4.1 The above discussion suggests that the degree of protection against counterparty credit and liquidity risks that a securities settlement system provides to its participants depends more on the specific risk safeguards utilised by the system than on which of the structural approaches (models) is employed. Model 1 and model 3 systems typically achieve DVP, while model 2 systems typically create an assured payment system that is intended to make the risk of a loss of principal value negligible. But no system has eliminated replacement cost risk or liquidity risk. Regardless of the model chosen, in managing these risks a settlement system faces three fundamental, interrelated questions:

1. How much credit should the system extend to its participants (either explicitly in the form of funds overdrafts or tacitly by allowing funds transfer instructions to be netted and net funds debit positions to be created)?
2. What safeguards should be employed to limit the potential losses and liquidity pressures from a participant's failure to repay a credit extension?
3. How should any losses and liquidity pressures be shared among the system operator and other participants?

In each case the best answer for a particular system is influenced by a variety of factors exogenous to the settlement system, including the opportunity costs of maintaining cash balances and the costs of credit facilities, the magnitude of replacement cost risks, the liquidity of money markets and securities markets, the credit standing of participants, and the degree of access by participants to central bank credit facilities.

4.2 In principle, participants could be required to maintain sufficient cash balances in their funds accounts to avoid an intraday or overnight overdraft (model 1) or an intraday net debit position (models 2 or 3). However, because the order and timing of securities transfers tend to be highly uncertain, participants would generally need to maintain quite substantial balances, especially if the balances could not be adjusted during the processing cycle or if the volume and value of transfers were relatively large. Therefore, participants might incur substantial opportunity costs if overdrafts or net debit positions were prohibited. If adequate balances were not maintained, high rates of failed transactions might occur, possibly adding substantially to replacement cost risk and liquidity risk. To improve this trade-off between efficiency (cost) and risk, nearly all securities settlement systems extend intraday (or overnight) credit to participants, either explicitly (model 1) or tacitly (models 2 or 3) ²⁹ The extent of the improvement in the trade-off depends on the level of uncertainty about intraday debit positions, the magnitude of opportunity costs associated with holding cash balances, the volatility of securities prices (through their influence on replacement costs) and the liquidity of money markets (through their influence on liquidity risk).

4.3 Against these potential benefits from the extension of credit to participants must be weighed the potential costs associated with failures to repay such credit extensions. These potential costs, in turn, depend on the safeguards imposed by the system to limit the likelihood of a default or failed payment and to contain the potential losses and liquidity pressures should a default or failed payment occur. All systems attempt to limit these risks through membership standards for participants. Other risk controls may or may not be imposed. Some systems limit credit risks by attempting to ensure that all credit extensions are collateralised, either by securities received by the participant during the processing cycle or by other securities held by the participant. However, relatively few systems appear to impose a binding collateral requirement on participants, in the sense that completion of a securities transfer is conditional on the availability of collateral with value greater than the resulting funds overdraft (or net funds debit). More often they attempt to maintain a closed system by stipulating that securities can be retransferred only against payment or, at a minimum, by limiting free transfers or free payments.³⁰ Nor are caps on participants' funds overdrafts (model 1) or net funds debit positions (models 2 or 3) commonly imposed to limit potential liquidity pressures from failure to cover an overdraft (model 1) or to cover a net funds debit position (models 2 or 3). The imposition of binding caps would, of course, require participants to maintain higher balances or higher fail rates would occur. Some systems have apparently concluded that the use of caps could cause fails to escalate to the point where substantial numbers of securities transfers could not be completed on the settlement day, that is, where -gridlock- could develop.³¹ Moreover, those systems that impose a binding collateral requirement may believe that the need for collateral will efficiently limit credit extensions to avoid serious liquidity problems in the event of a failure to repay. Finally, as noted earlier, some model 3 systems do not impose any risk controls other than membership standards.

4.4 Even if relatively strong safeguards are employed, a securities settlement system should establish a clear understanding as to how credit losses and liquidity pressures would be distributed in the event of a participants failure to repay a credit extension. In some systems the system operator or some other entity guarantees settlement. To protect itself and, if necessary, to make its guaranty credible, the guarantor would typically impose some of the risk controls discussed above - membership standards, collateralisation, or (less frequently) caps. In addition, unless the guarantor is a central bank, it would need to arrange access to liquidity facilities to ensure that it could complete settlements on schedule. The existence of a guarantor need not imply that participants would not bear any credit risk. In some cases the guarantor takes responsibility for liquidating any unencumbered collateral of a defaulting participant, but if the value of the collateral were insufficient to cover the credit extended, losses would be charged to the surviving participants. This allocation of losses could be based on the surviving participants' transfer activity with the failed participants or losses could be mutualised (spread across the entire membership). In either case, the guarantor might require participants to collateralise their contingent obligations through contributions to a collateral pool.

4.5 In model 3 systems without a guaranty, a default normally triggers the revocation of some transfer instructions. If the only transfer instructions revoked are those involving the participant that failed (an unwind), any replacement costs and liquidity pressures are borne initially by the counterparties of the failed participant (and perhaps by those participants' customers). If a partial unwind is possible, these liquidity pressures might well be manageable. But if the rules require a complete unwinding of transfers involving the failed participant, considerable systemic risk could be involved. On the funds side, the liquidity demands placed on some participants that dealt with the failed participant could, in theory far exceed the size of the net debit position that the participant failed to cover. On the securities side, a complete unwinding could create short positions in securities accounts that may be very difficult to cover.³²

Risk of Failure of a Settlement Bank, Guarantor or Custodian

4.6 In addition to counterparty credit and liquidity risks, some systems must consider the potential consequences of failure of a settlement bank, a guarantor (either the securities buyer's bank in an assured payment system or the guarantor of all settlement obligations in some other systems) or a custodian of securities. The risk of settlement bank failure has been eliminated in some systems by using central bank funds for payments. However, as noted earlier, in other cases some participants do not have access to central bank funds accounts. If central bank accounts cannot be used, several steps can, nonetheless, be taken to mitigate the risk of losses from a settlement bank failure. One possible approach is to diversify the risk by using multiple settlement banks. However, the settlement process with multiple banks would be more complicated; funds transfers between banks would be necessary to balance net funds debits and net funds credits at each of the banks. Completion of settlement might then hinge on completion of these transfers, introducing another source of potential error and delay into the process. As noted earlier, one step that is certain to reduce the risk of loss from settlement bank failure is to require the settlement banks to offer participants same-day availability.³³ Of course, when funds must be made available on a same-day basis, liquidity problems must be dealt with on a same-day basis. The Group of Thirty has concluded that the trade-off in moving from next-day to same-day funds is favourable, but the use of same-day funds increases the need for liquidity safeguards, which, as noted earlier, are not always very robust in existing securities settlement systems.

4.7 Model 2 systems that create an assured payment system to reduce the risk of losses from participant defaults must also give careful consideration to potential losses from the failure of a guarantor bank, especially since the full principal value of the securities transferred to the buyer would be at risk. At a minimum, financial standards for guarantor banks would appear necessary to ensure that only banks of the highest credit standing could act as guarantors. To provide further protection, at least one system is considering: placing caps on the net debit positions of individual participants, which would imply caps on the sum of the net debit positions guaranteed by any one bank; requiring the guarantors to enter into an agreement to share losses from the failure of a guarantor; and requiring the guarantors to collateralise their contingent obligations under the loss-sharing agreement.

4.8 Two other sources of risk must be considered in certain systems. First, in those systems (models 1, 2 or 3) in which the system operator or some other entity guarantees the completion of settlement of transfer instructions executed by the system, the risk of the failure of that guarantor must be considered. Clearly, such a failure could create serious systemic problems.³⁴ To ensure its financial integrity, a guarantor would need to impose various risk controls that limit its exposures to participants and ensure timely completion of settlements. Secondly, if the securities settlement system does not dematerialise securities or immobilise certificates itself but instead relies on the custody services of third parties (custodians), the risk of failure of a custodian must be considered. Even if there is no risk of loss of the value of the securities held by the custodian, the ability of participants to transfer the securities (other than to other participants) might temporarily be impaired.³⁵

Footnotes:

29. In the short run, the trade-off is between risk and efficiency, where efficiency is measured by the proportion of scheduled securities transfers that can be completed. In the longer run, the trade -off is between risk and cost- the cost of maintaining higher balances or enhancing the system in ways that reduce uncertainty, for example allowing participants to interact with the system (including adjusting balances during the processing cycle).

30. Even if a collateral requirement is binding, the degree of protection provided would depend on the effectiveness of the lien and on the quality of the collateral. Reliance on collateral to limit credit risks would raise particular concerns where an unanticipated default by the issuer of the security serving as collateral is a significant risk, notably in transfer systems for money market instruments such as commercial paper.

31. Concerns about gridlock tend to be especially acute in systems for transferring government securities, because a reduction in market liquidity could increase the interest cost on the national debt and, in cases in which open market operations are conducted in government securities, because the implementation of monetary policy might be complicated. It should also be noted, however, that, to the extent that caps are perceived to contribute to the stability of the settlement system, market liquidity would tend to be enhanced.

32. As noted earlier, a short position could result because the system may not reverse subsequent transfers made by a participant that received securities from the failed participant. If the subsequent transfer were reversed, participants that had not dealt directly with the failed participant would be adversely affected by the failure.

33. The use of same-day funds is possible, however, only if the national payment system provides same-day finality, a condition not yet satisfied in all G-10 countries.

34. An obvious parallel is with the potential consequences of failure of a central counterparty in a multilateral foreign exchange netting system.

35. Such custodial risk also typically exists for indirect participants in securities settlement systems whose securities are held in custody by direct participants. While for completeness the Study Group has identified custodian failure as a source of risk, analysis of the potential consequences is a very complex issue that is beyond the scope of this report.