7. Risk culture

A sound, diligent and consistent risk culture should be a key element of issuers of ARTs effective risk management and should enable these issuers to make sound and informed decisions that are consistent with their risk strategy and risk appetite.

Issuers of ARTs should develop an integrated and enterprise wide risk culture, based on a full understanding and holistic view of the risks they are or might be exposed to, including ESG risks, the risks to holders of assets, to markets, operational risks, ML-FT risks, liquidity risks and the risks linked to the investment of the assets of the reserve, the risk to the issuer of ARTs itself and how they are managed, taking into account the issuer of ARTs’ risk tolerance, and the conflicts of interest that may arise due to the interconnectedness of players in the crypto ecosystem.

Issuers of ARTs should develop a risk culture through policies, communication and staff training regarding the issuer of ARTs ’ activities, strategy and risk profile, and should adapt communication and staff training to take into account staff’s responsibilities regarding risk - taking and risk management.

Staff should be fully aware of their responsibilities relating to risk management. Risk management should not be confined to risk specialists or internal control functions. Business lines or units, under the oversight of the management body, should be primarily responsible for managing risks on a day-to-day basis in line with the issuers of ARTs ’ policies, procedures and controls, taking into account the issuer of ARTs ’ risk tolerance and appetite.

A strong risk culture should include but is not necessarily limited to:

• a. Tone from the top: the management body should be responsible for setting and communicating the issuer’s core values and expectations. The behaviour of its members should reflect these values. The management body should contribute to the internal communication of core values and expectations to staff. Staff should act in accordance with all applicable laws and regulations and promptly escalate observed non-compliance within or outside the issuer (e.g. to the competent authority through a whistleblowing process).
• b. Accountability: relevant staff at all levels should know and understand the core values of the issuer of ARTs and, to the extent necessary for their role and its risk tolerance and appetite. They should be capable of performing their roles and be aware that they will be held accountable for their actions in relation to the issuer of ARTs ’ risk-taking behaviour.
• c. Effective communication and challenge: a sound risk culture should promote an environment of open communication and effective challenge in which decision-making processes encourage a broad range of views, allow for testing of current practices, stimulate a constructive critical attitude among staff and promote an environment of open and constructive engagement throughout the entire organisation.
• d. Incentives: appropriate incentives should play a key role in aligning risk-taking behaviour with the issuer of ARTs ’ risk profile and its long-term interests in particular for issuers of significant ARTs.