You sign the rulebook on day one of membership, initial the loss-mutualisation clause somewhere around page forty, and never read it again. Forty pages of fine print, one sentence that matters more than any regulator's stress test, and a room full of sophisticated institutions that will collectively fail to imagine the scenario it was written to handle.
Not a conspiracy. A geometry problem.
The waterfall that decides what gets worried about
A clearing house sits between buyers and sellers, becoming the buyer to every seller and the seller to every buyer. When a trade is struck, the house guarantees it. If one party defaults, the house absorbs the initial hit and then, if the loss is large enough, reaches into a pre-funded default fund contributed by all its members. This cascading sequence of who bears losses in what order is called the default waterfall.
The specific shape of that waterfall is not neutral. It is a political document, quietly encoding whose money is at risk and under what circumstances, and it has been that way since the first central counterparty drafted membership rules.
Consider a simplified version. A central counterparty might structure its waterfall like this: the defaulting member's own margin is consumed first, then that member's contribution to the default fund, then a slice of the clearing house's own capital (the skin in the game), and finally the mutualised contributions of all surviving members. LCH, CME Clearing, and Eurex Clearing all operate variants of this architecture, with meaningful differences in the size of each layer and the triggers that move losses from one tier to the next.
Now imagine two members: a large bank clearing interest rate swaps and a smaller regional broker clearing equity derivatives. Their exposure profiles are completely different. Their contributions to the default fund are calibrated to their own positions. But in the mutualised layer, they share a fate. The large bank's potential loss from a fellow member's default in a product it barely trades is real, funded, and sitting in the waterfall waiting. What neither institution has a structural incentive to examine carefully is the risk profile of the other's book.
The blind spots that membership creates
Here is the mechanism that produces collective ignorance. Because each member's liability in the mutualised layer is capped, calculated as a multiple of their own default fund contribution, and because the scenarios that would exhaust that layer are treated by design as tail events, members rationally focus their risk management attention on the scenarios that affect their own margin calls. The existential scenarios, the ones that would actually wipe out the default fund and reach into the mutualised pool, are not discussed in any forum where all members sit together.
They can't be, structurally. Clearing houses convene risk committees, but membership of those committees is partial, rotating, and constrained by obvious conflicts. A bank that trades heavily in credit default swaps has a direct interest in how the clearing house models CDS default correlation. It also has an interest in not fully disclosing that model's weaknesses to its competitors around the same table. The committee discusses procedure and calibration at the margins. The truly dangerous correlations, the ones that would matter in a genuine multi-member stress event, go unexamined collectively.
There's a name for this in the academic literature: the problem of endogenous risk in CCP governance. The jargon obscures something almost embarrassingly simple. The people who share the most exposure in a crisis are the least likely to have a frank conversation about what that crisis looks like, because the clearing house's own rules give each of them an incentive to keep their risk model proprietary.
A worked scenario that lands
Take two hypothetical members: a bank called Meridian, which clears a large book of long-dated interest rate swaps, and a commodities firm called Tarrant, which clears energy futures. Under normal conditions, their risks are nearly uncorrelated. Meridian's stress scenarios involve sudden rate spikes. Tarrant's involve energy price gaps at open.
Both contribute to the same default fund. Both sit, nominally, on the clearing house's risk oversight committee.
Now suppose a sovereign debt event triggers simultaneous dislocations in interest rate markets and energy markets, the kind of correlated shock that is rare but not unprecedented. Meridian defaults. The clearing house burns through Meridian's margin, Meridian's default fund contribution, and the skin-in-the-game layer. It then reaches into the mutualised pool. Tarrant, whose own positions are now also under stress from the energy move, is called to contribute additional capital at exactly the moment it can least afford to. Think of it as two ships tethered together at the hull, fine in calm water, catastrophic when both sides take on waves at once.
At no point before this scenario did Meridian and Tarrant sit in a room and ask: what does our combined exposure look like when the correlation between our books spikes to one? The clearing house's structure never required it. The confidentiality provisions of membership actively discouraged it.
That is the risk that never gets discussed.
What people get wrong about the skin-in-the-game layer
The common assumption is that the clearing house's own capital contribution aligns its incentives with members and therefore produces better risk management. Regulators pushed hard for this after the 2008 crisis, and most major CCPs now maintain a meaningful proprietary layer. The logic is appealing: if the clearing house stands to lose its own money, it will model risks conservatively.
The flaw is that the clearing house's capital is finite and its liability is capped, while the mutualised pool is, in a genuine systemic event, the real shock absorber. The skin-in-the-game layer is large enough to matter in a single-member default. Not in a correlated multi-member event. And the clearing house, as an institution, has its own structural incentive to keep membership fees competitive, which means keeping default fund requirements from becoming so large that members take their business to a less demanding venue. A major CCP that loses even a modest share of cleared notional to a rival has a revenue problem next quarter, and everyone on the executive floor knows it.
So the stress tests that get published are rigorous within the scope of single-member defaults. The correlated multi-member scenarios, the ones that actually threaten the waterfall's integrity, are run internally, held tightly, and never become the subject of a member-wide conversation.
Are you still assuming that because a clearing house is regulated and publishes quarterly risk reports, the systemic risks are being collectively managed? That assumption is doing a lot of work. The regulation is real, the reports are genuine, and the risk remains, structurally, undiscussed.
The architecture of shared liability is also, inescapably, an architecture of shared blindness. The waterfall decides not just who pays, but what questions never get asked out loud, and that silence is the thing no stress test is designed to measure.