. "(k) a change in the designated trade repository's policies and procedure relating to risk-management, including policies and procedures relating to business continuity and data security, that have or may have an impact on the designated trade repository's provision of services to its users, and" . . . .