Regulatory Notice 15-09

Guidance on Effective Supervision and Control Practices for Firms Engaging in Algorithmic Trading Strategies

Published Date:

March 26, 2015

Equity Trading Initiatives: Supervision and Control Practices for Algorithmic Trading Strategies

Regulatory Notice
Notice Type Guidance	Suggested Routing Compliance Internal Audit Legal Operations Risk Senior Management Systems Technology Trading Training
Key Topics Algorithmic Trading Strategies High Frequency Trading Self-Trades Supervision Systems-Related Issues Trading Practices	Referenced Rules and Notices FINRA Rule 2010 FINRA Rule 3110 FINRA Rule 5210 FINRA Rule 6140 NTM 98-96 NTM 89-34 Regulatory Notice 14-10 SEC Regulation NMS SEC Regulation SCI SEC Regulation SHO SEA Rule 15c3-5 (Market Access Rule)

Executive Summary

As algorithmic trading strategies, including high frequency trading (HFT) strategies (hereinafter referred to collectively as "algorithmic strategies"), have grown to compose a substantial portion of activity on U.S. securities markets, the potential for these strategies to adversely impact market and firm stability has likewise grown. Although a reasonable supervision and control program may not foresee every potential failure or prevent every undesirable consequence, in an effort to reduce the future occurrence of such potential issues, FINRA is providing guidance on effective supervision and control practices for member firms and market participants that use algorithmic strategies. These effective practices are focused on five general areas: General Risk Assessment and Response; Software/Code Development and Implementation; Software Testing and System Validation; Trading Systems; and Compliance.

Questions concerning this Notice should be directed to:

• Susan Tibbs, Vice President, Quality of Markets, Market Regulation, at (240) 386-5082 or [email protected];

• Sherilyn Belcher, Director, Market Regulation, at (240) 386-5614 or [email protected]; or

• Brant K. Brown, Associate General Counsel, Office of General Counsel, at (202) 728-6927 or [email protected].

Background & Discussion

This Notice is one of seven FINRA initiatives relating to equity market structure and automated trading activities, including HFT.¹ These initiatives are designed to increase the scope of trading information FINRA receives, provide more transparency into trading activities to market participants and investors, and require firms engaged in electronic trading and their employees to be trained, educated and accountable for their role in equity trading.

As algorithmic strategies have grown to account for a substantial portion of activity on U.S. securities markets, the potential for such strategies to adversely impact market and firm stability has likewise grown. FINRA member firms that engage in algorithmic strategies are already subject to a number of existing SEC and FINRA rules governing their trading activities, including those listed below, as well as FINRA Rule 3110 (Supervision).² Thus, many existing requirements address the risks of, and impose obligations on, trading activity conducted by algorithmic strategies.

FINRA has long noted that, in addition to specific requirements imposed on trading activity, firms have a fundamental obligation generally to supervise their trading activity to ensure that the activity does not violate any applicable FINRA rule, provision of the federal securities laws or any rule thereunder.³ This would include, for example, ensuring that the firm's trading activity that uses algorithmic strategies complies with applicable rules and regulations, including:

• FINRA Rule 5210 (Publication of Transactions and Quotations): Rule 5210 provides that "no member shall publish or circulate, or cause to be published or circulated, any ...communication of any kind which purports to report any transaction as a purchase or sale of any security unless such member believes that such transaction was a bona fide purchase or sale of such security; or which purports to quote the bid price or asked price for any security, unless such member believes that such quotation represents a bona fide bid for, or offer of, such security." This rule prohibits activities such as fictitious quoting, spoofing and layering of quotes. In addition, Supplementary Material .02 to Rule 5210 requires firms to adopt policies and procedures regarding "self-trades," which are defined as "transactions in a security resulting from the unintentional interaction of orders originating from the same firm that involve no change in the beneficial ownership of the security."⁴ Under Rule 5210 and Supplementary Material .02, firms must have policies and procedures in place that are reasonably designed to review their trading activity for, and prevent, a pattern or practice of self-trades resulting from orders originating from a single algorithm or trading desk or from related algorithms or trading desks. Self-trades resulting from orders that originate from unrelated algorithms or separate and distinct trading strategies within the same firm are generally considered to be bona fide transactions.

• FINRA Rule 6140 (Other Trading Practices): Rule 6140 contains several provisions that were adopted to ensure the promptness, accuracy and completeness of last sale information and to prevent that information from being publicly trade reported in a fraudulent or manipulative manner. For example, Rule 6140(a) prohibits a firm from executing purchases of NMS stocks at successively higher prices (or sales at successively lower prices) for the purpose of creating or inducing a false, misleading or artificial appearance of activity in such security; unduly or improperly influencing the market price for such security; or establishing a price that does not reflect the true state of the market for such security.

• FINRA Rule 2010 (Standards of Commercial Honor and Principles of Trade): Rule 2010 requires firms, in the conduct of their business, to observe high standards of commercial honor and just and equitable principles of trade. These general requirements extend to any trading activity engaged in by the firm.

• SEC's Market Access Rule (Securities Exchange Act Rule 15c3-5): SEA Rule 15c3-5 requires brokers and dealers with market access,⁵ or that provide customers with market access, to establish, document and maintain a system of risk management controls and supervisory procedures that are reasonably designed to manage the financial and regulatory risks related to market access.⁶ A firm with market access is also required to establish, document and maintain a system for regularly reviewing the effectiveness of the risk management controls and supervisory procedures and for promptly addressing any issues.

• SEC Regulation NMS: Regulation NMS includes multiple provisions regarding the national market system that affect a firm's trading activity.⁷ For example, Rule 611, the Order Protection Rule, requires trading centers (e.g., national securities exchanges, ATSs, exchange and OTC market makers, and brokers or dealers that execute orders internally by trading as principal or crossing orders as agent) to establish, maintain and enforce written policies and procedures reasonably designed to prevent the execution of trades at prices inferior to protected quotations displayed by other trading centers, or, if relying on one of Rule 611's applicable exceptions, that are reasonably designed to assure compliance with the exception.⁸ Trading centers must surveil regularly to ascertain the effectiveness of their policies and procedures and take prompt action to remedy deficiencies. In addition, Rule 610, the Access Rule, includes provisions designed to prevent locked or crossed markets.⁹

• SEC Regulation SHO: Regulation SHO establishes a set of requirements regarding a firm's ability to sell securities short.¹⁰ For example, Rule 201(b)(1) requires that trading centers establish, maintain and enforce written policies and procedures reasonably designed to prevent the execution or display of a short sale order in a covered security that has declined 10 percent or more from the prior day's closing price at a price that is less than or equal to the current national best bid.¹¹ This prohibition remains in effect for the remainder of that trading day and the following trading day when a national best bid is calculated and disseminated on a continuing basis by a plan processor pursuant to an effective national market system plan.

With the occurrence of a number of market-impacting events related to technology issues in the past several years, the SEC, FINRA, other U.S. and foreign regulators, academics and commentators have focused on the issues of whether the current regulatory framework provides sufficient protection against the occurrence of technology failures by market participants, particularly where the failures can have a systemic impact on our highly automated and interconnected markets, and whether additional steps are necessary to mitigate the risks of the reoccurrence of such events in the future.¹² Most recently, the SEC adopted Regulation SCI with the stated intent of strengthening the technological infrastructure of key market participants. Although, as adopted, Regulation SCI applies primarily to self-regulatory organizations and alternative trading systems (ATSs) and not to broker-dealer algorithmic trading activity, the SEC stated that it could in the future seek comment on whether to expand the scope of Regulation SCI to include broker-dealer operations as well.¹³ The guidance in this Notice regarding firms' responsibilities for their algorithmic strategies is consistent with the SEC's fundamental approach in Regulation SCI of requiring that comprehensive policies and procedures be in place for certain technological systems and mandating the testing and review of those systems.

FINRA staff has conducted a number of examinations and investigations over the past several years that were prompted by the detection of systems-related issues at firms engaged in algorithmic strategies, and several of these investigations have resulted in settlements of formal actions. Among other things, these actions have noted that some firms lack appropriate supervisory controls and procedures related to the creation, modification, usage and testing of trading algorithms for such activity as wash sales and excessive levels of message traffic. As a result of these reviews and working with member firms engaged in algorithmic strategies, FINRA has developed the following list of suggested effective practices for such firms. These effective practices are focused on five main areas: General Risk Assessment and Response; Software/Code Development and Implementation; Software Testing and System Validation; Trading Systems; and Compliance.

As an initial matter, firms must have appropriate policies and procedures in place to review and test any trading algorithms they use, including development, deployment and post-implementation monitoring of algorithmic strategies. Although a reasonable supervision and control program will not foresee every potential failure or prevent every undesirable consequence, this Notice provides a list of effective supervision and control practices for firms that use algorithmic strategies that are based largely on FINRA staff's examination and investigative work related to algorithmic strategies. FINRA believes that firms' implementation of the suggested effective practices may help to reduce the future occurrence of unintended systems issues by firms engaging in algorithmic strategies; however, the list below is not intended to be an exhaustive list of steps firms should consider in conducting such activities. The suggested effective practices are largely drawn from discrete issues FINRA staff identified in connection with specific investigations and examinations. A firm's implementation of these effective practices in and of themselves would not necessarily suffice to satisfy its supervisory and other obligations that may arise under FINRA rules, the rules of other self-regulatory organizations, and SEC rules and regulations. In this regard, the effective practices below complement, rather than supplant, obligations firms have under existing or future rules and regulations, including those noted above.

Suggested Effective Practices for Firms Engaging in Algorithmic Strategies

I. General Risk Assessment and Response

As noted above, as the use of algorithmic strategies has increased, the potential of such strategies to adversely impact market and firm stability has likewise grown. When assessing the risk the use of algorithmic strategies creates, firms should undertake a holistic review of their trading activity and consider implementing a cross-disciplinary committee to assess and react to the evolving risks associated with algorithmic strategies.¹⁴ These committees are most effective when they include representation from areas outside of trading, such as those engaged in support and control types of functions within the firm.

II. Software/Code Development and Implementation

A firm's supervisory efforts should be focused on every stage in the process of developing algorithmic strategies and not be limited to reviewing trading activity by algorithmic strategies only after they have been put into production. Consequently, firms should also focus efforts on the development of algorithmic strategies and on how those strategies are tested and implemented. Firms should consider, for example:

• implementing a development and change management process that tracks the development of new trading code or material changes to existing code. An effective process should include a review of test results and a set of approval protocols that are appropriate given the scope of the code or any change(s) to the code.¹⁵

• monitoring activity to assure that algorithm development and change procedures are followed.

• employing redundant or multiple system validations before introducing new or materially changed code into production.

• archiving code versions in a retrievable manner for a period of time that is reasonable in view of the firm's size and the complexity of its algorithmic trading program.

• maintaining, at a minimum, a basic summary description of algorithmic strategies that enables supervisory, compliance and regulatory staff to understand the intended function of an algorithm without the need to resort, as an initial matter, to direct code review.

• providing mechanisms by which the firm may quickly disable the algorithm or supporting platform with a minimal number of steps.

• when implementing controls, account where necessary for the particular type or location of hardware as well as an algorithm's destination trading center. For example, if the hardware is co-located with a specific trading center or the code is targeted toward an individual trading center, or specific order types offered only through an individual trading center, it may call for different controls than code or hardware that can be used for multiple trading centers.

• where feasible, deploying new algorithmic strategies in a pilot phase of limited size, increasing only as results are confirmed.

• when deploying new code, maintaining heightened scrutiny of the impacted trading account, including real-time monitoring of the subject algorithmic strategy.

III. Software Testing and System Validation

Testing of algorithmic strategies prior to being put into production is an essential component of effective policies and procedures. When developing their policies and procedures around testing and system validations, firms should consider:

• conducting testing to confirm that core code components operate as intended and do not produce unintended consequences. To the extent practicable, firms should consider the profile of the subject security, market and the existence of adverse or fast market conditions.

• establishing a quality assurance process such that testing is performed independently of code development.

• implementing and periodically evaluating test controls to confirm their adequacy and reliability.

• implementing data integrity, accuracy and workflow validation testing processes.

• maintaining a record of testing protocols and results, as well as the remediation of identified significant code defects.

• conducting any significant testing in a development environment that is segregated from production.

IV. Trading Systems

A firm's supervisory obligations continue after any algorithmic strategy is put into production. Consequently, firms should develop their policies and procedures to include review of trading activity after an algorithmic strategy is in place or has been changed. Firms should consider:

• implementing controls, monitors, alerts and reconciliation processes that enable the firm to quickly identify whether an algorithm is experiencing unintended results that may indicate a failure at the firm or in the market.

• periodically evaluating the firm's controls and associated policies and procedures to assure that they remain adequate to manage access and changes to the firm's infrastructure including, but not limited to, the hardware, connectivity, and algorithms.

• implementing a protocol to track and record significant system problems.

• documenting and periodically reviewing parameter settings for the firm's risk controls, and making any parameter changes deemed appropriate.

• implementing checks on downstream market impacts.¹⁶

• making system capacity scalable to the extent a firm anticipates growth and peak levels of market activity such as messaging volume.

• implementing security measures to limit code access and control system entitlements.

• placing appropriate controls and limitations on a trader's ability to overwrite or otherwise evade system controls.

• implementing controls to manage outbound message volume via threshold parameters.

V. Compliance

Ensuring that there is effective communication between compliance staff and the staff responsible for algorithmic strategy development is a key element of effective policies and procedures. To that end, firms should consider:

• developing compliance monitoring tools that are broad enough in scope to include activity that may result from the interaction of multiple algorithms (e.g., wash sales, self-trades, manipulation).

• providing for adequate communication between supervisory and compliance staff related to the function and control of algorithms such that the firm meets its regulatory obligations.

• implementing periodic training for supervisory and compliance staff related to the firm's policies and procedures regarding algorithmic strategies.

• conducting periodic evaluations of compliance tools and updating those tools as appropriate.

• conducting periodic reviews of the adequacy of staffing levels and expertise for responding to regulatory inquiries and conducting surveillance of the firm's activities to monitor for compliance with applicable self-regulatory organization rules and federal securities laws.

• implementing controls, monitoring tools and alerts to address the operation and financial risks of algorithmic strategies and aggregate firm activity, and periodically evaluating the supervisory framework in light of current market conditions.

¹See FINRA's September 19, 2014, News Release "FINRA Board Approves Series of Equity Trading and Fixed Income Rulemaking Items."

² Effective December 1, 2014, NASD Rule 3010 was moved into the Consolidated FINRA Rulebook as FINRA Rule 3110. See Regulatory Notice 14-10 (March 2014).

³See, e.g., Notice to Members 98-96 (December 1998) (outlining minimum standards that the written supervisory procedures and supervisory systems of firms engaged in market-making activities must meet); Notice to Members 89-34 (April 1989) (noting that a firm's "supervisory system must cover all aspects of the firm's investment banking and securities business, including back office; corporate financing; trading activity;" and other types of activity).

⁴ For a full discussion of Supplementary Material .02, see Regulatory Notice 14-28 (June 2014). Wash sales (i.e., trading involving no change in beneficial ownership that is intended to produce the false appearance of trading) continue to be strictly prohibited under both the federal securities laws and FINRA rules. See, e.g., 15 U.S.C. 78i(a)(1); FINRA Rule 6140(b).

⁵ The term "market access" is defined as access to trading in securities (i) on an exchange or alternative trading system (ATS) as a result of being a member or subscriber of the exchange or ATS or (ii) on an ATS provided by a broker-dealer operator of an ATS to a non-broker-dealer. The term includes not only sponsored access and direct market access, but also includes access to trading for proprietary accounts or more traditional agency trading activities. See 17 CFR 240.15c3-5(a)(1).

⁶See 17 CFR 240.15c3-5.

⁷See 17 CFR 242.600 et seq.

⁸See 17 CFR 242.611.

⁹See 17 CFR 242.610.

¹⁰See 17 CFR 242.200 et seq.

¹¹See 17 CFR 242.201(b)(1). The prior day's closing price is determined as of the end of the prior day's regular trading hours on the security's listing market. See 17 CFR 242.201(b)(3).

¹² Among the many efforts in this regard are the following. The SEC hosted a roundtable entitled Technology and Trading Roundtable: Promoting Stability in Today's Markets in October 2012, and, in November 2014, the SEC adopted Regulation Systems Compliance and Integrity (Regulation SCI). See Securities Exchange Act Release No. 73639 (November 19, 2014), 79 FR 72252 (December 5, 2014). A transcript of the SEC roundtable is available at http://www. sec.gov/news/otherwebcasts/2012/ttr100212- transcript.pdf. In September 2013, the CFTC approved for publication Concept Release on Risk Controls and System Safeguards for Automated Trading Environments setting forth a series of proposed risk controls for participants in the futures markets. See Commodity Futures Trading Commission Release, 78 FR 56542 (September 12, 2013). The CFTC reopened the comment period for this CFTC Concept Release on January 21, 2014, through February 14, 2014. See Commodity Futures Trading Commission Release, 79 FR 4104 (January 24, 2014). The Federal Reserve Bank of Chicago conducted a survey of how HFT firms control risks. See Carol Clark and Rajeev Ranjan, How Do Proprietary Trading Firms Control the Risks of High Speed Trading? March 2012. A working group has written a proposal for the adoption of an ISO 9000-like standard for firms engaged in HFT. See Ben Van Vliet et al., The Rationale for HFT 9000: An ISO 9000-style Quality Management System for High Frequency Trading, August 2012. In October 2012, the Foresight Programme of the UK Government Office for Science released its final report relating to potential measures to be taken as a consequence of the growth of computerized trading in the financial markets. See Government Office for Science, London, Foresight: The Future of Computer Trading in Financial Markets (2012). The European Securities Markets Association (ESMA) issued guidelines for entities engaged in automated trading. See ESMA, Guidelines on systems and controls in an automated trading environment for trading platforms, investment firms, and competent authorities, December 2011. In November 2010, the FIA Principal Traders Group issued a series of recommendations for risk controls over electronic trading. See FIA Principal Traders Group, Recommendations for Risk Controls for Trading Firms, November 2010.

¹³See Securities Exchange Act Release No. 73639 (November 19, 2014), 79 FR 72252 (December 5, 2014).

¹⁴ Although cross-disciplinary committees may help firms with their compliance efforts regarding algorithmic strategies, committees should not take the place of oversight of these strategies by appropriately registered personnel of the firm.

¹⁵ While the application of these effective practice suggestions may vary greatly across firms, it is generally appropriate to give greater focus to material code portions and system functions.

¹⁶ While not an exhaustive list, particular consideration should be given to monitoring for activity such as messaging volume, order looping, and matched or wash trades.