# RISK MANAGEMENT POLICY
Date: 19 July 2031
Parties: Larchmere Digital Markets Limited and its Board
## 1. Purpose and parties
This policy applies to Larchmere Digital Markets Limited, its employees, contractors and material suppliers. The Board owns the framework; it is designed for a fictional FCA-authorised firm and complements, rather than replaces, applicable FCA Handbook SYSC, financial-crime and operational-resilience obligations.
## 2. Facts, scope and terms
Larchmere has low appetite for operational, liquidity and cyber risk, no appetite for deliberate legal or regulatory breach, and measured appetite for product and strategic risk. Appetite is not a promise that incidents will never occur; tolerances and key risk indicators are set in the annual appetite statement.
## 3. Process and responsibilities
Each business unit identifies inherent risk, existing controls and residual risk in its risk register. Likelihood and impact are scored from 1 to 5; red residual scores of 15 or more go to the Chief Risk Officer within 48 hours. Every material risk has a named owner and a due date for control action.
## 4. Evidence, records and safeguards
The first line owns risks and tests controls; Risk and Compliance provide second-line challenge; Internal Audit provides independent third-line assurance. The Board Risk Committee reviews the top-ten register monthly and the Board reviews appetite, stress results and emerging risks quarterly.
## 5. Review, escalation and outcome
Incidents are logged with facts, customer impact, root cause and remediation. The CRO reports material events to the Board and considers regulatory notification without waiting for a perfect investigation. Supplier risks, data breaches, conflicts and whistleblowing concerns have dedicated escalation routes.
## 6. Reservations and practical protections
Records are access-controlled and retained under the records schedule. Staff receive induction and annual training, and retaliation for good-faith reporting is prohibited. The policy is reviewed annually or after a material incident; an owner may temporarily accept residual risk only within delegated authority.
## 7. England and Wales law and completion
The Board approves this policy on 19 July 2031 under England and Wales law. It is an internal governance document, not a guarantee of outcomes or a substitute for a risk assessment, statutory notification or professional advice.