FX Risk Governance Frameworks

An FX risk governance framework connects the board's risk tolerance to the limits, controls and escalation decisions used by trading, treasury and independent risk functions. Its purpose is not simply to constrain positions. It establishes who may take risk, how much risk the institution is prepared to accept, how that risk is measured, and what happens when exposure approaches or exceeds approved tolerance.

A workable framework therefore needs four connected elements: a board-approved risk appetite, measurable operating limits, independent monitoring, and a defined escalation path. When these elements operate in isolation, apparently sound desk-level controls can still leave the institution exposed to unmanaged enterprise risk.

FX losses rarely remain confined to one risk category. A market move can increase margin requirements, consume liquidity, weaken a counterparty and create operational pressure at the same time. Governance must therefore connect market, liquidity, credit and operational risk rather than treating them as separate reporting exercises.

The practical governance question is simple: who has authority to act when several risk channels move together? The answer should be defined before the event, not improvised during it.

First line: risk taking and primary controls

The first line consists of the business and operational functions that create or manage FX exposure. Depending on the institution, this may include the trading desk, treasury and operational teams. The first line owns day-to-day activity and the controls embedded in that activity, but it should not have unilateral authority to redefine the independent risk limits against which it is monitored.

Second line: independent risk oversight

Independent risk management owns the monitoring and challenge function. It should be capable of measuring utilisation, identifying approaching limits, validating exception requests and escalating breaches without requiring permission from the revenue-generating desk.

In an effective independent-risk model, the Chief Risk Officer sits at the centre of the second-line structure. The CRO proposes and maintains the risk-limit framework, oversees stress testing, manages escalation and communicates material risk matters to senior governance bodies.

Third line: independent assurance

Internal audit assesses whether first- and second-line controls are operating as designed. Its role is different from risk management: the second line operates the control framework; the third line independently tests the effectiveness of that framework.

A sound FX governance structure separates routine risk decisions from board-level risk appetite decisions.

An illustrative structure is:

This is a governance model, not a universal regulatory prescription. Actual committee names, delegated authorities and reporting frequencies vary by institution and jurisdiction.

Enterprise FX governance should make visible at least four interacting risk dimensions:

• Market risk: directional exposure, volatility, options sensitivities and loss metrics.
• Liquidity risk: funding needs, margin calls, market depth and liquidity buffers.
• Counterparty credit risk: current and potential exposure, collateral and concentration.
• Operational risk: confirmation, settlement, system availability and process failure.

The value of integration is not the taxonomy itself. It is the ability to identify amplification. For example, a sharp currency move may increase margin requirements; a funding squeeze may then force asset sales; weaker collateral or counterparty quality may amplify the loss; and operational stress can delay mitigation.

A governance framework should make the following decisions explicit:

1. Risk appetite: what level and type of FX risk the institution is willing to accept.
2. Limit ownership: who proposes, approves and changes limits.
3. Monitoring ownership: who independently measures utilisation.
4. Escalation authority: who can approve an exception, require reduction or invoke emergency authority.
5. Board visibility: which events require board or board-committee notification.
6. Stress governance: who approves scenarios, reviews results and changes the scenario set.
7. Evidence: what records demonstrate that each decision was made under the approved framework.

Useful evidence typically includes:

• approved risk-appetite documentation;
• limit schedules and delegated authorities;
• daily or intraday utilisation records;
• exception requests and approvals;
• stress-test results and scenario changes;
• committee minutes and escalation memoranda;
• model-validation records where quantitative models support limits;
• post-event reviews and remediation evidence.

The point is reconstructability: a reviewer should be able to establish what the institution knew, which limit or appetite statement applied, who had authority, what decision was made and what happened next.

Two areas require particularly careful integration rather than separate governance silos.

First, regulatory capital measures and internal risk-appetite measures serve different purposes and should not be treated as interchangeable simply because both are expressed in monetary terms.

Second, emerging risks such as climate-related transition or physical risk may affect FX exposures through growth, commodity, funding and capital-flow channels. The governance requirement is to determine whether such drivers are material to the institution's FX risk and, if so, how they enter the existing appetite, stress and escalation framework.