2015 Assessment of the Reserve Bank Information and Transfer System Appendix B: Detailed Assessment of the Reserve Bank Information and Transfer System

This Appendix sets out the detailed Assessment of how well RITS observed the Principles developed by CPMI and IOSCO in the 2015 assessment period. This Assessment was produced by the Bank's Payments Policy Department, which is the functional area responsible for oversight of the payments system, drawing on information provided by the Bank's Payments Settlements Department, which is the functional area responsible for operating RITS. The conclusions have been endorsed by the PSB. In its assessment, Payments Policy Department have applied the rating system used in the CPMI-IOSCO Disclosure Framework. Under this framework, observance of each of the applicable Principles is rated according to the following scale:

• Observed – Any identified gaps and shortcomings are not issues of concern and are minor, manageable and of a nature that the FMI could consider taking them up in the normal course of its business.
• Broadly observed – The assessment has identified one or more issues of concern that the FMI should address and follow up on in a defined time line.
• Partly observed – The assessment has identified one or more issues of concern that could become serious if not addressed promptly. The FMI should accord a high priority to addressing these issues.
• Not observed – The assessment has identified one or more serious issues of concern that warrant immediate action. Therefore, the FMI should accord the highest priority to addressing these issues.
• Not applicable – The standard does not apply to the type of FMI being assessed because of the particular legal, institutional, structural or other characteristics of the FMI.

The ratings of RITS against the relevant Principles are supplemented by detailed information under each Key Consideration that is relevant to the Assessment. In assessing RITS, Payments Policy Department have relied on guidance on the application of the Principles to central bank FMIs published by CPMI and IOSCO in August 2015.

1. Legal basis

A payment system should have a well-founded, clear, transparent and enforceable legal basis for each material aspect of its activities in all relevant jurisdictions.

Rating: Observed

RITS is owned and operated by the Bank. The RITS Regulations form the legal basis for all key aspects of RITS. The Bank seeks external legal advice on material amendments to the RITS Regulations and associated contractual agreements, including, where relevant, on the interaction of such amendments with Australian and New South Wales laws and regulations. Based on this information, Payments Policy Department's assessment is that RITS has observed the requirements of Principle 1 during the 2015 Assessment period.

Nonetheless, while the RITS Regulations are comprehensive, changes to functionality and activity since the launch of RITS have added to their complexity. In light of this, the Bank is undertaking a major restructure and rewrite of the RITS Regulations. The main objective of the new version is to improve the clarity of the Regulations. To ensure that RITS continues to meet international best practice, it is recommended that the Bank continue to work towards implementation of new RITS Regulations, with a view to improving their clarity.

The legal basis of RITS is described in further detail under the following Key Considerations.

1.1 The legal basis should provide a high degree of certainty for each material aspect of a payment system's activities in all relevant jurisdictions.

The legal basis of RITS is set out in the RITS Regulations, which cover the operation of RITS, and the rights and obligations of participants and the Bank. Standard agreements are executed to bind each participant to the RITS Regulations. In addition to the RITS Regulations, the following key aspects of RITS activities are supported by Australian legislation and additional contractual arrangements.

RTGS feeder systems

RITS accepts settlement instructions from approved feeder systems. Admission as a feeder system is by specific reference in the RITS Regulations. The RTGS feeder systems are the SWIFT PDS, Austraclear and CHESS RTGS.^[28] The SWIFT PDS is administered by APCA under its HVCS. The Bank and APCA each have contractual arrangements with SWIFT covering the SWIFT PDS. The Austraclear and CHESS RTGS feeder systems are operated by Austraclear and ASX Settlement, respectively. Both entities are wholly owned subsidiaries of ASX. The Bank has separate contractual arrangements with Austraclear and ASX Settlement covering these feeder systems.

Settlement finality

The RITS Regulations state that settlement is final when the ESAs of the paying and receiving participants in RITS are simultaneously debited and credited, respectively. The irrevocability of payments settled in RITS is protected by RITS's approval as an RTGS system under Part 2 of the Payment Systems and Netting Act 1998 (PSNA). With this approval, a payment executed in RITS at any time on the day on which a RITS participant enters external administration has the same standing as if the participant had gone into external administration on the next day. Accordingly, in the event of insolvency all transactions settled on the day of the insolvency are irrevocable and cannot be unwound.

Similarly, the irrevocability of settled transactions originating from the Austraclear and CHESS RTGS feeder systems is supported by their respective approvals as RTGS systems under Part 2 of the PSNA.

Netting arrangements

In the unlikely event that RITS is unavailable for a significant period of time, payments arising from Austraclear and the SWIFT PDS can be settled using ‘fallback arrangements’. These arrangements involve the multilateral netting and settlement of transactions arising from those systems. The irrevocability of settlement under these fallback arrangements is supported by the approval of Austraclear and HVCS as netting arrangements under Part 3 of the PSNA. The approval of HVCS establishes the legal basis for the netting of SWIFT PDS payments.

While RITS is primarily an RTGS system, it also provides for the final settlement of net obligations arising in other payment and settlement systems. This is either through the LVSS or the batch feeder functionality.^[29] RITS's approval under Part 2 of the PSNA does not ensure the legal certainty of the netting of the underlying obligations. Nevertheless, the majority of the value of obligations settled in these multilaterally netted batches originates from the APCA clearing streams and transactions settled in the CHESS batch, which are approved netting arrangements under Part 3 of the PSNA.

Enforceability of repurchase agreements

The enforceability of repos in the event of a default also requires a high degree of legal certainty. Repos with the Bank are governed by an international standard agreement – The Bond Market Association (TBMA)/International Securities Market Association (ISMA) GMRA 2000 version – as amended by exhibits under the RITS Regulations.^[30] This agreement sets out, among other things, what constitutes default and the consequential rights and obligations of the parties. In the event of a default, the agreement allows the non-defaulting party to terminate the agreement, calculating the net obligation based on the prevailing market value at the time the contract is closed out. Close-out netting provisions included in repo contracts with RITS participants provide for the immediate liquidation of collateral in the event of default. This right is supported by Part 4 of the PSNA.

As part of the changes to the RITS Regulations, the Bank is also moving from the 2000 to the 2011 GMRA. The 2011 GMRA reflects lessons from the global financial crisis and the collapse of Lehman Brothers. It simplifies the calling of an event of default, gives the non-defaulting party more flexibility in determining the value of securities as part of the close-out procedure, and allows the close-out amount to be set-off against any other amounts payable by the non-defaulting party to the defaulting party. The latest version of the GMRA also broadens the definition of ‘act of insolvency’, which provides the flexibility to deal with insolvency events in a wide range of jurisdictions.

1.2 A payment system should have rules, procedures, and contracts that are clear, understandable, and consistent with relevant laws and regulations.

To facilitate a clear understanding of RITS rules and procedures, the RITS Regulations are supplemented by information papers and user guides that explain RITS requirements and functions. This material facilitates existing and prospective participants' understanding of the RITS Regulations and the risks they face by participating in RITS. Nonetheless, changes to functionality and activity since the launch of RITS have added to complexity of the RITS Regulations. As mentioned above, the Bank is undertaking a major restructure and rewrite of the RITS Regulations, with the objective of improving their clarity. The Bank is aiming to implement the new Regulations in 2016, following consultation with participants.

The Bank also seeks external legal advice on material amendments to the RITS Regulations and associated contractual agreements, including, where relevant, on the interaction of such amendments with Australian and New South Wales laws and regulations.

1.3 A payment system should be able to articulate the legal basis for its activities to relevant authorities, participants, and, where relevant, participants' customers, in a clear and understandable way.

At a high level, the legal basis for RITS is articulated in a clear and understandable manner on the Bank's website and the RITS Information Facility.^[31] The information paper on the RITS Regulations provides further detail on RITS's legal basis.^[32]

1.4 A payment system should have rules, procedures, and contracts that are enforceable in all relevant jurisdictions. There should be a high degree of certainty that actions taken by the payment system under such rules and procedures will not be voided, reversed, or subject to stays.

To ensure that the RITS Regulations and associated contractual agreements are enforceable, the Bank seeks external legal advice on material amendments to these documents.

There have been no court cases that have tested the RITS legal framework.

1.5 A payment system conducting business in multiple jurisdictions should identify and mitigate the risks arising from any potential conflict of laws across jurisdictions.

The RITS Regulations are governed by New South Wales law and require that all participants submit to the non-exclusive jurisdiction of the courts of New South Wales. Since 2011, the Bank has required foreign RITS applicants to provide a legal opinion affirming that the RITS membership legal documents constitute valid, legally binding and enforceable obligations.^[33] This opinion must cover whether the courts in the home jurisdiction of the applicant will give effect to the choice of New South Wales law as the governing law and whether the judgement of an Australian court would be enforceable in the home jurisdiction without retrial or re-examination.

2. Governance

A payment system should have governance arrangements that are clear and transparent, promote the safety and efficiency of the payment system, and support the stability of the broader financial system, other relevant public interest considerations, and the objectives of relevant stakeholders.

Rating: Observed

RITS is owned and operated by the Bank. Since it is not operated as a separate entity, the management and operation of RITS fall under the governance structure of the Bank, and are subject to the Bank's normal oversight, decision-making and audit processes. The Bank has clear and transparent governance arrangements, which are publicly available on the Bank's website. The specific objectives in relation to the Bank's operation of RITS are also published on its website. These are consistent with the high-level objectives of the Bank, which emphasise the stability of the broader financial system and the welfare of the Australian people. Accordingly, the Bank aims to provide infrastructure through which settlement obligations arising from the exchange of high-value payments and debt securities settlements can be extinguished in a safe and efficient manner. To ensure that the interests of relevant stakeholders are taken into account, the Bank engages in routine liaison with participants and consults on material changes to operational arrangements. Oversight of RITS is carried out by the Payments Policy Department, within the policy framework for which the Payments System Board has ultimate responsibility.

Based on this information, Payments Policy Department's assessment is that RITS has observed the requirements of Principle 2 during the 2015 Assessment period. Details of the governance arrangements for RITS are described under the following Key Considerations.

2.1 A payment system should have objectives that place a high priority on the safety and efficiency of the payment system and explicitly support financial stability and other relevant public interest considerations.

The high-level objectives of the Bank are set out in the Reserve Bank Act 1959. The Bank's duty is to contribute to the stability of the currency, maintenance of full employment, and the economic prosperity and welfare of the Australian people. Stability of the financial system is also a longstanding responsibility of the Bank – a mandate confirmed by the Australian Government when it introduced significant changes to Australia's financial regulatory structure in July 1998.^[34]

The Bank's website states its specific objectives in relation to its operation of RITS. In particular, the Bank's objective in developing and operating RITS is to provide the infrastructure through which settlement obligations arising from the exchange of high-value payments and debt securities settlements can be extinguished in a safe and efficient manner. The design of RITS ensures that there is no build-up of settlement exposures associated with high-value transactions, which in turn promotes the stability of Australia's financial system. Reflecting the critical importance of RITS to the Australian financial system, the Bank aims to operate RITS at an extremely high standard of availability and resilience, and to ensure that its settlement services continue to evolve to meet the changing needs of the broader payments system.

Decisions concerning the operation of RITS and ESAs are required to be consistent with the policy environment determined by Payments Policy Department, under the governance of the Payments System Board. The broad mandate of the Payments System Board, which is set out in the Reserve Bank Act, places a high priority on the safety and the efficiency of the wider Australian payments system.^[35]

2.2 A payment system should have documented governance arrangements that provide clear and direct lines of responsibility and accountability. These arrangements should be disclosed to owners, relevant authorities, participants, and, at a more general level, the public.

Information on the Bank's governance arrangements for RITS is documented on the Bank's website and described in Section A.1.^[36]

The Bank's governance arrangements reflect relevant provisions of the Reserve Bank Act and the Public Governance, Performance and Accountability Act 2013. In accordance with the Reserve Bank Act, the Governor is responsible for the management of the Bank and is therefore ultimately responsible for the operation of RITS. In fulfilling his responsibilities to manage the Bank, in particular under the Reserve Bank Act and as the accountable authority under the Public Governance, Performance and Accountability Act, the Governor is assisted and supported by the Executive Committee, which is comprised of the Bank's most senior executives. The Executive Committee is the key decision-making committee of the Bank for matters of an administrative and management nature that have strategic, Bank-wide or external significance. Accordingly, major decisions related to RITS are considered by the Executive Committee.

Decisions affecting the day-to-day operations, customer relations and development of RITS have been delegated to the Bank's Payments Settlements Department. Payments Settlements Department is part of the Bank's Banking and Payments Group, which is headed by an Assistant Governor who reports to the Governor and Deputy Governor.^[37] Clear internal procedures are in place to elevate day-to-day operational matters within Payments Settlements Department and other areas of the Bank, as appropriate.

Oversight of RITS is carried out by the Bank's Payments Policy Department, within the policy framework for which the Payments System Board has ultimate responsibility. Payments Policy Department is separate from Payments Settlements Department in the Bank's organisational structure, with separate reporting lines up to and including the level of Assistant Governor. The two departments nevertheless meet regularly to discuss policy issues and operational developments, and the Payments System Board is periodically updated on relevant developments.

As an independent central bank and statutory body, the Bank is ultimately accountable to the Parliament of Australia. Since 1996, the Governor and senior officers of the Bank have appeared twice yearly before the House of Representatives Standing Committee on Economics to report on matters under the responsibility of the Bank. The Reserve Bank Act also requires that the Bank inform the Australian Government of its policies ‘from time to time’. In addition, to fulfil its obligations under the Public Governance, Performance and Accountability Act, the Bank prepares an annual report for presentation to the Treasurer and tabling in the Parliament.^[38] The Payments System Board produces a separate annual report, which is also presented to the Treasurer and tabled in the Parliament, although this is not a legislative requirement.^[39]

2.3 The roles and responsibilities of a payment system's board of directors (or equivalent) should be clearly specified, and there should be documented procedures for its functioning, including procedures to identify, address, and manage member conflicts of interest. The board should review both its overall performance and the performance of its individual board members regularly.

As described in Key Consideration 2.2, the Governor, with assistance from the Executive Committee, is ultimately responsible for the management of the Bank, including the operation of RITS. The roles and responsibilities of the Governor are set out in the Reserve Bank Act and the Public Governance, Performance and Accountability Act. The roles and responsibilities of members of the Executive Committee are set out in internal position descriptions.

In recognition of the Governor's responsibility for maintaining a reputation for integrity and propriety on the part of the Bank, the Governor and other members of the Executive Committee are subject to the Code of Conduct for Reserve Bank Staff, which places a high priority on integrity and has provisions that address potential conflicts of interest. Specific Bank policies deal with potential conflicts of interest arising from the Bank's roles as the principal regulator of the payments system and as provider of banking services to the Australian Government.^[40]

2.4 The board should contain suitable members with the appropriate skills and incentives to fulfil its multiple roles. This typically requires the inclusion of non-executive board member(s).

Under the terms of the Reserve Bank Act, the Governor is appointed by the Treasurer. Since RITS is owned by the Bank, and is not operated as a separate legal entity, the skills and qualifications of the Governor are determined in accordance with the Bank's broader responsibilities. The Bank has human resources policies in place to help ensure that senior staff, including members of the Executive Committee, have the appropriate skills and incentives. These policies are described in Key Consideration 2.5.

2.5 The roles and responsibilities of management should be clearly specified. A payment system's management should have the appropriate experience, a mix of skills, and the integrity necessary to discharge their responsibilities for the operation and risk management of the payment system.

The roles and responsibilities of the management responsible for the day-to-day operation of RITS are clearly documented in position descriptions.

The Bank has human resources policies in place to help ensure that management positions are filled with employees with the appropriate skills, incentives, experience and integrity to perform their duties. The Bank has formal performance management arrangements, which help to clarify the expectations of supervisors and employees and ensure that timely feedback is provided. Recruitment and selection at the Bank is based on the suitability of an applicant to carry out the specific requirements of the position to be filled, having regard to the applicant's ability to perform the duties of the position, relevant experience, relevant training and qualifications, and willingness to meet any particular requirement specified in the position description. Bank staff are subject to the Code of Conduct for Reserve Bank Staff (see Key Consideration 2.3).

The Bank also aims to offer remuneration packages that attract employees able to perform their duties to a high standard. To this end, independent consultants are engaged from time to time to ensure that remuneration policies are consistent with market practice. The Remuneration Committee of the Reserve Bank Board is kept informed of the remuneration arrangements for Bank staff.

2.6 The board should establish a clear, documented, risk-management framework that includes the payment system's risk tolerance policy, assigns responsibilities and accountability for risk decisions, and addresses decision making in crises and emergencies. Governance arrangements should ensure that the risk-management and internal control functions have sufficient authority, independence, resources, and access to the board.

The Bank has a well-established risk management framework that facilitates the identification, assessment and treatment of all risks – including those arising from its operation of RITS – at both an enterprise (‘top-down’) and business (‘bottom-up’) level. Risk management is seen as an integral part of the management function within the Bank. Line managers have the responsibility to evaluate their risk environment, put in place appropriate controls, and monitor the effectiveness of these controls. Management is supported in this role through the development and maintenance of a culture that acknowledges the need for careful analysis and management of risk in all business processes.

The Bank's risk management framework is set out at a high level in the Bank's Risk Management Policy.^[41] Risks associated with the formulation of monetary and payments policies are the direct responsibility of the Reserve Bank Board and the Payments System Board, respectively. The Boards review management of these risks periodically as part of their decision-making processes. The Risk Management Policy is complemented by a Risk Appetite Statement, which provides an outline of the Bank's appetite for and approach to managing its most significant risks, including strategic, financial, people and operational risks.

The risk management framework, including the Risk Management Policy and Risk Appetite Statement, is governed by the Risk Management Committee, in accordance with the Risk Management Committee Charter. This Committee consists of members of the executive team who are responsible for the Bank's operational areas or key support functions. It is chaired by the Deputy Governor and comprises: the Assistant Governors for Banking and Payments, Corporate Services, Currency and Financial Markets; the Chief Financial Officer; the Chief Information Officer; the Heads of Audit Department, Human Resources Department, Information Department and Risk and Compliance Department; and the General Counsel. The Risk Management Committee meets six times a year, or more frequently if required, and reports on its activities both to the Executive Committee and the Reserve Bank Board Audit Committee.

The Risk Management Committee is assisted in its responsibilities by Risk and Compliance Department, the main role of which is to assist individual business areas to manage their risk environment within a broadly consistent framework. Risk and Compliance Department also monitors risk and reports on portfolio risks and compliance with respect to the Bank's operations in financial markets, and provides support to business areas in the implementation of fraud control, business continuity and compliance management. The Head of Risk and Compliance Department reports directly to the Deputy Governor.

Audit Department also supports the framework for managing risk, complementing but remaining separate from the work of Risk and Compliance Department. In addition to providing assurance that the Bank's risk management policies are effective, Audit Department has a separate, independent mandate to test the adequacy of procedures and controls at all levels of the Bank. The Head of Audit Department reports to the Deputy Governor and the Reserve Bank Board Audit Committee.

Crisis and emergencies

In circumstances including a significant disruption to the Bank's operations that affects several business areas, the Governor may delegate responsibility for coordination of the Bank's response, either to the Bank's Crisis Management Group or an individual. The Crisis Management Group's membership would vary with the nature of the disruption and would typically comprise executives from a number of areas of the Bank.

Payments Settlements Department also maintains plans that address decision making in crises and emergencies. These plans cover operational disruptions (see Principle 17) and the default of a RITS participant (see Principle 13). The plans are required to set out how Payments Settlements Department would communicate with the Crisis Management Group during a disruption.

2.7 The board should ensure that the payment system design, rules, overall strategy, and major decisions reflect appropriately the legitimate interests of its direct and indirect participants and other relevant stakeholders. Major decisions should be clearly disclosed to relevant stakeholders and, where there is a broad market impact, the public.

The Bank's governance arrangements ensure accountability and transparency to RITS participants and other relevant parties. To ensure the interests of relevant stakeholders are taken into account, the Bank engages in routine liaison with participants and consults on all material changes to operational arrangements (see Principle 21). All decisions affecting the operation of RITS are advised to participants. Policy decisions that affect RITS are also communicated to the public through media releases. Major decisions and the reasons for them are also explained in the Reserve Bank Annual Report and, if relevant, the Payments System Board Annual Report.

3. Framework for the comprehensive management of risks

A payment system should have a sound risk-management framework for comprehensively managing legal, credit, liquidity, operational, and other risks.

Rating: Observed

The Bank has a well-established risk management framework which facilitates the identification, assessment and treatment of all risks – including those arising from its operation of RITS – at both an enterprise (‘top-down’) and business (‘bottom-up’) level. Under the Bank's Risk Management Policy, Payments Settlements Department aims to identify in a single Risk Register all risks that might impact its ability to operate RITS in a safe and efficient manner. This includes risks arising from interdependencies with other participants, other FMIs or service providers. The Risk Register is updated at least annually, or when material changes to operations or the business environment occur. Payments Settlements Department also designs and applies appropriate controls to mitigate identified risks. This high-level framework is supported by more detailed policies (see Principles 4, 5, 7 and 17) and a governance structure to oversee the Bank's risk management activities (see Key Consideration 2.6).

Based on this information, Payments Policy Department's assessment is that RITS has observed the requirements of Principle 3 during the 2015 Assessment period. The framework for the comprehensive management of risks in RITS is described in further detail under the following Key Considerations.

3.1 A payment system should have risk-management policies, procedures, and systems that enable it to identify, measure, monitor, and manage the range of risks that arise in or are borne by the payment system. Risk-management frameworks should be subject to periodic review.

The Bank's risk management framework is set out under Key Consideration 2.6. Under this framework, Payments Settlements Department is required to identify all of the risks that might impact its ability to operate RITS in a safe and efficient manner in a single Risk Register. Risks are categorised at a high level into strategic, credit, liquidity and operational risks, and further sub-categorised into more detailed risk groups (e.g. legal and information technology risks are sub-categories of operational risk). For each risk that has been identified, Payments Settlements Department sets out the potential impact and probability of the risk occurring, and also identifies existing controls and mitigation strategies (including contingency plans) to reduce the likelihood and/or impact of the risk crystallising. Where a risk is co-managed by another business area – for example, some RITS operational controls are implemented by the Bank's Information Technology Department – this must be acknowledged by the other business area.

The Bank's Risk Management Policy requires that Payments Settlements Department reviews and updates its register of risks annually, and after any major change to the Department's risk environment, to reflect any changes in risks and controls that have occurred. As part of this process, any residual risks identified in the Risk Register that are outside of the Department's risk appetite or agreed tolerance levels must be appropriately escalated. The Department's risk appetite must be consistent with the Bank's Risk Appetite Statement.

3.2 A payment system should provide incentives to participants and, where relevant, their customers to manage and contain the risks they pose to the payment system.

Given the design of RITS, participants do not pose liquidity or credit risks to the Bank as operator of RITS (see Principle 4 and 7). RITS participation requirements aim to reduce the likelihood that an individual participant would disrupt the operation of RITS. If a participant does not meet these participation requirements, the Bank may apply sanctions to or impose additional requirements on that participant (see Principle 18).

3.3 A payment system should regularly review the material risks it bears from and poses to other entities (such as other FMIs, settlement banks, liquidity providers, and service providers) as a result of interdependencies and develop appropriate risk-management tools to address these risks.

The Bank, in operating RITS, reviews the material risks that it bears from and poses to other entities. This is done in the context of its ongoing review of risks (such as the annual update of its Risk Register), and its processes for identifying risks associated with major changes to its risk environment, such as new activities or system changes. This is also part of the Bank's change management framework (see Key Consideration 17.1). The tools used to manage risks from other entities include service level agreements, customer support packages and documented operational and contingency procedures (see Key Consideration 17.7).

4. Credit risk

A payment system should effectively measure, monitor, and manage its credit exposures to participants and those arising from its payment, clearing, and settlement processes. A payment system should maintain sufficient financial resources to cover its credit exposure to each participant fully with a high degree of confidence.

Rating: Observed

The Bank is not exposed to credit risk from the settlement of payments between participants in RITS. These payments are settled using funds in participants' ESAs, which cannot be overdrawn, and the Bank does not guarantee any transaction submitted for settlement in RITS. In the event of the default of a participant, the Bank would not be exposed to a loss in its role as operator of RITS. Accordingly, RITS does not maintain financial resources to cover the default of a participant. In addition, the RTGS mode of settlement in RITS is designed to ensure that unintended credit risk does not arise between participants during the settlement process.

The Bank does, however, incur credit risk in the provision of liquidity to ‘approved’ participants through Standing Facilities in support of payments activity (see Section A.4 for more information on these facilities). This risk is managed by purchasing high-quality securities under a repurchase agreement (repo), applying a conservative haircut to the securities, and collecting mark-to-market margin (see Principle 5).

Based on this information, Payments Policy Department's assessment is that RITS has observed the requirements of Principle 4 during the 2015 Assessment period. Credit risk in RITS is described in further detail under the following Key Considerations.

4.1 A payment system should establish a robust framework to manage its credit exposures to its participants and the credit risks arising from its payment, clearing, and settlement processes. Credit exposure may arise from current exposures, potential future exposures, or both.

The Bank is not exposed to credit risk in its role as operator of RITS. Payments in RITS are settled using funds in participants' ESAs, which cannot be overdrawn, and the Bank does not guarantee any transaction submitted for settlement in RITS. Accordingly, in the event of a participant default the Bank would not be exposed to a loss in its role as operator of RITS.

The Bank does, however, incur credit risk in the provision of liquidity to approved participants under its Standing Facilities to support payments activity. This risk is primarily managed by purchasing securities under repo, in accordance with the Bank's risk management framework. The Bank also manages the credit risk arising from its Standing Facilities by restricting the counterparties that it enters into a repo with. In particular, to access the Bank's Standing Facilities, a RITS participant must be an ESA holder, a member of Austraclear, subject to an appropriate level of regulation, and able to ensure efficient and timely settlement of transactions within the Austraclear system.

Under the Bank's risk management framework, responsibility for approving and reviewing its collateral policies is the responsibility of Domestic Markets Department, with oversight from the Risk Management Committee. The policies, procedures and controls implemented to mitigate credit risk are subject to audit by Audit Department. The Bank's risk management framework is reviewed annually (see Key Consideration 2.6 for further detail on the Bank's risk management framework.)

The RTGS mode of settlement in RITS is also designed to ensure that unintended credit risks do not accumulate between participants during the settlement process. For payments using the SWIFT PDS, transactions are settled across ESAs in RITS prior to the payment messages being sent to the receiving participant. Austraclear transactions submitted to RITS for settlement generally represent the cash legs of debt security transactions, which are settled on a delivery-versus-payment model 1 basis to mitigate the credit risk associated with the settlement process. Since RITS cash transfers are payments between two ESA holders unintended credit risk would not arise.

4.2 A payment system should identify sources of credit risk, routinely measure and monitor credit exposures, and use appropriate risk-management tools to control these risks.

Under the Bank's risk management framework, Domestic Markets Department has responsibility for identifying and managing the credit risks that arise from its activities. For each credit risk identified, the Department sets out the potential impact and probability of the credit risk crystallising, and, where possible, the existing controls and mitigation strategies. These controls are reviewed and signed off by management annually, or when there are material changes to the Bank's risk environment.

The Bank incurs credit risk in the provision of liquidity to approved RITS participants under repo. This credit risk is mitigated by purchasing only high-quality securities, applying appropriate haircuts to the securities, and maintaining mark-to-market margin on a daily basis (see Principle 5). Participation requirements in RITS also help to reduce the probability of a participant default (see Principle 18). The Bank monitors the liquidity it provides to approved RITS participants and the composition of securities that it holds on a daily basis. This information is readily available via summary reports produced by the Bank's trade entry and collateral management system (see Key Consideration 5.6).

4.3 A payment system should cover its current and, where they exist, potential future exposures to each participant fully with a high degree of confidence using collateral and other equivalent financial resources (see Principle 5 on collateral). In the case of a deferred net settlement payment system in which there is no settlement guarantee but where its participants face credit exposures arising from its payment, clearing, and settlement processes, such a payment system should maintain, at a minimum, sufficient resources to cover the exposures of the two participants and their affiliates that would create the largest aggregate credit exposure in the system.

The credit risk assumed by the Bank in providing liquidity to RITS participants is mitigated by purchasing high-quality securities under repo, which could be closed out immediately upon default of the repo counterparty. The Bank also faces a potential future loss, which would crystallise in the event that a participant defaulted and the market value of collateral securities fell below the amount of credit provided under repo. This risk is mitigated by applying a haircut to the securities, calibrated to cover the maximum expected decline in the market price of the securities, over a conservative liquidation horizon, at a high level of confidence. The Bank also maintains mark-to-market margin on a daily basis to ensure that the price changes on the previous day do not erode the value of the securities it holds (see Principle 5 for further detail on eligible securities, haircuts and mark-to-market margin maintenance).

RITS is not a deferred net settlement payment system and accordingly the requirement to maintain sufficient resources to cover the exposures of the two participants and their affiliates that would create the largest aggregate credit exposure in the system does not apply.

4.7 A payment system should establish explicit rules and procedures that address fully any credit losses it may face as a result of any individual or combined default among its participants with respect to any of their obligations to the payment system. These rules and procedures should address how potentially uncovered credit losses would be allocated, including the repayment of any funds a payment system may borrow from liquidity providers. These rules and procedures should also indicate the payment system's process to replenish any financial resources that the payment system may employ during a stress event, so that the payment system can continue to operate in a safe and sound manner.

As explained under Key Consideration 4.1, in the event of a participant default the Bank would not be exposed to a loss in its role as operator of RITS. Nevertheless, the Bank maintains internal procedures that set out the course of action it would take after a participant default (see Principle 13).

5. Collateral

A payment system that requires collateral to manage its or its participants' credit exposure should accept collateral with low credit, liquidity, and market risks. A payment system should also set and enforce appropriately conservative haircuts and concentration limits.

Rating: Observed

The implementation of monetary policy is the primary driver of the Bank's collateral policies. Nevertheless, the Bank's collateral policies relating to its role as provider of liquidity to approved RITS participants are broadly consistent with this Principle. The Bank only purchases highly rated debt securities denominated in Australian dollars when providing liquidity to approved participants' ESAs. Collateral is conservatively valued and subject to haircuts, and mark-to-market margin is maintained on a daily basis.

Based on this information, Payments Policy Department's assessment is that RITS has observed the requirements of Principle 5 during the 2015 Assessment period. The Bank's collateral policies are described in further detail under the following Key Considerations.

5.1 A payment system should generally limit the assets it (routinely) accepts as collateral to those with low credit, liquidity, and market risks.

The Bank provides liquidity to approved participants primarily through Standing Facilities. Under these facilities, a participant can enter into a repo with the Bank, exchanging outright title to eligible securities in return for the credit of funds in its ESA with an agreement to reverse the transaction at some point in the future (see A.4 for more information on the Standing Facilities available). Participants can also source liquidity through securities transactions conducted by the Bank in the ‘open market’ each day – known as open market operations – which are aimed at maintaining the overnight cash rate at its target. These transactions usually involve counterparties selling debt securities to the Bank either under repo or outright.^[42]

The Bank only purchases highly rated debt securities denominated in Australian dollars under repo. This policy covers all of the Bank's repo activity, including both repos entered into under the Bank's Standing Facilities and in respect of open market operations. This policy is publicly available on the Bank's website.^[43] Eligible securities are generally restricted to highly liquid securities issued by entities with high credit quality, including those issued by: the Australian Government; the central borrowing authorities of the state and territory governments (semi-government securities); certain supranational organisations, foreign governments and government agencies with an explicit government guarantee; and ADIs.

In addition, any security accepted must meet the following criteria:

• The security must be denominated in Australian dollars.
• The security must be lodged and active in Austraclear, which is the central securities depository for debt securities in Australia.
• Securities accepted as collateral must generally meet a minimum credit rating.^[44]
• Asset-backed securities must be tradeable in the secondary market and must be based on a true sale of assets into a bankruptcy remote special purpose vehicle.
• Securities sold to the Bank under a repo must not enter the ‘closed period to maturity’ during the term of the repo.

The Bank also does not accept what it deems to be highly structured securities, such as collateralised debt obligations backed by other asset-backed securities.

If the above conditions are met, Australian Government and semi-government securities are automatically eligible collateral. All other securities are subject to an initial approval process. The Bank will not purchase securities under repo until the approval process for eligibility is complete and the securities are added to the Bank's list of eligible securities.^[45]

In order to assess the eligibility of the security, the minimum credit rating assigned to a security or its issuer by any of the major rating agencies will be used (except certain credit-enhanced securities such as covered bonds). For ADI-issued securities with a residual maturity greater than one year, at least two major credit rating agencies must rate the security or the issuer. For covered bonds issued by ADIs, where two or more security ratings are available, only the ratings on the security will be considered. If two security ratings are not available for ADI-issued covered bonds, the minimum issuer rating will also be considered.

The Bank routinely monitors events such as credit downgrades to ensure that its list of eligible collateral remains current. If a particular collateral security is no longer eligible, counterparties with outstanding repos in that security with the Bank will be required, on a same-day basis, to substitute eligible collateral.

To enhance its risk management of asset-backed securities, since 30 June 2015, the Bank has required the issuers of these securities to provide more detailed information in order for these securities to be eligible for repo with the Bank.^[46] The new criteria are being introduced primarily because of the Bank's potential exposure to asset-backed securities under its Standing Facilities. This exposure has increased significantly due to the implementation of open repos (see Section 3.5.1). The additional information, which will have to be kept up to date, covers both transaction-related data as well as information on the underlying assets (i.e. loan-level data).

Wrong-way risk

To mitigate wrong-way risk in its operations, the Bank will not purchase securities from an approved RITS participant if it considers that participant to be materially related to the credit quality of the security. Where applicable, the Bank's list of eligible securities identifies those counterparties considered to be related to specific securities. The Bank considers a material relationship to exist when the entities are members of the same corporate group, or where one entity has an ownership stake in another entity that exceeds 15 per cent.

Upon request by a participant, the Bank may purchase certain related-party asset-backed securities under repo through its Standing Facilities. However, these securities are subject to an additional haircut and additional reporting requirements. Relatedness thresholds also apply beyond which the Bank will not permit the use of the security, irrespective of the size of the haircut. The Bank considers each of the following parties to be related to an asset-backed security: the sponsor of the issuing trust; the loan originators; servicers; swap counterparties; liquidity providers; and guaranteed investment contract providers to the issuing trust. The magnitude of any additional haircut will depend on the nature of the relationship between the participant and the asset-backed security.

In the event of insolvency, the close-out netting provisions included in the repo agreements allow the Bank to close out or terminate the second leg of the repo immediately. This right is protected by Part 4 of the PSNA. Where an approved participant sells securities issued by a third-party issuer as collateral, both the participant and the issuer of the security would have to fail for the Bank to face substantial financial loss. In the event that an approved participant that had provided asset-backed securities and the issuing trust failed, the Bank would have recourse to the underlying assets (e.g. the residential mortgage loan pool).

5.2 A payment system should establish prudent valuation practices and develop haircuts that are regularly tested and take into account stressed market conditions.

Valuation

The Bank values securities purchased under repo using available market prices. When a timely market price is not available or reliable, the Bank uses conservative valuation formulae that are reviewed regularly.

Haircuts and mark-to-market margin maintenance

The Bank applies haircuts to all securities purchased under repo.^[47] For operational simplicity, uniform haircut rates are set for broad groups of securities rather than for individual securities, with an additional adjustment for approved related-party asset-backed securities depending on the degree of credit support provided to the transaction by the sponsor. Haircut rates are set to cover the maximum expected decline in the market price of the security, at a confidence level of at least 95 per cent based on a look back period that includes stressed market conditions. The key inputs to this calculation are market prices, the maturity of the securities in the relevant asset classes and the credit ratings of the securities. The Bank reserves the right to review haircuts at any time. The uniform haircut rates are publicly available on the Bank's website.^[48]

The Bank also maintains mark-to-market margin on a daily basis to cover changes in the value of its portfolio of securities.^[49] To do this, the Bank revalues all securities held under repo using the aforementioned valuation practices at the start of each business day. Where the Bank's net exposure to a counterparty is greater than $1 million and represents more than 1 per cent of the net repurchase amounts agreed with that party, the Bank will call for mark-to-market margin equal to its net exposure.^[50] Similarly, the Bank will meet requests for mark-to-market margin from a counterparty when it has a net exposure to the Bank greater than $1 million and where that net exposure represents more than 1 per cent of the net repurchase amounts agreed with that party.

5.3 In order to reduce the need for procyclical adjustments, a payment system should establish stable and conservative haircuts that are calibrated to include periods of stressed market conditions, to the extent practicable and prudent.

The Bank generally applies haircuts that are calibrated to include periods of stressed market conditions. Haircuts are calibrated to capture the stressed market conditions following the default of Lehman Brothers in late 2008. This reduces the need for procyclical haircut adjustments during periods of stress.

5.4 A payment system should avoid concentrated holdings of certain assets where this would significantly impair the ability to liquidate such assets quickly without significant adverse price effects.

The Bank routinely monitors transaction and collateral summary reports to ensure that the Bank is not exposed to large collateral concentration and liquidation risks. The key factor considered by the Bank is the depth of the market for each security when compared with the Bank's holdings of that security. This mitigates the risk of a price impact from liquidation of a large collateral holding.

5.5 A payment system that accepts cross-border collateral should mitigate the risks associated with its use and ensure that the collateral can be used in a timely manner.

The Bank mitigates the risks associated with cross-border collateral by imposing additional restrictions. The only cross-border collateral that the Bank currently accepts is very highly rated Australian dollar-denominated securities issued or guaranteed by a foreign government or issued by a supranational. These securities must be issued under and governed by Australian law. In addition, because certain cross-border securities may be less liquid than domestic securities, the Bank applies higher haircuts to these securities. There is no operational risk associated with differences in time zones since all collateral must be lodged in Austraclear. The Austraclear system and RITS have similar operating hours.

5.6 A payment system should use a collateral management system that is well-designed and operationally flexible.

The Bank relies on a well-designed and operationally flexible trade entry and collateral management system to manage the securities it purchases under repo. This system is a widely used integrated trading, middle-office and back-office system, and has been extensively customised for the Bank. Transactions involving the exchange of securities with approved participants are recorded and tracked in this system.^[51] In addition, the system facilitates the calculation and execution of haircuts and margin calls. Using this system, the Bank has the capacity to produce a wide variety of reports. The system supports the buying, selling, margining, substitution and liquidation of securities in a timely manner. The Bank ensures that there are sufficient resources to maintain its trade entry and collateral management system to a high standard.

Since February 2014, RITS participants have had the option to use ASX Collateral services to deliver a subset of eligible securities under certain types of repos.^[52] ASX Collateral is a collateral management service that acts as an agent to automate the allocation and optimisation of collateral in respect of securities held in Austraclear.^[53] As agent, ASX Collateral is responsible for ensuring that securities delivered to the Bank's Austraclear account using its service are appropriately valued and meet the Bank's eligibility requirements. ASX Collateral also offers extensive reporting functionality, including reports on collateral transactions and securities held.

The Bank does not re-use securities it receives under repo.

7. Liquidity risk

A payment system should effectively measure, monitor, and manage its liquidity risk. A payment system should maintain sufficient liquid resources in all relevant currencies to effect same-day and, where appropriate, intraday and multiday settlement of payment obligations with a high degree of confidence under a wide range of potential stress scenarios that should include, but not be limited to, the default of the participant and its affiliates that would generate the largest aggregate liquidity obligation for the payment system in extreme but plausible market conditions.

Rating: Observed

RITS conducts its settlements on an RTGS basis and does not guarantee settlement. The Bank, as operator of RITS, does not therefore assume liquidity risk through these operations. Accordingly, many of the requirements under this Principle – including those around liquidity stress testing, monitoring, and the maintenance of a pool of liquid assets – do not apply.

However, settling payments on an RTGS basis does place liquidity demands on participants. RITS assists participants in the management of their liquidity requirements through its liquidity-efficient design, the provision of liquidity through Standing Facilities, and the provision of real-time information on transactions and ESA balances. The Bank's operational staff also continuously monitor settlement activity and participant balances in RITS for evidence of any disruption to the flow of liquidity, which could occur if a participant experienced an operational or financial problem. RITS's participation requirements aim to reduce the probability that such problems arise.

Based on this information, Payments Policy Department's assessment is that RITS has observed the requirements of Principle 7 during the 2015 Assessment period. Liquidity risk in RITS is described in further detail under the following Key Considerations.

7.1 A payment system should have a robust framework to manage its liquidity risks from its participants, settlement banks, nostro agents, custodian banks, liquidity providers, and other entities.

RITS conducts its settlements on an RTGS basis and does not guarantee settlement. The Bank, as operator of RITS, does not therefore assume liquidity risk in its operations. Since participants face liquidity risks, however, RITS assists participants in their liquidity management through: its liquidity-efficient design; the provision of liquidity through Standing Facilities; the provision of real-time information on transactions and ESA balances; and the provision of tools to manage their payments and liquidity (see Section A.4). Furthermore, RITS's participation requirements aim to reduce the probability that a participant experiences an operational or financial problem that could disrupt the flow of liquidity in the system (see Principle 18).

7.2 A payment system should have effective operational and analytical tools to identify, measure, and monitor its funding flows on an ongoing and timely basis, including its use of intraday liquidity.

Since RITS does not assume liquidity risk, there are no relevant funding flows for RITS to measure and monitor. In managing operational risk the Bank's operational staff continuously monitor the flow of liquidity and payments at both a system and participant level for evidence of any disruption to the flow of liquidity, which could occur if a participant experienced an operational or financial problem (see Principle 17). If such a disruption were observed, the Bank would liaise with participants to mitigate the impact. To further mitigate possible disruption under such a scenario, participants are required to inform the Bank in the event of any operational problem, and the RITS Regulations also set out actions that the Bank may take in response to a participant default (see Principle 13).

7.3 A payment system, including one employing a DNS mechanism, should maintain sufficient liquid resources in all relevant currencies to effect same-day settlement, and where appropriate intraday or multiday settlement, of payment obligations with a high degree of confidence under a wide range of potential stress scenarios that should include, but not be limited to, the default of the participant and its affiliates that would generate the largest aggregate payment obligation in extreme but plausible market conditions.

Since the Bank does not assume liquidity risk as operator of RITS, the requirement to maintain liquid resources to cover payment obligations in stressed scenarios does not apply.

7.5 For the purpose of meeting its minimum liquid resource requirement, a payment system's qualifying liquid resources in each currency include cash at the central bank of issue and at creditworthy commercial banks, committed lines of credit, committed foreign exchange swaps, and committed repos, as well as highly marketable collateral held in custody and investments that are readily available and convertible into cash with prearranged and highly reliable funding arrangements, even in extreme but plausible market conditions. If a payment system has access to routine credit at the central bank of issue, the payment system may count such access as part of the minimum requirement to the extent it has collateral that is eligible for pledging to (or for conducting other appropriate forms of transactions with) the relevant central bank. All such resources should be available when needed.

Since the Bank does not assume liquidity risk as operator of RITS, the minimum liquid resource requirement does not apply.

7.6 A payment system may supplement its qualifying liquid resources with other forms of liquid resources. If the payment system does so, then these liquid resources should be in the form of assets that are likely to be saleable or acceptable as collateral for lines of credit, swaps, or repos on an ad hoc basis following a default, even if this cannot be reliably prearranged or guaranteed in extreme market conditions. Even if a payment system does not have access to routine central bank credit, it should still take account of what collateral is typically accepted by the relevant central bank, as such assets may be more likely to be liquid in stressed circumstances. A payment system should not assume the availability of emergency central bank credit as a part of its liquidity plan.

Since the Bank does not assume liquidity risk as operator of RITS, the need to supplement its qualifying liquid resources is not relevant.

7.7 A payment system should obtain a high degree of confidence, through rigorous due diligence, that each provider of its minimum required qualifying liquid resources, whether a participant of the payment system or an external party, has sufficient information to understand and to manage its associated liquidity risks, and that it has the capacity to perform as required under its commitment. Where relevant to assessing a liquidity provider's performance reliability with respect to a particular currency, a liquidity provider's potential access to credit from the central bank of issue may be taken into account. A payment system should regularly test its procedures for accessing its liquid resources at a liquidity provider.

Since the Bank does not assume liquidity risk as operator of RITS, the requirement to maintain liquid resources to cover payment obligations in stressed scenarios does not apply.

7.8 A payment system with access to central bank accounts, payment services, or securities services should use these services, where practical, to enhance its management of liquidity risk.

Since the Bank does not assume liquidity risk as operator of RITS, the requirement to use central bank accounts, payment services or securities services, where practical, does not apply.

7.9 A payment system should determine the amount and regularly test the sufficiency of its liquid resources through rigorous stress testing. A payment system should have clear procedures to report the results of its stress tests to appropriate decision makers at the payment system and to use these results to evaluate the adequacy of and adjust its liquidity risk-management framework. In conducting stress testing, a payment system should consider a wide range of relevant scenarios. Scenarios should include relevant peak historic price volatilities, shifts in other market factors such as price determinants and yield curves, multiple defaults over various time horizons, simultaneous pressures in funding and asset markets, and a spectrum of forward-looking stress scenarios in a variety of extreme but plausible market conditions. Scenarios should also take into account the design and operation of the payment system, include all entities that might pose material liquidity risks to the payment system (such as settlement banks, nostro agents, custodian banks, liquidity providers, and linked FMIs), and where appropriate, cover a multiday period. In all cases, a payment system should document its supporting rationale for, and should have appropriate governance arrangements relating to, the amount and form of total liquid resources it maintains.

Since the Bank does not assume liquidity risk as operator of RITS, the requirement to test the sufficiency of its liquid resources does not apply.

7.10 A payment system should establish explicit rules and procedures that enable the payment system to effect same-day and, where appropriate, intraday and multiday settlement of payment obligations on time following any individual or combined default among its participants. These rules and procedures should address unforeseen and potentially uncovered liquidity shortfalls and should aim to avoid unwinding, revoking, or delaying the same-day settlement of payment obligations. These rules and procedures should also indicate the payment system's process to replenish any liquidity resources it may employ during a stress event, so that it can continue to operate in a safe and sound manner.

The RITS Regulations include rules and procedures that govern the management of a participant default (see Principle 13). Since the Bank does not assume liquidity risk as operator of RITS, the requirement to establish rules and procedures to address unforeseen and potentially uncovered liquidity shortfalls and replenish any liquid resources do not apply.

8. Settlement finality

A payment system should provide clear and certain final settlement, at a minimum by the end of the value date. Where necessary or preferable, a payment system should provide final settlement intraday or in real time.

Rating: Observed

RTGS payments in RITS are settled individually in real time. The RITS Regulations specify that settlement is final when the ESAs of the paying and receiving RITS participants are simultaneously debited and credited, respectively. The irrevocability of payments settled in RITS is further protected by RITS's approval as an RTGS system under Part 2 of the PSNA.

Based on this information, Payments Policy Department's assessment is that RITS has observed the requirements of Principle 8 during the 2015 Assessment period. RITS's arrangements for ensuring finality of settlements are described in further detail under the following Key Considerations.

8.1 A payment system's rules and procedures should clearly define the point at which settlement is final.

The settlement of a payment in RITS is final and irrevocable when the ESAs of the paying and receiving RITS participants are simultaneously debited and credited, respectively.^[54] The point of settlement is clearly defined in Regulation 1 of the RITS Regulations. As explained under Key Consideration 1.1, this is further protected by RITS's approval as an RTGS system under Part 2 of the PSNA.

8.2 A payment system should complete final settlement no later than the end of the value date, and preferably intraday or in real time, to reduce settlement risk. A large-value payment system should consider adopting RTGS or multiple-batch processing during the settlement day.

RTGS payments in RITS are settled individually in real time. Although settlements occur in real time, a payment submitted to the RITS queue may remain there if the payer chooses not to settle the transaction (e.g. if the payer has set the status of the transaction to ‘deferred’) or has insufficient funds. Any payments that are not settled at the end of the last session during which the transaction was eligible for settlement are automatically removed from RITS but may be resubmitted for settlement when the system reopens (for more information on RITS session times refer to Section A.6).

8.3 An FMI should clearly define the point after which unsettled payments, transfer instructions, or other obligations may not be revoked by a participant.

Under Regulation 8 of the RITS Regulations, a participant can unilaterally revoke its outgoing RTGS payments at any time prior to settlement. RITS cash transfers can be revoked via the RITS User Interface, while payments sent via a feeder system must be revoked via that feeder system.

9. Money settlements

A payment system should conduct its money settlements in central bank money where practical and available. If central bank money is not used, a payment system should minimise and strictly control the credit and liquidity risk arising from the use of commercial bank money.

Rating: Observed

RITS conducts its money settlements in central bank money across participants' ESAs at the Bank.

Based on this information, Payments Policy Department's assessment is that RITS has observed the requirements of Principle 9 during the 2015 Assessment period. Money settlements in RITS are described in further detail under the following Key Considerations.

9.1 A payment system should conduct its money settlements in central bank money, where practical and available, to avoid credit and liquidity risks.

Money settlements in RITS are conducted in central bank money. Payment obligations in RITS are settled on an RTGS basis across ESAs at the Bank.

9.2 If central bank money is not used, a payment system should conduct its money settlements using a settlement asset with little or no credit or liquidity risk.

Money settlements in RITS are conducted using central bank money.

9.3 If a payment system settles in commercial bank money, it should monitor, manage, and limit its credit and liquidity risks arising from the commercial settlement banks. In particular, a payment system should establish and monitor adherence to strict criteria for its settlement banks that take account of, among other things, their regulation and supervision, creditworthiness, capitalisation, access to liquidity, and operational reliability. A payment system should also monitor and manage the concentration of credit and liquidity exposures to its commercial settlement banks.

Money settlements in RITS are conducted using central bank money.

9.4 If a payment system conducts money settlements on its own books, it should minimise and strictly control its credit and liquidity risks.

Money settlements in RITS are conducted using central bank money across the books of the Bank. The Bank's credit and liquidity risks from the operation and provision of liquidity in RITS are strictly controlled, as described in Principles 4 and 7.

9.5 A payment system's legal agreements with any settlement banks should state clearly when transfers on the books of individual settlement banks are expected to occur, that transfers are to be final when effected, and that funds received should be transferable as soon as possible, at a minimum by the end of the day and ideally intraday, in order to enable the payment system and its participants to manage credit and liquidity risks.

The Bank does not use commercial bank money settlement agents in the operation of RITS.

12. Exchange-of-value settlement systems

If a payment system settles transactions that involve the settlement of two linked obligations (for example, securities or foreign exchange transactions), it should eliminate principal risk by conditioning the final settlement of one obligation upon the final settlement of the other.

Rating: Not applicable

RITS is not an exchange-of value settlement system. It does not perform the settlement of foreign exchange transactions or securities transactions. RITS does, however, facilitate the settlement of linked securities, foreign exchange and property transactions in other systems, assisting to eliminate principal risk in those systems. In particular, RITS settles the interbank obligations arising from the cash leg of delivery-versus-payment debt and equity security transactions in Austraclear and ASX Settlement, respectively.^[55] RITS is also used to fund the Australian dollar leg of foreign exchange transactions settled on a payment-versus-payment basis in CLS's settlement system. RITS also facilitates the financial settlement of property transactions originating from a system operated by PEXA such that the lodgement of the title transfer only occurs once settlement has been assured by the reservation of funds in ESAs.

13. Participant-default rules and procedures

A payment system should have effective and clearly defined rules and procedures to manage a participant default. These rules and procedures should be designed to ensure that the payment system can take timely action to contain losses and liquidity pressures and continue to meet its obligations.

Rating: Observed

The RITS Regulations define what constitutes an insolvency event, as well as the rights and responsibilities of participants and the Bank in an insolvency scenario, and the actions the Bank may take to manage the situation. The Bank may suspend an insolvent participant, at which point the Bank will remove any queued payments to and from the participant, and prevent the input of any new payments involving the suspended participant. By permitting swift and decisive action in this way, the RITS Regulations allow the Bank to minimise the potential for a participant default to disrupt settlement in the system more widely.

Based on this information, Payments Policy Department's assessment is that RITS has observed the requirements of Principle 13 during the 2015 Assessment period. RITS's default management arrangements are discussed in further detail under the following Key Considerations.

13.1 A payment system should have default rules and procedures that enable the payment system to continue to meet its obligations in the event of a participant default and that address the replenishment of resources following a default.

13.2 A payment system should be well prepared to implement its default rules and procedures, including any appropriate discretionary procedures provided for in its rules.

The Bank has internal default management procedures that document the steps it would take in response to an insolvency event. These procedures outline the roles and responsibilities of management for each decision that must be taken after such an event, which persons should be consulted when taking each decision, and which persons should be advised of a decision. The procedures also set out which other Australian industry bodies and other FMIs should be contacted if a participant is suspended from RITS, and the methods available for communication with these parties. The procedures are tested and updated on a periodic basis.

13.3 A payment system should publicly disclose key aspects of its default rules and procedures.

The key aspects of the default management rules and procedures are set out in the RITS Regulations, which are publicly available on the Bank's website.

13.4 A payment system should involve its participants and other stakeholders in the testing and review of the payment system's default procedures, including any close-out procedures. Such testing and review should be conducted at least annually or following material changes to the rules and procedures to ensure that they are practical and effective.

Since RITS default management procedures do not require participants to perform any actions, participants are not involved in the testing or review of these procedures.

15. General business risk

A payment system should identify, monitor, and manage its general business risk and hold sufficient liquid net assets funded by equity to cover potential general business losses so that it can continue operations and services as a going concern if those losses materialise. Further, liquid net assets should at all times be sufficient to ensure a recovery or orderly wind-down of critical operations and services.

Rating: Observed

The Bank manages the general business risk arising from RITS within the context of its organisation-wide risk management framework (see Principle 3). This process covers the full spectrum of financial, market, credit, operational and other risks. This is supported by the Bank's budgeting and accounting processes, which allow it to monitor, manage and control its operating expenses. New projects are subject to strong governance arrangements, both prior to initiation and through the implementation process. As a central bank-owned FMI, RITS does not hold ring-fenced liquid net assets to cover general business risk. Nevertheless, should a general business risk crystallise, the Bank has access to sufficient liquid funds to meet its current and projected operating expenses.

Based on this information, Payments Policy Department's assessment is that RITS has observed the requirements of Principle 15 during the 2015 Assessment period. The Bank's arrangements for managing general business risk are discussed in further detail under the following Key Considerations.

15.1 A payment system should have robust management and control systems to identify, monitor, and manage general business risks, including losses from poor execution of business strategy, negative cash flows, or unexpected and excessively large operating expenses.

16. Custody and investment risks

A payment system should safeguard its own and its participants' assets and minimise the risk of loss on and delay in access to these assets. A systemically important payment system's investments should be in instruments with minimal credit, market, and liquidity risks.

Rating: Observed

Securities provided to the Bank as collateral under repo (both for payment system purposes and open market operations) must be lodged in Austraclear, which is a licensed clearing and settlement (CS) facility overseen by the Australian Securities and Investments Commission (ASIC) and the Bank and subject to the Financial Stability Standards for Securities Settlement Facilities (SSF Standards). Close-out netting provisions included in repo contracts with participants provide for the immediate liquidation of collateral in the event of default. This right is supported by Part 4 of the PSNA. In addition, the Austraclear system is subject to high operational resilience standards and operates in the same time zone as RITS, with highly overlapping operating hours. The Bank would therefore expect to have prompt access to the securities it holds as collateral.

The Bank does not hold the collateral it receives in providing liquidity to RITS participants at custodian banks, or with entities in other time zones or legal jurisdictions. The Bank accepts only securities collateral under repo and does not re-use collateral received. The Bank therefore does not face investment risks.

Based on this information, Payments Policy Department's assessment is that RITS has observed the requirements of Principle 16 during the 2015 Assessment period. Custody and investment risks in RITS are described in further detail under the following Key Considerations.

16.1 A payment system should hold its own and its participants' assets at supervised and regulated entities that have robust accounting practices, safekeeping procedures, and internal controls that fully protect these assets.

16.2 A payment system should have prompt access to its assets and the assets provided by participants, when required.

16.3 A payment system should evaluate and understand its exposures to its custodian banks, taking into account the full scope of its relationships with each.

The Bank does not use custodian banks to hold the collateral it receives in providing liquidity to RITS participants.

16.4 A payment system's investment strategy should be consistent with its overall risk-management strategy and fully disclosed to its participants, and investments should be secured by, or be claims on, high-quality obligors. These investments should allow for quick liquidation with little, if any, adverse price effect.

The Bank accepts only securities collateral under repo and does not re-use collateral received. The Bank therefore does not face investment risks.

17. Operational risk

A payment system should identify the plausible sources of operational risk, both internal and external, and mitigate their impact through the use of appropriate systems, policies, procedures, and controls. Systems should be designed to ensure a high degree of security and operational reliability and should have adequate, scalable capacity. Business continuity management should aim for timely recovery of operations and fulfilment of the payment system's obligations, including in the event of a wide-scale or major disruption.

Rating: Observed

RITS is designed to achieve a very high standard of operational reliability, with comprehensive policies and controls in place to: ensure reliability of IT infrastructure, monitor performance in real time and address potential problems promptly; maintain sufficient capacity; maintain the security and integrity of the system; and manage change effectively. The Bank manages the operational risks arising from RITS within the Bank's organisation-wide risk management framework (see Key Consideration 2.6).

The Bank sets clear operational reliability and capacity objectives and implements policies, procedures and controls to achieve those targets. The key operational targets for RITS are 99.95 per cent availability and minimum capacity to accommodate projected volumes 18 months in advance with 20 per cent headroom. The Bank has sufficient resources, including well-trained and competent personnel, to operate RITS. There is also an effective change management framework to ensure that system changes do not adversely affect the operation of RITS.

The Bank has also put in place a framework to maintain the security and integrity of RITS. Access to RITS is tightly controlled using a range of security controls. To gain access to the RITS User Interface, each user requires a RITS token with a valid and unique digital certificate; these are issued to users via a secure process. Access rights are controlled via unique logons for each user, creating an audit trail for each action within the system. All traffic across the various networks that are used to access RITS is encrypted. The RITS application and supporting infrastructure is segmented using firewalls approved by the Australian Signals Directorate (the agency responsible for evaluating information security products and services used by the Australian Government). Vulnerability assessments and penetration testing are undertaken periodically by external consultants.

Nonetheless, recognising the growing systemic threat originating from cyber-related risks and consistent with recommendations in the 2014 Assessment, the Bank has initiated a project to review and test the mechanisms in place to prevent a cyber-related incident. The first stage of this project will involve a review of risks and a stocktake of existing security controls. The next stage involves a comprehensive program of penetration testing. Based on the findings from the review and testing the Bank will consider whether additional measures should be put in place. This project is expected to be completed in 2016.

In November 2015, CPMI and IOSCO released for consultation draft guidance in the area of cyber resilience to support relevant requirements in the Principles. The guidance is intended to help FMIs enhance their cyber resilience and provide a framework for supervisory dialogue. The guidance is expected to be finalised in the first half of 2016. The Bank is encouraged to review its cyber risk management arrangements in light of the guidance when it is published.

RITS's business continuity arrangements include detailed contingency plans, which are updated at least annually and are tested regularly, with recovery time targets of up to 40 minutes, depending on the nature of the operational disruption. The primary control to reduce the impact of a disruption is a high degree of redundancy in RITS's architecture. RITS is synchronously mirrored at a geographically remote second site, which is permanently staffed. Full redundancy exists at both sites, ensuring that there is no single point of failure at either site. Live operations are rotated between the two sites on a regular basis. Staff rotation and cross-training ensure that critical functions are not dependent on particular individuals. The Bank also has succession planning processes in place for key positions.

In light of international developments and consistent with a recommendation in the 2014 Assessment, the Bank initiated a project to review and consider options to improve RITS's ability to detect and recover from a disruption of service, or loss of software or data integrity, resulting from a wide range of operational disruptions, including a cyber-related incident. This project will include the identification of additional measures that could improve RITS's resilience in this area and an examination of the benefits, challenges and costs of implementing them. This project is also expected to be completed in 2016.

The Bank monitors the operational performance of its participants. In addition, in 2013, the Bank introduced Business Continuity Standards for RITS participants. The Bank received participants' latest annual self certification statements against the new standards as at the end of 2014, at which time 48 of 58 RITS participants were compliant with the standards. Almost all of the remaining participants indicated that they expected to be compliant by the end of the compliance deadline. The Bank has also established controls to limit the risk from critical service providers, utilities and other FMIs. The Bank has a service level agreement with Austraclear and has a premium support package from SWIFT; both entities are key service providers to RITS. These arrangements set out the response times and the minimum level of support expected from each service provider. The Bank also has in place a service level agreement with a key technology vendor that provides enhanced monitoring and technical support. RITS's use of critical service providers and utilities is subject to ongoing monitoring and testing.

Based on this information, Payments Policy Department's assessment is that RITS has observed the requirements of Principle 17 during the 2015 Assessment period. Nonetheless, to ensure that the operations of RITS continue to meet international best practice, Payments Policy Department recommends that the Bank:

• complete its analysis and testing of the mechanisms in place to prevent a cyber-related incident and consider whether additional measures should be put in place
• complete its project to review and consider options to improve RITS's ability to detect and recover from a disruption of service, or loss of software or data integrity, resulting from a wide range of operational incidents, including a cyber attack

The Bank is also encouraged to review its cyber risk management arrangements in light of forthcoming CPMI-IOSCO guidance on cyber resilience for FMIs.

Details of RITS's operational risk-management arrangements are described under the following Key Considerations.

17.1 A payment system should establish a robust operational risk-management framework with appropriate systems, policies, procedures, and controls to identify, monitor, and manage operational risks.

17.2 A payment system's board of directors should clearly define the roles and responsibilities for addressing operational risk and should endorse the payment system's operational risk-management framework. Systems, operational policies, procedures, and controls should be reviewed, audited, and tested periodically and after significant changes.