ASIC RG 241 — ASIC Regulatory Guide – RG 241 Electronic trading

Page 1 REGULATORY GUIDE 241 Electronic trading August 2022 About this guide This guide is for trading participants of the markets operated by ASX Limited, Cboe Australia Pty Ltd, National Stock Exchange Australia Limited and Sydney Stock Exchange Limited that use or intend to use their systems for automated order processing, including use in relation to a crossing system. It gives guidance on how trading participants can comply with their obligations under the ASIC Market Integrity Rules (Securities Markets) 2017 that apply to the use of automated order processing. Note: From 27 July 2020, applications for relief should be submitted through the ASIC Regulatory Portal. For more information, see how you apply for relief. Page 2 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 2 About ASIC regulatory documents In administering legislation ASIC issues the following types of regulatory documents. Consultation papers: seek feedback from stakeholders on matters ASIC is considering, such as proposed relief or proposed regulatory guidance. Regulatory guides: give guidance to regulated entities by:  explaining when and how ASIC will exercise specific powers under legislation (primarily the Corporations Act)  explaining how ASIC interprets the law  describing the principles underlying ASIC’s approach  giving practical guidance (e.g. describing the steps of a process such as applying for a licence or giving practical examples of how regulated entities may decide to meet their obligations). Information sheets: provide concise guidance on a specific process or compliance issue or an overview of detailed guidance. Reports: describe ASIC compliance or relief activity or the results of a research project. Document history This guide was issued in August 2022 and is based on the legislation and regulations as at the date of issue. The note on the front page was inserted on 27 July 2020. Previous versions:  Superseded Regulatory Guide 241, issued November 2012, reissued August 2013, November 2015 and May 2018 Disclaimer This guide does not constitute legal advice. We encourage you to seek your own professional advice to find out how the Corporations Act and other applicable laws apply to you, as it is your responsibility to determine your obligations. Examples in this guide are purely for illustration; they are not exhaustive and are not intended to impose or imply particular rules or requirements. Page 3 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 3 Contents A Overview ........................................................................................... 4 ASIC’s market supervision role ......................................................... 4 Who must comply with market integrity rules relating to AOP?......... 4 Scope of this regulatory guide ........................................................... 5 Key concepts ..................................................................................... 5 Notifications to ASIC .......................................................................... 8 Other relevant guidance .................................................................... 8 B Requirements for AOP .................................................................... 9 Automated filters .............................................................................. 10 Trading management arrangements ............................................... 14 Organisational and technical resources .......................................... 16 Security arrangements..................................................................... 18 Responsible use of AOP.................................................................. 18 Documentation ................................................................................. 24 Testing ............................................................................................. 26 ASIC direction to cease, suspend, limit or prohibit AOP ................. 28 C Access by authorised persons .................................................... 29 Authorised persons .......................................................................... 29 Policies and procedures .................................................................. 30 Agreements between trading participants and authorised persons 31 D Review and certification of documentation and systems ......... 32 Initial review and certification ........................................................... 32 Review of material changes............................................................. 35 Annual review and notification ......................................................... 39 Further certification .......................................................................... 41 Appropriately qualified persons/suitably qualified persons.............. 41 Appendix: Sample representations ..................................................... 43 Schedule A: Organisational and technical resources ...................... 43 Schedule B: Trading management arrangements ........................... 43 Schedule C: Security arrangements ................................................ 44 Schedule D: Controls for suspension, limitation or prohibition of AOP ............................................................................................. 44 Schedule E: Controls for suspension, limitation or prohibition of trading messages ............................................................................ 44 Schedule F: Direct control over filters and filter parameters ........... 45 Schedule G: Certification methodology ........................................... 45 Key terms ............................................................................................... 46 Related information ............................................................................... 50 Page 4 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 4 A Overview Key points This regulatory guide contains guidance on how a trading participant of a market operated by ASX Limited (ASX), Cboe Australia Pty Ltd (Cboe), National Stock Exchange of Australia Limited (NSXA) or Sydney Stock Exchange Limited (SSX) can comply with the automated order processing (AOP) obligations in the ASIC Market Integrity Rules (Securities Markets) 2017. ASIC’s market supervision role RG 241.1 We have responsibility for supervising trading on domestic licensed markets and participants of licensed markets. RG 241.2 As part of our supervisory role, we are able to make market integrity rules under Pt 7.2A of the Corporations Act 2001 (Corporations Act) dealing with activities and conduct in relation to licensed financial markets, including the activities and conduct of the participants of those markets. RG 241.3 The ASIC Market Integrity Rules (Securities Markets) 2017 set out market integrity rules relating to automated order processing (AOP), among other things. The rules and this regulatory guide use a number of key concepts and terms reflecting the steps, processes and components of electronic trading. Note: In this regulatory guide, ‘Securities Markets Rules’ refers to the ASIC Market Integrity Rules (Securities Markets) 2017. RG 241.4 We refer to AOP, designated trading representatives (DTRs), automated client order processing (ACOP)—also referred to as direct electronic access (DEA)—algorithmic programs and filters. These terms are described and where applicable illustrated in Figure 1 under ‘Key concepts’ and at RG 241.10–RG 241.23. Note: For the purposes of this guide, ‘electronic trading’ includes algorithmic programs, AOP, ACOP and DEA. Who must comply with market integrity rules relating to AOP? RG 241.5 Participants of the ASX, Cboe, NSXA and SSX markets must comply with the Securities Markets Rules, including rules relating to AOP. Page 5 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 5 Scope of this regulatory guide RG 241.6 This regulatory guide gives guidance on a trading participant’s obligations under the Securities Markets Rules when it uses an AOP system, including using an AOP system to transmit orders to a crossing system. It covers: (a) requirements for AOP (see Section B); (b) access by authorised persons (see Section C); and (c) review and certification of documentation and systems (see Section D). Note: Part 5.6 of the Securities Markets Rules includes rules for AOP that specifically refer to crossing systems: Rules 5.6.1(b)(iii), 5.6.3(1)(e)(iii) and 5.6.3(1)(e)(iv). RG 241.7 Where appropriate, this guide incorporates aspects of OLD ASX Guidance Notes 19, 21 and 22. Those ASX guidance notes are superseded by this regulatory guide. RG 241.8 This guide is not exhaustive in terms of the arrangements that a trading participant could implement to ensure ongoing compliance with its AOP obligations. The arrangements a trading participant puts in place should be tailored to and implement technology reflective of the nature, scale and complexity of the trading participant’s trading through its AOP system. Key concepts RG 241.9 The interaction between AOP, ACOP and the market is illustrated in Figure 1. Figure 1: Automated order processing and direct electronic access Note: See RG 241.10–RG 241.23 for the processes set out in this flowchart (accessible version). Automated order processing (AOP) RG 241.10 ‘Automated order processing’ (AOP) is the process by which orders are registered in a trading participant’s trading system and, if accepted for AOP (trading participant’s order management system and market access) Market ACOP 1 uses tradingDEA client participant’s systems Client managed orders Trading participant principal and agency managed orders ACOP 2 DEA client uses own system (vendor or bespoke) Page 6 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 6 submission into a trading platform by the trading participant, submitted as corresponding trading messages without being ‘keyed’ or ‘re-keyed’ by a DTR: see RG 241.13. ‘Trading messages’ are messages relating to trading functions (such as orders), amendment or cancellation of orders, and reporting or cancellation of transactions: Rule 1.4.3. RG 241.11 The concept of being ‘keyed’ or ‘re-keyed’ is critical to the distinction between manual processing and AOP. An order is not an AOP order where a DTR is required to exercise discretion and ‘key’ or ‘re-key’ an order into a trading platform of a particular market operator after registration (including creation) in a trading participant’s AOP system. RG 241.12 Where a DTR submits an order into a trading participant’s trading system but a routing decision is subsequently made by that system, the order would be considered an AOP order rather than a DTR order. DTRs and AOP RG 241.13 A trading participant must ensure that all trading in a trading platform is carried out either by a DTR, or in accordance with the AOP requirements in Part 5.6 of the Securities Markets Rules: Rules 2.5.1 and 2.5.3. A DTR is a representative of the trading participant who has been authorised by the trading participant to submit trading messages to the trading platform on behalf of the trading participant and who meets the criteria in Rule 2.5.5. RG 241.14 A representative of a trading participant that is authorised as a DTR under Part 2.5 may also act in the capacity of an authorised person by submitting trading messages to the trading platform through an AOP system and in accordance with the AOP requirements: see RG 241.12 and Section C of this guide. Automated client order processing (ACOP) RG 241.15 ‘Automated client order processing’ (ACOP) is AOP for an order submitted by an ‘authorised person’ (being a client, or an agent of a client, of a trading participant) into the trading participant’s trading system, as distinct from AOP for an order submitted by the trading participant as principal: Rule 1.4.3. RG 241.16 ACOP is commonly referred to in International Organization of Securities Commissions (IOSCO) documents as direct electronic access (DEA) or direct market access (DMA). Note: See IOSCO Report, Principles for direct electronic access to markets (PDF 444 KB) (IOSCOPD332), Technical Committee of IOSCO, 12 August 2010. RG 241.17 When using ACOP, an authorised person may use either: (a) the trading participant’s order management system and algorithmic programs to manage and generate orders (described as ‘ACOP 1’ in Figure 1); or Page 7 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 7 (b) their own systems or programs (including third-party vendors) that are connected to the trading participant’s AOP system (described as ‘ACOP 2’ in Figure 1). RG 241.18 ACOP enables an authorised person to access a market through a trading participant without itself being a trading participant and, therefore, without being subject to the market integrity rules and operating rules of that market. Algorithmic programs RG 241.19 AOP systems may use algorithmic programs to generate trading messages in, or through, those systems. For the purpose of this guide, ‘algorithmic programs’ are automated strategies using programmable logic, system- generated (rather than human-generated) messages based on a set of predetermined parameters, logic rules and conditions. These programs include algorithmic trading, automated order generation and automated/smart order routing. RG 241.20 Algorithmic programs are discussed in more detail at RG 241.98– RG 241.102. Filters RG 241.21 ‘Filters’ are a set of rules that apply in an AOP system that determine automatically which trading messages (or series of related trading messages) meet a pre-defined set of criteria and can pass into a trading platform. RG 241.22 ‘Filter parameters’ are the variables within each filter that can be changed to modify the operation of the filter without changing the rule to which the filter applies. The filter parameters result in trading messages being handled differently according to factors such as, for example, the type, source, size or price of an order, or its relationship with other orders. A filter parameter may apply at a number of different levels (e.g. to particular financial products, representatives, authorised persons or clients, or to a dollar value level). RG 241.23 Filters and filter parameters are discussed in more detail at RG 241.33– RG 241.46. Crossing systems RG 241.24 ‘Crossing systems’ are automated services provided by a trading participant that match or execute client orders otherwise than on an order book of a licensed market, with orders of: (a) the participant; (b) other clients of the trading participant; or (c) any other person whose orders may access the crossing system. Page 8 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 8 RG 241.25 Crossing systems are discussed further at RG 241.104 and in Section I of Regulatory Guide 265 Guidance on ASIC market integrity rules for participants of securities markets (RG 265). Notifications to ASIC When to notify ASIC RG 241.26 To meet its obligations for each AOP system, a trading participant must provide ASIC with certifications and notifications: see Section D. RG 241.27 These include: (a) initial review and certification (see RG 241.144–RG 241.165); (b) annual review and notification (see RG 241.182–RG 241.195); and (c) further certification (as required by ASIC) (see RG 241.196– RG 241.197). How to notify ASIC RG 241.28 The required certifications or notifications should be submitted using the relevant form on the ASIC Regulatory Portal. If you encounter issues while using the ASIC Regulatory Portal, contact market.participants@asic.gov.au. Other relevant guidance RG 241.29 This guide should be read in conjunction with other regulatory guides on market integrity rules and other obligations for market operators and trading participants: see Table 1. Table 1: Related guidance ASIC regulatory guide What it covers Regulatory Guide 172 Financial markets: Domestic and overseas operators (RG 172) Our expectations for market operator systems and controls: Part 2 of RG 172 Regulatory Guide 216 Markets Disciplinary Panel (RG 216) The disciplinary process for breaches of all ASIC market integrity rules, and the policies that the MDP will take into account when making decisions about alleged contraventions of the market integrity rules Regulatory Guide 265 Guidance on ASIC market integrity rules for participants of securities markets (RG 265) Guidance on the Securities Markets Rules and ASIC Market Integrity Rules (Capital) 2021 Regulatory Guide 266 Guidance on ASIC market integrity rules for participants of futures markets (RG 266) Guidance on ASIC Market Integrity Rules (Futures Markets) 2017 and ASIC Market Integrity Rules (Capital) 2021 Page 9 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 9 B Requirements for AOP Key points A trading participant that uses its system for AOP must: • have appropriate automated filters for AOP, including processes for recording any changes to, and having direct control over, automated filters and filter parameters; • have in place trading management arrangements, including arrangements to determine and log the origin and ownership of orders and trading messages, sufficient system capacity and adequate business continuity, backup and disaster recovery plans; • have in place organisational and technical resources to ensure it can comply with its obligations for trading through AOP; • have in place security arrangements to monitor and prevent unauthorised access to the system; • meet other requirements for responsible use of AOP, including monitoring trading through AOP in real time or close to real time, exception and post-trade analysis, managing particular financial and trading risks, and having adequate resources to manage change; • have and review policies and procedures for compliance with Part 5.6 and appropriate system design documentation; • have appropriate arrangements for testing its AOP filters, filter parameters, controls and systems; and • immediately comply with any direction from ASIC to cease, suspend, limit or prohibit AOP. RG 241.30 AOP systems can improve the speed and efficiency with which a trading participant routes and executes orders. However, the use of AOP systems can also result in increased risks to the efficiency and integrity of a market or a crossing system operated by a trading participant, as well as financial, reputational and regulatory risks for the trading participant. RG 241.31 Part 5.6 of the Securities Markets Rules imposes obligations on trading participants that seek to mitigate the risks posed by AOP systems, in particular the risks to the efficiency and integrity of the market or of a crossing system operated by a participant. The rules in Part 5.6 are specific to AOP systems, and build on the general obligations in Part 5.5, which require a trading participant to have organisational and technical resources and trading management arrangements in relation to the use of its trading infrastructure as a whole. Note: Part 5.6 of the Securities Markets Rules imposes obligations on a trading participant that operates a crossing system. Page 10 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 10 RG 241.32 This section covers requirements for AOP relating to: (a) automated filters; (b) trading management arrangements; (c) organisational and technical resources; (d) security arrangements; (e) responsible use of AOP; (f) documentation; (g) testing arrangements; and (h) directions from ASIC to cease, suspend, limit or prohibit AOP. Automated filters RG 241.33 The requirement to have appropriate automated filters is fundamental to the obligations imposed on trading participants under Part 5.6. Automated filters are referred to in: (a) Rule 5.6.1(a), which requires a trading participant that uses its system for AOP to at all times have appropriate automated filters for AOP; (b) Rules 5.6.3(1)(a) and 5.6.3(1)(b), which require a trading participant to have appropriate automated filters as part of its organisational and technical resources and trading management arrangements; and (c) Rule 5.6.3(2), which requires a trading participant to have direct control over its automated filters and the filter parameters for those filters. RG 241.34 Filters and filter parameters are pre-trade controls and the principal means by which trading messages are checked to ensure they will not interfere with the efficiency or integrity of the market or the proper functioning of any trading platform. Note: For the definitions of ‘filters’ and ‘filter parameters’, see RG 241.21–RG 241.23. RG 241.35 Filters establish points at which trading messages are tested and, by exception, action other than passing them directly into the market is taken. In practical terms, an automated filter can usually do one of four things in relation to any given trading message (depending on the settings of the filter parameters): (a) pass the trading message into the market; (b) pass the trading message into the market but identify it as an exception on exception reports generated by the system for subsequent analysis; (c) pass the trading message to a designated trading representative (DTR) for review and a decision as to whether the trading message may be submitted; or (d) reject the trading message outright. Page 11 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 11 RG 241.36 We recognise that, given the differences in types of business conducted by trading participants, there must be some degree of flexibility in determining what constitutes ‘appropriate’ filters for each trading participant. The types of filters will depend on the trading participant’s system capabilities; the nature, scale and complexity of its business; and the particular risks that the trading participant has assessed as relevant to that business (including financial, reputational and regulatory risks: see RG 241.88–RG 241.89). RG 241.37 Where a trading participant provides ACOP access to clients, the trading participant should have an adequate understanding of its clients’ business. The filters and controls for the client’s access should reflect the nature of the business. RG 241.38 Where a trading participant operates a crossing system, Rule 5.6.1(b)(iii) requires a trading participant to have in place appropriate filters in relation to AOP to ensure that orders entering the crossing system do not interfere with the efficiency and integrity of the crossing system. RG 241.39 We expect that for the purposes of Rules 5.5.2, 5.6.1 and 5.6.3(1)(a), a trading participant will have in place filters that minimise the opportunity for erroneous orders to be entered in the market, as such orders may interfere with the efficiency and integrity of the market or the proper functioning of a trading platform. RG 241.40 An ‘erroneous order’ is an order that is submitted in error or that contains an error in one of its attributes (e.g. the price or volume of the order does not reflect the price or volume at which the trading participant or its client intended to trade). RG 241.41 In an AOP environment, an erroneous order may be caused by, for example: (a) a mistake in, or incorrect context used for, any parameter of instruction placed by an authorised person (e.g. entering the wrong price, or entering the volume into the price field), or a mistake in the handling of an instruction by an order management system; (b) corruption of data when the order is transmitted to, or interpreted by, a system; or (c) duplication, or loss, of a trading message. RG 241.42 Market operators must have in place controls for equity market products and CGS depository interests to filter anomalous orders and manage extreme price movements: see Chapter 8 of the Securities Markets Rules and Section O of RG 172. These controls may complement the controls a trading participant may have in place. However, a trading participant cannot rely on a market operator’s controls to comply with its obligations under the Securities Markets Rules, including those outlined in this guide. Page 12 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 12 Processes to record any changes to the filters or filter parameters RG 241.43 A trading participant must have processes to record any changes to the filters or filter parameters: Rule 5.6.3(1)(a). We expect a trading participant, in complying with this rule, to have an ongoing audit and review function that will capture and record any changes to the filters or filter parameters. This includes intra-day changes to the filter parameters and changes made by authorised persons: see Section C of this guide. RG 241.44 A trading participant should be able to control, monitor and reconstruct (i.e. for information purposes) any changes to systems, filters or parameters within an AOP system. A trading participant should be able to identify which filters are activated and which are not activated at any point in time. We expect a trading participant to have in place procedures such that changes to filters and filter parameters at the ‘administrator’ level can be implemented only after they are authorised by a qualified person (e.g. a person with relevant experience in broking operations, operational management or compliance). RG 241.45 We expect a trading participant to demonstrate in the documentation that accompanies its initial certification under Rule 5.6.6 (see Section D of this guide) that it has in place processes to record any changes to the filters or filter parameters. We would not accept that an AOP system complies with Rules 5.5.2 and 5.6.3 where there are poor processes and internal controls over changes to filters, filter parameters and exception reports, or where filters, filter parameters and exception reports could be deactivated. RG 241.46 Any material changes to the filters will also be subject to a review of material changes in accordance with Rule 5.6.8: see Section D. Direct control over automated filters and filter parameters RG 241.47 A trading participant that uses its system for AOP must at all times have direct control over its automated filters and the filter parameters: Rule 5.6.3(2). RG 241.48 We expect a trading participant to have direct control over the application of the filters and filter parameters at the ‘administrator’ level. This means that a trading participant must have direct control over whether the filter is activated or deactivated in the AOP system, and over any changes to the filter parameters. However, a trading participant may allow a person some discretion to change the filter parameters at the ‘user’ level, within a defined range. RG 241.49 Where the trading participant relies on filters that are outside its AOP system (e.g. where the filter sits between the market operator and trading participant or with an independent third-party provider, or within another AOP system belonging to the trading participant), the trading participant must ensure that the activation or deactivation of the filter, and changes to the filter parameters, are only made with the authorisation of a qualified person of the trading Page 13 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 13 participant (e.g. a person with relevant experience in broking operations, operational management or compliance). RG 241.50 An example of where we would not consider that a trading participant has direct control over filters and changes to filter parameters is where there is no ‘administrator level’ control or where changes at this level are made by the client (or, if the client’s order management system is operated by a related party of the client, by that related party) and merely copied over to the trading participant for authorisation or information purposes. RG 241.51 Access arrangements where an authorised person deals directly on a market through a trading participant but independent of the trading participant’s controls, such as a sponsored access arrangement, are not permitted under Rule 5.6.3 (when read in conjunction with Rule 5.5.1). Controls for suspending, limiting or prohibiting AOP RG 241.52 A trading participant which uses its system for AOP must ensure that the system has in place controls, including automated controls, that enable immediate suspension, limitation or prohibition of the conduct of all AOP, AOP in respect of ACOP, or AOP in respect of one or more authorised persons, clients, financial products or markets: Rule 5.6.3(1)(d). RG 241.53 We would expect a trading participant to rely on these automated controls to suspend, limit or prohibit AOP when the trading participant has identified, for example, that trading messages from a particular source (e.g. a particular authorised person, account or algorithm) are interfering with the efficiency or integrity of the market or do not comply with the AOP requirements. RG 241.54 The automated controls required by Rule 5.6.3(1)(d) may include: (a) termination of an AOP system (referred to as a ‘kill switch’); (b) shutdown of a responsible AOP subsystem; (c) forced logout of an authorised person; or (d) a control implemented by amending the parameters of a particular filter to zero or a level that would prevent further trading. Controls for suspending, limiting or cancelling trading messages RG 241.55 A trading participant that uses its system for AOP must also ensure the system has in place controls that enable immediate: (a) suspension, limitation or prohibition of the entry of trading messages into a market and orders into a crossing system where the trading participant has identified that the trading messages or orders in the series have entered the market or crossing system and have interfered with, or are likely to interfere with, the efficiency or integrity of the market or crossing system (Rules 5.6.3(1)(e)(i) and 5.6.3(1)(e)(iii)); and Page 14 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 14 (b) cancellation of trading messages in a series that have already entered the market and cancellation of orders in a series that have already entered a crossing system, where the entry of further trading messages or orders in the series have been suspended, limited or prohibited under Rules 5.6.3(1)(e)(i) or 5.6.3(1)(e)(iii) (Rules 5.6.3(1)(e)(ii) and 5.6.3(1)(e)(iv)). RG 241.56 For the purposes of Rule 5.6.3, trading messages and orders may be part of a series where they are generated by a common user, account or algorithm and occur in close succession. RG 241.57 We understand it may be difficult for a trading participant to test the effect trading messages and orders, or a series of trading messages and orders, may have on the market or crossing system before they are submitted to the market or crossing system. For example, trading messages, orders, or a series of trading messages or orders, may not necessarily affect the last traded price of a product, but may affect the depth of the order book in that product and give rise to a false and misleading appearance of active trading in the product. RG 241.58 A trading participant must have in place controls so that once it has identified, through its monitoring arrangements (see RG 241.81–RG 241.87), a series of trading messages that are having or are likely to have an impact on a market, or a series of orders that are having or are likely to have an impact on a crossing system, it can suspend (i.e. isolate for review), limit or prohibit further entry of the orders or trading messages and cancel any that have already entered the market or crossing system. Trading management arrangements RG 241.59 Under Rule 5.5.3, a trading participant must have in place arrangements so that at all times the trading participant can determine the origin of all orders and trading messages, including: (a) the different stages of processing each order (regardless of whether a trading message is generated) and the time at which each stage of processing occurred; (b) the order that corresponds to a trading message; (c) the identity and capacity of the person placing the order (e.g. whether acting as agent or principal); (d) whether the trading message was the result of AOP; (e) the open interface device (i.e. the electronic protocol and message structure used to access the trading platform) and computer (or other device of the trading participant connected to an open interface device of the trading participant) through which the trading message was submitted; Page 15 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 15 (f) the DTR responsible for the open interface device or computer or other device connected to the open interface device (unless the trading message was the result of AOP); and (g) whether the trading message was submitted on the trading participant’s own account or for a client. RG 241.60 A trading participant must maintain records of the matters referred to in Rule 5.5.3 for a period of seven years from the date of the trading message to which the matters relate: Rule 5.5.4. RG 241.61 Under Rule 5.6.3(1)(b), a trading participant that uses its system for AOP must ensure that the system has trading management arrangements, including appropriate automated filters, filter parameters and processes to record any changes to the filters or filter parameters to enable the ready determination of the origin of all orders and trading messages. We consider this to mean that all AOP systems must have the capacity to capture the information required by Rule 5.5.3. Capacity RG 241.62 As part of its trading management arrangements, a trading participant should have sufficient AOP system capacity to accommodate reasonably foreseeable volumes of trading activity. We expect a trading participant to have in place arrangements to prevent capacity limits on messaging from being breached. RG 241.63 Trading participants should keep capacity requirements under review and conduct capacity stress tests regularly. A trading participant’s systems should be scalable to allow for changes in response to elevated message levels and/or stressed market conditions that might breach their capacity. Business continuity RG 241.64 As part of its trading management arrangements, a trading participant should have adequate business continuity, backup and disaster recovery plans for each of its systems that support order entry, order routing, execution and trade reporting. These plans should reflect the nature, scale and complexity of the trading participant’s businesses, including ensuring there is sufficient system capacity. For example, a trading participant with a smaller, less complex business may rely on another trading participant or the market operator to provide aspects of its business continuity, backup and disaster recovery arrangements. Other trading participants, such as those with substantial client commitments or market makers that are subject to minimum quoting requirements, will be likely to require arrangements that are tailored for their business. Page 16 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 16 RG 241.65 Trading participants should have adequate arrangements to ensure timely access to skilled and knowledgeable internal and vendor technical support for their specific AOP system configurations, particularly while implementing AOP system changes. RG 241.66 Trading participants must also establish, implement and maintain business continuity plans for effectively responding to a major event. A major event is an event that would or would be likely to cause significant disruption to a trading participant’s operations or materially affect their services: Part 8B.4 of the Securities Markets Rules. RG 241.67 A major event may include the failure of a critical business service such as a system that supports order entry, order routing, execution and trade reporting, or an event such as a pandemic, natural disaster, cyber attack or power failure. RG 241.68 A trading participant should refer to guidance in RG 265 on business continuity plans for responding to a major event. Logging information RG 241.69 We expect a trading participant to have trading management arrangements to ensure that its AOP system logs information about the interaction of orders and trading messages with any connected system or market operator system, to ensure that the origin and ownership of the order can be traced. RG 241.70 When considering the origin of each order, a trading participant should have in place trading management arrangements to define the origin of an order— for example, the source of the instructions to place the order and the ‘owner’ during each stage of the process before a message reaches the trading platform (i.e. the person or system responsible for the order). RG 241.71 Where additional systems such as smart order routers, algorithmic programs and internalised crossing engines are involved in processing trading messages, a trading participant may choose to pass message ownership to each system processing stage without changing the origin of the initial placement of the order. Organisational and technical resources RG 241.72 For the purposes of complying with Rule 5.5.2(b), a trading participant should have in place organisational and technical resources to ensure it can comply with its obligations for trading through AOP as set out below: (a) Trading record requirements: We expect a trading participant to have in place organisational and technical resources to automatically generate and maintain all trading records from the AOP system that are required to be kept specifically under Parts 4.1 and 4.2 of the Securities Markets Page 17 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 17 Rules and generally under the Corporations Act, regardless of whether the order enters the trading platform or is rejected by the trading participant’s AOP filter. (b) Capital requirements: We expect a trading participant (other than a trading participant that is a principal trader only, a clearing participant of an approved clearing facility or an authorised deposit-taking institution to have in place organisational and technical resources to ensure that when it trades on its own behalf or on behalf of clients through AOP, it complies at all times with the risk-based capital requirements set out in Schedule 1A of the ASIC Market Integrity Rules (Capital) 2021 (Capital Rules): Rule 8.2.1 of the Capital Rules. (c) Best execution obligations: We expect a trading participant of the ASX or Cboe markets to have in place organisational and technical resources to ensure that when it trades for clients through its AOP system, it complies with its best execution obligations and best execution policies and procedures: Parts 3.8 and 3.9 of the Securities Markets Rules. Note: Participants of the NSXA and SSX markets do not have to comply with Parts 3.8– 3.11 of the Securities Markets Rules until 16 November 2022: ASIC Market Integrity Rules (Securities Markets) Class Waiver 2018/258. (d) Client order priority requirements: We expect a trading participant to have in place organisational and technical resources to ensure that it complies with its obligations to deal fairly and in due turn with clients’ orders, and a client order on its own account (Rule 5.1.3), and that its AOP system can effectively manage, both on a pre-trade and post-trade basis, transactions where principal orders or orders from the same client on opposing sides of the market match (such that there is no change in beneficial ownership): Rule 5.7.2(h). RG 241.73 A trading participant must also have adequate arrangements to ensure the resilience, reliability, integrity and security of its critical business services: Part 8B.2 of the Securities Markets Rules. Critical business services include systems that support order entry, order routing, execution and trade reporting. A trading participant should refer to guidance in RG 265 on adequate arrangements for critical business services. RG 241.74 A trading participant must also have appropriate governance arrangements and adequate financial, technological and human resources to comply with its obligations under Chapter 8B of the Securities Markets Rules: Part 8B.5 of the Securities Markets Rules. A trading participant should refer to guidance in RG 265 on governance arrangements. Page 18 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 18 Security arrangements RG 241.75 Under Rule 5.6.3(1)(c), a trading participant’s AOP system must have in place security arrangements to monitor and prevent unauthorised access to a gateway or an open interface device, or to a computer or other device connected to an open interface device, and to ensure that the AOP system does not interfere with the efficiency and integrity of the market or the proper functioning of the trading platform. A trading participant should consider assessing its security arrangements against security standards such as AUS/NZS 4444 Information security management and ISO/IEC 17799 Information technology: Security techniques—Code of practice for information security management or equivalent. RG 241.76 A trading participant that accepts orders should have in place adequate physical and electronic security arrangements and seek to adopt and enforce written procedures to ensure reliability and uphold the confidentiality of orders and client account information. Such procedures would seek to at least address the following matters: (a) authentication and authorisation of users, so that the operating system and application security limit internal access to authorised personnel; (b) encryption of information; (c) firewalling to prevent unauthorised external access; (d) periodic testing of the trading participant’s security management; and (e) administration and ownership of system management. RG 241.77 A trading participant must have adequate arrangements to ensure the resilience, reliability, integrity and security of its critical business services: Part 8B.2 of the Securities Markets Rules. Critical business services include systems that support order entry, order routing, execution and trade reporting. RG 241.78 A trading participant must also have adequate arrangements to ensure the confidentiality, integrity and availability of information obtained, held or used by the participant in relation to its operations and services: Part 8B.3 of the Securities Markets Rules. RG 241.79 A trading participant should refer to guidance in RG 265 on adequate arrangements for critical business services and information security. Responsible use of AOP RG 241.80 We consider that, to comply with Rules 5.5.2, 5.6.1 and 5.6.3 and to ensure responsible use of AOP, a trading participant must ensure that it has in place monitoring and control arrangements, arrangements for managing the particular financial and trading risks that are relevant to the business it conducts through AOP, and resources for managing change: see RG 241.81–RG 241.111. Page 19 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 19 Monitoring and control: Real time or close to real time RG 241.81 We expect a trading participant to be able to monitor in real time, or close to real time, all trading messages submitted to a market. In some cases, a combination of filters and oversight by a DTR may be sufficient for this purpose. However, when the volume of orders, order-to-trade ratios, number of client accounts or speed or complexity of messaging exceeds, or may be expected to exceed, levels where manual oversight is no longer effective, a trading participant should consider automated methods for monitoring. Note: A trading participant that operates a crossing system should refer to guidance in RG 265 on monitoring arrangements for orders in a crossing system. RG 241.82 Any surveillance (whether manual or automated) should be capable of identifying potential or actual breaches of market integrity rules in real time or close to real time. Where the trading participant identifies activity that has interfered with or is likely to interfere with the efficiency and integrity of the market, it must take steps to address the issue without delay. Where appropriate, this includes the use of controls that enable immediate suspension, limitation or prohibition of trading messages or of the conduct of all AOP, AOP for ACOP, or AOP for one or more authorised persons, clients or financial products: see RG 241.52–RG 241.58. RG 241.83 A trading participant may consider monitoring the following when using an AOP system: (a) the nature and liquidity demands of the AOP system to avoid unusual movements in market price or increased volatility; (b) the level of use of the AOP system to avoid generation of large numbers of the following types of orders, which may result in an adverse impact on a market: (i) concurrent orders; (ii) orders of small executable quantity (e.g. under an elected dollar- based or other nominal value); or (iii) trading strategies that involve amending and/or cancelling a large number of orders that result in either a disproportionately low number of transactions or no transactions; (c) whether the AOP system appears to react to order book changes outside of the best market; and (d) the effectiveness of the ‘Chinese walls’ required to manage the involvement of those staff operating in a compliance or information technology (IT) oversight role who have access to information on the nature of the AOP system and to client order flow. Page 20 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 20 Monitoring and control: Exception and post-trade analysis RG 241.84 We consider that a trading participant must have both the capability and appropriately qualified personnel to regularly analyse historic order and trading patterns to: (a) identify trading activity that may warrant review by the trading participant’s compliance area; and (b) adjust the relevant automated filters and filter parameters where it is apparent that they are not operating as intended. RG 241.85 Where a trading message (or series of trading messages) that has been rejected by a filter is passed to a DTR for review, the DTR will need to make a decision whether to amend, cancel or pass the trading message (or series of trading messages) into the market. RG 241.86 Where a trading message has been passed to a DTR for review, a trading participant must ensure records of the DTR’s action comply with Parts 4.1 and 4.2 and Rule 5.5.3(f). RG 241.87 Where, in real-time monitoring, a DTR decides to pass a trading message into the market but places the trading message on an exception report for ongoing monitoring, a compliance officer or other qualified person must be available for the DTR to consult. Trading participants should ensure exception reports are monitored on a regular basis and at least daily. Financial and trading risks RG 241.88 In complying with Rules 5.5.2, 5.6.1 and 5.6.3 and ensuring responsible use of AOP, a trading participant should take into account financial and trading risks in addition to the regulatory risks and market integrity risks already described. RG 241.89 We consider the factors that will be relevant in assessing the level of financial and trading risk include, but are not limited to: (a) the proposed nature of the business passing through the AOP system; (b) whether the AOP system will permit ACOP; (c) where the AOP system does permit ACOP, whether the trading participant intends to allow authorised persons to delegate their ACOP access; (d) whether the AOP system will allow algorithmic trading (see RG 241.98–RG 241.102); (e) whether the AOP system uses a third-party system and whether it is provided to the trading participant by a related party of the authorised person conducting business through the AOP system; (f) whether there will be a high message or trade ratio flow through the AOP system; Page 21 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 21 (g) whether the AOP system relies on latency-dependent connections and interfaces such as co-located business; and (h) whether the AOP system interacts with a crossing system operated by the trading participant. Order-to-trade ratios RG 241.90 An order-to-trade ratio is a measure of the number of times orders submitted into an order book are amended or cancelled relative to the execution of a trade. RG 241.91 A trading participant that uses either a system to manually enter orders and instructions from an authorised person, or a highly sophisticated order management system that automatically generates instructions with little to no human intervention, will need to monitor order-to-trade ratios. RG 241.92 In particular, a trading participant will need to monitor order-to-trade ratios that may signal: (a) a dysfunctional AOP system or a poorly programmed algorithm that may either create or contribute to a disorderly market; or (b) order behaviour that may indicate abusive behaviour or market misconduct. RG 241.93 When monitoring order-to-trade ratios a trading participant will need to consider the following factors, which may indicate the matters set out in RG 241.92(a)–RG 241.92(b): (a) whether the value of the transaction(s) relative to the number of orders entered is materially different. For example, 1,000 orders entered into a market that generate trades amounting to a nominal value may indicate market misconduct; (b) whether the order-to-trade ratio is excessive relative to current market liquidity. For example, a large number of trading messages or orders relative to transactions in illiquid securities, or a large number of trading messages or orders (including amendments) in liquid securities away from the current market price may be indicative of either a dysfunctional algorithm or market misconduct; (c) whether the order-to-trade ratio is high in a volatile market and the volatility in the market is not driven by an event or explanation. For example, where an explicable market event is causing volatility, a relatively higher order-to-trade ratio may be appropriate; (d) the impact of the order-to-trade ratio on the price of a security; (e) the execution goals of the algorithm; and (f) compliance with order-to-trade ratio requirements under the market operator rules or guidance. Page 22 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 22 RG 241.94 For business models that use more sophisticated order management systems and that generate instructions with little or no human intervention or generate subordinated orders from a larger parent order through an AOP or ACOP system, a trading participant will need to consider whether the order-to-trade ratio reflects the execution goals of the algorithm while preventing a disorderly market and ensuring it does not amount to abusive behaviour or market misconduct. Measurement metrics may include, but are not restricted to: (a) the number of subordinated orders and trades over a specific timeframe relative to the execution goal and the parent order instruction; and (b) whether the order-to-trade ratio is excessive, at a more granular level, when measured relative to typical market liquidity and volatility levels of the financial product. ACOP RG 241.95 Where a trading participant’s AOP system permits ACOP, the trading participant will need to manage the financial risks associated with ACOP. RG 241.96 Trading participants should adopt and enforce written procedures reasonably designed to prevent clients and other authorised persons from entering into trades that create undue financial risk for the clearing participant (whether the clearing participant is the trading participant or a third party). RG 241.97 The procedures should address both pre-execution and post-execution controls to minimise financial risk. This includes considerations that should be taken into account before authorising the use of ACOP, the process for determining which controls to apply to a particular authorised person, and ongoing review of all controls imposed. In particular, the controls should ensure each authorised person has sufficient financial resources for their trading. Algorithmic programs RG 241.98 Trading participants that allow or conduct algorithmic programs will need to have in place arrangements to manage the risk associated with trading using algorithmic programs. Trading using algorithmic programs is a major source of trading messages. Note: For a definition of ‘algorithmic programs’, see RG 241.19–RG 241.20. RG 241.99 Algorithmic programs may be used by the trading participant, a client or by an authorised person. Like all trading messages, trading messages generated by the algorithmic program must pass through the trading participant’s filters and are deemed to have been submitted with the knowledge of the trading participant: Rules 2.5.1 and 2.5.4. Page 23 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 23 RG 241.100 We consider that a trading participant should also seek to have an agreement or arrangement with an authorised person who uses their own algorithmic trading models that systems flow should be tested against trading participant AOP filters before use (i.e. at the development stage) and to the extent possible before implementing material changes. RG 241.101 Trading participants should take into account any differences between the speed with which their AOP system can generate messages and the speed with which the market operator’s system can process those messages. RG 241.102 Where poor AOP controls lead to continuing patterns of order deletions, order amendments, high order-to-trade ratios relative to the underlying security, over trading or wash trading, we may consider giving a direction under Rule 5.6.12 to cease, suspend, limit or prohibit AOP: see RG 241.126–RG 241.129. Trading on multiple markets and multi-product AOP system routing RG 241.103 We consider responsible use of AOP requires trading participants to manage the risk associated with trading on multiple markets and in multiple product types, to accommodate the differing platform specifications and financial products and order types, and to consider the impact that a disruption caused by an AOP order on one market may have on another market (i.e. to ensure that the trading participant does not interfere with the conduct of an orderly market and does not assist or facilitate manipulative trading). Crossing systems RG 241.104 We consider the responsible use of AOP requires a trading participant that operates a crossing system to manage the risks associated with AOP interacting with its crossing system. For example, the trading participant should have alternative arrangements for managing client orders, including bypassing the crossing system and routing client orders to a licensed market, in the event of a disruption. Corporate actions RG 241.105 We consider that responsible use of AOP includes arrangements to manage the risk associated with trading during corporate actions. RG 241.106 When operating in a multiple market environment, a trading participant will need to ensure that it can manage or alert the authorised person for stock reconstructions, order book purges and corporate actions, taking into account any different treatment of those corporate actions by each market operator. Page 24 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 24 Resources to manage change RG 241.107 We expect a trading participant to have resources to manage change, and to demonstrate that change management. This requires appropriately authorised (e.g. at an IT oversight or change manager level), well-documented and clearly auditable processes reflecting system upgrades, changes and implementations. RG 241.108 Change management procedures may include procedures that ensure: (a) changes are adequately tested before implementation (see also RG 241.117–RG 241.125); (b) only authorised changes to software, hardware and systems can be implemented; and (c) new software, hardware and systems can only be implemented into the production environment after authorisation by an appropriately senior, qualified person. RG 241.109 A trading participant must also have adequate arrangements to ensure the resilience, reliability, integrity and security of its critical business services arrangements following the implementation of a new critical business service or of a change to an existing critical business service: Rule 8B.2.2 of the Securities Markets Rules. RG 241.110 A trading participant must also ensure its critical business services have sufficient and scalable capacity for its ongoing and planned operations and services: Rule 8B.2.1(2)(c) of the Securities Markets Rules. RG 241.111 A trading participant must also have appropriate governance arrangements and adequate financial, technological and human resources to comply with its obligation under Chapter 8B of the Securities Markets Rules: Part 8B.5 of the Securities Markets Rules. RG 241.112 A trading participant should refer to guidance in RG 265 on change management for critical business services and governance arrangements. Documentation RG 241.113 A trading participant must have, and review, policy documents relating to the use of AOP: Rules 5.6.4, 5.6.8(1) and 5.6.8A(1). We consider these policy documents should address the use of AOP in light of the business requirements of the trading participant and the type of activity envisaged for the AOP system(s). RG 241.114 We expect that a trading participant’s policies and procedures for compliance with Part 5.6 and system design documentation should be tailored to the nature, scale and complexity of the trading participant’s business and the type of activity envisaged for the AOP system, and must be Page 25 REGULATORY GUIDE 241: Electronic trading © Australian Securities and Investments Commission August 2022 Page 25 accurate, complete and up to date. These policies, procedures and system design documentation form the basis for initial certification and annual notification of the trading participant’s AOP system(s): see Section D of this guide. Policies and procedures RG 241.115 A trading participant’s policies and procedures for compliance with Part 5.6 should cover at least the following matters: (a) monitoring and reviewing all aspects of AOP and the AOP parameter specifications; (b) evaluating the manner in which AOP and its components will operate under various market scenarios; (c) ensuring that before effecting a particular algorithm, changes in market conditions are assessed to ensure compliance; (d) setting (and adjusting where necessary) system monitoring parameters (alerts) designed to detect potential manipulative, disruptive or other un