See Full Document Text
CIRCULAR
SEBI/HO/IMD/IMD-1 DOF2/P/CIR/2021/630 September 27, 2021
To,
All Mutual Funds/
Asset Management Companies (AMCs)/
Trustee Companies/ Board of Trustees of Mutual Funds/
Association of Mutual Funds in India (AMFI)
Sir / Madam,
Sub: Risk Management Framework (RMF) for Mutual Funds
1. In order to ensure that mutual funds render, at all times, high standards of
service, exercise due diligence, ensure proper care in their operations and to
protect the interests of investors, SEBI vide Circular No.
MFD/CIR/15/19133/2002, dated September 30, 2002 prescribed certain
systems, procedures and practices that must be followed by all mutual funds
with regard to risk management in various areas like fund management,
operations, customer service, marketing and distribution, disaster recovery and
business contingency, etc.
2. Since the date of issuance of the aforesaid circular, there have been significant
developments in the mutual fund industry and in the financial markets as a
whole, including in the area of product innovation, investment in newer asset
classes, distribution landscape, technological evolution, investor penetration and
awareness, increase in risk elements, etc. Accordingly, it has been decided to
review the extant Risk Management Framework for Mutual Funds. The matter
was deliberated in the Mutual Funds Advisory Committee (MFAC) based on the
inputs received from the mutual fund industry. The recommendations of MFAC
have been suitably incorporated in the Risk Management Framework for mutual
funds.
3. With the overall objective of management of key risks involved in mutual fund
operation, the revised Risk Management Framework (RMF) shall provide a set
of principles or standards, which inter alia comprise the policies, procedures, risk
Page 1 of 46management functions and roles & responsibilities of the management, the
Board of AMC and the Board of Trustees.
4. The detailed RMF for mutual funds are placed at Annexure-A.
5. The elements of RMF, wherever applicable, have been segregated into
‘mandatory elements' which should be implemented by the AMCs and
‘recommendatory elements' which address other leading industry practices that
can be considered for implementation by the AMCs, to the extent relevant to
them.
6. AMCs shall perform a self-assessment of their RMF and practices and submit a
report, thereon, to their Board along with the roadmap for implementation of the
framework. The aforesaid exercise must be completed and the necessary
systems must be in place at the AMCs to enable compliance with the provisions
of this circular with effect from January 01, 2022. The Circular No.
MFD/CIR/15/19133/2002, dated September 30, 2002 on “Risk Management
System” shall be rescinded with effect from January 01, 2022. However, AMCs
may choose to adopt the provisions of this circular before the effective date.
7. Compliance with the RMF should be reviewed annually by the AMC. Reports of
such reviews shall be placed before the Board of AMC and Trustees for their
consideration and appropriate directions, if any. Trustees may forward the
findings and steps taken to mitigate the risk along with their comments to SEBI
in the half-yearly trustee reports.
8. This circular is issued in exercise of powers conferred under Section 11 (1) of
the Securities and Exchange Board of India Act, 1992, read with the provisions
of Regulation 77 of SEBI (Mutual Funds) Regulations, 1996, to protect the
interests of investors in securities and to promote the development of, and to
regulate the securities market.
Yours faithfully,
Hruda Ranjan Sahoo
Deputy General Manager
Investment Management Department
022-26449586
hrsahoo@sebi.gov.in
Page 2 of 46Annexure A
Risk Management Framework (RMF) for Mutual Funds
1.0 RMF Standards
i. AMCs shall establish a RMF for its mutual fund business. The RMF of mutual
funds shall have the following characteristics:
a. Be structured, efficient and timely.
b. Be an integral part of the mutual fund’s processes and governance
framework, at both the operational and strategic level, and consider all
available information i.e. both internal and external.
c. Be customized to both AMC's and scheme’s risk profile, focuses on
potential risks and implements mitigation and control measures to
explicitly address uncertainty.
d. Be dynamic and flexible enough to identify new risks that emerge and
make allowances for those risks that no longer exist.
e. Recognize that people and culture have an impact on its effectiveness,
and accordingly the framework must communicate and consult with
stakeholders throughout.
f. Protect reputation.
ii. The objectives of RMF should assist the management and the Board of
Directors of both AMC and Trustees in:
a. Demonstrating high standards of due diligence in daily management.
b. Promoting proactive management and early identification of risk.
c. Assigning and increasing accountability and responsibility in the
organization.
d. Managing risk within the tolerance limits defined in the RMF.
iii. The RMF of mutual funds shall comprise the following components:
a. Governance and Organization.
b. Identification of Risks.
c. Measurement and Management of Risks.
d. Reporting of Risks and related Information.
Page 3 of 461.1 Governance and Organization
i. Risk Management shall be an independent and specific function of the AMC.
ii. There should be at least one CXO level officer identified to be responsible for
the risk management of specific functions of the AMC/Mutual Fund. For
instance, there should be dedicated risk officers for various key risks such as
Investment Risk (by Chief Investment Officer), Compliance Risk (by Chief
Compliance Officer), Operational Risk (by Chief Operating Officer or similar
functionary responsible for the respective functions overseen), Cyber Security
(by Chief Information Security Officer), etc.
iii. The policy on risk management of the mutual fund should have clarity on roles
and responsibility assigned to CXOs and the same needs to be disclosed on
their website.
iv. AMC should have a Chief Risk Officer (CRO), who would be responsible for
the overall risk management of the mutual fund operation including the key
risks. This is in addition to one CXO level officer responsible for each key risk
type. The CXO shall be the “Head of Department” or official of the AMC up to
one level below CEO, other than CRO. However, for the overall risk
management of the mutual fund, along with the management, both board of
AMC and trustees should also be responsible. For this purpose, both the AMC
and the trustees should mandatorily have separate Risk Management
Committees (RMCs). These committees shall undertake annual review of RMF
at both AMC and scheme level. The CRO should be part of the RMCs. The
RMCs shall report to the Board of AMCs and trustees respectively and also
recommend long term solutions regarding risk management both at the AMC
level as well as the scheme level.
v. There shall be clear demarcation between the roles and responsibilities of the
respective CXOs and the CRO. For instance, while defining the role of CRO,
it should be ensured that the CRO would be responsible for the overall
governance of the RMF; the investment decisions and the other functions of
CIO are not encroached upon and the risk taking ability of CIO in accordance
Page 4 of 46of the scheme objective is not hindered. The CRO or the risk management
function of the CRO cannot be entrusted with day to day functioning, the
responsibility for which shall lie with the respective CXOs.
vi. The AMC should maintain risk metric for each mutual fund scheme. The risk
metric should incorporate each key risk type like investment risk, liquidity risk,
credit risk, etc. along with the path to maintain the targeted risk level. The
metric may incorporate evaluation of risk levels vis-à-vis an appropriate
benchmark, wherever applicable. The RMCs shall meet at least once in a
quarter to review various risks including risk metrics at both the scheme and
the AMC level and assist the board of AMCs and trustees in discharging their
duties in this regard.
1.1.1 Risk Management Policy
The risk management policy can be a macro level description of risk
management governance (including roles and responsibilities of the Board of
AMC and the three lines of defense – Management, Risk Management Team
and Internal Auditor), the organization's risk appetite and key elements of its
risk management process. The policy on the RMF shall be approved by the
board of AMC and trustees. The mandatory and recommendatory elements for
inclusion in the risk management policy, approved by the board of AMC and
trustees, are outlined below:
1.1.1.1 Mandatory Elements
i. There shall be an approved policy on the RMF both at AMC and scheme level.
ii. A risk appetite framework should be in place at both AMC and scheme level.
Quantification of the framework in the form of a metric for key risks shall include
but not limiting to credit risk, market risk and liquidity risk, etc. and targeted
path of improvement. The metric, wherever applicable, should incorporate an
appropriate benchmark vis-à-vis which the measurements of risk and targeted
risk levels may be made.
Page 5 of 46iii. There should be a Delegation of Power (DoP) framework covering daily risk
management, daily risk reporting and corrective actions at various levels of
management.
iv. Formation of RMCs (of both AMC and Trustees), its roles and responsibilities.
v. Each CXO level officer to take ownership of risks and manage risk level for
those risks as are applicable to their area of operation.
vi. Clarity on roles and responsibility assigned to CXOs
vii. Responsibility of line management and process ownership for risk
management and reflection of the same in the performance appraisal through
Key Result Areas (KRAs) of key officials of line management. The
performance may be evaluated vis-à-vis an appropriate benchmark, if
applicable.
viii. All aspects of risks that the AMC can face along with the mitigation plans,
including but not limited to:
a. Risk management practices in fund management, customer service,
marketing and distribution.
b. Disaster recovery and business contingency planning.
ix. Limit management framework for the material or key risks.
x. Risk assessment & monitoring measures and tools for all risks with quantified
risk indicators and limits thereto.
xi. Implementation of scenario analysis and stress testing.
xii. Risk mitigation requirements and control mechanisms.
xiii. Additional triggers that could require review of the RMF, including:
a. Material claims or litigations from customers or incidents.
b. Material findings from internal or external audits.
c. Adverse media attention impacting reputation risk.
d. Adverse observations from the regulator(s), etc.
e. Key risk indicator breaches.
f. New regulatory requirements.
g. Sector-relevant developments or incidents.
Page 6 of 461.1.1.2 Recommended Elements
i. Use of technology to automate risk management, reporting and compliance.
1.1.2 Risk Management Function – Responsibility of Board of AMC, Trustees
and the Management
1.1.2.1 Risk Management - Role of the Board of AMC and Trustees
i. Approving the RMF policies and procedures including the risk metrics at
scheme level.
ii. Defining, reviewing and approving the AMC’s and scheme’s risk appetite
framework.
iii. Periodic monitoring of risk appetite versus actual risk at scheme level.
iv. Event based monitoring of Risk appetite versus actual risk at scheme level.
v. Define specific responsibility of the management, including CEO
vi. Approval for policy for risk based KRAs and KRAs at level of CEO and up to
one level below CEO. Suggest modifications in KRA outcomes and link
compensation to those KRAs.
vii. Review of actions taken by Board of AMC and management in respect of risk
management.
viii. Reporting of material risk related observations to SEBI on periodic basis.
ix. Setting up of the risk management function and developing appropriate
structures and procedures to ensure that it can function independently.
x. Approving a methodology for Board Evaluation of the RMF (either through
outsourced or self-assessment) on an annual basis.
xi. Annual review of effectiveness of the AMC and/or management’s risk
management function and policies including risk metrics to address the risk
outcomes.
xii. Trustee may recommend reduction/ change in the risk level of the schemes
within the Potential Risk Class (PRC).
xiii. For assessing the effectiveness of the RMF,
Page 7 of 46a. The board of AMC should seek an annual report through an internal
management assessment process or from a third party covering all key
risks and key risk metrics both at the AMC and scheme level.
b. The RMCs of both AMCs and Trustees shall meet at least once in a quarter
to review various risks including the risk metrics at both AMC and scheme
level.
c. The Board of AMC should have all relevant information of appropriate
committee(s) (with the mandate and membership), CRO, CXO(s) for
specific risk management, audit functions, investor relations, investment
and credit decisions, etc.
1.1.2.2 Risk Management - Role of the Management
i. The risk management role of the management can be broadly classified into
risk management roles and responsibilities of the CEO, CRO, CIO, CXOs
and the fund manager.
ii. The overall role of the management shall be as below:
a. Overseeing the risk management function.
b. Keeping the Board of AMC and Trustees informed on new or emerging
risks.
c. Putting in place a mechanism for risk reporting on quarterly basis to the
Board of AMC and trustees, covering all risks including risk metrics,
escalation of material risk related incidents, if any, and timely and
corrective actions taken in specific cases of risk escalation. This may be
carried out with an objective to address the root cause in escalation of such
risks and also to improve the measurement and control mechanism for
prevention of reoccurrence of such risks.
d. Establishing an organization-wide risk-conscious culture.
e. Inclusion of risk management as a parameter for performance appraisal
(through KRAs or equivalent) of all the officials of the AMC at the level of
CEO and up to two levels below CEO.
Page 8 of 46f. Establishing human resource practices pertaining to hiring, orientation and
training in order to send messages to employees regarding the
organization's expected standards on integrity, ethical behavior,
competence and risk management.
1.1.2.2.1 Risk Management - Role of Chief Executive Officer (CEO)
i. The CEO shall be responsible for all the risks at both AMC and Scheme
level.
ii. The CEO shall
a. ensure that the outcomes of risk management function are reported to
him on a monthly basis
b. define specific responsibility of CIO and CXO regarding risk
management
c. define a risk appetite framework for schemes and AMC.
d. define appropriate risk metric for respective CXO, CIO, fund manager,
etc.
e. ensure adherence to the guidelines pertinent to SEBI in respect of RMF
and relevant principles thereunder including risk identification, risk
management, risk reporting (both periodic and escalation of material
incident) and corrective actions taken, if any.
f. The CEO shall approve the corrective action on various findings and
report to the board of AMC and trustee regarding the same and also
escalate to board of AMCs and trustees, if required, any major findings
being reported.
1.1.2.2.2 Risk Management - Role of Chief Risk Officer (CRO)
i. The CRO shall be responsible for ensuring that there is an effective
governance framework and reporting framework of risk management in
line with the regulatory requirements.
ii. The risk management roles of the CRO are as under:
Page 9 of 46a. Implementation of Risk management framework across the
organization.
b. Review specific responsibility of management, including CEO, CIO,
CXOs, and Fund Managers.
c. Put in place mechanism for risk reporting at least on a quarterly basis
to the board of AMC, trustees and RMCs, covering all risks including
risk metrics, escalation of material risk related incidents, timely and
corrective actions taken, if any.
d. Independent assessment of reporting of risk to various committees
and CEO, etc.
e. Put in place mechanism for reporting to CEO - Including outcomes for
risk management function on monthly basis.
f. The reporting of risk as above is independent from the CIO and verified
by the risk team.
g. There is a DoP approved by the Board of AMC for risk management
by CRO covering the following:
1) Daily risk management
2) Daily risk reporting
3) Corrective actions at the level of Fund manager, CIO and CEO.
h. The CRO shall inform to board of AMCs, trustee and risk committees
regarding any major findings or corrective actions required and also
update on closure or the status of various recommendations.
1.1.2.2.3 Risk Management - Role of Chief Investment Officer (CIO)
i. Daily management of risk and necessary reporting relating to Investment
risk of all scheme(s) such as market Risk, liquidity Risk, credit risk etc.
and other scheme specific risks (Compliance Risk, Fraud Risk, etc.) lies
on the CIO.
ii. In respect of all schemes CIO should ensure:
a. Adherence to the guidelines pertinent to SEBI in respect of RMF and
relevant principles thereunder including risk identification, risk
Page 10 of 46management, risk reporting (both periodic and escalation of material
incident) and corrective actions taken, if any.
b. Defining specific responsibility of Fund Managers
c. Adherence to risk appetite framework - maintain risk level for
schemes
iii. CIO will calculate the overall risk by taking in to account the weighted
average of (i) the risk-o-meter and (ii) the events of defaults. Both (i) and
(ii) are to be calculated in terms of a number taking into account the risk-
o-meter and events of defaults or early mortality of investments which may
inter alia include credit default, change in yield, change in NAV, external
shock or unusual redemptions, etc. to quantify the overall risk.
iv. The CIO shall escalate the corrective actions taken, if any, to the CEO
and the CRO.
1.1.2.2.4 Risk Management - Role of other CXOs
i. The CXOs shall be responsible for the governance of the respective risk
types.
ii. In respect of respective risk type, CXO should ensure:
a. Adherence to the guidelines pertinent to SEBI in respect of RMF and
relevant principles thereunder including risk identification, risk
management, risk reporting (both periodic and escalation of material
incident) and corrective actions taken.
b. Defining specific responsibility regarding risk management of key
personnel reporting to them.
c. Maintaining risk level as per the risk metric.
iii. The CXOs shall take immediate corrective action for non-compliance or
major finding post approval from CEO as per DoP and shall report to CRO
regarding the risk reports.
iv. The CXO shall escalate to CEO and the CRO any major findings reported
by respective risk management function.
Page 11 of 461.1.2.2.5 Risk Management - Role of Fund Manager (FM)
i. The FM shall be responsible for daily management of investment risk of
managed scheme(s) such as market Risk, liquidity Risk, credit risk and
other scheme specific risks and appropriate risk reporting of any risk
related event to CIO.
ii. In respect of schemes managed by them, FMs should ensure:
a. Adherence to relevant SEBI guidelines in respect of RMF and relevant
principles thereunder including risk identification, risk management,
reporting and corrective actions etc.
b. Adherence to risk appetite framework to maintain appropriate risk level
for schemes.
c. If there is any need of change in the risk appetite of the scheme within
the PRC of that particular scheme, the same is to be with the approval
of the CIO.
iii. The FM shall take corrective action, if required, as per the approved DoP
and escalate major risk related event to CIO.
1.2 Identification of Risks
For the identification of risks, the RMF should address the following key
questions:
1.2.1 What are the different types of risks faced by the mutual fund/AMC and
its mutual fund schemes?
1.2.2 What is the probability of the happening of each of the above risks,
considering the control environment and automation within the AMC,
external factors or dependencies such as market infrastructure,
outsourced activities, etc. and available historical risk data?
1.2.3 What is the likely impact of key risk events, in terms of financial loss,
reputation loss, impact on investors/ unit holders and regulatory action?
Page 12 of 461.2.4 What are the emerging or new risks due to new business lines, new
products, statutory changes, changes in external environment or market
infrastructure, etc.?
1.2.5 The mandatory and recommendatory elements for identification of risks,
are outlined below:
1.2.5.1 Mandatory Elements
i. Each AMC shall identify on an ongoing basis, the specific risks to be
covered within the RMF, based on the nature, scale and complexity of its
business, the risk profiles and strategies of the funds it manages, and the
impact of different risks on its mutual funds business.
ii. Documented risk profile for each of the key functions incorporating
events that might create, enhance, prevent, degrade, accelerate or delay
the achievement of objectives, sources of risks and areas impacted due
to the event.
1.2.5.2 Recommendatory Elements
i. Formalized risk appetite statement (incorporating themes such as
investment, sales, and operational losses as a result of in-house or
outsourced activities) both at the scheme and AMC level.
1.3 Measurement and Management of Risks
1.3.1 AMC should have approved internal policy for measurement of various
scheme specific risks (such as governance risk, investment risk,
liquidity risk, credit risk) through appropriate risk metrics.
1.3.1.1 It should reflect the Risk-O-Meter and the PRC of the scheme vis-a-
vis the scheme benchmark.
Page 13 of 461.3.1.2 The policy should have the defined guidelines regarding the
appropriate risk metric with role clarity depending on the responsibility
of each person.
1.3.2 AMCs should have approved internal policy for measurement of
organization wide risk like operational risk, technology risk, legal risk,
talent risk, outsourcing risk, etc.
1.3.3 Having identified and documented the applicable risks, the risk
management function should develop process/tools to measure and
manage those risks. For this purpose, the following needs to be
considered for each risk category:
i. Ascertaining the measurement criteria for each risk category
(qualitative and quantitative criteria).
ii. Documentation of measurement tool(s) for each risk category, i.e.
Risk and Control Self-Assessment (RCSA), stress testing, scenario
analysis, etc.
iii. Determination of required frequency of monitoring.
iv. Developing a process for escalation.
v. Determination and documentation of remedial or mitigating actions.
Wherever appropriate, it is recommended that AMCs consider documenting
risk limits based on their risk appetite.
1.3.4 The mandatory and recommendatory elements for measurement and
management of risks, are outlined below:
1.3.4.1 Mandatory Elements
i. The AMCs shall have established structure and responsibility across the
three lines of defense:
a. Business Operations.
b. Oversight functions like Risk Management and Compliance.
c. Internal Audit.
ii. Internal Audit and Oversight functions like Risk Management and
Compliance shall ensure the following:
Page 14 of 46a. There should be a dedicated internal auditor at the AMC level for audit
of the RMF of the AMC.
However, the same may be carried out by independent auditor
appointed by trustees, provided that the personnel undertaking the
said audit have relevant expertise in the domain of risk management
necessary for both the AMC level and the scheme level audit. In such
scenario, care must be taken that no conflict arises w.r.t submission of
independent audit reports by the auditor to the audit committee and
the Board of both the AMC and the trustees for the conduct of their
respective audit functions.
b. The internal auditor should audit both the scheme level and AMC level
risks.
c. The internal auditor should audit compliance with the internal policies
of the AMC on risk management as well as the applicable rules and
regulations mandated by SEBI on risk management.
d. For the processes being audited by the internal auditor, a non-
compliance rate shall be computed. The non-compliance rate may be
computed based on sampling out of the total number of processes
being audited.
e. The internal auditor should submit the internal audit report to the audit
committee of the AMC and the Board of AMC representing the non-
compliance rate as audited in the books of accounts of the AMC and
its schemes. While submitting to the audit committee, the non-
compliance level shall be converted to an overall internal audit score
represented in the form of a number providing a quantitative
representation of the internal audit report. This number shall be
generated considering all key risk types.
f. Further, this number shall be compared in subsequent internal audits
to analyze the improvement in minimizing the non-compliance level at
the AMC. This shall reflect the degree of rectification of non-
compliance as done at the level of AMC. Therefore, this number may
Page 15 of 46be represented in the form of a “Rectification Index” in the internal audit
report.
iii. There shall be an RCSA process with defined frequency.
iv. There shall be an established mechanism for reporting to the CRO,
management and the Board of AMC and Trustees.
v. Periodic review of policy frameworks shall be done to ensure that the said
policies are up-to-date responding to new strategic priorities and risks and
the monitoring mechanisms are working to ensure compliance with the
updated policies.
vi. Mechanisms are established for management to make use of early
warning indicators to identify, evaluate, and respond to changes quickly.
vii. Periodic stress tests are performed on critical risks and the impact of risks
are assessed based on acceptable tolerances.
viii. Based on the management of the risk level as defined by respective risk
metric of CXOs, necessary corrective actions must be taken to address
any short comings. The output of the risk level shall be an indicator of the
performance of the respective CXOs and shall form one of the inputs for
their performance review.
1.3.4.2 Recommendatory Elements
i. There should be independent testing and verification of efficacy of
corporate governance standards and business line compliances,
validation of the RMF and assurance over the risk management
processes by external agency.
1.4 Reporting of Risks and Related Information
1.4.1 Adequate risk reporting is an integral part of the risk management framework
and it is important that those responsible for different functions within the AMC
shall ensure that they exercise sufficient oversight to report on their risk profile
and risk management actions.
Page 16 of 461.4.2 The mandatory elements for reporting of risk and related information, are
outlined below:
1.4.2.1 Mandatory Elements
i. In order to ensure that the risk management function obtains the
necessary information from other departments as well as from
outsourcing partners (wherever applicable), a structured bottom-up
reporting process should be designed and the risk management function
should perform meaningful and independent analysis of such information.
ii. The outcomes of the risk management function should mandatorily be
reported to the management at least once on a monthly basis and to the
Board of AMC and Trustees on a quarterly basis. Trustees may forward
the results and steps taken to mitigate the risk along with their comments
to SEBI in the half-yearly trustee reports.
iii. Risk reports should consider the following:
a. It should be holistic (considering all risk categories identified), timely
and accurate.
b. It should incorporate the risk metrics comprising the risk profile of all
schemes and the risk profile consolidated across the departments and
the AMC level. It should also incorporate the rectification index as
calculated in the internal audit report for both the AMC and the scheme
level.
c. It should contain all necessary information to assess whether
appropriate measures have been taken by the management to control
and mitigate all relevant risks.
d. It should provide information on existing as well as new risks including
a statement on severity (e.g. low, medium, high) and its evolution over
time, and the measures to mitigate existing risks where possible.
iv. The Risk management function shall ensure that any significant emerging
risk issues that are not adequately addressed by the responsible
Page 17 of 46functional department are promptly reported to the management or the
risk management team and to the Board of AMC.
2.0 Managing Key Risks
a. SEBI (Mutual Funds) Regulations, 1996 vide various circulars has prescribed
certain norms which would cover many aspects of risk management such as,
stress testing, internal credit risk assessment, cyber security and system audit,
liquidity buffer, creation of segregated portfolio, investment restrictions,
investment due diligence, etc. that are to be adhered to by the mutual funds.
The following sections incorporate comprehensive guidelines for management
of various key risks by the AMCs, elements of which may overlap with the
above mentioned norms and in such cases, the detailed norms specified in the
relevant circular must be strictly followed.
b. These key risks may be divided in to two broad categories.
i. Scheme specific risks
ii. AMC specific risks
c. The scheme specific risks are the risks majorly associated with the core
activities of investment and portfolio management. The AMC specific risks are
the risks associated with the functioning of the mutual fund business by the
AMC.
d. The scheme specific risks may be divided in to the following categories.
i. Investment risk
ii. Credit risk
iii. Liquidity risk and
iv. Governance risk
The AMC specific risks may be divided in to the following categories.
i. Operational Risk
ii. Technology, Information Security and Cyber Risk
iii. Reputation and Conduct Risks
iv. Outsourcing Risk
v. Sales and Distribution Risk
Page 18 of 46vi. Financial Reporting Risk
vii. Legal & Tax Risks and
viii. Talent Risk
The compliance risk shall be applicable for both investment management
activity (scheme specific risk) and business activity of AMC (AMC specific risk).
The following sections incorporate comprehensive guidelines for
management of the key risks
2.1 Investment Risk
2.1.1 Investment risk can be defined as the probability or likelihood of occurrence
of losses relative to the expected return on any particular investment.
2.1.2 Investment risk management should be based on reasonable investor
expectations about the risks that the mutual fund will take in order to achieve
its investment objectives, which can be thought of as the fund’s risk profile or
risk appetite. A fund's risk profile should be stated in its communications with
investors including in its Scheme Information Document (SID) and marketing
materials, which state the fund's investment strategies and risk factors. The
SID shall also incorporate any other elements of risk appetite as may be
stipulated by AMCs and Trustees.
2.1.3 Investment risk management should involve both controlling risk by limiting
certain risk exposures and the size & probability of losses, as well as using a
number of active investment techniques that seek to align the fund’s
investments with its investment objectives, its risk profile, and the portfolio
manager's investment convictions.
2.1.4 Risk control should focus on placing limits on a fund’s investment positions
and concentrations. These limits should include the investment restrictions
mentioned in the fund’s SID as well as any limits and restrictions imposed by
the risk management function within the regulatory limits. Risk control
activities may include reviewing portfolio concentrations and adjusting
portfolio holdings accordingly; evaluating and reviewing new and/or complex
Page 19 of 46instruments, such as derivatives, and imposing conditions and limits on their
use; monitoring and limiting credit exposure from issuers of portfolio
securities and from counterparties; and ensuring that a fund is managed in
compliance with the SID and the regulatory investment restrictions.
2.1.5 The mandatory and recommendatory elements for managing investment risk,
are outlined below:
2.1.5.1 Mandatory Elements
i. The AMC should have the following policies / process:
a. An investment universe to be updated periodically and responsibility for
the same should be clearly defined.
b. An investment policy for investment in various asset classes/ securities
as permitted by SEBI from time to time and policy on hedging of interest
rate risk, foreign exchange risk, price risk, etc.
c. Policy on participation in IPOs/FPOs including policy on participation in
IPOs/FPOs of associate/ group company(ies).
d. Trade execution policy.
e. Policy on trade allocation and Inter-Scheme Transfers (ISTs).
f. Investment valuation policy.
g. Broker empanelment policy.
h. Trustee should review the portfolio at frequency as required by SEBI
Regulations.
ii. The AMC must ensure that investment risk is adequately factored in by:
a. Setting up an Investment committee which has close coordination with
related departments, and monitors market risk.
b. Setting limits for issuer/ sector exposure vis-a-vis benchmark (in line with
MF Regulations and internal limits).
c. Setting limits for investment in debt and money market instruments of
various credit qualities.
d. Having all relevant documents and disclosures (that are required for
listing) with regard to the debt and money market instruments before
Page 20 of 46finalizing the deal for investment into the respective instruments so that
mutual funds as investors into such instruments are not at an
informational disadvantage vis-à-vis other market participants or lenders.
e. Review of passive breaches and corrective actions.
iii. Investment Committee shall be responsible for the following:
a. Review of Investment Policy at a pre-defined frequency.
b. Reviewing the Investment plan or policy to meet the investment
objectives documented in the SID.
c. Any other responsibility as assigned by the management.
iv. The AMC should conduct the following to manage and monitor investment
risks (at scheme level or aggregate portfolio level, whichever is applicable):
a. Redemption analysis.
b. Investor concentration analysis. Both single investor and/or group
concentration.
c. Monitor investment risk at a defined frequency.
d. Managing and monitoring investment restrictions for overseas
investment, if any.
e. Monitor investment risk at individual portfolio level and also concentration
risk and other relevant risks at aggregate level in a structured manner.
f. Stress testing for investment risk.
g. Consider investment risk while launching new products.
h. Ensure that Trade Allocation policy is adhered to along with adequate
information to identify those allocations that are out of line with the normal
percentage allocation across funds.
i. Quantitative risk analysis using metrics such as VaR, Sharpe Ratio,
Treynor Ratio, Information Ratio, etc.
j. Prepare and maintain management reports on topics discussed and
conclusions made at investment committee meetings (including interest
rate prospects, risk-taking and hedging policy, etc.)
k. Distributor concentration analysis.
v. Further, it should be ensured that:
a. Actual risk measures and reports are adapted to the risk characteristics
Page 21 of 46of the individual asset classes, and capture dependencies between risks
(e.g. market risk and liquidity risk).
b. Actual risk measures address risks in normal and stressed market
conditions.
c. Actual risk measures cover all risk types in the portfolio, including
counterparty credit and liquidity risks (assets, investors).
d. Appropriate tools are adopted for measurement of market and credit risks
on different types of investment products.
e. Adequate processes and controls are in place to ensure that risk
reporting is complete, accurate, timely and meets the needs of various
stakeholders.
f. Adequate documentation of calculations, analyses and decisions is
maintained.
g. Performance and positions with regard to objectives of schemes are
reviewed.
h. Performance vis-à-vis scheme benchmarks and performance of peer
group(s) is reviewed.
i. Exceptions are defined and their monitoring is conducted.
j. Exceptions in style drift and portfolio concentration are reviewed.
k. In cases of inter scheme transfer, the scheme (s) buying the securities
must conduct an enhanced level of due diligence.
2.1.5.2 Recommendatory Elements
The AMCs may consider the following practices:
a. Regular analysis on bulk trades and block deals of large values.
b. Formulating a plan for assessing and monitoring risks of investing in
multiple markets.
c. Setting limits for minimum number of stocks/securities, cash (net of
derivatives), stocks/securities vis-a-vis benchmark and Beta range.
Page 22 of 462.2 Credit Risk
2.2.1 The credit risk relevant to mutual funds is the issuer credit risk attributable to
individual securities and the negative outlook on specific sectors or industries
and its consequent impact on the credit exposures.
2.2.2 The mandatory and recommendatory elements for managing credit risk, are
outlined below:
2.2.2.1 Mandatory Elements
i. To manage credit risk, the AMC must have a robust framework comprising:
a. An approved and documented Credit Risk Management policy.
b. Analysis and evaluation of ratings received from multiple credit rating
agencies for securities across portfolios, at all points of time i.e. before
investing in such securities/instruments or products and also on
continuous basis.
c. Formal procedure for AMCs to carry out their own credit assessment of
assets and reduce reliance on credit rating agencies. For this purpose,
all AMCs shall have an appropriate policy and system in place to conduct
an in-house credit risk assessment or due diligence of debt and money
market instruments or products at all points of time i.e. before investing
in such instruments or products and also on continuous basis.
d. Adequate provisions to generate early warning signals (including yield
based alerts) on deterioration of credit profile of the issuer. Based
on the alerts generated, the AMCs shall take appropriate measures and
report the same to trustees.
e. Concentration limits (counterparty wise, group wise, industry or sector
wise, geography wise) monitoring.
f. Stress testing for credit risk - applying shocks based on rating
downgrades, negative outlook on specific industries and the consequent
impact on credit exposures.
Page 23 of 462.2.2.2 Recommendatory Elements
i. Over a period of time and having regard to the size, scale and complexity of
the fixed income portfolio, AMCs may consider developing sector level
standards for implementing internal credit assessment based models to
measure credit risk in line with the prevailing global best practices.
2.3 Liquidity Risk
2.3.1 Thinly traded securities carry the danger of not being easily saleable at or
near their real values. Further, all securities run the risk of not being saleable
in tight market conditions at or near their real values. Measuring and
monitoring liquidity risk is an important aspect of risk management.
2.3.2 The mandatory and recommendatory elements for managing liquidity risk,
are outlined below:
2.3.2.1 Mandatory Elements
i. Liquidity Risk has to be modelled at the level of each scheme (except schemes
that do not have continuous liquidity requirements like close ended and interval
schemes) and should display alerts pertaining to asset liability mis-match on
monthly basis and in line with any other relevant guidelines as specified by
SEBI in this regard from time to time. The aforesaid model, should be based
on the following key principles:
a. The secondary market liquidity of assets of the scheme, shall be incorporated
into the liquidity risk management model.
b. For debt and money market instruments, the total asset value shall be
classified in various maturity buckets for e.g. assets maturing in days 0-30,
30-60, 60-90 and so on. Debt and money market instruments that have a
demonstrable secondary market liquidity shall be classified into a lesser
maturity bucket depending upon the reasonable time in which particular value
of the said instrument can be expected to be offloaded. In the absence of
Page 24 of 46demonstrable secondary market liquidity, the instruments shall be strictly
classified based only on the maturity dates.
c. Liabilities of scheme shall be modelled in similar buckets based on back
testing of historical data for subscription and redemption amounts in the
respective schemes. The back testing period should be sufficiently long (say
for last 5 years) to include spikes in redemptions because of market wide
events. Organization specific factors/risks that may have a bearing on
redemptions should also be factored into the model.
d. Liquidation of assets at near the value ascribed to each asset in the scheme
portfolio in specified period of time, shall be one of the factors to be
considered in liquidity risk management.
e. The model should incorporate forward looking asset liability mis-match for
the scheme at different periods of time at least up to next 30 days.
ii. The AMC should have policy in place on management of the mis-match in
putative liabilities vis-à-vis the liquid assets of each scheme. It should follow
the following principles:
a. There should be an upper limit or threshold on the mis-match in putative
liabilities vis-à-vis the liquid assets of each scheme. The upper limit shall be
customized depending on size or type of the scheme.
b. There should be a system based mechanism to generate alerts as per point-
(a) above.
c. The policy shall include monthly reporting to Board of AMC and Trustees and
on quarterly basis to SEBI in a standard format (to be prescribed by AMFI in
consultation with SEBI).
d. The report shall include the details of alerts generated by the system
regarding asset liability mis-match in excess of the defined threshold and
subsequent actions taken to address the same. The scheme wise mis-match
limits shall be put in the system and all alerts shall be managed effectively.
iii. Stress testing should be mandatorily conducted for all schemes (excluding
close ended and interval schemes) appropriately atleast on monthly basis. The
results of the stress testing may be placed before trustees in every quarter.
Trustees may forward the results along with their comments and steps taken,
Page 25 of 46if any, to SEBI in the half-yearly trustee reports. With respect to stress testing
of open ended debt schemes, norms have been provided vide SEBI circular
No. CIR/IMD/DF/03/2015 dated April 30, 2015 and SEBI circular No.
SEBI/HO/IMD/DF3/CIR/P/2020/229 dated November 6, 2020 and the same
must be adhered to and any future guidelines issued by SEBI in this regard
may suitably be followed.
iv. The policies and procedures implemented by the AMC should include the
following:
a. Measures and limits for monitoring liquidity risk - cash flow approaches,
ratios/tools for monitoring market liquidity (including equity market), etc.
b. Measures for managing intra-day liquidity and controls around the same.
c. Stress testing policy to align the stress testing requirements mandated by
SEBI for mutual funds in India specifically incorporating:
1. Risk parameters used and methodology adopted to conduct the stress
tests.
2. Procedure to deal with stress events and early warning signals.
d. Overview of funding plans/strategy during normal and stressed events,
including contingency funding plan.
v. Systematic classification and evaluation of liquidity risks should be initiated by
performing following activities:
a. Evaluation and disclosure of liquidity risk associated with schemes/products
in the SID.
b. Controls around preparation and accuracy of cash flows.
c. Management of collateral and margins for execution and settlement of
derivatives, securities and money-market instruments.
2.3.2.2 Recommendatory Elements
i. AMCs may consider introducing the following measures:
a. Judicious use of intraday / overnight borrowing lines to address liquidity /
settlement risks faced by the mutual funds. Uncommitted lines of credit
available with the AMC may not be useful in real time of stress and therefore
Page 26 of 46while assessing liquidity risk of AMC, these lines should be treated differently
than committed lines.
b. Internal committee with the mandate to review and provide direction on
liquidity risk management.
c. Identifying and reporting appropriate and relevant information to the
management, for decision making.
d. Reporting to the Board of AMC on any other material outcomes and events.
2.4 Governance Risk
2.4.1 Governance risk is a risk that the persons who are in position of power or
fiduciary responsibility towards the holders of security (equity/debt), do not
act in the best interest of such stakeholders, rather compromise the interest
of such stake holders for their personal gain.
2.4.2 The act of people with power may significantly impact the equity market price
of the shares along with having a direct impact on debt issuances.
2.4.2.1 Mandatory Elements
a. The AMC shall have an approved policy to deal with governance risk of the
investee companies.
b. The policy shall incorporate measures such as assessment of whether there
are enough system checks and balances in the governance structure of the
issuer to prevent such wrong doing and also assessment of track record or
history of the issuer to monitor the trend of their past behavior.
c. The policy shall also include guidelines on how it identifies and monitors any
conflicts of interest involving members of the Board/ KMPs of the investee
company.
d. The AMC shall adhere to the “Stewardship Code” prescribed by SEBI for
mutual funds which inter alia includes continuous monitoring of the investee
companies on various matters such as operational and financial
performance, corporate governance, related party transactions, opportunities
Page 27 of 46or risks including ESG risks, etc., bearing in mind the insider trading
Regulation while seeking information from the investee company for the
purpose of monitoring etc.
2.5 Operational Risk
2.5.1 Operational risk refers to the risk of loss resulting from inadequate or failed
processes, people and systems or from external events, e.g. internal fraud,
external fraud, physical damage caused by nature or man-made, etc.
2.5.2 As operational risk could manifest in any function or process within the
organization or at a third party service provider, it is important to have
adequate monitoring and tracking of all elements that can go wrong. This
includes fails, reconciliation differences, customer complaints, guideline
breaches, systems issues, process gaps, system bugs, etc. It is equally
important to have an escalation process as any undue delay in reporting
could magnify the loss or turn a gain into a loss.
2.5.3 The key for effective operational risk management should be to create a
process that tracks the various elements of operational risk over time, to
identify trends that could be an early warning signal, and to implement an
exception/escalation process that ensures the problems which are
significant, large, aged or growing dealt with at increasingly higher levels of
management.
2.5.4 SEBI vide circular SEBI/HO/IMD/DF2/CIR/P/2019/57, dated April 11, 2019
has provided indicative guidelines encompassing system audit framework.
The systems and processes as elaborated in the aforementioned circulars
must be in place and any future guidelines issued by SEBI in this regard may
be suitably followed.
2.5.5 The mandatory elements for managing operational risk, are outlined below:
2.5.5.1 Mandatory Elements
i. The AMC should implement the following policies:
Page 28 of 46a. Operational risk management policy, shall cover the following key elements:
1. Purpose and scope.
2. Governance Structure - Roles and Responsibilities.
3. Identification of operational risk events.
4. Management of the operational risk events, e.g. reversal of positions,
rectifications, etc.
5. Guidelines regarding transactions with associates, group entities, related
parties or even with other stakeholders, such as distributors, channel
partners, brokers, etc.
6. Escalation and reporting.
7. Compensation of loss, if any.
8. Follow-up actions, e.g. strengthening of systems and processes, training,
etc.
9. Communication with external stakeholders - regulators, investors,
distributors, etc.
10. Implementation of a ‘new product approval' process to ensure that all
functions have the systems, people, processes to support a new product
11. Recording and documentation.
b. The Dealing room policy incorporating the non- usage of mobile, restricted
internet access, dedicated recorded lines, handling of information, etc. In this
regard, the detailed guidelines on this aspect as provided in SEBI circular
SEBI/HO/IMD/DF2/CIR/P/2020/175 dated September 17, 2020 as well as in
the part B of Fifth Schedule of SEBI (Mutual Funds) Regulations, 1996 or any
further SEBI guidelines may be referred to.
c. Roles and responsibilities are defined for the following:
1. Time stamping, application processing and confirmation,
2. Review of KYC and investor declarations as specified through various
SEBI regulations,
3. Timely and accurate credit identification (for investor subscription) and
bank reconciliations (banks/custody).
4. A system to track and report high value transactions (including bulk
Page 29 of 46redemptions) to the Investment management function.
5. Control oversight on brokerage computation and payment, redemptions,
inter-scheme switches, maturity payments in closed ended funds,
dividend payouts, tax and other statutory payments, subscription refunds,
identification of unclaimed amounts and their deployment as per
regulatory requirements, etc.
6. Review of ‘value dated’ transactions, reversals, broker/ distributor code
changes, etc.
7. Incident reporting and escalation matrix for the same.
8. Maintaining a Chinese wall between the different businesses earned out
by the Asset Management Company (such as PMS, AIF, Overseas
Investments, Advisory, Mutual Funds, etc.)
9. Documented process to review human errors in transaction processing to
identify training needs and corrective actions to prevent the errors in the
future.
d. There is an adequate RCSA process for operational risks on a periodic basis
with a structured reporting methodology.
e. The AMC should perform the following:
1. Analyze and classify frauds into internal (within the organization) and
external (by persons outside the organization) frauds, identify root causes
and incorporate monitoring mechanisms to address fraud scenarios.
2. Reporting of frauds and near miss incidents to the Board of AMC and
Trustees on quarterly basis.
f. Insurance cover shall be obtained for first and third party losses:
1. The mutual fund must have insurance cover against third party losses
arising from errors and omissions:
(a) Third party liabilities refer to liabilities arising out of financial loss to
investors or any other third party, incurred due to errors and omissions
of directors, officers, employees, trustees, R&T agents, custodians
etc.
(b) The level and type of cover should be recommended by the AMC and
approved by the Trustees.
Page 30 of 462. Further, the AMC shall have insurance to cover first party losses:
(a) First party losses are those which impact the insured and include asset
based losses (due to natural or unnatural disasters such as fire, flood,
burglary, etc.) as well as financial or data losses.
(b) They also include losses due to the acts of employees of the insured
and computer based crimes such as hacking or virus attacks that may
impact the data of the mutual fund, etc.
(c) Key details of the same, together with claims thereunder, shall be
annually reported to the Trustees.
g. The AMC should have an integrated system (front-mid-back) to perform the
following functions:
1. Order generation
2. Position-keeping (Positions on all supported products are updated in real
time). Trades can be accounted for by an electronic feed.
3. Pre-trade compliance checks
4. Order execution
5. Deal booking
6. Straight-through processing to allow one-time capture of trade details.
7. System check on preset parameters and reporting of breaches e.g.
whether investments made in permitted securities or limits on deal size,
etc. have been adhered.
8. Automatic time-stamping of deals.
9. Maker-checker authorisations.
10. Exception reporting.
11. Generation of deal confirmations.
12. Monitoring of outstanding confirmations, settlements and payments.
13. Cash management.
14. Integrated reporting across the Mutual Fund.
15. The back office system should facilitate daily fund projections to ascertain
liquidity and settlement requirements.
h. The AMC should have documented procedures for the following:
1. Trade confirmations, settlements.
Page 31 of 462. Cash flow Management.
3. Collateral Management.
4. Corporate Actions.
5. Margin Management.
6. Security Master Creation.
7. Pricing and Valuation.
8. Corporate action tracking and accounting.
9. Oversight on Service Providers – Custodians, Fund Administrators - SLA
tracking, Parallel Valuation and calculation of NAV. The oversight over
custodians shall inter alia include, receipt of daily position report from
custodian, end of day reconciliation of positions with custodian data and
once a week complete reconciliation of fund accounting system records
with custodian records.
i. The AMC may implement the following depending upon the scale and
complexity of business:
a. Documenting a Fraud Response Plan and reporting of near miss
incidents.
b. Developing Fraud Risk scenarios and updating with changing business
dynamics, documentation thereof being maintained in appropriately
designed and updated Fraud Risk Registers (capturing details such as
past fraud incidents).
c. Using data analytics as a key tool for identifying fraud patterns and
indicators.
d. Conducting a fraud control and reporting' training program.
2.6 Compliance Risk
2.6.1 Failure by the AMC to meet its regulatory obligations or manage changes in
legal statutory and regulatory requirements may result in investigations, fines,
financial forfeiture, or regulatory sanctions and material loss to investors and
the organization.
Page 32 of 462.6.2 The mandatory and recommendatory elements for managing compliance
risk, are outlined below:
2.6.2.1 Mandatory Elements
i. The AMC shall establish and maintain policies as required by applicable
statutes and regulations, including policies to address the following:
a. Know Your Client (KYC), Anti-Money Laundering (AML) and Combating
the Financing of Terrorism (CFT)
b. Outsourcing
c. Customer Complaints & Investor Grievance – Should inter alia include
details of adherence to SEBI regulations with regard to investor servicing
and complaint resolution, tracking complaint resolution, update of complaint
log and forwarding of complaints and the Management Information System
(MIS) to compliance officer, complaint resolution process being reviewed
by compliance officer. The compliance officer shall review the complaints
with an objective to catch early warning signs for fraud or any systemic
issues.
d. Related Party Transactions.
e. Front running
f. Conflict of Interest.
g. Employee Trading (including issues related to Insider Trading).
h. Code of Conducts.
i. Commission and other sales & marketing costs.
j. Commercial Bribes or Kickbacks.
k. Fraud Risk Management
l. Whistle Blowing
m. Information Security and Data Privacy
n. Gifts and Entertainment
o. Record Retention
p. Dealing Room Policy
q. All disclosure requirements (including derivative transactions, off balance
Page 33 of 46sheet items and contingent liabilities, etc.).
ii. There should be defined responsibilities for:
a. Filing of timely and accurate regulatory reports to the Regulator(s) and
Board of AMC and Trustees as prescribed by the applicable laws and
regulations.
b. Pre-use review of AMC’s marketing materials (collateral, brochures etc.),
website uploads, digital advertising and performance advertising etc.
c. Monitoring that all investments and holdings are consistent with disclosures
made to clients and applicable restrictions.
d. Mechanism for prevention or detection of possible insider trading at the
personnel or portfolio levels.
e. Review for adequacy of disclosures made to the investors regarding
significant risks such as liquidity, counterparty and credit (quality of
investments made mainly debt based on the credit rating), investment, and
other risk areas.
f. Measures to prevent and detect trading violations involving short selling.
g. Maintenance of all required licenses, registrations, approvals and
permissions.
iii. AMCs should have an Anti-Money Laundering/Combating Financing of
Terrorism (AML/CFT) program with the following attributes:
a. Employees understand obligations and contents of policies to effectively
carry out their AML/CFT responsibilities.
b. Transaction Monitoring is done to identify Suspicious Activities.
c. Suspicious Transactions Reporting is done to the relevant authorities.
d. Adequate training programs to ensure employees are constantly aware of
money laundering/financing of terrorism risks and measures (focus on their
roles and responsibilities).
iv. AMCs should have systems in place to detect and prevent securities market
violations including securities market frauds and malpractices at their end:
a. A report containing details of the alerts generated and the subsequent
actions taken in this regard should be submitted to trustees on a quarterly
basis.
Page 34 of 46b. Trustees may forward the results along with their comments and steps
taken, if any, to SEBI in the half-yearly trustee reports.
2.6.2.2 Recommendatory Elements
i. The following policies may be incorporated by the AMCs depending on
complexity and scale of operations:
a. Political Contributions.
b. Outside business activity policy.
ii. The AML/CFT program of the AMCs may include the following depending on
the size and scale:
a. investor awareness programs (literature or pamphlets or such) to educate
clients about the AMC’s AML/CFT obligations.
b. Review of client risk scoring model to ensure effectiveness of the AML/CFT
program.
c. Independent or External review of AML/CFT policies to ensure their
effectiveness.
2.7 Technology, Information Security and Cyber Risk
2.7.1 Given the huge dependence on technology, any system failure could trigger
a variety of risks, e.g. operational risk, compliance risk. etc. Technology
Operations should support processing and storage of information, such that
the required information is available in a timely, reliable, secure and resilient
manner.
2.7.2 Increasing disclosure requirements on public portals by AMCs required a
focused approach towards data management. Digitalization and online
platforms have given rise to need for effectively mitigating information
security and cyber risks.
SEBI vide circulars, SEBI/HO/IMD/DF2/CIR/P/2019/12,
SEBI/HO/IMD/DF2/CIR/P/2019/57, SEBI/HO/IMD/DF2/CIR/P/2019/58 dated
Page 35 of 46January 10, 2019, April 11, 2019 and April 11, 2019 respectively has provided
indicative guidelines encompassing cyber security and cyber resilience
framework and audit framework encompassing systems and processes for
Mutual Funds/AMCs. The systems and processes as elaborated in the
aforementioned circulars must be in place and any future guidelines issued
by SEBI in this regard may be suitably followed.
2.8 Reputation and Conduct Risks
2.8.1 The risk of damage to the firm's reputation that could lead to negative
publicity, costly litigation, a decline in the customer base or the exit of key
employees and therefore, directly or indirectly, financial loss or revenue
shrinkage.
2.8.2 Conduct risk is often defined as the risk to the delivery of fair customer
outcomes or to market integrity.
2.8.3 The mandatory and recommendatory elements for managing reputation and
conduct risk are outlined below:
2.8.3.1 Mandatory Elements
i. The management must look into reputation and conduct risks and inculcate
their significance in the AMC culture by,
a. Integrating reputation and conduct risk considerations into strategy-
setting and business planning.
b. Establishing a crisis management policy (to minimize or neutralize
negative publicity in the event of any incident or bad conduct by an
employee).
c. Establishing monitoring tool(s) for social media grievances, etc.
ii. The Board of AMC should approve and monitor the effectiveness of
implementation of an enforceable code of ethics and business conduct; in the
event of a material breach in conduct or a significant reputation risk event,
the Board of AMC should be informed.
Page 36 of 46iii. The following practices must be adopted by the AMC:
a. While designing or improving the products, the complexity of the product
and consumer behaviors must be considered.
b. Impact assessment should be undertaken for sales and promotion
expenses (i.e. evaluation of value added v/s cost incurred) using
appropriate techniques, e.g. analysis of complaints, compliance
monitoring program, data analytics, mystery shopping, etc.
c. Preventive measures and monitoring mechanism should be implemented
to mitigate mis-selling risks.
2.8.3.2 Recommendatory Elements
i. AMCs may consider adopting:
a. Reputation risk policy.
b. Media interaction policy and procedures
c. Assessment and management of reputation via brand management tools,
data analytics, business intelligence.
d. Framework / Process to review and action any negative mention in
traditional or social media.
e. Procedures to monitor reputation risk on an ongoing basis.
ii. The management may be involved in increasing awareness about conduct
risk within the AMCs by:
a. Conducting training programs for conduct risk awareness.
b. Monitoring conduct risk indicators.
c. Incorporating conduct performance as part of the AMCs’ sales and
marketing team metrics.
Page 37 of 462.9 Outsourcing Risk
2.9.1 Inadequate management of outsourced processes lead to errors, frauds,
Inefficiencies, poor quality investor services, breach of fiduciary duties data
pilferages and long term impact on reputation and contractual obligations.
2.9.2 Asset management companies often rely on third parties including
Custodians, Fund Administrators, R&T agents, and various types of
outsourced service providers who perform operational, accounting,
recordkeeping and other types of services. In utilizing the services of such
third parties, it is important from a risk management perspective to keep in
mind that asset managers have ongoing fiduciary obligations to their
customers even though they have delegated certain of their roles to others.
It is therefore critical to perform careful reviews of the capabilities of third
parties at inception of relationships and on an ongoing basis, and to review
information provided by third parties for completeness, balance and accuracy
in order to be able to determine whether such third parties meet the risk
management, credit, operational, legal and other relevant standards of the
reviewing company with respect to the function they are performing.
2.9.3 The mandatory and recommendatory elements for managing Outsourcing
risk, are outlined below:
2.9.3.1 Mandatory Elements
i. Risk management with respect to any outsourced activity should be done in
the manner as if the activities were being done in-house.
ii. There shall be a dedicated person in the AMC who would be responsible for
the outsourced activities of each outsourced vendor.
iii. The AMC should have a Board approved Outsourcing Policy incorporating
the following aspects (as well as other applicable regulatory requirements):
a. Listing of core activities which cannot be outsourced.
b. Procedure for outsourcing, including risk and materiality assessment.
c. Monitoring and control of outsourced activities (as part of outsourcing risk
Page 38 of 46management program).
d. Information security and confidentiality (including data privacy/ protection
standards).
e. Criteria for selection and minimum qualification.
f. Minimum quality standards.
g. Tenure of agreement.
h. Responsibility for outsourced functions.
i. Acceptable level of deviations.
j. Periodic review of service levels and pricing.
k. Restriction on sub-delegation or sub-contracting.
l. Right for inspection and audit.
m. Approval authorities.
n. Service level agreement.
o. Archival and retrieval of documents/data.
p. Insurance requirements.
q. Incident reporting and escalation matrix.
iv. Before outsourcing any activity, the AMC should ensure the following is in
place:
a. Outsourcing agreements with service provider are legal and binding as
per the law.
b. Due diligence (including AML/CFT, if applicable) is conducted on the
service provider, where the outsourced activity is material, which may
include the following considerations:
1. Availability of qualified and experienced service providers to perform
the service on an ongoing basis
2. Arrangements for structured review of the capability and experience
of service providers
3. Evaluation of relevant personnel for critical functions, to evaluate their
specific competencies and execution capabilities
4. A disaster recovery and business continuity plan exist with regard to
the contracted services and products, and that the adequacy and
effectiveness of the same is maintained and tested periodically by the
Page 39 of 46service provider.
c. Analysis of the benefits and risks of outsourcing the proposed activity as
well as the service provider risk, and determination of the cost implications
for establishing the outsourcing arrangement.
v. After outsourcing any activity, the AMC shall ensure:
a. Outsourcing vendors’ process/people/systems are reviewed.
b. A periodic internal review is done on the functioning of outsourced
activities (like Fund Accounting and R&T agent functions) at least
annually.
c. An effective structured tool (IT / manual) is used to review/benchmark the
performance of the third party service providers (Fund Administrators /
Custodians / R&T agents) vis-a-vis the SLA.
d. The result of the review documented and risks emanating from them are
highlighted and remediation plans are monitored on an ongoing basis.
e. Communication of its error tolerance, code of conduct and objective to its
third party service providers (Fund Administrators / Custodians / R&T
agents).
f. The service provider should test business continuity and contingency plan
on a periodic basis to ensure adequacy and effectiveness’.
vi. The Mutual Fund should establish reconciliation procedures with regard to
periodic reconciliation between fund accounting system, R&T system and
bank account and conduct a periodic audit of all investor-related activities,
carried out both by the Mutual Fund and the R&T agent, to ensure that all
allotments, redemptions, income distributions and commission distributions
have been accurate and timely.
vii. The Mutual Fund should ensure that the fund accounting systems used (in-
house or by the fund accountant to whom this activity has been outsourced)
facilitate:
a. Validation of NAV calculations.
b. Automated and manual price feeds.
c. Identification of missing prices.
d. Flagging of price variances beyond pre-established tolerance levels.
Page 40 of 462.9.3.2 Recommendatory Elements
i. To enhance protection over outsourcing risk, AMCs may include the following
as part of their evaluation / monitoring program:
a. Consider fraud vulnerabilities in the outsourced process, including:
1. Detailed periodic fraud risk assessment program
2. Fraud response plan
3. Fraud risk register
4. Reporting to the AMC’s Board
b. Maintain an exit strategy including a pool of comparable service
providers, in the event that a contracted service provider is unable to
perform or in the event of a critical fraud.
2.10 Sales and Distribution Risk
2.10.1 As most AMCs outsource or use other channels for distributing products,
such as banks, IAs, brokers, NBFCs, Distributors, etc., there is a need of
monitoring risks associated with managing distribution channels and
processes, commission pay-outs, brokerage disbursements, sales
expenses, etc.
2.10.2 The mandatory and recommendatory elements for managing sales and
distribution risk, are outlined below:
2.10.2.1 Mandatory Elements
i. The KRA/performance appraisal at the relevant CXO level must capture the
performance in managing the risk of mis-selling. The risk of mis-selling may
incorporate the components like the number of mis-sellings, outcomes in the
inspection report, analysis of the portfolio of investors, analysis based on
assessment of appropriateness to the investors, etc. As an example, a
parameter to gauge mis-selling may be the analysis of whether growth in the
Page 41 of 46AUM of a scheme is on account of performance or mainly due to higher
commission paid to distributor.
ii. The AMC shall also be responsible for the mis-selling done by the persons
associated with selling of mutual funds including distributors. The
performance disclosure to investors, if any, by the distributors should be true
and fair. It should not be misleading to the investor by representing any
selective time period representing the favorable return.
iii. Detailed analysis should be done at the AMC level to verify mis-sellings, if
any.
iv. All the sales staff and distributers must be NISM certified with the required
qualifications prescribed by SEBI/AMFI.
v. The AMC must implement the following procedures relating to distributor
commissions:
a. Analytical tools/ audit procedures used to review trends/errors in
brokerage/ commission disbursements.
b. An approved methodology for determining commission structures
applicable to distributors / products, together with an authorization matrix
for approving deviations and reporting cost-benefit outcome.
c. Ensuring that commissions and other payments made to distributors
adhere to AMFI and regulatory requirements.
vi. Conducting regular performance reviews for distributors.
vii. Conducting enhanced due diligence of distributors where appropriate
(suitable policy to be incorporated)
2.10.2.2 Recommendatory Elements
i. Distribution risks can be further monitored by:
a. Monitoring marketing, sales and promotional expenses which includes
the nature of expenses and approval matrix for the expenses.
b. Monitoring and reporting the cost-benefit outcome of the marketing,
marketing, sales and promotional expenses
c. Undertaking mystery shopping.
Page 42 of 46d. Claw back provisions in the commission structures to provide adequate
protection from continuous services to the investors.
2.11 Financial Reporting Risk
2.11.1 Absence of internal control over financial reporting with regard to the mutual
fund schemes, may pose the following risks:
i. Improper maintenance of records that, in reasonable detail, accurately and
fairly reflect the transactions and dispositions of assets
ii. Absence of reasonable assurance that transactions are recorded as necessary
to permit calculation of NAV and preparation of financial statements in
accordance with generally accepted accounting principles, and that receipts
and expenditures are being made only in accordance with authorizations of the
management and the Board
iii. Failure to prevent or timely detect unauthorized acquisition, use, or disposition
of assets that could have a material effect on the NAV and/or financial
statements.
2.11.2 The mandatory elements for managing financial reporting risk, are outlined
below:
2.11.2.1 Mandatory Elements
i. The AMC should have detailed accounting policies and procedures for Mutual
Fund accounting.
ii. Adequate segregation of duties must be created within the Finance (or
relevant) function for Mutual Fund accounting.
iii. There should be documentation and regular testing of internal controls over
financial reporting of Mutual Fund schemes.
Page 43 of 462.12 Legal & Tax Risks
2.12.1 Legal & Tax risk is the risk of loss to an institution which is primarily caused
by:
i. A defective transaction.
ii. A claim (including a defense to a claim or a counterclaim) being made or some
other event occurring which results in a liability for the institution or other loss
(for example, as a result of the termination of a contract).
iii. Failing to take appropriate measures to protect assets (for example, intellectual
property) owned by the institution.
iv. Change in law
v. Misinterpretation of statutes and regulations.
vi. Failure to collect or pay appropriate taxes, or submit required returns or
information.
2.12.2 The mandatory elements for managing legal and tax risk, are outlined below:
2.12.2.1 Mandatory Elements
i. The AMC should have documented processes and defined responsibilities
for:
a. Calculation and deposit statutory levies applicable to Mutual Funds.
b. Acceptance of applications from permitted jurisdictions.
c. Monitoring of risks emanating from tax related aspects and their
redressal.
d. Implementation of new and amended statutory and regulatory
requirements.
ii. To mitigate legal risks, the AMC should have documented processes and
defined responsibilities for:
a. Review of material agreements.
b. Authorized personnel for execution and registration of legal
agreements and documents.
c. Centralized register of all legal agreements
Page 44 of 46d. Archival of physical and electronic versions of all legal agreements and
documents.
2.13 Talent Risk
2.13.1 Talent risk is the risk of not having the right people in place at the right time
to drive current and future business growth.
2.13.2 The mandatory and recommendatory elements for managing talent risk, are
outlined below:
2.13.2.1 Mandatory Elements
i. With respect to talent risk, there should be proper succession planning for
identified key positions. At no point of time the AMC is deprived of the
services of any Key Managerial Person.
ii. The AMC should have adequately documented policies and procedures for:
a. Recruiting staff with appropriate experience, skill levels, and degree of
expertise to undertake specialized business operations., in particular,
those relating to risk management
b. Employing screening procedures, including background checks, for job
applicants, particularly for key positions.
c. Creation of policies for recruiting, retaining and remunerating staff,
especially for key personnel.
d. Evaluation of the candidate's capability and experience to manage the
risks associated with the concerned role is should be a key element of the
recruitment process.
e. Adequate back-ups for key people are present.
2.13.2.2 Recommendatory Elements
i. AMCs may implement a remuneration policy that prevents excessive risk
taking and also ensures retention of good talent.
Page 45 of 46ii. A Remuneration Committee, comprising mainly of non-executive directors
may be established to review and recommend the policy relating to the
remuneration of key management personnel, including the CEO, Fund
Managers, etc.
Page 46 of 46