TAC Reference Document

October 30, 2012

Compilation of Existing Testing and Supervision 

Standards, Recommendations and Regulations

Contents: Page

I. Current Exchange Standards/Controls 1

a. CME Group 1

b. ICE 2

II. Recommendations 4

a. FIA Market Access Risk Management Recommendations (April 2010) 4

b. FIA Principal Traders Group: Recommendations for Risk Controls for Trading 

 Firms (November 2010) 7

c. Joint CFTC-SEC Recommendations on May 6 Flash Crash (February 2011) 10

d. TAC Subcommittee on Pre-Trade Functionality Recommendations (March 2011) 12

e. FIA Principal Traders Group and FIA European Principal Traders Association: 

 Software Development and Change Management Recommendations (March 2012) 14

f. FIA Order Handling Risk Management Recommendations for Executing 

 Brokers (March 2012) 16

III. Relevant CFTC Regulations 19
TAC Reference Document

October 30, 2012

1

I. Current Exchange Standards/Controls

a. CME Group1

Equal access to host proximity and data

• All participants have non-discriminatory access to the same connectivity options at the 

same prices

• Market data is disseminated to all participants simultaneously

• All participants have access to identical data

• Anonymity of traders and firms is protected in all bids, offers and execution reports

• All orders are processed in the order received

• Bids and offers are available to all participants and matched according to transparent 

algorithms (primarily Price/Time or Pro-Rata)

CME Group Surveillance Systems 

• Comprehensive audit trail of all message data, order book data and cleared trade data

• RAPID System – real-time and historical message data and query/aggregation tool

• Live Alerts – real time position and volume anomaly alerts at account level

• MASS – real time price and volume anomaly alerts at contract level

• Real time message frequency alerting at the session level

• SMART – Pattern detection, anomalies, volumetric analysis

• ARMADA – real time and historical order book data; market replay capability

• Real time system performance monitoring

Types of Surveillance 

• Disruptive trading – e.g. spoofing, manipulation, pre-open abuse

• Trade practice abuse – e.g. wash trades, prearrangement, money pass, frontrunning

• Anomalies – e.g. Stop Logic events, error trades, price spikes, position anomalies

• Messaging Efficiency Program

CME Group Risk and Volatility Mitigation Tools 

• Price banding

• Message volume controls

• Stop logic functionality

• Maximum order size

• Protection points for market and stop orders

• Market Maker Sweep Protections

• Product price limits and circuit breakers 

• Transparent error trade policy 

• Market Maker Sweep Protections

 1 This presentation was made by a CME representative at a TAC meeting on March 29, 2012.

http://www.cftc.gov/ucm/groups/public/@aboutcftc/documents/file/tacpresentation032912_cme.pdf.
TAC Reference Document

October 30, 2012

2

CME Group Risk Management Tools

• Globex Credit Controls (mandatory) - provides automated pre-trade risk controls at firm

level and clearing firm has the ability to select real-time actions if risk limits are hit.

• Risk Management Interface (RMI) - allows clearing firm to block and cancel orders by 

firm, account, futures/options, product or exchange. Allows cross exchange risk 

management.

• Cancel on Disconnect – automatically cancels user’s resting day orders if connection is 

involuntarily dropped

• Drop Copy – facilitates real-time risk management by sending real-time copies of all 

order messages and executions for defined sessions to trading firms and clearing firms

• FirmSoft – browser based order management tool that provides firm administrators, risk 

management and trading personnel with consolidated activity and order cancel 

functionality.

• Conformance Testing

b. ICE2

ICE Functional Controls for Automated Trading Systems (ATS)

• Automated order entry validations 

o Message throttle limits

o Max quantity limits

o Price Reasonability Validation

o Position validation

o Orders removed upon logout 

• Manual validations and controls 

o Kill All button / Log Off user button/ Suspend clearing accounts

o Cleared error trade policy and “No Cancellation Range”

• Interval Price Limit 

o ICE’s circuit breaker protection for price spikes

o Provides a floor/ceiling price limits for within a specific timeframe configurable 

by market

o New floor/ceiling price limits recalculated each new time interval based on 

current market price

o If floor/ceiling price exceeded, market put in HOLD state

o Does not halt trading in opposite direction of HOLD

o Traders can manage resting orders & enter new orders

o Market HOLD notification sent to all users

o After HOLD ends, new Upper/Lower IPL limits calculated

ICE Systems Monitoring and Controls for ATS

• ATS conformance testing and approval 

 2 This presentation was made by an ICE representative at a TAC meeting on March 29, 2012.

http://www.cftc.gov/ucm/groups/public/@aboutcftc/documents/file/tacpresentation032912_ice.pdf.
TAC Reference Document

October 30, 2012

3

• Message rate threshold alerts

• Systems performance reports

• ATS efficiency reports

• SMARTs – Real-time Market Surveillance 

o Real-time and historical graphical representation of the entire market including 

orders, trades, and blocks

o Reconstruct full order book, synchronized playback of multiple markets (spread 

months)

o Customized alerts to detect anomalies, significant price movements and potential 

market abuses

o Overlay related markets to view correlations

• Message policy and WVR Report (discourages inefficient messaging – 33% reduction)
TAC Reference Document

October 30, 2012

4

II. Recommendations

a. FIA Market Access Risk Management Recommendations3

Execution Risk Tools

To reduce the inevitable errors that occur with manual data entry, exchanges should work 

towards providing a standard communication protocol that would allow firms to automate setting 

and updating risk parameters for individual trading entities. This would also give clearing firm 

risk managers the ability to more efficiently disable a client from multiple exchanges 

simultaneously. An API based on an agreed standard protocol such as FIX would be the 

preferred method for entering and updating limits.

Unless otherwise indicated, exchange risk control systems should provide clearing firms with the 

ability to define risk controls by product. All limits should be set by positive permissioning. The 

auto-default should be set to zero (i.e. clearing firm will set limits only for the products that they 

are allowing the trading firm to trade).

• Order Size: quantity-per-order limits should be mandatory. The clearing firm should 

establish limits with the trading firm to avoid generating and sending erroneously-sized 

orders to the market. Occasionally, larger-sized orders are legitimate. In such cases, the 

trading firm needs to contact the clearing firm to adjust their limits. The exchange should 

provide default limits to protect the integrity of its market.

o A clearing firm providing direct access to a market should have visibility to the 

limits and the ability to set appropriate limits for the trading firm’s activity, 

regardless of whether the trading firm accesses the market directly (DA-E), 

through the clearing member system (DA-C) or through a third-party system 

(DA-V).

o Risk controls need to be sophisticated enough to allow the clearing firm to set pretrade limits per product for each client and prevent trading beyond established 

limits. Different sized limits are required for more liquid versus less liquid 

instruments (e.g., front month versus back month futures or options, in-the-money 

versus out-of-the-money options).

o Trading firm access to products should be blocked until limits are established by 

the clearing firm. Default limits should not allow “unlimited” trading. 

• Intraday Position Limits: The exchange should make available the ability to set pretrade intraday position limits. Once the trading entity has reached these limits, only riskreducing trades would be allowed. The position limit capability should have the 

following characteristics:

o Set by trader, account, or firm and with the ability to set by groups of traders or

accounts.

o Set maximum cumulative long positions and maximum cumulative short 

positions.

 3 These recommendations were published in April 2010. 

http://www.futuresindustry.org/downloads/Market_Access-6.pdf.
TAC Reference Document

October 30, 2012

5

o Include working orders in maximum long/maximum short position calculations.

o Set by product level.

o Provide the ability to raise or lower limits intraday.

o Be configurable by open API, preferably FIX API.

o Be mandatory for all participants so that latency is the same for all.

o Recognizing that options have a lower delta than futures, position limit capability

must include the ability to differentiate limits by product type.

• Cancel-On-Disconnect: exchanges should implement a flexible system that allows a user 

to determine whether their orders should be left in the market upon disconnection. This 

should only be implemented if the clearing firm’s risk manager has the ability to cancel 

working orders for the trader if the trading system is disconnected. The exchange should 

establish a policy whether the default setting for all market participants should be to 

maintain or cancel all working orders.

• Kill Button: exchanges should provide clearing firms with the ability to: 1) delete all 

open orders and quotes and 2) reject entry of new orders and quotes.

o The exchange should have a registration system that requires firms to specify 

which staff members are authorized to use the kill button.

o The system itself should have explicit warnings informing authorized users of the

consequences of activating the kill button.

o Similar functionality could be implemented to allow a trading firm to halt trading

activity on a firm-wide, trading group or individual trader basis.

• Order Cancel Capabilities: exchanges should provide to clearing members an order 

management tool that allows real-time access to information on working and filled 

electronic orders. The tool should provide risk mitigation functionality in the event of an 

electronic trading system failure.

o The clearing member and trading firm should have the ability to view and cancel 

orders via this tool. Clearing members should be able to delegate and permission 

the tool for individual traders or firms at granular levels. 

o The tool should provide view capabilities for: current order status; fill 

information, including partial fills; cancel and replace history; and order 

timestamps.

o The tool should provide cancel capabilities for: individual orders; groups of 

orders; and all working orders via a single command.

• Price Banding/Dynamic Price Limits: the exchange should have the ability to set price 

limits on a dynamic basis, continuously adjusting throughout the day to account for 

current market conditions.

o Exchanges should have the ability to widen price bands throughout the trading 

day when necessary to account for additional volatility in the market. The width 

of the price limits should be determined by product. Price banding occasionally 

can be too strict for less liquid markets and may need manual intervention to 

facilitate trading if the current range is deemed unsuitable.
TAC Reference Document

October 30, 2012

6

• Market Maker/Sweep Protections: exchanges should allow a level of protection for 

market makers who quote simultaneously on both sides of the market.

o Protection parameters should be optional and should allow values to be set by 

each market maker or market-making entity. When market maker-defined 

protection values are met or exceeded within certain time intervals, the 

protections should be triggered. When triggered, the electronic trading system 

would initiate the market-maker protection functionality, which rejects new 

messages and/or cancels resting quotes associated with the market maker.

• Internal Trade Crossing: Wash trades are prohibited to prevent manipulating the market 

by artificially distorting market price or volume. Inadvertent crosses do not have the 

intent to mislead the public. Exchanges, working within the framework provided by their 

respective regulators, should set guidelines for vendors, customers, and clearing 

members, defining what would be acceptable reasons for inadvertent cross trades. 

Existing rules should be re-examined in the context of today’s trading environment.

Post-Trade Checks

Exchanges should make drop copies available to clearing and trading firms.

• Trade capture drop copy: exchanges should provide clearing firms with drop copies of 

orders and executed trades. This allows clearing firms to get their current set of

trades and positions from a secondary channel independent of the primary trading

system.

• Post-clearing drop copy: exchanges should provide clearing firms net position per

maturity per contract as soon as the trade is matched at the clearinghouse. This

functionality needs to be as close to real-time as possible.

• Exchange drop-copy functionality should allow clearing firms to enable trading firms

to receive trade capture and post-clearing drop copies.

Co-Location Policies

Steps should be taken to ensure that access to co-location is available to every firm that is 

interested in such a service and that the terms of the co-location service remain transparent to all 

market participants.

Conformance/Certification Testing

All trading firms that wish to write directly to the order entry or market data interfaces of an 

exchange should be required to pass an initial set of conformance tests for execution and market 

data that highlight basic functionality of the trading system that will be making the direct 

connection. All ISVs and proprietary systems should be required to pass the same conformance 

tests, so the proprietary system client using the ISV should not be required to pass conformance.

The exchange should be required to provide a conformance environment on demand for recertification requirements.

Error Trade Policy

• Trade Certainty: exchanges should adopt a “Preferred Adjust-Only Policy” to ensure 

absolute trade certainty to all parties to an error trade. In a Preferred Adjust-Only Policy 
TAC Reference Document

October 30, 2012

7

all trades inside of a product-specific “no-adjust” range are ineligible for adjustment. All 

trades outside of the no-adjust range potentially could be adjusted to the edge of the noadjust range from the prevailing market at the time of execution. The Preferred AdjustOnly Policy would not eliminate the authority of an exchange to cancel or correct trades 

under extreme circumstances.

• Contingency Orders: contingent or stop orders executed as a result of an error trade 

should be eligible for compensation from the party that made the error. An exchange’s 

authority to cancel orders under extreme circumstances should not be invoked merely 

because an order is a contingent order.

• Notification: the exchange should establish a minimal reporting time of less than five 

minutes for firms to notify the exchange that an error has occurred. The exchange should 

announce a potential adjust-or-bust situation immediately upon notification and the adjust 

decision should be disseminated to the marketplace within a reasonable timeframe via a 

specific market data message, email and/or other established mode of communication on 

a best efforts basis.

b. FIA Principal Traders Group: Recommendations for Risk Controls for Trading Firms4

Access & Oversight 

Each ETS should have a management console to display information about the actions and 

market exposure. This management console should also provide the trader with the capability to 

control the ETS.

Firms should have policies and processes for setting, modifying and tracking changes to pre and 

post-trade risk checks. Policies should specify who is authorized to enter, view and modify preand post-trade checks, which checks are enforced, and in what manner. Firms should consider 

how responsibilities are assigned for managing pre- and post-trade checks, inputting settings and 

operating other parts of the ETS and should strive to minimize potential opportunities for 

unauthorized trading. 

• Change Management & Testing—Firms should have processes in place to allow 

representatives from trading, risk, and software management to approve changes and 

verify internal testing before a new trading system can be enabled in production.

• Conformance Testing—Trading firms are required to pass conformance testing with the 

party providing access when implementing a new direct access system or when the 

exchange deems it necessary because of a fundamental change in exchange functionality. 

The onus is on the trading firm to determine when it must recertify due to a change in 

logic within their system.

• Error Control— Trading firms should have documented procedures that direct the 

actions of traders, ETS trading monitors and support staff in the event of a trading system 

 4 These recommendations were published in November 2010. 

http://www.futuresindustry.org/downloads/Trading_Best_Pratices.pdf.
TAC Reference Document

October 30, 2012

8

error. The procedures should be aimed at evaluating, managing and mitigating market 

disruption and firm risk and should specify people to be notified in the event of an error 

resulting in violations of risk profile, or potential violations of exchange rules.

o Firm Level Controls: In addition to pre-trade risk controls at the exchange and 

clearing firm levels, trading firms should set risk controls at the trading firm level.

Pre-Trade Risk Management 

In addition to pre-trade risk controls at the exchange and clearing firm levels, trading firms 

should set risk controls at the trading firm level.

• Pre-Trade Risk Limits—Trading firms should establish and automatically enforce pretrade risk limits that are appropriate for the firms’ capital base, clearing arrangements, 

trading style, experience, and risk tolerance. These risk limits can include a variety of 

hard limits, such as position size and order size. Depending on the trading strategy, these 

limits may be set at several levels of aggregation. These risk limits should be 

implemented in multiple independent pre-trade components of a trading system.

• Price Collars—Trading systems should have upper and lower limits on the price of the 

orders they can send, configurable by product. They should prevent any order for a price 

outside of the “price collar” from leaving the system.

• Volatility Awareness—Trading systems should take a specified action (have an alert, 

pause, or automatically disable) if an unusual price move or volume spike occurs during a 

specified timeframe.

• Fat-Finger Quantity Limits—Trading systems should have upper limits on the size of 

the orders they can send, configurable by product. They should prevent any order for a 

quantity larger than the fat-finger limit from leaving the system.

• Repeated Automated Execution Throttle—Automated trading systems should have 

functionality in place that monitors the number of times a strategy is filled and then reenters the market without human intervention. After a configurable number of repeated 

executions the system should be disabled until a human re-enables it. 

• Outbound Message Rate—Trading firms should limit the number of order messages 

their trading systems can send to the exchange in a short period of time. These limits 

should be in line with exchange rules and the trading firm risk tolerance.

• Market Data Reasonability—Trading systems should have “reasonability checks” on 

incoming market data as well as on generated values.

• Kill Button—Trading systems should have a manual “kill button” that, when activated, 

disables the system’s ability to trade and cancels all resting orders.

• Market Maker Protections—Firms acting as designated market makers should be aware 

of and, when appropriate, utilize exchange-provided market maker protections.
TAC Reference Document

October 30, 2012

9

Trading Interruptions

• Heartbeats among System Components—Electronic trading systems should monitor 

“heartbeats” among their various components as well as with the exchange to identify 

when connectivity to any system component or the exchange has been lost. If 

connectivity is lost, the ETS should be disabled and working orders cancelled by the 

system or through exchange provided “cancel-on-disconnect” functionality.

• Emergency Notification Procedures—Trading operations staff should have contact 

details for incident response personnel responsible for network connectivity, software 

development, and third-party vendors as well as market operations staff at relevant 

exchanges. 

• Back-Up Execution Facilities—Trading firms should have alternate execution platforms 

available to their traders and trading monitors in the event that their primary systems or 

direct market access fail. Options include exchange, clearing firm or ISV-provided 

execution platforms. In addition, firms should have documented procedures for 

alternative trade execution methods (including trading desk phone numbers, account 

numbers, clearing information as applicable) in the event electronic trading is not 

feasible. When trades are executed through alternative methods, firms should have logs 

documenting the execution of such trades and recording the relevant trade details.

Post-Execution and Back Office

All firms should strive to maintain timely and accurate trade and account information by 

reconciling as soon as practicable their own electronic trading logs with records provided by 

their brokers, clearing firms, or other business partners. In satisfying this objective, firms should 

consider segregating trading and back office roles and responsibilities in such a way that an 

individual cannot conceal unauthorized trading activity.

• Post Trade—All firms should strive to maintain timely and accurate trade and account 

information by reconciling as soon as practicable their own electronic trading logs with 

records provided by their brokers, clearing firms, or other business partners. In satisfying 

this objective, firms should consider segregating trading and back office roles and 

responsibilities in such a way that an individual cannot conceal unauthorized trading 

activity.

• Post-Trade Limits—Trading firms can also establish and automatically enforce posttrade risk limits that are appropriate for the firms’ capital base, clearing arrangements, 

trading style, experience, and risk tolerance. For example, a trading firm can set daily 

loss-limits by instrument, asset class, and strategy and automatically close out or reduce 

positions if those limits are breached.

• Order Fill Validity—Trading firms can monitor order fill messages they receive from 

the exchange in order to confirm they are valid. Validity can be determined by a number 

of trade specific factors including fill price, fill quantity, order ownership, or aggregate 
TAC Reference Document

October 30, 2012

10

measures such as net positions and fill frequencies. Should an order fail these checks, 

action should be taken to investigate the discrepancy.

• Near Real-Time Reconciliation—ETSs should have functionality to accept drop-copies 

from exchanges and clearing firms. Drop copies are duplicate copies of orders that allow 

a firm to compare the exchange or clearing firm view of trades and positions with the 

systems’ internal view. This helps to assure that all systems are performing as expected 

and maintaining accurate and consistent views of trades and positions. The drop-copy 

data may also be used by risk managers to view their firm’s risk exposure independently 

of the trading system.

Electronic Security

Firms should consider the security of their trading and business networks and be aware of the 

risk of access to their network infrastructure by unauthorized personnel. In particular, firms with 

direct access to exchange matching engines should be aware of the potential, once compromised, 

for intruders to use their network infrastructure to launch attacks against exchange networks or 

others or potentially engage in unauthorized trading, and firms must take steps to mitigate such 

risk. The use of network firewalls, VPN connections or other security devices to prevent 

unauthorized remote access to business networks is strongly encouraged. Failure to use firewalls 

or other security measures in order to reduce latency or increase throughput is strongly 

discouraged.

c. Joint CFTC-SEC Recommendations on May 6 Flash Crash5

Volatility:

• Concurs with steps taken by the SEC (working with the exchanges and FINRA) to:

o Create single stock pauses/circuit breakers for the Russell 1000 stocks and

actively traded ETFs;

o Enact rules that provide greater certainty as to which trades will be broken when

there are multi stock aberrant price movements; and

o Implement minimum quoting requirements by primary and supplemental market

makers that effectively eliminate the ability of market makers to employ “stub

quotes.”

• Commissions should require that the pause rules of the exchanges and FINRA be 

expanded to cover all but the most inactively traded listed equity securities, ETFs, and 

options and single stock futures on those securities.

• SEC should work with the Exchanges and FINRA to implement a “limit up/limit down” 

process to supplement the existing Pause rules and that the Commissions clarify whether 

securities options exchanges and single stock futures exchanges should continue to trade 

during any equity limit up/down periods.

 5 The Joint CFTC-SEC Advisory Committee on Emerging Regulatory Issues was established a few days after the 

“Flash Crash” of May 6, 2010. It made these recommendations at a meeting of the Committee on February 18, 

2011. http://www.cftc.gov/ucm/groups/public/@aboutcftc/documents/file/jacreport_021811.pdf.
TAC Reference Document

October 30, 2012

11

• CFTC and the relevant derivative exchanges should evaluate whether a second tier of 

pre-trade risk safeguards with longer timeframes should be instituted when the “five 

second limit” does not attract contra-side liquidity.

• Commissions should evaluate the present system-wide circuit breakers and consider:

o Reducing, at least, the initial trading halt to a period of time as short as ten

minutes;

o Allowing the halt to be triggered as late as 3:30 pm; and

o Using the S&P 500 Index as the triggering mechanism.

Restrictions on Co-location and Direct Access:

• Supports the SEC’s “naked access” rulemaking and urges the SEC to work closely with 

FINRA and other exchanges with examination responsibilities to develop effective 

testing of sponsoring broker-dealer risk management controls and supervisory 

procedures.

• CFTC should use its rulemaking authority to impose strict supervisory requirements on 

DCMs or FCMs that employ or sponsor firms implementing algorithmic order routing 

strategies and that the CFTC and the SEC carefully review the benefits and costs of 

directly restricting “disruptive trading activities “with respect to extremely large orders or 

strategies.

Liquidity Pricing and Liquidity Rebates:

• SEC should evaluate the potential benefits which might be gained by changes in 

maker/taker pricing practices, including building in incentives for the Exchanges to 

provide for “peak load” pricing models.

Market Maker Obligations:

• SEC should evaluate whether incentives or regulations can be developed to encourage 

persons who engage in market making strategies to regularly provide buy and sell 

quotations that are “reasonably related to the market.”

• Commissions should explore ways to fairly allocate the costs imposed by high levels of 

order cancellations, including perhaps requiring a uniform fee across all exchange 

markets that is assessed based on the average of order cancellations to actual transactions 

effected by a market participant.

Preferencing, Internalization, and Routing Protocols:

• SEC should conduct further analysis regarding the impact of a broker-dealer maintaining 

privileged execution access as a result of internalizing its customer’s orders or through 

preferencing arrangements. The SEC’s review should, at a minimum, consider whether to 

(i) adopt its rule proposal requiring that internalized or preferenced orders only be 

executed at a price materially superior (e.g., 50 mils for most securities) to the quoted 

best bid or offer, and/or (ii) require firms internalizing customer order flow or executing 

preferenced order flow to be subject to market maker obligations that requires them to 

execute some material portion of their order flow during volatile market periods.

• SEC should study the costs and benefits of alternative routing requirements. In particular, 

we recommend that the SEC consider adopting a “trade at” routing regime. The 

Committee further recommends analysis of the current “top of book” protection protocol 
TAC Reference Document

October 30, 2012

12

and the costs and benefits of its replacement with greater protection to limit orders placed 

off the current quote or increased disclosure of relative liquidity in each book.

Information Provision:

• Commissions should consider reporting requirements for measures of liquidity and 

market imbalance for large market venues.

Regulators’ Access to Information:

• SEC should proceed with a sense of urgency, and focus on meaningful cost/benefit 

analyses, to implement a consolidated audit trail for the US equity markets and that the 

CFTC similarly enhance its existing data collection regarding orders and executions.

d. TAC Subcommittee on Pre-Trade Functionality Recommendations6

Trading Firms:

• Pre-Trade quantity limits on individual orders—Orders where the quantity exceeds 

the specified limit would be caught before being sent to an exchange, and rejected 

internally (so never sent to the exchange). 

• Pre-Trade price collars—Orders where the price is too far away from the current 

market would be caught, rejected internally, and never sent to the exchange. 

• Execution Throttles—If a particular algorithm or group of algorithms receives too many 

fills over a specified period of time, it will disable that algorithm (or group) and prevent it 

from placing new orders until there is human intervention to verify that the system is 

functioning properly. 

• Message Throttles—If a particular algorithm or group of algorithms sends too many 

messages in a specified period of time, it will disable that algorithm (or group) and 

prevent it (them) from placing new orders until there is human verification that the 

system is functioning properly. 

• Kill Button—As a failsafe, every firm should have the capability to simultaneously 

cancel all existing orders, and to prevent the entire firm from placing any new orders. 

Clearing Firms:

Clearing firms should be required to institute reasonable measures to confirm that their client 

trading firms generally implement the pre-trade controls mentioned above. This is a sensitive 

issue as the trading firms will generally not want clearing firm personnel examining their 

proprietary code. Therefore, the clearing firms will have to rely on written certification from the 

 6 These recommendations were first publicly presented at a TAC meeting on March 1, 2011. The stated objective 

was to recommend “pre-trade measures that would preserve market integrity in cases of direct market access.” 

http://www.cftc.gov/ucm/groups/public/@swaps/documents/dfsubmission/tacpresentation030111_ptfs2.pdf.
TAC Reference Document

October 30, 2012

13

trading firm, and from the trading firm’s hosting independent software vendor (ISV), that the 

functionalities are in place and being used with parameters agreed to by the clearing firm. 

Specifically, whether the pre-trade functionalities are developed by the clearing firm, by the 

trading firm or by an ISV, 

• The parameters used must be agreed to by the clearing firm and cannot be changed 

without permission from the clearing firm. 

• The kill button must be accessible to both the trading firm and the clearing firm 

Exchanges:

• Pre-Trade quantity limits on individual orders—Orders where the quantity exceeds 

the specified limit would be caught and rejected by the exchange. Currently, most major 

exchanges have this functionality, with specific limits by product and/or by trading 

session. 

• Intra-day Position Limits—The exchanges should allow clearing firms to set intra-day 

net long or short position limits for its customers in order to halt potentially errant 

algorithms. To be clear, the sole purpose of such limits is to enable clearing firms to 

prevent customers from accumulating positions that exceed levels at which the clearing 

firm is financially comfortable. 

• Pre-Trade price collars—Orders where the price is too far away from the current 

market would be caught and rejected. Many exchanges have such functions in place, if 

not active for all products. 

• Message Throttles—Parallel to execution throttles, the exchange should similarly 

monitor the incoming messages from an identifiable individual and take action when the 

rate of messaging is too high. 

• Error Trade Policies—Error trade policies should be clear and should favor trade price 

adjustment rather than trade cancellation to minimize market disruption due to errors. 

• Order cancellation policies—To help clearing firms control risk, exchanges should: 

a. Allow clearing firms and their clients to opt for automatic cancellation of orders 

should the trading firm be disconnected from the exchange network. 

b. Provide clearing firms with an order management tool that allows them to view 

all of their firm’s working and filled orders and to cancel working orders.
TAC Reference Document

October 30, 2012

14

e. FIA Principal Traders Group and FIA European Principal Traders Association: 

Software Development and Change Management Recommendations7

Software Development

Trading firms should have a process in place through which they can implement new code or 

changes to existing source code. Best practices for software development processes should 

address the following:

a. Development Environment—Firms should maintain a development environment that is 

adequately isolated from the production trading environment. The development environment 

may include computers, networks and databases and should be used by software engineers 

while developing and testing new source code.

b. Source Code Management—Firms should maintain a source code repository to manage 

source code access, persistence, and changes. The source code repository may be used to 

ascertain when software changes were made and the nature of the changes.

c. Risk Controls—Firms should implement software based risk controls that are independent 

from the trader in order to reduce the risk of market disruptions due to system failures or 

errors (see FIA PTG Recommended Risk Controls). 

d. Source Code Review—When appropriate, firms should have a process describing how 

software engineers may have their source code reviewed and how that review may be 

conducted.

Software Testing 

Trading firms should have a process for testing core software components before they are 

released to the production environment. Among the testing methods to consider are:

e. Unit Testing—A type of testing in which discrete units of source code are tested to verify 

they work as desired. These tests may be configured to run automatically throughout the 

development process. 

f. Functional Testing—A type of testing in which well-defined software modules are 

combined to have their functionality tested as a group. Two types of functional testing that 

may be considered are “integration” and “regression” testing.

g. Non-Functional Testing—A type of testing in which well-defined software modules are 

combined to have their non-functional aspects tested as a group. Such non-functional aspects 

might include scalability, performance, stability, and usability. 

h. Acceptance Testing—Software is tested by an end-user to verify conformance of a system 

to the stated business requirements. Acceptance testing should be done in an environment 

that adequately represents the environment in which the software will be released. 

 7 These recommendations were published in March 2012. 

http://www.futuresindustry.org/downloads/Software_Change_Management.pdf.
TAC Reference Document

October 30, 2012

15

i. Exchange-Based Conformance Testing—A type of testing utilized to confirm a system’s 

functionality while interacting with an exchange. This process is often guided by a script of 

tests provided by the exchange and is performed in an exchange-provided testing 

environment to simulate the production trading environment.

During the testing process, firms should consider potential impact to trading systems, external 

markets, compliance systems, middle and back office systems, user interfaces, and reporting 

mechanisms.

Change Management Process

Change Management Core Components 

The following practices are integral to a trading firm’s change management process: 

• Authorization—Any changes to the production environment should be subject to review 

by a responsible party within the organization. The depth of the review performed should 

align with the magnitude of the proposed change. 

• Auditability—Trading firms should establish procedures for communicating 

requirements, changes and functionality related to their proprietary software and 

technical infrastructure. Trading firms should also maintain a historical audit trail of 

material changes made to their proprietary software, allowing them to accurately 

determine: 

When a change was made? Who made the change? The nature of the change?

Steps Commonly Seen Within the Release Process 

• Initiation—Every software change is initiated to meet a business, technical, or external 

requirement. The initiator of the change should identify the requirement(s) or nature of 

the change. 

• Approval—Prior to deployment, a planned change should be reviewed and subject to 

approval by a responsible party. This review may occur prior to development taking place 

or after development is completed. 

• Scheduling—Prior to deployment, a planned change should be scheduled for release into 

the production environment, and should be considered along with any other planned 

changes. 

• Deployment—Deployment is the act of releasing a change into the production 

environment. Depending on the nature of the change, it may be appropriate to deploy to 

the entire production environment at once or to deploy the change in phases to further 

mitigate risk and ease the reversion of the change if necessary. 

Deployment may be thought of as containing four phases: 

1) Preparation—The change is prepared for release and the current production 

environment is backed up in order to allow for reversion of the change. 

2) Execution—The change is released to the production environment. 
TAC Reference Document

October 30, 2012

16

3) Validation—The change and the state of the production environment should be 

verified for correctness. The scope of a firm’s validation process should be 

appropriate and proportionate to the change being made. 

4) Completion/Reversion—A successful validation should result in completion of 

the change. If the change cannot be validated, the environment should be reverted 

to its prior stable state. 

• Post Deployment—Special consideration should be given to how certain changes to 

trading systems may impact trading in the production environment. Where reasonable, 

substantive changes to trading systems should be activated initially with appropriately 

restricted risk limits and access to markets. 

These practices facilitate effective risk management and are consistent with the overall 

development and change management process: identifying the desired or required change, 

developing and testing the change, deploying the change, and verifying the change.

Security 

Trading firms should establish security measures within all aspects of their business. In addition 

to the security measures in the FIA PTG Recommended Risk Controls, some considerations in 

building effective security measures for software development and change management include:

• Maintaining source code, technical infrastructure and trading systems (“Technology”) in 

a physically, technologically and otherwise secure manner; and

• Allowing access to Technology to approved persons and through mechanisms that 

validate identity in a manner consistent with a firm’s regulatory obligations and internal 

requirements.

f. FIA Order Handling Risk Management Recommendations for Executing Brokers8

Executing Broker Pre-Trade Controls

Executing brokers should use pre-trade controls to reduce the risk of 1) inadvertent entry of 

orders at the wrong price or quantity, 2) unintentional triggering of a client algorithm or 3) an 

improperly configured client algorithm. Effective pre-trade controls may include the following:

• Trader and Automated Trading System Identifiers

• Order Size or “Fat Finger” Limits

• Position or Margin Limits

• Cancel-on-Disconnect

• Independent Order Cancellation Capability

• Kill Switch

Executing Broker Automated Execution Tools

 8 These recommendations were published in March 2012.

http://www.futuresindustry.org/downloads/Order_Handling-Ex_Brokers.pdf.
TAC Reference Document

October 30, 2012

17

The use of a broker-provided automated execution tool requires both client and broker to

be cognizant of the performance of the tool and how it is expected to behave under different

market conditions. Consistent with prudent risk management, it is recommended that executing

brokers establish general controls similar to those listed above but with additional checks for the 

tool while it is working, as well as checks against the orders that the tool submits to the market. 

These may include:

• Controls Before the Execution Tool

o Order Size Limits

• Controls Embedded Within the Execution Tool

o Market Impact Checks

o Dynamic Price Checks

o Dynamic Market Move Checks

o Market Halt Parameters

• Controls after the execution tool

o Last-Look Reasonability Checks

Client Post-Trade Reconciliation

FIA supports the widespread industry practice of allowing clients to compare their internal trade

records against the executing broker’s own records. Similarly, FIA recommends processes that 

allow clients to reconcile both orders and fills through their executing broker’s trading platforms. 

FIA advises that the post-trade data feed contain all fills at a minimum but may also contain 

additional data (messaging, cancels, etc.) at the discretion of the executing broker or at the 

request of the client. In addition, FIA recommends that brokers, exchanges and other trading 

platforms work toward an industry standard for delivering cleared information within a standard 

deadline (e.g., two to three minutes after a trade is executed). 

Validation of Client Access and Oversight of Client Activity

Executing brokers should provide information to clients that access the brokers’ trading 

platforms in the following areas:

• Guidance on relevant rules and regulations for trading on an exchange, including

where possible a link to the exchange website.

• Alternative methods to contact the executing broker during any outage of their

trading platform.

Executing brokers should develop procedures for reviewing electronic execution of orders,

including:

• Trading restrictions

• Review of internal administrative terminal access

• Ratios of orders to fills

Executing brokers should also implement procedures to address inadvertent trading and errors

that may result from such.

Client Conformance Testing

In the event that a client seeks to have its systems write directly to the order entry or market

data interfaces of a broker’s trading platforms, the executing broker should require the client
TAC Reference Document

October 30, 2012

18

to satisfy a set of conformance tests to ensure that the client’s systems interact correctly with

the relevant platforms. Such conformance tests are also applicable for third-party OMS’ and

EMS’ that interface with the broker’s trading platform.

The most effective means of accomplishing this goal would be through a conformance or test 

environment that replicates the actual behavior of the trading platform that the client will access 

to trade in production. This could be accomplished by providing the client with access

to an exchange test environment where available and/or a simulation environment for the

broker’s automated execution tools. Consistent with FIA’s Market Access Risk Management

Recommendations, FIA strongly recommends that exchanges provide a test environment that

brokers, vendors and clients can use for certification of their message flow. This should be as

close as possible to the current production environment and should be available throughout

the business week.

Additional Recommended Best Practices for Executing Brokers

• Electronic Trading Interruptions: in cases where clients access a broker’s trading 

platform, executing brokers should establish monitoring tools to alert support staff when 

a trading connection is broken and/or orders are being rejected.

• Physical Security: executing brokers should take steps reasonably designed to limit 

access to trading platforms under the broker’s control to only those authorized to trade.

• Electronic Security: firms should consider the security of their trading and business 

networks and be aware of the risk of access to their network infrastructure by 

unauthorized personnel; use network firewalls, virtual private network (VPN) 

connections or other security devices to prevent unauthorized remote access to

business networks; and have policies and procedures to address staff departures.

• Business Continuity: firms should consider the necessity of a comprehensive disaster 

response plan in the context of their business; consider the utility of standby failover for 

production infrastructure such as servers and network hardware in addition to key 

services such as the trading platform as well as supporting services such as back office 

and business e-mail continuity; and regularly test business continuity plans.

• Electronic Error Trade Process: executing brokers should have in place flexible but 

robust processes to address electronic error trades for their trading platform.
TAC Reference Document

October 30, 2012

19

III. Relevant CFTC Regulations

(CFTC Rule Changes Pursuant to Dodd-Frank)

Market Abuse – Disruptive Trading Practices

• Adds new section 4c(a)(5) to the Commodity Exchange Act

• Prohibits any trading, practice, or conduct on or subject to the rules of a registered entity 

that

o Violates bids or offers

o Demonstrates intentional or reckless disregard for the orderly executions in the 

close

o Is spoofing (bidding or offering with intent to cancel before execution)

DCM / SEF Rules

• Commission regulation 38.255 (pre-trade risk controls): DCMs to establish risk controls 

that “prevent and reduce the potential risk of price distortion and market disruptions, 

including, but not limited to, market restrictions that pause or halt trading in conditions 

prescribed” by the DCM. 

• DCM Core Principle 4 requires that DCMs identify pre-trade limits order size, price 

collars or bands and message throttles as responsive measures to demonstrate compliance 

with CP4

• Commission regulation 38.607: requires exchanges that permit direct market access to 

have effective systems and controls designed to facilitate FCM’s management of 

financial risk.

• SEF proposed rules require similar halt requirements to those in regulation 38.255

FCMs, SDs, and MSPs that are Clearing Members

• Commission regulation 1.73: required to screen “order” for risk limits.

• Commission regulation 23.609: requires clearing member firms to establish risk-based 

limits based on “position size, order size, margin requirements or other similar factors.”

• Commission regulations 1.74 and 23.610: straight through processing to pre-screen 

orders and allow DCO to accept or reject trades.

Traders (SD/MSP/Floor brokers)

• Commission regulation 23.600(d)(9): books and records to ensure compliance with 

supervision, maintenance, testing and inspection of trade programs.