Turn the investment policy into limits your systems can check.

An implementation checklist.

1. 1.Write down the list of holdings first, before touching the policy. One row per position, as of today, with the amount, the currency, the instrument type, the legal entity on the other side and where the record came from. Most teams find that this takes longer than expected and that the difficulty is concentrated in positions held outside the bank statement, which is the useful finding.
2. 2.Give every counterparty a legal entity identifier and record its parent. The GLEIF API returns direct parent and ultimate parent links on an LEI record, which is what lets three separate positions roll up to one credit. Without that link, a group exposure is assembled by someone recognising names, which works until the names differ.
3. 3.Record the redemption mechanics of each instrument as attributes rather than as assumptions. Whether a fee can apply on redemption, whether the cut off is 2pm or 4pm and in which time zone, what the settlement cycle is, and whether liquidity comes from an issuer or from a market. These are the fields that decide what happens on the day it matters.
4. 4.Turn each policy clause into a limit row. A limit has a subject (an issuer, a group, an instrument type, a rating band, a tenor bucket), a basis (absolute currency amount or percentage of portfolio), a value, an effective date and an owner. A clause that resists this treatment is usually a clause that was ambiguous in prose too, and pinning it down is the point.
5. 5.Keep the rating with its source and its date. A rating is a fact about a moment. Stored as a bare field it silently becomes a claim about the present that nobody refreshed. Stored with the agency and the date, a stale rating is visible as staleness rather than passing as current.
6. 6.Run the check before the money moves. A pre trade check that says this placement would take group exposure to 31 percent against a 25 percent limit is worth more than a report that says the same thing on Thursday. The pre trade version prevents a breach; the report documents one.
7. 7.Recompute daily and store the result, not just the exception. A stored daily result is the evidence that the check ran and passed. Storing only breaches leaves you unable to distinguish a clean day from a day the job failed to run, which is precisely the distinction an auditor will want.
8. 8.Model the sweep. Where an operating balance sweeps overnight into a fund or a repo, the exposure at the end of the day is not the one on the account. Record the sweep target as part of the account so the overnight position is derived rather than assumed.
9. 9.Give exceptions an owner and an expiry. A breach that is accepted deliberately is a normal part of treasury life, particularly around an acquisition or a large receipt. An accepted breach with no end date is how a temporary position becomes the permanent shape of the portfolio. Require both, and let the expiry force a fresh decision.
10. 10.Separate trade date from settlement date in the model. A securities position exists from trade date and the cash leaves on settlement date. Where both are held in one field, the exposure report and the cash forecast disagree by a day or two and nobody can say which is right.
11. 11.Version the policy and stamp each check with the version it used. When the policy changes, yesterday’s passing result was tested against yesterday’s limits, and that is correct rather than a problem, provided the record says so. Without the stamp, a policy change silently rewrites the history of every previous check.
12. 12.Decide in advance how a downgrade is handled. A limit keyed on a rating band will start failing when a counterparty moves band, which is the system working. What the policy needs to say, and what the workflow needs to implement, is whether the existing position is held to maturity or unwound, and who decides.

Failure modes, framed so you can plan around them.

• Aggregating exposure by account rather than by credit. This is the most common shape of the problem and it is quiet, because every individual number is right. Four accounts, a fund and a repo can all lead back to entities under one parent. A report that lists them separately shows six modest positions where the policy would see one large one.
• Treating a money market fund as interchangeable with a deposit. They sit next to each other on the cash line and behave differently under stress. A government fund is outside the mandatory liquidity fee. An institutional prime or tax exempt fund carries a fee obligation once daily net redemptions exceed 5 percent of net assets, unless liquidity costs are de minimis. Recording the fund category is a small field with a large consequence.
• Assuming deposit insurance does meaningful work at corporate scale. The FDIC insures deposits to at least 250,000 dollars per insured bank. For a corporate balance that is a detail rather than a protection, and a policy that mentions insurance without a limit behind it is describing comfort rather than control.
• Letting the rating go stale without noticing. A rating field with no date is the easiest kind of decay to miss, because the check keeps passing. The remedy is mechanical: store the agency and the date, and treat an old rating as an exception in its own right rather than as a valid input.
• Checking only after the placement. A daily exposure report is useful and it is not a control. The money has moved, and unwinding a placement costs spread and attention. The same limit logic invoked before the placement turns the finding into a prompt.
• Storing exceptions but not clean results. A control that writes a row only when something is wrong cannot prove it ran. Silence then means either a good day or a broken job, and in an audit the two look identical.
• Modelling a repo with one counterparty field. A repurchase agreement carries the dealer on one side and the collateral issuer on the other. Collapsing them loses the distinction the policy usually cares about most, and it does so in a way that makes the exposure look better than it is.
• Holding limits as percentages without recording the denominator. Twenty five percent of the portfolio is a moving target, and the same position passes or fails depending on what else was held that day. Store the denominator used, so a historical result can be explained rather than re-derived.
• Leaving the sweep out of the picture. An operating account that sweeps overnight is reported as a deposit and is something else by the time the day ends. Where the sweep target is not part of the record, the overnight concentration is invisible to the very check designed to catch it.
• Treating the policy document as the system of record. When the limits live in a PDF and the check lives in a workbook, the two drift, and the drift is only discovered when someone compares them. The document should be generated from the limit table, or at minimum the table should carry the clause reference, so a difference is a visible mismatch.

What this asks of the data model.

• The counterparty is a legal entity with a parent, not a name. Key the counterparty master on a legal entity identifier and store the direct parent and ultimate parent links alongside it. The GLEIF API returns exactly those relationships, together with branches and managed funds, which covers the two hard cases: a branch that trades under a local name, and a fund whose manager is the credit the policy is really thinking about.
• Instruments need a redemption model, not a type label. Two fields carry most of the weight: how liquidity is obtained (on demand from an issuer, by redeeming from a fund, by selling into a market, or at contractual maturity) and what can interrupt it (a cut off time, a fee, a settlement cycle, a thin market). A type label such as money market fund answers neither.
• Limits are rows with effective dates, and the effective date is the part that gets forgotten. A limit is a subject, a basis, a value and a window of time in which it applied. Without the window, a check result from three months ago cannot be reconciled to the policy that governed it, and every policy revision rewrites history.
• Ratings carry an agency and an as of date. Store rating at acquisition and current rating as separate facts on separate rows rather than as one field that is overwritten. A policy that tests eligibility at purchase and monitoring thereafter needs both, and overwrite loses the first one permanently.
• Trade date, settlement date and value date are three different things. Exposure begins at trade date. Cash moves at settlement date. A forecast keyed on value date and an exposure report keyed on trade date will disagree, correctly, and the model should let them.
• A repurchase agreement needs two counterparty fields. The cash counterparty and the collateral issuer are separate credits with separate limits. Model the haircut and whether the transaction is centrally cleared on the same row, because the SEC clearing mandate reaches eligible repo transactions from 30 June 2027 and the cleared flag becomes a reportable attribute rather than a detail.
• Sweep relationships belong on the account record. An account that sweeps has a target, a threshold and a time. Holding those three fields lets the overnight position be computed from the daytime one, rather than requiring a second feed that arrives late or not at all.
• Check results are records, with the inputs that produced them. Store the limit version, the denominator, the exposure computed, the result and the timestamp. A stored pass is evidence. A recomputed pass is an assertion, because the inputs have moved since.
• Exceptions are first class rows with an owner and an expiry. An approved breach needs the limit it breached, the amount, the reason, who approved it, when, and the date the approval lapses. Held as an email thread, it is a recollection. Held as a row, the expiry can be queried and the list of live exceptions is a real artefact.
• Currency and entity have to travel with every position. A group limit that quietly mixes currencies, or that aggregates across legal entities that cannot actually lend to each other, produces a number that is arithmetically correct and operationally meaningless. Carry the holding entity and the currency on the row and convert explicitly, with the rate and the date.

The evidence to keep.

• The investment policy as it stood on the date in question, with a version identifier, the approval that put it in force and the date it took effect.
• The limit table as of that same date, with each row traceable to the clause of the policy it implements, so the check that ran can be tied to the document that authorised it.
• The daily check results for the period, including the passing days, each one carrying the limit version, the portfolio denominator, the computed exposure and the timestamp of the run.
• The counterparty master extract, showing each counterparty’s legal entity identifier, its parent links and the group under which its exposures were aggregated.
• The rating history for each counterparty and instrument held during the period, with the agency and the as of date for each observation, and the eligibility conclusion drawn at acquisition.
• The pre trade check log, showing placements that were proposed and the result returned before the money moved, including any that were declined by the check.
• The exception register, listing each accepted breach with the limit, the amount, the reason, the approver, the approval date and the expiry, together with evidence of what happened at expiry.
• The instrument master for the holdings in the portfolio, recording the redemption mechanics relied on, so that the liquidity assumption in the cash forecast can be traced to a stated attribute rather than to custom.
• The reconciliation from the positions used in the exposure calculation to the cash and cash equivalents and short term investment balances reported in the accounts, so the control and the financial statements describe the same portfolio.
• The record of policy changes during the period, showing what changed, who approved it and from which date, with the corresponding change to the limit rows.

Questions worth asking in your own review.

• If someone asked for our total exposure to a single banking group right now, including deposits, funds managed by that group and any repo where it is the cash counterparty, how long would that take and who would assemble it?
• Is our investment policy readable by anything other than a person? Could a system answer whether a proposed placement is inside it?
• For each holding, do we know whether a redemption can carry a fee, and is that recorded anywhere other than in the fund documents nobody has opened since onboarding?
• When did we last refresh the credit ratings behind our counterparty limits, and would we be able to tell if one had gone stale?
• Does our concentration check run before a placement or after it, and what happens to the finding in each case?
• Can we produce evidence that the check ran and passed on a specific day three months ago, or only that no exception was raised?
• Where an operating account sweeps overnight, does our exposure report show the daytime balance or the overnight position?
• If a counterparty were downgraded tomorrow, does the policy say what happens to positions we already hold, and does anyone own that decision?
• Do we have accepted exceptions with no expiry date, and if so, when were they last looked at?
• Does the portfolio used for the exposure calculation reconcile to the cash and short term investment balances we report externally?

What this adds up to.

The policy question is settled in most companies. Three in four have written one down, the risk appetite in it has been argued through and approved, and nobody needs convincing that concentration limits are sensible. That is the expensive part of the work and it is already done. What remains is a translation problem, and translation problems reward ordinary engineering rather than new thinking.

The operating payoff is larger than the compliance one. A treasury that can name every counterparty, roll each exposure up to the credit group behind it, state how each holding redeems and on what cut off, and show a stored check result for every day of the quarter has built something that serves several purposes at once. The cash forecast gets more honest, because liquidity assumptions are traceable to instrument attributes. The audit gets shorter, because the evidence already exists in the shape the auditor wants. And a downgrade or a stressed market becomes a query rather than a scramble, which is the only time anyone finds out whether the work was done.

If there is one place to start, it is the counterparty master. Take the current list of holdings, attach a legal entity identifier and a parent to each counterparty, and compute the group exposures once. Most teams find one or two groupings they had not seen, and those are worth knowing about on an ordinary Tuesday rather than on an interesting one. Everything else in this article builds on that table, and it is a week of work rather than a project.

Sources.

• Association for Financial Professionals, press release of 16 June 2026, AFP Survey Finds Stablecoins Remain Peripheral to Liquidity Strategies as Cash Reserves Rise, announcing the 2026 AFP Liquidity Survey Report. Fetched and read directly rather than through a summary. Source for every survey figure used here: that the survey was conducted in March 2026 among 309 treasury professionals from US organisations of varying sizes and industries; that 46 percent of organisations increased their US cash balances as of March 2026, up from 38 percent the previous year; that an average of 83 percent of short term investment balances are held in safe and liquid investment vehicles such as bank deposits, money market funds and Treasury securities; that the average share of investments in bank deposits dropped to 42 percent, the lowest since 2011, while the average share in Treasury securities increased; that three in four organisations have a written investment policy that dictates their short term investment strategy; that 1 percent are piloting or using stablecoins in a limited capacity while 9 percent are actively exploring them; that the most important factor companies look for in a bank is relationship strength, followed by credit quality and counterparty risk; that the most important factor in a money market fund is yield, followed by fund ratings and a stable net asset value; and that 41 percent of organisations expect money market funds to offer 24/7 liquidity, up from 38 percent in 2025.
• Association for Financial Professionals, 2026 AFP Liquidity Survey landing page. The report itself, now in its 21st year and underwritten by Invesco, sits behind this page. Used to confirm the survey series, its scope and its availability, not as the source of any figure quoted here.
• US Securities and Exchange Commission, Fact Sheet, Money Market Fund Reforms, accompanying Release No. 33-11211. Downloaded as a file and read page by page rather than through a fetched summary. Source for the normative statements about money market fund mechanics used here: that the amendments increase minimum liquidity requirements to at least 25 percent of a fund’s total assets in daily liquid assets and at least 50 percent in weekly liquid assets; that they remove the ability to impose temporary redemption gates and remove the regulatory tie permitting liquidity fees when weekly liquid assets fall below a threshold; that institutional prime and institutional tax exempt money market funds must impose mandatory liquidity fees when a fund experiences daily net redemptions exceeding 5 percent of net assets, unless the fund’s liquidity costs are de minimis; that non government money market funds must impose a discretionary liquidity fee if the fund’s board or its delegate determines a fee is in the best interest of the fund; and that retail and government money market funds may handle a negative interest rate environment either by converting to a floating share price or by reducing shares outstanding.
• US Securities and Exchange Commission, press release of 12 July 2023, SEC Adopts Money Market Fund Reforms and Amendments to Form PF Reporting Requirements for Large Liquidity Fund Advisers. Fetched and read directly. Used to corroborate the fact sheet on the removal of gates, the removal of the tie between liquidity fees and the weekly liquid asset threshold, and the 5 percent daily net redemption trigger for institutional prime and institutional tax exempt funds.
• US Securities and Exchange Commission, press release of 25 February 2025, SEC Extends Compliance Dates and Provides Temporary Exemption for Rule Related to Clearing of U.S. Treasury Securities. Fetched and read directly. Source for the compliance dates cited here: that the Commission extended the compliance dates for Rule 17ad-22(e)(18)(iv)(A) and (B) under the Securities Exchange Act by one year, to 31 December 2026 for eligible cash market transactions and 30 June 2027 for eligible repo market transactions.
• US Securities and Exchange Commission, statement of Commissioner Mark T. Uyeda, Update on the SEC’s Work Toward Treasury Clearing Implementation, 20 April 2026. Fetched and read directly. Used for the current implementation position: that the Commission published for comment a SIFMA request for targeted modifications to the inter affiliate exemption, that it reopened the comment period on an Institute of International Bankers request concerning extraterritorial application of the trade submission requirement, that it has approved new clearing agencies for Treasury securities and Fixed Income Clearing Corporation rule changes broadening client access to clearing, and that the US Treasury market stands at nearly 29 trillion dollars outstanding.
• Global Legal Entity Identifier Foundation, public LEI API. Queried directly for a live record rather than described from memory. An LEI record returned by the API carries relationship links named direct-parent, ultimate-parent, direct-children, branches and managed-funds, which is the reference data that lets separate holdings be rolled up to the credit group behind them and lets a fund be associated with the manager that runs it.
• Federal Deposit Insurance Corporation, Deposit Insurance resource page. Fetched and read directly. Source for the statement that deposits are automatically insured to at least 250,000 dollars at each FDIC insured bank, and that mutual funds, annuities, life insurance policies, stocks and bonds, and crypto assets held through a bank are not covered by deposit insurance.

Every figure attributed to the 2026 AFP Liquidity Survey was read from the Association for Financial Professionals press release of 16 June 2026 announcing it, fetched as a file and read directly rather than through a summary. The survey covers 309 treasury professionals at US organisations and was fielded in March 2026, so it describes US practice at that date and nothing broader. Statements about money market fund mechanics come from the SEC fact sheet accompanying Release No. 33-11211, downloaded and read page by page, and corroborated against the Commission’s press release of 12 July 2023. The Treasury clearing compliance dates come from the SEC press release of 25 February 2025, and the current implementation position from Commissioner Uyeda’s statement of 20 April 2026, both read directly. The deposit insurance statement comes from the FDIC resource page. The legal entity identifier relationship fields were confirmed by querying the public GLEIF API for a live record rather than described from memory. No public post on X is cited in this article: a search for current, relevant and verifiable practitioner or regulator posts on corporate investment policy limits and the 2026 liquidity data did not produce one that could be confirmed as authentic and on point, and an unverified embed is worse than none. The record shapes in this article are worked illustrations of structure, and every identifier, rating, amount and entity name in them is a placeholder rather than a real holding or counterparty. Nothing here is investment advice or accounting advice for any particular company, and the obligations that apply to any regulated fund or intermediary come from the rules themselves rather than from this article.