General requirements

A CSD shall adopt a sound risk-management framework for comprehensively managing legal, business, operational and other direct or indirect risks, including measures to mitigate fraud and negligence.