This month’s Risk Committee update focuses on a comprehensive review of sub-custodian banks and market infrastructure developments across a number of countries.
Key points of interest centre on operational resilience; asset servicing and settlement practices; and account structures/naming and clarity around beneficial ownership.
For further regional insight, please contact Ana Giraldo, Chief Risk Officer and Director, Americas.
Czech Republic
The review of sub-custodian banks in the Czech Republic has highlighted their continued focus on operational resilience, for example, in the maintenance of contingency sites to ensure operational continuity in case of potential adversity.
Furthermore, additional information regarding the treatment of liens at the market-level, has resulted in improvements to specific asset safety scores (in line with Thomas Murray’s sub-custodian methodology).
Romania
The assessment of sub-custodian banks in Romania placed particular emphasis on scoring for asset servicing. In particular, adjustments have been made to account for the automatic processing of market claims at the CSD level; it’s important to note that market claims rarely occur in the market, as nearly all trades settle on settlement date.
Meanwhile, a recent proposal to introduce a domestic CCP in Romania, hasn’t been well received by participants, as it will likely prove costly for any future clearing members. Despite this, it remains part of a drive in Romania to upgrade the market in line with international best practices.
Additional market developments include plans for regional integration. Finance ministers and senior officials from Bulgaria, Croatia, Hungary, North Macedonia, Poland, Romania, Slovakia, and Slovenia, signed a Memorandum of Understanding (MoU) on 25 August 2025 in Zagreb. The MoU formalises the commitment of these countries to work together to enhance the integration of capital market infrastructures in the region. It further builds on the strategic agreement, signed in November 2024, between the stock exchanges in the signatory countries and the European Bank for Reconstruction and Development (EBRD).
Costa Rica
Thomas Murray comprehensively reviewed account structures and naming conventions in the Costa Rican market, with particular focus on the records maintained at the level of the agent bank’s book and those recorded at the CSD level.
The conclusion was that the market is segregated by client, with omnibus and omnibus sub-accounts not allowed at the CSD-level. At the agent bank level, local clients must open accounts in the name of the beneficial owner, but global custodians can open an omnibus account on behalf of their underlying clients, or segregate by the beneficial owner’s name.
The market regulator (SUGEVAL) is working on the formalisation of monthly reconciliations of sub-custodians' account holder information against the records of the central securities depositories (InterClear and Central Bank’s SAC). Draft regulatory amendments have been published for consultation, but no timeline has yet been set for their entry into force.
Other market developments include the signing of an MoU by the Costa Rican CSD (InterClear) with the Guatemalan Securities Depository (Central de Valores Nacional – CVN), enabling each depository to clear and settle transactions undertaken by their respective participants. This will potentially provide a cheaper, direct link for settlement of cross-border transactions.
In addition, SUGEVAL has authorised InterClear Central de Valores as the country’s first Central Register for electronic promissory notes and bills of exchange, under Law No. 10,069.
Greece and Cyprus
Sub-custodian providers in Greece and Cyprus were also assessed in relation to corporate actions, resulting in some alignment between providers. Operational risk scores across banks remained relatively stable, although the confirmation of one institution implementing an annual IASE3402 external audit resulted in a notable improvement in their operational risk grade.
The Greek market has been upgraded from ‘Advanced Emerging Market’ to ‘Developed Market’ by FTSE Russell. This new market classification is expected to come into effect on 21 September 2026.
In addition, Euronext has received all necessary regulatory approvals for its acquisition of Hellenic Exchanges-Athens Stock Exchange S.A. (ATHEX), the Greek capital markets operator. The voluntary offer Acceptance Period began on 6 October 2025 and will close on 17 November 2025. Completion is subject to a minimum acceptance of 67% of ATHEX’s voting share capital. If Euronext reaches 90% ownership, it will initiate a squeeze-out procedure under Greek Law 3461/2006.
Ukraine
The Ukrainian market remains volatile following the Russian aggression initiated in 2022, which led the market to implement certain repatriation restrictions and the exit of some foreign banks, although the National Bank of Ukraine (NBU) has been slowly relaxing restrictions to ensure the market’s stability. The NBU and the Securities Commission (NSSMC) have also advanced regulatory changes to introduce delivery-versus-payment (DVP) settlement for over-the-counter (OTC) transactions on domestic government bonds (OVDPs), as well as for cross-border trades on government bonds conducted through the Clearstream link.
The Ukrainian post-trade infrastructure is, however, about to undergo significant reform aimed at modernising its infrastructure by consolidating all central securities depository services under the National Depository of Ukraine (NDU), while trading and clearing will be run by a vertical silo operated by a new holding company (to be created). This new entity (where participation of an international strategic partner is expected) will create a new exchange and will become the main shareholder of Ukraine’s clearing house (Settlement Centre). No set timelines have been disclosed for the completion of this initiative and, as yet, there is no clear information about the future of the existing exchanges. While these reforms will strengthen transparency, risk mitigation, and market efficiency, practical challenges remain in achieving this vision, not least in ensuring operational resilience amid ongoing geopolitical and macroeconomic uncertainty.
In the context of the Ukraine-Russia war, sub-custodian risk grades have been maintained at lower levels since the outbreak of the war, and currently no grade changes have been proposed.
There is only one ‘outlook’ change from ‘Negative’ to ‘On-Watch’ for asset servicing for a major bank in Ukraine. There was a recent improvement (effective 6 Aug 2025) regarding companies now being able to authorise repatriation of dividends corresponding to 2023, subject to the existing overall monthly cap of EUR 1 million (cap unchanged). This shifts the eligibility for businesses to repatriate part of their dividends from 1 January 2023, instead of 1 January 2024. Last year, the central bank had allowed the same for dividend payments accrued from operations conducted since 1 January 2024.
Japan
There have been notable improvements across operational risk scores for sub-custodian providers in Japan. These improvements have been primarily driven by enhanced operational resilience practices, risk management procedures, and financial crime policies. Among others, this included some banks allowing for greater distances between primary and secondary data sites, conducting more frequent risk and control self-assessments, and the establishment of more formalised and comprehensive policies on whistleblowing.


Risk Committee Updates
Stay informed with Thomas Murray for the latest on market dynamics and regulatory trends – subscribe to Risk Committee Updates on LinkedIn.
We safeguard clients and their communities

Petroleum Development Oman Pension Fund
“Thomas Murray has been a very valuable partner in the selection process of our new custodian for Petroleum Development Oman Pension Fund.”

ATHEX
"Thomas Murray now plays a key role in helping us to detect and remediate issues in our security posture, and to quantify ATHEX's security performance to our directors and customers."

Northern Trust
“Thomas Murray provides Northern Trust with a range of RFP products, services and technology, delivering an efficient and cost-effective solution that frees our network managers up to focus on higher Value activities.”
Insights

Understanding supply chain and concentration risks in cloud services
The major incident on Friday, 19 July highlighted the high levels of concentration risk emerging from our technology landscape.

Thomas Murray launches OrbitAI
Thomas Murray is proud to launch OrbitAI, starting with a virtual cyber security consultant integrated into our Orbit Security platform.

Thomas Murray launches Cyber Risk practice with key strategic hire
Leading global risk intelligence firm Thomas Murray has announced the launch of its Cyber Risk advisory practice.

Tabletop exercises: Where to start
Knowing how to deal with the fallout from a major cyber incident is just as important as knowing how to prepare for one.