[Federal Register Volume 82, Number 205 (Wednesday, October 25, 2017)]
[Notices]
[Pages 49456-49462]
[FR Doc No: 2017-23121]

-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

[Release No. 34-81909; File No. SR-OCC-2017-005]

Self-Regulatory Organizations; The Options Clearing Corporation;
Notice of Filing of Proposed Rule Change Related to a Comprehensive
Risk Management Framework

October 19, 2017.
    Pursuant to Section 19(b)(1) of the Securities Exchange Act of 1934
(``Act''),\1\ and Rule 19b-4 thereunder,\2\ notice is hereby given that
on October 10, 2017, The Options Clearing Corporation (``OCC'') filed
with the Securities and Exchange Commission (``Commission'') the
proposed rule change as described in Items I, II, and III below, which
Items have been prepared by OCC. The Commission is publishing this
notice to solicit comments on the proposed rule change from interested
persons.
---------------------------------------------------------------------------

    \1\ 15 U.S.C. 78s(b)(1).
    \2\ 17 CFR 240.19b-4.
---------------------------------------------------------------------------

I. Clearing Agency's Statement of the Terms of Substance of the
Proposed Rule Change

    This purpose of the proposed rule change is to adopt a
comprehensive Risk Management Framework Policy, which would describe
OCC's framework for comprehensive risk management, including OCC's
framework to identify, measure, monitor, and manage all risks faced by
OCC in the provision of clearing, settlement and risk management
services. The Risk Management Framework Policy is included in
confidential Exhibit 5 of the filing. The proposed rule change does not
require any changes to the text of OCC's By-Laws or Rules. All terms
with initial capitalization that are not otherwise defined herein have
the same meaning as set forth in the OCC By-Laws and Rules.\3\
---------------------------------------------------------------------------

    \3\ OCC's By-Laws and Rules can be found on OCC's public Web
site: http://optionsclearing.com/about/publications/bylaws.jsp.
---------------------------------------------------------------------------

II. Clearing Agency's Statement of the Purpose of, and Statutory Basis
for, the Proposed Rule Change

    In its filing with the Commission, OCC included statements
concerning the purpose of and basis for the proposed rule change and
discussed any comments it received on the proposed rule change. The
text of these statements may be examined at the places specified in
Item IV below. OCC has prepared summaries, set forth in sections (A),
(B), and (C) below, of the most significant aspects of these
statements.

(A) Clearing Agency's Statement of the Purpose of, and Statutory Basis
for, the Proposed Rule Change

(1) Purpose
Background
    On September 28, 2016, the Commission adopted amendments to Rule
17Ad-22 \4\ and added new Rule 17Ab2-2 \5\ pursuant to Section 17A of
the Securities Exchange Act of 1934 (``Exchange Act'') \6\ and the
Payment, Clearing and Settlement Supervision Act of 2010 (``Clearing
Supervision Act'') \7\ to establish enhanced standards for the
operation and governance of those clearing agencies registered with the
Commission that meet the definition of a ``covered clearing agency,''
as defined by Rule 17Ad-22(a)(5) \8\ (collectively, the new and amended
rules are herein referred to as ``CCA'' rules). The CCA rules require
that covered clearing agencies, among other things:
---------------------------------------------------------------------------

    \4\ 17 CFR 240.17Ad-22.
    \5\ 17 CFR 240.17Ab2-2.
    \6\ 15 U.S.C. 78q-1.
    \7\ 12 U.S.C. 5461 et seq.
    \8\ 17 CFR 240.17Ad-22(a)(5).

    ``[E]stablish, implement, maintain and enforce written policies
and procedures reasonably designed to . . . [m]aintain a sound risk
management framework for comprehensively managing legal, credit,
liquidity, operational, general business, investment, custody, and
other risks that arise in or are borne by the covered clearing
agency, which . . . [i]ncludes risk management policies, procedures,
and systems designed to identify, measure, monitor, and manage the
range of risks that arise in or are borne by the covered clearing
agency, that are subject to review on a specified periodic basis and
approved by the board of directors annually . . .'' \9\
---------------------------------------------------------------------------

    \9\ 17 CFR 240.17Ad-22(e)(3).

    OCC is defined as a covered clearing agency under the CCA rules,
and therefore is subject to the requirements of the CCA rules,
including Rule 17Ad-22(e)(3).\10\ Accordingly, OCC proposes to adopt a
Risk Management Framework Policy (``RMF''), as described below, to
formalize and update its overall framework for comprehensively managing
the Key Risks \11\ that arise in or are borne by OCC to promote
compliance with Rule 17Ad-22(e)(3).\12\
---------------------------------------------------------------------------

    \10\ Id.
    \11\ Under the proposed RMF, ``Key Risks'' would be defined as
risks that are related to the foundational aspects of CCP clearing,
settlement and risk management services.
    \12\ 17 CFR 240.17Ad-22(e)(3).
---------------------------------------------------------------------------

Proposed Policy
    OCC proposes to adopt a new RMF document. The purpose of the RMF is
to describe OCC's framework for

comprehensive risk management, including OCC's framework to identify,
measure, monitor, and manage all risks faced by OCC in the provision of
clearing, settlement and risk management services. Specifically, the
RMF would establish the context for OCC's risk management framework,
outline OCC's risk management philosophy, describe OCC's Risk Appetite
Framework and use of Risk Tolerances,\13\ describe the governance
arrangements that implement risk management, outline OCC's
identification of Key Risks, and describe OCC's program for enterprise-
wide risk management, including the three lines of defense structure
(discussed below), and describe OCC's approach to risk monitoring,
assessment and reporting. As a single risk management framework
addressing risks across all facets of OCC's business, the RMF would
foster OCC's compliance with the requirements of the CCA rules, and in
particular the requirement of Rule 17Ad-22(e)(3) \14\ that it maintain
a sound framework for comprehensively managing risks.
---------------------------------------------------------------------------

    \13\ Under the proposed RMF, ``Risk Tolerances'' would be
defined as the application of risk appetite to a specific sub-
category or aspect of a Key Risk, typically in quantitative form,
used to set an acceptable levels of risk.
    \14\ 17 CFR 240.17Ad-22(e)(3).
---------------------------------------------------------------------------

Context of OCC's Risk Management Framework
    The RMF would begin by establishing the context for OCC's risk
management framework. Specifically, OCC is a Systemically Important
Financial Market Utility (``SIFMU'') \15\ that serves a critical role
in financial markets as the sole central counterparty (``CCP'') that
provides clearance and settlement services for U.S. listed options and
guarantees the obligations associated with the contracts that it
clears. As a SIFMU, OCC recognizes its role in promoting financial
stability for market participants, investors and the economy and that
it must therefore maintain a sound risk management framework for
comprehensively managing the risks that it presents.
---------------------------------------------------------------------------

    \15\ The Financial Stability Oversight Council designated OCC a
SIFMU on July 18, 2012 pursuant to the Clearing Supervision Act. See
12 U.S.C. 5463.
---------------------------------------------------------------------------

OCC's Risk Management Philosophy
    The proposed RMF would describe OCC's risk management philosophy.
As a SIFMU, OCC must be mindful of the public interest and its
obligation to promote financial stability, reduce the potential for
systemic contagion and support the smooth functioning of the U.S.
financial markets. Furthermore, as a CCP, OCC concentrates financial
risks for the markets it serves by acting as the CCP for all of the
transactions that it clears. As a result of this concentration, OCC's
primary objective is to ensure that it properly manages the financial
risks associated with functioning as a CCP, which primarily relate to
potential clearing member default scenarios.
    As a CCP, OCC's daily operations, among other things, involve
managing financial, operational and business risks. In managing these
risks, OCC's daily operations--which are guided by policies, procedures
and controls--are designed to ensure that financial exposures and
service disruptions are within acceptable limits set by OCC as part of
its Risk Appetite Framework (``RAF'') as described below.
Risk Appetite Framework
    The proposed RMF would describe OCC's RAF and use of Risk
Tolerances. The purpose of the RAF is to establish OCC's overall
approach to managing risks at the enterprise level in an effective and
integrated fashion. The RAF establishes the level and types of Key
Risks, described in further detail below, that OCC is willing and able
to assume in accordance with OCC's mission as a SIFMU. Under the RAF,
Risk Appetite Statements \16\ would be used to express OCC's judgment,
for each of OCC's Key Risks, regarding the level of risk that OCC is
willing to accept related to the provision of CCP services. These
statements would be qualitative indications of appetite that set the
tone for OCC's approach to risk taking, and are indicative of the level
of resources or effort OCC puts forth to prevent or mitigate the impact
of a Key Risk.
---------------------------------------------------------------------------

    \16\ Under the proposed RMF, ``Risk Appetite Statement'' would
be defined as a statement that expresses OCC's judgment, for each of
OCC's Key Risks, regarding the level of risk OCC is willing to
accept related to the provision of CCP services.
---------------------------------------------------------------------------

    Under the RMF, Risk Appetite Statements would be set annually by
each department associated with a Key Risk in cooperation with OCC's
Enterprise Risk Management department (``ERM'') according to applicable
procedures. OCC's risk appetite levels would be classified into four
categories:
    1. No appetite: OCC is unwilling to deliberately accept any level
of risk.
    2. Low appetite: OCC devotes significant resources to managing risk
but may choose to accept certain risks that do not materially affect
core clearing and settlement because the level of resources that OCC
would be required to put forth to mitigate the risks would be
impractical.
    3. Moderate appetite: OCC is willing to engage in certain
activities that pose risks because those activities may bring longer-
term efficiencies or result in business opportunities even though the
activities or new businesses may pose new risks to OCC.
    4. High appetite: OCC is willing to implement a new high-risk
process or business opportunity; however, it is unlikely OCC would
apply this level of appetite to a Key Risk absent a compelling, urgent
business need.
    Under the RMF, OCC's Board would have ultimate responsibility for
reviewing and approving the Risk Appetite Statements in connection with
each Key Risk on an annual basis upon recommendation of OCC's
Management Committee.
    The Risk Appetite Statements allow OCC to carefully calibrate the
levels of risk it accepts for each of its Key Risks to be consistent
with OCC's core mission of promoting financial stability in the markets
it serves. Accordingly, the RAF helps to ensure that OCC has an
effective and comprehensive framework for managing its Key Risks (e.g.,
legal, credit, liquidity, operational, general business, investment,
custody and other risks that arise in or are borne by OCC).\17\
---------------------------------------------------------------------------

    \17\ OCC's Key Risks are described below in the discussion
covering OCC's identification of its material risks.
---------------------------------------------------------------------------

    In addition to Risk Appetite Statements, the RMF would require that
OCC assign Risk Tolerances to the Key Risks contained within the RMF as
approved by OCC's Board. While the Risk Appetite Statements would be
more high-level and principles-based, Risk Tolerances would
comparatively be more granular and represent the application of OCC's
risk appetite to specific sub-categories or aspects of Key Risks. The
purpose of the proposed Risk Tolerances is to ensure that OCC sets
acceptable levels of risk within those specified sub-categories of Key
Risks. Risk Tolerances would be stated in either quantitative or
qualitative terms, depending on the nature of the risk and OCC's
ability to measure it.
    Under the RMF, each department would be required to establish Risk
Tolerances at least annually for sub-categories of Key Risks that are
within their relevant domains of responsibility and would be
responsible for managing applicable risks within established tolerance
levels. ERM staff would monitor Risk Tolerances through quantitative
metrics, where applicable, and compile such monitoring in a report that
the Chief Risk Officer shall present to OCC's Management Committee and

Board (or a committee thereof) at least quarterly. In addition, the RMF
would require that OCC's Board evaluate its Risk Tolerances at least
annually, and more frequently if necessary as a result of changes to
products, processes, market conventions or other changes to OCC's
material risks.
Identification of Key Risks
    The proposed RMF would identify risks that could affect OCC's
ability to perform services as expected, and the process for
identifying such risks would take a broad view to include: (i) Direct
financial and operational risks that may prevent the smooth functioning
of CCP services, (ii) reputational risks that could undermine the
perception of OCC as a sound pillar in the financial market and (iii)
the risks OCC faces from third parties, such as custodians and
settlement banks, that are critical to the design and operation of
OCC's infrastructure and risk management. Identifying Key Risks in this
manner would facilitate OCC's ability to comprehensively manage the
legal, credit, liquidity, operational, general business, investment,
custody and other risks that arise in or are borne by it. Based on this
identification process, the RMF would define OCC's Key Risks as
described below.
Financial Risk
    The RMF would indicate that financial risk encompasses many aspects
of risk at OCC, including the risks that a Clearing Member will be
unable to meet its obligations when due or that OCC will not maintain
sufficient financial resources to cover exposures (i.e., credit risk),
the risk that OCC will not maintain sufficient liquid resources to meet
its same day and, where appropriate, intraday and multiday settlement
of payment obligations (i.e., liquidity risk), the risk that OCC will
incur losses on overnight investments (i.e., investment risk), and the
risk that financial models are inaccurate (i.e., model risk).
    The proposed RMF would require OCC's credit risk management
framework to encompass policies and procedures for maintaining
sufficient prefunded resources in the form of margin and Clearing Fund
deposits, accepting collateral from participants that is low risk and
high quality, monitoring the creditworthiness and operational
reliability of all counterparties, including participants, custodians,
settlement banks, liquidity providers, and linked financial market
utilities (``FMUs''), and maintaining a waterfall of resources to be
used in the event of participant default and a process for replenishing
resources.
    In addition, the RMF would require OCC's liquidity risk framework
to encompass sizing liquidity resources to cover liquidity needs in the
event of the default of the largest Clearing Member Group, forecasting
daily settlements needs under normal market conditions, maintaining
liquid resources in the form of cash and committed facilities,
maintaining a contingency funding plan and periodically reviewing the
size of liquidity resources, maintaining liquidity resources at
creditworthy custodians and monitoring the financial and operational
performance of financial institutions and committed liquidity
facilities, and investing liquidity resources in safe overnight
investments or at a Federal Reserve Bank.
    Moreover, the RMF would require OCC to address investment risks by
maintaining an account at a Federal Reserve Bank, which bears no
investment risk, and investing funds not held at the Federal Reserve
Bank in high quality liquid assets. The RMF would also require OCC to
manage model risk through a model development program, independent
model validation and strong governance arrangements for the approval of
new models or models with material changes in accordance with relevant
policies.
Operational Risk
    The RMF would define operational risk as the risk of disruptions in
OCC's CCP services due to: (i) Deficiencies in internal controls,
processes or information systems, (ii) human error or misconduct, or
(iii) external events or intrusions. The definition of operational risk
would also cover deficiencies related to information technology
(``IT''), such as data security and IT systems reliability. To reflect
the importance OCC assigns to managing IT risks, the RMF would also
categorize IT risk as a separate Key Risk, discussed below.
    The RMF would also assert that OCC manages operational risks in
number of ways, including that OCC: (i) Maintains an Enterprise Project
Management Program that performs initial assessments of proposed
projects and manages project execution, to ensure that proper oversight
exists during the initiation, planning, execution and delivery of OCC
corporate projects, (ii) maintains a Business Continuity Program to
support continuance of critical services in the event of a catastrophic
loss of infrastructure and/or staff (including a Crisis Management
Plan, which outlines OCC's processes for decision-making in crisis or
emergency circumstances), (iii) maintains a comprehensive third-party
risk management program which includes requirements for onboarding and
ongoing monitoring of third parties on which OCC relies (such as
vendors, settlement banks and FMUs with linkages to OCC) performed by
various areas of the organization, including National Operations,
Collateral Services, Credit Risk, and ERM, (iv) provides training and
development through its Human Resources Department to ensure staff
maintains and develops the necessary knowledge and skills to perform
their jobs, and (v) conducts training on business ethics and OCC's Code
of Conduct.
Operational Risk--Information Technology
    The RMF also would address operational risks specifically related
to IT as a distinct Key Risk. Operational risk related to IT would be
defined as the risk that inadequate levels of system functionality,
confidentiality, integrity, availability, capacity or resiliency for
systems that support core clearing, settlement or risk management
services or critical business functions results in disruptions in OCC
services. In addition to the ways described above that OCC manages
operational risks generally, the RMF would also provide that OCC
manages IT operational risks by maintaining a: (i) Quality Standards
Program, which includes targets that set performance standards for
systems operations, (ii) cybersecurity program, and (iii) program to
maintain system functionality and capacity.
Legal Risk
    The RMF would define legal risk as the risk that OCC's by-laws,
rules, policies and procedures do not provide for a well-founded,
clear, transparent, and enforceable legal basis for each aspect of its
activities in all relevant jurisdictions. The RMF would also provide
that OCC manages legal risk by: (i) Maintaining rules, policies, and
contracts that are consistent with applicable laws and regulations and
(ii) maintaining legal agreements that establish counterparty
obligations regarding the material aspects of its clearing, settlement
and risk management services, including, but not limited to, settlement
finality, vendor performance, exchange performance, options exercise
and cross-margining obligations.
General Business Risk
    The RMF would define general business risk as the risk of any
potential

impairment of OCC's financial condition due to declines in its revenue
or growth in its expenses arising from OCC's administration and
operation as a business enterprise (as opposed to a participant's
default), resulting in expenses that exceed revenues and losses that
must be charged against OCC's capital.
    The RMF would provide that OCC manages general business risk by:
(i) Maintaining a target capital level of liquid net assets funded by
equity equal to the greater of six-months' operating expenses or the
amount sufficient to ensure a recovery or orderly wind-down of OCC's
operations as set forth in OCC's recovery and wind-down plan, and a
plan that provides for capital replenishment in the event of non-
default losses in excess of target capital, (ii) maintaining a
corporate planning program to manage new business activity, and (iii)
actively managing the public perception of OCC.
Risk Management Governance
    The RMF would describe the governance arrangements through which
OCC implements its risk management philosophy. These governance
arrangements would include the responsibilities of the Board, the
Board's committees and management in establishing and executing OCC's
risk management framework. These responsibilities are described in
further detail below.
    The RMF would provide that OCC's risk governance framework follows
a hierarchical structure that begins with the Board, which has ultimate
oversight responsibility for OCC's risk management activities. The
Board performs an oversight role to ensure that OCC is managed and
operated in a manner consistent with OCC's regulatory responsibilities
as a SIFMU providing clearance and settlement services. The Board also
is responsible for ensuring that OCC has governance arrangements that,
among other things, prioritize the safety and efficiency of OCC through
the proposed risk management framework. Moreover, under the RMF, the
Board is responsible for overseeing OCC's risk management policies,
procedures and systems designed to identify, measure, monitor and
manage risks consistent within the Risk Appetite Statements and Risk
Tolerances approved by the Board. The RMF also provides that the Board
is responsible for overseeing and approving OCC's recovery and orderly
wind-down plan (consistent with OCC's Board of Directors Charter).
    To carry out these responsibilities, the RMF would indicate that
the Board has established Committees to assist in overseeing OCC's Key
Risks. These Committees are: (i) The Audit Committee, (ii) the
Compensation and Performance Committee, (iii) the Governance and
Nominating Committee, (iv) the Risk Committee, and (v) the Technology
Committee. The responsibilities of these committees to manage OCC's Key
Risks are outlined in their respective committee charters.\18\
---------------------------------------------------------------------------

    \18\ OCC's Board and Board committee charters are available on
OCC's public Web site: https://www.theocc.com/about/corporate-information/what-is-occ.jsp.
---------------------------------------------------------------------------

    The RMF would also provide that OCC's Management Committee is
responsible for annually reviewing and approving the RMF--and the Risk
Appetite Statements and Risk Tolerances established thereunder--and
recommending further approval thereof to the Board. The Management
Committee would also review reports related to metrics for assessing
Risk Tolerances to determine whether OCC's Key Risks are behaving
within established tolerances and take or recommend action as needed to
return Key Risks to their appropriate levels and escalate exceptions to
Risk Tolerances and Risk Appetite Statements to relevant Board
committees. The Management Committee would also be permitted to
establish working groups to assist it in the management of Key Risks.
Risk Management Practice
    The RMF would describe OCC's program for enterprise-wide risk
management. The internal structures for risk management described in
the proposed RMF are intended to follow programs generally accepted in
the financial services industry, including the ``three lines of
defense'' model (i.e., front line employees, enterprise risk/compliance
functions and internal audit) and a program for internal controls that
includes risk assessment and reporting.
``Three Lines of Defense''
    To maintain a resilient risk management and internal control
infrastructure, the RMF would formalize OCC's ``three lines of
defense'' model, which allows OCC to manage its control infrastructure
with clarity of ownership and accountability. The first line of defense
consists of OCC's operational business units, including Financial Risk
Management, National Operations, technology, legal, regulatory affairs
and corporate functions such as human resources, finance, accounting
and project management. The first line is responsible and accountable
for designing, owning and managing risks by maintaining policies,
procedures, processes and controls to manage relevant risks. The first
line would also be responsible and accountable for internal controls
and implementing corrective action to address control deficiencies.
    The first line is supported and monitored by the second line of
defense, which consists of the ERM, Compliance, Security Services and
Model Validation Group functions. The second line is an oversight
function and is responsible for designing, implementing and maintaining
an enterprise-wide risk management and compliance program and tools to
assess and manage risk at the enterprise level. The second line would
also work with the first line to assess risks and establish policies
and guidelines, and advise, monitor and report on the first line's
effectiveness in managing risk and maintaining and operating a
resilient control infrastructure. The second line reports to OCC's
Management Committee and Board (or committee thereof) on the first line
of defense's effectiveness in managing risk and compliance and an
assessment of whether OCC's services are being delivered within Risk
Appetite Statements and Risk Tolerances.
    The third line of defense consists of OCC's internal audit
function. The third line reports to the Audit Committee of the Board
and is accountable for designing, implementing and maintaining a
comprehensive audit program that allows senior management and the Board
to receive independent and objective assurance that the quality of
OCC's risk management and internal control infrastructure is consistent
with OCC's risk appetite and Risk Tolerances. The RMF also would
require that OCC's Internal Audit department maintains a diverse and
skilled team of professionals with a variety of business, technology
and audit skills, and perform all of its activities in compliance with
the Institute of Internal Auditors' standards found in the
International Professional Practices Framework.
    The three lines of defense model is designed to provide for a
robust governance structure that distinguishes among the three lines
involved in the effective and comprehensive management of risk at OCC:
The functions that own and manage risks, the functions that oversee and
provide guidance on the management of risks, and the functions that
provide independent and objective assurance of the robustness and
appropriateness of risk management and internal controls.

Risk Assessments
    In furtherance of the three lines of defense model, the RMF would
provide for risk identification and assessment programs described below
to identify, measure, and monitor current and emerging risks at OCC.
Findings or recommendations that result from the assessments would be
documented, monitored and escalated through the appropriate governance
according to applicable OCC policies and procedures.
    One such assessment--the Enterprise Risk Assessment--would be
conducted by OCC's first line of defense in conjunction with ERM. The
Enterprise Risk Assessment would analyze risks based on: (i) Inherent
Risk,\19\ (ii) quality of risk management, and (iii) Residual Risk \20\
to provide OCC information on the quantity of risk in a certain
functional area or business area, and provide a mechanism to prioritize
risk mitigation activities. ERM would use analysis of Residual Risk in
conjunction with metrics related to Risk Tolerances to develop a risk
profile and determine whether a Key Risk is within in appetite and
provide OCC's Management Committee and Board (or committee thereof)
information on the quantity of risk in a certain functional area or
business area, which would provide a mechanism to prioritize risk
mitigation activities.
---------------------------------------------------------------------------

    \19\ Under the Policy, ``Inherent Risk'' would be defined as the
absolute level of risk exposure posed by a process or activity prior
to the application of controls or other risk-mitigating factors.
    \20\ Under the Policy, ``Residual Risk'' would be defined as t
level of risk exposure posed by a process or activity after the
application of controls or other risk-mitigating factors.
---------------------------------------------------------------------------

    Another such assessment--the Scenario Analysis Program--would be a
method for identifying risks that may not be otherwise captured in
OCC's risk statements. ERM, in cooperation with the first line of
defense, would design simulations of potential disruptions, and
business unit staff would be able to identify risks that may not have
been previously uncovered or identify weaknesses in current controls.
ERM would include potential risks identified through the Scenario
Analysis Program in its analysis of, and reporting on, the quantity of
risk within a certain Key Risk and whether the Key Risk is within
appetite.
    A third assessment--the IT Risk Assessment Program--would be
conducted by OCC's Security Services department prior to the
procurement, development, installation, and operation of IT services
and systems. This assessment would be triggered by certain events that
may affect the nature or level of IT risks OCC faces, such as
evaluation or procurement of a new system or technology, changes in OCC
business processes that affect current services and systems, and the
emergence of new threats that subvert existing controls and that
require a new technology mitigation. OCC would also conduct periodic
assessments.
    A fourth assessment would be conducted by OCC's compliance function
to identify and measure regulatory compliance risks. The assessment
would also provide OCC's compliance function with a basis for
prioritizing testing and training activities.
Risk Reporting
    Under the RMF, ERM would be responsible for completing a review and
reporting process that provides OCC's Management Committee and Board
(or committee thereof) with the information necessary to fulfill their
obligations for risk management and oversight of risk management
activities, respectively. This reporting would be designed to assist
OCC's Management Committee and Board (or committee thereof) in
understanding the most significant risks faced by OCC from a process
perspective and determining whether Risk Tolerances are being managed
in accordance with Risk Appetite Statements. On a quarterly basis, ERM
would provide a risk report with a summary analysis of risk appetite
and risk profile that includes analysis of Residual Risks from the
Enterprise Risk Assessment program, reporting on Risk Tolerances and
recommendations for prioritization of risk mitigation activities. The
reporting process would indicate procedures for escalation in the event
of a breach of Risk Tolerance.
Control Activities
    Under the RMF, the Compliance Department would be responsible for
maintaining an inventory of all business processes and associated
controls. OCC would also provide guides to assist staff in documenting
their control activities in a consistent way and periodically conduct
training on the importance of a strong risk and control environment. In
addition, on at least an annual basis, the Compliance Department would
be required to conduct training to assist OCC staff in understanding
their respective responsibilities in implementing OCC's risk and
control environment.
(2) Statutory Basis
    Section 17A(b)(3)(F) of the Act \21\ requires, in part, that the
rules of a clearing agency be designed to promote the prompt and
accurate clearance and settlement of securities transactions, to assure
the safeguarding of securities and funds in the custody or control of
the clearing agency or for which it is responsible, and in general, to
protect investors and the public interest. As described above, the RMF
is designed to formalize, clarify, and streamline OCC's overall
framework for comprehensively managing risks. Specifically, the RMF
would describe OCCs overall framework for comprehensive risk
management, including OCC's framework to identify, measure, monitor and
manage all risks faced by OCC in the provision of clearing, settlement
and risk management services. In particular, the RMF would establish
the context for OCC's risk management framework, outline OCC's risk
management philosophy, describe OCC's Risk Appetite Framework and use
of Risk Tolerances, describe the governance arrangements that implement
risk management, outline OCC's identification of Key Risks and describe
OCC's program for enterprise-wide risk management, including the three
lines of defense structure and OCC's approach to risk monitoring,
assessment and reporting.
---------------------------------------------------------------------------

    \21\ 15 U.S.C. 78q-1(b)(3)(F).
---------------------------------------------------------------------------

    The proposed rule change would formalize the risk management
framework OCC currently employs in a single document and would
therefore serve as a guide for readers to understand OCC's
comprehensive framework for managing risk and its universe of risk
management policies. Moreover, by describing some of the ways that OCC
manages its risks, the RMF would serve as a basis for the processes,
policies, procedures and other documents that OCC may develop and
maintain to facilitate those risk management activities. As a result,
OCC believes the proposed rule change is designed to promote the prompt
and accurate clearance and settlement of securities transactions,
assure the safeguarding of securities and funds in the custody or
control of the clearing agency or for which it is responsible, and in
general, to protect investors and the public interest in accordance
with Section 17A(b)(3)(F) of the Act.\22\
---------------------------------------------------------------------------

    \22\ Id.
---------------------------------------------------------------------------

    Rule 17Ad-22(e)(3) \23\ requires, in part, that a covered clearing
agency ``establish, implement, maintain and enforce written policies
and procedures

reasonably designed to . . . [m]aintain a sound risk management
framework for comprehensively managing legal, credit, liquidity,
operational, general business, investment, custody, and other risks
that arise in or are borne by the covered clearing agency, which . . .
[i]ncludes risk management policies, procedures, and systems designed
to identify, measure, monitor, and manage the range of risks that arise
in or are borne by the covered clearing agency, that are subject to
review on a specified periodic basis and approved by the board of
directors annually . . .'' OCC believes that the proposed rule change
is also consistent with Rule 17Ad-22(e)(3) \24\ because the RMF
describes OCC's comprehensive framework for identifying, measuring,
monitoring and managing the risks that arise within OCC or are borne by
it, including legal, credit, liquidity, operational, general business,
investment and custody risk. For example, the RMF describes OCC's
framework for identifying its Key Risks and the relevant policies that
OCC maintains to address those risks. Moreover, the RMF would establish
a foundation of OCC's risk management practice by describing OCC's
enterprise-wide risk management framework. This framework incorporates
established principles employed across the financial services industry,
such as the ``three lines of defense'' model for enterprise-wide risk
management, to ensure that OCC maintains and operates a resilient,
effective and reliable risk management and internal control
infrastructure that assures risk management and processing outcomes
expected by OCC stakeholders. This framework also describes how OCC's
second line of defense monitors the risks that arise in or are borne by
OCC through a variety of risk assessment, risk reporting and internal
control management activities, consistent with the requirements of Rule
17Ad-22(e)(3).\25\
---------------------------------------------------------------------------

    \23\ 17 CFR 240.17Ad-22(e)(3).
    \24\ Id.
    \25\ Id.
---------------------------------------------------------------------------

    The RMF also describes OCC's RAF and use of Risk Appetite
Statements and Risk Tolerances to ensure that OCC sets appropriate
levels and types of Key Risks that OCC is willing and able to assume in
accordance with OCC's mission as a SIFMU. For example, the use of Risk
Appetite Statements ensures that OCC can carefully calibrate the levels
of risk it accepts for each Key Risk in a manner consistent with OCC's
core mission of promoting financial stability in the markets it serves.
In addition, the use of Risk Tolerances helps to ensure that OCC sets
acceptable levels of risk within specified sub-categories of Key Risks,
and which may also be used to set thresholds for acceptable variability
in risk levels and to provide clear and transparent escalation triggers
when the thresholds are breached. As a result, OCC believes the RMF is
reasonably designed to provide for a sound, comprehensive framework for
identifying, measuring, monitoring and managing the range of risks that
arise in or are borne by OCC in a manner consistent with Rule 17Ad-
22(e)(3).\26\
---------------------------------------------------------------------------

    \26\ Id.
---------------------------------------------------------------------------

    The proposed rule change is not inconsistent with the existing
rules of OCC, including any other rules proposed to be amended.

(B) Clearing Agency's Statement on Burden on Competition

    Section 17A(b)(3)(I) of the Act \27\ requires that the rules of a
clearing agency not impose any burden on competition not necessary or
appropriate in furtherance of the purposes of the Act. OCC does not
believe that the proposed rule change would impact or impose any burden
on competition. The proposed rule change would formalize the framework
OCC uses internally to identify, monitor and manage its risks in a more
transparent and understandable way. While the proposed rule change
would update OCC's internal risk management framework document, this
update does not affect Clearing Members' access to OCC's services or
impose any direct burdens on Clearing Members. Accordingly, the
proposed rule change would not unfairly inhibit access to OCC's
services or disadvantage or favor any particular user in relationship
to another user.
---------------------------------------------------------------------------

    \27\ 15 U.S.C. 78q-1(b)(3)(I).
---------------------------------------------------------------------------

(C) Clearing Agency's Statement on Comments on the Proposed Rule Change
Received From Members, Participants or Others

    Written comments on the proposed rule change were not and are not
intended to be solicited with respect to the proposed rule change and
none have been received.

III. Date of Effectiveness of the Proposed Rule Change and Timing for
Commission Action

    Within 45 days of the date of publication of this notice in the
Federal Register or within such longer period up to 90 days (i) as the
Commission may designate if it finds such longer period to be
appropriate and publishes its reasons for so finding or (ii) as to
which the self- regulatory organization consents, the Commission will:
    (A) By order approve or disapprove the proposed rule change, or
    (B) institute proceedings to determine whether the proposed rule
change should be disapproved.

IV. Solicitation of Comments

    Interested persons are invited to submit written data, views and
arguments concerning the foregoing, including whether the proposed rule
change is consistent with the Act. Comments may be submitted by any of
the following methods:

Electronic Comments

     Use the Commission's Internet comment form (http://www.sec.gov/rules/sro.shtml); or
     Send an email to [email protected]. Please include
File Number SR-OCC-2017-005 on the subject line.

Paper Comments

     Send paper comments in triplicate to Secretary, Securities
and Exchange Commission, 100 F Street NE., Washington, DC 20549-1090.

All submissions should refer to File Number SR-OCC-2017-005. This file
number should be included on the subject line if email is used. To help
the Commission process and review your comments more efficiently,
please use only one method. The Commission will post all comments on
the Commission's Internet Web site (http://www.sec.gov/rules/sro.shtml). Copies of the submission, all subsequent amendments, all
written statements with respect to the proposed rule change that are
filed with the Commission, and all written communications relating to
the proposed rule change between the Commission and any person, other
than those that may be withheld from the public in accordance with the
provisions of 5 U.S.C. 552, will be available for Web site viewing and
printing in the Commission's Public Reference Room, 100 F Street NE.,
Washington, DC 20549, on official business days between the hours of
10:00 a.m. and 3:00 p.m. Copies of such filing also will be available
for inspection and copying at the principal office of OCC and on OCC's
Web site at http://www.theocc.com/components/docs/legal/rules_and_bylaws/sr_occ_17_005.pdf. All comments received will be
posted without change; the Commission does not edit personal
identifying information from submissions. You should submit only
information that you wish to make available publicly. All submissions
should refer to File

Number SR-OCC-2017-005 and should be submitted on or before November
15, 2017.

    For the Commission, by the Division of Trading and Markets,
pursuant to delegated Authority.\28\
---------------------------------------------------------------------------

    \28\ 17 CFR 200.30-3(a)(12).
---------------------------------------------------------------------------

Eduardo A. Aleman,
Assistant Secretary.
[FR Doc. 2017-23121 Filed 10-24-17; 8:45 am]
 BILLING CODE 8011-01-P


[Federal Register Volume 87, Number 116 (Thursday, June 16, 2022)]
[Notices]
[Pages 36312-36313]
[FR Doc No: 2022-12997]

=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF ENERGY

Federal Energy Regulatory Commission

[Project No. 15275-000]

Joe Stephens; Notice of Preliminary Permit Application Accepted
for Filing and Soliciting Comments, Motions To Intervene, and Competing
Applications

    On May 31, 2022, Mr. Joe Stephens filed an application for a
preliminary permit, pursuant to section 4(f) of the Federal Power Act
(FPA), proposing to study the feasibility of the Joe Stephens Small
Hydroelectric Power #1 (Small Hydroelectric Power #1 or project) to be
located on the east coast of Baranof Island, near Sitka, Alaska. The
sole purpose of a preliminary permit, if issued, is to grant the permit
holder priority to file a license application during the permit term. A
preliminary permit does not authorize the permit holder to perform any
land-disturbing activities or otherwise enter upon lands or waters
owned by others without the owners' express permission.
    The proposed project would consist of the following: (1) a lake
with a surface area of 148 acres, having a total storage capacity of
45,000,000 cubic-feet at a normal maximum operating elevation of 460
feet above mean sea level (msl); (2) an intake structure at a set
distance below the lake level that will limit the amount of potential
draw down; (3) an approximately 1,000 foot penstock (engineering
specifications still to be determined); (4) a power house; (5) a single
500-kW turbine; (6) an approximately 100 foot tailrace conduit
connecting the turbine outlet with Nelson Bay; (7) a charging station
that will supply power to floating vessels in the vicinity of the
project; and (8) appurtenant facilities.
    The estimated annual generation of the Project would be 4,104 MW-
hr.
    Applicant Contact: Joe Stephens, 3609 Tongass Ave., #5416,
Ketchikan, AK 99901,<PHONE_NUMBER>.
    FERC Contact: Jeffrey Ackley at [email protected].
    Deadline for filing comments, motions to intervene, competing
applications (without notices of intent), or notices of

intent to file competing applications: 60 days from the issuance of
this notice. Competing applications and notices of intent must meet the
requirements of 18 CFR 4.36.
    The Commission strongly encourages electronic filing. Please file
comments, motions to intervene, notices of intent, and competing
applications using the Commission's eFiling system at http://www.ferc.gov/docs-filing/efiling.asp. Commenters can submit brief
comments up to 6,000 characters, without prior registration, using the
eComment system at http://www.ferc.gov/docs-filing/ecomment.asp. You
must include your name and contact information at the end of your
comments. For assistance, please contact FERC Online Support at
[email protected],<PHONE_NUMBER> (toll free), or (202) 502-
8659 (TTY). In lieu of electronic filing, please send a paper copy to:
Secretary, Federal Energy Regulatory Commission, 888 First Street NE,
Washington, DC 20426. The first page of any filing should include
docket number P-15275-000.
    More information about this project, including a copy of the
application, can be viewed or printed on the ``eLibrary'' link of
Commission's website at http://www.ferc.gov/docs-filing/elibrary.asp.
Enter the docket number (P-15275) in the docket number field to access
the document. For assistance, contact FERC Online Support.

    Dated: June 10, 2022.
Debbie-Anne A. Reese,
Deputy Secretary.
[FR Doc. 2022-12997 Filed 6-15-22; 8:45 am]
BILLING CODE 6717-01-P