What processes must a CIF have for credit, market, liquidity, operational and leverage risk?

The exam material lists detailed rules for each type of risk, taken from the CRD through CySEC Directive DI144-2014-14. For Class 1-minus CIFs they now sit in Law 97(I)/2021 (sections 40 to 48), and for banks in the banking law. Since 5 November 2021 Class 2 CIFs have followed a shorter duty in Law 165(I)/2021 section 23: robust strategies, policies, processes and systems to identify, measure, manage and monitor material risks to clients, to the market and to the firm itself, including risks that could deplete own funds, and liquidity risk over suitable periods, including intraday. Class 3 CIFs cover the client, firm and liquidity limbs. General rules on risk management for all CIFs sit in the MiFID II framework; see What organisation, risk management and internal audit must an investment firm have?.

Credit must be granted on sound, well-defined criteria, with a clear process for approving credit and for changing, renewing or refinancing it. Internal methods must assess credit risk for single obligors, securities and securitisation positions and for the portfolio as a whole, and must not rely solely or mechanically on external ratings. Where an own funds requirement rests on a rating, or on an exposure being unrated, the firm still weighs other relevant information when it allocates internal capital. Portfolios are monitored continuously, which means identifying and handling problem credits and setting aside enough value adjustments and provisions, and they are diversified in line with the firm's target market.

Residual risk, the risk that credit risk mitigation works less well than expected, and concentration risk must both be addressed in written policies and procedures. Concentrations can arise from counterparties, including central counterparties, from connected groups, and from exposures in one sector, region, activity or commodity, as well as from large indirect exposures, for example where much of the collateral comes from one issuer. Securitisation risk, for a firm acting as investor, originator or sponsor, must be assessed so that the economic substance of each deal is reflected.

For market risk, the firm needs policies for all material sources and effects. Where short positions fall due before long ones, it must guard against a liquidity shortage. A firm that nets index shares against index futures must hold internal capital for basis risk, the risk that the future and the shares do not move together. The same applies to opposite positions in index futures that differ in maturity or composition. A firm that reduces its underwriting position must hold capital for the risk between the initial commitment and the next working day. Separately, systems must identify, evaluate and manage interest rate risk from non-trading activities.

Operational risk policies must cover model risk and rare but severe events, and must say what counts as operational risk. They include contingency and business continuity plans, which keep the firm running and limit its losses in a severe disruption. Since 21 February 2025, Law 97(I)/2021 has required those plans to include ICT continuity, response and recovery plans, in line with the EU's Digital Operational Resilience Act.

Liquidity risk needs robust strategies and systems over suitable periods, including intraday, with liquidity buffers and limits tailored to business lines, currencies and entities. The firm separates pledged assets from unencumbered assets available at all times, especially in an emergency, and considers where assets are held and any limits on moving them. It runs alternative scenarios and reviews its funding assumptions at least annually. Its liquidity recovery plans are tested at least annually, and the results go to senior management, who must approve them. These are CRD rules; IFR firms must hold liquid assets of at least one third of their fixed overheads requirement.

For excessive leverage, the firm needs policies to identify, manage and monitor it, allowing for falls in own funds from expected or realised losses. Indicators include the leverage ratio and any mismatch between assets and liabilities. The leverage ratio is Tier 1 capital divided by the total exposure measure, as a percentage; since 28 June 2021 the CRR has set a 3% minimum. It does not apply to IFR firms.