A. Overview

4. Among the sixteen FMIs located in Brazil, four systemically important ones belong to the top twenty FMIs in the world. There are sixteen FMIs in Brazil whose nature and activities are presented in Appendix III, among which nine are qualified by the BCB as systemically important (see below). Appendix II shows the graphical landscape of Brazilian FMIs. The four FMIs which belong to the top twenty in the world are presented here and Key statistics on the value and volume of their activity is shown in Appendix V.

• The Sistema de Transferência de Reservas (STR) is an RTGS system operated by the BCB that constitutes the backbone of the Brazilian payment system (SPB)⁷.The funds transfers are settled by STR in the accounts held at BCB. STR settles transactions in the monetary, foreign exchange and capital markets between the financial institutions that hold accounts at BCB. In addition to these financial flows, the net positions of the clearing and settlement systems are settled through the STR.

• SELIC, Sistema Especial de Liquidação e de Custódia, the BCB-operated central securities depository (CSD) and securities settlement system (SSS), settles trades with government securities in real time⁸.

• In Brazil, the entities that provide securities settlement services usually also provide other post-trade processing, acting both as a clearing house, a CSD, or a trade repository (TR).

• CETIP, Central de Custódia e de Liquidação Financeira de Títulos, privately owned CSD/SSS and TR, records trades with OTC derivatives and private fixed income bonds, and is the CSD of corporate debt securities and some government securities. It has merged with BM&FBOVESPA which kept its CSD operation separate from the CCP operation.

5. BM&FBOVESPA Clearinghouse, the largest CCP in Latin America and one of the top 10 CCPs in the world, is one of the CCPs operated by B3. B3 (Brasil, Bolsa, Balcão) was established in March 2017 when the activities of BM&FBOVESPA were combined with the activities of CETIP through a merge. BM&FBOVESPA itself resulted from the merger of BM&F and BOVESPA in 2008. In the markets for exchange-traded products, B3 operates trading and post-trading (clearing and settlement) systems and services (PS) for equities, financial and commodity derivatives, bonds, federal government debt securities, spot currencies and agricultural commodities. For unlisted products traded bilaterally on the OTC market, such as financial instruments issued by banks and customized derivatives, B3 offers the infrastructure for registration of these trades by market participants. For post-trading services, B3 operates several FMIs: 2 CSDs, 4 SSSs, 3 CCPs, one PS and 4 TRs, which are operational departments under the same legal entity B3, some of which have been integrated.

6. BM&FBOVESPA has developed a post-trade integration project (IPN) to create an integrated clearinghouse. In August 28, 2017, the scope of BM&FBOVESPA Clearinghouse has been extended in migrating the equity and corporate fixed income markets into a new infrastructure integrated with the derivatives and commodities markets. Hence, BM&FBOVESPA Clearinghouse is responsible for clearing and settling practically all trades executed on the markets operated by B3. At the end of the project⁹, when the two remaining CCPs, BM&FBOVESPA Cambio (FX) and BM&FBOVESPA Debt Securities Clearinghouse will be integrated, B3’s clearing, settlement and CCP services will have a single set of rules, a single participant structure and register, unified processes for position allocation, clearing and control, a single settlement window, a single risk management system, a single collateral pool, and a single safeguard structure. The benefits for participants consists of better liquidity management, more efficient capital allocation, more efficient margin calculation, and lower operational risk.

7. Some specificities and general characteristics in the Brazilian framework deserve to be highlighted. Two long existing rules are structuring features for the Brazilian system: post-trade identification of the final beneficial owner is mandatory and enables a consolidated view of the position of each investor. OTC derivatives trades are only valid if registered. They may be with or without central counter-party. Other features are: almost all securities are dematerialized, and the trading, clearing and settlement systems are automated and STP (straight through processing) is widely used. The principle of delivery versus payment (DVP) is observed in all securities settlement systems. Dark pools and order internalization are not allowed which increases transparency on price formation.

B. Overview of the Supervisory and Oversight Framework

8. The authorities responsible for regulation, supervision and oversight of FMIs in Brazil are the National Monetary Council (CMN), Central Bank of Brazil (BCB) and the Brazilian Securities Commission (CVM).

• CMN is a policy committee composed of the Minister of Finance, the Minister of Planning, Budget & Management, and the Governor of the Central Bank. The CMN does not have supervisory powers—it issues general guidelines that apply to the entire financial services sector in Brazil with a focus of promoting the improvement of institutions and financial instruments to ensure higher efficiency of the national payments system.

• Under the CMN general regulation, with focus on the safety and the efficiency of the Brazilian Payment System (SPB) and the stability of the National Financial System, the BCB is empowered to regulate, authorize the functioning and oversee FMIs that involve settlement therefore payment systems (PS), SSS and CCPs. The competences of BCB related to oversight activities are related to risks and include approval of rules, approval of risk models, monitoring, on-site inspection, enforcement of corrective actions.

• Under CMN’s regulation, CVM¹⁰, has jurisdiction over market participants who deal with financial assets which are mentioned in the Securities Law 6385/76 for regulation and supervision as regards the integrity of the market and the investors’ protection. The BCB and CVM have shared responsibilities over SSSs, CSDs and TRs. Regarding CCPs, because of the vertically integrated structure of B3, CVM is competent for the corporate governance at the company level in addition to its competence mentioned above, while the BCB is competent as regards the whole of PFMI including governance at the CCP level. The authorities are considering enhancing the legal framework through a comprehensive bill that clarifies the respective field of competence, of consolidating dispersed legislation and regulations regarding FMIs and of incorporating the internationally accepted classification of FMIs.

9. The regulation, supervision and oversight of the BCB and CVM are based on statutory law, CMN’s Resolutions, BCB’s Circulars and Policy statements, and CVM Instructions¹¹ (see Appendix VI). Coordination between BCB and the CVM is established at the policy level on the basis of mandatory consistency with CMN’s Resolutions which serve as common guidelines for both authorities. At the operational level coordination is based on a memorandum of understanding (MoU). The MoU in place allows for information sharing and coordinated activities among the BCB and CVM, in order to supervise, regulate, oversee FMIs and avoid overlaps as well as gaps.

10. Organized securities markets, clearinghouses, CSDs and TRs are considered ancillary organs of CVM in performing market surveillance. They exercise the self-regulatory authority delegated to them to supervise the conduct of the intermediaries and other financial institutions that operate in their markets, as well as the transactions involving securities executed in these markets. Entities that manage organized securities markets must issue specific norms that regulate securities trading and registration in their markets, listed companies, as well as clearing, settlement and centralized custody. In B3’s case, these norms are embodied mainly in its rulebooks, manuals and circulars after approval by the regulators. To assure the independence of the self-regulation function, on one hand, and segregation from operating activities, on the other, CVM Instruction 461/07 allows operators of organized markets to choose one of the following options:

• Creation of a specific self-regulation structure comprising a department of self-regulation, a chief regulatory officer and a self-regulation board, or

• Incorporation of a special-purpose vehicle, or

• Engagement of an independent third party

11. B3 chose to incorporate a special-purpose vehicle, BSM (see para 18), which performs the required self-regulation activities through on-site inspections and desk audits. In addition, it assesses all applicants to B3 based on BCB, CVM and B3 standards. BSM’s independence from B3 is guaranteed, in accordance with CVM Instruction 461/07 Chapter IV, by administrative, financial and budget management autonomy and by an independent Board. The Board should have at least 2/3 of independent members and no B3 employee or member. Presently, out of 12 members, 9 are independent. Board members are granted a 3 years fixed term. BSM has a full right of access to information and complete independence as regards the result of investigations.

A. Regulation, Supervision and Transparency (Responsibilities A, C and D)

12. There are clear and publicly disclosed criteria governing which FMIs are subject to regulation and oversight by the BCB. Criteria for qualifying systemically important FMIs are based on BCB’s Circular 3057. Following Article 8 of BCB’s Circular 3057 (see Box 2), the settlement systems for financial assets, securities, derivatives and foreign exchange, are considered systemically important regardless of the transaction amounts or daily turnover. While systems for interbank funds transfer, and for other obligations are considered systemically important either if their daily turnover¹² is above 4 percent of the STR average turnover, or at BCB’s discretion, the likelihood that a participant may default, in a deferred net settlement system, will cause risk to the SPB payments flow.

13. Based on these criteria, BCB published the Policy Statement 30516 that establishes which FMIs are qualified systemically important. In Brazil, there are two systemically important PSs¹³, three CSDs/SSSs¹⁴, three TRs/SSSs¹⁵ and one SSS¹⁶.There are three CCPs.^{17, 18} All of them have been identified to be subject to the PFMI.¹⁹ Regarding the oversight of the systems that are not systemically important, the BCB statement provides that they are subject to oversight however the PFMI related to credit risk and liquidity risk do not apply.

14. The FMIs for which CVM is competent concerning their regulation and supervision are defined in statutory laws and regulations. Following the merge between CETIP and B3, only one legal entity, B3, is subject to CVM’s supervision and regulation, as the operator of a SSS, a CSD and a TR, all of which deal with securities covered by the Securities Law 6385.

15. The BCB discloses its policies and objectives for the oversight of FMIs. The BCB’s policies and practices are disclosed in its Oversight report which has been published annually since 2013. The Report describes the BCB’s role and the scope of SPB oversight, the last developments in Brazilian FMIs, the oversight activities undertaken over the year and the oversight policies regarding payment schemes and FMIs. Publication for 2016 is delayed given a change in format, the report being divided in two reports, one on policies which will only change when policies change, and one on the annual oversight activities and the evolutions in the SPB. BCB objectives as overseer and regulator of FMIs are also clearly disclosed on its website and in various public reports. “Oversight intends to foster soundness, efficiency and improvement of SPB, taking into account its importance to the soundness and normal functioning of the National Financial System.”, hence contributing to maintain financial stability.

16. CVM should consider defining and disclosing specific objectives for the supervision of FMIs. CVM is responsible for the market functioning, conduct of market participants, and protection of investors and its policies are issued through Instructions and Legal Opinion.

17. The BCB has adopted the PFMI and applies them in the oversight of the FMIs. The BCB issued a policy statement (25,097) in January 2014 committing to apply the PFMI in the authorization process and in the oversight activities of FMIs. While systemically important FMIs must comply with all PFMI, non-systemically important FMIs are also subject to oversight against the PFMI but exempted from complying with the principles related to credit risk and liquidity risk. BCB conducts monitoring of operational risk indicators (availability index, number of failures and capacity utilization in real time settlement systems) and financial risk indicators for CCPs to verify whether resources required from participants and from the CCP, as calculated by the CCP’s risk system, will be sufficient in case of participants defaulting. The BCB also performs each year on-site inspections which last up to a month (in 2015, SELIC, CETIP and BM&FBOVESPA among others) resulting in action plans for addressing identified gaps. These plans have schedules monitored by BCB although not always met (see below).

18. CVM requires any FMI subject to its competence to certify its compliance with the PFMI as a condition of their authorization. Through Instructions 461 modified by 544, and 541, CVM requires CSDs and TRs, in order to be authorized, to supply a document by which they certify that they comply with the PFMI. Supervision is executed through (i) cooperation with BCB (ii) review of reports by BSM²⁰, the B3 self-regulatory organization, (iii) through market surveillance for which CVM has agreements with Issuers Regulation Department (IRD), an independent department within B3, which supervise listed issuers and (iv) through reporting by the B3 compliance and internal control department. BSM’s main responsibilities cover (i) the supervision of all trades performed and of all participants authorized to trade in B3’s markets, (ii) following the Exchange and OTC activities, (iii) investigating misconducts in compliance with laws and regulations, and (iv)initiating, instructing and conducting administrative proceedings of a disciplinary nature. Both BSM and IRD have delegation from CVM and B3 (from BCB also in case of BSM) to notify warnings and apply sanctions (fines) to market participants²¹, which they do effectively. Incidents that would affect the market players have to be reported to CVM. On particular topics, as regards for instance the IPN (integration of BM&FBOVESPA’s post trading systems at B3) project which required both BCB and CVM’s approval, there are more regular contacts and monitoring of the integration process. In addition, the Office of Market Surveillance receives the self-assessment reports from CETIP and BM&FBOVESPA against the PFMI. CVM should however disclose it has adopted the PFMI for its supervision and consider producing a supervisory report disclosing its supervisory findings regarding FMIs.

19. Systemically important FMIs are subject to appropriate and effective supervision and oversight although implementation of corrective actions should be accelerated. The BCB 2015 Brazilian Payment System Report states that BCB assesses payment and settlement systems it operates against the PFMI in the same way as other systemically important FMIs. This includes STR and SELIC which are owned, operated and overseen by the BCB. The PFMI requirements which are not applicable to FMIs operated by central banks, as published by the Bank for International Settlements, are not applied in the oversight of the systems operated by BCB. Where necessary, the BCB defines action plans to remedy any deficiencies. However, implementation of such measures should be accelerated. Several mitigation measures which have been identified following the 2012 FSAP to address problems which can have a systemic impact in the case of a severe disruption of STR and an analysis of the impact on the other FMIs of a severe outage at STR are still pending implementation. Some measures have a deadline until 2018 due to the need for adjustments to regulation, some are pending FMIs decision. Such timeframe especially when affecting the RTGS which is the backbone of the SPB should be shortened. The BCB should ensure that mitigation measures are implemented as soon as possible when deficiencies are identified. BCB’s preferred enforcement tool is through persuasiveness (often referred to as “moral suasion”). Discussions with the system operator and participants play an important part in achieving oversight objectives. A central bank’s persuasiveness in such discussions depends in the first instance on the strength of its monitoring and assessment.

20. The BCB as operator and overseer does not have in place separate reporting and escalation lines to the Board of Governors for addressing potential conflict of interest for STR. Within the BCB, the Department of Banking Operations and Payments System (Deban) is in charge of operating and overseeing STR²². Potential conflict of interest between the BCB’s role as the operator of systems and its role as overseer is addressed through organizational separation of the two functions up to the level of the head of Deban in the case of STR (and up to the level of the Deputy Governor in the case of SELIC). Best practice for many Central banks²³ consists in separate reporting lines and escalation lines to the Deputy Governor for the operators and the overseers to address such case.

21. There is evidence that BCB’s and CVM’s oversight and supervision have been effective in improving risk management practices at Brazilian FMIs. Improvements in risk management frameworks and practices range from the creation in BM&FBOVESPA’s corporate governance of advisory committees for the board and the CEO, the adoption of best practices in compliance and risk management with initiatives such as definition of critical processes and risk appetite, the improvements in information security management, the introduction in 2014 of a skin-in-the-game contribution for the CCPs in their default waterfall, the adoption of a new and more efficient risk management model²⁴; to the establishment of a working group to identify the interdependencies between the FMIs operating in the market and the critical service providers that represent a risk to the business continuity of the whole system, continuous improvement of the company’s information security structure in order to maintain its resilience, or the improvement in the management procedures of incidents which are registered with corrective actions monitored and learning lessons processes in place.

22. Nevertheless, there is still room for improvement in inducing compliance with the PFMI or in the implementation of corrective action plans. The BCB should require all systemically important FMIs, in particular, STR, SELIC, and CETIP, to publish a disclosure framework in compliance with key consideration 5 of Principle 23 of PFMI and for BM&FBOVESPA Cambio (FX) a quantitative disclosure in compliance with Public quantitative disclosure standards for central counterparties. For the second point, the BCB has initiated a working group led by B3 identifying the risks resulting from interdependencies between FMIs and critical service providers. The assessment of these risks and their impact on the SPB, and the action plans resulting from the assessment should be accelerated and should be integrated in the oversight framework of BCB.

23. Cyber risk has recently been recognized as a major threat. The authorities should continue fostering the implementation of the CPMI–IOSCO 2016 Guidance on cyber resilience for financial market infrastructures through their oversight and supervision of FMIs against the PFMI in addition to BCB’s oversight division continuously evaluating the FMIs’ information security framework. While the guidance is directly aimed at FMIs, it is important for FMIs to take on an active role in outreach to their participants, in particular the banks, and other relevant stakeholders to promote understanding and support of resilience objectives and their implementation. Given the extensive interconnections in the financial system, the cyber resilience of an FMI is in part dependent on that of interconnected FMIs, of service providers and not least of the participants. In this context, recently, the FMIs were requested to answer a survey which objective was to reveal their progress in meeting the provisions outlined in the Guidance. Also, the BCB intends to communicate on the Guidance through the FMI Forum it has created as a channel to communicate with stakeholders in FMIs, emphasizing with the market the importance of cyber resilience.

B. Powers and Resources (Responsibility B)

24. Both the BCB and CVM have powers to obtain information from the FMIs that are subject to their supervision and oversight. These powers are based in relevant laws (see Appendix VI). Both authorities are entitled to request information they believe necessary. FMIs are also required to provide their competent authorities with information regarding planned changes to their systems or operations, and other significant matters, as well as statistical information to BCB²⁵. Any change on their internal rules related to risk and efficiency must be approved by the BCB, and other minor changes must be informed in order to be assessed. The same applies to CVM for the FMIs under their jurisdiction (SSS/CSD and TR). Both the BCB and CVM have authority to apply penalties if FMI refuses to give access to the requested information.

25. Both the BCB and CVM have the authority to induce change and enforce corrective action at supervised FMIs although implementation of changes may take time. Both authorities may issue specific regulation, consistent with CMN’s general regulation, applicable to FMIs, and require changes in the authorization process and then in the approval process required for material changes in the systems, rules and operations. Perceived deficiencies with a specific FMI are discussed and notified through a letter of recommendations with action plans. Implementation of actions may take time and BCB should continue to encourage FMIs to improve timeframes for corrective action plans, especially recommendations to the FMIs following on-site inspection. Both BCB and CVM have stated that they have found this to be an effective mechanism for inducing change. Both may rely on moral suasion, but also have the power to impose FMIs sanctions or penalties²⁶ which they haven’t used up to now for FMIs. As stated earlier, persuasiveness in such discussions depends in the first instance on the strength of the monitoring and assessment.

26. Resourcing of the FMI supervision and oversight functions within the BCB and CVM are adequate and kept under review although CVM could benefit from increased resources (staff) in particular if the market has new entrants. The Department of Banking operations and Payment Systems (DEBAN) at the BCB is in charge of the oversight of FMIs. Its staff comprises approximately 27 qualified persons. CVM is a much smaller entity in number of staff and budget. The Office of Market Surveillance employs approximately 12 qualified persons partially dedicated to FMI supervision in a total staff of 37. It should be noted that by law, part of the supervisory tasks is delegated to the self-regulatory organization of B3, BSM, and to IRD through agreements (see paragraph 17). Both the BCB and CVM state that their resources in personnel are adequate in number and in qualification and kept under review, as are their budgets. However, it seems that CVM may need increased staff if new FMIs enter the market.

C. Cooperation Among Authorities in Normal and Stressed Circumstances (Responsibility E)

D. Oversight Expectations Applicable to Critical Service Providers (CSP) (Annex F)

33. The BCB should continue enhancing its oversight framework regarding the Assessment Methodology for the Oversight Expectations of CSPs to FMIs (Annex F of the PFMI). The operational reliability of an FMI may be dependent on the continuous and adequate functioning of third-party service providers that are critical to an FMI’s operations, such as information technology and messaging providers. Annex F outlines five oversight expectations that help ensure that the operations of a CSP are held to the same standards as the FMI would be if it provided the same: (i) ensuring strong risk identification and management; (ii) robust information security management; (iii) reliability and resilience of system; (iv) effective technology planning; and (v) strong communications with users. The BCB has the authority to establish such expectations for CSPs of FMIs based on Circular 3057, article 25²⁷. Currently, the monitoring process of critical service providers is being conducted through principle 17 on operational risk. At this stage, the main critical service providers identified in the working group led by B3 on interdependencies and impact of unavailability of service, are for the CCP (i) other FMIs (the RTGS STR and the SSS/CSD SELIC), (ii) RTM (information technology supplier) and (iii) the Brazilian messaging system RSFN (see appendix II in the TN), mostly used instead of SWIFT in Brazil. With regard to the assessment methodology for the oversight expectations, the BCB has indicated that it plans to require FMIs to assess their critical service providers following the methodology and establish action plans to address eventual gaps.

A. Governance and Corporate Structure

36. B3 is a vertically integrated multi-asset multi-market legal entity and listed company which operates BM&FBOVESPA. All the FMIs it operates are operational departments and not subsidiaries. There is therefore a spill-over risk in case one FMI fails. It uses the individual customer segregation model²⁸ for all stages of the trading, registration and post-trading cycles²⁹. B3 is a public company listed on the Novo Mercado premium listing segment³⁰ with no single shareholder or organized shareholder group having voting rights equivalent to more than 7 percent of the total number of shares (see Table 2 for ownership structure). It publishes quarterly reports. B3 has 6 subsidiaries: the BM&FBOVESPA Settlement Bank, created for facilitating the clearing and settlement of transactions, two local representative offices in the US and in UK, one inactive stock exchange in Rio, one civil society for social projects, and BSM, the not-for-profit association organized as a self-regulatory and market surveillance organization.

• Download Figure
• Download figure as PowerPoint slide

View Full Size

• Download Figure
• Download figure as PowerPoint slide

• Download Figure
• Download figure as PowerPoint slide

37. The Board of Directors oversees the FMIs’ activities pursuing the objectives of safety, efficiency and transparency and explicitly support financial stability. These priorities are explicit in the presentation of B3 on its website³¹. The Board is composed of 11 members. Six are independent³² members including the Chairman (it is a regulatory requirement) and the other five are shareholders representatives and/or are linked to market participants but not connected to controlling group or to management³³. Their profile is available on B3’s website. They are proposed by the nomination committee and are elected by the shareholder’s meeting.

38. The Board of Directors’ duties and responsibilities are clearly established in the by-laws³⁴. It is the Board’s duty and authority to approve policies, define guidelines in pursuit of its strategic objectives, key plans and targets, overall budgets, internal control framework, risk appetite and risk management framework, financial reporting and compliance. It nominates the directors in charge of executing the activities and supervises their performance. Corporate governance arrangements are documented in order to provide clear and direct lines of responsibility and accountability. The performance of the Board of Directors as a group is assessed yearly with the support of the Corporate Governance Committee. The performance of each individual member is assessed under the authority of the Chairman³⁵. The Board is accountable to the shareholders meeting whose authority is clearly defined in the by-laws which are available on B3’s website. Corporate governance documents are disclosed to its shareholders, competent authorities, participants and the general public through the website. The Board of Directors is assisted by advisory Committees³⁶ which have clearly defined activities in the by-laws.

39. B3 is managed by an Executive Board appointed by the Board of Directors in accordance with the by-laws³⁷. The Executive Board is composed of six directors, one of whom is a President and five Vice-Presidents. Management compensation is aligned with the Company’s performance and strategic objectives, and shareholders long term interests. There are 11 advisory committees to the Executive Board among which a corporate risk advisory committee, a credit risk technical committee, a business continuity committee and an information security management committee (Table 3).

Table 3.

Brazil: Corporate Governance

Sources: BM&FBOVESPA PFMI Information Disclosure_March 2017

Table 3.

Brazil: Corporate Governance

Sources: BM&FBOVESPA PFMI Information Disclosure_March 2017

View Table

Table 3.

Brazil: Corporate Governance

View Expanded

Sources: BM&FBOVESPA PFMI Information Disclosure_March 2017

• Download Figure
• Download figure as PowerPoint slide

View Full Size

• Download Figure
• Download figure as PowerPoint slide

• Download Figure
• Download figure as PowerPoint slide

40. The Board has established a Finance and Risk Committee to assess and monitor the risk framework. The Committee has presently 6 members, two of which are independent. Its duties³⁸ include to assess and monitor exposure to risks inherent in the different business activities of B3, with particular focus on structural and strategic risk management; to periodically make recommendations to the Board about guidelines related to the management of risks and propose specific limits; with regard to CCP Risk, to present to the Board periodic reports providing combined information regarding exposures to typical risk factors, the quality of collateral taken, and the outcomes of liquidity stress tests; and to monitor and analyze liquidity, cash flow, the indebtedness policy, and the capital structure. It has established two risk management frameworks, one for managing central counterparty risk and one for managing corporate risk.

41. The Board has established a solid risk management and internal control structures and policies. The corporate risk methodology follows a top-down and bottom-up approach to identify, measure, control and mitigate the material risks inherent in B3’s activities including BM&FBOVESPA. The approach is based on 4 principles which are shown in table 4 (lower image). It aligns risk management with the company’s strategy and follows the risk appetite and the risk tolerance defined at the Board level. The corporate governance framework is structured along four lines of defense shown in table 4 (upper image):

• The Business Areas are mainly responsible for the management of business risks and internal controls. They report to the Risk Technical Committee and the Market Risk Committee of the Executive Committee, which must approve any change to the procedures, criteria, parameters or systems.

• The Internal Controls, Compliance and Corporate Risk Department (DCR) evaluates the conceptual soundness of the models used, analyses the outcomes, and monitors the processes (for financial risks, business continuity, etc.), reporting to the Risk and Financial Committee at Board level

• The Internal Audit Department performs an independent evaluation of the internal controls reporting to the Audit Committee. The external auditors review how the financial impact of risks are taken into account in the financial statements, and BCB approves the CCP rules and models.

Table 4.

Brazil: Corporate Risk Governance—Corporate Risk Model

Source: B3 presentation

Table 4.

Brazil: Corporate Risk Governance—Corporate Risk Model

Source: B3 presentation

View Table

Table 4.

Brazil: Corporate Risk Governance—Corporate Risk Model

View Expanded

Source: B3 presentation

• Download Figure
• Download figure as PowerPoint slide

View Full Size

• Download Figure
• Download figure as PowerPoint slide

• Download Figure
• Download figure as PowerPoint slide

These corporate governance arrangements enable the DCR, recently created with appropriate resources (staff), to have authority because their processes are audited by the Internal Audit Department (which reports to the Audit Committee) and independence through their direct access to the Risk and Financial Committee at the Board level.

42. The Board has defined a low appetite for CCP risk. The main risks associated with BM&FBOVESPA clearinghouse are credit, liquidity and market risks. The Board has defined low appetite for CCP risks, and that financial resources (“safeguard structure” in B3’s terms) and qualified liquid resources should be sufficient to cover credit and liquidity risks under multiple stress scenarios (as required by the PFMI- see below) with a 99,96 percent market risk confidence level. Policies and procedures are described in the rulebooks and manuals available on B3’s website. Any change to the rulebooks must be approved by the Board and by BCB.

43. The legal basis for clearing arrangements lies in Law 10214/01 and BCB Circular 3057. When the trade is entered through the exchange³⁹, it is contracted with the CCP as a counterparty (after control at pre-trade stage) and not with the buyer or the seller. So, the contract with the CCP occurs at the moment where the trade is accepted and registered. Hence the unconditional and irrevocable nature of settlement is achieved. The assets pledged as collateral to the CCP cannot be apprehended in case of default.

B. Recovery and Wind-Down Planning

48. Ensuring the right conditions for recovery measures to succeed is a key policy objective for CCPs, as their failure is considered to be potentially highly disruptive for the wider financial system. A CCP’s viability may be threatened by significant losses or liquidity shortfalls that may arise from the default of one or more participants, or in case of an extraordinary loss resulting from a non-default situation, for example, losses that could arise from financial impacts of operational risks such as terrorist attack, natural disaster, cyber-attacks; or potential litigation. BM&FBOVESPA has identified four scenarios which might constitute a threat to its business continuity and viability. B3 has in the rulebooks of BM&FBOVESPA Clearinghouse some tools similar to recovery tools, however they do not meet the requirements set in the guidance for recovery of FMIs in that they are not comprehensive and effective (in terms of reliability, timeliness and legal basis). BM&FBOVESPA should finalize a recovery plan, which is still at a very early stage, compliant with the PFMI, aiming at continuing to ensure critical services and mitigating contagion risks through participants, with the appropriate set of recovery tools all backed by agreements with relevant decision makers.

Table 5.

Brazil: Default Waterfall

Source: B3 website.

Table 5.

Brazil: Default Waterfall

Source: B3 website.

View Table

Table 5.

Brazil: Default Waterfall

View Expanded

Source: B3 website.

• Download Figure
• Download figure as PowerPoint slide

View Full Size

• Download Figure
• Download figure as PowerPoint slide

• Download Figure
• Download figure as PowerPoint slide

C. Margin Arrangements and Pro-Cyclicality

49. BM&FBOVESPA has established an effective margin system based on the calculation of portfolio risk at the individual customer level. The margin calculation methodology (CORE) measures the worst cash flow requirement accumulated during the process of closing out the portfolio of a defaulting customer, given adverse price movements defined in the risk factor variation scenarios for the portfolio in question, i.e. for the customer’s positions and collateral. The close-out period is defined as between 1 and 10 days. CORE uses the full valuation method to value all positions, including positions in non-linear instruments, under 10,000 scenarios for each risk factor. The confidence level used in the calculation is at least 99.96 percent. CORE is used for all products.

50. The 10,000 scenarios comprise historical scenarios which use a sample look-back period from 2002 to 2016, quantitative scenarios that are extreme but plausible and did not necessarily occur in the period covered by the sample, and prospective scenarios (“what if”). BM&FBOVESPA use marked-to market values to update margin requirement, collateral and margin calls, and for calculating daily settlement values. The clearinghouse requires additional margin for positions that exceed the concentration limits for open positions, and may require intermediaries and clearing members to post collateral on an intraday basis if justified by the monitoring of intraday risk as the intermediary’s balance should be kept positive at all times. The Risk Management Department monitors the adequacy of the margining model’s parameters and assumptions every day⁴¹ using (i) a daily margin backtesting procedure for all portfolios, and (ii) daily monitoring of the market risk scenarios, which are compared with the observed variations in market prices.

51. However, the sensitivity of its margin model coverage should be tested using a wide range of parameters and assumptions at least monthly. It should use the results of these sensitivity tests to analyze the potential losses it could suffer and evaluate the potential losses in individual customers’ positions. Rigorous sensitivity analysis of margin requirements may take on increased importance in case markets become illiquid or volatile.

52. BM&FBOVESPA’s margin model also addresses procyclicality as it is designed to prevent sudden changes in required margin amounts by including stress scenarios in the margin calculations, which combine price fluctuations incorporating fat tails and volatility fluctuations. Because the parameters of the risk model are not based on conditional volatility, but instead, are based on the unconditional distribution of shock returns, an increase in market volatility does not imply an automatic change in the required margin. Procyclicality in the model is also limited because its parameters (daily liquidity and scenarios for risk factors) are determined ex ante, unconditionally and exogenously to the model. The CORE methodology takes the average daily liquidity of each contract into account to determine the maximum number of contracts the CCP can closeout (or auction) at any given day of the holding period when defining the closeout strategy. Thus, the presence of positions in contracts with low liquidity may result in a higher margin requirement. Regarding collateral, the need for procyclical adjustments is low considering that (i) collateral valuation is an integral part of the CORE methodology for calculating risks, and (ii) more than 95 percent of the collateral posted to BM&FBOVESPA consists of Brazilian government bonds, the most liquid asset in the Brazilian market, for which the average haircut is less than 1 percent. The methodology prevents wrong-way risk by not accepting securities issued by a clearing participant or its group affiliates as collateral and imposes limits to prevent concentration risk in order to mitigate adverse price movements impacting the collateral it receives.

D. Credit Risk

53. BM&FBOVESPA has identified three main types of credit risk: (i) the risk of financial losses resulting from the failure of providers of infrastructure for settlement processes; (ii) the risk of losses due to default by one or more participants, associated with the market and liquidity risks inherent in closeout of positions and collateral execution; and (iii) the credit risk associated with issuers of assets used in the clearinghouse’ financial resources that the CCP calls “safeguard structures”. Sources of credit risk are identified by the Risk Management Department and the Credit Risk Technical Committee.

54. BM&FBOVESPA Clearinghouse monitors credit exposures every day and intraday using credit stress tests and has tools to manage and control them. Credit stress tests assume default by two participants and their affiliates⁴². The financial impact of such defaults is simulated using the CORE methodology, assuming market risk scenarios of greater severity than those used to calculate margin requirement. The credit quality of participants, collateral issuers and infrastructure suppliers is assessed using external metrics and internal metrics (daily settlement volumes, margin requirements and collateral posted, for example). If a participant’s credit quality deteriorates, BM&FBOVESPA Clearinghouse can take steps to reduce its exposure, such as lowering the limits assigned to the participant and requiring additional collateral. If a participant becomes insolvent, BM&FBOVESPA can also prohibit new transactions that cause an increase in exposure, impose position closeout, and revoke the participant’s access authorization.

55. The financial resources to cover current exposures⁴³ and potential future exposures⁴⁴ consists of collateral posted by participants (margin requirement including additional margin by customers, and intermediary collateral posted by an intermediary to meet his access requirement and/or to raise the intraday risk limit) and a settlement fund replenished by the clearing members and by the CCP (currently 50 percent of the fund). A credit stress test is used to assess that the level of protection granted by the financial resources is sufficient to cover the default of the two participants and their affiliates with the largest exposures to the CCP with a higher confidence level for market risk than the level used to calculate margin requirements. It provides for the replenishment of the default fund only to cover future defaults and is capped, in any 20-day period, to three times the value of the non-defaulting clearing member’s contribution.

56. The Clearinghouse is not exposed to credit risk arising from the potential default of a settlement bank since it uses its own account with BCB in the STR to receive and make payments from and to its clearing members.

E. Liquidity Risk

57. The monitoring and management of liquidity risk has two main components: analysis of settlement values and analysis of collateral. The first component analyzes potential liquidity needs that may arise due to failures in settlement by one or more participants during the clearing process. The liquidity analysis of the collateral seeks to ensure that the collateral is adequate and can be monetized promptly in the event of a default of a participant and subsequent close out of positions. Independently, the aggregate liquidity risk is evaluated based on stress scenarios simulations that consider the failure of financial conglomerates that owe the largest settlement amount to BM&FBOVESPA Clearinghouse, including the performance of the group entities as liquidity providers and issuers of collateral (Bank Certificate of Deposit (CDBs) and letters of bank guarantee). BM&FBOVESPA calculates settlement obligations, including collateral requirements, due by all participants at all levels (final beneficiary, intermediary and clearing member), and monitors settlements and flows in real time. These tools are also made available to participants (intermediaries and clearing members) to assist them in managing their liquidity risks intraday.

58. Stress testing is used to estimate liquidity requirements in the event of members’ default. To meet its liquidity requirements, the following qualifying liquid resources are available to BM&FBOVESPA: dedicated credit lines from top-tier banks; liquidity assistance from BM&FBOVESPA Bank; cash dedicated by the CCP; Brazilian Government bonds in the Settlement Fund and BM&FBOVESPA Clearinghouse free cash flow. The stress tests results show that these liquid resources are sufficient to cover the default of the clearing member that owes the largest settlement obligation to the CCP. No liquidity breaches have been reported against “cover 1” by BCB in its Financial Stability Report. The CCP also stress tests the liquidity requirement against the simultaneous default of two clearing members⁴⁵. It is worth highlighting that in the individual customer segregated model followed by BM&FBOVESPA Clearinghouse, each affiliate that clears through his parent clearing member is taken into account as any customer for calculating the largest exposure to the CCP. Where an affiliate clears through a clearing member other than his parent and has a standing payment obligation to the CCP, BM&FBOVESPA should consider this payment obligation in the clearing members’ exposure if not covered by the first clearing member.

F. Operational Risk

59. Operational risk management framework is designed to mitigate and manage sources of operational risk in compliance with BM&FBOVESPA Clearinghouse’s risk management policy. The Corporate Risk Management, Operational Risk and Internal Control Policies of BM&FBOVESPA establish guidelines, functions and responsibilities to identify, monitor and manage operational risks. The Board of Directors of BM & FBOVESPA has established and revised, at least annually, Corporate Risk Management, Operational Risk and Internal Control Policies, which determine the functions and responsibilities related to operational risk management. The operational risk management structure is subject to internal and external auditing.

60. BM&FBOVESPA has comprehensive physical and information security policies that are based on international and national standards, such as the ISO 27000 family of standards, which it should enhance in implementing the 2016 CPMI IOSCO Guidance on cyber resilience recognizing cyber risk as a major threat. BM&FBOVESPA has a Security Operations Centre (SOC) which operates around the clock seven days a week. The SOC is responsible for security monitoring and treatment of IT incidents (detecting and responding to invasion attempts), ethical hacking, and internal and external audits that continuously assess information security controls.

61. BM&FBOVESPA has a strong business continuity management framework and should assess the risks identified from interdependencies with other FMIs and critical service providers and implement corrective actions promptly. BM&FBOVESPA has business continuity rules and a business continuity policy, a business continuity committee, and a business continuity management system designed to minimize the financial, operational, legal and regulatory impacts of a lack or shortage of human, material and technological resources essential to the secure functioning of its operations. Following an initiative by the BCB, BM&FBOVESPA has lead a working group on the identification of interdependencies among FMIs and critical service providers, that represent a risk to the business continuity of the entire system. BM&FBOVESPA with other FMIs and critical service providers should assess the risks arising from the identified interdependencies, coordinate continuity plans, and/or carry out joint contingency tests.

62. For its mission-critical processes a recovery time objectives (a two-hour RTO) and recovery point objectives (an RPO of 0) are defined. BM&FBOVESPA’s business continuity plans consist of operational contingency plans, which establish alternative procedures to be executed in the event of critical process interruptions. The plans are updated and tested at least annually. Participants and suppliers of critical services are invited to take part in testing at least once a year. BM&FBOVESPA has an annual calendar for testing its business continuity plans to check their capacity to achieve the recovery objectives set, among other things, considering large-scale material disruption scenarios, such as total loss of technological resources and/or the workplace. The continuity plan testing results show that the RTO is achieved within 2 hours in 2017 for all B3 clearing houses. The PFMI quantitative disclosure for the second quarter of 2017 shows the actual availability of the core system over the previous 12 months as 99,994 percent.

63. BM&FBOVESPA should consider acquiring the ability of testing regularly the upgrades in the application softwares in the prime and secondary data center to avoid divergences between the main site and the contingency site, which have occurred in the past. The architecture of the technology that supports the processing of settlement is designed to eliminate single points of failure. Data replication between the primary and secondary (contingency) data centers, which are 20 kms apart, occurs in synchronous mode, and the technological environment is characterized by high availability (if a specific IT resource presents a problem, another resource on the same site can replace it) and disaster recovery (if resources on the same site present problems, resources on the backup site can replace them). Business areas have procedures to verify data integrity if processes are interrupted. These procedures can be run on the primary site or on the secondary site after execution of recovery procedures.

Table 6.

Brazil: B3 Sites (Data Centers and Offices)

Source: B3 presentation

Table 6.

Brazil: B3 Sites (Data Centers and Offices)

Source: B3 presentation

View Table

Table 6.

Brazil: B3 Sites (Data Centers and Offices)

View Expanded

Source: B3 presentation

• Download Figure
• Download figure as PowerPoint slide

View Full Size

• Download Figure
• Download figure as PowerPoint slide

• Download Figure
• Download figure as PowerPoint slide