82_FR_49661 82 FR 49456 - Self-Regulatory Organizations; The Options Clearing Corporation; Notice of Filing of Proposed Rule Change Related to a Comprehensive Risk Management Framework

82 FR 49456 - Self-Regulatory Organizations; The Options Clearing Corporation; Notice of Filing of Proposed Rule Change Related to a Comprehensive Risk Management Framework

SECURITIES AND EXCHANGE COMMISSION

Federal Register Volume 82, Issue 205 (October 25, 2017)

Page Range49456-49462
FR Document2017-23121

Federal Register, Volume 82 Issue 205 (Wednesday, October 25, 2017)
[Federal Register Volume 82, Number 205 (Wednesday, October 25, 2017)]
[Notices]
[Pages 49456-49462]
From the Federal Register Online  [www.thefederalregister.org]
[FR Doc No: 2017-23121]


-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

[Release No. 34-81909; File No. SR-OCC-2017-005]


Self-Regulatory Organizations; The Options Clearing Corporation; 
Notice of Filing of Proposed Rule Change Related to a Comprehensive 
Risk Management Framework

October 19, 2017.
    Pursuant to Section 19(b)(1) of the Securities Exchange Act of 1934 
(``Act''),\1\ and Rule 19b-4 thereunder,\2\ notice is hereby given that 
on October 10, 2017, The Options Clearing Corporation (``OCC'') filed 
with the Securities and Exchange Commission (``Commission'') the 
proposed rule change as described in Items I, II, and III below, which 
Items have been prepared by OCC. The Commission is publishing this 
notice to solicit comments on the proposed rule change from interested 
persons.
---------------------------------------------------------------------------

    \1\ 15 U.S.C. 78s(b)(1).
    \2\ 17 CFR 240.19b-4.
---------------------------------------------------------------------------

I. Clearing Agency's Statement of the Terms of Substance of the 
Proposed Rule Change

    This purpose of the proposed rule change is to adopt a 
comprehensive Risk Management Framework Policy, which would describe 
OCC's framework for comprehensive risk management, including OCC's 
framework to identify, measure, monitor, and manage all risks faced by 
OCC in the provision of clearing, settlement and risk management 
services. The Risk Management Framework Policy is included in 
confidential Exhibit 5 of the filing. The proposed rule change does not 
require any changes to the text of OCC's By-Laws or Rules. All terms 
with initial capitalization that are not otherwise defined herein have 
the same meaning as set forth in the OCC By-Laws and Rules.\3\
---------------------------------------------------------------------------

    \3\ OCC's By-Laws and Rules can be found on OCC's public Web 
site: http://optionsclearing.com/about/publications/bylaws.jsp.
---------------------------------------------------------------------------

II. Clearing Agency's Statement of the Purpose of, and Statutory Basis 
for, the Proposed Rule Change

    In its filing with the Commission, OCC included statements 
concerning the purpose of and basis for the proposed rule change and 
discussed any comments it received on the proposed rule change. The 
text of these statements may be examined at the places specified in 
Item IV below. OCC has prepared summaries, set forth in sections (A), 
(B), and (C) below, of the most significant aspects of these 
statements.

(A) Clearing Agency's Statement of the Purpose of, and Statutory Basis 
for, the Proposed Rule Change

(1) Purpose
Background
    On September 28, 2016, the Commission adopted amendments to Rule 
17Ad-22 \4\ and added new Rule 17Ab2-2 \5\ pursuant to Section 17A of 
the Securities Exchange Act of 1934 (``Exchange Act'') \6\ and the 
Payment, Clearing and Settlement Supervision Act of 2010 (``Clearing 
Supervision Act'') \7\ to establish enhanced standards for the 
operation and governance of those clearing agencies registered with the 
Commission that meet the definition of a ``covered clearing agency,'' 
as defined by Rule 17Ad-22(a)(5) \8\ (collectively, the new and amended 
rules are herein referred to as ``CCA'' rules). The CCA rules require 
that covered clearing agencies, among other things:
---------------------------------------------------------------------------

    \4\ 17 CFR 240.17Ad-22.
    \5\ 17 CFR 240.17Ab2-2.
    \6\ 15 U.S.C. 78q-1.
    \7\ 12 U.S.C. 5461 et seq.
    \8\ 17 CFR 240.17Ad-22(a)(5).

    ``[E]stablish, implement, maintain and enforce written policies 
and procedures reasonably designed to . . . [m]aintain a sound risk 
management framework for comprehensively managing legal, credit, 
liquidity, operational, general business, investment, custody, and 
other risks that arise in or are borne by the covered clearing 
agency, which . . . [i]ncludes risk management policies, procedures, 
and systems designed to identify, measure, monitor, and manage the 
range of risks that arise in or are borne by the covered clearing 
agency, that are subject to review on a specified periodic basis and 
approved by the board of directors annually . . .'' \9\
---------------------------------------------------------------------------

    \9\ 17 CFR 240.17Ad-22(e)(3).

    OCC is defined as a covered clearing agency under the CCA rules, 
and therefore is subject to the requirements of the CCA rules, 
including Rule 17Ad-22(e)(3).\10\ Accordingly, OCC proposes to adopt a 
Risk Management Framework Policy (``RMF''), as described below, to 
formalize and update its overall framework for comprehensively managing 
the Key Risks \11\ that arise in or are borne by OCC to promote 
compliance with Rule 17Ad-22(e)(3).\12\
---------------------------------------------------------------------------

    \10\ Id.
    \11\ Under the proposed RMF, ``Key Risks'' would be defined as 
risks that are related to the foundational aspects of CCP clearing, 
settlement and risk management services.
    \12\ 17 CFR 240.17Ad-22(e)(3).
---------------------------------------------------------------------------

Proposed Policy
    OCC proposes to adopt a new RMF document. The purpose of the RMF is 
to describe OCC's framework for

[[Page 49457]]

comprehensive risk management, including OCC's framework to identify, 
measure, monitor, and manage all risks faced by OCC in the provision of 
clearing, settlement and risk management services. Specifically, the 
RMF would establish the context for OCC's risk management framework, 
outline OCC's risk management philosophy, describe OCC's Risk Appetite 
Framework and use of Risk Tolerances,\13\ describe the governance 
arrangements that implement risk management, outline OCC's 
identification of Key Risks, and describe OCC's program for enterprise-
wide risk management, including the three lines of defense structure 
(discussed below), and describe OCC's approach to risk monitoring, 
assessment and reporting. As a single risk management framework 
addressing risks across all facets of OCC's business, the RMF would 
foster OCC's compliance with the requirements of the CCA rules, and in 
particular the requirement of Rule 17Ad-22(e)(3) \14\ that it maintain 
a sound framework for comprehensively managing risks.
---------------------------------------------------------------------------

    \13\ Under the proposed RMF, ``Risk Tolerances'' would be 
defined as the application of risk appetite to a specific sub-
category or aspect of a Key Risk, typically in quantitative form, 
used to set an acceptable levels of risk.
    \14\ 17 CFR 240.17Ad-22(e)(3).
---------------------------------------------------------------------------

Context of OCC's Risk Management Framework
    The RMF would begin by establishing the context for OCC's risk 
management framework. Specifically, OCC is a Systemically Important 
Financial Market Utility (``SIFMU'') \15\ that serves a critical role 
in financial markets as the sole central counterparty (``CCP'') that 
provides clearance and settlement services for U.S. listed options and 
guarantees the obligations associated with the contracts that it 
clears. As a SIFMU, OCC recognizes its role in promoting financial 
stability for market participants, investors and the economy and that 
it must therefore maintain a sound risk management framework for 
comprehensively managing the risks that it presents.
---------------------------------------------------------------------------

    \15\ The Financial Stability Oversight Council designated OCC a 
SIFMU on July 18, 2012 pursuant to the Clearing Supervision Act. See 
12 U.S.C. 5463.
---------------------------------------------------------------------------

OCC's Risk Management Philosophy
    The proposed RMF would describe OCC's risk management philosophy. 
As a SIFMU, OCC must be mindful of the public interest and its 
obligation to promote financial stability, reduce the potential for 
systemic contagion and support the smooth functioning of the U.S. 
financial markets. Furthermore, as a CCP, OCC concentrates financial 
risks for the markets it serves by acting as the CCP for all of the 
transactions that it clears. As a result of this concentration, OCC's 
primary objective is to ensure that it properly manages the financial 
risks associated with functioning as a CCP, which primarily relate to 
potential clearing member default scenarios.
    As a CCP, OCC's daily operations, among other things, involve 
managing financial, operational and business risks. In managing these 
risks, OCC's daily operations--which are guided by policies, procedures 
and controls--are designed to ensure that financial exposures and 
service disruptions are within acceptable limits set by OCC as part of 
its Risk Appetite Framework (``RAF'') as described below.
Risk Appetite Framework
    The proposed RMF would describe OCC's RAF and use of Risk 
Tolerances. The purpose of the RAF is to establish OCC's overall 
approach to managing risks at the enterprise level in an effective and 
integrated fashion. The RAF establishes the level and types of Key 
Risks, described in further detail below, that OCC is willing and able 
to assume in accordance with OCC's mission as a SIFMU. Under the RAF, 
Risk Appetite Statements \16\ would be used to express OCC's judgment, 
for each of OCC's Key Risks, regarding the level of risk that OCC is 
willing to accept related to the provision of CCP services. These 
statements would be qualitative indications of appetite that set the 
tone for OCC's approach to risk taking, and are indicative of the level 
of resources or effort OCC puts forth to prevent or mitigate the impact 
of a Key Risk.
---------------------------------------------------------------------------

    \16\ Under the proposed RMF, ``Risk Appetite Statement'' would 
be defined as a statement that expresses OCC's judgment, for each of 
OCC's Key Risks, regarding the level of risk OCC is willing to 
accept related to the provision of CCP services.
---------------------------------------------------------------------------

    Under the RMF, Risk Appetite Statements would be set annually by 
each department associated with a Key Risk in cooperation with OCC's 
Enterprise Risk Management department (``ERM'') according to applicable 
procedures. OCC's risk appetite levels would be classified into four 
categories:
    1. No appetite: OCC is unwilling to deliberately accept any level 
of risk.
    2. Low appetite: OCC devotes significant resources to managing risk 
but may choose to accept certain risks that do not materially affect 
core clearing and settlement because the level of resources that OCC 
would be required to put forth to mitigate the risks would be 
impractical.
    3. Moderate appetite: OCC is willing to engage in certain 
activities that pose risks because those activities may bring longer-
term efficiencies or result in business opportunities even though the 
activities or new businesses may pose new risks to OCC.
    4. High appetite: OCC is willing to implement a new high-risk 
process or business opportunity; however, it is unlikely OCC would 
apply this level of appetite to a Key Risk absent a compelling, urgent 
business need.
    Under the RMF, OCC's Board would have ultimate responsibility for 
reviewing and approving the Risk Appetite Statements in connection with 
each Key Risk on an annual basis upon recommendation of OCC's 
Management Committee.
    The Risk Appetite Statements allow OCC to carefully calibrate the 
levels of risk it accepts for each of its Key Risks to be consistent 
with OCC's core mission of promoting financial stability in the markets 
it serves. Accordingly, the RAF helps to ensure that OCC has an 
effective and comprehensive framework for managing its Key Risks (e.g., 
legal, credit, liquidity, operational, general business, investment, 
custody and other risks that arise in or are borne by OCC).\17\
---------------------------------------------------------------------------

    \17\ OCC's Key Risks are described below in the discussion 
covering OCC's identification of its material risks.
---------------------------------------------------------------------------

    In addition to Risk Appetite Statements, the RMF would require that 
OCC assign Risk Tolerances to the Key Risks contained within the RMF as 
approved by OCC's Board. While the Risk Appetite Statements would be 
more high-level and principles-based, Risk Tolerances would 
comparatively be more granular and represent the application of OCC's 
risk appetite to specific sub-categories or aspects of Key Risks. The 
purpose of the proposed Risk Tolerances is to ensure that OCC sets 
acceptable levels of risk within those specified sub-categories of Key 
Risks. Risk Tolerances would be stated in either quantitative or 
qualitative terms, depending on the nature of the risk and OCC's 
ability to measure it.
    Under the RMF, each department would be required to establish Risk 
Tolerances at least annually for sub-categories of Key Risks that are 
within their relevant domains of responsibility and would be 
responsible for managing applicable risks within established tolerance 
levels. ERM staff would monitor Risk Tolerances through quantitative 
metrics, where applicable, and compile such monitoring in a report that 
the Chief Risk Officer shall present to OCC's Management Committee and

[[Page 49458]]

Board (or a committee thereof) at least quarterly. In addition, the RMF 
would require that OCC's Board evaluate its Risk Tolerances at least 
annually, and more frequently if necessary as a result of changes to 
products, processes, market conventions or other changes to OCC's 
material risks.
Identification of Key Risks
    The proposed RMF would identify risks that could affect OCC's 
ability to perform services as expected, and the process for 
identifying such risks would take a broad view to include: (i) Direct 
financial and operational risks that may prevent the smooth functioning 
of CCP services, (ii) reputational risks that could undermine the 
perception of OCC as a sound pillar in the financial market and (iii) 
the risks OCC faces from third parties, such as custodians and 
settlement banks, that are critical to the design and operation of 
OCC's infrastructure and risk management. Identifying Key Risks in this 
manner would facilitate OCC's ability to comprehensively manage the 
legal, credit, liquidity, operational, general business, investment, 
custody and other risks that arise in or are borne by it. Based on this 
identification process, the RMF would define OCC's Key Risks as 
described below.
Financial Risk
    The RMF would indicate that financial risk encompasses many aspects 
of risk at OCC, including the risks that a Clearing Member will be 
unable to meet its obligations when due or that OCC will not maintain 
sufficient financial resources to cover exposures (i.e., credit risk), 
the risk that OCC will not maintain sufficient liquid resources to meet 
its same day and, where appropriate, intraday and multiday settlement 
of payment obligations (i.e., liquidity risk), the risk that OCC will 
incur losses on overnight investments (i.e., investment risk), and the 
risk that financial models are inaccurate (i.e., model risk).
    The proposed RMF would require OCC's credit risk management 
framework to encompass policies and procedures for maintaining 
sufficient prefunded resources in the form of margin and Clearing Fund 
deposits, accepting collateral from participants that is low risk and 
high quality, monitoring the creditworthiness and operational 
reliability of all counterparties, including participants, custodians, 
settlement banks, liquidity providers, and linked financial market 
utilities (``FMUs''), and maintaining a waterfall of resources to be 
used in the event of participant default and a process for replenishing 
resources.
    In addition, the RMF would require OCC's liquidity risk framework 
to encompass sizing liquidity resources to cover liquidity needs in the 
event of the default of the largest Clearing Member Group, forecasting 
daily settlements needs under normal market conditions, maintaining 
liquid resources in the form of cash and committed facilities, 
maintaining a contingency funding plan and periodically reviewing the 
size of liquidity resources, maintaining liquidity resources at 
creditworthy custodians and monitoring the financial and operational 
performance of financial institutions and committed liquidity 
facilities, and investing liquidity resources in safe overnight 
investments or at a Federal Reserve Bank.
    Moreover, the RMF would require OCC to address investment risks by 
maintaining an account at a Federal Reserve Bank, which bears no 
investment risk, and investing funds not held at the Federal Reserve 
Bank in high quality liquid assets. The RMF would also require OCC to 
manage model risk through a model development program, independent 
model validation and strong governance arrangements for the approval of 
new models or models with material changes in accordance with relevant 
policies.
Operational Risk
    The RMF would define operational risk as the risk of disruptions in 
OCC's CCP services due to: (i) Deficiencies in internal controls, 
processes or information systems, (ii) human error or misconduct, or 
(iii) external events or intrusions. The definition of operational risk 
would also cover deficiencies related to information technology 
(``IT''), such as data security and IT systems reliability. To reflect 
the importance OCC assigns to managing IT risks, the RMF would also 
categorize IT risk as a separate Key Risk, discussed below.
    The RMF would also assert that OCC manages operational risks in 
number of ways, including that OCC: (i) Maintains an Enterprise Project 
Management Program that performs initial assessments of proposed 
projects and manages project execution, to ensure that proper oversight 
exists during the initiation, planning, execution and delivery of OCC 
corporate projects, (ii) maintains a Business Continuity Program to 
support continuance of critical services in the event of a catastrophic 
loss of infrastructure and/or staff (including a Crisis Management 
Plan, which outlines OCC's processes for decision-making in crisis or 
emergency circumstances), (iii) maintains a comprehensive third-party 
risk management program which includes requirements for onboarding and 
ongoing monitoring of third parties on which OCC relies (such as 
vendors, settlement banks and FMUs with linkages to OCC) performed by 
various areas of the organization, including National Operations, 
Collateral Services, Credit Risk, and ERM, (iv) provides training and 
development through its Human Resources Department to ensure staff 
maintains and develops the necessary knowledge and skills to perform 
their jobs, and (v) conducts training on business ethics and OCC's Code 
of Conduct.
Operational Risk--Information Technology
    The RMF also would address operational risks specifically related 
to IT as a distinct Key Risk. Operational risk related to IT would be 
defined as the risk that inadequate levels of system functionality, 
confidentiality, integrity, availability, capacity or resiliency for 
systems that support core clearing, settlement or risk management 
services or critical business functions results in disruptions in OCC 
services. In addition to the ways described above that OCC manages 
operational risks generally, the RMF would also provide that OCC 
manages IT operational risks by maintaining a: (i) Quality Standards 
Program, which includes targets that set performance standards for 
systems operations, (ii) cybersecurity program, and (iii) program to 
maintain system functionality and capacity.
Legal Risk
    The RMF would define legal risk as the risk that OCC's by-laws, 
rules, policies and procedures do not provide for a well-founded, 
clear, transparent, and enforceable legal basis for each aspect of its 
activities in all relevant jurisdictions. The RMF would also provide 
that OCC manages legal risk by: (i) Maintaining rules, policies, and 
contracts that are consistent with applicable laws and regulations and 
(ii) maintaining legal agreements that establish counterparty 
obligations regarding the material aspects of its clearing, settlement 
and risk management services, including, but not limited to, settlement 
finality, vendor performance, exchange performance, options exercise 
and cross-margining obligations.
General Business Risk
    The RMF would define general business risk as the risk of any 
potential

[[Page 49459]]

impairment of OCC's financial condition due to declines in its revenue 
or growth in its expenses arising from OCC's administration and 
operation as a business enterprise (as opposed to a participant's 
default), resulting in expenses that exceed revenues and losses that 
must be charged against OCC's capital.
    The RMF would provide that OCC manages general business risk by: 
(i) Maintaining a target capital level of liquid net assets funded by 
equity equal to the greater of six-months' operating expenses or the 
amount sufficient to ensure a recovery or orderly wind-down of OCC's 
operations as set forth in OCC's recovery and wind-down plan, and a 
plan that provides for capital replenishment in the event of non-
default losses in excess of target capital, (ii) maintaining a 
corporate planning program to manage new business activity, and (iii) 
actively managing the public perception of OCC.
Risk Management Governance
    The RMF would describe the governance arrangements through which 
OCC implements its risk management philosophy. These governance 
arrangements would include the responsibilities of the Board, the 
Board's committees and management in establishing and executing OCC's 
risk management framework. These responsibilities are described in 
further detail below.
    The RMF would provide that OCC's risk governance framework follows 
a hierarchical structure that begins with the Board, which has ultimate 
oversight responsibility for OCC's risk management activities. The 
Board performs an oversight role to ensure that OCC is managed and 
operated in a manner consistent with OCC's regulatory responsibilities 
as a SIFMU providing clearance and settlement services. The Board also 
is responsible for ensuring that OCC has governance arrangements that, 
among other things, prioritize the safety and efficiency of OCC through 
the proposed risk management framework. Moreover, under the RMF, the 
Board is responsible for overseeing OCC's risk management policies, 
procedures and systems designed to identify, measure, monitor and 
manage risks consistent within the Risk Appetite Statements and Risk 
Tolerances approved by the Board. The RMF also provides that the Board 
is responsible for overseeing and approving OCC's recovery and orderly 
wind-down plan (consistent with OCC's Board of Directors Charter).
    To carry out these responsibilities, the RMF would indicate that 
the Board has established Committees to assist in overseeing OCC's Key 
Risks. These Committees are: (i) The Audit Committee, (ii) the 
Compensation and Performance Committee, (iii) the Governance and 
Nominating Committee, (iv) the Risk Committee, and (v) the Technology 
Committee. The responsibilities of these committees to manage OCC's Key 
Risks are outlined in their respective committee charters.\18\
---------------------------------------------------------------------------

    \18\ OCC's Board and Board committee charters are available on 
OCC's public Web site: https://www.theocc.com/about/corporate-information/what-is-occ.jsp.
---------------------------------------------------------------------------

    The RMF would also provide that OCC's Management Committee is 
responsible for annually reviewing and approving the RMF--and the Risk 
Appetite Statements and Risk Tolerances established thereunder--and 
recommending further approval thereof to the Board. The Management 
Committee would also review reports related to metrics for assessing 
Risk Tolerances to determine whether OCC's Key Risks are behaving 
within established tolerances and take or recommend action as needed to 
return Key Risks to their appropriate levels and escalate exceptions to 
Risk Tolerances and Risk Appetite Statements to relevant Board 
committees. The Management Committee would also be permitted to 
establish working groups to assist it in the management of Key Risks.
Risk Management Practice
    The RMF would describe OCC's program for enterprise-wide risk 
management. The internal structures for risk management described in 
the proposed RMF are intended to follow programs generally accepted in 
the financial services industry, including the ``three lines of 
defense'' model (i.e., front line employees, enterprise risk/compliance 
functions and internal audit) and a program for internal controls that 
includes risk assessment and reporting.
``Three Lines of Defense''
    To maintain a resilient risk management and internal control 
infrastructure, the RMF would formalize OCC's ``three lines of 
defense'' model, which allows OCC to manage its control infrastructure 
with clarity of ownership and accountability. The first line of defense 
consists of OCC's operational business units, including Financial Risk 
Management, National Operations, technology, legal, regulatory affairs 
and corporate functions such as human resources, finance, accounting 
and project management. The first line is responsible and accountable 
for designing, owning and managing risks by maintaining policies, 
procedures, processes and controls to manage relevant risks. The first 
line would also be responsible and accountable for internal controls 
and implementing corrective action to address control deficiencies.
    The first line is supported and monitored by the second line of 
defense, which consists of the ERM, Compliance, Security Services and 
Model Validation Group functions. The second line is an oversight 
function and is responsible for designing, implementing and maintaining 
an enterprise-wide risk management and compliance program and tools to 
assess and manage risk at the enterprise level. The second line would 
also work with the first line to assess risks and establish policies 
and guidelines, and advise, monitor and report on the first line's 
effectiveness in managing risk and maintaining and operating a 
resilient control infrastructure. The second line reports to OCC's 
Management Committee and Board (or committee thereof) on the first line 
of defense's effectiveness in managing risk and compliance and an 
assessment of whether OCC's services are being delivered within Risk 
Appetite Statements and Risk Tolerances.
    The third line of defense consists of OCC's internal audit 
function. The third line reports to the Audit Committee of the Board 
and is accountable for designing, implementing and maintaining a 
comprehensive audit program that allows senior management and the Board 
to receive independent and objective assurance that the quality of 
OCC's risk management and internal control infrastructure is consistent 
with OCC's risk appetite and Risk Tolerances. The RMF also would 
require that OCC's Internal Audit department maintains a diverse and 
skilled team of professionals with a variety of business, technology 
and audit skills, and perform all of its activities in compliance with 
the Institute of Internal Auditors' standards found in the 
International Professional Practices Framework.
    The three lines of defense model is designed to provide for a 
robust governance structure that distinguishes among the three lines 
involved in the effective and comprehensive management of risk at OCC: 
The functions that own and manage risks, the functions that oversee and 
provide guidance on the management of risks, and the functions that 
provide independent and objective assurance of the robustness and 
appropriateness of risk management and internal controls.

[[Page 49460]]

Risk Assessments
    In furtherance of the three lines of defense model, the RMF would 
provide for risk identification and assessment programs described below 
to identify, measure, and monitor current and emerging risks at OCC. 
Findings or recommendations that result from the assessments would be 
documented, monitored and escalated through the appropriate governance 
according to applicable OCC policies and procedures.
    One such assessment--the Enterprise Risk Assessment--would be 
conducted by OCC's first line of defense in conjunction with ERM. The 
Enterprise Risk Assessment would analyze risks based on: (i) Inherent 
Risk,\19\ (ii) quality of risk management, and (iii) Residual Risk \20\ 
to provide OCC information on the quantity of risk in a certain 
functional area or business area, and provide a mechanism to prioritize 
risk mitigation activities. ERM would use analysis of Residual Risk in 
conjunction with metrics related to Risk Tolerances to develop a risk 
profile and determine whether a Key Risk is within in appetite and 
provide OCC's Management Committee and Board (or committee thereof) 
information on the quantity of risk in a certain functional area or 
business area, which would provide a mechanism to prioritize risk 
mitigation activities.
---------------------------------------------------------------------------

    \19\ Under the Policy, ``Inherent Risk'' would be defined as the 
absolute level of risk exposure posed by a process or activity prior 
to the application of controls or other risk-mitigating factors.
    \20\ Under the Policy, ``Residual Risk'' would be defined as t 
level of risk exposure posed by a process or activity after the 
application of controls or other risk-mitigating factors.
---------------------------------------------------------------------------

    Another such assessment--the Scenario Analysis Program--would be a 
method for identifying risks that may not be otherwise captured in 
OCC's risk statements. ERM, in cooperation with the first line of 
defense, would design simulations of potential disruptions, and 
business unit staff would be able to identify risks that may not have 
been previously uncovered or identify weaknesses in current controls. 
ERM would include potential risks identified through the Scenario 
Analysis Program in its analysis of, and reporting on, the quantity of 
risk within a certain Key Risk and whether the Key Risk is within 
appetite.
    A third assessment--the IT Risk Assessment Program--would be 
conducted by OCC's Security Services department prior to the 
procurement, development, installation, and operation of IT services 
and systems. This assessment would be triggered by certain events that 
may affect the nature or level of IT risks OCC faces, such as 
evaluation or procurement of a new system or technology, changes in OCC 
business processes that affect current services and systems, and the 
emergence of new threats that subvert existing controls and that 
require a new technology mitigation. OCC would also conduct periodic 
assessments.
    A fourth assessment would be conducted by OCC's compliance function 
to identify and measure regulatory compliance risks. The assessment 
would also provide OCC's compliance function with a basis for 
prioritizing testing and training activities.
Risk Reporting
    Under the RMF, ERM would be responsible for completing a review and 
reporting process that provides OCC's Management Committee and Board 
(or committee thereof) with the information necessary to fulfill their 
obligations for risk management and oversight of risk management 
activities, respectively. This reporting would be designed to assist 
OCC's Management Committee and Board (or committee thereof) in 
understanding the most significant risks faced by OCC from a process 
perspective and determining whether Risk Tolerances are being managed 
in accordance with Risk Appetite Statements. On a quarterly basis, ERM 
would provide a risk report with a summary analysis of risk appetite 
and risk profile that includes analysis of Residual Risks from the 
Enterprise Risk Assessment program, reporting on Risk Tolerances and 
recommendations for prioritization of risk mitigation activities. The 
reporting process would indicate procedures for escalation in the event 
of a breach of Risk Tolerance.
Control Activities
    Under the RMF, the Compliance Department would be responsible for 
maintaining an inventory of all business processes and associated 
controls. OCC would also provide guides to assist staff in documenting 
their control activities in a consistent way and periodically conduct 
training on the importance of a strong risk and control environment. In 
addition, on at least an annual basis, the Compliance Department would 
be required to conduct training to assist OCC staff in understanding 
their respective responsibilities in implementing OCC's risk and 
control environment.
(2) Statutory Basis
    Section 17A(b)(3)(F) of the Act \21\ requires, in part, that the 
rules of a clearing agency be designed to promote the prompt and 
accurate clearance and settlement of securities transactions, to assure 
the safeguarding of securities and funds in the custody or control of 
the clearing agency or for which it is responsible, and in general, to 
protect investors and the public interest. As described above, the RMF 
is designed to formalize, clarify, and streamline OCC's overall 
framework for comprehensively managing risks. Specifically, the RMF 
would describe OCCs overall framework for comprehensive risk 
management, including OCC's framework to identify, measure, monitor and 
manage all risks faced by OCC in the provision of clearing, settlement 
and risk management services. In particular, the RMF would establish 
the context for OCC's risk management framework, outline OCC's risk 
management philosophy, describe OCC's Risk Appetite Framework and use 
of Risk Tolerances, describe the governance arrangements that implement 
risk management, outline OCC's identification of Key Risks and describe 
OCC's program for enterprise-wide risk management, including the three 
lines of defense structure and OCC's approach to risk monitoring, 
assessment and reporting.
---------------------------------------------------------------------------

    \21\ 15 U.S.C. 78q-1(b)(3)(F).
---------------------------------------------------------------------------

    The proposed rule change would formalize the risk management 
framework OCC currently employs in a single document and would 
therefore serve as a guide for readers to understand OCC's 
comprehensive framework for managing risk and its universe of risk 
management policies. Moreover, by describing some of the ways that OCC 
manages its risks, the RMF would serve as a basis for the processes, 
policies, procedures and other documents that OCC may develop and 
maintain to facilitate those risk management activities. As a result, 
OCC believes the proposed rule change is designed to promote the prompt 
and accurate clearance and settlement of securities transactions, 
assure the safeguarding of securities and funds in the custody or 
control of the clearing agency or for which it is responsible, and in 
general, to protect investors and the public interest in accordance 
with Section 17A(b)(3)(F) of the Act.\22\
---------------------------------------------------------------------------

    \22\ Id.
---------------------------------------------------------------------------

    Rule 17Ad-22(e)(3) \23\ requires, in part, that a covered clearing 
agency ``establish, implement, maintain and enforce written policies 
and procedures

[[Page 49461]]

reasonably designed to . . . [m]aintain a sound risk management 
framework for comprehensively managing legal, credit, liquidity, 
operational, general business, investment, custody, and other risks 
that arise in or are borne by the covered clearing agency, which . . . 
[i]ncludes risk management policies, procedures, and systems designed 
to identify, measure, monitor, and manage the range of risks that arise 
in or are borne by the covered clearing agency, that are subject to 
review on a specified periodic basis and approved by the board of 
directors annually . . .'' OCC believes that the proposed rule change 
is also consistent with Rule 17Ad-22(e)(3) \24\ because the RMF 
describes OCC's comprehensive framework for identifying, measuring, 
monitoring and managing the risks that arise within OCC or are borne by 
it, including legal, credit, liquidity, operational, general business, 
investment and custody risk. For example, the RMF describes OCC's 
framework for identifying its Key Risks and the relevant policies that 
OCC maintains to address those risks. Moreover, the RMF would establish 
a foundation of OCC's risk management practice by describing OCC's 
enterprise-wide risk management framework. This framework incorporates 
established principles employed across the financial services industry, 
such as the ``three lines of defense'' model for enterprise-wide risk 
management, to ensure that OCC maintains and operates a resilient, 
effective and reliable risk management and internal control 
infrastructure that assures risk management and processing outcomes 
expected by OCC stakeholders. This framework also describes how OCC's 
second line of defense monitors the risks that arise in or are borne by 
OCC through a variety of risk assessment, risk reporting and internal 
control management activities, consistent with the requirements of Rule 
17Ad-22(e)(3).\25\
---------------------------------------------------------------------------

    \23\ 17 CFR 240.17Ad-22(e)(3).
    \24\ Id.
    \25\ Id.
---------------------------------------------------------------------------

    The RMF also describes OCC's RAF and use of Risk Appetite 
Statements and Risk Tolerances to ensure that OCC sets appropriate 
levels and types of Key Risks that OCC is willing and able to assume in 
accordance with OCC's mission as a SIFMU. For example, the use of Risk 
Appetite Statements ensures that OCC can carefully calibrate the levels 
of risk it accepts for each Key Risk in a manner consistent with OCC's 
core mission of promoting financial stability in the markets it serves. 
In addition, the use of Risk Tolerances helps to ensure that OCC sets 
acceptable levels of risk within specified sub-categories of Key Risks, 
and which may also be used to set thresholds for acceptable variability 
in risk levels and to provide clear and transparent escalation triggers 
when the thresholds are breached. As a result, OCC believes the RMF is 
reasonably designed to provide for a sound, comprehensive framework for 
identifying, measuring, monitoring and managing the range of risks that 
arise in or are borne by OCC in a manner consistent with Rule 17Ad-
22(e)(3).\26\
---------------------------------------------------------------------------

    \26\ Id.
---------------------------------------------------------------------------

    The proposed rule change is not inconsistent with the existing 
rules of OCC, including any other rules proposed to be amended.

(B) Clearing Agency's Statement on Burden on Competition

    Section 17A(b)(3)(I) of the Act \27\ requires that the rules of a 
clearing agency not impose any burden on competition not necessary or 
appropriate in furtherance of the purposes of the Act. OCC does not 
believe that the proposed rule change would impact or impose any burden 
on competition. The proposed rule change would formalize the framework 
OCC uses internally to identify, monitor and manage its risks in a more 
transparent and understandable way. While the proposed rule change 
would update OCC's internal risk management framework document, this 
update does not affect Clearing Members' access to OCC's services or 
impose any direct burdens on Clearing Members. Accordingly, the 
proposed rule change would not unfairly inhibit access to OCC's 
services or disadvantage or favor any particular user in relationship 
to another user.
---------------------------------------------------------------------------

    \27\ 15 U.S.C. 78q-1(b)(3)(I).
---------------------------------------------------------------------------

(C) Clearing Agency's Statement on Comments on the Proposed Rule Change 
Received From Members, Participants or Others

    Written comments on the proposed rule change were not and are not 
intended to be solicited with respect to the proposed rule change and 
none have been received.

III. Date of Effectiveness of the Proposed Rule Change and Timing for 
Commission Action

    Within 45 days of the date of publication of this notice in the 
Federal Register or within such longer period up to 90 days (i) as the 
Commission may designate if it finds such longer period to be 
appropriate and publishes its reasons for so finding or (ii) as to 
which the self- regulatory organization consents, the Commission will:
    (A) By order approve or disapprove the proposed rule change, or
    (B) institute proceedings to determine whether the proposed rule 
change should be disapproved.

IV. Solicitation of Comments

    Interested persons are invited to submit written data, views and 
arguments concerning the foregoing, including whether the proposed rule 
change is consistent with the Act. Comments may be submitted by any of 
the following methods:

Electronic Comments

     Use the Commission's Internet comment form (http://www.sec.gov/rules/sro.shtml); or
     Send an email to [email protected]. Please include 
File Number SR-OCC-2017-005 on the subject line.

Paper Comments

     Send paper comments in triplicate to Secretary, Securities 
and Exchange Commission, 100 F Street NE., Washington, DC 20549-1090.

All submissions should refer to File Number SR-OCC-2017-005. This file 
number should be included on the subject line if email is used. To help 
the Commission process and review your comments more efficiently, 
please use only one method. The Commission will post all comments on 
the Commission's Internet Web site (http://www.sec.gov/rules/sro.shtml). Copies of the submission, all subsequent amendments, all 
written statements with respect to the proposed rule change that are 
filed with the Commission, and all written communications relating to 
the proposed rule change between the Commission and any person, other 
than those that may be withheld from the public in accordance with the 
provisions of 5 U.S.C. 552, will be available for Web site viewing and 
printing in the Commission's Public Reference Room, 100 F Street NE., 
Washington, DC 20549, on official business days between the hours of 
10:00 a.m. and 3:00 p.m. Copies of such filing also will be available 
for inspection and copying at the principal office of OCC and on OCC's 
Web site at http://www.theocc.com/components/docs/legal/rules_and_bylaws/sr_occ_17_005.pdf. All comments received will be 
posted without change; the Commission does not edit personal 
identifying information from submissions. You should submit only 
information that you wish to make available publicly. All submissions 
should refer to File

[[Page 49462]]

Number SR-OCC-2017-005 and should be submitted on or before November 
15, 2017.

    For the Commission, by the Division of Trading and Markets, 
pursuant to delegated Authority.\28\
---------------------------------------------------------------------------

    \28\ 17 CFR 200.30-3(a)(12).
---------------------------------------------------------------------------

Eduardo A. Aleman,
Assistant Secretary.
[FR Doc. 2017-23121 Filed 10-24-17; 8:45 am]
 BILLING CODE 8011-01-P



                                                49456                       Federal Register / Vol. 82, No. 205 / Wednesday, October 25, 2017 / Notices

                                                  • Send an email to rule-comments@                       SECURITIES AND EXCHANGE                               (A) Clearing Agency’s Statement of the
                                                sec.gov. Please include File Number SR–                   COMMISSION                                            Purpose of, and Statutory Basis for, the
                                                GEMX–2017–48 on the subject line.                                                                               Proposed Rule Change
                                                                                                          [Release No. 34–81909; File No. SR–OCC–
                                                Paper Comments                                            2017–005]                                             (1) Purpose
                                                                                                                                                                Background
                                                  • Send paper comments in triplicate                     Self-Regulatory Organizations; The
                                                to Brent J. Fields, Secretary, Securities                 Options Clearing Corporation; Notice                     On September 28, 2016, the
                                                and Exchange Commission, 100 F Street                     of Filing of Proposed Rule Change                     Commission adopted amendments to
                                                NE., Washington, DC 20549–1090.                           Related to a Comprehensive Risk                       Rule 17Ad–22 4 and added new Rule
                                                                                                          Management Framework                                  17Ab2–2 5 pursuant to Section 17A of
                                                All submissions should refer to File                                                                            the Securities Exchange Act of 1934
                                                Number SR–GEMX–2017–48. This file                         October 19, 2017.                                     (‘‘Exchange Act’’) 6 and the Payment,
                                                number should be included on the                             Pursuant to Section 19(b)(1) of the                Clearing and Settlement Supervision
                                                subject line if email is used. To help the                Securities Exchange Act of 1934                       Act of 2010 (‘‘Clearing Supervision
                                                                                                          (‘‘Act’’),1 and Rule 19b–4 thereunder,2               Act’’) 7 to establish enhanced standards
                                                Commission process and review your
                                                                                                          notice is hereby given that on October                for the operation and governance of
                                                comments more efficiently, please use
                                                                                                          10, 2017, The Options Clearing                        those clearing agencies registered with
                                                only one method. The Commission will                      Corporation (‘‘OCC’’) filed with the
                                                post all comments on the Commission’s                                                                           the Commission that meet the definition
                                                                                                          Securities and Exchange Commission                    of a ‘‘covered clearing agency,’’ as
                                                Internet Web site (http://www.sec.gov/                    (‘‘Commission’’) the proposed rule
                                                rules/sro.shtml). Copies of the                                                                                 defined by Rule 17Ad–22(a)(5) 8
                                                                                                          change as described in Items I, II, and               (collectively, the new and amended
                                                submission, all subsequent                                III below, which Items have been
                                                amendments, all written statements                                                                              rules are herein referred to as ‘‘CCA’’
                                                                                                          prepared by OCC. The Commission is                    rules). The CCA rules require that
                                                with respect to the proposed rule                         publishing this notice to solicit                     covered clearing agencies, among other
                                                change that are filed with the                            comments on the proposed rule change                  things:
                                                Commission, and all written                               from interested persons.
                                                communications relating to the                                                                                     ‘‘[E]stablish, implement, maintain and
                                                                                                          I. Clearing Agency’s Statement of the                 enforce written policies and procedures
                                                proposed rule change between the                          Terms of Substance of the Proposed                    reasonably designed to . . . [m]aintain a
                                                Commission and any person, other than                     Rule Change                                           sound risk management framework for
                                                those that may be withheld from the                                                                             comprehensively managing legal, credit,
                                                public in accordance with the                                This purpose of the proposed rule                  liquidity, operational, general business,
                                                provisions of 5 U.S.C. 552, will be                       change is to adopt a comprehensive Risk               investment, custody, and other risks that
                                                                                                          Management Framework Policy, which                    arise in or are borne by the covered clearing
                                                available for Web site viewing and
                                                                                                          would describe OCC’s framework for                    agency, which . . . [i]ncludes risk
                                                printing in the Commission’s Public                       comprehensive risk management,                        management policies, procedures, and
                                                Reference Room, 100 F Street NE.,                         including OCC’s framework to identify,                systems designed to identify, measure,
                                                Washington, DC 20549, on official                         measure, monitor, and manage all risks                monitor, and manage the range of risks that
                                                business days between the hours of                                                                              arise in or are borne by the covered clearing
                                                                                                          faced by OCC in the provision of                      agency, that are subject to review on a
                                                10:00 a.m. and 3:00 p.m. Copies of the                    clearing, settlement and risk                         specified periodic basis and approved by the
                                                filing also will be available for                         management services. The Risk                         board of directors annually . . .’’ 9
                                                inspection and copying at the principal                   Management Framework Policy is
                                                office of the Exchange. All comments                      included in confidential Exhibit 5 of the                OCC is defined as a covered clearing
                                                received will be posted without change.                   filing. The proposed rule change does                 agency under the CCA rules, and
                                                Persons submitting comments are                           not require any changes to the text of                therefore is subject to the requirements
                                                                                                          OCC’s By-Laws or Rules. All terms with                of the CCA rules, including Rule 17Ad–
                                                cautioned that we do not redact or edit
                                                                                                          initial capitalization that are not                   22(e)(3).10 Accordingly, OCC proposes
                                                personal identifying information from
                                                                                                          otherwise defined herein have the same                to adopt a Risk Management Framework
                                                comment submissions. You should
                                                                                                          meaning as set forth in the OCC By-                   Policy (‘‘RMF’’), as described below, to
                                                submit only information that you wish                                                                           formalize and update its overall
                                                to make available publicly. All                           Laws and Rules.3
                                                                                                                                                                framework for comprehensively
                                                submissions should refer to File                          II. Clearing Agency’s Statement of the                managing the Key Risks 11 that arise in
                                                Number SR–GEMX–2017–48 and                                Purpose of, and Statutory Basis for, the              or are borne by OCC to promote
                                                should be submitted on or before                          Proposed Rule Change                                  compliance with Rule 17Ad–22(e)(3).12
                                                November 15, 2017.                                           In its filing with the Commission,                 Proposed Policy
                                                  For the Commission, by the Division of                  OCC included statements concerning
                                                Trading and Markets, pursuant to delegated                the purpose of and basis for the                        OCC proposes to adopt a new RMF
                                                authority.15                                              proposed rule change and discussed any                document. The purpose of the RMF is
                                                                                                          comments it received on the proposed                  to describe OCC’s framework for
                                                Eduardo A. Aleman,
                                                Assistant Secretary.                                      rule change. The text of these statements
                                                                                                                                                                  4 17 CFR 240.17Ad–22.
                                                                                                          may be examined at the places specified
                                                [FR Doc. 2017–23117 Filed 10–24–17; 8:45 am]                                                                      5 17 CFR 240.17Ab2–2.
                                                                                                          in Item IV below. OCC has prepared                      6 15 U.S.C. 78q–1.
                                                BILLING CODE 8011–01–P
                                                                                                          summaries, set forth in sections (A), (B),
sradovich on DSK3GMQ082PROD with NOTICES




                                                                                                                                                                  7 12 U.S.C. 5461 et seq.
                                                                                                          and (C) below, of the most significant                  8 17 CFR 240.17Ad–22(a)(5).
                                                                                                          aspects of these statements.                            9 17 CFR 240.17Ad–22(e)(3).
                                                                                                                                                                  10 Id.
                                                                                                            1 15U.S.C. 78s(b)(1).                                 11 Under the proposed RMF, ‘‘Key Risks’’ would
                                                                                                            2 17CFR 240.19b–4.                                  be defined as risks that are related to the
                                                                                                            3 OCC’s By-Laws and Rules can be found on           foundational aspects of CCP clearing, settlement
                                                                                                          OCC’s public Web site: http://optionsclearing.com/    and risk management services.
                                                  15 17   CFR 200.30–3(a)(12).                            about/publications/bylaws.jsp.                          12 17 CFR 240.17Ad–22(e)(3).




                                           VerDate Sep<11>2014     22:06 Oct 24, 2017   Jkt 244001   PO 00000   Frm 00146   Fmt 4703   Sfmt 4703   E:\FR\FM\25OCN1.SGM   25OCN1


                                                                          Federal Register / Vol. 82, No. 205 / Wednesday, October 25, 2017 / Notices                                                   49457

                                                comprehensive risk management,                          a CCP, OCC concentrates financial risks                   3. Moderate appetite: OCC is willing
                                                including OCC’s framework to identify,                  for the markets it serves by acting as the             to engage in certain activities that pose
                                                measure, monitor, and manage all risks                  CCP for all of the transactions that it                risks because those activities may bring
                                                faced by OCC in the provision of                        clears. As a result of this concentration,             longer-term efficiencies or result in
                                                clearing, settlement and risk                           OCC’s primary objective is to ensure                   business opportunities even though the
                                                management services. Specifically, the                  that it properly manages the financial                 activities or new businesses may pose
                                                RMF would establish the context for                     risks associated with functioning as a                 new risks to OCC.
                                                OCC’s risk management framework,                        CCP, which primarily relate to potential                  4. High appetite: OCC is willing to
                                                outline OCC’s risk management                           clearing member default scenarios.                     implement a new high-risk process or
                                                philosophy, describe OCC’s Risk                            As a CCP, OCC’s daily operations,                   business opportunity; however, it is
                                                Appetite Framework and use of Risk                      among other things, involve managing                   unlikely OCC would apply this level of
                                                Tolerances,13 describe the governance                   financial, operational and business                    appetite to a Key Risk absent a
                                                arrangements that implement risk                        risks. In managing these risks, OCC’s                  compelling, urgent business need.
                                                management, outline OCC’s                               daily operations—which are guided by                      Under the RMF, OCC’s Board would
                                                identification of Key Risks, and describe               policies, procedures and controls—are                  have ultimate responsibility for
                                                OCC’s program for enterprise-wide risk                  designed to ensure that financial                      reviewing and approving the Risk
                                                management, including the three lines                   exposures and service disruptions are                  Appetite Statements in connection with
                                                of defense structure (discussed below),                 within acceptable limits set by OCC as                 each Key Risk on an annual basis upon
                                                and describe OCC’s approach to risk                     part of its Risk Appetite Framework                    recommendation of OCC’s Management
                                                monitoring, assessment and reporting.                   (‘‘RAF’’) as described below.                          Committee.
                                                As a single risk management framework                   Risk Appetite Framework                                   The Risk Appetite Statements allow
                                                addressing risks across all facets of                                                                          OCC to carefully calibrate the levels of
                                                                                                           The proposed RMF would describe                     risk it accepts for each of its Key Risks
                                                OCC’s business, the RMF would foster
                                                                                                        OCC’s RAF and use of Risk Tolerances.                  to be consistent with OCC’s core
                                                OCC’s compliance with the
                                                                                                        The purpose of the RAF is to establish                 mission of promoting financial stability
                                                requirements of the CCA rules, and in
                                                                                                        OCC’s overall approach to managing                     in the markets it serves. Accordingly,
                                                particular the requirement of Rule
                                                                                                        risks at the enterprise level in an                    the RAF helps to ensure that OCC has
                                                17Ad–22(e)(3) 14 that it maintain a
                                                                                                        effective and integrated fashion. The                  an effective and comprehensive
                                                sound framework for comprehensively
                                                                                                        RAF establishes the level and types of                 framework for managing its Key Risks
                                                managing risks.
                                                                                                        Key Risks, described in further detail                 (e.g., legal, credit, liquidity, operational,
                                                Context of OCC’s Risk Management                        below, that OCC is willing and able to                 general business, investment, custody
                                                Framework                                               assume in accordance with OCC’s                        and other risks that arise in or are borne
                                                   The RMF would begin by establishing                  mission as a SIFMU. Under the RAF,                     by OCC).17
                                                the context for OCC’s risk management                   Risk Appetite Statements 16 would be                      In addition to Risk Appetite
                                                framework. Specifically, OCC is a                       used to express OCC’s judgment, for                    Statements, the RMF would require that
                                                Systemically Important Financial                        each of OCC’s Key Risks, regarding the                 OCC assign Risk Tolerances to the Key
                                                Market Utility (‘‘SIFMU’’) 15 that serves               level of risk that OCC is willing to                   Risks contained within the RMF as
                                                a critical role in financial markets as the             accept related to the provision of CCP                 approved by OCC’s Board. While the
                                                sole central counterparty (‘‘CCP’’) that                services. These statements would be                    Risk Appetite Statements would be
                                                provides clearance and settlement                       qualitative indications of appetite that               more high-level and principles-based,
                                                                                                        set the tone for OCC’s approach to risk                Risk Tolerances would comparatively be
                                                services for U.S. listed options and
                                                                                                        taking, and are indicative of the level of             more granular and represent the
                                                guarantees the obligations associated
                                                                                                        resources or effort OCC puts forth to                  application of OCC’s risk appetite to
                                                with the contracts that it clears. As a
                                                                                                        prevent or mitigate the impact of a Key                specific sub-categories or aspects of Key
                                                SIFMU, OCC recognizes its role in
                                                                                                        Risk.                                                  Risks. The purpose of the proposed Risk
                                                promoting financial stability for market                   Under the RMF, Risk Appetite
                                                participants, investors and the economy                                                                        Tolerances is to ensure that OCC sets
                                                                                                        Statements would be set annually by
                                                and that it must therefore maintain a                                                                          acceptable levels of risk within those
                                                                                                        each department associated with a Key
                                                sound risk management framework for                                                                            specified sub-categories of Key Risks.
                                                                                                        Risk in cooperation with OCC’s
                                                comprehensively managing the risks                                                                             Risk Tolerances would be stated in
                                                                                                        Enterprise Risk Management
                                                that it presents.                                                                                              either quantitative or qualitative terms,
                                                                                                        department (‘‘ERM’’) according to
                                                                                                                                                               depending on the nature of the risk and
                                                OCC’s Risk Management Philosophy                        applicable procedures. OCC’s risk
                                                                                                                                                               OCC’s ability to measure it.
                                                  The proposed RMF would describe                       appetite levels would be classified into                  Under the RMF, each department
                                                OCC’s risk management philosophy. As                    four categories:                                       would be required to establish Risk
                                                                                                           1. No appetite: OCC is unwilling to
                                                a SIFMU, OCC must be mindful of the                                                                            Tolerances at least annually for sub-
                                                                                                        deliberately accept any level of risk.
                                                public interest and its obligation to                      2. Low appetite: OCC devotes                        categories of Key Risks that are within
                                                promote financial stability, reduce the                 significant resources to managing risk                 their relevant domains of responsibility
                                                potential for systemic contagion and                    but may choose to accept certain risks                 and would be responsible for managing
                                                support the smooth functioning of the                   that do not materially affect core                     applicable risks within established
                                                U.S. financial markets. Furthermore, as                 clearing and settlement because the                    tolerance levels. ERM staff would
                                                                                                        level of resources that OCC would be                   monitor Risk Tolerances through
sradovich on DSK3GMQ082PROD with NOTICES




                                                  13 Under the proposed RMF, ‘‘Risk Tolerances’’
                                                                                                        required to put forth to mitigate the                  quantitative metrics, where applicable,
                                                would be defined as the application of risk appetite                                                           and compile such monitoring in a report
                                                to a specific sub-category or aspect of a Key Risk,     risks would be impractical.
                                                typically in quantitative form, used to set an                                                                 that the Chief Risk Officer shall present
                                                acceptable levels of risk.                                16 Under the proposed RMF, ‘‘Risk Appetite           to OCC’s Management Committee and
                                                  14 17 CFR 240.17Ad–22(e)(3).
                                                                                                        Statement’’ would be defined as a statement that
                                                  15 The Financial Stability Oversight Council          expresses OCC’s judgment, for each of OCC’s Key          17 OCC’s Key Risks are described below in the

                                                designated OCC a SIFMU on July 18, 2012 pursuant        Risks, regarding the level of risk OCC is willing to   discussion covering OCC’s identification of its
                                                to the Clearing Supervision Act. See 12 U.S.C. 5463.    accept related to the provision of CCP services.       material risks.



                                           VerDate Sep<11>2014   22:06 Oct 24, 2017   Jkt 244001   PO 00000   Frm 00147   Fmt 4703   Sfmt 4703   E:\FR\FM\25OCN1.SGM   25OCN1


                                                49458                     Federal Register / Vol. 82, No. 205 / Wednesday, October 25, 2017 / Notices

                                                Board (or a committee thereof) at least                 event of participant default and a                    for decision-making in crisis or
                                                quarterly. In addition, the RMF would                   process for replenishing resources.                   emergency circumstances), (iii)
                                                require that OCC’s Board evaluate its                      In addition, the RMF would require                 maintains a comprehensive third-party
                                                Risk Tolerances at least annually, and                  OCC’s liquidity risk framework to                     risk management program which
                                                more frequently if necessary as a result                encompass sizing liquidity resources to               includes requirements for onboarding
                                                of changes to products, processes,                      cover liquidity needs in the event of the             and ongoing monitoring of third parties
                                                market conventions or other changes to                  default of the largest Clearing Member                on which OCC relies (such as vendors,
                                                OCC’s material risks.                                   Group, forecasting daily settlements                  settlement banks and FMUs with
                                                                                                        needs under normal market conditions,                 linkages to OCC) performed by various
                                                Identification of Key Risks                             maintaining liquid resources in the form              areas of the organization, including
                                                   The proposed RMF would identify                      of cash and committed facilities,                     National Operations, Collateral Services,
                                                risks that could affect OCC’s ability to                maintaining a contingency funding plan                Credit Risk, and ERM, (iv) provides
                                                perform services as expected, and the                   and periodically reviewing the size of                training and development through its
                                                process for identifying such risks would                liquidity resources, maintaining                      Human Resources Department to ensure
                                                take a broad view to include: (i) Direct                liquidity resources at creditworthy                   staff maintains and develops the
                                                financial and operational risks that may                custodians and monitoring the financial               necessary knowledge and skills to
                                                prevent the smooth functioning of CCP                   and operational performance of                        perform their jobs, and (v) conducts
                                                services, (ii) reputational risks that                  financial institutions and committed                  training on business ethics and OCC’s
                                                could undermine the perception of OCC                   liquidity facilities, and investing                   Code of Conduct.
                                                as a sound pillar in the financial market               liquidity resources in safe overnight
                                                                                                        investments or at a Federal Reserve                   Operational Risk—Information
                                                and (iii) the risks OCC faces from third                                                                      Technology
                                                parties, such as custodians and                         Bank.
                                                settlement banks, that are critical to the                 Moreover, the RMF would require                       The RMF also would address
                                                design and operation of OCC’s                           OCC to address investment risks by                    operational risks specifically related to
                                                infrastructure and risk management.                     maintaining an account at a Federal                   IT as a distinct Key Risk. Operational
                                                Identifying Key Risks in this manner                    Reserve Bank, which bears no                          risk related to IT would be defined as
                                                would facilitate OCC’s ability to                       investment risk, and investing funds not              the risk that inadequate levels of system
                                                                                                        held at the Federal Reserve Bank in high              functionality, confidentiality, integrity,
                                                comprehensively manage the legal,
                                                                                                        quality liquid assets. The RMF would                  availability, capacity or resiliency for
                                                credit, liquidity, operational, general
                                                                                                        also require OCC to manage model risk                 systems that support core clearing,
                                                business, investment, custody and other
                                                                                                        through a model development program,                  settlement or risk management services
                                                risks that arise in or are borne by it.
                                                                                                        independent model validation and                      or critical business functions results in
                                                Based on this identification process, the
                                                                                                        strong governance arrangements for the                disruptions in OCC services. In addition
                                                RMF would define OCC’s Key Risks as
                                                                                                        approval of new models or models with                 to the ways described above that OCC
                                                described below.
                                                                                                        material changes in accordance with                   manages operational risks generally, the
                                                Financial Risk                                          relevant policies.                                    RMF would also provide that OCC
                                                                                                        Operational Risk                                      manages IT operational risks by
                                                   The RMF would indicate that
                                                                                                                                                              maintaining a: (i) Quality Standards
                                                financial risk encompasses many                            The RMF would define operational                   Program, which includes targets that set
                                                aspects of risk at OCC, including the                   risk as the risk of disruptions in OCC’s              performance standards for systems
                                                risks that a Clearing Member will be                    CCP services due to: (i) Deficiencies in              operations, (ii) cybersecurity program,
                                                unable to meet its obligations when due                 internal controls, processes or                       and (iii) program to maintain system
                                                or that OCC will not maintain sufficient                information systems, (ii) human error or              functionality and capacity.
                                                financial resources to cover exposures                  misconduct, or (iii) external events or
                                                (i.e., credit risk), the risk that OCC will             intrusions. The definition of operational             Legal Risk
                                                not maintain sufficient liquid resources                risk would also cover deficiencies                       The RMF would define legal risk as
                                                to meet its same day and, where                         related to information technology                     the risk that OCC’s by-laws, rules,
                                                appropriate, intraday and multiday                      (‘‘IT’’), such as data security and IT                policies and procedures do not provide
                                                settlement of payment obligations (i.e.,                systems reliability. To reflect the                   for a well-founded, clear, transparent,
                                                liquidity risk), the risk that OCC will                 importance OCC assigns to managing IT                 and enforceable legal basis for each
                                                incur losses on overnight investments                   risks, the RMF would also categorize IT               aspect of its activities in all relevant
                                                (i.e., investment risk), and the risk that              risk as a separate Key Risk, discussed                jurisdictions. The RMF would also
                                                financial models are inaccurate (i.e.,                  below.                                                provide that OCC manages legal risk by:
                                                model risk).                                               The RMF would also assert that OCC                 (i) Maintaining rules, policies, and
                                                   The proposed RMF would require                       manages operational risks in number of                contracts that are consistent with
                                                OCC’s credit risk management                            ways, including that OCC: (i) Maintains               applicable laws and regulations and (ii)
                                                framework to encompass policies and                     an Enterprise Project Management                      maintaining legal agreements that
                                                procedures for maintaining sufficient                   Program that performs initial                         establish counterparty obligations
                                                prefunded resources in the form of                      assessments of proposed projects and                  regarding the material aspects of its
                                                margin and Clearing Fund deposits,                      manages project execution, to ensure                  clearing, settlement and risk
                                                accepting collateral from participants                  that proper oversight exists during the               management services, including, but not
                                                that is low risk and high quality,                      initiation, planning, execution and
sradovich on DSK3GMQ082PROD with NOTICES




                                                                                                                                                              limited to, settlement finality, vendor
                                                monitoring the creditworthiness and                     delivery of OCC corporate projects, (ii)              performance, exchange performance,
                                                operational reliability of all                          maintains a Business Continuity                       options exercise and cross-margining
                                                counterparties, including participants,                 Program to support continuance of                     obligations.
                                                custodians, settlement banks, liquidity                 critical services in the event of a
                                                providers, and linked financial market                  catastrophic loss of infrastructure and/              General Business Risk
                                                utilities (‘‘FMUs’’), and maintaining a                 or staff (including a Crisis Management                 The RMF would define general
                                                waterfall of resources to be used in the                Plan, which outlines OCC’s processes                  business risk as the risk of any potential


                                           VerDate Sep<11>2014   22:06 Oct 24, 2017   Jkt 244001   PO 00000   Frm 00148   Fmt 4703   Sfmt 4703   E:\FR\FM\25OCN1.SGM   25OCN1


                                                                          Federal Register / Vol. 82, No. 205 / Wednesday, October 25, 2017 / Notices                                            49459

                                                impairment of OCC’s financial                           established Committees to assist in                   designing, owning and managing risks
                                                condition due to declines in its revenue                overseeing OCC’s Key Risks. These                     by maintaining policies, procedures,
                                                or growth in its expenses arising from                  Committees are: (i) The Audit                         processes and controls to manage
                                                OCC’s administration and operation as a                 Committee, (ii) the Compensation and                  relevant risks. The first line would also
                                                business enterprise (as opposed to a                    Performance Committee, (iii) the                      be responsible and accountable for
                                                participant’s default), resulting in                    Governance and Nominating                             internal controls and implementing
                                                expenses that exceed revenues and                       Committee, (iv) the Risk Committee, and               corrective action to address control
                                                losses that must be charged against                     (v) the Technology Committee. The                     deficiencies.
                                                OCC’s capital.                                          responsibilities of these committees to
                                                                                                                                                                 The first line is supported and
                                                   The RMF would provide that OCC                       manage OCC’s Key Risks are outlined in
                                                manages general business risk by: (i)                                                                         monitored by the second line of defense,
                                                                                                        their respective committee charters.18
                                                Maintaining a target capital level of                     The RMF would also provide that                     which consists of the ERM, Compliance,
                                                liquid net assets funded by equity equal                OCC’s Management Committee is                         Security Services and Model Validation
                                                to the greater of six-months’ operating                 responsible for annually reviewing and                Group functions. The second line is an
                                                expenses or the amount sufficient to                    approving the RMF—and the Risk                        oversight function and is responsible for
                                                ensure a recovery or orderly wind-down                  Appetite Statements and Risk                          designing, implementing and
                                                of OCC’s operations as set forth in                     Tolerances established thereunder—and                 maintaining an enterprise-wide risk
                                                OCC’s recovery and wind-down plan,                      recommending further approval thereof                 management and compliance program
                                                and a plan that provides for capital                    to the Board. The Management                          and tools to assess and manage risk at
                                                replenishment in the event of non-                      Committee would also review reports                   the enterprise level. The second line
                                                default losses in excess of target capital,             related to metrics for assessing Risk                 would also work with the first line to
                                                (ii) maintaining a corporate planning                   Tolerances to determine whether OCC’s                 assess risks and establish policies and
                                                program to manage new business                          Key Risks are behaving within                         guidelines, and advise, monitor and
                                                activity, and (iii) actively managing the               established tolerances and take or                    report on the first line’s effectiveness in
                                                public perception of OCC.                               recommend action as needed to return                  managing risk and maintaining and
                                                                                                        Key Risks to their appropriate levels and             operating a resilient control
                                                Risk Management Governance                                                                                    infrastructure. The second line reports
                                                                                                        escalate exceptions to Risk Tolerances
                                                   The RMF would describe the                           and Risk Appetite Statements to                       to OCC’s Management Committee and
                                                governance arrangements through                         relevant Board committees. The                        Board (or committee thereof) on the first
                                                which OCC implements its risk                           Management Committee would also be                    line of defense’s effectiveness in
                                                management philosophy. These                            permitted to establish working groups to              managing risk and compliance and an
                                                governance arrangements would include                   assist it in the management of Key                    assessment of whether OCC’s services
                                                the responsibilities of the Board, the                  Risks.                                                are being delivered within Risk Appetite
                                                Board’s committees and management in                                                                          Statements and Risk Tolerances.
                                                establishing and executing OCC’s risk                   Risk Management Practice
                                                                                                                                                                 The third line of defense consists of
                                                management framework. These                                The RMF would describe OCC’s
                                                                                                                                                              OCC’s internal audit function. The third
                                                responsibilities are described in further               program for enterprise-wide risk
                                                                                                                                                              line reports to the Audit Committee of
                                                detail below.                                           management. The internal structures for
                                                   The RMF would provide that OCC’s                                                                           the Board and is accountable for
                                                                                                        risk management described in the
                                                risk governance framework follows a                                                                           designing, implementing and
                                                                                                        proposed RMF are intended to follow
                                                hierarchical structure that begins with                                                                       maintaining a comprehensive audit
                                                                                                        programs generally accepted in the
                                                the Board, which has ultimate oversight                                                                       program that allows senior management
                                                                                                        financial services industry, including
                                                responsibility for OCC’s risk                                                                                 and the Board to receive independent
                                                                                                        the ‘‘three lines of defense’’ model (i.e.,
                                                management activities. The Board                                                                              and objective assurance that the quality
                                                                                                        front line employees, enterprise risk/
                                                performs an oversight role to ensure that               compliance functions and internal                     of OCC’s risk management and internal
                                                OCC is managed and operated in a                        audit) and a program for internal                     control infrastructure is consistent with
                                                manner consistent with OCC’s                            controls that includes risk assessment                OCC’s risk appetite and Risk Tolerances.
                                                regulatory responsibilities as a SIFMU                  and reporting.                                        The RMF also would require that OCC’s
                                                providing clearance and settlement                                                                            Internal Audit department maintains a
                                                                                                        ‘‘Three Lines of Defense’’                            diverse and skilled team of
                                                services. The Board also is responsible
                                                for ensuring that OCC has governance                       To maintain a resilient risk                       professionals with a variety of business,
                                                arrangements that, among other things,                  management and internal control                       technology and audit skills, and perform
                                                prioritize the safety and efficiency of                 infrastructure, the RMF would formalize               all of its activities in compliance with
                                                OCC through the proposed risk                           OCC’s ‘‘three lines of defense’’ model,               the Institute of Internal Auditors’
                                                management framework. Moreover,                         which allows OCC to manage its control                standards found in the International
                                                under the RMF, the Board is responsible                 infrastructure with clarity of ownership              Professional Practices Framework.
                                                for overseeing OCC’s risk management                    and accountability. The first line of                    The three lines of defense model is
                                                policies, procedures and systems                        defense consists of OCC’s operational                 designed to provide for a robust
                                                designed to identify, measure, monitor                  business units, including Financial Risk              governance structure that distinguishes
                                                and manage risks consistent within the                  Management, National Operations,                      among the three lines involved in the
                                                Risk Appetite Statements and Risk                       technology, legal, regulatory affairs and             effective and comprehensive
                                                                                                        corporate functions such as human                     management of risk at OCC: The
sradovich on DSK3GMQ082PROD with NOTICES




                                                Tolerances approved by the Board. The
                                                RMF also provides that the Board is                     resources, finance, accounting and                    functions that own and manage risks,
                                                responsible for overseeing and                          project management. The first line is                 the functions that oversee and provide
                                                approving OCC’s recovery and orderly                    responsible and accountable for                       guidance on the management of risks,
                                                wind-down plan (consistent with OCC’s                                                                         and the functions that provide
                                                                                                          18 OCC’s Board and Board committee charters are
                                                Board of Directors Charter).                            available on OCC’s public Web site: https://
                                                                                                                                                              independent and objective assurance of
                                                   To carry out these responsibilities, the             www.theocc.com/about/corporate-information/           the robustness and appropriateness of
                                                RMF would indicate that the Board has                   what-is-occ.jsp.                                      risk management and internal controls.


                                           VerDate Sep<11>2014   22:06 Oct 24, 2017   Jkt 244001   PO 00000   Frm 00149   Fmt 4703   Sfmt 4703   E:\FR\FM\25OCN1.SGM   25OCN1


                                                49460                      Federal Register / Vol. 82, No. 205 / Wednesday, October 25, 2017 / Notices

                                                Risk Assessments                                        or level of IT risks OCC faces, such as               (2) Statutory Basis
                                                   In furtherance of the three lines of                 evaluation or procurement of a new                       Section 17A(b)(3)(F) of the Act 21
                                                defense model, the RMF would provide                    system or technology, changes in OCC                  requires, in part, that the rules of a
                                                for risk identification and assessment                  business processes that affect current                clearing agency be designed to promote
                                                programs described below to identify,                   services and systems, and the                         the prompt and accurate clearance and
                                                measure, and monitor current and                        emergence of new threats that subvert                 settlement of securities transactions, to
                                                emerging risks at OCC. Findings or                      existing controls and that require a new              assure the safeguarding of securities and
                                                recommendations that result from the                    technology mitigation. OCC would also                 funds in the custody or control of the
                                                assessments would be documented,                        conduct periodic assessments.                         clearing agency or for which it is
                                                monitored and escalated through the                       A fourth assessment would be                        responsible, and in general, to protect
                                                appropriate governance according to                                                                           investors and the public interest. As
                                                                                                        conducted by OCC’s compliance
                                                applicable OCC policies and                                                                                   described above, the RMF is designed to
                                                                                                        function to identify and measure
                                                procedures.                                                                                                   formalize, clarify, and streamline OCC’s
                                                   One such assessment—the Enterprise                   regulatory compliance risks. The                      overall framework for comprehensively
                                                Risk Assessment—would be conducted                      assessment would also provide OCC’s                   managing risks. Specifically, the RMF
                                                by OCC’s first line of defense in                       compliance function with a basis for                  would describe OCCs overall framework
                                                conjunction with ERM. The Enterprise                    prioritizing testing and training                     for comprehensive risk management,
                                                Risk Assessment would analyze risks                     activities.                                           including OCC’s framework to identify,
                                                based on: (i) Inherent Risk,19 (ii) quality             Risk Reporting                                        measure, monitor and manage all risks
                                                of risk management, and (iii) Residual                                                                        faced by OCC in the provision of
                                                Risk 20 to provide OCC information on                      Under the RMF, ERM would be                        clearing, settlement and risk
                                                the quantity of risk in a certain                       responsible for completing a review and               management services. In particular, the
                                                functional area or business area, and                   reporting process that provides OCC’s                 RMF would establish the context for
                                                provide a mechanism to prioritize risk                  Management Committee and Board (or                    OCC’s risk management framework,
                                                mitigation activities. ERM would use                    committee thereof) with the information               outline OCC’s risk management
                                                analysis of Residual Risk in conjunction                necessary to fulfill their obligations for            philosophy, describe OCC’s Risk
                                                with metrics related to Risk Tolerances                                                                       Appetite Framework and use of Risk
                                                                                                        risk management and oversight of risk
                                                to develop a risk profile and determine                                                                       Tolerances, describe the governance
                                                                                                        management activities, respectively.
                                                whether a Key Risk is within in appetite                                                                      arrangements that implement risk
                                                and provide OCC’s Management                            This reporting would be designed to
                                                                                                                                                              management, outline OCC’s
                                                Committee and Board (or committee                       assist OCC’s Management Committee                     identification of Key Risks and describe
                                                thereof) information on the quantity of                 and Board (or committee thereof) in                   OCC’s program for enterprise-wide risk
                                                risk in a certain functional area or                    understanding the most significant risks              management, including the three lines
                                                business area, which would provide a                    faced by OCC from a process                           of defense structure and OCC’s
                                                mechanism to prioritize risk mitigation                 perspective and determining whether                   approach to risk monitoring, assessment
                                                activities.                                             Risk Tolerances are being managed in                  and reporting.
                                                   Another such assessment—the                          accordance with Risk Appetite                            The proposed rule change would
                                                Scenario Analysis Program—would be a                    Statements. On a quarterly basis, ERM                 formalize the risk management
                                                method for identifying risks that may                   would provide a risk report with a                    framework OCC currently employs in a
                                                not be otherwise captured in OCC’s risk                 summary analysis of risk appetite and                 single document and would therefore
                                                statements. ERM, in cooperation with                    risk profile that includes analysis of                serve as a guide for readers to
                                                the first line of defense, would design                 Residual Risks from the Enterprise Risk               understand OCC’s comprehensive
                                                simulations of potential disruptions,                   Assessment program, reporting on Risk                 framework for managing risk and its
                                                and business unit staff would be able to                Tolerances and recommendations for                    universe of risk management policies.
                                                identify risks that may not have been                   prioritization of risk mitigation                     Moreover, by describing some of the
                                                previously uncovered or identify                        activities. The reporting process would               ways that OCC manages its risks, the
                                                weaknesses in current controls. ERM                                                                           RMF would serve as a basis for the
                                                                                                        indicate procedures for escalation in the
                                                would include potential risks identified                                                                      processes, policies, procedures and
                                                through the Scenario Analysis Program                   event of a breach of Risk Tolerance.
                                                                                                                                                              other documents that OCC may develop
                                                in its analysis of, and reporting on, the               Control Activities                                    and maintain to facilitate those risk
                                                quantity of risk within a certain Key                                                                         management activities. As a result, OCC
                                                Risk and whether the Key Risk is within                    Under the RMF, the Compliance                      believes the proposed rule change is
                                                appetite.                                               Department would be responsible for                   designed to promote the prompt and
                                                   A third assessment—the IT Risk                       maintaining an inventory of all business              accurate clearance and settlement of
                                                Assessment Program—would be                             processes and associated controls. OCC                securities transactions, assure the
                                                conducted by OCC’s Security Services                    would also provide guides to assist staff             safeguarding of securities and funds in
                                                department prior to the procurement,                    in documenting their control activities               the custody or control of the clearing
                                                development, installation, and                          in a consistent way and periodically                  agency or for which it is responsible,
                                                operation of IT services and systems.                   conduct training on the importance of a               and in general, to protect investors and
                                                This assessment would be triggered by                   strong risk and control environment. In               the public interest in accordance with
                                                certain events that may affect the nature               addition, on at least an annual basis, the            Section 17A(b)(3)(F) of the Act.22
sradovich on DSK3GMQ082PROD with NOTICES




                                                                                                        Compliance Department would be                           Rule 17Ad–22(e)(3) 23 requires, in
                                                  19 Under the Policy, ‘‘Inherent Risk’’ would be
                                                                                                        required to conduct training to assist                part, that a covered clearing agency
                                                defined as the absolute level of risk exposure posed                                                          ‘‘establish, implement, maintain and
                                                by a process or activity prior to the application of    OCC staff in understanding their
                                                controls or other risk-mitigating factors.                                                                    enforce written policies and procedures
                                                                                                        respective responsibilities in
                                                  20 Under the Policy, ‘‘Residual Risk’’ would be
                                                                                                        implementing OCC’s risk and control                     21 15    U.S.C. 78q–1(b)(3)(F).
                                                defined as t level of risk exposure posed by a
                                                process or activity after the application of controls   environment.                                            22 Id.

                                                or other risk-mitigating factors.                                                                               23 17    CFR 240.17Ad–22(e)(3).



                                           VerDate Sep<11>2014   22:06 Oct 24, 2017   Jkt 244001   PO 00000   Frm 00150   Fmt 4703   Sfmt 4703   E:\FR\FM\25OCN1.SGM     25OCN1


                                                                          Federal Register / Vol. 82, No. 205 / Wednesday, October 25, 2017 / Notices                                              49461

                                                reasonably designed to . . . [m]aintain a               categories of Key Risks, and which may                   the self- regulatory organization
                                                sound risk management framework for                     also be used to set thresholds for                       consents, the Commission will:
                                                comprehensively managing legal, credit,                 acceptable variability in risk levels and                  (A) By order approve or disapprove
                                                liquidity, operational, general business,               to provide clear and transparent                         the proposed rule change, or
                                                investment, custody, and other risks                    escalation triggers when the thresholds                    (B) institute proceedings to determine
                                                that arise in or are borne by the covered               are breached. As a result, OCC believes                  whether the proposed rule change
                                                clearing agency, which . . . [i]ncludes                 the RMF is reasonably designed to                        should be disapproved.
                                                risk management policies, procedures,                   provide for a sound, comprehensive                       IV. Solicitation of Comments
                                                and systems designed to identify,                       framework for identifying, measuring,
                                                measure, monitor, and manage the range                  monitoring and managing the range of                       Interested persons are invited to
                                                of risks that arise in or are borne by the              risks that arise in or are borne by OCC                  submit written data, views and
                                                covered clearing agency, that are subject               in a manner consistent with Rule 17Ad–                   arguments concerning the foregoing,
                                                to review on a specified periodic basis                 22(e)(3).26                                              including whether the proposed rule
                                                and approved by the board of directors                                                                           change is consistent with the Act.
                                                                                                           The proposed rule change is not                       Comments may be submitted by any of
                                                annually . . .’’ OCC believes that the                  inconsistent with the existing rules of
                                                proposed rule change is also consistent                                                                          the following methods:
                                                                                                        OCC, including any other rules
                                                with Rule 17Ad–22(e)(3) 24 because the                  proposed to be amended.                                  Electronic Comments
                                                RMF describes OCC’s comprehensive
                                                                                                        (B) Clearing Agency’s Statement on                         • Use the Commission’s Internet
                                                framework for identifying, measuring,
                                                                                                        Burden on Competition                                    comment form (http://www.sec.gov/
                                                monitoring and managing the risks that
                                                arise within OCC or are borne by it,                                                                             rules/sro.shtml); or
                                                                                                           Section 17A(b)(3)(I) of the Act 27                      • Send an email to rule-comments@
                                                including legal, credit, liquidity,                     requires that the rules of a clearing                    sec.gov. Please include File Number SR–
                                                operational, general business,                          agency not impose any burden on                          OCC–2017–005 on the subject line.
                                                investment and custody risk. For                        competition not necessary or
                                                example, the RMF describes OCC’s                        appropriate in furtherance of the                        Paper Comments
                                                framework for identifying its Key Risks                 purposes of the Act. OCC does not                           • Send paper comments in triplicate
                                                and the relevant policies that OCC                      believe that the proposed rule change                    to Secretary, Securities and Exchange
                                                maintains to address those risks.                       would impact or impose any burden on                     Commission, 100 F Street NE.,
                                                Moreover, the RMF would establish a                     competition. The proposed rule change                    Washington, DC 20549–1090.
                                                foundation of OCC’s risk management                     would formalize the framework OCC                        All submissions should refer to File
                                                practice by describing OCC’s enterprise-
                                                                                                        uses internally to identify, monitor and                 Number SR–OCC–2017–005. This file
                                                wide risk management framework. This
                                                                                                        manage its risks in a more transparent                   number should be included on the
                                                framework incorporates established
                                                                                                        and understandable way. While the                        subject line if email is used. To help the
                                                principles employed across the financial
                                                                                                        proposed rule change would update                        Commission process and review your
                                                services industry, such as the ‘‘three
                                                                                                        OCC’s internal risk management                           comments more efficiently, please use
                                                lines of defense’’ model for enterprise-
                                                                                                        framework document, this update does                     only one method. The Commission will
                                                wide risk management, to ensure that
                                                                                                        not affect Clearing Members’ access to                   post all comments on the Commission’s
                                                OCC maintains and operates a resilient,
                                                                                                        OCC’s services or impose any direct                      Internet Web site (http://www.sec.gov/
                                                effective and reliable risk management
                                                                                                        burdens on Clearing Members.                             rules/sro.shtml). Copies of the
                                                and internal control infrastructure that
                                                assures risk management and processing                  Accordingly, the proposed rule change                    submission, all subsequent
                                                outcomes expected by OCC                                would not unfairly inhibit access to                     amendments, all written statements
                                                stakeholders. This framework also                       OCC’s services or disadvantage or favor                  with respect to the proposed rule
                                                describes how OCC’s second line of                      any particular user in relationship to                   change that are filed with the
                                                defense monitors the risks that arise in                another user.                                            Commission, and all written
                                                or are borne by OCC through a variety                                                                            communications relating to the
                                                                                                        (C) Clearing Agency’s Statement on
                                                of risk assessment, risk reporting and                                                                           proposed rule change between the
                                                                                                        Comments on the Proposed Rule
                                                internal control management activities,                                                                          Commission and any person, other than
                                                                                                        Change Received From Members,
                                                consistent with the requirements of Rule                                                                         those that may be withheld from the
                                                                                                        Participants or Others
                                                17Ad–22(e)(3).25                                                                                                 public in accordance with the
                                                   The RMF also describes OCC’s RAF                       Written comments on the proposed                       provisions of 5 U.S.C. 552, will be
                                                and use of Risk Appetite Statements and                 rule change were not and are not                         available for Web site viewing and
                                                Risk Tolerances to ensure that OCC sets                 intended to be solicited with respect to                 printing in the Commission’s Public
                                                appropriate levels and types of Key                     the proposed rule change and none have                   Reference Room, 100 F Street NE.,
                                                Risks that OCC is willing and able to                   been received.                                           Washington, DC 20549, on official
                                                assume in accordance with OCC’s                                                                                  business days between the hours of
                                                                                                        III. Date of Effectiveness of the
                                                mission as a SIFMU. For example, the                                                                             10:00 a.m. and 3:00 p.m. Copies of such
                                                                                                        Proposed Rule Change and Timing for
                                                use of Risk Appetite Statements ensures                                                                          filing also will be available for
                                                                                                        Commission Action
                                                that OCC can carefully calibrate the                                                                             inspection and copying at the principal
                                                levels of risk it accepts for each Key                    Within 45 days of the date of                          office of OCC and on OCC’s Web site at
                                                Risk in a manner consistent with OCC’s                  publication of this notice in the Federal                http://www.theocc.com/components/
                                                                                                        Register or within such longer period                    docs/legal/rules_and_bylaws/sr_occ_17_
sradovich on DSK3GMQ082PROD with NOTICES




                                                core mission of promoting financial
                                                stability in the markets it serves. In                  up to 90 days (i) as the Commission may                  005.pdf. All comments received will be
                                                addition, the use of Risk Tolerances                    designate if it finds such longer period                 posted without change; the Commission
                                                helps to ensure that OCC sets acceptable                to be appropriate and publishes its                      does not edit personal identifying
                                                levels of risk within specified sub-                    reasons for so finding or (ii) as to which               information from submissions. You
                                                                                                                                                                 should submit only information that
                                                  24 Id.                                                  26 Id.                                                 you wish to make available publicly. All
                                                  25 Id.                                                  27 15    U.S.C. 78q–1(b)(3)(I).                        submissions should refer to File


                                           VerDate Sep<11>2014   22:06 Oct 24, 2017   Jkt 244001   PO 00000   Frm 00151     Fmt 4703    Sfmt 4703   E:\FR\FM\25OCN1.SGM   25OCN1


                                                49462                       Federal Register / Vol. 82, No. 205 / Wednesday, October 25, 2017 / Notices

                                                Number SR–OCC–2017–005 and should                         (Catalog of Federal Domestic Assistance               ACTION:   Notice of Social Security Ruling
                                                be submitted on or before November 15,                    Number 59008)                                         (SSR).
                                                2017.                                                     James E. Rivera,
                                                                                                                                                                SUMMARY:    We are republishing SSR 16–
                                                  For the Commission, by the Division of                  Associate Administrator for Disaster                  3p, a ruling that rescinded and
                                                Trading and Markets, pursuant to delegated                Assistance.
                                                Authority.28                                                                                                    superseded SSR 96–7p, with a revision
                                                                                                          [FR Doc. 2017–23181 Filed 10–24–17; 8:45 am]
                                                                                                                                                                detailing how we apply the SSR as it
                                                Eduardo A. Aleman,                                        BILLING CODE 8025–01–P                                relates to the applicable date. We
                                                Assistant Secretary.
                                                                                                                                                                changed our terminology from ‘‘effective
                                                [FR Doc. 2017–23121 Filed 10–24–17; 8:45 am]                                                                    date’’ to ‘‘applicable date’’ based on
                                                                                                          SMALL BUSINESS ADMINISTRATION
                                                BILLING CODE 8011–01–P                                                                                          guidance from the Office of the Federal
                                                                                                          [Disaster Declaration #15274 and #15275;              Register. We also updated citations to
                                                                                                          Texas Disaster Number TX–00487]                       reflect the revised regulations that
                                                SMALL BUSINESS ADMINISTRATION                                                                                   became effective on March 27, 2017.
                                                                                                          Presidential Declaration Amendment of                 This Ruling is otherwise unchanged,
                                                [Disaster Declaration #15338 and #15339;                  a Major Disaster for the State of Texas
                                                Georgia Disaster Number GA–00101]                                                                               and provides guidance about how we
                                                                                                          AGENCY: U.S. Small Business                           evaluate statements regarding the
                                                Presidential Declaration Amendment of                     Administration.                                       intensity, persistence, and limiting
                                                a Major Disaster for Public Assistance                    ACTION: Amendment 7.                                  effects of symptoms in disability claims
                                                Only for the State of Georgia                                                                                   under Titles II and XVI of the Social
                                                                                                          SUMMARY:    This is an amendment of the               Security Act (Act) and blindness claims
                                                AGENCY: U.S. Small Business                               Presidential declaration of a major                   under Title XVI of the Act.
                                                Administration.                                           disaster for the State of Texas (FEMA–                FOR FURTHER INFORMATION CONTACT:
                                                ACTION: Amendment 2.                                      4332–DR), dated 08/25/2017.                           Elaine Tocco, Office of Disability Policy,
                                                                                                            Incident: Hurricane Harvey.                         Social Security Administration, 6401
                                                SUMMARY:   This is an amendment of the                      Incident Period: 08/23/2017 through
                                                Presidential declaration of a major                                                                             Security Boulevard, Baltimore, MD
                                                                                                          09/15/2017.
                                                disaster for Public Assistance Only for                                                                         21235–6401, (410) 966–6356. For
                                                                                                          DATES: Issued on 10/19/2017.
                                                the State of Georgia (FEMA–4338–DR),                                                                            information on eligibility or filing for
                                                                                                            Physical Loan Application Deadline
                                                dated 09/28/2017.                                                                                               benefits, call our national toll-free
                                                                                                          Date: 11/24/2017.
                                                   Incident: Hurricane Irma.                                Economic Injury (EIDL) Loan                         number, 1–800–772–1213 or TTY 1–
                                                   Incident Period: 09/07/2017 through                    Application Deadline Date: 05/25/2018.                800–325–0778, or visit our internet site,
                                                09/20/2017.                                                                                                     Social Security Online, at http://
                                                                                                          ADDRESSES: Submit completed loan
                                                                                                                                                                www.socialsecurity.gov.
                                                DATES: Issued on 10/18/2017.                              applications to: U.S. Small Business
                                                   Physical Loan Application Deadline                     Administration, Processing and                        SUPPLEMENTARY INFORMATION:      Although
                                                Date: 11/27/2017.                                         Disbursement Center, 14925 Kingsport                  5 U.S.C. 552(a)(1) and (a)(2) do not
                                                   Economic Injury (EIDL) Loan                            Road, Fort Worth, TX 76155.                           require us to publish this SSR, we are
                                                Application Deadline Date: 06/28/2018.                    FOR FURTHER INFORMATION CONTACT: A.                   doing so in accordance with 20 CFR
                                                ADDRESSES: Submit completed loan                          Escobar, Office of Disaster Assistance,               402.35(b)(1).
                                                applications to: U.S. Small Business                      U.S. Small Business Administration,                      Through SSRs, we convey to the
                                                Administration, Processing and                            409 3rd Street SW., Suite 6050,                       public SSA precedential decisions
                                                Disbursement Center, 14925 Kingsport                      Washington, DC 20416, (202) 205–6734.                 relating to the Federal old age,
                                                Road, Fort Worth, TX 76155.                               SUPPLEMENTARY INFORMATION: The notice
                                                                                                                                                                survivors, disability, supplemental
                                                FOR FURTHER INFORMATION CONTACT:                          of the President’s major disaster                     security income, and special veterans
                                                Alan Escobar, Office of Disaster                          declaration for the State of Texas, dated             benefits programs. We may base SSRs
                                                Assistance, U.S. Small Business                           08/25/2017, is hereby amended to                      on determinations or decisions made at
                                                Administration, 409 3rd Street SW.,                       extend the deadline for filing                        all levels of administrative adjudication,
                                                Suite 6050, Washington, DC 20416,                         applications for physical damages as a                Federal court decisions, Commissioner’s
                                                (202) 205–6734.                                           result of this disaster to 11/24/2017.                decisions, opinions of the Office of the
                                                                                                            All other information in the original               General Counsel, or other
                                                SUPPLEMENTARY INFORMATION: The notice
                                                                                                          declaration remains unchanged.                        interpretations of the law and
                                                of the President’s major disaster                                                                               regulations.
                                                declaration for Private Non-Profit                        (Catalog of Federal Domestic Assistance                  Although SSRs do not have the same
                                                organizations in the State of Georgia,                    Number 59008)
                                                                                                                                                                force and effect as statutes or
                                                dated 09/28/2017, is hereby amended to                    James E. Rivera,                                      regulations, they are binding on all
                                                include the following areas as adversely                  Associate Administrator for Disaster                  components of the Social Security
                                                affected by the disaster.                                 Assistance.                                           Administration. 20 CFR 402.35(b)(1).
                                                Primary Counties: Bibb, Chattahoochee,                    [FR Doc. 2017–23183 Filed 10–24–17; 8:45 am]             This SSR will remain in effect until
                                                     Clarke, Clinch, Decatur, Dodge,                      BILLING CODE 8025–01–P                                we publish a notice in the Federal
                                                     Dooly, Glascock, Grady, Gwinnett,                                                                          Register that rescinds it, or we publish
                                                     Heard, Henry, Jefferson, Lanier, Lee,                                                                      a new SSR that replaces or modifies it.
                                                     McDuffie, Mitchell, Pulaski,                                                                                  This SSR, republished in its entirety,
sradovich on DSK3GMQ082PROD with NOTICES




                                                                                                          SOCIAL SECURITY ADMINISTRATION
                                                     Stewart, Sumter, Terrell, Thomas,                                                                          includes a revision to clarify that our
                                                     Towns, Twiggs, Union, Upson,                         [Docket No. SSA–2015–0055]                            adjudicators will apply SSR 16–3p
                                                     Webster, White, Wilkinson                                                                                  when we make determinations and
                                                                                                          Social Security Ruling 16–3p Titles II
                                                   All other information in the original                                                                        decisions on or after March 28, 2016.
                                                                                                          And XVI: Evaluation Of Symptoms In
                                                declaration remains unchanged.                                                                                  When a Federal court reviews our final
                                                                                                          Disability Claims
                                                                                                                                                                decision in a claim, we also explain that
                                                  28 17   CFR 200.30–3(a)(12).                            AGENCY:    Social Security Administration.            we expect the court to review the final


                                           VerDate Sep<11>2014     22:06 Oct 24, 2017   Jkt 244001   PO 00000   Frm 00152   Fmt 4703   Sfmt 4703   E:\FR\FM\25OCN1.SGM   25OCN1



Document Created: 2017-10-25 01:16:38
Document Modified: 2017-10-25 01:16:38
CategoryRegulatory Information
CollectionFederal Register
sudoc ClassAE 2.7:
GS 4.107:
AE 2.106:
PublisherOffice of the Federal Register, National Archives and Records Administration
SectionNotices
FR Citation82 FR 49456 

2025 Federal Register | Disclaimer | Privacy Policy
USC | CFR | eCFR