Self-Regulatory Organizations; ICE Clear Europe Limited; Order Approving Proposed Rule Change Relating to the ICE Clear Europe Outsourcing Policy, 56129-56131 [2022-19679]

Download as PDF Federal Register / Vol. 87, No. 176 / Tuesday, September 13, 2022 / Notices Commission takes such action, the Commission shall institute proceedings under Section 19(b)(2)(B) 14 of the Act to determine whether the proposed rule change should be approved or disapproved. IV. Solicitation of Comments Interested persons are invited to submit written data, views, and arguments concerning the foregoing, including whether the proposed rule change is consistent with the Act. Comments may be submitted by any of the following methods: jspears on DSK121TN23PROD with NOTICES Electronic Comments • Use the Commission’s internet comment form (https://www.sec.gov/ rules/sro.shtml); or • Send an email to rule-comments@ sec.gov. Please include File Number SR– NYSEAMER–2022–37 on the subject line. Paper Comments • Send paper comments in triplicate to: Secretary, Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549–1090. All submissions should refer to File Number SR–NYSEAMER–2022–37. This file number should be included on the subject line if email is used. To help the Commission process and review your comments more efficiently, please use only one method. The Commission will post all comments on the Commission’s internet website (https://www.sec.gov/ rules/sro.shtml). Copies of the submission, all subsequent amendments, all written statements with respect to the proposed rule change that are filed with the Commission, and all written communications relating to the proposed rule change between the Commission and any person, other than those that may be withheld from the public in accordance with the provisions of 5 U.S.C. 552, will be available for website viewing and printing in the Commission’s Public Reference Room, 100 F Street NE, Washington, DC 20549 on official business days between the hours of 10:00 a.m. and 3:00 p.m. Copies of the filing also will be available for inspection and copying at the principal office of the Exchange. All comments received will be posted without change. Persons submitting comments are cautioned that we do not redact or edit personal identifying information from comment submissions. You should submit only information that you wish to make available publicly. All 14 15 U.S.C. 78s(b)(2)(B). VerDate Sep<11>2014 17:30 Sep 12, 2022 Jkt 256001 submissions should refer to File Number SR–NYSEAMER–2022–37 and should be submitted on or before October 4, 2022. For the Commission, by the Division of Trading and Markets, pursuant to delegated authority.15 J. Matthew DeLesDernier, Deputy Secretary. [FR Doc. 2022–19688 Filed 9–12–22; 8:45 am] BILLING CODE 8011–01–P SECURITIES AND EXCHANGE COMMISSION [Release No. 34–95685; File No. SR–ICEEU– 2022–014] Self-Regulatory Organizations; ICE Clear Europe Limited; Order Approving Proposed Rule Change Relating to the ICE Clear Europe Outsourcing Policy September 7, 2022. I. Introduction On July 19, 2022, ICE Clear Europe Limited (‘‘ICE Clear Europe’’ or ‘‘ICEEU’’) filed with the Securities and Exchange Commission (‘‘Commission’’), pursuant to Section 19(b)(1) of the Securities Exchange Act of 1934 (the ‘‘Act’’),1 and Rule 19b–4 thereunder,2 a proposed rule change to adopt an Outsourcing Policy. The proposed rule change was published for comment in the Federal Register on August 4, 2022.3 The Commission did not receive comments regarding the proposed rule change. For the reasons discussed below, the Commission is approving the proposed rule change. II. Description of the Proposed Rule Change The proposed rule change would create an Outsourcing Policy to describe, in a consolidated document, ICEEU’s procedures for management of its outsourcing arrangements with thirdparty providers and affiliates, including how ICEEU’s board maintains oversight of these outsourcing arrangements.4 The Outsourcing Policy, as a rule of the clearing agency, is designed to complement two of ICE Clear Europe’s 15 17 CFR 200.30–3(a)(12). U.S.C. 78s(b)(1). 2 17 CFR 240.19b–4. 3 Self-Regulatory Organizations; ICE Clear Europe Limited; Notice of Filing of Proposed Rule Change Relating to the ICE Clear Europe Outsourcing Policy, Exchange Act Release No. 95394 (July 29, 2022); 87 FR 47809 (Aug. 4, 2022) (File No. SR– ICEEU–2022–014) (‘‘Notice’’). 4 The description that follows is substantially excerpted from the Notice. Capitalized terms not otherwise defined herein have the meanings assigned to them in ICEEU’s Outsourcing Policy or Rules, as applicable. 1 15 PO 00000 Frm 00142 Fmt 4703 Sfmt 4703 56129 policies: the Vendor Management Policy (‘‘VMP’’) and the Outsourcing Operating Manual (‘‘OOM’’). The VMP describes certain group-wide policies of ICEEU’s parent, Intercontinental Exchange, Inc., with respect to its outsourcing arrangements with third parties. The OOM sets out additional details concerning the steps it follows in order to introduce, amend and maintain outsourcing arrangements. Together with the VMP, the proposed Outsourcing Policy would document how the ICEEU assesses the risks of outsourcing certain functions. The Outsourcing Policy would not represent a change in the ICEEU’s current practices, but rather more clearly document those practices in an overall policy. The Outsourcing Policy would include an introduction section that describes the differences between outsourcing and purchasing services, the former described as ICEEU’s use of a service provider to perform an ongoing activity that would usually be performed by ICEEU and which often involves transferring or sharing related non-public proprietary information, and the latter being ICEEU’s purchases of services, goods and facilities and which would typically not include any transfer of non-public proprietary information. The Outsourcing Policy would also differentiate ICEEU’s outsourcing practices and purchasing arrangements with third-party providers from those with its affiliates. The Outsourcing Policy would state that outsourcing through its affiliates typically have a lower risk profile for ICEEU because affiliates tend to be regulated entities with the same or similar systems, risk appetites, standards and processes, among other commonalities, as ICE Clear Europe. The Outsourcing Policy would also set out ICEEU’s overall objectives when considering outsourcing. The Outsourcing Policy would include a discussion of outsourcing to third parties and to ICEEU’s affiliates. As mentioned, outsourcing to third parties is covered under the VMP, which covers due diligence, risk assessment, suitability, and performance management, among other topics. Outsourcing to affiliates of ICEEU would follow the same process and standards as under the VMP; however, assessments would be performed by ICEEU’s senior management rather than the ICEEU’s Vendor Management Office. ICEEU represented that, in all cases, it would look to ensure that all service provider-related incidents (such as service interruptions) are recorded, monitored, and escalated to ICEEU’s E:\FR\FM\13SEN1.SGM 13SEN1 jspears on DSK121TN23PROD with NOTICES 56130 Federal Register / Vol. 87, No. 176 / Tuesday, September 13, 2022 / Notices senior management in a consistent manner.5 The Outsourcing Policy would provide that ICEEU would consider, in its assessment of service providers, the lower risk associated in outsourcing functions to third parties that are also regulated or authorized. ICEEU would also consider in its assessment of a service provider how the service provider’s presence in a different jurisdiction impacts the risks associated with outsourcing functions to that service providers. The Outsourcing Policy would also state that ICEEU would look to manage any potential or actual conflicts of interest resulting from its outsourcing arrangements, particularly in respect of outsourcing arrangements it has with its affiliates. Additionally, ICE Clear Europe proposes to include in the Outsourcing Policy that it looks to reserve independent audit rights to check compliance with legal and regulatory requirements and policies in its outsourcing agreements with third-party and affiliate service providers, as required. ICE Clear Europe also proposes to include in the Outsourcing Policy information about its cloud-based outsourcing arrangements. Outsourcing to the cloud is generally covered under the existing VMP. Relevant ICE Clear Europe and ICE Group policies, such as the Corporate Information Security Policy, would also be considered when engaging in cloud outsourcing arrangements. Adding a new or significantly changing an existing cloud outsource arrangement would be covered under the OOM. The Outsourcing Policy would include a section describing ICEEU’s considerations when deciding whether to outsource a function considered ‘‘critical or important.’’ A function is considered by ICEEU to be ‘‘critical or important’’ where a defect or failure in its performance would materially impair the ICEEU’s continuing compliance with the conditions and obligations or its authorizations or other obligations, financial performance, or the soundness or continuity of its services and activities. The Outsourcing Policy would include an acknowledgment by ICEEU that outsourcing ‘‘critical or important’’ functions could impact ICEEU’s risk profile, ability to oversee the service provider and manage risks, business continuity measures, and performance of its business activities. Under the proposed Outsourcing Policy, ICEEU 5 See Notice at 47809. VerDate Sep<11>2014 17:30 Sep 12, 2022 Jkt 256001 would ensure that such matters would be considered in the decision-making processes with respect to outsourcing. Additionally, ‘‘critical or important’’ functions would impact how an outsourcing arrangement is assessed, documented and managed by ICEEU (including by having an exit plan, if practical). Also, if a function to be outsourced is or would be a dependency to the delivery of one or more of ICEEU’s important business services under its operational resilience framework, such function would be mapped accordingly with appropriate consideration given to potential vulnerabilities, resiliency, and impact to the relevant impact tolerances. The Outsourcing Policy would also include a discussion of additional considerations of particular importance to ICEEU, in light of its position as a systemically important financial market infrastructure and in alignment with its regulatory oversight. The proposed Outsourcing Policy would highlight the following additional items that ICEEU would consider with respect to its outsourcing arrangements: (i) business continuity arrangements, (ii) incident management responsiveness and reporting, (iii) independent assurances, and (iv) redundancies, notice periods and exit strategies. Regarding business continuity arrangements, the proposed rule change would state that, during the onboarding process and through periodic reviews and testing, ICEEU would assess the service provider’s business continuity plans to ensure that they are fit for the relevant purposes. The proposal would state that incident management and responsiveness and timely reporting are important factors in ICEEU’s outsourcing arrangements, given the services that ICEEU operates. Accordingly, the proposal would require that outsourcing providers have appropriate mechanisms for timely response and incident management. Regarding independent assurances, the proposal would state that where possible and practicable, ICEEU would look to collect independent assurances of the outsourcing providers’ services, which may include but are not limited to SOC2 audits, Regulation SCI audits, and enterprise technology risk assessments. Finally, the proposed Outsourcing Policy would state that where possible and practicable, the ICEEU would look to mitigate the risk of disruption to its services from outsourcing providers ceasing to provide their services to ICEEU, through redundancies (the use of multiple providers), sufficient notice periods, or exit strategies. PO 00000 Frm 00143 Fmt 4703 Sfmt 4703 The proposed Outsourcing Policy would also include a section describing ICEEU’s Board oversight of outsourcing arrangements. The Board oversees ICEEU’s outsourcing arrangements through risk appetite metrics that include service and incident reporting, operational risk reporting that covers incidents observed in the relevant period, their resolution and other performance metrics, and an Annual Outsourcing Assessment Report. The proposed Outsourcing Policy would state that the COO or its delegate would prepare the Annual Outsourcing Assessment Report, which would be reviewed by the Board each year directly or via its committees. The Annual Outsourcing Assessment Report would cover the following topics: (i) the activities and services that are outsourced, (ii) the identities of the outsource providers, (iii) the performance of the outsourcing providers and their adherence to agreed service levels, (iv) where relevant, the security measures of the outsourcing providers, (v) risk reviews of the outsourcing providers, particularly those providing critical or important cloud outsourcing arrangements, (vi) exit strategies and contingency arrangements associated with outsourcing critical or important functions, and (vii) results and conclusions of additional assurance mechanisms (for example, SOC2 audits) where applicable. Finally, the proposed Outsourcing Policy would describe governance and exception handling. The document owner would be responsible for ensuring that it remains up to date and reviewed in accordance with ICEEU’s governance processes. Exceptions to the Outsourcing Policy would also be approved in accordance with such governance processes. Any deviations from the Outsourcing Policy would have to be appropriately escalated and reported in a timely manner by the document owner, and the document owner would also be responsible for reporting any material breaches or deviations to the President of ICE Clear Europe and the Risk Oversight Department in order to determine the appropriate governance escalation and notification requirements. III. Discussion and Commission Findings Section 19(b)(2)(C) of the Act directs the Commission to approve a proposed rule change of a self-regulatory organization if it finds that such proposed rule change is consistent with the requirements of the Act and the rules and regulations thereunder E:\FR\FM\13SEN1.SGM 13SEN1 Federal Register / Vol. 87, No. 176 / Tuesday, September 13, 2022 / Notices applicable to such organization.6 For the reasons discussed below, the Commission finds that the proposed rule change is consistent with Section 17A(b)(3)(F) of the Act,7 and Rules 17Ad–22(e)(2)(v) and (e)(3)(i) thereunder.8 jspears on DSK121TN23PROD with NOTICES A. Consistency With Section 17A(b)(3)(F) of the Act Section 17A(b)(3)(F) of the Act requires, among other things, that the rules of ICE Clear Europe be designed to promote the prompt and accurate clearance and settlement of securities transactions and, to the extent applicable, derivative agreements, contracts, and transactions.9 As noted above, the proposed rule change would create a consolidated policy-level document for managing outsourcing of services with both third-party providers and affiliates of ICEEU. Specifically, the proposed rule change would lay out in detail certain key considerations of ICEEU in outsourcing, including assessing service providers’ operational capabilities, dependencies, resilience, financial, reputational, legal, and regulatory standing. The proposed rule change would also include an acknowledgment by ICEEU that outsourcing critical or important functions could impact its risk profile, ability to oversee the service provider and manage risks, business continuity measures, and performance of its business activities, and would be considered in outsourcing decisions. The proposed Outsourcing Policy would also include that ICEEU looks to manage any potential or actual conflicts of interest resulting from its outsourcing arrangements. The Commission believes that these overarching considerations, combined with a description of ICEEU’s Board oversight of outsourcing arrangements, would enhance ICEEU’s ability to manage risks associated with outsourcing as they arise as well as its ability to regularly assess outsourcing providers. The Commission believes that this in turn should strengthen ICEEU’s ability to carry out its operations, thereby promoting the prompt and accurate clearance and settlement of securities transactions. For these reasons, the Commission believes that the proposed rule change is consistent with Section 17A(b)(3)(F) of the Act.10 6 15 U.S.C. 78s(b)(2)(C). U.S.C. 78q–1(b)(3)(F). 8 17 CFR 240.17Ad–22(e)(2)(v) and (e)(3)(i). 9 15 U.S.C. 78q–1(b)(3)(F). 10 15 U.S.C. 78q–1(b)(3)(F). B. Consistency With Rule 17Ad– 22(e)(2)(v) Under the Act Rule 17Ad–22(e)(2)(v) requires, in relevant part, that ICEEU establish, implement, maintain, and enforce written policies and procedures reasonably designed, as applicable, to provide for governance arrangements that specify clear and direct lines of responsibility.11 As noted above, the proposed Outsourcing Policy would explain the Board’s role in overseeing outsourcing arrangements, including through utilization of risk metrics, operational risk reporting, and the review of the annual outsourcing assessment report (prepared by the COO). Further, the proposed rule change would state that the document owner is responsible for updating the proposed Outsourcing Policy, that any exceptions to the document would be escalated and reported by the document holder, and that the document owner would report any material breaches or deviations to the President of ICEEU and will notify the Risk Oversight Department in order to determine the appropriate governance escalation and notification requirements. The Commission believes that documenting the roles and responsibilities for managing the proposed Outsourcing Policy in this way provides for governance arrangements that specify clear and direct lines of responsibility. For these reasons, the Commission believes that the proposed rule change is consistent with Rule 17Ad– 22(e)(2)(v).12 C. Consistency With Rule 17Ad– 22(e)(3)(i) Under the Act Rule 17Ad–22(e)(3)(i) requires that ICEEU establish, implement, maintain, and enforce written policies and procedures reasonably designed to, as applicable, maintain a sound risk management framework for comprehensively managing legal, credit, liquidity, operational, general business, investment, custody, and other risks that arise in or are borne by ICEEU, which includes risk management policies, procedures, and systems designed to identify, measure, monitor, and manage the range of risks that arise in or are borne by ICEEU, that are subject to review on a specified periodic basis and approved by ICEEU’s board of directors annually.13 Because the proposed Outsourcing Policy described above sets forth considerations and approaches to 7 15 VerDate Sep<11>2014 17:30 Sep 12, 2022 Jkt 256001 11 17 CFR 240.17 Ad–22(e)(2)(v). CFR 240.17 Ad–22(e)(2)(v). 13 17 CFR 240.17 Ad–22(e)(3)(i). 12 17 PO 00000 Frm 00144 Fmt 4703 Sfmt 9990 56131 measuring, monitoring, and identifying the risks related to outsourcing arrangements and lays out governance of this process on an annual basis, the Commission believes that it strengthens ICEEU’s management of a range of risks borne by it which is also subject to periodic and annual Board review. For example, the Commission believes that the proposed procedures related to identifying critical functions (defining a function as ‘‘critical or important’’), the regular assessment of service providers (assessment of service provider’s business continuity plans and timely response to incidents), and mitigation of risk (through redundancies, notice periods and exit strategies) from service providers, all support and strengthen ICEEU’s ability to identify, monitor, and measure the risks related to outsourcing arrangements. For these reasons, the Commission believes that the proposed rule change is consistent with Rule 17Ad– 22(e)(3)(i).14 IV. Conclusion On the basis of the foregoing, the Commission finds that the proposed rule change is consistent with the requirements of the Act, and in particular, with the requirements of Section 17A(b)(3)(F) of the Act,15 and Rules 17Ad–22(e)(2)(v) and 17Ad– 22(e)(3)(i).16 It is therefore ordered pursuant to Section 19(b)(2) of the Act 17 that the proposed rule change (SR–ICEEU–2022– 014), be, and hereby is, approved.18 For the Commission, by the Division of Trading and Markets, pursuant to delegated authority.19 J. Matthew DeLesDernier, Deputy Secretary. [FR Doc. 2022–19679 Filed 9–12–22; 8:45 am] BILLING CODE 8011–01–P 14 17 CFR 240.17Ad–22(e)(3)(i). U.S.C. 78q–1(b)(3)(F). 16 17 CFR 240.17Ad–22(e)(2)(i) and (v) and 17 CFR 240.17Ad–22(e)(3)(i). 17 15 U.S.C. 78s(b)(2). 18 In approving the proposed rule change, the Commission considered the proposal’s impact on efficiency, competition, and capital formation. 15 U.S.C. 78c(f). 19 17 CFR 200.30–3(a)(12). 15 15 E:\FR\FM\13SEN1.SGM 13SEN1

Agencies

SECURITIES AND EXCHANGE COMMISSION

[Federal Register Volume 87, Number 176 (Tuesday, September 13, 2022)]
[Notices]
[Pages 56129-56131]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2022-19679]


-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

[Release No. 34-95685; File No. SR-ICEEU-2022-014]


Self-Regulatory Organizations; ICE Clear Europe Limited; Order 
Approving Proposed Rule Change Relating to the ICE Clear Europe 
Outsourcing Policy

September 7, 2022.

I. Introduction

    On July 19, 2022, ICE Clear Europe Limited (``ICE Clear Europe'' or 
``ICEEU'') filed with the Securities and Exchange Commission 
(``Commission''), pursuant to Section 19(b)(1) of the Securities 
Exchange Act of 1934 (the ``Act''),\1\ and Rule 19b-4 thereunder,\2\ a 
proposed rule change to adopt an Outsourcing Policy. The proposed rule 
change was published for comment in the Federal Register on August 4, 
2022.\3\ The Commission did not receive comments regarding the proposed 
rule change. For the reasons discussed below, the Commission is 
approving the proposed rule change.
---------------------------------------------------------------------------

    \1\ 15 U.S.C. 78s(b)(1).
    \2\ 17 CFR 240.19b-4.
    \3\ Self-Regulatory Organizations; ICE Clear Europe Limited; 
Notice of Filing of Proposed Rule Change Relating to the ICE Clear 
Europe Outsourcing Policy, Exchange Act Release No. 95394 (July 29, 
2022); 87 FR 47809 (Aug. 4, 2022) (File No. SR-ICEEU-2022-014) 
(``Notice'').
---------------------------------------------------------------------------

II. Description of the Proposed Rule Change

    The proposed rule change would create an Outsourcing Policy to 
describe, in a consolidated document, ICEEU's procedures for management 
of its outsourcing arrangements with third-party providers and 
affiliates, including how ICEEU's board maintains oversight of these 
outsourcing arrangements.\4\
---------------------------------------------------------------------------

    \4\ The description that follows is substantially excerpted from 
the Notice. Capitalized terms not otherwise defined herein have the 
meanings assigned to them in ICEEU's Outsourcing Policy or Rules, as 
applicable.
---------------------------------------------------------------------------

    The Outsourcing Policy, as a rule of the clearing agency, is 
designed to complement two of ICE Clear Europe's policies: the Vendor 
Management Policy (``VMP'') and the Outsourcing Operating Manual 
(``OOM''). The VMP describes certain group-wide policies of ICEEU's 
parent, Intercontinental Exchange, Inc., with respect to its 
outsourcing arrangements with third parties. The OOM sets out 
additional details concerning the steps it follows in order to 
introduce, amend and maintain outsourcing arrangements. Together with 
the VMP, the proposed Outsourcing Policy would document how the ICEEU 
assesses the risks of outsourcing certain functions. The Outsourcing 
Policy would not represent a change in the ICEEU's current practices, 
but rather more clearly document those practices in an overall policy.
    The Outsourcing Policy would include an introduction section that 
describes the differences between outsourcing and purchasing services, 
the former described as ICEEU's use of a service provider to perform an 
ongoing activity that would usually be performed by ICEEU and which 
often involves transferring or sharing related non-public proprietary 
information, and the latter being ICEEU's purchases of services, goods 
and facilities and which would typically not include any transfer of 
non-public proprietary information.
    The Outsourcing Policy would also differentiate ICEEU's outsourcing 
practices and purchasing arrangements with third-party providers from 
those with its affiliates. The Outsourcing Policy would state that 
outsourcing through its affiliates typically have a lower risk profile 
for ICEEU because affiliates tend to be regulated entities with the 
same or similar systems, risk appetites, standards and processes, among 
other commonalities, as ICE Clear Europe. The Outsourcing Policy would 
also set out ICEEU's overall objectives when considering outsourcing.
    The Outsourcing Policy would include a discussion of outsourcing to 
third parties and to ICEEU's affiliates. As mentioned, outsourcing to 
third parties is covered under the VMP, which covers due diligence, 
risk assessment, suitability, and performance management, among other 
topics. Outsourcing to affiliates of ICEEU would follow the same 
process and standards as under the VMP; however, assessments would be 
performed by ICEEU's senior management rather than the ICEEU's Vendor 
Management Office. ICEEU represented that, in all cases, it would look 
to ensure that all service provider-related incidents (such as service 
interruptions) are recorded, monitored, and escalated to ICEEU's

[[Page 56130]]

senior management in a consistent manner.\5\
---------------------------------------------------------------------------

    \5\ See Notice at 47809.
---------------------------------------------------------------------------

    The Outsourcing Policy would provide that ICEEU would consider, in 
its assessment of service providers, the lower risk associated in 
outsourcing functions to third parties that are also regulated or 
authorized. ICEEU would also consider in its assessment of a service 
provider how the service provider's presence in a different 
jurisdiction impacts the risks associated with outsourcing functions to 
that service providers.
    The Outsourcing Policy would also state that ICEEU would look to 
manage any potential or actual conflicts of interest resulting from its 
outsourcing arrangements, particularly in respect of outsourcing 
arrangements it has with its affiliates.
    Additionally, ICE Clear Europe proposes to include in the 
Outsourcing Policy that it looks to reserve independent audit rights to 
check compliance with legal and regulatory requirements and policies in 
its outsourcing agreements with third-party and affiliate service 
providers, as required.
    ICE Clear Europe also proposes to include in the Outsourcing Policy 
information about its cloud-based outsourcing arrangements. Outsourcing 
to the cloud is generally covered under the existing VMP. Relevant ICE 
Clear Europe and ICE Group policies, such as the Corporate Information 
Security Policy, would also be considered when engaging in cloud 
outsourcing arrangements. Adding a new or significantly changing an 
existing cloud outsource arrangement would be covered under the OOM.
    The Outsourcing Policy would include a section describing ICEEU's 
considerations when deciding whether to outsource a function considered 
``critical or important.'' A function is considered by ICEEU to be 
``critical or important'' where a defect or failure in its performance 
would materially impair the ICEEU's continuing compliance with the 
conditions and obligations or its authorizations or other obligations, 
financial performance, or the soundness or continuity of its services 
and activities.
    The Outsourcing Policy would include an acknowledgment by ICEEU 
that outsourcing ``critical or important'' functions could impact 
ICEEU's risk profile, ability to oversee the service provider and 
manage risks, business continuity measures, and performance of its 
business activities. Under the proposed Outsourcing Policy, ICEEU would 
ensure that such matters would be considered in the decision-making 
processes with respect to outsourcing. Additionally, ``critical or 
important'' functions would impact how an outsourcing arrangement is 
assessed, documented and managed by ICEEU (including by having an exit 
plan, if practical). Also, if a function to be outsourced is or would 
be a dependency to the delivery of one or more of ICEEU's important 
business services under its operational resilience framework, such 
function would be mapped accordingly with appropriate consideration 
given to potential vulnerabilities, resiliency, and impact to the 
relevant impact tolerances.
    The Outsourcing Policy would also include a discussion of 
additional considerations of particular importance to ICEEU, in light 
of its position as a systemically important financial market 
infrastructure and in alignment with its regulatory oversight. The 
proposed Outsourcing Policy would highlight the following additional 
items that ICEEU would consider with respect to its outsourcing 
arrangements: (i) business continuity arrangements, (ii) incident 
management responsiveness and reporting, (iii) independent assurances, 
and (iv) redundancies, notice periods and exit strategies. Regarding 
business continuity arrangements, the proposed rule change would state 
that, during the onboarding process and through periodic reviews and 
testing, ICEEU would assess the service provider's business continuity 
plans to ensure that they are fit for the relevant purposes. The 
proposal would state that incident management and responsiveness and 
timely reporting are important factors in ICEEU's outsourcing 
arrangements, given the services that ICEEU operates. Accordingly, the 
proposal would require that outsourcing providers have appropriate 
mechanisms for timely response and incident management. Regarding 
independent assurances, the proposal would state that where possible 
and practicable, ICEEU would look to collect independent assurances of 
the outsourcing providers' services, which may include but are not 
limited to SOC2 audits, Regulation SCI audits, and enterprise 
technology risk assessments. Finally, the proposed Outsourcing Policy 
would state that where possible and practicable, the ICEEU would look 
to mitigate the risk of disruption to its services from outsourcing 
providers ceasing to provide their services to ICEEU, through 
redundancies (the use of multiple providers), sufficient notice 
periods, or exit strategies.
    The proposed Outsourcing Policy would also include a section 
describing ICEEU's Board oversight of outsourcing arrangements. The 
Board oversees ICEEU's outsourcing arrangements through risk appetite 
metrics that include service and incident reporting, operational risk 
reporting that covers incidents observed in the relevant period, their 
resolution and other performance metrics, and an Annual Outsourcing 
Assessment Report.
    The proposed Outsourcing Policy would state that the COO or its 
delegate would prepare the Annual Outsourcing Assessment Report, which 
would be reviewed by the Board each year directly or via its 
committees. The Annual Outsourcing Assessment Report would cover the 
following topics: (i) the activities and services that are outsourced, 
(ii) the identities of the outsource providers, (iii) the performance 
of the outsourcing providers and their adherence to agreed service 
levels, (iv) where relevant, the security measures of the outsourcing 
providers, (v) risk reviews of the outsourcing providers, particularly 
those providing critical or important cloud outsourcing arrangements, 
(vi) exit strategies and contingency arrangements associated with 
outsourcing critical or important functions, and (vii) results and 
conclusions of additional assurance mechanisms (for example, SOC2 
audits) where applicable.
    Finally, the proposed Outsourcing Policy would describe governance 
and exception handling. The document owner would be responsible for 
ensuring that it remains up to date and reviewed in accordance with 
ICEEU's governance processes. Exceptions to the Outsourcing Policy 
would also be approved in accordance with such governance processes. 
Any deviations from the Outsourcing Policy would have to be 
appropriately escalated and reported in a timely manner by the document 
owner, and the document owner would also be responsible for reporting 
any material breaches or deviations to the President of ICE Clear 
Europe and the Risk Oversight Department in order to determine the 
appropriate governance escalation and notification requirements.

III. Discussion and Commission Findings

    Section 19(b)(2)(C) of the Act directs the Commission to approve a 
proposed rule change of a self-regulatory organization if it finds that 
such proposed rule change is consistent with the requirements of the 
Act and the rules and regulations thereunder

[[Page 56131]]

applicable to such organization.\6\ For the reasons discussed below, 
the Commission finds that the proposed rule change is consistent with 
Section 17A(b)(3)(F) of the Act,\7\ and Rules 17Ad-22(e)(2)(v) and 
(e)(3)(i) thereunder.\8\
---------------------------------------------------------------------------

    \6\ 15 U.S.C. 78s(b)(2)(C).
    \7\ 15 U.S.C. 78q-1(b)(3)(F).
    \8\ 17 CFR 240.17Ad-22(e)(2)(v) and (e)(3)(i).
---------------------------------------------------------------------------

A. Consistency With Section 17A(b)(3)(F) of the Act

    Section 17A(b)(3)(F) of the Act requires, among other things, that 
the rules of ICE Clear Europe be designed to promote the prompt and 
accurate clearance and settlement of securities transactions and, to 
the extent applicable, derivative agreements, contracts, and 
transactions.\9\ As noted above, the proposed rule change would create 
a consolidated policy-level document for managing outsourcing of 
services with both third-party providers and affiliates of ICEEU. 
Specifically, the proposed rule change would lay out in detail certain 
key considerations of ICEEU in outsourcing, including assessing service 
providers' operational capabilities, dependencies, resilience, 
financial, reputational, legal, and regulatory standing. The proposed 
rule change would also include an acknowledgment by ICEEU that 
outsourcing critical or important functions could impact its risk 
profile, ability to oversee the service provider and manage risks, 
business continuity measures, and performance of its business 
activities, and would be considered in outsourcing decisions. The 
proposed Outsourcing Policy would also include that ICEEU looks to 
manage any potential or actual conflicts of interest resulting from its 
outsourcing arrangements. The Commission believes that these 
overarching considerations, combined with a description of ICEEU's 
Board oversight of outsourcing arrangements, would enhance ICEEU's 
ability to manage risks associated with outsourcing as they arise as 
well as its ability to regularly assess outsourcing providers. The 
Commission believes that this in turn should strengthen ICEEU's ability 
to carry out its operations, thereby promoting the prompt and accurate 
clearance and settlement of securities transactions.
---------------------------------------------------------------------------

    \9\ 15 U.S.C. 78q-1(b)(3)(F).
---------------------------------------------------------------------------

    For these reasons, the Commission believes that the proposed rule 
change is consistent with Section 17A(b)(3)(F) of the Act.\10\
---------------------------------------------------------------------------

    \10\ 15 U.S.C. 78q-1(b)(3)(F).
---------------------------------------------------------------------------

B. Consistency With Rule 17Ad-22(e)(2)(v) Under the Act

    Rule 17Ad-22(e)(2)(v) requires, in relevant part, that ICEEU 
establish, implement, maintain, and enforce written policies and 
procedures reasonably designed, as applicable, to provide for 
governance arrangements that specify clear and direct lines of 
responsibility.\11\
---------------------------------------------------------------------------

    \11\ 17 CFR 240.17 Ad-22(e)(2)(v).
---------------------------------------------------------------------------

    As noted above, the proposed Outsourcing Policy would explain the 
Board's role in overseeing outsourcing arrangements, including through 
utilization of risk metrics, operational risk reporting, and the review 
of the annual outsourcing assessment report (prepared by the COO). 
Further, the proposed rule change would state that the document owner 
is responsible for updating the proposed Outsourcing Policy, that any 
exceptions to the document would be escalated and reported by the 
document holder, and that the document owner would report any material 
breaches or deviations to the President of ICEEU and will notify the 
Risk Oversight Department in order to determine the appropriate 
governance escalation and notification requirements. The Commission 
believes that documenting the roles and responsibilities for managing 
the proposed Outsourcing Policy in this way provides for governance 
arrangements that specify clear and direct lines of responsibility.
    For these reasons, the Commission believes that the proposed rule 
change is consistent with Rule 17Ad-22(e)(2)(v).\12\
---------------------------------------------------------------------------

    \12\ 17 CFR 240.17 Ad-22(e)(2)(v).
---------------------------------------------------------------------------

C. Consistency With Rule 17Ad-22(e)(3)(i) Under the Act

    Rule 17Ad-22(e)(3)(i) requires that ICEEU establish, implement, 
maintain, and enforce written policies and procedures reasonably 
designed to, as applicable, maintain a sound risk management framework 
for comprehensively managing legal, credit, liquidity, operational, 
general business, investment, custody, and other risks that arise in or 
are borne by ICEEU, which includes risk management policies, 
procedures, and systems designed to identify, measure, monitor, and 
manage the range of risks that arise in or are borne by ICEEU, that are 
subject to review on a specified periodic basis and approved by ICEEU's 
board of directors annually.\13\
---------------------------------------------------------------------------

    \13\ 17 CFR 240.17 Ad-22(e)(3)(i).
---------------------------------------------------------------------------

    Because the proposed Outsourcing Policy described above sets forth 
considerations and approaches to measuring, monitoring, and identifying 
the risks related to outsourcing arrangements and lays out governance 
of this process on an annual basis, the Commission believes that it 
strengthens ICEEU's management of a range of risks borne by it which is 
also subject to periodic and annual Board review. For example, the 
Commission believes that the proposed procedures related to identifying 
critical functions (defining a function as ``critical or important''), 
the regular assessment of service providers (assessment of service 
provider's business continuity plans and timely response to incidents), 
and mitigation of risk (through redundancies, notice periods and exit 
strategies) from service providers, all support and strengthen ICEEU's 
ability to identify, monitor, and measure the risks related to 
outsourcing arrangements.
    For these reasons, the Commission believes that the proposed rule 
change is consistent with Rule 17Ad-22(e)(3)(i).\14\
---------------------------------------------------------------------------

    \14\ 17 CFR 240.17Ad-22(e)(3)(i).
---------------------------------------------------------------------------

IV. Conclusion

    On the basis of the foregoing, the Commission finds that the 
proposed rule change is consistent with the requirements of the Act, 
and in particular, with the requirements of Section 17A(b)(3)(F) of the 
Act,\15\ and Rules 17Ad-22(e)(2)(v) and 17Ad-22(e)(3)(i).\16\
---------------------------------------------------------------------------

    \15\ 15 U.S.C. 78q-1(b)(3)(F).
    \16\ 17 CFR 240.17Ad-22(e)(2)(i) and (v) and 17 CFR 240.17Ad-
22(e)(3)(i).
---------------------------------------------------------------------------

    It is therefore ordered pursuant to Section 19(b)(2) of the Act 
\17\ that the proposed rule change (SR-ICEEU-2022-014), be, and hereby 
is, approved.\18\
---------------------------------------------------------------------------

    \17\ 15 U.S.C. 78s(b)(2).
    \18\ In approving the proposed rule change, the Commission 
considered the proposal's impact on efficiency, competition, and 
capital formation. 15 U.S.C. 78c(f).

    For the Commission, by the Division of Trading and Markets, 
pursuant to delegated authority.\19\
---------------------------------------------------------------------------

    \19\ 17 CFR 200.30-3(a)(12).
---------------------------------------------------------------------------

J. Matthew DeLesDernier,
Deputy Secretary.
[FR Doc. 2022-19679 Filed 9-12-22; 8:45 am]
BILLING CODE 8011-01-P

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.