11. Risk management framework

As part of the overall internal control framework, issuers of ARTs should have a holistic issuer-wide risk management framework extending across all their business lines and internal units, including internal control functions, recognising fully the economic substance of all their risk exposures including the risks the issuer of ARTs poses to itself, the holders of assets, operational risks and risks resulting from the reserve of assets.

The risk management framework should enable the issuer of ARTs to make fully informed decisions on all risks they are or might be exposed to including ICT risks in accordance with Regulation (EU) 2022/2554 (DORA)¹⁵ and Section 12. The risk management framework should encompass all risks, including actual risks and future risks that the issuer of ARTs may be exposed to. Risks should be evaluated from the bottom up and from the top down, within and across business lines or internal units using consistent terminology and compatible methodologies throughout the issuer of ARTs and at a consolidated level where applicable. All relevant risks should be encompassed in the risk management framework with appropriate consideration given to both financial and non-financial risks, including concentration, operational, ICT, reputational, legal, conduct and ESG risks. Consideration should also be given to credit risk, market risk, concentration risk and liquidity risk resulting from the reserve assets.

¹⁵ Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector: Publications Office (europa.eu)

An issuer of ARTs risk management framework should include policies, procedures, risk limits and risk controls ensuring adequate, timely and continuous identification, measurement or assessment, monitoring, management, mitigation and reporting of the risks at the business line, internal units, issuer and group level, where applicable.

An issuer of ARTs risk management framework should provide specific guidance on the implementation of risk strategies. This guidance should, where appropriate, establish and maintain internal limits consistent with the issuer’s risk tolerance , risk appetite and be commensurate with its sound operation, operational resilience, financial strength, liquidity needs and strategic goals. An issuer of ARTs s risk profile should be kept within the established limits. The risk management framework should ensure that, whenever breaches of risk limits occur, there is a defined process to escalate and address them with an appropriate follow-up procedure.

The risk management framework should be subject to independent internal review, e.g., performed by the internal audit function, and reassessed regularly against the issuer of ARTs risk tolerance and risk appetite.

Regular and transparent reporting mechanisms should be established so that the management body and all relevant units in the issuer of ARTs are provided with reports in a timely, accurate, concise, understandable and meaningful manner and can share relevant information about the identification, measurement or assessment, monitoring and management of risks. The reporting framework should be well defined and documented.

Effective communication and awareness regarding risks and the risk strategy is crucial for the whole risk management process, including the review and decision-making processes, and helps preventing decisions that may unknowingly increase risk levels. Effective risk reporting involves sound internal consideration and the communication of the risk strategy and relevant risk data both horizontally across the issuer of ARTs and up and down the management chain.