A derivatives risk management program is the written set of policies and procedures that SEC Rule 18f-4 requires of every registered fund and BDC whose derivatives exposure is above 10% of net assets: it identifies the fund's derivatives risks, sets measurable guidelines, stress tests and backtests every week, escalates, and is reviewed every year. The rule puts one person in charge of it. The derivatives risk manager is an officer of the fund's adviser, approved by the board, who may not be one of the fund's portfolio managers and must have relevant experience managing derivatives risk. The seat has no job code of its own and may sit with a chief risk officer who has other duties, yet it carries decisions that nobody else in the firm may take, from the choice of reference portfolio to the written report a board receives when a fund stays over its VaR limit. Botminds' Derivatives Risk Management Program is built for that officer: agents run and check the daily work, an analyst prepares each decision, and the derivatives risk manager signs it.
The SEC explained the role in its adopting release of December 2020, and the rule itself is 17 CFR 270.18f-4. The people and firm shown on screens are fictional sample data.
Five seats around a derivatives risk management program, before and after agents take the routine work
Today
Reads 45 ratios from a workbook each morning and is emailed about funds near their limit; writes the quarterly board report from the workbook and the inbox.
With agents
Starts with the one fund over its limit, the funds near it and the decisions due, each prepared by an analyst with its evidence one click away.
Still theirs: every approval: reference portfolios, model changes, remediation plans, board reports, filings to be made
Today
Copies engine output into the limit workbook, chases missing prices, counts breach days in a calendar and explains backtest exceptions by hand.
With agents
Checks the agents’ explanations against their cited sources and prepares the plan, review or report for the derivatives risk manager.
Still theirs: the judgement that an explanation is right before it reaches the derivatives risk manager
Today
Hears about a breach by email, sometimes days in, and argues about the number.
With agents
Is told on day one, sees the ways back under the limit priced by the risk engine, and proposes the trade.
Still theirs: the choice of trade; never the test, the limit or the approval
Today
Builds Form N-RN from figures the risk team sends, under a one-business-day deadline.
With agents
Receives a pre-filled, verified Form N-RN approved by the derivatives risk manager, held until it is due.
Still theirs: the submission to the SEC
Today
Reads a quarterly summary that says the funds were within limits.
With agents
Reads a report in which every figure is cited to the run that produced it, and can ask questions of it.
Still theirs: oversight, and the approval of who sits in the derivatives risk manager’s seat
What is a derivatives risk management program?
It is a written program "reasonably designed to manage the fund's derivatives risks and to reasonably segregate the functions associated with the program from the portfolio management of the fund." The rule names the risks it has in mind, "leverage, market, counterparty, liquidity, operational, and legal risks", plus any other the derivatives risk manager deems material, and lists six elements every program must contain: risk identification and assessment, risk guidelines with measurable thresholds, stress tests at least weekly, backtests at least weekly, internal reporting and escalation, and a review at least once a year.
Alongside the program sits the limit. A full-program fund must pass a VaR test every business day: its VaR at most 200% of a designated reference portfolio's VaR or, where no reference fits, at most 20% of net assets. The program is how the fund stays inside the limit; the limit is how the SEC knows whether it did. The rule in full is set out in Rule 18f-4 in plain words.
The SEC expected about 2,766 funds, "about 21% of funds", to need a program, and estimated what it would cost each: $150,000 to $500,000 to set up and $97,500 to $375,000 a year to run, the lower end being more likely for funds in a complex. Its list of set-up costs includes "recruiting and hiring a derivatives risks manager", and its ongoing costs include "the derivatives risk manager's base salary and compensation", where no existing officer can fill the seat.
Who can be a derivatives risk manager?
An officer, or a group of officers, of the fund's investment adviser, who meets two conditions. The derivatives risk manager "May not be a portfolio manager of the fund, or if multiple officers serve as derivatives risk manager, may not have a majority composed of portfolio managers of the fund", and "Must have relevant experience regarding the management of derivatives risk." The fund's board, with a majority of its independent directors, must approve the designation.
The SEC chose not to define the experience. It said the requirement is meant to let the officer's experience be "relevant in light of the derivatives risks unique to the fund", and that "We do not believe it would be practical to detail in our rules the specific experience a derivatives risk manager should hold." A rates fund's derivatives risk manager needs to understand rate futures and swaps; an options-income ETF's needs to understand gamma.
The seat can be shared and can sit outside the main adviser. A group may serve, and the SEC noted it "could include officers of both the fund's primary adviser and sub-adviser(s)". The adviser may nominate candidates, and the release expects boards "generally would request that the adviser carry out due diligence on appropriate candidates". The SEC also acknowledged that smaller firms may find the seat harder to fill and "may choose to hire a new officer or promote a current employee".
The work has no public labour statistics of its own. The Department of Labor's O*NET classification has no code for a derivatives risk manager; the nearest, Financial Risk Specialists (13-2054), is about analysing and measuring an organization's exposure to credit and market risk (O*NET OnLine), which covers the analysis but not the regulatory office.
Can a portfolio manager be the derivatives risk manager?
Not for a fund the person manages. The rule bars a portfolio manager of the fund from the seat, and a committee from having a majority of the fund's portfolio managers. It does not bar that person from serving as derivatives risk manager for other funds, which the release says expressly.
"Because a fund may compensate its portfolio management personnel in part based on the returns of the fund, the incentives of portfolio managers may not always be consistent with the restrictions that a derivatives risk management program would impose."
SEC, adopting release for Rule 18f-4, December 2020
Separation is not silence. The SEC wrote that segregation "is not meant to indicate that the derivatives risk manager and portfolio management must be subject to a communications 'firewall'", and that separate reporting lines, oversight arrangements or separate monitoring systems and staff could achieve it. The program requires the two to talk: portfolio managers must be told about exceedances and stress results, and they are usually the ones who make the trades that bring a fund back.
Can the chief risk officer be the derivatives risk manager?
Yes; nothing in the rule prevents it, and the SEC order discussed below involved a CRO who held both roles. The combination concentrates two kinds of duty in one person: the firm-wide risk role, which reports to management, and the fund-level regulatory role, which reports to the fund's board and, through the fund, to the SEC. The first is about managing risk; the second is also about telling the board on time.
The SEC's order of July 27, 2026 against Simplify Asset Management shows how the two can come apart. The firm's chief risk officer was also the ETF's derivatives risk manager. He warned the portfolio manager on April 26, 2024 that VaR stood at about 253% of the reference portfolio's and pressed for reductions every day that week, yet the board learned of the two breaches only on August 8, 2024 (Release IC-36269, settled, findings neither admitted nor denied). The risk was managed; the regulatory reporting was not. Form N-RN instructions, read through that breach, follows the case day by day.
Six decisions only the derivatives risk manager makes
Most of the program's work can be delegated; a handful of its decisions cannot. The rule assigns them to the derivatives risk manager by name, and each leaves a document behind.
Decisions Rule 18f-4 reserves to the derivatives risk manager
- Which reference portfolio, or none
Approving the designated index or securities portfolio, any change to it, or determining that none is appropriate and the absolute test applies.
- What counts as normal
The risk guidelines: thresholds the fund "does not normally expect to exceed", and what happens when it does.
- When to escalate
Telling portfolio management "in a timely manner" of material risks, and the board "as appropriate".
- Whether the model still works
The annual review of the VaR model, its backtesting and the reference portfolio, and the basis for any material change.
- How and by when the fund comes back
The written report to the board once a fund is out of compliance for five business days, and the analysis within thirty calendar days.
- That the program is reasonably designed
The annual written representation to the board, made on "reasonable belief after due inquiry", with its basis.
The first decision shapes every daily test. A reference portfolio that fits loosely makes the 200% limit loose or tight for reasons unrelated to leverage, which is why its approval and any change go to the board with a stated basis; what relative VaR measures explains why the denominator matters so much.
What does the derivatives risk manager report to the board, and when?
Four kinds of written report, on four clocks. Each has a trigger the rule sets and a content the rule names, and each must be kept for five years.
The derivatives risk manager's reports to the board under Rule 18f-4
| Report | When | What it must contain |
|---|---|---|
| Implementation and annual report | On or before the program starts, then at least annually | A representation that the program is reasonably designed, its basis, information to evaluate its adequacy and effectiveness, and the basis for the reference portfolio or for using the absolute test |
| Regular report | At a frequency the board sets | The derivatives risk manager’s analysis of guideline exceedances, and the results of stress testing and backtesting since the last report |
| Out-of-compliance report | When the fund is not back within its VaR limit after five business days | How and by when, in business days, the fund will come back into compliance |
| Thirty-day report | Within thirty calendar days of the exceedance | How the fund came back, the analysis of why it stayed out, and the program updates; or an update if it is still out |
The SEC left the regular report's frequency to the board because "it is important that the board determines for itself how frequently it will receive these reports", and observed that many advisers already reported on derivatives "often in connection with quarterly board meetings". It also chose not to require a report on every backtest exception, which a correct model produces about 2.5 times a year at 99%.
Where the derivatives risk manager's quarter goes
Most of the seat's time goes to work that is not judgement. The estimate below breaks a quarter of program work for a complex with about 45 full-program funds into six tasks; by hand, the largest are writing the board report and copying and checking engine ratios. Neither requires the derivatives risk manager's authority, and both are where errors enter: a ratio miscopied, a figure in the report that no longer matches the engine.
A quarter of program work: by hand, and with Derivatives Risk Management Program
By hand · about 22 business days a quarter
- Copying and checking engine ratios · 27%
- Chasing inputs, re-testing references · 18%
- Counting and explaining backtest exceptions · 14%
- Cure days and escalations · 9%
- Writing the board report · 32%
With the solution · about 3¼ business days
- Copying and checking engine ratios · 15%
- Chasing inputs, re-testing references · 23%
- Counting and explaining backtest exceptions · 15%
- Cure days and escalations · 16%
- Reviewing the drafted board report · 31%
The judgement that is left is concentrated. On the sample firm's busiest morning, the derivatives risk manager's screen showed one fund over its limit on day three, three near their limits, and five decisions waiting, each prepared by a named analyst with a deadline.
The derivatives risk manager's morning in Derivatives Risk Management Program: four numbers, five prepared decisions
The decision itself is a signature with a reason. In the sample, the derivatives risk manager asked whether the reference portfolio could change instead of the positions, and the Reference agent refused because the blend still fit; he asked what cutting 1,450 euro rate futures would do, and the Test agent had the risk engine re-price the fund at 191%; then he signed the analyst's remediation plan with reason code ESC-02.
Ask, decide, sign: the remediation plan approved with a reason code
What examiners have found in derivatives risk management programs
The programs are being examined, and some are falling short on paper. In November 2024 the SEC's Division of Examinations reported deficiencies in funds' policies and procedures "on a variety of topics, including compliance with custody requirements, fee billing, derivatives and liquidity risk management programs, valuation of portfolio assets", where policies were missing, not reasonably designed or not effectively implemented (SEC risk alert).
The examiners are still looking. The Division's priorities for fiscal 2027, published October 23, 2026, name "funds with leverage vulnerabilities, such as BDCs and inverse and leveraged ETFs" among the areas of focus for registered funds (SEC examination priorities). For the derivatives risk manager, the practical question an examiner asks is simple: show me the decision, who made it, on what evidence, and when the board heard. A program that keeps those four things together for every decision answers it; one that keeps them in four systems spends a week reconstructing them.
That is the design point of Derivatives Risk Management Program: the agents test, verify, explain, count and draft; the analyst prepares; the derivatives risk manager decides; and every step lands on a sealed audit trail with its evidence.
Questions people ask
Who approves the derivatives risk manager?
The fund's board of directors, with a majority of the independent directors voting for it. The adviser may nominate and vet candidates, and the SEC expected boards to ask it to, but the approval is the board's.
Can one person be the derivatives risk manager for many funds?
Yes. Nothing limits the number of funds one derivatives risk manager oversees, and a portfolio manager may serve as derivatives risk manager for funds he or she does not manage. At a complex, one officer or one committee commonly covers every full-program fund.
Can the derivatives risk manager role be a committee?
Yes. The rule defines the derivatives risk manager as "an officer or officers" of the adviser, so a group may serve, provided portfolio managers of the fund are not a majority. The SEC noted the group could include officers of a sub-adviser.
Does a limited derivatives user need a derivatives risk manager?
No. A fund whose derivatives exposure stays at or under 10% of net assets needs only written policies and procedures to manage its derivatives risk, and its adviser decides which risks are material. If it stays above 10% for five business days, the adviser reports to the board and may have to adopt the full program.
What experience must a derivatives risk manager have?
"Relevant experience regarding the management of derivatives risk", which the SEC deliberately left undefined so that it can match the derivatives a fund actually uses. The board's approval is where that judgement is made, and the materials it considered must be kept for five years.