Notice2024-26869
Self-Regulatory Organizations; ICE Clear Credit LLC; Notice of Filing of Proposed Rule Change Relating to the ICC Operational Risk Management Framework
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
November 19, 2024
Issuing agencies
Securities and Exchange Commission
Full Text
<html>
<head>
<title>Federal Register, Volume 89 Issue 223 (Tuesday, November 19, 2024)</title>
</head>
<body><pre>
[Federal Register Volume 89, Number 223 (Tuesday, November 19, 2024)]
[Notices]
[Pages 91443-91446]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2024-26869]
=======================================================================
-----------------------------------------------------------------------
SECURITIES AND EXCHANGE COMMISSION
[Release No. 34-101603; File No. SR-ICC-2024-011]
Self-Regulatory Organizations; ICE Clear Credit LLC; Notice of
Filing of Proposed Rule Change Relating to the ICC Operational Risk
Management Framework
November 13, 2024.
Pursuant to Section 19(b)(1) of the Securities Exchange Act of
1934,\1\ and Rule 19b-4 thereunder,\2\ notice is hereby given that on
October 31, 2024, ICE Clear Credit LLC (``ICC'') filed with the
Securities and Exchange Commission (``Commission'') the proposed rule
change, as described in Items I, II and III below, which Items have
been primarily prepared by ICC. The Commission is publishing this
notice to solicit comments on the proposed rule change from interested
persons.
---------------------------------------------------------------------------
\1\ 15 U.S.C. 78s(b)(1).
\2\ 17 CFR 240.19b-4.
---------------------------------------------------------------------------
I. Clearing Agency's Statement of the Terms of Substance of the
Proposed Rule Change
The principal purpose of the proposed rule change is to revise the
Operational Risk Management Framework. These revisions do not require
any changes to the ICC Clearing Rules (the ``Rules'').
II. Clearing Agency's Statement of the Purpose of, and Statutory Basis
for, the Proposed Rule Change
In its filing with the Commission, ICC included statements
concerning the purpose of and basis for the proposed rule change,
security-based swap submission, or advance notice and discussed any
comments it received on the proposed rule change, security-based swap
submission, or advance notice. The text of these statements may be
examined at the places specified in Item IV below. ICC has prepared
summaries, set forth in sections (A), (B), and (C) below, of the most
significant aspects of these statements.
(A) Clearing Agency's Statement of the Purpose of, and Statutory Basis
for, the Proposed Rule Change
(a) Purpose
ICC proposes to revise its ORMF. The ORMF details ICC's dynamic and
independent program of risk assessment and oversight that aims to
reduce operational incidents, encourage process, and control
improvement, bring transparency to operational performance standard
monitoring, and fulfill regulatory obligations. ICC believes such
proposed revisions will facilitate the prompt and accurate clearance
and settlement of securities transactions and derivative agreements,
contracts, and transactions for which it is responsible. ICC proposes
to make such changes effective following Commission approval of the
proposed rule change. The proposed revisions are described in detail as
follows.
The primary purpose of the proposed revisions is to incorporate
procedures designed to comply with Commission Rule 17Ad-25(i) \3\ which
imposes requirements on ICC related to the management of risks from
relationships with service providers for core services \4\ (``SPCS'').
ICC proposes adding new Section II.B. `Management of Risks from
Relationships with Service Providers for Core Services' to the ORMF
which adds procedures regarding ICC's management of the risks related
to relationships with SPCS. Specifically, proposed Section II.B.
imposes the following requirements on ICC: (1) ICC senior management is
required to evaluate and document the risks related to an agreement
with a SPCS, including under changes to circumstances and potential
disruptions, and whether the risks can be managed in a manner
consistent with the ORMF; (2) ICC senior management is required to
submit to the Board for review and approval any agreement that would
establish a relationship with a SPCS, along with a risk evaluation
described in (1) above; (3) ICC senior management is required to
establish policies and procedures that govern relationships and manage
risks related to such agreements with SPCS and the Board is required to
be responsible for reviewing and approving such policies and
procedures; and (4) ICC senior management is required to perform
ongoing monitoring of the relationships with SPCS, and report to the
Board which will provide its evaluation of any action taken by ICC
senior management to remedy significant deterioration in performance or
address changing risks or material issues identified through such
monitoring, or if the risks or issues cannot be remedied, require ICC
senior management to assess and document weaknesses or deficiencies in
the relationship with the SPCS for submission to the Board. Also, ICC
proposes to include in new Section II.B. a description of how ICC will
identify
[[Page 91444]]
and manage its SPCS using a two-pronged assessment approach broken down
between internal and external service providers. With respect to
internal service providers, the proposed addition to the ORMF describes
certain services provided by ICC's ultimate parent, Intercontinental
Exchange, Inc. (``ICE, Inc.'') and the applicable legal agreements
between ICC and ICE, Inc. With respect to the identification and
oversight of external service providers, the proposed revisions to the
ORMF describe the use of ICE, Inc.'s third party risk management
program and of ICC's counterparty monitoring procedures. As a result of
the proposed addition of new Section II.B., the remainder of the ORMF
has been re-lettered.
---------------------------------------------------------------------------
\3\ 17 CFR 240.17ad-25(i).
\4\ Commission Rule 17ad-25(a) defines `Service Provider for
Core Services' as any person that, through a written services
provider agreement for services provided to or on behalf of a
registered clearing agency, on an ongoing basis, directly supports
the delivery of clearance or settlement functionality or any other
purposes material to the business of the registered clearing agency.
---------------------------------------------------------------------------
ICC further proposes to revise and replace the former `Vendor
Assessment' processes in Section II.B. with updated Section II.C.
`External Service Provider Assessments' processes. Accordingly, the
proposed revisions include renaming ``critical vendors'' as ``external
SPCS'' and, together with new Section II.B., clarifying that ICC's
assessment of external SPCS is in addition to, and will take into
consideration, ICE, Inc.'s third party risk management program. ICC
proposes to remove the bullet point list of items that may be included
in the risk assessments and replace it with language to mirror the
regulatory requirement of new Commission Rule 17ad-25(i).\5\ In
particular, ICC, through its BCP and DR Oversight Committee \6\
(``BDOC''), must evaluate and document the risks related to an
agreement with an external SPCS, including under changes to
circumstances and potential disruptions, and whether the risks can be
managed in a manner consistent with the ORMF. ICC also proposes
updating and reordering the language describing the responsibilities of
the BDOC. The BDOC will continue to review and recommend approval of
the inventory of ICC external SPCS (formerly the ``critical vendor''
inventory) and will continue to assign risk ratings to the risk
assessments in order to determine the frequency of ongoing risk
assessment reviews. The risk ratings continue to be based on the risk
assessments and consideration of the risk direction for strategic,
reputational, compliance, legal, and operational risk presented by the
external SPCS (formerly critical vendor). ICC is proposing to also
clarify that the risk ratings will take into consideration ICC's plan
to complete core processing if the service is unavailable. In order to
provide for more internal consistency, ICC is proposing to replace the
terminology of ``Tier'' with ``Risk Rating'' noting that the criteria
and schedule for periodic reviews remains the same.
---------------------------------------------------------------------------
\5\ 17 CFR 240.17ad-25(i).
\6\ The ICC BCP and DR Oversight Committee is a subcommittee of
the ICC Compliance Committee and assists the ICC Compliance
Committee in fulfilling its oversight responsibilities with respect
to: (i) providing Business Continuity Planning (``BCP'') and
Disaster Recovery (``DR'') guidance; (ii) approving BCP and DR
program documentation; (iii) reviewing reports on the effectiveness
of BCP and DR testing; and (iv) the performance of such other
functions as the ICC Compliance Committee may assign from time to
time.
---------------------------------------------------------------------------
Furthermore, ICC proposes clarifications to the `Introduction'
section of the ORMF to provide uniform abbreviations to existing
defined terms. By incorporating these abbreviations, ICC aims to
enhance the clarity and readability of the ORMF.
Also, ICC proposes revising the `Operational Risk Lifecycle' chart
in Section I. of the ORMF to replace ``Respond'' with ``Monitor,'' and
to replace ``Monitor'' with ``Mitigate.'' The purpose of the revisions
to the Operational Risk Lifecycle chart is to ensure that it accurately
reflects the description of the operational life cycle narrative
contained in Section I. Furthermore, ICC proposes to correct
typographical errors in Sections I.A. and I.B., to, in each case,
delete an erroneous ``The.''
ICC also proposes revisions to Section II., `Operational Risk Focus
Areas', to update ICC's reference to certain functions performed by
ICE, Inc. ICC proposes to remove the reference to functions being
``outsourced'' to ICE, Inc. and instead notes that the functions
performed by ICE, Inc. are described in the ORMF (e.g., the newly added
Section II.B.) and such functions are performed pursuant to services
agreements entered into between ICC and ICE, Inc.
In addition, ICC proposes to amend Section II.A., `Business
Continuity Planning and Disaster Recovery,' to better describe the
steps in the collaboration process with respect to the business impact
analysis (``BIA'') process. Specifically, ICC is proposing to reorder
and restate the steps for completing BIA surveys used in creating test
plans. Specifically, ICC is clarifying that each critical business unit
begins by performing the BIA; then business continuity plans (``BCPs'')
are created for those processes identified in the BIA; finally, the
BCPs are tested, and the results of such testing are reported. This
refresh of the language in Section II.A. better describes the order of
ICC's process with respect to recovery from a wide-scale disruption.
ICC proposes revisions to Section II.F. (previously Section II.E.)
`Technology Control Functions.' Specifically, ICC proposes changes to
the description of the responsibilities of the ICC Technology
Department to more accurately reflect the responsibilities of the ICC
Technology Department control functions. Such proposed changes clarify
that the ICC Technology Department is responsible for end to end
design, development, testing, deployment, maintenance and day to day
operations of enterprise software systems needed for ICC core
functions. In addition, ICC proposes to update the reference to the
title of the `ICC Project Delivery Policy' to the document's current
title which is the ICC `Credit Technology Delivery Method.' Also, ICC
proposes a minor revision to change a reference to the ICC technology
director to rather reference the ICC Technology leadership team to more
accurately reflect that technology releases are assessed by the entire
ICC Technology leadership team and not just the ICC technology
director.
Furthermore, ICC proposes to amend Appendix 1 in the ORMF to
include the titles of the relevant regulatory requirements while
removing the summaries of such regulations. The purpose of this
proposed amendment is to streamline the reference process in order to
provide the reader with a more direct reference to all the applicable
regulations and to avoid the need to review and update summaries of
applicable regulations as they are amended from time-to-time. By
removing the summaries, employees instead should refer to the full
current regulation which will ensure employees are reviewing the most
up-to-date language in the regulations.
Lastly, ICC proposes to revise the `Revision History' section of
the ORMF to reflect the proposed changes described above.
In addition to the foregoing proposed modifications to the ORMF,
ICC also proposes to formalize a series of non-material updates to the
ORMF which were reviewed and approved by the Board in 2021, 2022 and
2023. Such proposed changes, which are described below, are the output
of the annual review of the ORMF conducted by the ICC Compliance
Committee \7\ (the ``Compliance Committee'') and reviewed and approved
by the Board.
---------------------------------------------------------------------------
\7\ The ICC Compliance Committee is an internal ICC committee
that oversees and manages ICC's compliance program that establishes
the framework for identifying, assessing, measuring, monitoring,
mitigating, and reporting on compliance risks for ICC.
---------------------------------------------------------------------------
In 2021 the Board approved non-material changes to the ORMF \8\ to
[[Page 91445]]
clarify language in Section I.A. `Risk Assessment.' Specifically,
revisions were made to clarify the language which describes the
Compliance Committee's review of risk assessments. In addition, such
Board approved changes in 2021 made minor clarifications to Section
I.B. to provide further clarity regarding one of the current
responsibilities of the ICE, Inc. Enterprise Risk Management (``ERM'')
function. Specifically, such change clarified that, with respect to the
incident management and mitigation process, ERM may review and
challenge corrective action plan decisions and priority levels. Both
2021 changes are non-material as they are intended to clarify the
description of current practices and the readability of the ORMF, and
as such, do not change current practices. As part of these 2021
changes, the ORMF was re-dated December 8, 2021, the version was
changed to 4.0.4 and the version history was updated to reflect these
changes.
---------------------------------------------------------------------------
\8\ Version 4.0.4 of the ORMF was reviewed and approved by the
Compliance Committee on November 18, 2021, recommended by the Risk
Committee for approval by the Board on December 8, 2021, and
approved by the Board on December 8, 2021.
---------------------------------------------------------------------------
In 2022 the Board approved non-material changes to the ORMF \9\ in
connection with the annual review of the document. No changes were made
to the ORMF as a result of the 2022 review. However, the document was
re-dated December 13, 2022, the version was changed to 4.0.5 and the
version history was updated to reflect the annual review.
---------------------------------------------------------------------------
\9\ Version 4.0.5 of the ORMF was reviewed and approved by the
Compliance Committee on November 29, 2022, recommended by the Risk
Committee for approval by the Board on December 13, 2022, and
approved by the Board on December 13, 2022.
---------------------------------------------------------------------------
In 2023 the Board approved non-material changes to the ORMF \10\ to
make minor language clarifications and to update the title of a cross-
referenced ICE, Inc. procedures document. To date, the 2023 changes
have not been incorporated into the ORMF and ICC is proposing to add
the 2023 changes to the changes described herein. Specifically, ICC
proposes to revise Section II.E. (previously Section II.D.), `ICE
Information Security' to update the title of a cross-referenced ICE,
Inc. procedures document from `ICE Information Security Risk Management
and Assessment Procedures' to `ICE IS GRC Risk Assessment Profile
Procedures' \11\ (the ``Cross-Referenced Procedure''). The Cross-
Referenced Procedure was renamed in order to better reflect the
subjects covered in the procedures. Such renaming does not affect the
content, ownership, or use of the Cross-Referenced Procedure. In
addition, ICC proposes to clarify language in paragraph 2 of Section
II.E. Specifically, ICC proposes to delete the word ``potential'' from
the reference to security controls because the word improperly narrows
the sentence's meaning and does not accurately describe ICC's current
practice of reviewing not only potential security controls but also
existing security controls. In connection with the 2023 changes, ICC
proposes updating the version history to reflect these changes.
---------------------------------------------------------------------------
\10\ Proposed modifications to Version 4.0.5 of the ORMF was
reviewed and approved by the Compliance Committee on November 28,
2023, recommended by the Risk Committee for approval by the Board on
December 13, 2023, and approved by the Board on December 13, 2023.
\11\ ``IS'' stands for Information Security and ``GRC'' stands
for Governance, Risk and Compliance.
---------------------------------------------------------------------------
(b) Statutory Basis
ICC believes that the proposed changes are consistent with the
requirements of Section 17A of the Securities Exchange Act of 1934
(``Act'') \12\ and the regulations thereunder applicable to it,
including the applicable standards under Rule 17Ad-22.\13\ In
particular, Section 17A(b)(3)(F) of the Act \14\ requires that the rule
change be consistent with the prompt and accurate clearance and
settlement of securities transactions and derivative agreements,
contracts and transactions cleared by ICC, the safeguarding of
securities and funds in the custody or control of ICC or for which it
is responsible, and the protection of investors and the public
interest. ICC believes that the proposed rule change is consistent with
the requirements of the Act and the rules and regulations thereunder
applicable to ICC, in particular, to Section 17A(b)(3)(F),\15\ because
the proposed rule change enhances ICC's ability to control its
operational risk by ensuring that ICC is incorporating detailed
practices on managing relationship and risks with SPCS. As such, the
proposed rule change is designed to promote the prompt and accurate
clearance and settlement of securities transactions, derivatives
agreements, contracts, and transactions; to contribute to the
safeguarding of securities and funds associated with security-based
swap transactions in ICC's custody or control, or for which ICC is
responsible; and, in general, to protect investors and the public
interest within the meaning of Section 17A(b)(3)(F) of the Act.\16\
---------------------------------------------------------------------------
\12\ 15 U.S.C. 78q-1.
\13\ 17 CFR 240.17ad-22.
\14\ 15 U.S.C. 78q-1(b)(3)(F).
\15\ Id.
\16\ Id.
---------------------------------------------------------------------------
Rule 17Ad-22(e)(17) \17\ requires each covered clearing agency to
establish, implement, maintain, and enforce written policies and
procedures reasonably designed to manage its operational risks by (i)
identifying the plausible sources of operational risk, both internal
and external, and mitigating their impact through the use of
appropriate systems, policies, procedures, and controls; (ii) ensuring
that systems have a high degree of security, resiliency, operational
reliability, and adequate, scalable capacity; and (iii) establishing
and maintaining a business continuity plan that addresses events posing
a significant risk of disrupting operations. The proposed revisions
provide details and updates with respect to ICC's management of SPCS
and assuring that risks and relationships between ICC and the SPCS are
continuously being monitored. Such detailed processes are intended to
enhance ICC's ability to identify relevant sources of operational risk,
both internal and external, and define processes and controls for the
mitigation of the impact of such identified risks through the use of
appropriate systems, policies, procedures, and controls, thereby
ensuring that ICC will continue to fulfill regulatory obligations,
consistent with the requirements of Rule 17Ad-22(e)(17).\18\
---------------------------------------------------------------------------
\17\ 17 CFR 240.17ad-22(e)(17).
\18\ Id.
---------------------------------------------------------------------------
Rule 17Ad-25(i) requires that a registered clearing agency must
establish, implement, maintain, and enforce written policies and
procedures reasonably designed to (1) Require senior management to
evaluate and document the risks related to an agreement with a service
provider for core services, including under changes to circumstances
and potential disruptions, and whether the risks can be managed in a
manner consistent with the clearing agency's risk management framework;
(2) Require senior management to submit to the board of directors for
review and approval any agreement that would establish a relationship
with a service provider for core services, along with the required risk
evaluation; (3) Require senior management to be responsible for
establishing the policies and procedures that govern relationships and
manage risks related to such agreements with service providers for core
services and require the board of directors to be responsible for
reviewing and approving
[[Page 91446]]
such policies and procedures; and (4) Require senior management to
perform ongoing monitoring of the relationship, and report to the board
of directors for its evaluation of any action taken by senior
management to remedy significant deterioration in performance or
address changing risks or material issues identified through such
monitoring; or if the risks or issues cannot be remedied, require
senior management to assess and document weaknesses or deficiencies in
the relationship with the service provider for submission to the board
of directors.\19\ The proposed revisions add detailed procedures with
respect to ICC's management of the risks associated with relationships
with SPCS. Such procedures include the requirement that ICC evaluate
and document the risks related to an agreement with a SPCS and whether
such risks can be managed in a manner consistent with the ORMF. The new
procedures also require that such risk evaluation be provided to the
Board, along with any agreement that would establish a relationship
with a SPCS, for the Board's review and approval. Furthermore, such new
procedures establish ICC's processes for managing and monitoring the
risks associated with such relationships with SPCS, including
procedures for remediation of any significant deterioration in
performance or to address changing risks. Such detailed procedures are
intended to enhance ICC's ability to identify and manage risks
associated with SPCS, consistent with the requirements of Rule 17Ad-
25(i).\20\
---------------------------------------------------------------------------
\19\ 17 CFR 240.17ad-25(i).
\20\ Id.
---------------------------------------------------------------------------
Furthermore, the proposed changes are consistent with the
requirements of Rule 17Ad-22(e)(2)(i) and (v) \21\ which requires, in
part, that a covered clearing agency establish, implement, maintain and
enforce written policies and procedures reasonably designed to provide
for governance arrangements that are clear and transparent and specify
clear and direct lines of responsibility. The non-material changes
approved by the Board in 2021 and 2023 to update the ORMF to clarify
the description of the Compliance Committee and ERM responsibilities,
as well as the general updates to ensure the ORMF is accurate and up-
to-date, are consistent with the requirement to maintain clear and
transparent governance arrangements, and with the requirement to
specify clear and direct lines of responsibility. Such changes improve
the accuracy and transparency of ICC's governance arrangements and
improve the clarity of the lines of responsibility. In ICC's view, the
proposed changes are therefore consistent with the requirements of Rule
17Ad-22(e)(2)(i) and (v).\22\
---------------------------------------------------------------------------
\21\ 17 CFR 240.17ad-22(e)(2)(i) and (v).
\22\ Id.
---------------------------------------------------------------------------
(B) Clearing Agency's Statement on Burden on Competition
ICC does not believe the proposed rule change would have any
impact, or impose any burden, on competition. The proposed changes to
revise the ORMF will apply uniformly across all market participants.
Therefore, ICC does not believe the proposed rule change would impose
any burden on competition that is inappropriate in furtherance of the
purposes of the Act.
(C) Clearing Agency's Statement on Comments on the Proposed Rule Change
Received From Members, Participants or Others
Written comments relating to the proposed rule change have not been
solicited or received. ICC will notify the Commission of any written
comments received by ICC.
III. Date of Effectiveness of the Proposed Rule Change and Timing for
Commission Action
Within 45 days of the date of publication of this notice in the
Federal Register or within such longer period up to 90 days (i) as the
Commission may designate if it finds such longer period to be
appropriate and publishes its reasons for so finding or (ii) as to
which the self-regulatory organization consents, the Commission will:
(A) by order approve or disapprove such proposed rule change, or
(B) institute proceedings to determine whether the proposed rule
change should be disapproved.
IV. Solicitation of Comments
Interested persons are invited to submit written data, views, and
arguments concerning the foregoing, including whether the proposed rule
change is consistent with the Act. Comments may be submitted by any of
the following methods:
Electronic Comments
<bullet> Use the Commission's internet comment form (<a href="https://www.sec.gov/rules-regulations/self-regulatory-organization-rulemaking">https://www.sec.gov/rules-regulations/self-regulatory-organization-rulemaking</a>);
or
<bullet> Send an email to <a href="/cdn-cgi/l/email-protection#6f1d1a030a420c0002020a011b1c2f1c0a0c41080019"><span class="__cf_email__" data-cfemail="94e6e1f8f1b9f7fbf9f9f1fae0e7d4e7f1f7baf3fbe2">[email protected]</span></a>. Please include
file number SR-ICC-2024-011 on the subject line.
Paper Comments
Send paper comments in triplicate to Secretary, Securities and
Exchange Commission, 100 F Street NE, Washington, DC 20549.
All submissions should refer to file number SR-ICC-2024-011. This file
number should be included on the subject line if email is used. To help
the Commission process and review your comments more efficiently,
please use only one method. The Commission will post all comments on
the Commission's internet website (<a href="https://www.sec.gov/rules-regulations/self-regulatory-organization-rulemaking">https://www.sec.gov/rules-regulations/self-regulatory-organization-rulemaking</a>). Copies of the
submission, all subsequent amendments, all written statements with
respect to the proposed rule change that are filed with the Commission,
and all written communications relating to the proposed rule change
between the Commission and any person, other than those that may be
withheld from the public in accordance with the provisions of 5 U.S.C.
552, will be available for website viewing and printing in the
Commission's Public Reference Room, 100 F Street NE, Washington, DC
20549, on official business days between the hours of 10 a.m. and 3
p.m. Copies of such filings will also be available for inspection and
copying at ICC's principal office and on ICC's website at <a href="https://www.ice.com/clear-credit/regulation">https://www.ice.com/clear-credit/regulation</a>.
Do not include personal identifiable information in submissions;
you should submit only information that you wish to make available
publicly. We may redact in part or withhold entirely from publication
submitted material that is obscene or subject to copyright protection.
All submissions should refer to file number SR-ICC-2024-011 and
should be submitted on or before December 10, 2024.
---------------------------------------------------------------------------
\23\ 17 CFR 200.30-3(a)(12).
For the Commission, by the Division of Trading and Markets,
pursuant to delegated authority.\23\
Sherry R. Haywood,
Assistant Secretary.
[FR Doc. 2024-26869 Filed 11-18-24; 8:45 am]
BILLING CODE 8011-01-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on November 19, 2024.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.