(a) Responsibilities of the board of directors. Your board of directors must adopt written policies for managing your non-program investment activities. Your board must also ensure that management complies with these policies and that appropriate internal controls are in place to prevent loss. At least annually, your board, or a designated committee of the board, must review the sufficiency of these investment policies. Any changes to the policies must be adopted by the board. You must report any changes to these policies to the OSMO within 10 business days of adoption.

(b) Investment policies—general requirements. Your investment policies must address the purposes and objectives of investments, risk tolerance, delegations of authority, internal controls, due diligence, and reporting requirements. Moreover, your investment policies must fully address the extent of pre-purchase analysis that management must perform for various types, classes, and structure of investments. Furthermore, the policies must include reporting requirements and approvals needed for exceptions to the board's policies. Investment policies must be sufficiently detailed, consistent with, and appropriate for the amounts, types, and risk characteristics of your investments. You must document in the Corporation's records any analyses used in formulating your policies or amendments to the policies.

(c) Investment policies—risk tolerance. Your investment policies must establish risk limits for the various types, classes, and sectors of eligible investments. These policies must include concentration limits to ensure prudent diversification of credit, market, and liquidity risks in the investment portfolio. Risk limits must be based on all relevant factors, including the Corporation's objectives, capital position, earnings, and quality and reliability of risk management systems. Your policies must identify the types and quantity of investments that you will hold to achieve your objectives and control credit, market, liquidity, and operational risks. Your policies must establish risk limits for the following types of risk:

(1) Credit risk. Your investment policies must establish:

(i) Credit quality standards, limits on counterparty risk, and risk diversification standards that limit concentrations in a single or related counterparty(ies), industry sectors, and asset classes or obligations with similar characteristics.

(ii) Criteria for selecting brokers, dealers, and investment bankers (collectively, securities firms). You must buy and sell eligible investments with more than one securities firm. As part of your review of your investment policies required under paragraph (a) of this section, your board of directors, or a designated committee of the board, must review the criteria for selecting securities firms. Any changes to the criteria must be approved by the board.

(iii) Collateral margin requirements on repurchase agreements. You must regularly mark the collateral to market and ensure appropriate controls are maintained over collateral held.

(2) Market risk. Your investment policies must set market risk limits for specific types of investments and for the investment portfolio.

(3) Liquidity risk. Your investment policies must describe the liquidity characteristics of eligible investments that you will hold to meet your liquidity needs and the Corporation's other objectives.

(4) Operational risk. Investment policies must address operational risks, including delegations of authority and internal controls in accordance with paragraphs (d) and (e) of this section.

(5) Concentration risk. Your investment policies must set risk diversification standards. Diversification parameters must be based on the carrying value of investments. You may not invest more than 10 percent of your Regulatory Capital in allowable investments issued by any single entity, issuer, or obligor. Only investments in obligations backed by U.S. Government agencies or GSEs may exceed the 10-percent limit.

(d) Delegation of authority. All delegations of authority to specified personnel or committees must state the extent of management's authority and responsibilities for investments.

(e) Internal controls. You must:

(1) Establish appropriate internal controls to detect and prevent loss, fraud, embezzlement, conflicts of interest, and unauthorized investments.

(2) Establish and maintain a separation of duties between personnel who supervise or execute investment transactions and personnel who supervise or engage in all other investment-related functions.

(3) Maintain records and management information systems that are appropriate for the level and complexity of your investment activities.

(4) Implement an effective internal audit program to review, at least annually, your investment management functions, controls, processes, and compliance with FCA regulations. The scope of the annual review must be appropriate for the size, risk, and complexity of the investment portfolio.

(f) Due diligence—(1) Pre-purchase analysis—(i) Objective, eligibility, and compliance with investment policies. Before you purchase an investment, you must conduct sufficient due diligence to determine whether the investment is eligible under § 652.20, is for an authorized purpose under § 652.15(a), and complies with your board-approved investment policies. You must document its eligibility, purpose, and investment policy compliance and your investment objective. Your investment policies must fully address the extent of pre-purchase analysis that management must perform for various types, classes, and structure of investments. Your board must approve your decision to hold an investment that does not comply with your written investment policy requirements.

(ii) Valuation. Prior to purchase, you must verify the value of the investment (unless it is a new issue) with a source that is independent of the broker, dealer, counterparty or other intermediary to the transaction.

(iii) Risk assessment. Your risk assessment must be documented and, at a minimum, include an evaluation of credit risk, market risk, and liquidity risk and the underlying collateral of the investment. You must conduct stress testing before you purchase any investment that is structured or that has uncertain cash flows, including all mortgage-backed securities or asset-backed securities. The stress testing must be commensurate with the risk and complexity of the investments and must comply with the requirements of paragraph (f)(4) of this section.

(2) Monthly fair value determination. At least monthly, you must determine the fair market value of each investment in your portfolio and the fair market value of your whole investment portfolio.

(3) Ongoing analysis of credit risk. You must establish and maintain processes to monitor and evaluate changes in the credit quality of each security and the whole investment portfolio on an ongoing basis.

(4) Quarterly stress testing. (i) You must stress test your entire investment portfolio, including stress tests of all investments individually and stress tests of the portfolio as a whole, at the end of each quarter. The stress tests must enable you to determine that your investment securities, both individually and on a portfolio-wide basis, do not expose your capital, earnings, or liquidity to risks that exceed the risk tolerance specified in your investment policies. If your portfolio risk exceeds your investment policy limits, you must develop a plan to reduce risk and comply with your investment policy limits.

(ii) Your stress tests must be comprehensive and appropriate for the risk profile of your investment portfolio and the Corporation. At a minimum, the stress tests must be able to measure the price sensitivity of investments over a range of possible interest rate/yield curve scenarios. The methodology that you use to analyze investment securities must be appropriate for the complexity, structure, and cash flows of the investments in your portfolio. You must rely to the maximum extent practicable on verifiable information to support all your assumptions, including prepayment and interest rate volatility assumptions, when you apply your stress tests. Your assumptions must be prudent and based on sound judgment, and you must document the basis for all assumptions that you use to evaluate the security and its underlying collateral. You must also document all subsequent changes in your assumptions.

(5) Presale value verification. Before you sell an investment, you must verify its value with a source that is independent of the broker, dealer, counterparty, or other intermediary to the transaction.

(g) Reports to the board of directors. At least quarterly, executive management must report on the following to the board of directors or a designated committee of the board:

(1) Plans and strategies for achieving the board's objectives for the investment portfolio;

(2) Whether the investment portfolio effectively achieves the board's objectives;

(3) The current composition, quality, and liquidity profile of the investment portfolio;

(4) The performance of each class of investments and the entire investment portfolio, including all gains and losses that you incurred during the quarter on individual securities that you sold before maturity and why they were liquidated;

(5) Potential risk exposure to changes in market interest rates as identified through quarterly stress testing and any other factors that may affect the value of your investment holdings;

(6) How investments affect your capital, earnings, and overall financial condition;

(7) Any deviations from the board's policies. These deviations must be formally approved by the board of directors.