation requirements. In addition, for CCR management, banks should also consider applying the SWWR classification to cases with no strict legal connection but where the counterparty is significantly economically dependent on its underlying exposure. The results of the regular SWWR identification process should be reported with adequate frequency and escalated to senior management where necessary.

The exposure metrics should account for WWR (either directly or via suitable adjustments or overlays). This is especially relevant for NBFIs, particularly institutions with high leverage and/or concentrated exposures, whose solvency – because of the leverage and concentration – becomes materially correlated with portfolio performance. In such cases, banks should ensure that at least some of the risk metrics used to monitor CCR are calibrated to historical and idiosyncratic scenarios commensurate, for instance, with those observed during the Archegos Capital Management and Long-Term Capital Management defaults, when WWR drove large gap moves for the underlying portfolio assets and ultimately magnified the closeout losses.

Banks should quantify CCR exposure daily, using PFE or alternative metrics to measure the future exposure against a given counterparty conditional upon its default. For risk monitoring, when calibrating PFE or alternative metrics, banks should have due regard to the modelled risk factor dynamics (including, when appropriate, the calibrated gap moves for the underlying assets), as well as the applicable margin period of risk (MPOR)7 and collateral haircuts.

While using PFE to monitor risk limits at counterparty and product levels, banks should ensure that the counterparties’ PFEs are: (i) reflective of the contractual terms, including trade attributes, netting and collateral requirements; (ii) computed and monitored across all the applicable risk horizons; (iii) based on risk scenarios that conservatively account for the stochastic behaviour of the portfolio’s material risk factors and the collateral dynamics over the MPOR; and (iv) computed with a sound modelling of correlations among risk factors and of any risk basis (eg long/short positions with residual dispersion) that may materialise in ordinary or distressed markets. In general, banks should be conservative in their treatment and modelling of excess collateral received from counterparties.

When relying on PFE to manage CCR, stakeholders should maintain a sound understanding of both the risks captured by the metric and its inherent limitations, such as the risks not captured in the PFE. The limitations should be documented and reviewed on an ongoing basis and compensated in the CCR management process by assessing exposures using complementary risk metrics such as factor sensitivities, aggregation on a gross basis and stress testing. For example, should the peculiar risk dynamics of over-collateralised and/or highly leveraged counterparties not be fully captured within the PFE model, it is crucial to consider them within stress testing.

Banks should adjust the MPOR to account for excessive risks driven from concentrated and/or illiquid portfolios or collateral and give due consideration to related idiosyncratic risks that can materialise upon the default of the counterparty, such as crowding during liquidation and a consequent large drop in the value of the assets. Such risks should primarily be addressed through: (i) a suitable framework capable of quantifying the closeout MPOR based on the counterparty’s portfolio; and (ii) for potentially illiquid trades/underlyings, by simulating the portfolio dynamics with stochastic models calibrated to a level of distress commensurate with the market risk of liquidating highly concentrated positions. It is noteworthy that, in the case of Archegos Capital Management (whose closeout period was not unusually long), the forecasted PFE was less than a tenth of the realised closeout losses. As such, the PFE modelling framework was severely understating the impact of liquidity and concentration on the closeout exposure.

Banks should be mindful that plainly offsetting the scenarios trades exposures with the forecasted level of IM (in addition to any applicable VM) may result in zero or negligible PFEs for collateralised counterparties.8 This perspective does not account for the material risk of margin-driven defaults, where the available IM may not compensate for the large VM collateral shortfall originated by a sudden gap move of the underlying portfolio assets (for instance, driven by the leverage/WWR dynamics previously discussed). This scenario is especially relevant for highly leveraged institutions, particularly those that take excessive leverage and have significant concentrations.

As part of the ongoing model governance, PFE should be backtested using either real or hypothetical portfolios (or a combination of both) so as to extensively probe the modelling assumptions versus the realised historical markets. In addition, banks should benchmark their PFE models versus the realised dynamics of well publicised defaults such as Long-Term Capital Management and Archegos Capital Management. They should assess whether: (i) their PFE model is able to produce commensurate exposures at realistic quantiles; and/or (ii) the banks’ overall CCR management framework has adequate compensating measures able to flag an excess of CCR for similar portfolios.

As a necessary and complementary metric to PFE, banks should develop a dedicated CCR stress testing framework for the assessment of counterparties’ exposures in a stressed market environment, where the resulting stressed exposures are fully integrated into the bank’s BAU risk management process and monitored against limits. This is especially relevant for exposures to NBFIs for whom stress testing may be the only systemic approach to identifying and quantifying the main portfolio’s vulnerabilities.

Banks should have clear, documented governance of their CCR stress testing framework in order to ensure the appropriate identification of relevant scenarios, as well as their design and revision when necessary. The framework should include a robust number of scenarios, exhaustive of the multi-dimensional nature of the risks to which the bank’s portfolio is exposed. In addition, banks should have the ability to perform ad hoc stress tests, reverse stress testing and scenarios analysis in a reasonably short time. Based on the business model of the counterparty, a bank should be able to characterise extreme but plausible scenarios that could result in significant adverse outcomes.

CCR stress testing should be consistent and have a broad scope of coverage across all business lines and product types. Banks should apply market shocks simultaneously to both the trades and collateral. The resulting counterparty’s exposures should be compared with risk limits at the individual counterparty level as well as at aggregated portfolio risk levels. The CCR stress testing framework should inform the bank’s day-to-day exposure and concentration risk management and be able to identify extreme market conditions that could excessively strain the financial resources of the bank. As part of CCR stress testing, a comprehensive set of severe stress tests should be routinely performed at the counterparty and portfolio levels, applying both macroeconomic scenarios and relevant combinations of shocks to individual risk factors. These standard stress scenarios should be designed to identify counterparties’ material vulnerabilities. To provide a realistic assessment of exposures to counterparties under stress, these scenarios should be granular at the level of material risk factors and be able to capture material idiosyncratic risks such as concentration in a single name, sector, geography, tenor, risk rating etc, as well as dispersion, basis risks and liquidity issues.

In designing a suite of scenarios for CCR stress testing, due regard should be given to: (i) historical events; (ii) the current macroeconomic and financial environment; and (iii) hypothetical future events, including new information and idiosyncratic and emerging risks.9 Regarding the latter, an effective design process should, for example, consider specific hypothetical geopolitical or natural disaster scenarios that for some counterparties – eg in the commodities or insurance sectors – are more likely to be the ultimate drivers of the exposure conditional upon default. Risk managers should contemplate different hypothetical scenarios that are conceivable regardless of their level of severity. Overall, the design of CCR stress testing scenarios should be informed by periodic vulnerabilities assessments at the level of both the whole book (eg in terms of risk factor coverage) and the most material counterparties (in terms of scenarios’ appropriateness, see next paragraph).

To the extent that specific risk dynamics relevant to the portfolio structure of material counterparties are not captured by the standard set of stress scenarios, banks should design bespoke stress tests capable of accounting for them. Direct and reverse stress testing at the counterparty level, as well as scenario analysis, should be used as active tools to identify the tail risks to which material counterparties may be exposed.

When conducting CCR stress testing, banks should test for situations in which risk mitigation measures do not work as intended, especially under stress or counterparty default conditions. This may entail challenging the strength of assumptions made about the legal enforceability of contracts (eg under specific geopolitical risk scenarios in certain jurisdictions), netting and portfolio diversification, and the ability to collect and liquidate collateral or benefit from any other risk mitigation measures. Stress testing the collateral should provide the bank with an alternative view of its CCR that is not shown when relying solely on PFE. The importance of this is clearly highlighted by the Archegos Capital Management case, in which the realised VM collateral shortfall at default for one of the exposed broker-dealers was more than $1 billion, as compared with no projected shortfall under the PFE metric.

The stress testing scenarios should appropriately capture the impacts derived from the costs of winding down portfolios or netting sets comprising less liquid collateral or transactions that are hard to replace after default by the counterparty. In the absence of reliable information on horizontal concentration in portfolios maintained with high-risk counterparties, the stress testing framework should incorporate conservative assumptions with regard to the bank’s ability to wind down the defaulted position under stressed market conditions, paying due consideration to measurement of the potential market risk losses derived from unmatched hedging positions upon the default of the counterparty.

The CCR stress testing framework should pay particular attention to riskier counterparties, as well as to the identification of counterparties for which certain market scenarios could lead to acute stress on their solvency or liquidity positions and which are therefore particularly vulnerable to exposure tail events. The resulting stressed exposures enable the bank’s risk management function to: (i) identify particularly vulnerable counterparties under certain scenarios; and (ii) identify the most relevant scenarios for the bank’s overall CCR portfolio. Senior management should take a leading role in integrating CCR stress testing into the bank’s risk management framework and risk culture.

As part of the governance of the CCR stress testing framework, the scenarios – as well as any other key modelling inputs used in computing stressed exposures – should be reviewed periodically by end users and key stakeholders in order to ensure ongoing comprehensiveness, granularity and relevance.10 This periodic assessment should include some level of benchmarking for the severity of the applied shocks, eg by comparing the resulting stressed exposures with historically realised exposures for – at the least – the most material and/or vulnerable counterparties.

It is essential that banks develop comprehensive and effective limit frameworks that allow for monitoring and control of the bank’s exposures to its counterparties at both the individual counterparty level and the aggregate portfolio level. Banks should leverage their suite of exposure metrics when designing a limit structure, recognising that any one metric and limit has weaknesses. Broadly speaking, a bank’s limit structure should cover a range of both exposure metrics calibrated on current/recent market conditions and exposure metrics calibrated on stressed market conditions that can include, for example, PFE, gross notional amount or gross market value, as well as other stress test-based measures.

The risk limits framework should be informed by and provide visibility into the key risks – eg concentration, liquidation, dispersion and maturity term structure – in the underlying exposure to a counterparty. Risk limits should also capture all the credit exposures to the counterparty across all products and financial relationships within the banking organisation. Banks should ensure that risk aggregation practices, for the purpose of limit setting, are accurate and reliable.

Effective limit frameworks should be calibrated with a level of severity consistent with a bank’s risk appetite statement, with justifications on the severities used. Risk limits should not be set so high such that they would lead to excessive build-up of risk and prevent a bank from taking the necessary actions to effectively reduce the level of exposure in a timely manner. Additionally, risk limits should not be set too low such that they do not serve as a credible reflection of the bank’s risk tolerance.

Banks should ensure that limit calibration processes are rigorous and subject to senior management review and challenge. Limit frameworks should be reviewed and, when appropriate, recalibrated with reasonable frequency and upon significant changes in overall risk appetite, market conditions, business strategy, business organisation and risk measurement methodologies. In addition, limits set against a single counterparty should be reflective of any material change in the riskiness of the counterparty and/or of its underlying exposures.

Solid governance for CCR relies on three pillars. The first pillar consists of competent people and the right risk culture in the organisation. The second pillar is an adequate strategy for managing CCR, with clear processes and effective limits in place. The third pillar is management reporting and its integration into the decision-making process. This management reporting should enable swift analyses of key CCR in any market situation.

As part of the principle of proportionality and risk-based application, solid governance should account for the size and complexity of the organisation and its business model, as well as related counterparties. Organisations with a more complex business model and higher-risk counterparties should have an appropriate number of qualified staff and are expected to have a more elaborate governance structure. This is not necessarily dependent on the size of the balance sheet. Complexity can arise, for example, as a result of the organisation and management of the business in various cross-border locations or through the trading of highly complex and/or illiquid transactions with a counterparty. Sound governance has to take account of all potential sources of complexity.

People and risk culture

Banks should foster a culture that ensures understanding of all risks, with accountability for taking risk management actions when necessary. Banks should have clear lines that link CCR management reporting and metrics to risk-taking or reducing decisions in a way that is consistent across business lines.

Banks should foster a culture that values the important role played by data and models in managing CCR. A bank’s culture should encourage an appropriate degree of confidence in the data and models underlying CCR management, balanced with an appropriate level of challenge and an awareness of limitations.

CCR contains elements of both market risk and credit risk, requiring CCR management to involve strong collaboration between the market risk and credit risk functions at the bank. Banks should have dedicated functions for CCR. At a minimum, the bank’s risk culture should foster strong collaboration, including but not limited to knowledge and information transfer between the market and credit risk departments. Therefore, banks should prevent siloed thinking in their risk departments and strongly encourage the exchange of information gathered, in particular on market or credit risk that may be relevant to assessing the credit risk of a counterparty or potentially market-distorting events due to the deteriorating credit quality of a counterparty.

Banks should demonstrate that risk management oversight is conducted by risk managers with clearly defined roles and responsibilities and appropriate levels of authority, including exception approval and a clearly defined and actionable escalation framework.

Banks’ CCR managers need to have sufficient experience, expertise and stature to understand CCR and interact with counterparts in trading businesses and with the bank's most senior managers, including the risk committees of the boards of directors. Banks should appoint managers that have a reasonable level of understanding of CCR from both business and risk perspectives, as well as an understanding of how data and models are used to assess and manage CCR. Bank boards of directors should know that they are ultimately accountable for the quality of senior management.

Banks should foster a culture that enables adequate consideration of CCR arising from changes or dysfunctionalities in the geopolitical landscape. They should be able to assess the impact of potential wars and sanctions on their ongoing businesses. Furthermore, banks with an international presence should be able to swiftly assess the impact of wars and sanctions on intragroup transactions that involve their own legal entities, especially those located in potentially sanctionable jurisdictions.

Risk framework

Banks should establish a clear CCR strategy and an effective CCR management process approved by the board of directors and implemented by senior management. The CCR strategy should define the bank’s risk appetite, its desired risk-return trade-off and mix of products and markets. Such a strategy should be supplemented by clear, robust and actionable policies and procedures that establish the effective monitoring and control of CCR relationships. These policies and procedures should drive the credit-setting process and govern banks’ relationships with counterparties and should not be overridden by competitive pressures.

Policies and procedures should be clear with regards to ownership, roles and responsibilities, providing clear guidelines for credit approval authority, remediation and escalation processes. Banks should strike a strong balance between ensuring individual ownership of policies and ensuring that important changes to policy are approved by relevant oversight committees. Additionally, regular policy reviews are conducted on a systematic basis to adequately reflect the bank's risk and business model11 and to ensure their continued relevance. In all cases, authorship and ownership of policies and procedures should be clearly separated.

Banks should ensure that CCR oversight – including second and third lines of defence – is effective, with clear mandates, sufficient knowledge and stature, and the ability to operate in an environment in which managers and staff throughout the organisation are incentivised to identify, challenge, escalate and resolve risks.

The long-term success of a bank’s credit relationships relies heavily on effective and sophisticated risk management. Sound monitoring of a counterparty’s activities requires thorough knowledge and understanding of the economics of the relevant exposures, including purpose, source of repayment, risks associated with collateral, risk concentrations and controls. Reliance on collateral cannot be a substitute for day-to-day risk management and monitoring.

Banks should establish and empower risk committees as governing bodies with authority over all risk-taking aspects of trading businesses, including risk limits, permitted products, hedging strategies, collateral eligibility, margins, risk measurement methodologies and overall risk appetite. As governing bodies, risk committees should receive, on a timely basis, appropriate information on the key risk drivers and risk trends of ongoing trading activities through risk sensitivities, risk scenarios and stress tests.

Banks’ governing bodies should have accountability for limit exceptions and approvals in line with the bank’s established delegation of authority. Banks should embed approval authority for policy changes in risk committees that oversee all trading activities for market and CCR and give risk committees review authority for all approved exceptions. Risk committees are encouraged to delegate their approval and review authority. Nevertheless, in case of delegation of authority, senior management and risk committees retain ultimate accountability for limit exceptions and approvals.

Risk committees should include senior managers from trading and risk functions as well as from compliance, finance, legal and operations groups. Furthermore, risk committees should report regularly to the bank’s board risk committee. Risk committees should be of a size that is adequate to promote the dissemination of decisions taken throughout the organisation, without reducing the accountability of individual participants. Ideally, the chair of the committee is accountable for the committee's decisions.

Remote cross-border activities are more challenging for banks in terms of allocating adequate responsibility for risk management. Banks should manage their counterparty exposure by assigning clear accountabilities for risk management that align to the specificities of their cross-border activities.

Management reporting

Management is directly accountable for the implementation of a sufficiently detailed CCR reporting framework. This reporting should allow management – as well as key risk committees – to easily understand the CCR taken by the bank and to act based on the reported risks. Furthermore, management reporting should empower managers to aggregate the data at an adequate level across key risk dimensions and over time periods. It should also enable managers to easily analyse data and conduct drilldowns on a timely basis.

Banks should have CCR reporting that includes but is not limited to:

1. the key CCR exposure metrics used at both a single name and portfolio level of aggregation;
2. the evolution of CCR exposure over time;
3. top CCRs;
4. relevant limits, breaches and other flagged risks (such as concerning or potentially distressed counterparties or industries); and
5. the degree of likelihood of a potential loss.

Management reporting should inform senior management about non-standard terms and conditions in CCR contracts. Non-standard terms and conditions in such contracts should be discussed by management on a regular basis.

Managers are encouraged to continuously improve the quality of CCR reporting in their institutions. Management reports should be comprehensive, accurate, consistent, actionable, relevant and timely. Furthermore, a bank should be able to produce and analyse reports in both normal and stressed market conditions. This applies both to the reports produced on a BAU basis, and to the ad hoc reports that may be necessary due to the stressed market environment.

Bank management is responsible for building a management information system (MIS) that does not overwhelm users with data. Managers should use the bank's MIS for management reporting and be able to perform on-request analysis without external help for counterparties with material exposure or those on watch lists/close monitoring lists.

Managers should foster a culture that stresses the importance of management reporting in managing CCR. This includes but is not limited to valuing the important role played by data and models in managing CCR.

Banks should also promote a holistic view of market and CCR management, enabling the assessment of the impact of a counterparty default on market risk and vice versa, as well as a clear and actionable risk framework around these assessments.

Limit governance and exception management

Banks should implement a transparent and actionable limit governance framework with clear and proper oversight and review. The limit framework should include a remediation process for limit breach, with distinct and accurate oversight, review and challenge stages commensurate with the severity and materiality of limit breaches.

Limits should be set and verified independently of the business function.

Limit actions such as exceptions should require approval from an independent risk function. If exceptions are sufficiently large, then delegation of authority should require approvals from senior management. Banks should ensure an adequate audit trail of such approvals and record and document such approvals in their risk systems.

Banks should not disregard limit exceptions that may be considered technical breaches without proper review and escalation. Technical breaches – ie breaches caused by bad data, incorrect mapping or similar issues – should be subject to exception approvals that are sized appropriately to allow for meaningful limit monitoring while the root cause of the breach is remediated.

Passive breaches of counterparty credit limits – ie breaches caused by changes in MTM, not position changes – should require the same review and challenge as active breaches.

Risk limits should be set based on the risk tolerance level established by the designated risk committee within the bank. The risk committee should be represented by senior management, including senior risk officers. Risk committee members should have the ability to mandate decisive actions to reduce risk even when there are disagreements with the business units.

At the counterparty level, risk limits should be set at levels consistent with the bank’s assessment of the counterparty’s credit quality, the degree of transparency the bank has on the counterparty’s overall financial condition and leverage, and the bank’s ability to effectively unwind the counterparty’s portfolio in a timely manner in the event of counterparty default.

Banks monitor exposures against established risk limits at least on a daily basis. In addition, banks are encouraged to develop a framework for intraday exposure monitoring that can provide early warning of material developments in counterparties' portfolios and mitigate the risk of a breach of relevant risk limits. For transactions with material risk impact, banks should be able to estimate in a timely fashion whether a new transaction could potentially lead to a breach of the applicable limit and consider controls to mitigate the occurrence of a breach and the size of the breach.

Banks should be able to estimate intraday the potential impact of large market moves on limit utilisation, at least for clients with large portfolios in terms of potential adverse market moves and for clients that are most prone to a downgrade in creditworthiness. Furthermore, banks are encouraged to keep pace with technological developments and improve their exposure monitoring framework such that an intraday exposure calculation is performed wherever technically feasible and adequate for a better risk mitigation.

Banks should have a clear and actionable strategy for de-risking exposure in case of limit breaches. Furthermore, these procedures should also be actionable during phases of high volatility and illiquidity.

Banks may set early warning indicators when limit utilisations increase significantly or are elevated but do not yet result in limit breaches. Early warning indicators can promote proactive management of risk and help a bank take early actions when warranted to mitigate risk.

Timely, accurate and reliable counterparty infrastructure, data and risk systems are necessary for sound management of CCR, as outlined in and reinforced by Supervisory review process - risk data aggregation and risk reporting SRP36. All aspects of CCR are affected by the quality of the data, systems and aggregation capabilities used by banks to manage their risks. This includes, for example, information collection that feeds into due diligence, the digitisation of key contractual terms governing the adequacy of credit risk mitigants, the risk metrics used to size counterparty exposure, and the information and reporting needs of not only senior management but also traders and credit officers involved in the day-to-day risk management of CCR.

Banks should ensure that the risk systems (eg front office, valuation and booking systems, and risk engines) and data management capabilities underpinning CCR management – including risk measurement and limit monitoring – are commensurate with the size and complexity of counterparty exposures. Systems, models and data management capabilities should be sound and sophisticated enough to support CCR measurement under current and stressed market conditions, and they should be enhanced as the bank’s risk profile evolves and newer sound practices are established.

CCR measurement is a highly involved risk data aggregation process given the complexity of calculations and processes. It is best exemplified by reliance on large internal and external data sets, numerous upstream data systems and platforms, and interdependent models involved in risk measurement. The complexity of these processes requires commensurate capabilities and controls that ensure comprehensive, granular, accurate and timely risk metrics. The inability to produce fit-for-purpose risk metrics that meet these critical data dimensions can have a negative impact on a bank’s ability to effectively measure, monitor and control CCR given the highly dynamic nature of trading book exposures.

Banks should ensure that key risk systems have minimal frictions that would impede comprehensive, accurate and timely risk data aggregation and measurement. Where necessary, they should implement adequate compensating processes and controls, such as data staging platforms to mitigate known shortcomings. Banks should aim to reduce the number of systems involved in exposure measurement and management in order to reduce operational risk. They should allocate adequate resources to implementing the required upgrades to capabilities where deemed necessary, ie commensurate with the business model and risk profile. Banks should maintain capabilities to aggregate and measure risk exposures seamlessly across products, businesses, geographies and risk factors to support concentration monitoring at both the counterparty and portfolio levels.

Banks should ensure that the data management protocols, processes and controls underlying counterparty risk data aggregation and measurement are aligned to enterprise/bank-wide data management frameworks and standards in order to ensure comprehensive, accurate and timely risk monitoring. Banks should have consistent data taxonomies across businesses that align with enterprise classifications to ensure, for instance, that the risk metrics estimated by different systems are aggregated accurately and conservatively. Further, stronger practices entail data issue/incident remediation processes for counterparty risk measurement that are directly linked to bank-wide processes in order to ensure strategic, long-term solutions for system and/or data issues.

Banks should ensure that reporting and oversight routines provide key stakeholders with sufficient information about the overall effectiveness of counterparty risk data aggregation and measurement processes. These insights ultimately ensure that end users of risk metrics and reports – eg credit risk officers and front office traders – make informed risk appetite decisions at the desk, counterparty and portfolio levels. Such decisions include the approval or restriction of new trades and the implementation of risk mitigation or reduction strategies. The socialisation of known and identified issues with stakeholders and/or end users of reports and metrics is critical to maintaining and strengthening risk aggregation and measurement processes, including receiving sufficient resources, ie “buy-in”, to remediate issues and implement system/capabilities upgrades. Material issues and weaknesses should also be escalated to relevant bank-wide technology and data management forums for awareness and effective resolution.

Strong governance practices are grounded in sound preventative, detective and corrective technology and data quality controls that facilitate the identification, monitoring, escalation and remediation of system, data and model issues. Banks should maintain a suite of controls to support counterparty risk data aggregation and measurement, including, for example:

1. robust preventative and detective controls to identify data anomalies for all key or material counterparty risk metrics used to constrain risk-taking at the portfolio, desk and counterparty levels, ie not limited to a select few metrics;
2. key controls that include data reconciliation and variance analysis processes that efficiently build on each other as opposed to creating control redundancies;
3. a robust process to monitor data feed transfer from upstream systems to data staging platforms and risk engines, underpinned by well documented service-level agreements that are strictly enforced and monitored. Data feed management processes and other relevant technology controls are not executed and managed in a silo by a technology and/or operational team, but are instead integrated into counterparty risk measurement governance and control frameworks;
4. a robust process to manually adjust missing or incorrect data identified via technology, data reconciliation and variance analysis, or other detective controls. Banks should have a metrics adjustment process that is well documented and executed through automated capabilities to minimise operational risk. An adjustment process also addresses data issues identified and flagged by upstream data providers;
5. a key performance indicator (KPI) or risk indicator (KRI) framework designed and monitored against outcomes of technology (eg data feed) and data management controls (eg manual adjustments). The framework synthesises control outcomes to facilitate reporting to end users, ie a “scorecard” on the overall effectiveness of the counterparty risk data aggregation and measurement process;
6. material issues and/or critical KPIs, including KPIs tracking the level of manual intervention (ie data adjustments) or data feed timeliness, which are further escalated to senior governance forums with mandates to oversee CCR. Escalation and reporting to bank-wide management risk committees and the chief risk officer in order to facilitate awareness of the extent to which CCR exposure is a key contributor to the bank’s overall risk profile; and
7. forums established for the sole purpose of overseeing the counterparty risk data aggregation and measurement processes. These governance bodies serve as the first escalation point for system, data or model issues affecting the production of portfolio, desk and counterparty level risk metrics. KPI scorecards, issue logs, manual data adjustments etc are all key inputs into ongoing discussions. Participants include system/application owners, model owners, owners of reports/metrics, end users of reports and key upstream data providers.

Counterparty credit risk reporting

Banks should embrace the risk reporting practices set out in SRP36 with respect to their CCR reporting. All principles below should be seen as enhancing these generally formulated risk reporting practices.

Banks should regularly assess the relevance, timeliness and quality of CCR reporting. This should include, but not be limited to, an assessment of input data quality, analysis of comments on potential data anomalies, assessment of the frequency of reporting and ensuring adequate socialisation of reports within key business and oversight functions. Banks should discourage fragmented reporting environments for CCR. If the reporting environment is deemed to be too fragmented, banks should redesign the environment without delay.

Banks should set up risk reporting through appropriate MIS in order to ensure an adequate level of CCR analysis. Adequate reporting includes aggregating the data for each decision level, allowing for aggregation across key risk dimensions and over time periods, and enabling easy data analysis and drilldowns on a timely basis.

Banks should build up MIS so that relevant CCR data are easily retrievable at the risk factor, counterparty and aggregate levels. Banks’ MIS should avoid overwhelming users with data, while allowing for detailed on-request analysis by decision-makers.

Banks should build an MIS for CCR reporting that is user-friendly and intuitive. Each decision-maker should have the ability to analyse data individually, ideally without using tools outside the MIS. Furthermore, banks should consider enabling users to comment on the most relevant CCR measures and store these comments in the MIS. There should be an audit trail of the analysis.

Banks should train their personnel in the operation of the MIS. Each user of the MIS should be able to understand and analyse the data to a level that enables consistent and effective risk reporting.

Sound management of CCR includes banks recognising the need to act quickly based on their contractual ability to close out a counterparty when necessary, with full knowledge of all of the steps needed to initiate, execute and manage residual impacts, including, where applicable, collateral liquidation and risk replacement.

Watch list practices and default management protocol

Banks closing out counterparties should know that the potential costs of such actions can be high. Closeout of counterparties involves business, legal and risk staff carrying out actions properly, as banks serving notice on counterparties should not breach legal provisions in agreements such as the International Swaps and Derivatives Association Master Agreement,12 the related credit support annex (CSA),13 the International Capital Market Association’s Global Master Repurchase Agreement14 or the Global Master Securities Lending Agreement.15 Liquidation of trades invariably leads to the realisation of MTM losses and the need for new replacement trades. The costs to the bank of carrying out a closeout are material and should be known.

Banks should ensure that seasoned professionals familiar with the legal processes for carrying out a declaration of counterparty default are able to initiate closeouts as needed. Involvement from the legal department is critical to carrying out all aspects of a counterparty closeout. The process should have input from credit risk and risk management more broadly. As part of the bank’s ongoing credit monitoring process, independent credit officers should be engaged in regular oversight of counterparties and they should maintain a watch list of any names that require restricted or risk-reducing activity only.

Banks should maintain up-to-date closeout playbooks. They should carry out mock closeout exercises to uncover potential issues in advance of an actual closeout. The mock closeout candidate should be a name that involves more than one legal jurisdiction and, potentially, multiple business lines. The counterparty type should vary from year to year. In the event of a closeout, the bank’s teams should complete a post-mortem exercise following such incidents to compile lessons learned. Any lessons learned should then be used to enhance existing playbooks for such events in the future. The exercise should include participants from credit, finance, legal, operations, risk and trading teams, with the following minimum objectives:

1. All involved parties are identified and have sufficient resources to execute the closeout in parallel with ongoing BAU.
2. Demonstrate that relevant reporting is shared with involved functions in due time and is complete and correct.
3. Closeout governance allows for fast and consistent decision-making by involved management functions, and all decisions taken are in line with internal policies and procedures and are consistent with the legal framework for the affected financial contracts.
4. Trading capabilities that enable the orderly unwinding of positions (including experienced traders, access to capital markets and counterparty limits) are available, and mission-critical payments and securities transfer protocols should be designed with kill switches for manual operation only.

Banks should understand that contractual terms embedded in legal agreements can limit a bank’s ability to reduce or discontinue activity with a counterparty. Closeout provisions should be carefully calibrated based on the bank’s assessment of counterparty credit quality, including control and ownership. Any concession to a counterparty regarding such provisions should be made with awareness of the bank’s need to maintain flexibility in order to avoid the need to declare a counterparty in default.