The GCRO’s risk management strategy integrates evolving external factors, risks and trends with DTCC’s objectives ‒ prioritizing Resilience and Innovation guided by a commitment to the organization’s Stakeholders and Employees (RISE).

Risk Management Strategy

The RISE Framework

Through the RISE Framework, the GCRO supports DTCC’s objectives and key priorities, and mitigates extreme and emerging risks within agreed tolerances, by drawing on people, processes and emerging technology.

Resilience
The GCRO supports the business priority to focus on cyber, operational and financial resiliency by adapting to the evolving threat landscape, strategic goals and market and technology changes.

Innovation
The GCRO supports the business priority to engage in new initiatives and optimization efforts to transform the enterprise and the broader financial markets by integrating data, models, technology and expert judgement through a risk-focused artificial intelligence / automation / digital strategy.

Stakeholders
The GCRO supports the business priority to proactively engage with stakeholders to identify solutions to address emerging industry demands and risks by effective communication that aligns with stakeholders' expectations and objectives to achieve shared outcomes.

Employees
The GCRO supports the business priority to recruit and retain diverse and flexible talent pool combining specialist skills and experience across multiple risk disciplines by concentrating on developing necessary capabilities to strengthen resiliency and generate sustainable value.

DTCC’s risk management framework is designed to comprehensively manage the range of risks to which the organization is exposed while supporting the organization’s objectives and key priorities.

The Clearing Agencies

NSCC, FICC and DTC are clearing agencies registered with, and under the supervision of, the U.S. Securities and Exchange Commission (SEC).

The Clearing Agencies are also designated systemically important financial market utilities under Title VIII of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (Dodd-Frank) and are “covered clearing agencies” under the SEC’s Standards for Covered Clearing Agencies.

Covered Clearing Agencies are subject to additional regulatory requirements, including establishing, implementing, maintaining and enforcing written policies and procedures reasonably designed to maintain a sound risk management framework for comprehensively managing legal, credit, liquidity, operational, general business, investment custody and other risks that arise in or are borne by them.

Overarsching Documents

All DTCC entities, including NSCC, FICC and DTC, are subject to the DTCC Corporate Risk Management Policy and the Risk Tolerance Statements. NSCC, FICC and DTC are also subject to the Clearing Agency Risk Management Framework, which has been filed with and approved by the SEC.

In support of the overarching documents discussed within the Risk Management Framework tab above are various underlying policies and procedures. These supporting policies and procedures identify and describe the specific metrics, triggering thresholds, mitigation processes and escalation requirements particular to the applicable risk management topic they cover.

Filed Policy Documents - The Clearing Agencies

The Clearing Agency Risk Management Framework compliments the DTCC Corporate Risk Management Policy and Risk Tolerance Statements. This overarching document applies exclusively to NSCC, FICC and DTC and has been filed with and approved by the SEC. Other policy documents exclusive to NSCC, FICC and DTC have also been filed with and approved by the SEC:

• Clearing Agency Liquidity Risk Management Framework
• Clearing Agency Operational Risk Management Framework
• Clearing Agency Model Risk Management Framework
• Clearing Agency Securities Valuation Framework
• Clearing Agency Stress Testing Framework
• Clearing Agency Investment Policy
• Clearing Agency Policy on Capital Requirements
• Clearing Agency Capital Replenishment Plan

The Clearing Agency Risk Management Framework and the other filed policy documents are collectively referred to as “the Clearing Agency Risk Frameworks”.

Policy Review & Approval

The DTCC Corporate Risk Management Policy, Risk Tolerance Statements and the several Clearing Agency Risk Frameworks identified above are reviewed and approved by the Board and/or Board Risk Committee, annually.

Underlying policies and procedures identified by management as necessary to support compliance with the annual approval requirements of the Covered Clearing Agency Standards are also reviewed and approved by the Board and/or Board Risk Committee, annually.

The three lines of defense approach to risk management begins with the principle that everyone ‒ no matter their role in the organization ‒ is a risk manager. By adhering to this principle and following the organization’s risk management policies and procedures, DTCC is best positioned to execute on its strategy and meet its objectives while staying within established risk tolerances, and when necessary, to quickly address and mitigate risk if any tolerance is breached.

The First Line of Defense

The first line of defense is comprised of the various business lines and supporting functional units including Product Management, Operations, Information Technology and other areas critical to DTCC’s daily operations and functioning. Their mandate is to manage risk proactively on a day-to-day basis.

The Second Line of Defense

The second line of defense is comprised of DTCC’s control functions, including the General Counsel’s Office, Privacy Office, Compliance and areas that fall within the Group Chief Risk Office. Their mandate is to provide advice and guidance to the first line of defense for adhering to established risk standards and/or to monitor compliance with those standards.

The Third Line of Defense

The third line of defense is the Internal Audit Department (IAD). IAD provides an independent and objective view to assist in the organization’s maintenance of effective risk management and control practices. IAD’s mission is to challenge the adequacy of the organization’s control environment.