Systems and Controls in an automated trading environment for trading platforms
The purpose of the ESMA guidelines on systems and controls in an automated trading environment for trading platforms is to ensure consistent and common application of the Markets in Financial Instruments Directive (MIFID) and Market Abuse Directive (MAD). The guidelines cover;
· the operation of an electronic trading system by a regulated market or a multilateral trading facility;
· the use of an electronic trading system, including a trading algorithm, by an investment firm for dealing on own account or for the execution of orders on behalf of clients; and
· the provision of direct market access or sponsored access by an investment firm as part of the service of the execution of orders on behalf of clients.
Guideline 1: Organizational requirements for regulated markets’ and multilateral trading facilities’ electronic trading systems
The systems of Trading platforms should be well adapted to the business which takes place through them and must be robust enough to ensure continuity and regularity in the performance of the automated markets operated by the market operator or investment firm. They must take into account technological advancements and trends in the use of technology by its members/participants or users. On this note, Trading platforms must at least take into account the following;
a) The governance process is of outmost importance when complying with regulatory obligations. Trading platforms should, within their overall governance framework, develop and monitor their electronic trading systems through a clear process. All relevant aspects including commercial, technical, risk and compliance that are considered when making key decisions must be taken into account. The governance process must also have clear lines of accountability, including procedures for the sign-off for development, initial deployment, subsequent updates and resolution of problems identified through monitoring. Appropriate procedures should be in place to ensure efficient communication of information.
b) Regulated markets’ and multilateral trading facilities’ electronic trading systems should have sufficient capacity in order to accommodate realistic possible mass volumes of messaging and that are efficient and ready for an increase in capacity to be able to respond to rising messages and emergency conditions that could threat their proper operation.
c) business continuity arrangements must be in place so that their electronic trading systems are able to address disruptive incidents, including but not limited tp system failures. The arrangements should cover :
I. Governance for the development and deployment of the arrangements;
II. Consideration of an adequate range of possible scenarios related to the operation of their electronic trading systems which require specific continuity arrangements;
III. The backing up of business (including compliance) critical data that flows through their electronic trading systems;
IV. The procedures for moving to and operating the electronic trading system from a back-up site;
V. Staff training on the operation of the arrangements and individuals’ roles within them; and
VI. An on-going program for the testing, evaluation and review of the arrangements including procedures for modification of the arrangements in light of the results of that program.
d) Testing methodologies must be in place in order to test out electronic trading systems and updates prior to their commencement of operation. The use of these methodologies should ensure that, the operation of the electronic trading system is compatible with the regulated market’s and multilateral trading facility’s obligations under MiFID , that compliance and risk management controls in the systems work, and that the electronic trading system can continue to work effectively in troubled market conditions.
e) Trading platforms should monitor, in real time, their electronic trading systems. Problems identified must be dealt with as soon as possible. When necessary Trading platforms should be able to shut down or adjust the trading systems. Problems dealt with should be in order of priority. The operators of these trading platforms should periodically review and evaluate their electronic trading systems. The review should be taken by internal audit function or a third party in order to be somewhat independent.
f) Physical and electronic security arrangements must be in place and should be designed to protect electronic trading systems from misuse or unauthorized access. This will help ensure the integrity of the data that is part of or passes through the systems.
g) Trading platforms should have arrangements in placeto determine their staffing requirements and then to ensure they employ adequate quantity and quality of staff with the necessary skills manage their electronic trading systems. This can be done through recruitment and training.
h) Trading platforms should keep records in relation to their electronic trading systems covering at least the matters referred to in points a) to g) above. The records should be sufficiently detailed to enable the MFSA to monitor compliance. Records should be kept for at least 5 years. Market operators operating regulated markets should keep them for at least as long as required by the MFSA. Trading platforms should inform competent authorities, in line with the supervisory arrangements , about any significant risks that may affect the sound management of the technical operations of the system and major incidents where those risks take place.
Guideline 2. Organisational requirements for investment firms’ electronic trading systems (including trading algorithms)
The electronic trading systems, including trading algorithms, of investment firms ought to be suitable for the business which takes place through them in order to guarantee the smooth performance of the firm’s investment services and activities in an automated trading environment. In particular, investment firms must take the following matters into account:
a) Governance – Investment firms should adopt a clear and formalized governance process to develop, produce and monitor their electronic trading systems, including trading algorithms. Commercial, technical, risk and compliance considerations ought to be given appropriate attention when making key decisions. In addition, the governance process should incorporate clear lines of accountability, including procedures for the sign-off for development, initial deployment, subsequent updates and problem solving. Moreover, adequate communication channels must be in place. Compliance staff should have sufficient knowledge of the way in which trading systems and algorithms operate in order to provide clarity about the firm’s regulatory obligations and detect and discrepancies between the actual use of the trading systems and the firm’s obligations.
b) Capacity and resilience – The electronic trading systems utilized by investment firms should be able to cope with reasonably foreseeable volumes of messaging and provide timely response to any emergency condition that could potentially put the system’s proper operation in jeopardy.
c) Business Continuity arrangements must be in place so that their electronic trading systems are able to address disruptive incidents, including but not limited to system failures. The arrangements should cover:
i. Governance for the development and deployment of the arrangements;
ii. Consideration of an adequate range of possible scenarios related to the operation of their electronic trading systems which require specific continuity arrangements;
iii. The backing up of business (including compliance) critical data that flows through their electronic trading systems;
iv. The procedures for moving to and operating the electronic trading system from a back-up site;
v. Staff training on the operation of the arrangements and individuals’ roles within them; and
vi. An on-going program for the testing, evaluation and review of the arrangements including procedures for modification of the arrangements in light of the results of that program.
d) Testing
- Clearly delineated development and testing methodologies should be used by investment firms prior to deploying an electronic trading system or algorithm, as well as prior to incorporating updates. In the case of algorithms, such testing may consists of performance simulation or offline testing. Testing should ensure that the electronic trading system or algorithm is compliant with the investment firm’s obligations and works effectively in stressed market conditions. This could imply that the system shuts down under such conditions. Moreover, testing should guarantee that the embedded compliance and risk management controls function properly.
- An Investment firm ought to adapt trading algorithm tests to the strategy adopted by the firm, taking account of the markets to which it will send orders. Tests need to be proportionate to the risks that the firm’s strategy might pose. Further testing should be undertaken if there is a change in the markets where the algorithm is to be used.
- Trading algorithms should also be tested in a controlled live environment to make sure that the system functions properly. The live environment ought to be controlled by for instance limiting the number of financial instruments being traded and the number of markets to which orders are sent.
e) Monitoring and review – Electronic trading systems and trading algorithms should be monitored in real time to ensure that they are able to deal adequately with problems as they arise, or immediately shut down if necessary. When dealing with problem solving, investment firms should give particular attention to the need for members/participants and users of regulated markets to act in an orderly manner.
Investment firms should undertake a periodic review of their electronic trading systems and algorithms and take the necessary steps to remedy any shortcomings. The involvement of internal auditors or third parties should be encouraged in order to ensure the evaluation is performed with a certain degree of independence.
f) Security – Arrangements for physical and electronic security should be in place to prevent the misuse or unauthorized access to the electronic trading systems and algorithms and guarantee data integrity.
g) Staffing – Having a sufficient number of qualified and trained staff is essential for an investment firm to manage its electronic trading systems and algorithms. The investment firm should have proper training and recruitment schemes in place in order to employ staff who have the necessary expertise to manage, monitor and test the trading systems and algorithms and ensure compliance with the firm’s regulatory obligations.
h) Record keeping and co-operation – Investment firms should maintain records of their electronic trading systems, including information about key decisions, trading strategies and testing methodologies, for a minimum period of five years. Such records should contain sufficient detail to enable competent authorities to monitor the investment firm’s compliance with its obligations. The competent authorities should be kept informed about any significant risks that may affect the proper operation of the electronic trading systems and algorithms, and any incidents that occur.
Guideline 3. Organisational requirements for regulated markets and multilateral trading facilities to promote fair and orderly trading in an automated trading environment
Regulated markets and multilateral trading facilities ought to implement adequate rules and procedures for fair and orderly trading on their electronic markets which cater for the particular types of members or participants in the light of the nature and scale of trading on those markets. The rules and procedures of trading platforms should at least comprise the following:
a) Requirements for members or participants who are not credit institutions or investment firms – Applicants who are not credit institutions or investment firms under EU law should not be admitted as members of a trading platform unless adequate due diligence is carried out beforehand. Moreover, trading platforms should have organizational requirements and guidelines concerning the monitoring of trading and the management of risk which members who are not credit institutions or investment firms should fulfil.
b) IT compatibility – Standard conformance testing should be ensure that the systems which members and participants use to access the platform are compatible with the electronic trading system and would not disrupt trading activity on the platform.
c) Pre- and post-trade controls – Controls over the trading activities of members and users, such as controls on filtering order price, must be carried out by the trading platform, although members/participants are still bound to implement their own pre- and post-trade controls.
d) Trader access and knowledge – Trading platforms should enforce standards concerning the knowledge of persons within members/participants.
e) Limits to access and intervention on transactions – Trading platforms should make members/participants aware of the rules and procedures used to cancel, amend or correct a transaction, as well as for preventing access of a member or participant to their markets in whole or in part.
f) Trading platforms should adopt measures to cope with excessive flooding of the order book at any point in time, possibly by stipulating limiting the number of orders which each participant can place at a point in time.
g) In order to prevent the breach of capacity limits, trading platforms should implement adequate arrangements which should be made available to members and users. Prevention of capacity limits from being breached.
h) Measures to constrain or halt trading
Arrangements such as volatility interruptions or automatic rejection of orders exceeding pre-determined volume and price thresholds should be in force to maintain an orderly market. Members and users should be informed about such arrangements.
i) In order to monitor compliance with the relevant rules and procedures, trading platforms should be able to obtain the required information from members or users.
j) Monitoring – Employees of the trading platform should carry out monitoring of the markets close to real time as possible to detect signs of disorderly trading and take remedial action to safeguard fair and orderly trading.
k) Record keeping and co-operation
- Market operators and investment firms operating multilateral trading facilities are bound to keep detailed records of the above policies and procedures and of any related issues that arise for a minimum period of five years. Market operators operating regulated markets only need to maintain such records for such period as required by their home competent authority.
- Trading platforms should notify the competent authorities about major risks and actual incidents which impact orderly trading negatively.
Guideline 4. Organisational requirements for investment firms to promote fair and orderly trading in an automated trading environment
Investment firms must implement policies and procedures to ensure that their automated trading activities on trading platforms are in line with the relevant regulatory requirements and that the corresponding risks are properly managed. As a minimum, investment firms’ automated trading activities should tackle the following issues:
a) Price or size parameters
Orders which do not meet the pre-determined price or size parameters for the particular financial instrument should be automatically blocked. Checks could be conducted either or both on an order-by-order basis or over a specified period of time.
b) Permission to trade – investment firms should be in a position to automatically block or cancel orders for a financial instrument which a particular trader does not have authority to trade.
c) Risk management – orders which could compromise the investment firm’s own risk management thresholds should be automatically blocked or cancelled. Controls should be customised depending on the particular client the potential risks involved.
d) Consistency with the regulatory and legal framework – The investment firm’s electronic systems and the orders generated should not be in breach of the relevant applicable legislation or rules.
e) Reporting obligations to supervisory arrangements – Investment firms should notify the competent authorities of potential risks and major incidents that jeopardise fair and orderly trading.
f) Overriding of pre-trade controls – Orders which have been automatically blocked by the firm’s pre-trade controls, but which the firm wishes to submit nonetheless, should be dealt with according to predetermined procedures. The approval of compliance and risk management staff should be sought.
g) Training on order entry procedures – employees involved in order entry should be given proper training on order entry procedures and compliance imposed by trading platforms.
h) Monitoring and accessibility of knowledgeable and mandated staff – Investment firms should employ qualified staff to monitor the orders being set to trading platforms as close to real time as possible and remedy any disorderly trading. The firm’s Competent Authority and the trading platform should be able to communicate with such staff.
i) Close scrutiny by compliance staff – compliance staff should monitor closely the firm’s electronic activity to be able to correct any failures or regulatory infractions immediately.
j) Investment firms should be in control of messaging traffic to individual trading platforms.
k) Management of operational risk – investment firms should use appropriate governance arraignments, internal controls and internal reporting systems to manage operational risks in line with CEBS’ Guidelines on the Management of Operational Risk in Market-Related Activities.
l) IT compatibility – The systems which the investment firm utilises should be compatible with electronic trading systems of the trading platform it access to permit a minimum level of functionality.
m) Record keeping and cooperation - Investment firms are bound to keep detailed records of the above policies and procedures and of any related issues that arise for a minimum period of five years. Trading platforms should notify the competent authorities about major risks and actual incidents which have negative repercussions on fair and orderly trading.
Guideline 5. Organisational requirements for regulated markets and multilateral trading facilities to prevent market abuse (in particular market manipulation) in an automated trading environment
Trading platforms should implement effective arrangements and procedures in line with the relevant regulation in their Member State in order to identify conduct by their members/participants and users which could involve market abuse. Potential cases of market manipulation in an automated trading environment include:
Ping orders – entering small orders in order to ascertain the level of hidden orders.
Quote stuffing- entering large numbers of orders, cancellations and/or updates to cause disruption and camouflage their own strategy.
Momentum ignition – entering orders to start or intensify a trend to create an opportunity to unwind or open a position at an advantageous price.
Layering and Spoofing- submitting multiple orders following a particular trend with the intention of executing an opposite order, and then immediately withdrawing the manipulative orders.
Trading platforms should at least apply the following measures:
a) Staffing – Trading platforms should employ staff who are trained to monitor trading activity and identify potential market abuse.
b) Monitoring – The systems used by trading platforms should have the capacity to accommodate high frequency generation of orders and transactions. Furthermore, such systems should permit the detection of any behaviour by members/ participants and users involving market abuse, and make it possible to trace backwards orders entered or cancelled which raise suspicions of market manipulation.
c) Trading platforms should implement arrangements for the identification and reporting of suspicious transactions and orders to competent authorities without undue delays.
d) Reviews - Reviews and internal audits of procedures used to prevent and identify conduct which raises suspicions of market abuse should be undertaken periodically.
e) Record keeping – Detailed records of the above matters and audit trails of behaviour identified as suspicious should be kept for at least five years in the case of market operators and investment firms operating multilateral trading facilities. The duration of the record keeping obligations for market operators operating regulated markets varies depending on which is their home competent authority.
Guideline 6. Organisational requirements for investment firms to prevent market abuse (in particular market manipulation) in an automated trading environment
Investment firms should implement policies and procedures to reduce the risk that their automated trading activity leads to market abuse, in particular market manipulation. The main potential cases of market manipulation in a highly automated trading environment include ping orders, quote stuffing, momentum ignition and layering and spoofing. Investment firms should at least abide by the following minimum requirements:
a) Understanding, skill and authority of compliance staff – staff engaged in the compliance function should have adequate understanding both of regulation and trading activity, as well as skill and authority to challenge staff responsible for trading if there is a suspicion of market abuse.
b) Training in market abuse – Staff involved in executing orders on behalf of clients and individuals dealing on own account should be given regular training on what amounts to market abuse.
c) Monitoring activity – investment firms should have proper systems in place, including automated alert systems, to facilitate the monitoring of transactions as well as orders submitted, modified or cancelled and flag behaviour which raises suspicion of market abuse.
d) Investment firms should have arrangements for the identification and reporting of suspicious transactions and orders to competent authorities without undue delay. Where initial enquires are undertaken without finding a satisfactory explanation for the suspicious behaviour, a report should be made as quickly as possible.
e) Investment firms should undertake periodic reviews and internal audits of procedures and arrangements to prevent and identify instances of conduct that may involve market abuse.
f) Record keeping – Records of arrangements and procedures used to identify conduct which may involve market abuse should be kept for at least 5 years. Moreover, detailed records should also be kept relating to how alerts of potential suspicious behaviour are dealt with, irrespective of whether a report is made to the relevant competent authorities.
Guideline 7. Organisational requirements for regulated markets and multilateral trading facilities whose members/participants and users provide direct market access/sponsored access
It is possible for trading platforms to allow members/participants or users to provide direct market access/ sponsored access (DMA/SA). In such a scenario, the platforms should implement and enforce at least the following basic rules and procedures to ensure that the DMA/SA is compatible with fair and orderly trading and does not disrupt the smooth operation of the trading platform:
a) Ultimate responsibility for messages, including orders, and eventual interventions and sanctions – Trading platforms should clarify that a member/participant or user is solely responsible for all communication under its trading codes, and may be subject to interventions or sanctions in the event of any breaches.
b) Subsidiary responsibility when providing DMA/SA – DMA/SA providers should be held accountable to the trading platform for all trades using their market participant ID code or other identification.
c) Requirements for members/participants to provide DMA/SA – Trading platforms should require members/participants or users to implement adequate systems and effective controls to ensure that the provisions of DMA/SA does not jeopardise compliance with the relevant rules or lead to market abuse.
d) Members/participants should conduct due diligence on clients prior to provision of DMA/SA
e) Rights of access – trading platforms should retain the power to turn down a request from a member/participant to provide SA to a client if this would not be in line with its rules and procedures for fair and orderly trading.
f) Monitoring of orders – Trading platforms should monitor orders sent to their systems by a member/participants’ SA clients.
g) Potential interventions over SA – Trading platforms should retain the power to suspend or withdraw the SA if it is envisaged that the rules and procedures for fair and orderly trading will be breached. Unique customer IDs should be given to clients accessing the market via SA to enable the trading platform to stop orders from such persons separately from those of the member or participant providing the SA. The members’ or users’ internal risk control systems should also be subject to review by the trading platform.
h) Record Keeping – Trading platforms should retain detailed records of their policies and procedures relating to DMA/SA and any particular incidents relating to SA trading for 5 years.
Guideline 8. Organisational requirements for investment firms that provide direct market access and/or sponsored access
Investment firms which offer direct market access and/or sponsored access (DMA/SA) to clients should establish policies and procedures to ensure that the activities of such clients comply with the rules and procedures adopted by the relevant trading platforms. The following should be taken into account:
a) &nbs
