Reading the PFMI: The Lines Financial Market Infrastructures Must Hold Behind the 24 Principles

In October 2026, the Committee on Payments and Market Infrastructures (CPMI), hosted by the Bank for International Settlements, and the International Organization of Securities Commissions (IOSCO) published a final report titled FMIs'management of general business risks and general business losses: further guidance to the PFMI^[1]. The PFMI in that title is the Principles for Financial Market Infrastructures (PFMI), published in 2012. The new report states at the outset that it does not add any standards beyond the PFMI. Its purpose is to help financial market infrastructures (FMIs) better observe Principle 15 of the PFMI.

To understand the new guidance, you have to start with the PFMI itself. Luminale has cited the PFMI several times before. Our article introducing financial infrastructure used its definitions and classification, and our articles on settlement finality, central counterparties and FX PvP drew on Principle 8, Principles 4 to 7 and 13, and Principle 12 respectively. Those were individual provisions. This article reads the PFMI differently, as a complete document. It looks at where the PFMI thinks an FMI may be exposed to risk, which kind of risk each of the 24 principles addresses, and how countries turn this international standard into domestic regulatory requirements.

1. Why Payment Systems, CCPs and CSDs Follow the Same Principles

Before 2012, there were three sets of international standards for FMIs: the Core Principles for Systemically Important Payment Systems (2001), the Recommendations for Securities Settlement Systems (2001), and the Recommendations for Central Counterparties (2004)^[2]. They covered payment systems, securities settlement systems and central counterparties (CCPs) respectively. They were issued at different times, and their approaches were not fully consistent.

After the 2008 financial crisis, the Group of Twenty (G20) pushed for standardised over-the-counter derivatives to be centrally cleared and for trade data to be reported to trade repositories (TRs). Risk became increasingly concentrated in CCPs, and TRs went from not existing to becoming a window through which authorities could see the market. Against this background, the Committee on Payment and Settlement Systems (CPSS, renamed CPMI in 2014) and the Technical Committee of IOSCO published the PFMI in April 2012. It merged the three older sets of standards into one and brought TRs into scope^[2].

The PFMI applies to five types of FMI: payment systems (PS), central securities depositories (CSDs), securities settlement systems (SSSs), CCPs and TRs. For their definitions and classification, see our article Financial Infrastructure: Payment, Clearing, and Settlement.

The PFMI applies by function. If one institution acts as both a central securities depository and a securities settlement system, it must observe the principles that apply to both functions.

The PFMI is aimed mainly at systemically important FMIs. Under paragraph 1.20, CSDs, SSSs, CCPs and TRs are presumed to be systemically important. Whether a payment system is systemically important is for national authorities to decide. They usually look at whether it could trigger or transmit systemic disruptions, for example whether it is the sole or principal large-value payment system in a country, or whether it settles funds for other systemically important FMIs. If an authority decides that a particular CSD, SSS, CCP or TR is not systemically important, it should publicly disclose the name of the institution and the reasons^[3].

In its drafting, the PFMI is a principles-based standard. Paragraph 1.19 says plainly that, with a few exceptions, the principles do not prescribe a specific tool or arrangement, and they allow different means of meeting the same principle. The principles are interrelated and should be applied as a whole^[3]. As a result, the text of the PFMI reads more like a set of objectives. The accompanying explanatory notes and the assessment methodology are what tell you what counts as meeting them.

The PFMI has no direct legal force of its own. CPMI and IOSCO are standard-setting bodies, not the regulators of FMIs in any country. The PFMI can bind an FMI only after the authority where that FMI is located writes it into domestic law, regulation or supervisory policy. That is the question Chapter 5 takes up.

2. How to Read the 24 Principles: A Map Arranged by Source of Risk

The main text of the PFMI groups the 24 principles into nine sections: general organisation; credit and liquidity risk management; settlement; CSDs and exchange-of-value settlement systems; default management; general business and operational risk management; access; efficiency; and transparency^[2]. In Luminale's analytical framework, these nine sections can be regrouped into four layers according to where the risk comes from, plus one group of principles on external relationships.

Principle 1 comes first because every risk control that follows depends on the law. Multilateral netting, settlement finality, the liquidation of collateral and the handling of defaults all have to remain effective when a participant becomes insolvent. Otherwise, the netting a clearing house has just completed could be overturned by an insolvency administrator on the grounds that it lacks a sound legal basis. Principle 1 requires an FMI to have a well-founded, clear, transparent and enforceable legal basis for each material aspect of its activities in all relevant jurisdictions^[2].

Principles 2 and 3 deal with decision-making and the overall view. Principle 2 requires an FMI's governance arrangements to promote the safety and efficiency of the FMI and to support the stability of the broader financial system and other relevant public interests. Principle 3 requires an FMI to manage legal, credit, liquidity, operational and other risks comprehensively. That includes the risks it bears from settlement banks, custodians and linked FMIs, as well as the risks it poses to others^[2].

Many institutions do not join an FMI directly. They connect indirectly through direct participants. Indirect participants may account for large volumes, yet their risk sits where the FMI cannot see it. Principle 19 requires an FMI to identify, monitor and manage the material risks arising from tiered participation arrangements^[2].

Not every one of the 24 principles applies to every type of FMI. The PFMI sets this out in an applicability table^[3]. The rows below are those where the differences are largest:

Principles 15 and 17 apply to all five types of FMI. A TR does not bear credit risk from participants and does not need margin, but it can still become unable to keep providing its services because of poor business performance.

3. A Few Hard Requirements: Cover 2, End of Value Date, Central Bank Money, Two Hours

Most of the PFMI is qualitative, but in a few places it sets measurable thresholds. These thresholds bring the principles down to the level of accounts and funds.

Credit and liquidity: Cover 1 and Cover 2. Principle 4 requires an FMI to fully cover its credit exposure to each participant with a high degree of confidence. A CCP must also hold additional financial resources sufficient to cover a wide range of stress scenarios under extreme but plausible market conditions. For a CCP that is involved in activities with a more complex risk profile or that is systemically important in multiple jurisdictions, these scenarios must at least include the default of the two participants and their affiliates that would potentially cause the largest aggregate credit exposure. This is what is usually called Cover 2. Other CCPs must cover at least the largest one, known as Cover 1^[2]. For a deferred net settlement (DNS) payment system or securities settlement system that offers no settlement guarantee but in which participants face credit exposures, the key considerations of Principle 4 also require it to cover at least the exposures created by its two largest participants^[3].

Principle 7 sets a similar requirement for liquidity. An FMI should hold sufficient liquid resources in all relevant currencies to complete settlement on the same day, under stress scenarios that include at least the default of the participant and its affiliates that would generate the largest liquidity obligation. For a CCP with a more complex risk profile or that is systemically important in multiple jurisdictions, the PFMI says it should consider preparing liquidity for a scenario in which two participants default^[3]. The wording on credit and on liquidity differs in strength, and the two are easy to confuse when cited.

Taking a CCP as an example, these resources are generally arranged in a default waterfall. The defaulting member's own margin and default fund contribution are used first, then the CCP's own capital contribution, and only after that the default fund contributions of other members. For the details of this structure, see What Does a CCP Solve? Counterparty Risk, Clearing and Atomic Settlement.

Settlement: end of the value date and central bank money. Principle 8 requires an FMI to provide clear and certain final settlement at the latest by the end of the value date, and intraday or in real time where necessary or preferable^[2]. We discussed this in Can a "Successful Payment" Be Reversed? Settlement Finality, so we will not go into it again here.

Principle 9 requires an FMI to conduct its money settlements in central bank money where practical and available. If central bank money is not used, the FMI should minimise and strictly control the credit and liquidity risk arising from the use of commercial bank money^[2]. The table below shows how the two arrangements differ at the account level. Suppose Bank A pays 100 to Bank B:

When settlement is in central bank money, the receiving bank gets a central bank liability, and the settlement asset itself carries no credit risk. When settlement is in commercial bank money, the receiving bank gets a deposit at the settlement bank. If the settlement bank runs into trouble, a settlement that has already been completed can turn into a claim on a failing bank.

This is also why our articles BIS Singleness of Money: Why Stablecoins May Differ and Who Can Hold an Account at the Central Bank? Account Hierarchy Explained repeatedly discuss settlement assets and central bank accounts together.

Operations: recovery within two hours, settlement completed the same day. The key considerations of Principle 17 require an FMI's business continuity plan to use a secondary site and to ensure that critical information technology systems can resume operations within two hours of a disruptive event. The plan should also enable the FMI to complete settlement by the end of the day of the disruption, even in extreme circumstances^[3]. Restoring systems within two hours is only half the job. Queued payments and settlement obligations falling due still have to be processed the same day. Otherwise, participants'positions and liquidity arrangements will be thrown into disorder.

The FMI's own business: at least six months of operating expenses. Principle 15 requires an FMI to hold liquid net assets funded by equity (LNAFE) equal to at least six months of current operating expenses. These assets are separate from the resources used to cover participant defaults^[3]. This requirement is not the same thing as a bank's capital adequacy ratio. It targets losses from the FMI's own business, and it requires assets that are funded by equity and can be turned into cash.

4. Principles for FMIs, Responsibilities for Authorities: The Two Tracks of the PFMI

The 24 principles are addressed to FMIs. Five further responsibilities are addressed to central banks, market regulators and other relevant authorities^[2]:

These five responsibilities answer a different question: who confirms whether an FMI has met the principles, and on what basis. Responsibility E matters especially for cross-border FMIs. A CCP may clear many currencies and serve members from many countries. It is hard for a single national authority to see all of its risks, so several authorities need to put cooperative arrangements in place.

In December 2012, CPSS and IOSCO published two companion documents: the Disclosure framework and the Assessment methodology^[4]. The first sets out how an FMI should explain publicly how it observes each principle. The second gives authorities and international organisations a common basis for assessment, including rating criteria for each principle.

Disclosure corresponds to specific requirements in the PFMI. Principle 23 requires an FMI to provide sufficient information to enable participants to have an accurate understanding of the risks, fees and other material costs they incur by participating in the FMI^[2]. A CCP member needs to know where it sits in the default waterfall and how much additional funding it might be called on to provide under stress, so that it can manage its own liquidity properly.

Since 2012, CPMI and IOSCO have issued several pieces of supplementary guidance. These cover the recovery of FMIs (published in 2014 and revised in 2017), cyber resilience (2016), CCP resilience (2017), the application of the PFMI to systemically important stablecoin arrangements (2022)^[5], and now the guidance on general business risk. These documents do not add standards beyond the PFMI. They are detailed guidance on implementing it.

5. From International Principles to National Rules: How Jurisdictions Implement, Disclose and Are Assessed

The PFMI has no direct legal force. Its hold on an FMI passes through three stages: countries write it into their domestic rules, FMIs make public disclosures under those rules, and international organisations check whether national rules and the actual practice of FMIs are consistent with it.

Rules: Writing the Principles into Domestic Regulation

Paragraph 1.30 of the PFMI asks relevant authorities to strive to incorporate the principles and responsibilities into their legal and regulatory frameworks by the end of 2012^[3]. In practice, countries generally divide FMIs among different authorities by type. The table below gives a rough picture of the arrangements in several major jurisdictions:

For the legal basis of the rules in the United States, the European Union and Australia, see the Federal Reserve's 2014 notice revising Regulation HH, the Official Journal of the European Union and the RBA's standards page respectively^[6]. In the United States, for example, when the Federal Reserve revised Regulation HH in 2014, it replaced two earlier sets of standards, one for payment systems and one for CSDs and CCPs, with a single set based on the PFMI. Designated institutions supervised by the SEC or the CFTC are subject to those agencies'own rules^[6].

In 2013, the General Office of the People's Bank of China (PBOC) and the General Office of the China Securities Regulatory Commission (CSRC) each issued a notice on implementing the PFMI (Yinbanfa [2013] No. 187 and Zhengjianbanfa [2013] No. 42). In January 2014, the two authorities jointly issued the Notice on Conducting Assessments of Financial Market Infrastructures. Using the PFMI as the standard and the CPSS-IOSCO Assessment methodology as the method, they assessed systems operated by 12 institutions, including the China Foreign Exchange Trade System, the China National Clearing Center of the PBOC, China Central Depository & Clearing, China UnionPay, Shanghai Clearing House, China Securities Depository and Clearing Corporation, and four futures exchanges. The institutions first carried out self-assessments, after which the two authorities organised external assessments by experts^[7]. The PBOC's China Payment System Development Report (2016) noted that the assessment found China's financial market infrastructures to be broadly in observance of the PFMI, and that the two authorities had fully accepted the PFMI and incorporated it into their regulatory frameworks^[8]. In 2025, the PBOC and the CSRC issued the Measures for the Supervision and Administration of Financial Infrastructure, effective from 1 October 2025. Article 7 states that the construction, operation and supervision of financial infrastructure should be aligned with international standards such as the PFMI. For more, see our article Financial Infrastructure: Payment, Clearing, and Settlement.

Disclosure: FMIs Explain Publicly How They Meet the Principles

Under paragraph 3.23.7 of the PFMI, an FMI should complete and publicly disclose its responses to the Disclosure framework on a regular basis. It should update them promptly after significant changes to the system or its environment, and review them in full at least every two years^[3]. CCPs also face a set of quantitative disclosure requirements. In 2015, CPMI and IOSCO published the Public quantitative disclosure standards for central counterparties, which require CCPs to disclose data such as margin, default funds, stress testing and liquid resources each quarter, using a common template^[9]. If you open a CCP's PFMI disclosure page, you will usually find two kinds of material: a long document that goes through the 24 principles one by one, and a set of quantitative tables updated every quarter.

Assessment: International Organisations Check Whether Countries Have Delivered

CPMI and IOSCO track the implementation of the PFMI through three levels of monitoring^[10]:

The Financial Sector Assessment Program (FSAP) run by the International Monetary Fund (IMF) and the World Bank also assesses how well important FMIs observe the PFMI. In 2018, the IMF published a technical note on China under the FSAP^[11].

Taken together, Level 1 measures whether the rules have been written in, Level 2 measures whether they have been written correctly, and only Level 3 looks at how FMIs actually perform. The Level 3 assessment on general business risk, published in November 2025, covered 34 FMIs. It found that some FMIs did not take general business risk into account when determining their LNAFE and had no clear plan for raising additional equity^[12]. The rules were written into national frameworks more than a decade ago, yet outcomes remain uneven. That is why CPMI and IOSCO produced a separate piece of guidance on Principle 15.

6. An FMI Is Also a Company That Can Lose Money

Most of the PFMI deals with risks that come from others: participant defaults, falling collateral values, the failure of a settlement bank, and risks from indirect participants passing through to the FMI. For these risks, the PFMI provides a full set of tools: margin, default funds, loss allocation rules and default procedures agreed in advance.

Principle 15 deals with a different kind of loss. According to the PFMI's explanatory notes, general business risk refers to the risks and potential losses that arise from an FMI's administration and operation as a business enterprise. It is unrelated to participant default and is not covered by the financial resources prepared under the credit and liquidity risk principles. Falling revenue or expenses that exceed revenue can result in losses that must be charged against capital. Poor execution of business strategy, negative cash flows, or unexpected and excessively large operating expenses can all lead to such losses. Operational events such as legal disputes, investment losses, fraud or theft can also land here as large one-off losses^[3].

The distinction shows that a CCP can get into financial difficulty even if its members never default, for example because a large systems project runs over budget, an investment loses money, or it faces a lawsuit. The margin that participants post cannot be used to fill that hole. The PFMI allows an FMI to reduce or transfer part of this risk through internal controls, insurance or third-party indemnification^[3]. The rest is borne mainly by its own equity capital.

This kind of risk has drawn more attention in recent years. Many FMIs are investing heavily in system upgrades, cross-border links and tokenisation pilots, with long project cycles and uncertain budgets. Some FMIs are listed or for-profit companies that face competition from peers, while others are operated by central banks and face different incentives. In 2022, CPMI and IOSCO also made clear that the PFMI can apply to systemically important stablecoin arrangements^[5]. The business risks of these new arrangements, like those of traditional FMIs, ultimately come back to the same questions: who bears the losses, and can the service continue?

The October 2026 final report refines Principle 15 in several respects^[1]. The most direct concerns the minimum amount of LNAFE. The original PFMI requires at least six months of operating expenses. The final report also requires an FMI to estimate the full cost of executing its recovery and orderly wind-down plan, including normal operating expenses, the additional expenses of recovery and wind-down, and any losses that need to be covered by LNAFE, and then to hold whichever of the two amounts is higher. The final report further requires that the liquid assets and the equity on the balance sheet each be no less than the required LNAFE amount.

Conclusion

Read from beginning to end, the PFMI keeps answering two questions: who bears the losses in the worst case, and can critical services continue? Efficiency, access and transparency all rest on those two questions already having answers.

For participant defaults, the PFMI and the guidance that followed it already give fairly mature answers. For an FMI's own business losses, the answer is still being worked out. As FMIs take on more technology investment and more cross-border links, their own financial resilience will matter as much as their ability to manage participant risk.

References

[1]: CPMI and IOSCO, FMIs'management of general business risks and general business losses: further guidance to the PFMI – final report, October 2026. ↩

[2]: CPSS and IOSCO, Principles for financial market infrastructures, April 2012, section "Overview of principles and responsibilities". ↩

[3]: CPSS and IOSCO, Principles for financial market infrastructures, April 2012, paragraphs 1.19, 1.20 and 1.30; Table 1; Principle 4, key consideration 3; explanatory note to Principle 7; Principle 15, key consideration 3, and paragraphs 3.15.1 and 3.15.3; Principle 17, key consideration 6; paragraph 3.23.7. ↩

[4]: CPSS and IOSCO, Principles for financial market infrastructures: Disclosure framework and Assessment methodology, December 2012. ↩

[5]: CPMI and IOSCO, Recovery of financial market infrastructures, published October 2014, revised July 2017; Guidance on cyber resilience for financial market infrastructures, June 2016; Resilience of central counterparties (CCPs): Further guidance on the PFMI, July 2017; Application of the Principles for Financial Market Infrastructures to stablecoin arrangements, July 2022. ↩

[6]: Federal Reserve, Financial Market Utilities, Final Rule, Federal Register, 5 November 2014; European Central Bank, Regulation (EU) No 795/2014 on oversight requirements for systemically important payment systems, July 2014; Reserve Bank of Australia, Financial Stability Standards. ↩

[7]: General Office of the People's Bank of China and General Office of the China Securities Regulatory Commission, Notice on Conducting Assessments of Financial Market Infrastructures (in Chinese), January 2014. ↩

[8]: Payment and Settlement Department of the People's Bank of China, China Payment System Development Report (2016) (in Chinese), China Financial Publishing House, May 2017, Part 1, "Completing the Assessment of Financial Market Infrastructures". ↩

[9]: CPMI and IOSCO, Public quantitative disclosure standards for central counterparties, February 2015. ↩

[10]: CPMI, Monitoring implementation of the PFMI, BIS website, accessed October 2026. ↩

[11]: IMF, The People's Republic of China: Financial Sector Assessment Program – Systemic Oversight of Financial Market Infrastructures – Technical Note, IMF Country Report No. 18/192, June 2018. ↩

[12]: CPMI and IOSCO, Implementation monitoring of the PFMI: Level 3 assessment on general business risks, November 2025. ↩

Originally published by Luminale Fintech Observer: https://luminale.cn/articles/reading-pfmi-principles-for-fmis-en