THOMAS MURRAY RISK RATING REPORTS – STRUCTURE AND CONTENT AND METHODOLOGY

1. THOMAS MURRAY RISK RATING REPORTS – STRUCTURE AND CONTENT AND METHODOLOGY CAIRO October 2011

2. Agenda • Why TM has developed Risk Reports? • Risks Assessed • Risk Weights • Risk Factors

3. Investor Exposure TM CSD Risk – Why TM Risk Reports are required?

4. Risk Definitions Risks Assessed • Asset Commitment Risk - The period of time from when control of securities or cash is given up until receipt of counter value. • Liquidity Risk - The risk that insufficient securities and or funds are available to meet commitments; the obligation will be covered some time later. • Counterparty Risk - The risk that a counterparty (i.e., a participant) will not settle its obligations for full value at any time. • Asset Servicing Risk - The risk that a participant may incur a loss arising from missed or inaccurate information provided by the depository, or from incorrectly executed instructions, in respect of corporate actions and proxy voting. • Financial Risk - The ability of the CSD to operate as a financially viable company. • Operational Risk - The risk that deficiencies in information systems or internal controls, human errors or management failures will result in losses.

5. CSD Services CSD Risk changes as they move up the value chain

6. Risk Definitions • Two New Risks • Asset Safety Risk - The risk that assets held in custody at the CSD may be lost or misappropriated, either due to a default or an omission, misuse, or breakdown of controls (legal, operational or other). • Governance & Transparency Risk - The risk that losses will occur due to poor governance and management arrangements and inadequate disclosure of information.

7. Rating AAA AA+ AA AA- A+ A A- BBB BB B CCC CC C Average Rating - ACSDA Average Rating – Asia Pacific Average Rating – Africa Average Rating – EU/EEA Average Rating – Middle East Average Rating – Eurasia Overall Risk Risk Weights Key Issues • The Overall Risk rating is a weighted average of the other six risk types. The risks are divided into 3 groups; Settlement, CSD Operation and Asset Servicing and each group is given equal weighting. • Settlement group comprises of Asset Commitment, Liquidity and Counterparty Risk. • CSD Operation comprises Financial and Operational Risks. • The weights can vary depending on the degree to which the CSD undertakes Asset Servicing activities. • The weights will need to be revised with the inclusion of Asset Safety and Governance & Transparency Risks.

8. Risk Weights

9. Rating AAA AA+ AA AA- A+ A A- BBB BB B CCC CC C Average Rating - ACSDA Average Rating – Asia Pacific Average Rating – Africa Average Rating – EU/EEA Average Rating – Middle East Average Rating – Eurasia Asset Commitment Risk Risk Factors • Asset commitment risk is a quantitative measurement of the asset commitment period for every type of settlement process • Most depositories have different ways of settling transactions, which could depend on place of trade execution (e.g. on-exchange or OTC), different markets, choice of processing cycle (Batch or real-time) or even asset class • The weighting given to each process is determined by the value percentage of transactions going through each settlement process.

10. Rating AAA AA+ AA AA- A+ A A- BBB BB B CCC CC C Average Rating - ACSDA Average Rating – Asia Pacific Average Rating – Africa Average Rating – EU/EEA Average Rating – Middle East Average Rating – Eurasia Liquidity Risk Risk Factors • The settlement processing model adopted by a CSD usually follows either Gross or Net settlement. The number of settlement cycles and thenetting efficiency of the processing is a key component in assessing the effectiveness of the settlement model. • The appropriate fails management regime operated by the CSD hinges around the range and timing of approaches used, factored by the actual settlement rate • The ability of clients to access credit facilities is critical to their ability to provide timely funding of a trade • Securities borrowing and lending (SBL) provides for securities shortfalls. • Matching processes in the market for CSD settled transactions assess both client side matching and market side matching and are given equal weighting. • Also take into account the registration arrangement and the proportion of securities on issue held within the CSD.

11. Rating AAA AA+ AA AA- A+ A A- BBB BB B CCC CC C Average Rating - ACSDA Average Rating – Asia Pacific Average Rating – Africa Average Rating – EU/EEA Average Rating – Middle East Average Rating – Eurasia Counterparty Risk Risk Factors • The most important principle to control counterparty risk is the use of Delivery versus Payment (DVP) settlement; which is the interdependent transfer of securities against cash. • Participants should have minimum capital requirement specified and appropriate technical resources. • Some surveillance should be undertaken on participants activities and their exposure levels. • The ability to manage a default is assessed in terms of the structure and financial resources available to guarantee all open obligations of the party that has defaulted (a guarantee fund). • Where a CCP is available, these are assessed as the ultimate counterparty in a market

12. Rating AAA AA+ AA AA- A+ A A- BBB BB B CCC CC C Average Rating - ACSDA Average Rating – Asia Pacific Average Rating – Africa Average Rating – EU/EEA Average Rating – Middle East Average Rating – Eurasia Asset Servicing Risk Risk Factors • Asset servicing is undertaken to various degrees by CSDs • Where the CSD is not involved in executing voluntary corporate actions or does not play a primary role in asset servicing, the weighting of this risk is reduced. • There are two key focal points to this risk – the first involves the collection and dissemination of information and the second is the receipt and execution of instructions. • There are other areas such as proxy voting and other related services eg tax services that are also included where these are (rarely) pursued by the CSD.

13. Rating AAA AA+ AA AA- A+ A A- BBB BB B CCC CC C Average Rating - ACSDA Average Rating – Asia Pacific Average Rating – Africa Average Rating – EU/EEA Average Rating – Middle East Average Rating – Eurasia Financial Risk Risk Factors • Capital adequacy is an important criteria in ensuring the financial stability of a company. • Profitability and revenue generation is assessed over a 5 year period. • The strength and quality of ownership of the CSD becomes increasingly important were the CSD to be under duress. • The standard of liability a depository assumes in relation to any claims against it by participants who may have suffered losses due to the actions or omissions of the CSD. • The primary way a CSD can cover any claims is through acquiring adequate insurance. • Another avenue of funds is through secured credit lines • Also examine outstanding investments by the CSD in infrastructure (building, computer systems etc.)

14. Rating AAA AA+ AA AA- A+ A A- BBB BB B CCC CC C Average Rating - ACSDA Average Rating – Asia Pacific Average Rating – Africa Average Rating – EU/EEA Average Rating – Middle East Average Rating – Eurasia Operational Risk Risk Factors • Identification of the risks and the key controls used to manage those risks. • Documented procedures are required for all processes. • All operations including IT operations should be subject to both internal and external audit. • Appropriate DRP and BCP arrangements that have been fully and regularly tested are essential. • Automation of processes reduces the risk of manual errors. • Reporting arrangements to clients is also taken into account. • Staff training helps manage risks when manual intervention is required.

15. Asset Safety Risk Risk Factors • Segregation of Securities • Legal Conventions • Forms of Securities • Liens • Reconciliation and Audit • Account Control • Cash Deposits

16. Governance & Transparency Risk • Board Arrangements • Establishment of Risk Management • Disclosure of Corporate Information • Disclosure of Statistical Information • User Group Arrangements Risk Factors

17. Example Operational Risk Ratings Rating Established procedures Identification of key controls Operational Audit Processing Reporting Disaster Recovery procedures Business Continuity Plan Staff training Indicates likely direction of any change in this factor. O1 AAA AA+ AA AA- A+ A A- BBB BB B CCC CC C O2 O3 O2 O1 O7 CSD Public Rating O3 O4 O5 O6 O4 O8 O4 O5 O6 O7 Comparative Chart Average Americas - TM Proprietary Rating Average Eastern Europe – TM Proprietary Avge West Euro – TM Proprietary Avge Asia Pac – TM Proprietary Average Africa – TM Proprietary Avge Mid East – TM Proprietary S Public Rating O8 CSD Critical Less important Important