5. Risk Management and Compliance

RISK MANAGEMENT AND COMPLIANCE

LEADING PRINCIPLE:

Market Participants are expected to promote and maintain a robust control and compliance environment to effectively identify, manage, and report on the risks associated with their engagement in the FX Market.

I. Frameworks for Risk Management, Compliance, and Review

Appropriate risk management, compliance, and review structures should be in place to manage and mitigate the risks that arise from a Market Participant’s activities in the FX Market. These structures vary in complexity and scope, but generally share some common aspects. For example:

The responsibility rests with the business unit which owns the risk it incurs in conducting its activities.
In addition, there may be both a risk management function that oversees risk-taking activities and assesses those risks independently from the business line, and an independent compliance function that monitors compliance with Applicable Law ¹ and Standards ².
Finally, there may be a review or audit function that provides independent review of, among other things, internal control systems and the activities of the business unit and the risk management and compliance functions.

Periodic independent reviews of risk and compliance controls should also be undertaken, including a review of the qualitative and quantitative assumptions within the risk management system.

The principles below describe numerous recommendations that illustrate how to achieve robust frameworks for risk management, compliance, and review. However, not every recommendation may be appropriate for every Market Participant. Accordingly, Market Participants should assess which recommendations are appropriate based on the size and complexity of their FX Market activities, and the nature of their engagement in the FX Market, taking into account Applicable Law.

Principle 24

Market Participants should have frameworks for risk management and compliance.

The common components of these two frameworks may include:

Effective oversight by the senior body or individual(s), consistent with Principle 4, including support for the stature and independence of risk management and compliance. In particular:
- the senior body or individual(s) should make strategic decisions on the risk appetite of the FX business.
- the senior body or individual(s) should be responsible for the establishment, communication, enforcement, and regular review of a risk management and compliance framework that clearly specifies authorities, limits, and policies. Risks should be managed prudently and responsibly in accordance with established principles of risk management and Applicable Law ³.
The provision of concise, timely, accurate, and understandable risk- and compliance related information to the senior body or individual(s).
The appropriate segregation of duties and independent reporting lines, including the segregation of trading from risk management and compliance and from deal processing, accounting, and settlement. While risk managers and compliance personnel may work closely with business units, the risk management and compliance functions should be independent of the business unit and should not be directly involved in revenue generation. Compensation structures should be designed not to compromise such independence.
Adequate resources and employees with clearly specified roles, responsibilities, and authority, including appropriate access to information and systems. These personnel should have appropriate knowledge, experience, and training.

Principle 25

Market Participants should familiarise themselves with, and abide by, all Applicable Law and Standards that are relevant to their FX Market activities and should have an appropriate compliance framework in place.

An effective compliance framework should provide independent oversight and control and could comprise, but is not limited to:

identification of Applicable Law ⁴ and Standards ⁵ that apply to their FX Market activities
appropriate processes designed to prevent and detect abusive, collusive, or manipulative practices, fraud, and financial crime, and to mitigate material risk that could arise in the general conduct of the FX Market activities
capturing and retaining adequate records to enable effective monitoring of compliance with Applicable Law and Standard
well-defined escalation procedures for issues identified
consideration of the need to periodically restrict relevant personnel’s access through measures such as mandatory vacation to facilitate detection of possible fraudulent activities
the provision of advice and guidance to senior management and personnel on the appropriate implementation of Applicable Law, external codes, and other relevant guidance in the form of policies and procedures and other documents such as compliance manuals and internal codes of conduct
training and/or attestation processes to promote awareness of and compliance with Applicable Laws and Standards ⁶
appropriate implementation and utilisation of compliance programs (for example, the establishment of processes to monitor daily activities and operations)
the periodic review and assessment of compliance functions and controls, including mechanisms to alert senior management about material gaps or failures in such functions and controls. The appropriate senior body or individual(s) should oversee the timely resolution of any issues

Principle 26

Market Participants should maintain an appropriate risk management framework with systems and internal controls to identify and manage the FX risks they face.

Effective risk management starts with the identification and understanding by Market Participants of the various types of risks to which they are exposed (see the section on Key Risk Types below), and typically involves the establishment of risk limits and monitoring mechanisms, as well as the adoption of risk-mitigating and other prudent practices. An effective risk management framework could comprise, but is not limited to:

an appropriate and well-documented approval process for the setting of risk limits
a comprehensive and well-documented strategy for the identification, measurement, aggregation, and monitoring of risks across the FX business, including, for example, risks that may be specific to a Market Participant that intermediates Client trades as a Prime Broker ⁷ or that provides market access
documented policies, procedures, and controls, which are periodically reviewed and tested, to manage and mitigate risks
the clear communication of risk management policies and controls within the institution to promote awareness and compliance, as well as processes and programs to facilitate the understanding of such policies and controls by personnel
information systems to facilitate the effective monitoring and timely reporting of risks
robust incident management, including appropriate escalation, mitigating actions, and lessons learned
robust risk assessment for all (and approval processes for new) products, services, and procedures to identify new or emerging risks
sound accounting policies and practices encompassing prudent and consistent valuation methods and procedures
an appropriately robust risk control self-assessment process that includes processes to remediate identified gaps or weaknesses

Certain Market Participants provide credit intermediation and/or market access to other Market Participants—for example Prime Brokers and FX E-Trading Platforms ⁸. These Market Participants should have a risk management and compliance framework that takes this activity into account. In addition, these Market Participants are encouraged to engage in ongoing dialogue with those for whom they are providing credit intermediation and/or access to the market to underscore expectations regarding appropriate behaviour in the market.

Principle 27

Market Participants should have practices in place to limit, monitor, and control the risks related to their FX Market trading activity.

These practices could comprise, but are not limited to:

The regular monitoring of trading activities, including the identification and internal escalation, as appropriate, of failed, cancelled, or erroneous trades.
Automated or manual monitoring systems to detect actual or attempted market misconduct and market manipulation. Relevant personnel should be qualified to detect trading patterns that may suggest unfair or manipulative practices. Market Participants may use certain statistics or metrics to flag behaviour warranting further review, such as off-market rates, repetitive orders, and unusually small or large orders. There should be appropriate processes whereby suspicious practices can be promptly reviewed and escalated as appropriate.
Verification of the valuations used for risk management and accounting purposes, conducted by personnel independent of the business unit that owns the risk.
Independent reporting on a regular and timely basis of risk positions and trader profit/loss statements to the relevant risk management function or senior management, as appropriate, including a review of exceptional deviations of profit/loss from expected levels.
Transactions should be promptly and accurately captured so that risk positions can be calculated in an accurate and timely manner for monitoring purposes (see Principle 36).
Regular reconciliations of front, middle, and back office systems, with differences identified and their resolution tracked by personnel independent of the business unit.
Timely reporting to a senior body or individual(s) when risk limits have been breached, including follow-up action to bring exposures within limits, and any appropriate measures to prevent a recurrence.
Appropriate controls around proper order and quote submission, such as kill switches or throttles in the case of electronic trading submissions. These controls should be designed to prevent the entry or transmission of erroneous orders or quotes that exceed pre-set size and price parameters as well as financial exposure thresholds.

Market Participants should be aware of the risks associated with reliance on a single source of liquidity and incorporate contingency plans as appropriate.

Principle 28

Market Participants should have processes in place to independently review the effectiveness of and adherence to the risk management and compliance functions.

Independent review should be performed regularly, with any review findings recorded and corrective action tracked.
All material risk related to FX Market activities should be covered, using an appropriate assessment methodology.
The review team should be given the necessary mandate and support, including adequate personnel with requisite experience or expertise.
Findings should be reported to an appropriately senior level for review and follow-up.

The above may be undertaken by the audit function where appropriate.

II. Key Risk Types

Market Participants may be subject to different risks, and to varying degrees, depending on the size and complexity of their FX Market activities, and the nature of their engagement in the FX Market. With this in mind, the principles below outline some of the good practices relevant to the key risk types applicable to FX activities.

CREDIT/COUNTERPARTY RISK

Principle 29

Market Participants should have adequate processes to manage counterparty credit risk exposure, including where appropriate, through the use of appropriate netting and collateral arrangements, such as legally enforceable master netting agreements and credit support arrangements.

The use of master netting agreements and credit support arrangements helps to strengthen the smooth functioning of the FX Market. Other measures to manage counterparty credit risk include the accurate and timely assessment of a counterparty’s creditworthiness prior to a transaction, sufficient diversification of counterparty exposure where appropriate, the prompt setting and monitoring of counterparty exposure limits, and the acceptance of transactions only if they fall within approved limits. Credit limits should be set independently of the front office, and should reflect the established risk appetite of the Market Participant.

Market Participants should maintain accurate records material to their counterparty relationships. This could include records of conversations and written correspondence, and retention policies should be aligned with Applicable Law ⁹.

FX E-Trading Platforms ¹⁰ that have multiple liquidity providers and consumers should at a minimum disclose the following as it relates to credit monitoring:

what mechanisms and/or controls are in place to set, amend, and monitor all applicable credit limits
whether and how the responsibility of monitoring credit limit breaches fall upon the platform or the users, and which parties are responsible for resolving credit limit reaches
what specific methodologies are used to calculate credit exposures (such as Net Open Position, etc.)

MARKET RISK

Principle 30

Market Participants should have processes to measure, monitor, report, and manage market risk in an accurate and timely way.

Changes in FX prices or rates give rise to market risk, which could have an adverse effect on the financial condition of Market Participants. Market risk measurement should be based on generally accepted measurement techniques and concepts, including the use of stress testing. Such measurement techniques should be periodically and independently reviewed. The measurement of market risk should take into account hedging and diversification effects.

Market Participants should be aware of, monitor, and—where appropriate—mitigate the liquidity risk that could arise from their transactions in the FX Market.

Principle 31

Market Participants should have independent processes in place to mark-to-market trading positions to measure the size of their profit and loss and the market risk arising from trading positions.

In marking-to-market trading positions, quoted market prices, where available, are generally the best guide. When obtaining external data for valuation purposes:

useful sources of data include screen services, brokers, and other third-party providers
a function independent of the front office should check that prices and marked-to-market valuations are measured accurately and regularly
there should be understanding of what the data represent—for example, if the price was the last actual trade, when the last trade was executed, and if prices were not actual trades how these were calculated.

Market Participants should have an internal agreed close of business for each trading day against which end-of-day positions can be monitored and evaluated.

Where reference market prices are not available (for example, in marking-to-market complex derivatives or exotic instruments), internal models, validated by an internal function that is independent from the front office, can be used to guide the appropriate pricing of risks.

OPERATIONAL RISK

Principle 32

Market Participants should have appropriate processes in place to identify and manage operational risks that may arise from human error, inadequate or failed systems or processes, or external events.

Market Participants should take into consideration operational risks arising from a global cross-border environment, such as time differences or differences in industry conventions. Operational risks could include those arising from human error, misconduct, systems issues, or unforeseen external circumstances.

Market Participants should put in place strict security measures to address the vulnerability of trading areas and infrastructure to possible operational disruptions, terrorism, or sabotage. Access to the dealing function should be controlled, with procedures in place that specify time constraints, security checks, and management approvals around access, where appropriate, for non-dealing personnel and external visitors.

Principle 33

Market Participants should have business continuity plans (BCPs) in place that are appropriate to the nature, scale, and complexity of their FX business and that can be implemented quickly and effectively in the event of large-scale disasters, loss of access to significant trading platforms, settlement, or other critical services, or other market disruptions.

BCPs could comprise, but are not limited to, the following elements:

Contingency plans that support business continuity across the FX business, including plans related to data storage and usage, and procedures in the event of the nonavailability of FX fixes, where relevant.
The regular review, updating, and testing of contingency plans, including drills to familiarise senior management and relevant personnel with the arrangements under a contingent situation. This should include the regular review of potential scenarios that would require the activation of such plans.
Disaster recovery plans that identify requisite systems and procedural backups. All critical automated processes as determined by the Market Participant should have a documented automated and/or manual contingency.
The identification of external dependencies, including an understanding of the BCPs of settlement system operators and other infrastructure and critical service providers, as well as the appropriate inclusion of these plans, or other back-up processes, into Market Participants’ own BCPs.
Emergency contact information for both internal and external dependencies. Communication tools should be secure.
Non-primary location backup sites that can accommodate essential personnel, systems, and operations, and that are maintained and tested on a regular basis.

TECHNOLOGY RISK

Principle 34

Market Participants should have in place processes to address potential adverse outcomes arising from the use of or reliance on technological systems (hardware and software).

Market Participants should have processes in place to assign clear ownership of every system on which they rely, and changes should be approved according to internal policies. Any system should be thoroughly tested before release into production use, with an audit trail of all actions taken saved and available for review. This should apply to the development, testing, deployment, and subsequent updates of trading systems and algorithms. Market Participants should also be aware of broader risks that may exist and affect their FX Market activity, such as risks related to cyber security.

Market Participants operating FX E-Trading Platforms ¹¹ should monitor the intraday health of the platform (for example, capacity utilisation) and should conduct periodic capacity testing of critical systems to determine such system’s ability to process transactions in an accurate, timely, and robust manner.

Market Participants involved in electronic trading should put in place appropriate and proportionate controls to reduce the likelihood of and mitigate any consequences of generating or acting upon electronic quotations that may result in erroneous transactions or market disruption such as off-market quotes or trades, fat finger errors, unintended or uncontrolled trading activity arising from technological failures, flaws in trading logic, and unexpected or extreme market conditions.

Market Participants should not knowingly generate or attempt to act upon quotations in a way that is beyond the technical capabilities of the recipient or inconsistent with advertised protocols. Excessive message rates that are known to approach or breach the limitations of the platform should be controlled, for instance via the application of throttling logic and/or circuit breakers. Any identified platform flaws or features that may risk its continued operation should be escalated appropriately.

The inclusion of a third party into the electronic workflow between those participants generating and acting upon quotations does not remove either party’s obligations. Market Participants such as aggregators and multibank venues that may perform both the function of distributing and acting upon electronic quotations should abide by all relevant principles.

SETTLEMENT RISK ¹²

Principle 35

Market Participants should reduce their Settlement Risk as much as practicable, by settling FX transactions through settlement methods that eliminate Settlement Risk, for example by using services that provide payment-versus-payment (PVP) settlement where available.

When determining settlement methods for FX transactions Market Participants should consider the following hierarchy to reduce Settlement Risk:

Where practicable, Market Participants should eliminate Settlement Risk, for example by using settlement services that provide PVP settlement.
Where Settlement Risk cannot be eliminated, Market Participants should reduce the size and duration of their Settlement Risk as much as practicable. The netting of FX settlement obligations (in particular the use of automated settlement netting systems) is encouraged.
Where practicable, gross bilateral settlement should be minimised.

Where used by Market Participants, and where practicable, the netting of FX settlement obligations should be supported by appropriate documentation (for example, market standard netting documentation). Such obligation netting may be bilateral or multilateral. Market Participants should agree which settlement method will be used for a given product and currency as part of the counterparty onboarding process. Once agreed, the settlement method should be used consistently, and ad-hoc arrangements with the same counterparty considered only on an exception basis. Market Participants should also review their agreed settlement method choices on a regular basis with a view to reducing Settlement Risk as much as practicable.

The Management and relevant personnel of each area involved in a Market Participant’s FX operations should have a thorough understanding of the settlement process and the tools that may be used to mitigate Settlement Risk, including, where available, the use of PVP settlement. Market Participants should consider creating internal mechanisms to reduce risks associated with FX settlement. For example, by using automated solutions over manual processes. Market Participants should also monitor industry developments in Settlement Risk mitigation and seek to adopt best practice.

Please also see the Confirmation and Settlement section for further details on this topic

COMPLIANCE RISK ¹³

Principle 36

Market Participants should keep a timely, consistent, and accurate record of their market activity to facilitate appropriate levels of transparency and auditability and have processes in place designed to prevent unauthorised transactions.

Market Participants should keep an accurate and timely record of orders and transactions that have been accepted and triggered/executed, as well as the reasons behind electronic trade request and order ejections, consistent with those set out under Principle 9, to create an effective audit trail for review and to provide transparency to Clients ¹⁴ where appropriate.

This record may include, but is not limited to, the following: the date and time, product type, order type (for example, a Stop Loss Order ¹⁵, or an order where price is subject to last look), quantity, price, trader, and Client identity. Market Participants should apply sufficiently granular and consistent time-stamping so that they record both when an order is accepted and when it is triggered/executed.

Market Participants should have processes in place to support appropriate related data storage and retention of such detail.

Information should be made available to Clients upon request, to provide sufficient transparency regarding their orders and transactions to facilitate informed decisions regarding their market interactions. Information may also be used in resolving trade disputes. Records should allow Market Participants to effectively monitor their own compliance with internal policies, as well as their adherence to appropriate market behaviour standards.

Market Participants should set guidelines that specify personnel authorised to deal in after-hours or off-premise transactions and the limit and type of transactions permitted. A prompt written reporting process should be developed and appropriate records should be kept.

Principle 37

Market Participants should perform “know-your-customer” (KYC) checks on their counterparties to ascertain that their transactions are not used to facilitate money laundering, terrorist financing, or other criminal activities.

Market Participants should have appropriate measures in place to enforce the KYC principle (see Principle 52 in Confirmation and Settlement section).

Market Participants should have a clear understanding of all Applicable Law ¹⁶ on the prevention of money laundering and terrorist financing.

Market Participants should have internal processes in place to facilitate the prompt reporting of suspicious activities (for example, to the compliance officer or appropriate public authority, as necessary). Effective training should be provided for relevant personnel, to raise awareness of the serious nature of these activities, and reporting obligations, while not revealing their suspicions to the entity or individual suspected of illegal activities. Such training should be regularly updated to keep pace with the rapidly changing methods of money laundering.

Principle 38

Market Participants should have in place reasonable policies and procedures (or governance and controls) such that trading access, either direct or indirect, is limited to authorised personnel only.

Market Participants should maintain trader or desk mandates, which detail what products each trader is permitted to trade, as well as post-trade surveillance in order to detect exceptions from the trader’s mandate.

Market Participants should periodically review trading access in order to confirm that such access, either direct or indirect, is limited to authorised access only.

Market Participants should implement monitoring practices designed to detect the concealment or manipulation of (or the attempt to conceal or manipulate) profit and loss and/or risk using trades or adjustments that are not for a genuine business purpose.

Principle 39

Market Participants should generate a timely and accurate record of transactions undertaken to enable effective monitoring and auditability.

At the request of a Client, Market Participants should be able to provide information regarding the actions taken in handling a specific transaction with such Client. Clients requesting data from a Market Participant are expected to do so in a reasonable manner, avoiding spurious or extraneous requests. When requesting data, a Client should outline the reason for the request. Market Participants should have processes in place to respond to Client requests for the data.

LEGAL RISK

Principle 40

Market Participants should have processes in place to identify and manage legal risks arising in relation to their FX Market activities.

Market Participants should have an understanding of where Applicable Law ¹⁷ may affect the legality or enforceability of rights and obligations with other Market Participants and should take steps to mitigate material legal risks.

Market Participants should have in place legal agreements with their counterparties, and should use standard terms and conditions, where appropriate. Market Participants should maintain a record of the agreements they have in place with their counterparties.

When trading, Market Participants should make clear if standard terms are used, and if changes are proposed. Where changes are substantial, these should be agreed before any transaction. Where standard terms do not exist, Market Participants should take more care in the negotiation of these terms. Market Participants should strive to finalise documentation promptly.

CONSIDERATIONS RELATED TO PRIME BROKERAGE ACTIVITIES

Principle 41

Prime Brokerage Participants should strive to monitor and control trading permissions and credit provision in Real Time at all stages of transactions in a manner consistent with the profile of their activity in the market to reduce risk to all parties.

Prime Brokerage Participants ¹⁸ should strive to develop and/or implement robust control systems that include the timely allocation, monitoring, amendment, and/or termination of credit limits and permissions and adequately manage associated risks.

Prime Brokerage Clients should strive for Real-Time monitoring of their available lines and permitted transaction types and tenors so that only trades within permitted parameters are executed.
Executing dealers should strive for Real-Time monitoring of designation limits to validate trade requests prior to execution.
Prime Brokers should have systems reasonably designed to monitor trading activity and applicable limits upon receiving Give-Up ¹⁹ trades.

Prime Brokers should be in a position to accept trades in accordance with terms and conditions within Prime Brokerage agreements and designation notices.

Prime Brokers should have policies and procedures reasonably designed to address limit breach exceptions, limit changes, amendments, and novations.

Prime Brokers should clearly disclose to Clients how they monitor their credit limits and how limit breaches are managed.

1
Applicable Law: With respect to a Market Participant, the laws, rules, and regulations applicable to it and the FX Market in each jurisdiction in which it does business ↩︎
2
Standards: A Market Participant’s internal policies, external codes (the FX Global Code and any annexes to the Code published by regional FX committees or jurisdictions in which the Market Participant is based or operating), and other relevant guidance (for example, guidance provided by public sector international organizations such as the Bank for International Settlements and the Financial Stability Board) ↩︎
3
Applicable Law: With respect to a Market Participant, the laws, rules, and regulations applicable to it and the FX Market in each jurisdiction in which it does business ↩︎
4
Applicable Law: With respect to a Market Participant, the laws, rules, and regulations applicable to it and the FX Market in each jurisdiction in which it does business ↩︎
5
Standards: A Market Participant’s internal policies, external codes (the FX Global Code and any annexes to the Code published by regional FX committees or jurisdictions in which the Market Participant is based or operating), and other relevant guidance (for example, guidance provided by public sector international organizations such as the Bank for International Settlements and the Financial Stability Board) ↩︎
6
Standards: A Market Participant’s internal policies, external codes (the FX Global Code and any annexes to the Code published by regional FX committees or jurisdictions in which the Market Participant is based or operating), and other relevant guidance (for example, guidance provided by public sector international organizations such as the Bank for International Settlements and the Financial Stability Board) ↩︎
7
Prime Broker (PB): An entity that provides credit intermediation to one or more parties to a trade based on pre-agreed terms and conditions governing the provision of such credit. The Prime Broker can also offer subsidiary or allied offerings, including operational and technology services ↩︎
8
FX E-Trading Platform: Any system that allows Market Participants to execute trades electronically in the FX Market ↩︎
9
Applicable Law: With respect to a Market Participant, the laws, rules, and regulations applicable to it and the FX Market in each jurisdiction in which it does business ↩︎
10
FX E-Trading Platform: Any system that allows Market Participants to execute trades electronically in the FX Market ↩︎
11
FX E-Trading Platform: Any system that allows Market Participants to execute trades electronically in the FX Market ↩︎
12
Settlement Risk: The risk of outright loss of the full value of a transaction resulting from the counterparty’s failure to settle. This can arise from paying away the currency being sold, but failing to receive the currency being bought. (Settlement Risk is also referred to as “Herstatt Risk.”) ↩︎
13
Compliance Risk: Risk of legal or regulatory sanctions, material financial loss, or loss to reputation as a result of a Market Participant’s failure to comply with laws, regulations, rules, industry standards, and codes of conduct applicable to its FX activities. Compliance concerns include observing proper standards of market conduct, managing conflict of interest, treating customers fairly, and taking measures for the prevention of money laundering and terrorist financing. ↩︎
14
Client: A Market Participant requesting transactions and activity from, or via, other Market Participants that provide market making or other trade execution services in the FX Market. A Market Participant can act as a Client in some instances while making markets in other instances ↩︎
15
Stop Loss Orders: A contingent order that triggers a buy or sell order for a specified notional amount when a reference price has reached or passed a pre-defined trigger level. There are different variants of Stop Loss Orders, depending on the execution relationship between counterparties, the reference price, the trigger, and the nature of the triggered order. A series of parameters are required to fully define a Stop Loss Order, including the reference price, order amount, time period, and trigger ↩︎
16
Applicable Law: With respect to a Market Participant, the laws, rules, and regulations applicable to it and the FX Market in each jurisdiction in which it does business ↩︎
17
Applicable Law: With respect to a Market Participant, the laws, rules, and regulations applicable to it and the FX Market in each jurisdiction in which it does business ↩︎
18
Prime Brokerage Participant: A Market Participant that is either (i) a Prime Broker, (ii) a Client using the services of a Prime Broker, or (iii) a Market Participant acting as an executing dealer (price maker) or execution intermediary (such as an Agent or platform) between the Prime Brokerage Client and the Prime Broker ↩︎
19
Give-Up: A process by which trades are passed on to a Prime Broker by a party designated by the Prime Broker to execute transactions with a Prime Broker Client ↩︎

2025 Online FX Global Code