• INMA Chapter 4 INMA Chapter 4 Management of risk

    Guidance for Chapter 4
    Risk management should be directly overseen by an INMA firm’s governing body (see CTRL, rules 1.2.3, 1.2.4, 3.1.12 and 3.1.14).

     

    Amended by QFCRA RM/2021-1 (as from 1st July 2021)

    • INMA Part 4.1 INMA Part 4.1 Introduction — Chapter 4

      • INMA 4.1.1 Introduction

        (1) This Chapter sets out requirements in relation to an INMA firm's risk management strategy and risk management policy.

        Note 1 The requirements in this Chapter are additional to the general risk management requirements set out in CTRL.

        Note 2 CTRL, rule 7.1.7 (4), requires an INMA firm to establish and regularly review its risk management strategy, which must be appropriate to the nature, scale and complexity of the firm's business.

        Note 3 An INMA firm's risk management policy is part of, and supports, the firm's risk management strategy.
        (2) This Chapter also sets out the requirement for certain INMA firms to take out and maintain professional indemnity insurance.
        Derived from QFCRA RM/2014-4 (as from 1st January 2015)
        Amended by QFCRA RM/2021-1 (as from 1st July 2021).

    • INMA Part 4.2 INMA Part 4.2 Risk management

      • INMA 4.2.1 INMA 4.2.1 Risks to be addressed

        (1) In its risk management strategy an INMA firm must identify all the risks to which the firm is exposed.
        (2) An INMA firm's risk management policy must address at least operational risk, reputational risk and liquidity risk. Each of those kinds of risk is described in Schedule 1.
        (3) If an INMA firm is exposed (because of the nature, scale and complexity of its business, or for any other reason) to any of the other kinds of risk described in Schedule 1, or a risk of any other kind, that risk must also be addressed in the firm's risk management policy.
        Derived from QFCRA RM/2014-4 (as from 1st January 2015).

        • INMA 4.2.1 Guidance

          1 Schedule 1 gives guidance about what, in the Regulatory Authority's view, should be included in an INMA firm's risk management policy.
          2 The list in Schedule 1 is not exhaustive. With the exception of operational, reputational and liquidity risk, the Regulatory Authority accepts that not all firms will be exposed to all of the risks there described.
          Derived from QFCRA RM/2014-4 (as from 1st January 2015).

      • INMA 4.2.2 Risk management policy

        An INMA firm's risk management policy must reflect the nature, scale and complexity of the firm's operations and must include:

        (a) the kinds of risk mentioned in rule 4.2.1(2) and other kinds of risk that it has identified itself as exposed to;
        (b) the firm's strategies, policies, procedures and processes to deal with those risks;
        (c) the firm's assessment of whether its financial resources are adequate to address those risks;
        (d) procedures for reporting on compliance with the policy to the firm's governing body and senior management, and for ensuring that the policy is embedded within the firm's decision-making;
        (e) triggers and scope for reviewing the policy in the light of changed conditions and factors affecting the firm's risk appetite, risk profile, business activities and financial resources; and
        (f) procedures for reporting the results of the reviews to the firm's governing body and senior management.
        Derived from QFCRA RM/2014-4 (as from 1st January 2015).

      • INMA 4.2.3 Staff understanding of risks

        An IMNA firm must ensure that its staff clearly understand:

        (a) the firm's risk management strategy and policy; and
        (b) the kinds of risk mentioned in rule 4.2.1(2) and the other kinds of risk that the firm is exposed to;
        so that the staff can identify, assess, manage and mitigate those risks effectively.

        Derived from QFCRA RM/2014-4 (as from 1st January 2015).

      • INMA 4.2.4 Governing body's obligation

        An INMA firm's governing body must evaluate the suitability and effectiveness of the information and reports that it and the firm's senior management receive under the firm's risk management policy. The test of suitability and effectiveness is whether the information and reports are suitable for effectively overseeing and implementing the firm's risk management strategy and policy.

        so that the staff can identify, assess, manage and mitigate those risks effectively.

        Derived from QFCRA RM/2014-4 (as from 1st January 2015).

    • INMA Part 4.3 INMA Part 4.3 Professional indemnity insurance

      • INMA 4.3.1 Firms must take out and maintain professional indemnity insurance

        (1) An INMA firm must take out and maintain professional indemnity insurance in accordance with this Part.
        (2) An INMA firm is taken to comply with subrule (1) if its activities are covered by a group-wide professional indemnity insurance policy that covers the firm and its activities and otherwise complies with this Part.

        Guidance

        If the group-wide policy does not comply with this Part, the firm must obtain professional indemnity insurance that does so.
        (3) However, an INMA firm need not take out or maintain such insurance if another firm provides a guarantee for it in accordance with rule 4.3.4.
        Derived from QFCRA RM/2014-4 (as from 1st January 2015).

      • INMA 4.3.2 Minimum requirements for professional indemnity insurance policies

        (1) The amount of an INMA firm’s professional indemnity cover must be determined by the firm’s governing body, and must be adequate, having regard to the nature, scale and complexity of the firm’s business.
        (2) An INMA firm’s professional indemnity insurance policy must provide:
        (a) cover for claims for which the firm may be liable as a result of its conduct or the conduct of its employees, the members of its governing body and its agents;
        (b) appropriate cover for legal defence costs;
        (c) continuous cover for claims arising from work carried out from when the firm was authorised to conduct a regulated activity in or from the QFC; and
        (d) cover for awards made against the firm under the customer dispute resolution scheme.

        Note Customer dispute resolution scheme is defined in the glossary.
        (3) An INMA firm must not take out professional indemnity insurance that provides for the payment of fines imposed by the Regulatory Authority or the QFC Authority.
        (4) If the Regulatory Authority considers that, because of the nature, scale and complexity of a particular INMA firm’s business, the firm should increase the level of its professional indemnity insurance cover, the authority may direct the firm to take out professional indemnity insurance that provides a specified minimum level of cover.
        Derived from QFCRA RM/2014-4 (as from 1st January 2015).

      • INMA 4.3.3 Suitability of professional indemnity insurers

        (1) Before an INMA firm takes out or renews a professional indemnity insurance policy with an insurer, the firm must be satisfied, on reasonable grounds after making an appropriate assessment, that the insurer is suitable to provide the policy to the firm.
        (2) The firm must have systems and controls to ensure that the assessment remains correct.
        (3) In assessing whether an insurer is suitable, the firm must have regard to all the relevant circumstances, including the following:
        (a) the insurer’s credit rating, capital and financial resources;
        (b) its regulatory status and history;
        (c) its expertise and market reputation;
        (d) the regulatory and legal regimes of the jurisdiction in which it is located.

        Note Jurisdiction is defined in the glossary.
        (4) Without limiting subrule (1), an insurer that is not authorised in the QFC to conduct insurance business, and does not have an equivalent authorisation in Qatar or a zone 1 country, is suitable to provide a professional indemnity insurance policy to the firm only if all of the requirements in subrule (6) are met.
        (5) The zone 1 countries are Australia, Austria, Belgium, Canada, Denmark, Finland, France, Germany, Greece, Hong Kong, Iceland, Ireland, Italy, Japan, Luxembourg, Netherlands, Norway, Portugal, Singapore, Spain, Sweden, Switzerland, the United Kingdom and the United States of America.
        (6) The requirements are:
        (a) that the insurer is rated at least BBB by Standard & Poor’s or the equivalent by another rating agency;
        (b) that the firm has given notice to the Regulatory Authority about its intention to take out or renew the insurance policy with the insurer; and
        (c) that either:
        (i) the firm has received written notice from the authority stating that it does not object to the firm’s taking out or renewing a policy with the insurer; or
        (ii) 28 business days has elapsed since the firm gave the notification to the authority and the authority has not notified the firm in writing that the authority objects to the firm’s taking out or renewing a policy with the insurer.
        (7) If, at any time after the firm has taken out or renewed a professional indemnity insurance policy with an insurer, the authority considers that the insurer is, or is likely to become, unsuitable to provide the policy, the authority may, by written notice to the firm, require the firm to cancel the policy and take out equivalent professional indemnity insurance with another insurer in accordance with this rule.
        Derived from QFCRA RM/2014-4 (as from 1st January 2015).

      • INMA 4.3.4 What firms may provide guarantees

        (1) A firm (the guarantor firm) may provide a guarantee to an INMA firm for this Part only if the guarantor firm has net tangible assets of more than QR35 million.
        (2) If the INMA firm is a member of a corporate group in which there is a firm with net tangible assets of more than QR35 million, a firm that is not a member of the group must not provide a guarantee to the INMA firm.

        Note Corporate group is defined in the glossary.
        (3) A guarantee provided for this Part:
        (a) must be in writing; and
        (b) must make provision at least equal to the provision required by rule 4.3.2 (Minimum requirements for professional indemnity insurance policies).
        (4) The INMA firm must give a copy of the guarantee to the Regulatory Authority.
        Derived from QFCRA RM/2014-4 (as from 1st January 2015).

      • INMA 4.3.5 INMA 4.3.5 Notices to the Regulatory Authority

        An INMA firm:

        (a) every year, must give the Regulatory Authority a copy of the firm’s professional indemnity insurance cover for the following 12-month period;
        (b) must notify the authority of any significant changes to the cover, including the level of cover and the renewal or termination of the cover; and
        (c) must notify the authority of any significant claim against the firm of professional misconduct or negligence, or by the firm under its professional indemnity insurance cover.
        Derived from QFCRA RM/2014-4 (as from 1st January 2015).

        • INMA 4.3.5 Guidance

          Whether a claim is significant depends on the nature, scale and complexity of the firm. The Regulatory Authority expects firms to treat a series of single claims that are significant in the aggregate as significant.

          Derived from QFCRA RM/2014-4 (as from 1st January 2015).