Collateral Management

Learning outcomes

Collateral is the quiet machinery that lets two parties who do not fully trust each other trade for years. Every derivative, every repo, every securities loan, every cleared position rests on a pile of assets pledged to make a promise credible. When that machinery works, nobody notices. When it fails, it fails the way Lehman did: not because anyone miscalculated a price, but because the collateral that was supposed to be there, in the right place, in the right name, was not. Get collateral management right and counterparty risk stops being an act of faith and becomes a measured, margined, daily-settled number. Get it wrong and you are one disputed mark away from an uncollateralized loss.

After studying this page, you can:

• Explain why collateral exists, what exposure it covers, and why a credible promise needs assets behind it rather than trust.
• Decide whether an asset is eligible to post, apply a haircut to it, and say why the haircut and the eligibility schedule are risk controls rather than paperwork.
• Distinguish variation margin from initial margin, compute each on a worked example, and explain why the uncleared margin rules forced both onto the bilateral market.
• Read the structure of an ISDA Master Agreement and a Credit Support Annex, and say what the CSA actually governs: thresholds, minimum transfer amounts, eligible collateral, and the timing of calls.
• Tell title transfer apart from a security interest, and explain how that legal choice changes who owns the collateral, who can reuse it, and what happens in a default.
• Compare bilateral and tri-party collateral arrangements and say what a tri-party agent does that a bilateral relationship cannot.
• Trace a chain of rehypothecated collateral and name the systemic risk it creates.
• Design the core of a collateral management engine: eligibility checks, margin calls, substitutions, disputes, and the settlement of collateral movements.
• Name the ways collateral management fails in production and the controls that catch each one before it becomes a loss.

Before we dive in

You do not need a derivatives background to start, but you do need a few words pinned down, because the field reuses ordinary words in precise ways.

A derivative is a contract whose value derives from something else: an interest rate, an exchange rate, the price of a bond. An interest rate swap, the workhorse example we will return to, is a contract where one party pays a fixed rate and receives a floating rate on a notional amount, and the other party takes the opposite side. As rates move, the contract becomes worth money to one party and a loss to the other, even though no principal ever changes hands.

Exposure is the amount one party would lose if the other defaulted right now. For a swap, it is the current value of the contract to the in-the-money party: what they are owed and would have to chase if their counterparty vanished. Counterparty credit risk is the risk that this happens, that the party who owes you walks away before paying.

Collateral is an asset one party gives the other to cover that exposure. Margin is the same idea seen from the risk side: the amount of collateral required. A margin call is a demand to post more collateral when exposure grows. To post collateral is to deliver it; to return it is to give it back when exposure shrinks.

A CCP, or central counterparty, is a clearing house that steps into the middle of a trade and becomes the buyer to every seller and the seller to every buyer, so each participant faces the CCP rather than each other. OTC, over the counter, means a trade negotiated directly between two parties without a CCP in the middle. Bilateral trades are uncleared OTC trades where the two parties manage collateral between themselves.

Throughout, amounts are shown in dollars for readability. Hold one picture as we go: two parties, a contract that swings in value between them, and a pile of pledged assets that keeps the swing from ever turning into an uncovered loss.

Mental Model

The wrong model, and it is a comfortable one, is that collateral is a deposit you hand over and forget, like a security deposit on an apartment: a lump sum that sits in escrow until the lease ends. In that picture collateral is static, it is yours in name only while it is held, and the amount is fixed at the start.

Almost none of that is true for derivatives collateral, and the gap is where people get hurt. Collateral is not static: it is recomputed and exchanged every single day, because the exposure it covers moves every day as prices move. It is often not held in your name: under the most common legal structure in the swaps market, you transfer outright ownership of it to your counterparty, so it is theirs, and you have only a contractual claim to get equivalent assets back. And the amount is anything but fixed: it tracks a live mark-to-market that can call for tens of millions more by tomorrow morning.

Here is the model to hold instead. Picture a seesaw between two parties, with the contract’s value as the tilt. Every day the seesaw is re-leveled: whichever side is down (out of the money) shovels collateral across to the side that is up, exactly enough to bring the plank back to flat. That daily re-leveling is variation margin, and it neutralizes the change in exposure as it happens, so a loss never accumulates unmargined. On top of that, both sides keep a separate buffer set aside against the gap that could open up in the days it takes to close out a defaulter, the move that happens after the last seesaw was leveled. That buffer is initial margin, and unlike variation margin it is held by a third party, untouchable, so a defaulting party cannot grab back the cushion meant to absorb their own default. Two flows, two purposes: one that chases today’s move, one that guards tomorrow’s. Every rule below falls out of keeping those two straight.

Breaking it down

The core teaching runs in twelve steps. The first ten build the institutional and legal machinery the way a collateral operations team and a derivatives lawyer understand it. The last two rebuild it the way an engineer must, because the mechanics are old but the systems that run them at scale, and the ways they break, are not.

1. Why collateral exists at all

Start with the problem collateral solves, because every later complication is an answer to it. Two banks enter a ten-year interest rate swap on a notional of one hundred million dollars. No money changes hands at the start; the swap is worth zero to both. But rates move, and a year later the swap is worth five million dollars to Bank A and minus five million to Bank B. Bank A is owed five million by Bank B, spread over the remaining life of the contract. If Bank B fails tomorrow, Bank A loses that five million, an unsecured creditor in a bankruptcy that may pay cents on the dollar years later.

The first instinct is to price that risk in: charge a credit spread, set a limit on how much business you do with a shaky counterparty. That helps, but it does not cover the exposure; it only compensates you for bearing it, and only if your pricing was right. Collateral does something better. It converts an unsecured promise into a secured one. If Bank B posts five million in cash or bonds against the swap’s value, then when the swap moves in Bank A’s favor, Bank A already holds the assets that cover the move. Bank B’s default no longer costs Bank A the five million, because Bank A can keep the collateral and net it against what it is owed.

The deep idea is that collateral transforms counterparty credit risk into something far more manageable: the risk that the collateral itself is bad, mispriced, or hard to seize. That residual is real, and the rest of this page is largely about controlling it, but it is a much smaller and more measurable risk than betting your recovery on a bankruptcy court. Collateral does not make risk vanish. It moves the risk from “will this counterparty pay me back” to “is this asset worth what I think and can I get at it,” and the second question is one a risk team can actually manage day to day.

flowchart LR
  T["Swap moves<br/>in A's favor"] --> E["A has exposure<br/>to B of $5M"]
  E --> C{"Is the exposure<br/>collateralized?"}
  C -->|"No"| U["B defaults: A is an<br/>unsecured creditor,<br/>recovers cents on the dollar"]
  C -->|"Yes"| S["B posted $5M: A keeps<br/>collateral, nets the loss,<br/>recovery near full"]

2. Eligibility and the haircut

If collateral is going to stand in for cash when a counterparty fails, then the quality of the collateral matters as much as the quantity. This is where two controls enter: the eligibility schedule and the haircut.

The eligibility schedule is the agreed list of what you will accept as collateral. Cash in major currencies is the gold standard: it is worth its face value, settles instantly, and needs no liquidation. Government bonds of strong sovereigns come next. Then high-grade corporate bonds, then sometimes equities in major indices, each less desirable than the last. The schedule is not arbitrary taste; it encodes how confident you are that the asset will still be worth what you think, and be sellable, on the day you need to seize it. You exclude an asset from the schedule when its value is too uncertain, its market too thin, or its correlation with the counterparty too dangerous. That last point is wrong-way risk: never accept a bank’s own shares as collateral for a trade with that bank, because the shares crater at the exact moment the bank fails and you need the collateral, so the cover evaporates precisely when you need it.

The haircut is the discount applied to collateral’s market value when counting it toward an obligation. A bond with a market value of one hundred dollars and a two percent haircut counts as ninety-eight dollars of collateral. The haircut absorbs two risks at once. First, market risk: between the moment a counterparty defaults and the moment you have liquidated the collateral, its price can fall, so you hold extra to cover that fall. Second, liquidity risk: a large or illiquid position may have to be sold below the screen price, and the haircut buffers that gap. Riskier, more volatile, less liquid, longer-dated assets carry bigger haircuts. Cash in the obligation’s own currency carries none.

Two parties can disagree about a haircut, and the disagreement is itself a risk. If you under-haircut, you are under-collateralized and do not know it: the collateral you hold is worth less than your model says, so a default leaves a gap. If you over-haircut, you tie up more of your counterparty’s assets than the risk warrants, which is expensive for them and a competitive disadvantage for you. The haircut is a negotiated number that sits in the legal agreement, and getting it right is a genuine risk decision, not a clerical one.

3. Variation margin tracking the mark

Now the first of the two margin flows. Variation margin, or VM, is collateral that covers the current mark-to-market exposure and is exchanged as that exposure changes, typically every day. Its job is simple to state: keep the net exposure between the two parties at or near zero at all times, so a default never finds a large unmargined loss sitting on the table.

The mechanism is a daily cycle. Each day the portfolio of trades between the two parties is revalued at current market prices. The net value is the exposure: if the portfolio is worth four million to you and minus four million to your counterparty, your counterparty owes you four million of exposure. You compare that to the collateral already posted. If exposure has grown, you call for more; if it has shrunk, you return some. The collateral chases the mark, day after day, so the uncovered gap is only ever one day’s market move plus a few frictions.

Two frictions keep tiny movements from generating endless calls. The minimum transfer amount, or MTA, is a floor below which no collateral moves: if exposure changed by less than the MTA since the last call, you do not bother, to avoid shuffling trivial sums every day. The threshold is an amount of exposure each party allows the other to run uncollateralized, a line of unsecured credit baked into the agreement; collateral is only called on exposure above the threshold. For most post-crisis VM relationships the threshold is zero, meaning every dollar of exposure is collateralized, but the mechanism allows a non-zero threshold where the parties accept some unsecured exposure.

The discipline of VM is what makes a derivatives book survivable. Because exposure is neutralized daily, the loss a defaulting counterparty can inflict is bounded by how much the market can move between the last successful margin exchange and the close-out of the position, not by the full lifetime value of the trades. That bounded gap is exactly what the second margin flow is designed to cover.

4. Initial margin and the uncleared margin rules

Variation margin covers today’s mark. But default is not instantaneous and clean. When a counterparty fails, you cannot close out the portfolio at that instant; you must declare default, terminate the trades, and replace or hedge them in the market, and that takes days. During that margin period of risk, the market keeps moving, and the exposure can grow beyond the last VM you collected. Initial margin, or IM, is the buffer held against that potential future move during the close-out window. It is sized not to today’s exposure but to a worst-case move over the margin period, typically a high percentile (the industry standard models size IM to a ten-day move at the 99th percentile of historical scenarios).

IM behaves differently from VM in three ways that matter. It is held against potential future exposure, not current exposure, so it is required even when the trade is worth zero today. It is exchanged in both directions and held gross, not netted: each party posts IM to cover the other’s potential exposure to it. And, crucially, IM must be segregated with a third-party custodian, held away from the receiving party so they cannot spend or reuse it, because its entire purpose is to be there, untouched, on the day the poster defaults. A buffer your defaulting counterparty already pledged on to someone else is no buffer at all.

For most of the market’s history, only cleared trades had initial margin; a CCP demanded it, but bilateral OTC trades did not exchange IM. The 2008 crisis exposed how dangerous that was: an enormous web of uncollateralized and partially collateralized bilateral exposures, with no buffer for the close-out period. The regulatory response was the uncleared margin rules, or UMR, a global framework agreed by the Basel Committee and IOSCO and implemented across jurisdictions, which for the first time required both VM and two-way segregated IM on non-centrally-cleared derivatives between large market participants. UMR phased in by size, starting with the largest dealers around 2016 and extending in successive waves to progressively smaller firms; the final phase brought in firms above a roughly eight-billion-dollar threshold of aggregate average notional amount of non-cleared derivatives. A firm below that threshold is out of scope for mandatory IM; one above it must build the whole apparatus: an IM model or the regulatory standardized schedule, segregated custody accounts, and a daily two-way IM exchange.

flowchart TB
  subgraph vm["Variation margin"]
    V1["Covers current<br/>mark-to-market exposure"]
    V2["Netted, exchanged one way<br/>to the in-the-money party"]
    V3["Can be reused by the holder"]
  end
  subgraph im["Initial margin"]
    I1["Covers potential future<br/>exposure over close-out"]
    I2["Two-way, posted gross<br/>by both parties"]
    I3["Segregated with a third party,<br/>cannot be reused"]
  end
  vm --> P["Together: today's loss is<br/>margined, tomorrow's gap is buffered"]
  im --> P

The distinction between VM and IM is the single most important thing to hold from this section, so let the reader test it directly against a worked case.

5. The ISDA Master Agreement and the Credit Support Annex

None of this works without a legal framework, and in the OTC derivatives world that framework is overwhelmingly the documentation published by ISDA, the International Swaps and Derivatives Association. Two documents do the heavy lifting.

The ISDA Master Agreement is the umbrella contract between two parties that governs all their derivatives trades with each other. Its central achievement is close-out netting: instead of treating each of a thousand trades as a separate claim in a default, the Master Agreement says that on a default, all trades are terminated, valued, and collapsed into a single net amount that one party owes the other. This is enormous for risk, because exposure is the net across the whole portfolio, not the gross sum of every losing trade. Without enforceable netting, a defaulter’s administrator could cherry-pick, demanding payment on trades that favor the estate while defaulting on the ones that favor you. Netting is what makes collateralizing the net exposure legitimate, and a large part of derivatives law is about ensuring that netting is enforceable in each counterparty’s jurisdiction.

The Credit Support Annex, or CSA, is the document attached to the Master Agreement that governs collateral. It is where every parameter we have discussed lives: which assets are eligible, the haircuts (called valuation percentages) on each, the threshold, the minimum transfer amount, the rounding, the timing of calls and the deadlines for delivery, the interest paid on cash collateral, the valuation agent, and the dispute procedure. When an operations team “looks at the CSA,” they are reading the rulebook for exactly how much collateral moves, in what, by when. There are several flavors of CSA reflecting different legal structures and the VM-versus-IM split, and a single relationship in the UMR era often runs more than one: a VM CSA for variation margin and a separate IM document for the segregated initial margin.

6. Title transfer versus security interest

Here is the legal fork that changes everything downstream, and it is the part engineers most often miss because both look like “posting collateral” on a screen. There are two fundamentally different legal ways to give collateral.

Under title transfer, you transfer outright legal ownership of the collateral to your counterparty. It becomes theirs. They can sell it, lend it, pledge it onward. In exchange you get a contractual claim to receive back equivalent assets (the same amount of the same security, or the same cash) when your obligation shrinks. The English-law VM CSA works this way, and it is the dominant structure for variation margin in much of the market. The advantage is operational simplicity and certainty on default: because the collateral is already the holder’s property, on a counterparty default the holder simply keeps it and nets it against what it is owed, with no need to enforce a security interest or go to court. The cost is that while everything is fine, your collateral is genuinely gone from your estate; you are an unsecured creditor for the return obligation if the holder fails.

Under a security interest (a pledge), you keep ownership of the collateral but grant your counterparty a legal charge over it. It stays yours; the counterparty holds it (or controls it at a custodian) as security. On your default, the counterparty enforces the security interest to seize and sell the collateral. The New-York-law CSA works this way. The advantage is that segregated, pledged collateral can be held bankruptcy-remote at a custodian, protected from the holder’s own insolvency, which is exactly what initial margin requires. The cost is more legal and operational machinery: perfecting the security interest, controlling the account, and enforcing on default.

This is not a stylistic preference; it determines who owns the asset, whether it can be reused, and how a default unwinds. Variation margin, where reuse and operational simplicity are valued, gravitates to title transfer. Initial margin, where the whole point is that the collateral sits untouched and protected from the holder’s failure, gravitates to a segregated security interest. The same word, collateral, hides two different property arrangements with very different consequences.

7. Bilateral versus tri party arrangements

Once collateral moves every day, in different assets, with haircuts and substitutions and disputes, the operational burden is real. There are two ways to carry it.

In a bilateral arrangement, the two parties manage collateral directly between themselves. Each runs its own valuation, issues its own calls, agrees the amount, chooses which specific assets to deliver, and settles the movement. It is flexible and keeps both parties in full control, but it is operationally heavy: every call is a negotiation, every substitution is a manual exchange, and the two sides must reconcile their portfolios and valuations or end up in disputes. For a firm with a handful of relationships this is manageable; for a dealer with thousands, done purely bilaterally, it is a small army of operations staff.

In a tri-party arrangement, a third party, the tri-party agent (typically a large custodian bank), sits between the two and runs the collateral mechanics. The two parties agree the exposure and the eligibility rules; the agent then handles the rest inside its own books. The agent holds both parties’ assets, automatically selects eligible collateral from the poster’s available pool to meet the required amount, applies the haircuts, allocates it to the receiver’s account, marks it daily, and performs substitutions automatically when the poster wants a specific asset back and has something else eligible to swap in. Because both legs of a movement happen on the agent’s own books, settlement is simultaneous and there is no settlement risk between the parties for that movement. The agent does not take on the credit risk of the trade; it provides the operational plumbing and the asset selection, neutrally, for both sides.

sequenceDiagram
  participant P as Collateral poster
  participant A as Tri-party agent
  participant R as Collateral receiver
  R->>A: Required amount = $10M eligible collateral
  A->>A: Select eligible assets from poster's pool, apply haircuts
  A->>A: Allocate to receiver's segregated account (on agent's books)
  A-->>P: Confirm assets allocated out of available pool
  A-->>R: Confirm $10M post-haircut collateral now held
  Note over A: Daily mark, auto-substitute if poster recalls a specific asset

The tri-party model is dominant in repo and securities financing and is heavily used for segregated initial margin under UMR, precisely because the agent can hold IM bankruptcy-remote and automate the segregation that the rules demand. The trade-off is that you outsource control and pay the agent a fee, and you concentrate operational dependence on that agent. But for any firm running collateral at scale, the automation of selection, substitution, and simultaneous settlement is worth far more than the fee.

8. Rehypothecation reuse and the collateral chain

Collateral you receive is an asset sitting in your hands, and a tempting one. Reuse, of which rehypothecation is the common form, is the practice of taking collateral you received and posting it onward to someone else, or lending it, or selling it and buying it back. Under title transfer this is trivial, because the collateral is already yours. Under a pledge it depends on whether the agreement granted a right of reuse.

Reuse is economically powerful. It means a given pool of high-quality assets can support multiple obligations as it passes through the system: a hedge fund posts a bond to its prime broker, the prime broker reuses it to meet its own obligation to a dealer, the dealer reuses it again. The same bond collateralizes a chain of exposures. This raises collateral velocity, the number of times a unit of collateral is reused, and it makes the financial system far more efficient with scarce high-quality assets. Without reuse, every obligation would need its own untouched pile of collateral, and there is not enough top-grade collateral in the world for that.

The power is also the danger. A reuse chain links the parties together in a way that is invisible from any single link. If one party in the middle fails, everyone downstream who was relying on collateral that traced back through that party can find their claim is now to an equivalent asset from an insolvent estate, not to a specific asset they can seize. The chain can unwind violently: when a link fails, parties scramble to reclaim collateral that has been posted onward and is no longer simply sitting somewhere to be taken back. This is exactly what amplified the 2008 crisis. When a prime broker fails, hedge funds that posted collateral that was rehypothecated discover they are unsecured creditors for its return, and the scramble to reclaim or replace collateral propagates the stress.

The regulatory response has been to constrain reuse where it is most dangerous. Segregated initial margin under UMR generally cannot be reused: that is the entire point of segregation, and it deliberately sacrifices collateral velocity for safety, removing IM from the reuse chain so the buffer is always there. Variation margin under title transfer can be reused. Reform after 2008 also tightened disclosure and consent around rehypothecation, so a client can see and limit how their collateral is reused. The tension is permanent: reuse makes scarce collateral go further, and reuse makes the system more interconnected and more fragile. Where you fall on that trade-off depends on whether the collateral is meant to chase exposure (VM, reuse acceptable) or to be a last-resort buffer (IM, reuse forbidden).

9. Optimization and transformation

Posting collateral has a cost. The cheapest thing to post is cash, but cash posted as collateral is cash you cannot invest elsewhere, and high-quality bonds posted as collateral cannot be used for anything else either. Across thousands of obligations, in different currencies, with different eligibility rules and haircuts, choosing what to post where becomes an optimization problem worth real money.

Collateral optimization is the discipline of meeting every obligation with the cheapest eligible asset, subject to all the constraints. The principle is to post your worst eligible collateral first, keeping your best assets free, because your most liquid, highest-quality assets have the most valuable alternative uses, and an obligation that accepts a lower-grade bond should be fed the lower-grade bond. The constraints are dense: each counterparty’s CSA has its own eligibility schedule and haircuts, currencies must match or be eligible, some assets are already pledged, and moving collateral has settlement cost. Done well across a large book, optimization frees up scarce high-quality assets and reduces funding cost measurably; done badly, a firm posts cash where a bond would do and leaves money on the table every day. At scale this is a genuine mathematical optimization, often a linear program, run daily over the whole inventory.

Collateral transformation is the related service that appears when a firm has the wrong kind of collateral. A pension fund may hold mostly corporate bonds and equities, but its cleared swaps and its UMR obligations demand cash or government bonds for VM and high-grade assets for IM. Transformation is the upgrade: through a repo or a securities loan, the firm temporarily swaps its lower-grade assets for the high-grade assets it needs to post, paying a fee for the difference in quality. A dealer or custodian provides the high-grade asset and takes the lower-grade one plus a fee. This solves a real mismatch, but it adds a layer of dependency and cost, and in stress the transformation trade can be pulled exactly when the firm most needs the upgraded collateral, which is a known fragility. The cleaner picture is that UMR and clearing increased demand for high-grade collateral, and transformation is the market’s way of meeting that demand from firms that do not naturally hold it, at a price and with a string attached.

10. CCP collateral versus OTC collateral

The same word, collateral, behaves differently depending on whether a CCP sits in the middle, and a senior practitioner should hold both pictures.

In bilateral OTC collateral, governed by the CSA, the two parties face each other. Margin terms are negotiated: thresholds, MTAs, eligibility, and haircuts can differ from one relationship to the next. VM and (under UMR) IM are exchanged between the two, bilaterally or through a tri-party agent. The arrangement is bespoke, the netting set is the portfolio under one Master Agreement, and the residual risk if collateral falls short lands directly on the surviving counterparty.

In CCP collateral, the central counterparty stands between every buyer and seller and mutualizes default risk. A CCP’s margining is not negotiated; it is set by the CCP’s rulebook and applied uniformly to all clearing members. The CCP demands VM and IM, but it adds a layer bilateral arrangements do not have: a default waterfall, a defined order in which resources absorb a defaulting member’s losses. The defaulter’s own IM and a contribution to a mutual default fund go first; then the CCP’s own capital (often called skin in the game) takes a slice; then the default fund contributions of the surviving, non-defaulting members are tapped. This mutualization is the CCP’s defining feature: members collectively backstop each other through the fund, so a single member’s failure does not fall on one counterparty but is absorbed by a pre-funded, ordered set of buffers. The CCP also runs intraday margin calls and far more conservative, standardized risk models than a typical bilateral CSA, because it is concentrating risk and cannot afford a gap.

flowchart TB
  D["Defaulting member's<br/>losses"] --> W1["1. Defaulter's initial margin"]
  W1 --> W2["2. Defaulter's default<br/>fund contribution"]
  W2 --> W3["3. CCP capital<br/>(skin in the game)"]
  W3 --> W4["4. Surviving members'<br/>default fund contributions"]
  W4 --> W5["5. Recovery tools<br/>(assessments, further measures)"]

The regulatory push since 2008 has been to move standardized OTC derivatives into central clearing precisely to get this waterfall and the multilateral netting a CCP provides, and to impose UMR on what remains bilateral so the uncleared book is no longer a margin-free zone. The result is a two-track world: cleared trades under CCP rules with mutualized defaults, and uncleared trades under CSAs with two-way segregated IM. A large dealer runs both, and a collateral system has to speak both dialects: CCP rulebook margins on one side, negotiated CSA terms on the other.

11. Engineering a collateral management engine

Everything above is the domain. Now build the system that runs it. A collateral management engine is, at its core, a daily loop: value the exposure, compute the required collateral, compare to what is held, issue or respond to calls, settle movements, handle substitutions, and manage disputes. The hard parts are correctness under disagreement and keeping a faithful record of who holds what, in what legal form.

The data model starts with the agreements, because every number depends on terms. You need the agreement (the CSA) with its parameters, the eligibility schedule and haircuts, the inventory of assets the firm can post, and the collateral balances by agreement and legal structure. A workable shape:

-- The agreement holds the negotiated terms that drive every call.
CREATE TABLE csa (
  csa_id          BIGINT PRIMARY KEY,
  counterparty_id BIGINT NOT NULL,
  margin_type     TEXT   NOT NULL,  -- 'VM' or 'IM'
  legal_structure TEXT   NOT NULL,  -- 'title_transfer' or 'security_interest'
  threshold       BIGINT NOT NULL,  -- minor units; often 0 for post-crisis VM
  mta             BIGINT NOT NULL,  -- minimum transfer amount
  base_currency   CHAR(3) NOT NULL
);

-- Eligibility and haircut, per agreement, per asset class.
CREATE TABLE eligibility (
  csa_id          BIGINT NOT NULL,
  asset_class     TEXT   NOT NULL,   -- 'cash_usd', 'ust', 'ig_corp', ...
  valuation_pct   NUMERIC(6,4) NOT NULL  -- 1.0000 = no haircut; 0.9800 = 2% haircut
);

-- Posted collateral, tracked by legal structure so reuse rights are explicit.
CREATE TABLE collateral_posting (
  posting_id      BIGINT PRIMARY KEY,
  csa_id          BIGINT NOT NULL,
  direction       TEXT   NOT NULL,   -- 'received' or 'posted'
  asset_class     TEXT   NOT NULL,
  market_value    BIGINT NOT NULL,   -- minor units, integer, never a float
  reusable        BOOLEAN NOT NULL,  -- false for segregated IM
  custodian_id    BIGINT             -- set when segregated at a tri-party agent
);

The call computation is the heart of it. For each agreement, compute the exposure (the net mark for VM, or the model output for IM), subtract the threshold, and compare to the post-haircut value of collateral held. The post-haircut value of held collateral is the sum over postings of market value times the valuation percentage. The required transfer is the gap, but only if it exceeds the minimum transfer amount. The same integer discipline that protects a ledger applies here: money is an integer count of minor units, never a float, because a haircut applied to a float and summed over thousands of postings drifts, and a collateral balance that drifts is a dispute waiting to happen.

exposure              = net_mark_to_market        (VM)  or  model_PFE (IM)
collateral_value      = sum(market_value * valuation_pct) over held postings
uncovered             = exposure - threshold - collateral_value
call_amount           = uncovered, if uncovered > MTA, else 0

Substitutions are the next piece. A poster who wants a specific asset back (to deliver it elsewhere, or because it is being called away) requests a substitution: deliver in replacement eligible collateral of equal post-haircut value, and recall the original. The engine must verify the replacement is eligible and sufficient before releasing the original, and the two legs should settle so the firm is never briefly under-collateralized in between, the same simultaneity a tri-party agent provides on its own books.

Disputes are unavoidable and must be designed for, not treated as exceptions. Two parties independently value the same portfolio and will sometimes disagree, because they use different models, different market data, or different timing. When the call amounts differ by more than a tolerance, a margin dispute is raised: the parties exchange their valuations, identify the trades or marks that differ, and resolve to an agreed number, often escalating through a defined dispute-resolution procedure in the CSA. A good engine records both sides’ numbers, flags the gap automatically, isolates the disputed trades, and lets the undisputed portion settle immediately while the disagreement is worked, because freezing the whole call over one disputed trade leaves real exposure uncollateralized.

The architectural lesson mirrors the ledger one. The truth is the record of agreements, postings, and movements; required amounts and coverage are derived from it daily and never stored as the only copy. Exposure marks, haircuts, and balances are computed, logged, and reconciled against the counterparty and the custodian, because, exactly as with a ledger, internal consistency (your numbers agree with themselves) is not the same as external correctness (your numbers agree with the counterparty and the assets that actually moved). Reconciliation against the tri-party agent and the counterparty is where a silent shortfall is caught.

12. Failure modes and the controls that catch them

A collateral system that computes calls correctly can still fail, because most collateral failures are not arithmetic errors. They are gaps between the model and reality, between the books and the assets, between the legal form you assumed and the one you actually have. Knowing which control catches which failure is what separates an operations team that sleeps from one that gets surprised in a default.

The pattern is the same one that governs any financial control system. The call math guarantees internal consistency: given correct inputs, your required and held amounts agree. It says nothing about external correctness: whether the inputs were right, whether the asset is eligible and properly haircut, whether it actually settled, whether you truly own it in the legal form you assumed, and whether your number matches your counterparty’s. Every serious collateral failure lives in that gap, and every serious control, reconciliation against the agent and the counterparty, the eligibility schedule, the dispute procedure, segregation of IM, exists to close one part of it. Collateral management is the discipline of making a promise credible; the engineering is the discipline of making sure the assets that back the promise are real, valued correctly, in the right legal form, and actually there on the day the promise is tested.

Mastery Questions

1. A risk manager argues that since the firm collects variation margin daily with a zero threshold, every dollar of exposure is always covered, so initial margin is redundant overhead the firm should push back on. Where is the argument wrong, and what exactly does initial margin cover that variation margin does not?

   Answer. The argument confuses current exposure with the exposure that opens up during a default close-out. Variation margin with a zero threshold does cover today’s mark-to-market exposure, and it does so well: after each successful daily exchange, the net exposure is near zero. But default is not instantaneous. When a counterparty fails, the surviving party must declare default, terminate the portfolio, and replace or hedge the trades, and that takes days, the margin period of risk. During that window the market keeps moving, and the exposure can grow well beyond the last VM collected, because there is no longer a functioning counterparty to call for more VM. Initial margin is the buffer sized to that potential move, typically a high-percentile move over roughly ten days. It is required even when today’s mark is zero, because the close-out gap exists regardless of today’s value. So IM is not redundant with VM; the two cover different exposures: VM neutralizes the move that already happened, IM buffers the move that happens after the defaulter stops paying. The further point is that IM must be segregated and unreusable, so that the defaulting party cannot have already spent the very buffer meant to absorb their default, which is the whole reason UMR forces it to a third-party custodian.

2. Your firm posts a government bond as variation margin under an English-law title transfer CSA, and separately pledges a similar bond as segregated initial margin under a security-interest arrangement at a tri-party custodian. Your counterparty becomes insolvent. What happens to each bond, and why does the legal structure produce different outcomes?

   Answer. The two bonds are treated very differently because they were given under different property arrangements. The VM bond was transferred outright: under title transfer, ownership passed to the counterparty, and you hold only a contractual claim to receive an equivalent bond back when your obligation shrinks. When the counterparty becomes insolvent, that bond is part of their estate. You are an unsecured creditor for the return of an equivalent asset, and you recover alongside other unsecured creditors, potentially cents on the dollar, although in practice close-out netting under the Master Agreement lets you net the value of returnable collateral against amounts in the overall termination, which substantially limits the loss. The IM bond is the opposite. It was pledged under a security interest and held segregated, bankruptcy-remote, at a third-party custodian. It never left your ownership; the counterparty had only a charge over it. On their insolvency, the bond is not part of their estate, and because they had no enforcement event against you (you did not default), the segregated IM is returned to you rather than seized. This contrast is the entire reason UMR mandates segregation for IM: outright transfer is fine for VM that chases daily exposure and can be reused, but a buffer that must survive the holder’s own failure has to be held in a structure where the holder’s insolvency cannot consume it, and only a segregated security interest at a bankruptcy-remote custodian gives that.

3. A pension fund newly in scope for UMR holds mostly corporate bonds and equities, but its counterparties’ CSAs demand cash and government bonds for VM and high-grade assets for segregated IM. The fund’s operations lead proposes simply rehypothecating collateral it receives to meet its own posting obligations, to avoid the cost of upgrading. Evaluate the plan: where does it work, where does it fail, and what is the sound alternative?

   Answer. The plan works only in the narrow place where the collateral the fund holds is both reusable and eligible for what it needs to post. Variation margin received under a title transfer CSA is genuinely the fund’s property and can be reused, so if it received cash or government bonds as VM, reposting those to meet a VM obligation elsewhere is exactly the collateral velocity the system is built on. But the plan fails for the harder obligations. Segregated initial margin the fund receives cannot be reused at all; that is the point of segregation, so it cannot be a source. And much of what a pension fund holds or receives is the wrong type: corporate bonds and equities are not what a counterparty demanding cash or government bonds will accept, and rehypothecating ineligible assets does nothing to meet an eligibility schedule that excludes them. The plan also quietly increases the fund’s entanglement in reuse chains, which is the fragility that turns one failure into many, and for a buy-side firm whose mandate is safety that is a poor trade. The sound alternative is collateral transformation: through a repo or securities loan, the fund temporarily upgrades its lower-grade assets into the high-grade collateral it must post, paying a fee for the quality difference. This meets the eligibility requirement honestly, but the fund must price in the cost and recognize the dependency: the transformation trade can be pulled in stress, exactly when the upgraded collateral is most needed, so the fund should size that risk and keep a buffer rather than rely on transformation being available on demand.