3.1 The Study Group began its analysis by developing a questionnaire regarding the structure of securities settlement systems and applying the questionnaire to at least one national system in each of the G-10 countries and also to two international securities transfer systems, Cedel and Euroclear. The questionnaire and the responses for the eighteen systems examined are summarised in Annex 3. Although this does not constitute an exhaustive survey of the systems in use or under development in the G-10 countries, the Study Group believes that the systems that have been reviewed adequately represent the range of approaches to linking delivery and payment in those countries.

3.2 On the basis of its review of the responses to the questionnaire, the Study Group identified three common structural approaches or models for achieving DVP (or, more generally, for linking delivery and payment in a securities settlement system):

Model 1: systems that settle transfer instructions for both securities and funds on a trade-by-trade (gross) basis, with final (unconditional) transfer of securities from the seller to the buyer (delivery) occurring at the same time as final transfer of funds from the buyer to the seller (payment);

Model 2: systems that settle securities transfer instructions on a gross basis with final transfer of securities from the seller to the buyer (delivery) occurring throughout the processing cycle, but settle funds transfer instructions on a net basis, with final transfer of funds from the buyer to the seller (payment) occurring at the end of the processing cycle;

Model 3: systems that settle transfer instructions for both securities and funds on a net basis, with final transfers of both securities and funds occurring at the end of the processing cycle. ¹³

Although the systems examined did not all fit equally well into this classification, the Study Group found the distinctions quite useful in developing its analysis. The remainder of this section describes these three models in greater detail. In each case, the potential risks associated with the structure are first identified. Consideration is then given to how in practice or in principle these risks can be limited through the imposition of various risk controls.

Model 1: Gross, Simultaneous Settlements of Securities and Funds Transfers

3.3 The essential characteristic of model 1 systems is the simultaneous settlement of individual securities transfer instructions and associated funds transfer instructions. The system typically maintains both securities and funds accounts for participants and makes all transfers by book entry. ¹⁴ An "against payment" transfer instruction is settled by simultaneously debiting the seller's securities account, crediting the buyer's securities account, debiting the buyer's funds account and crediting the seller's funds account. ¹⁵ All transfers are final (irrevocable and unconditional) transfers at the instant the debits and credits are posted to the securities and funds accounts. Overdrafts (negative balances) on securities accounts are prohibited. Although funds account overdrafts are allowed in most model 1 systems, the Study Group concluded that the properties of model 1 systems could be brought into sharper focus by assuming initially that funds account overdrafts are also prohibited. In such a system an instruction to transfer securities against payment would not be executed either if the seller had an insufficient securities balance or if the buyer had an insufficient funds balance.

3.4 Model 1 systems clearly allow participants to eliminate principal risk. However, such systems may require participants to maintain substantial money balances to ensure the completion of settlements, especially if participants are unable to adjust their money (or securities) balances during the processing cycle, or if the volume and value of transfers are relatively large. If balances cannot be adjusted during the processing cycle, participants must maintain balances sufficient not only to cover the net value of all funds debits and credits on the settlement date, but also to cover the largest debit balance during processing. The magnitude of the largest debit balance during processing tends to be very difficult to predict with any precision. Even if the debit balance after processing were known with certainty, the largest debit balance during processing could be considerably larger because the order in which transfers occur is determined by the availability of securities balances and cannot be predicted in advance. If participants do not maintain substantial money balances and are unable to adjust their money balances during the processing cycle, high rates of failed transactions are likely to result in a model 1 system. High fail rates increase replacement cost risk by delaying settlements and increase liquidity risk by adding to uncertainty about balances in both securities and funds at the end of processing. In an extreme case, a high fail rate could escalate to a gridlock situation in which very few, if any, transactions could be completed on the settlement date.

3.5 To avoid high fail rates, model 1 systems frequently employ some type of queue management technique and may also offer securities lending facilities. Any system that prohibits securities overdrafts or funds overdrafts must make decisions about the treatment of transfer orders that cannot be executed because of insufficient securities or money balances. The options available depend critically on whether participants are able to interact with the system during the processing cycle. If so, responsibility for queue management might be left to the participants. Counterparties to a failed transaction could be promptly notified and given the opportunity to borrow the securities or funds necessary to allow execution of the instruction. The system could repeatedly recycle instructions on a simple "first in, first out" basis until participants had taken the steps necessary to allow execution. In some model 1 systems, however, transfers are executed during one or more "batch-processing cycles" in which participants have no opportunity to adjust their securities or money balances to make completion possible. Such systems typically employ complex "chaining procedures" that manipulate the order in which transfer instructions are executed so as to maximise the number or value of securities transferred and correspondingly minimise the number and value of failed transactions. ¹⁶ These systems may also offer automatic securities lending programmes, that is, programmes in which participants may preauthorise the lending of available securities to other participants that have insufficient securities balances to allow execution of their transfer instructions.

3.6 Queuing arrangements and securities lending arrangements (automatic or otherwise) can reduce participants' uncertainties regarding the balances required to execute their transfer instructions. Even with such facilities, however, participants are often perceived to face an unattractive trade-off between higher money balances and higher fail rates, particularly in systems in which the volume and value of transfers are relatively large. To limit the need for money balances while keeping fail rates at acceptable levels, most model I systems have extended intraday or overnight credit to their participants by allowing them to overdraw their funds accounts, in some cases by quite substantial amounts. The provision of such credit extensions reduces the need for (and the opportunity costs usually associated with) money balances and, by reducing fail rates, reduces the associated replacement cost and liquidity risks. However, it creates a new source of risk - the failure of a participant to repay the credit extended. Such a failure would clearly entail liquidity and replacement cost risks. If such credit extensions are not collateralised, principal risks would also, in effect, be created. Liquidity pressures and any losses from a failure to repay the loan would be borne by the system operator or by the other participants.

3.7 Thus, the degree of protection against counterparty credit and liquidity risks in a model 1 system often depends importantly on the controls that the system imposes to limit the likelihood of a failure by a participant to repay an intraday or overnight credit extension and to contain the potential losses and liquidity pressures should a failure occur. ¹⁷ Credit risk is normally limited by imposing membership standards and by establishing a lien on the participant's holdings of securities, including securities received during the current processing cycle. To ensure that adequate collateral is available, the system would need to restrict free transfers of securities, free payments and, if securities are certificated, withdrawals of securities from the system. Also, in many cases customer securities held by the participant would need to be identified and could not be counted towards compliance with the collateral requirement. ¹⁸ Even if credit extensions are collateralised, however, credit losses could result from unanticipated declines in the value of the collateral.

3.8 In existing model 1 systems such residual losses (analogous to replacement costs) are borne by the system operator, but the system could establish loss-sharing rules that allocated the losses to the participants. ¹⁹ The system operator typically guarantees the timely receipt of payment for securities transferred and attempts to ensure that the guaranty can be honoured by arranging lines of credit with third parties (either commercial banks or the central bank). In principle, liquidity pressures on the system operator could be limited by imposing a cap on each participant's funds overdraft, but in existing model 1 systems a collateral requirement is usually the only factor limiting intraday credit extensions. If a central bank operates the system, it can clearly meet any demands for liquidity resulting from a failure to repay a credit extended. Nonetheless, it may wish to limit such credit extensions, both to avoid undermining incentives for participants to manage counterparty credit and liquidity risks and to limit the scale of the operations it would need to undertake to offset the effects of its actions on the monetary base.

3.9 In addition to imposing net debit caps, some private sector systems limit potential liquidity pressures by prohibiting participants from withdrawing funds received during the processing cycle until the next day. While this gives the system an extra day to address liquidity problems arising from a default, it potentially places the system's participants at considerable risk in the event that the system operator fails. This risk, which the Group of Thirty addressed in its same-day funds recommendation, would be particularly acute if the system operator were not very strongly capitalised or engaged in other, potentially more risky lines of business in addit;ion to providing settlement services.

Model 2: Gross Settlements of Securities Transfers Followed by Net Settlement of Funds Transfers

3.10 The essential characteristic of the model 2 system is that securities transfers are settled on a trade-for-trade (gross) basis throughout the processing cycle, while funds transfers are settled on a net basis at the end of the processing cycle. The system maintains securities accounts for participants, but funds accounts are generally held by another entity, either a commercial bank or the central bank. Securities are transferred by book entry, that is, by debiting the seller's securities account and crediting the buyer's securities account. These transfers are final at the instant the entries are made on the system's books. The corresponding funds transfers are irrevocable but not final. During the processing cycle the system calculates running balances of funds debits and credits. The running balances are settled at the end of the processing cycle when the net debit positions and net credit positions are posted on the books of the commercial bank or central bank that maintains the funds accounts. Settlement of funds transfers may occur once a day or several times a day. Thus, final transfer of securities (delivery) precedes final transfer of funds (payment). Like model 1 systems, mode] 2 systems typically prohibit participants from overdrawing securities accounts but funds overdrafts are tacitly allowed since the running balances are permitted to be net debit balances. A securities transfer instruction is rejected if and only if sufficient securities are not available in the seller's account.

3.11 Without additional safeguards model 2 systems would expose sellers of securities to principal risk. Replacement cost risk and liquidity risk would also be present, but by allowing participants to settle funds transfer instructions on a net basis, the frequency of failed transactions would be reduced, thereby limiting the potential for fails to exacerbate such risks to participants. Nonetheless, failed transactions would occur in the case of insuffficient securities balances. Thus, queuing arrangements need to be developed, although they generally do not need to be as complex as in a model 1 system that prohibited both securities and funds overdrafts. Still, the system must decide whether to depart from ''first in, first out" processing of securities transfer instructions and adopt more complex procedures that maximise the number or value of transfers completed.

3.12 Operators of model 2 systems have recognised the dangers inherent in allowing delivery prior to payment, and these systems are designed to provide strong assurances that sellers will receive payment for securities delivered. In most cases, an assured payment system is utilised, that is, a system in which the seller delivers securities in exchange for an irrevocable commitment from the buyer's bank to make payment to the seller's bank at the end of the processing cycle.

3.13 A model 2 system that includes an assured payment system eliminates counterparty principal risk but leaves participants exposed to the failure of the guarantor of one or more participants. ²⁰ Typically, the guarantors are commercial banks of the highest credit standing. ²¹ A guarantor normally protects itself against credit risks by establishing a lien on securities held by the participant in the system, including securities delivered to the participant's account during the processing cycle. Nonetheless, credit risks of the same magnitude as principal risks may result from securities purchases by participants on behalf of customers, retransfers of securities free of payments, free payments or, if securities are certificated, physical withdrawals of securities from the system. Even if the guarantor successfully establishes a lien on the participant's securities, it still faces credit risk analogous to replacement cost risk and liquidity risk if a participant fails to cover a net funds debit position. To limit the potential consequences of a failure of a guarantor, one model 2 system is considering a variety of additional safeguards, including capping the sum of net funds debit positions of participants that can be supported by any one guarantor (including the guarantor's own net debit position). ²² Finally, the possibility of failure of a buyer's bank in an assured payment system must be considered. As in model 1, that risk can be limited by insisting on same-day availability of balances received for securities delivered.

Model 3: Simultaneous Net Settlement of Securities and Funds Transfers

3.14 The essential characteristic of model 3 systems is the simultaneous net settlement of both securities and funds transfer instructions. Settlement may occur once a day or at several times during the day. The system maintains securities accounts for participants. Funds accounts may be maintained by a separate entity, either a commercial bank or a central bank. Securities are transferred by book entry, that is, by debiting the seller's securities account and crediting the buyer's securities account. During a processing cycle, running balances of debits and credits to funds and securities accounts are calculated, and in some systems this information may be made available to participants. ²³ However, book-entry transfers of securities do not occur until the end of the processing cycle. In the interim, all funds and securities transfers are provisional. At the end of the processing cycle (and possibly also at points during the processing cycle) the system checks whether those participants in a net debit position in funds or securities have sufficient balances to cover the net debits. ²⁴ If a participant has insufficient balances, it may be notified and given an opportunity to obtain the necessary funds or securities. If and only if all participants in net debit positions have aufficient balances of funds and securities, final transfers of the net securities balances and net funds balances are executed.

3.15 Model 3 systems can achieve and most do achieve DVP and, therefore, eliminate principal risk. The exceptions involve systems that in certain circumstances allow provisional securities transfers to become final prior to the settlement of funds transfers. For example, one system allows a participant that has received a securities transfer to retransfer the securities free of payment to a third party and treats the transfer to the third party as final at the time the securities accounts are debited and credited. In effect, it operates as a model 2 system with respect to those transfers. But the existence of principal risk in model 3 systems is the exception rather than the rule. As in all other systems, replacement cost risk and liquidity risk, however, are not eliminated. Failed transactions and the associated risks are reduced by the extensions of intraday credit implicit in allowing funds transfer instructions to be settled on a net basis, and also by the settlement of securities transfers on a net basis. ²⁵ Also, if funds accounts are not held at a central bank, the risk of settlement bank failure exists.

3.16 By far the most serious concern regarding risk in model 3 systems is the potential for substantial liquidity pressures to emerge if a participant fails to settle its net funds debit position. With a few notable exceptions, the netting of securities and funds transfers in model 3 systems is not legally binding. Rather, in the event that a participant fails to settle a net funds debit position, some or all transfers involving that participant may be revoked (a procedure referred to as an unwind) or, less likely, all transfers might be postponed to the next day or indefinitely. In the case of an unwind, the settlement obligations of the other participants would be recalculated. If a partial unwind of the transfers of the failed participant were possible (say, if just enough securities transfers could be revoked to eliminate the net debit position), liquidity pressures would tend to be limited, but most systems require (sometimes because of legal concerns) a complete unwind of all the participant's transfers. ²⁶

3.17 The unwind of all transfers involving even a single participant that fails to settle has the potential to create significant systemic risk. The key issue raised is whether the participants can reasonably be expected to cope with the liquidity pressures that might arise. This would depend on the magnitude of the potential changes in their funds and securities positions and on how easily they can adjust to those changes. The potential changes depend not only on the size of the net positions of the participant that fails to settle its obligations but on the distribution of its transfer activity among the other participants. The netting of funds and securities transfers in a model 3 system is usually multilateral position netting. In the event that the multilateral net position is unwound, participants whose transfer activity vis-a-vis the participant that failed to settle involved bilateral net credit positions in funds or securities would lose those net credits; upon recalculation, their multilateral net positions vis-a-vis the system would be smaller net credits or larger net debits.

3.18 The other participants' ability to cope with the changed positions would depend in part on how tightly they were managing their cash and securities balances and whether, in particular, they were relying on the credits generated by their bilateral activity with the participant that failed to settle. ²⁷ In the case of cash balances, if they were depending on the credit to meet other obligations, their ability to cope would depend on the liquidity of the money markets (or their access to credit lines, either from commercial banks or from the central bank) at the time the failure to settle became apparent. In money markets, liquidity tends to dry up as the end of the business day approaches, so participants would be more likely to encounter serious difficulty adjusting to a settlement failure if settlement is scheduled for very late in the day.

3.19 In the case of securities balances, an unwind may cause other participants to be unable to meet their obligations to deliver securities if they had relied on securities that they had anticipated receiving from the failed participant. Furthermore, in an unwind, the system may not reverse all of the subsequent transfers made by a participant that received securities from the failed participant. In that case, a participant would in effect overdraw its securities account to the extent it relied on securities from the failed participant ²⁸ If the participant cannot cover the shortfall, it may also be declared in default, triggering an additional unwind.

3.20 The ability of a participant affected by a complete or partial unwind to complete its delivery commitments may depend on the liquidity of the securities lending markets (or the availability of automatic securities lending facilities). Securities lending markets are often rather illiquid throughout the business day, although the liquidity of markets for different securities varies greatly. Illiquidity in the securities lending markets would probably be exacerbated if an unwind forced a number of participants into the market simultaneously.

3.21 In markets with relatively small settlement volumes and which either are extremely liquid at the tin.e of settlement or enjoy highly reliable liquidity facilities (for funds and securities), reliance on unwinding may not create unacceptable systemic risk. In several markets, howeer, operators of model 3 systems evidently have concluded that the risk associated with unwinds is unacceptable and have imposed a variety of risk controls to either supplement or substitute for unwinds. In these systems the completion of settlement is generally guaranteed by the system operator (or by a clearing corporation that achieves legally binding multilateral trade netting by acting as a central counterparty). The risk controls are intended to protect the guarantor and also to make the guaranty credible to participants. Among the controls that have been employed to limit credit risk are membership requirements, requirements that net funds debits be fully collateralised, and required contributions to a collateral pool. Liquidity risk has in some instances been limited by arranging third-party liquidity facilities; however, none of the model 3 systems that the Study Group has reviewed currently imposes caps on net funds debit positions. In principle, such caps could be determined by the system operator, perhaps on the basis of bilateral limits set by the participants.

Footnotes :

13. Logically, one might posit the existence of a fourth model in which funds transfer instructions are settled on a gross basis and securities transfer instructions on a net basis. However, the Study Group is aware of no system that is designed in this way. The apparent preference to complete securities transfers before, or at least no later than, the completion of funds transfers probably reflects the greater complexity and difficulty of ensuring completion of securities transfers, given the large number of individual securities and the tendency for securities markets and securities lending markets to be less liquid than money markets.

14. If funds accounts are held by another entity, a communications link must be established between the operator of the securities transfer system and the other entity to provide the securities transfer system with real-time information on the completion of funds transfers.

15. The system may also allow participants to make "free transfers," that is, transfers of securities without a corresponding transfer of funds, or "free payments," that is, transfers offunds without a corresponding transfer of securities

16. In some countries, "chaining procedures" are not employed because of concerns about the legality of a departure from "first in, first out" processing.

17. Securities loans to participants also create credit risks that must be limited, usually through the use of similar types of controls.

18. More generally, the system needs to ensure that its lien on any collateral is legally enforceable.

19. Of course, if the operator is owned by the participants they ultimately bear the loss in any event.

20. The obligation of the seller's bank in the event of failure of the buyer's bank is a matter of negotiation between the seller's bank and the seller. In some cases, the seller's bank may guaranty that the seller will receive payment even if the buyer's bank fails.

21. In at least one system, some of the guarantors are also participants in the system.

22. Of course, the imposition of caps on net funds debit positions would tend to require more complex queuing arrangements and would, nonetheless, tend to result in higher fail rates.

23. In other systems such information is not communicated to participants. In some of these systems transfer instructions are processed in batches, affording no possibility of communicating the results to participants prior to the end of the cycle. Even in systems that process transfer instructions individually, however, the information may not be communicated prior to the end of the cycle because the legal system provides that the securities transfers would be final as soon as the participants were notified (and thus before the associated funds transfers were final).

24. In some systems a transfer instruction would not be processed if it would result in a net debit position in a security larger than the participant's balance in that security. In other systems, however, an inadequate securities balance might not become evident until later in the processing cycle or at the end of the processing cycle.

25. Still, in most systems transfers would not be processed if sufficient securities balances were not available, and some sort of queuing arrangements would need to be established.

26. In those systems in which an inadequate securities balance might not become evident until the end of the processing cycle, an unwind could also be triggered by a failure to cover a net debit position in a security. In such systems a partial unwind of transfers involving that particular security typically occurs.

27. Such reliance may be more likely if the running balances are reported to participants during the day.

28. An overdrawn securities account could also result in those systems that permit participants to withdraw securities transferred to their account during the day. Most securities settlement systems do not allow withdrawals, however.