Patent ID: 12260458

DESCRIPTION OF NON-LIMITING EXAMPLE EMBODIMENTS

FIG.1is a schematic representation of a system in accordance with a non-limiting example embodiment. Multiple trader computer terminals12a. . .12ncommunicate (1) trade related data messages with a Broker data communications network10(which is typically an internal data communications network for the Broker's organization). Although shown outside, the trader terminals may reside inside or outside the Broker data communications network.FIG.1also shows multiple trader algorithm computer servers29a. . .29nthat each perform computer-implemented automatic trading within the Broker data communications network. The Broker data communications network10includes one or more switches18-26for switching or directing packets from a source node to a destination node. In various embodiments, the switches may switch packets based on protocol layer 2 information, e.g., MAC header information, protocol layer 3 information, e.g., IP header information, or a combination of layer 2 and layer 3 information. A packet switch is sometimes understood to packet switch at layer 2 while packet router is sometimes understood to packet switch at layer 3. The technology includes but is not limited to embodiments that use switches, routers, and combination switch/routers.

The Broker data communications network10also communicates with one or more exchanges14a. . .14n, (e.g., trading exchanges, liquidity destinations, dark pools, etc.) and Broker systems16(only one is shown for simplicity). Such exchanges14a. . .14nand Broker systems16are controlled by one or more computer servers or the like. Although output packets is shown flowing from the trader terminals12a. . .12nvia the Broker data communications network10to the exchanges14a. . .14nand Broker system16, packet monitoring and risk assessment may also be performed on packets flowing in other directions including from the exchanges14a. . .14nand/or Broker system16to the trader terminals12a. . .12n. Communication may be via any suitable signal communication medium as described above including but not limited to wired, wireless, electrical, optical, or electromagnetic communications technology.

The switches18,24, and26on the borders of the Broker data communications network10preferably also include a firewall for data security and protection. Data packets received from trader terminals12a. . .12nis routed towards the exchanges14a. . .14nvia one or more packet switches18-26in the network10. These packet switches may be owned or operated, in one non-limiting example, by a broker that allows an institutional client to trade under its market participant identifier (MPID). One or more of these switches18-26is configured to minor (copy) the packet flow it receives and sends the original packets on to their appropriate destination(s), which if those packets relate to trading means they are sent to one or more of the exchanges14a. . .14n. Each switch18-26may also be configured to send the mirrored packets to a network capture device28. The network capture device28receives mirrored data packets from one or more of the switches18-26.

In this example embodiment, the network capture device28receives all of the data packets that are transported through the Broker data communications network so that all data packets can be inspected. In example embodiments, the network capture device28identifies all data packets that relate to financial transactions and sends them to a normalization data processor30which eliminates duplicate packets and converts them to a standard format, if needed, before sending them to a risk analysis/exposure computer system32. In other example embodiments, the network capture device28forwards all packets to another node or to a further entity, e.g., a packet filter, that identifies all of those packets that relate to financial transactions and sends them to a normalization data processor30which eliminates duplicate packets and converts them to a standard format, if needed, before sending them to a risk analysis/exposure computer system32.

The network capture device28may be a packet analyzer, also known as a network analyzer, protocol analyzer, or packet sniffer, and is implemented using a programmed computer and/or using computing hardware which intercepts (and can if desired log) data packets passing over the data communications network10. One example network capture device28is Velocimetrics “Tip-off” product.

As data streams flow across the data communications network10, the network capture device28captures each data packet and, in non-limiting example embodiments, decodes the packet's header or other fields in the data packet to determine if it relates to financial network data packets. For example, decoded packets that contain both an = sign and a control A (ASIC 0) in a repeating pattern are likely to be FIX packets. FIX is a known financial data packet communications protocol. As another example, the packet analysis may be performed by decoding and identifying a data packet that is or relates to an OUCH (or other financial data communications protocol) login or other request. Packets that follow for that requested transmission are assumed to include OUCH packets.

One way to monitor all data packets in the Broker data communications network is via each network switch having a monitoring port that mirrors all packets passing through all ports of the switch. Another example approach is to use a network tap. Yet another example embodiment uses a packet analyzer such as tcpdump.

The risk analysis/exposure computer system32performs risk analysis (detailed examples are described below) and provides the results to a Broker computer system16. Based on the results, the Broker computer system16may take some appropriate or desired risk awareness action.

This financial data packet routing and monitoring technology addresses and resolves a computer-implemented financial transactions system technical challenge and provides a number of advantages not provided by existing computer-implemented financial transaction systems. First, monitoring all the data packets in the network prevents a rogue algorithm and other unconfigured and/or unauthorized order generators from avoiding detection and analysis by a risk analysis/exposure system. No assumption is made that all computerized trading systems are properly configured to be monitored by a risk analysis/exposure system. As a result, risk protection is enhanced dramatically. Second, the monitoring technology which provides this risk protection enhancement is low cost. Third, no additional latency is introduced over and above that introduced by the network switch. Fourth, the data packet mirroring and analysis is done in parallel to and does not impact normal trade communications and processing. Fifth, by monitoring all financial trade data packets sent over the network, trading algorithms and other order generators which are unexpected and/or unauthorized in the network can be detected and trigger risk awareness actions. In situations where there are multiple, diverse order generation systems, configuration of each system to allow for risk monitoring and shut-down can be prohibitively expensive as each system would need to be individually modified. Sixth, the technology described in this application allows for a single point of set-up and configuration to enable automatic risk monitoring for all trading systems.

In the example case of the rogue algorithm at Knight Capital, which was not configured to run through any risk analysis engine, the technology in this application would nevertheless detect those rogue trades and take risk awareness actions. Even if those risk awareness actions are ignored, the risk analysis computer system may take additional steps and shut down the network port that the rogue algorithm is trading on to break communication between the algorithm and exchange(s) which would have triggered an automatic cancellation of all open orders by the exchange(s). Such actions would have severely limited the losses sustained by Knight Capital had they been taken.

FIG.2is a flowchart illustrating example steps in accordance with a non-limiting example embodiment. In step S1, trader terminals transmit packetized messages to a broker's network, and the network routes those packets via one or more packet switches through the network to one or more exit switches (step S2). One or more of the switches minor (copy) all data packets moving through the network to a network capture device ((step S3). Meanwhile, the trade data packets continue on their way through the network (without any delay caused by the minoring) to the appropriate exchange destination (step S4). The network capture device automatically processes the received data packets, e.g., by decoding each packet to extract packet information like packet header information, packet size, particular packet fields or indicators, etc., in order to detect those packets that relate to financial transactions (step S5). As mentioned above, the network capture device may, in example embodiments, pass the packets to another computer node or entity to perform this processing. The network capture device (or other packet processing node or entity) transmits those data packets that the decoding detects relate to financial transactions for risk analysis (step S6), and may optionally save the detected packets in a memory if desired. In example embodiments, those detected packets that relate to financial transactions are normalized into a standard format since the packets may originate from disparate sources that use different data formats. This normalization may be done by a normalization engine, which then sends the packets that relate to financial transactions, now in standard format, to the risk exposure system for financial risk analysis and action if warranted (step S7).

FIG.3is a function block diagram of another non-limiting example embodiment with an illustrative financial trading and risk analysis computer system that processes financial articles of trade. One example trading system, described in U.S. Pat. No. 7,778,915 and incorporated herein by reference, performs consolidation and analysis of intraday financial risk related to submitted securities, commodities, options, futures transactions, where securities, commodities, options, and futures are examples of financial articles of trade. The submitted securities, commodities, options, futures, or other financial articles of trade transaction involve at least one of disparate systems, multiple parties, and multiple liquidity destinations. Reference to securities or security transactions below include transactions involving securities, commodities, options, or futures. The term “other financial articles of trade” transaction refers to any other article traded at the liquidity destinations other than securities, commodities, options, and futures. It should be appreciated that different configurations can be used to consolidate and analyze the data to achieve a given result. Although particular combinations are disclosed, variations on those combinations can be used to achieve the same consolidation and analysis in the financial trading and risk analysis computer system.

Hedge Funds1and2(40and42) each buy and/or sell various securities asset classes such as equities and equity derivatives (e.g., futures and options) in Electronic Communication Networks (ECNs)14a, Alternative Trading Systems (ATSs)14b, and exchanges14c,14d. A correspondent broker44is an authorized member of and helps the Hedge Funds40and42access the Electronic Communication Networks (ECNs)14a, Alternative Trading Systems (ATSs)14b, and exchanges14c,14d. The Hedge Funds40and42may use the broker44or a standalone electronic trading system to affect trades, e.g., the Hedge Fund42uses a proprietary system to trade on the Electronic Communication Network (ECN)14aas well as the Alternative Trading System (ATS)14band is using broker's system to trade on the Exchanges14c,14d. The Hedge Funds40and42and the broker44need to know about all the trading activities on a real time basis in order to more effectively manage their risk. Once a trade is executed, the trade must be settled using the clearing broker46. Advantageously, all of the data packets traffic associated with the hedge funds40and42, the broker, the Electronic Communication Networks (ECNs)14a, Alternative Trading Systems (ATSs)14b, and exchanges14c,14dare copied to the network capture device28for processing as described above.

The financial trading and risk analysis computer system32inFIG.3receives the financial data packets from the network capture device28and performs risk analysis based on those received final data packets. The risk analysis enables parties involved in the purchase and/or sale of securities, commodities and other financial articles to monitor intraday financial risk related to submitted securities transactions regardless of which securities trading system(s) were used by such party or such party's clients to affect such transactions, regardless of which liquidity destination or destinations was/were used to effect such transactions (e.g., the NYSE, NASDAQ or Alternative Trading Systems such as ECNs), and regardless of which third parties ultimately became involved in effecting such transactions (e.g., the initiating client, intermediary broker dealer(s), clearing firms, etc.).

At the same time that post-trade data is collected from the liquidity destinations, other financial information is collected from other sources including for example pre-trade financial transactions such as trader terminal orders identified by the network capture device from one or more networks that carry financial data packets. As financial data is collected from liquidity destinations and networks that carry financial data packets, other criteria, such as parameters of relevant account information may collected and stored so as to enable computer-implemented, real-time comparison of trading activity versus historical activity.

The risk exposure computer system32can interact with different network technologies and topologies to aggregate desired information. In some cases, the risk exposure computer system must be able to be configured to identify a particular private data messaging infrastructure to monitor and record appropriate transaction activity. In other cases, the risk exposure computer system may interact with other systems to make requests on a timed or event driven basis. This interaction could involve data message-based inquiries, direct access to databases, or other transaction-based requests. When relevant information related to a given financial situation is detected on one or more monitored networks, the relevant financial information is collected and, if necessary or desired, packaged, or translated into an appropriate normalized format and submitted for risk analysis. For example, the widely known FIX data protocol standard may be used as the standard format. Other data protocol formats could be used, e.g., OUCH or a proprietary format used only by the packet normalizer and risk analysis computer.

The risk exposure computer system32processes the received trade related data packets from the network capture device28and compares it against criteria, such as parameters or rules with regard to certain risks, trends, outages, uses, or other desired limits. The risk exposure computer system32can also leverage the capabilities of external analysis systems which may be commercially available to address particular risk, trend, outage, use scenarios, or other determining events. For example, an external analysis system could include a third party risk system for a particular class of securities or group of clients or other class. These parameters or rules and external analysis systems can be managed via a hierarchy to set overall criteria for a group of users, specialized criteria for individual users at any level within a defined hierarchy, or other criteria. These parameters or rules and external analysis systems can be used to adjust one or more composite ratings that will be used in other processing, or may simply accumulate a value or values for the impacted users and the hierarchy within which they exist.

Once the risk exposure computer system32determines that information warrants a responsive action, for example, the information equals, exceeds or falls below specified parameters or rules, notification alerts and/or action responses may be generated and sent. A configurable dashboard user interface may be used to display real-time views of aggregated trading activity across markets, asset classes, and trading systems. Notification alerts can be sent via e-mail, facsimile transmission, text message, voice, third-party message format/protocol or other messaging means to notify one or more user designated recipients, i.e., a human and/or machine, of a particular event. Notification alerts can require confirmation from recipients, if confirmation is not received within a defined timeframe. Also, follow-up notification alerts can be sent in accordance with user defined alert hierarchies until an acknowledgement is received from a designated recipient or recipients. Notification Alerts can be assigned priority to determine if they should be sent out instantaneously or after a specified amount of time, such as once an hour, a business driven window, such as once a day, or accumulate a certain number of messages before being released, or according to some other user criteria.

The risk exposure computer system32can also create action responses in an attempt to mitigate or maximize, as appropriate, the impact of identified situations in different scenarios. In this regard, an effective network(s) in which to affect an action response may be a network or networks other than the one in which the initial event occurred. For example, an action response may be to send a signal to the switch where the financial transactions are passing through, ordering that switch to stop all data packets on the port transporting the transactions. This would break the connection to the exchange and prevent further trades from occurring.

FIG.4is a function block diagram of an example of a non-limiting example embodiment of a network switch node100. The network switch100is coupled to other network switching devices and/or network nodes using one or more ports102. Switch100also includes a controller106that includes one or more processors or CPUs108, one or more memories110(including but not limited to magnetic, flash-based, solid state, or other storage technology), and an optional user interface112. The controller106is coupled to one or more forwarding information tables104that may include forwarding and/or routing information used by the switch100to forward network data packets via the one or more ports112. In some examples, the one or more forwarding information tables104may include a media access control (MAC) table, a layer 3 (L3) table, and/or other tables and data structures. In particular, the controller using the routing tables to forward a minor or copy of all of its data packets via one or more ports102to the network capture device28or200as described below.

FIG.5is a function block diagram of an example of a non-limiting example embodiment of a network of a network capture device200that is programmed according to certain example embodiments. The network capture device200includes a central processing unit or CPU202, a system bus204that communicates with RAM206and storage208. The storage208can be magnetic, flash-based, solid state, or other storage technology. The system bus204communicates with user input adapter210(e.g., PS/2, USB interface, or the like) that allows users in input commands to network capture device200via a user input device212(e.g., a keyboard, mouse, touch panel, or the like). The results of the processing may be displayed to a user on a display216via display interface214(e.g., a video card or the like).

The network capture device200may also include a network interface218(e.g., a transceiver) to facilitate wired (e.g., Ethernet—802.3x) and/or wireless communication (WiFi/802.11x protocols, cellular technology, and the like) with external systems222such as one or more of the packet switches like the network switch node100shown inFIG.4and/or one or more databases220. External systems222may also include other processing systems, such as systems that provide third party services, client devices, server systems, or other computing nodes similar to that of computing node200, e.g., to form a distributed computing system. External systems222may also include network attached storage (NAS) to hold large amounts of data. External systems, along with the internal storage and memory, may form a storage system for storing and maintaining information (e.g., graphical models, event log data, etc). Such a system may communicate with users and/or other computing systems to implement the techniques described herein. The database220may include relational, object orientated, or other types of databases for storing information (e.g., the makeup of an index, a tracked about of cash that has been generated by index components, etc).

In certain examples, a CPU may include multiple cores (e.g., (core1, core2, core3, and core4) that are all coupled to on-die memory (e.g., L2 or L3 cache memory). It will be appreciated that other architecture types may be used. For example, a multiple processor system may be used and the distinct processors may share fast onboard cache memory. Systems with additional, fewer, or single cores are also contemplated.

The risk exposure computer system32may automatically monitor and manage risk in several categories. Non-limiting examples in computerized trading exchanges include buying power/threshold restrictions, restricted and hard to borrow securities risk management, short sell restriction risk management, single order quantity limit management, single order value risk management, realized and unrealized profit and loss. The risk management system can be loaded with clients' overnight buying power and stock positions. During the day, the risk exposure computer system receives copies of all client messages of a financial nature in real-time, performs risk calculations, generates appropriate alerts, and/or takes appropriate action.

The risk exposure computer system32can check for the following example risk parameters and raise an alert if any of the defined parameters or rules is violated. Other customized risks checks may be added.

The following detailed examples are non-limiting and refer to a risk exposure computer system labeled RX which stands for RiskXposure to check for, detect, and manage all types of financial trading risks called “risk checks” across exchanges, clients, regions, and asset classes (e.g., equities, options, futures, etc.) to better manage exposure, and prevent unwanted activity like rogue trading algorithms, credit overages, etc. RiskXposure may be integrated with RiskWay, which is a trade control gateway for trading equities, to help users trade across multiple destinations while supporting managed activity with a robust set of trade risk controls.

Pre-Trade Risk Checks

Limits set in RX are sent to order entry gateways. Orders passing through the gateways are reviewed and possibly rejected before delivery to exchanges.

SOV, SOQ, Price Collars

Separate limits are available per asset class for SOQ (single order quantity), SOV (single order value), contract premium, and price collars.

Risk Checks

ActionVisibleVisibleRiskOnininCheckDescriptionBreachRiskwayRXEquityA limit on the number of shares in an order. Set asOrder isYesNoSOQ Limita function of the share price.rejected.EquityMaximum order value (shares * price) per order.Order isYesNoSOV Limitrejected.TieredPrice of an equity order is checked to ensure it isOrder isYesNoEquityin a range around the Best Bid & Offer. Multiplerejected.Price Collarprice collar ranges are configurable based onorder price. Price collar checks can enforce dollarranges or percent value ranges.% ADVLimits orders to within a percentage of the 20 dayOrder isYesNoas SOQaverage daily volume for the symbol.rejected.OptionsA limit on the number of contracts in an order. SetOrder isYesNoSOQas a function of the option price.rejected.OptionThe maximum order value (contracts * price)Order isYesNoSOV Limitper option.rejected.OptionsRestriction on the maximum price of an optionsOrder isYesNoMaxcontractrejected.PremiumOptionA limit to the total number of option contractsOrder isYesNoContractsbought and sold during the trading day.rejected.LimitTieredPrice of an option order is checked to ensure it isOrder isYesNoOptionin a range around the Best Bid & Offer. Multiplerejected.Priceprice collar ranges are configurable based onCollarorder price. Price collar checks can enforce dollarranges or percent value ranges.FuturesA per order risk check set on the shares/contractsOrder isYesNoSOQrequested in individual futures orders.rejected.MultiA limit on the combined value of a multileg orderOrder isYesNoLeg SOVcontaining equities and options.rejected.
Kill Switches

RX can disable trading of specific assets, or all trading for the entire enterprise, or for select traders.

ActionVisibleVisibleRiskOnininCheckDescriptionBreachRiskwayRXEquity KillDisables all equity trading for aOrder isYesNoSwitchtrader or group of traders.rejected.Option KillDisables all option trading for aOrder isYesNoSwitchtrader or group of traders.rejected.Disable AllDisables all trading for a traderOrder isYesNoTradingor group of traders.rejected.
Restricted Stocks, ETB
Restricted stock lists, and ETB validation is enforced before orders go to market.

ActionVisibleVisibleRiskOnininCheckDescriptionBreachRiskwayRXEasy ToOrder is checked againstOrder isYesNoBorrowbroker's ETB list.rejected.(ETB)Short SaleRestrictedOrder is checked against theOrder isYesNoStockbroker's Restricted Stock list.rejected.RestrictedOrder is checked againstOrder isYesNoStockbroker's Restricted Stock listrejected.by Sidebased on the side.Long/Order is checked against longOrder isYesNoShort Saleportfolio position to ensurerejected.sell is long sale.
At-Trade Risk Checks
At-Trade risk checks are updated with execution messages read from trading exchanges. If an execution creates a portfolio condition that exceed the allowed limit for a trader, RX will create
a breach condition that is sent to connected gateways. This breach notification informs the gateway either to reject all further trades from a trader (reject all mode), or to only allow specific order types that will decrease the trader's risk (liquidation mode).
Portfolio Market Value Risk Checks
RX can track and limit growing portfolio value (net, gross, long, and short).

ActionVisibleVisibleRiskOnininCheckDescriptionBreachRiskwayRXLeverageA limit on the portfolioRX screen alert,YesYesLimitgross marketEmail alert,value divided byPortfolio levelthe current equity.“reject all.”PortfolioLimitation on theRX screen alert,YesYesGMVabsolute value ofEmail alert,Limitthe long market valuePortfolio levelplus the short marketliquidate mode.value of a portfolio.PortfolioThe gross marketRX screen alert,YesYesGMV/value limit dividedEmail alert,Equityby the equity limit.Portfolio levelLimitliquidate mode.PortfolioThe limit to the marketRX screen alert,YesYesLMVvalue of allEmail alert,Limitlong positionsPortfolio levelfor the portfolio.liquidate mode.PortfolioThe net marketRX screen alert,YesYesNMVvalue limit for theEmail alert,Limitportfolio.Portfolio levelliquidate mode.PortfolioThe net market valueRX screen alert,YesYesNMV/divided by theEmail alert,Equityequity limit forPortfolio levelLimitthe portfolio.liquidate mode.PortfolioA limit on the shortRX screen alert,YesYesSMVmarket value ofEmail alert,Limitthe portfolio.Portfolio levelliquidate mode.NeutralityThe absolute value ofRX screen alert,YesYesRatiothe net marketEmail alert.value divided by thegross market value.Excess orA constraint on theRX screen alert,YesYesDeficitamount of liveEmail alert.Limitequity a tradermust keep in reserve.One option is torequire an equityamount greaterthan a percentageof the GMV of thetrader's portfolio.Another option isto set a fixedrequirement margin.StockLimit on total numberRX screenYesYesSharesof shares held.alert,LimitEmail alert.
Portfolio Loss Limits
RX can alert on and limit portfolio losses, both realized by held positions, and unrealized due to the current market value of a portfolio.

ActionVisibleVisibleRiskOnininCheckDescriptionBreachRiskwayRXRealizedLimit on theRX screen alert,YesYesLossrealized profitEmail alert,Limitand lossPortfolio levelof the traderliquidate mode.portfolio.UnrealizedLimit on theRX screen alert,YesYesLoss Limitunrealized profitEmail alert,and loss of thePortfolio levelportfolioliquidate mode.consideringcurrent marketprices.Total LossThe sum ofRX screen alert,YesYesLimitrealized andEmail alert,unrealizedPortfolio levelprofit and loss.liquidate mode.Total LossA limit to theRX screen alert,YesYesOverrealized plusEmail alert,Equityunrealized loss aPortfolio leveltrader can makeliquidate mode.as a percentage oftheir currentequity.
Portfolio Concentration Limits
RX can track and prevent traders from forming excessively concentrated portfolios with positions in just a few symbols.

ActionVisibleVisibleRiskOnininCheckDescriptionBreachRiskwayRXGMVThe maximum percentage thatRXYesYes%the Gross MarketscreenConcen-Value of any onealert,trationinstrument can be asEmailLimitcompared toalert,the Gross MarketPortfolioValue of the portfolio.levelliquidatemode.LMV %The maximum percentageRXYesYesConcen-that the long marketscreentrationvalue of any onealert,Limitinstrument can beEmailas compared toalert,the Long Market Value of thePortfolioportfolio.levelliquidatemode.SMVThe maximum percentageRXYesYes%that the ShortscreenConcen-Market Value of any onealert,trationinstrument can beEmailLimitas compared toalert,the Short Market Value of thePortfolioportfolio.levelliquidatemode.$DeltaThe Dollar Delta limit on anyPortfolioYesYesConcen-position within a portfolioleveltrationcompared to the DollarRXLimitDelta of the entire portfolioscreen(US only).alert,Emailalert,liquidatemode.Con-A limit to the potential lossRXNoYessolidatedin a single product and itsscreenRequire-derivative instruments versus thealert,mentTIMS-based worst caseEmailConcen-requirement of the entire traderalerttrationportfolio.
Locate Management
Locates can be tracked either in a pre-trade fashion or at-trade.
Risk Checks

ActionVisibleVisibleRiskOnininCheckDescriptionBreachRiskwayRX$DeltaThe Dollar Delta limit on anyRXYesYesConcen-position within a portfolioscreentrationcompared to the Dollar Delta ofalert,Limitthe entire portfolio (US only).Emailalert,Portfoliolevelliquidatemode.Con-A limit to the potential lossRXNoYessolidatedin a single product and itsscreenRequire-derivative instrumentsalert,mentversus theEmailConcen-TIMS-based worst casealerttrationrequirement of the entire traderportfolio.OrderOrder is checked againstOrder isYesNoBasedremainingrejected.Locateslocate quantity basedon total orders inthe market.ExecutionOrder is checked againstOrder isNoYesBasedremaining locate quantityrejected.Locatesbased on executions.
Order Pattern Limits
RX can temporarily suspend traders when certain trading patterns are detected.

ActionVisibleVisibleRiskOnininCheckDescriptionBreachRiskwayRXOptionLimits the number of optionRX screenYesYesFillexecutions a traderalert, EmailRatecan have peralert, optionsecond. If the tradertradingbreaches thissuspendedlimit, they will betemporarily.unable to placeoption orders for aconfigurabletimeout period.DuplicateRX scans for duplicateRX screenYesYesOrderorders with inalert, EmailPatternsa configurable time window.alert, similarduplicateorders arerejected fora time-outperiod.SelfRX periodically scansRX screenNoYesCrossfor self cross trades,alert, EmailCheckwhere the same MPIDalertparticipates in bothsides of a match,and creates breachesif they are found.
Portfolio Capital Risk Checks

ActionVisibleVisibleRiskOnininCheckDescriptionBreachRiskwayRXCommittedA limit onRX screenYesYesCapitalintraday portfolioalert, EmailLimitvalue minusAlert,offsetting BOD value.Portfoliolevel“liquidateonly.”BuyA limit on the runningRX screenYesYesCapitalsum of allalert, EmailLimittrader buyalert,executions (Shares *PortfolioPrice) for the day.level“reject all.”NetAbsolute value of buyRX screenYesYesCapitalcapital-sell capital.alert, EmailLimitalert,Portfoliolevel“reject all.”SellLimitation on theRX screenYesYesCapitalrunning sumalert, Emailof all sell executionsalert,(Shares *PortfolioPrice) for the day.level“reject all.”TotalThe running sum of allRX screenYesYesCapitalexecutionsalert, Email(Shares * Price) overalert,the trading day.Portfoliolevel“reject all.”
Position Level Risk Checks
As RX reads execution messages from exchanges, it tracks and updates the positions of each trader. These risk checks limit the exposure allowed in any single trader position. RX can also be configured to allow separate limits to be set on ETFs.

ActionVisibleVisibleRiskOnininCheckDescriptionBreachRiskwayRXFuturesA trader position limitRX screenYesYesNetset for individualalert, EmailContractsfutures contracts.alert.SymbolA limit to the totalRX screenYesYesADVnumber ofalert, Emailshares a trader is allowed toAlert,buy and sell in any symbol.Symbollevelliquidationmode.SymbolA limit on the NetRX screenYesYesNMVMarket Valuealert, EmailLimitof any symbol/position.Alert,Symbollevelliquidationmode.SymbolA limit to any symbol's netRX screenYesYesNMVmarket value divided by thealert, EmailOvertrader's current equity.Alert,EquitySymbolLimitlevelliquidationmode.ETFA limit to the total numberRX screenYesYesSymbolof shares a trader isalert, EmailADVallowed to buyAlert,and sell in an ETF symbol.Symbollevelliquidationmode.ETFA limit on the NetRX screenYesYesSymbolMarket Valuealert, EmailNMVof any ETF in theAlert,Limittrader portfolio.Symbollevelliquidationmode.ETFA limit to anyRX screenYesYesSymbolETF's net marketalert, EmailNMVvalue divided by the currentAlert,Overtrader equity.SymbolEquitylevelLimitliquidationmode.
Option Greek Risk Checks
RX supports limits on combined exposure to cross-asset risk. Limits can be placed on the combined risk of positions in equities and their related options (US only).

ActionVisibleVisibleRiskOnininCheckDescriptionBreachRiskwayRXPositionA maximumRX screenYesYes$DeltaDollar Delta limitalert, Emailfor any of the trader'sAlert,positions.Symbol levelliquidationmode.PositionA limit on the Dollar DeltaRX screenYesYes$Delta/divided by equityalert, EmailEquityfor any ofAlert,the trader's positions.Symbol levelliquidationmode.PositionA maximum Dollar GammaRX screenYesYes$Gammalimit for any of the trader'salert, Emailpositions.Alert,Symbol levelliquidationmode.PositionA limit on theRX screenYesYes$Gamma/Dollar Gammaalert, EmailEquitydivided by equity for any ofAlert,the trader's positions.Symbol levelliquidationmode.PortfolioA limit on the DollarRX screenYesYes$DeltaDelta foralert, Emaila trader's portfolioalert,Portfoliolevelliquidatemode.PortfolioA trader portfolio limit onRX screenYesYes$Delta/Dollar Delta dividedalert, EmailEquityby equity.alert,Portfoliolevelliquidatemode.PortfolioA limit on theRX screenYesYes$GammaDollar Gammaalert, Emailfor a trader's portfolio.alert,Portfoliolevelliquidatemode.PortfolioA trader portfolio limit onRX screenYesYes$Gamma/Dollar Gamma divided byalert, EmailEquityequity.alert,Portfoliolevelliquidatemode.PortfolioA limit on the DollarRX screenYesYes$VegaVega foralert, Emaila trader's portfolio.alert,Portfoliolevelliquidatemode.PortfolioA trader portfolio limit forRX screenYesYes$Vega/calculated Vega divided byalert, EmailEquityequity.alert,Portfoliolevelliquidatemode.GMVA trader portfolioRX screenYesYesDollarlimit for thealert, EmailDeltaDollar Delta adjusted Grossalert,Market Value.Portfoliolevelliquidatemode.GMVA trader portfolioRX screenYesYesDollarlimit for thealert, EmailDelta/Dollar Delta adjusted Grossalert,CurrentMarket Value divided byPortfolioEquityequity.levelliquidatemode.
Portfolio Margin Risk Checks
RX can track and limit the theoretical losses a trader portfolio will incur under an array of simulated market shifts.

ActionVisibleVisibleOnininRisk CheckDescriptionBreachRiskwayRXBuyingA limit on the calculatedRXYesYesPowerlosses a portfolio canscreenLimitincur assuming a ‘worstalert,case’ drop in value.EmailThe value loss ofalert,equities and options arePortfoliodeterminedlevelfrom TIMS data.liquidatemode.ConsolidatedA limit to the TIMSRXNoYesRequirementworst-case analysis onscreenLimita portfolio with additionalalert,security mapping andEmailoffsetting (futures,alert.options on futures, ETFs,options on ETFs, andoptions on indexes).ConsolidatedA limit to the TIMSRXNoYesRequirement/worst-case analysis on ascreenEquity Limitportfolio versus thealert,amount of reserve equityEmailheld by the trader.alert.ProductA limit on the ratio of theRXNoYesRequirement/worst case possible lossscreenEquity Limitfrom any of thealert,derivative instrumentsEmailof any single product versusalert.the trader's equity.
Custom Stress Risk Checks

sCustom stresses allow a client to define the their own shock scenarios that will be used to stress-test trader portfolios for potential losses.

ActionVisibleVisibleRiskOnininCheckDescriptionBreachRiskwayRXCustomA limit on theoretical portfolioRXNoYesScenario 1loss from thescreenOverfirst price/volatility shockalert,Equityscenario divided byEmailtrader equity.alert.CustomA limit on theoretical portfolioRXNoYesScenario 2loss from thescreenOversecond price/volatilityalert,Equityshock scenario divided byEmailtrader equity.alert.CustomA limit on theoretical portfolioRXNoYesScenario 3loss from thescreenOverthird price/volatilityalert,Equityshock scenario divided byEmailtrader equity.alert.CustomA limit on theoretical portfolioRXNoYesScenario 4loss from thescreenOverfourth price/volatilityalert,Equityshock scenario divided byEmailtrader equity.alert.CustomA limit on theoretical portfolioRXNoYesScenarioloss from thescreen5/Overfifth price/volatilityalert,Equityshock scenario divided byEmailtrader equity.alert.CustomA limit on theoretical portfolioRXNoYesScenario 6loss from thescreenOversixth price/volatilityalert,Equityshock scenario divided byEmailtrader equity.alert.CustomA limit on theoretical portfolioRXNoYesScenario 7loss from thescreenOverseventh price/volatilityalert,Equityshock scenario dividedEmailby trader equity.alert.CustomA limit on theoretical portfolioRXNoYesScenario 8loss from thescreenOvereighth price/volatilityalert,Equityshock scenario divided byEmailtrader equity.alert.CustomA limit on theoretical portfolioRXNoYesScenario 9loss from thescreenOverninth price/volatilityalert,Equityshock scenario divided byEmailtrader equity.alert.CustomA limit on theoretical portfolioRXNoYesScenarioloss from thescreen10 Overtenth price/volatilityalert,Equityshock scenario divided byEmailtrader equity.alert.Breakup 1A portfolio-wide limit on lossesRXNoYesOverusing the worst-screenEquitycase result per underlyingalert,from two of theEmaildefined custom scenarios.alert.Breakup 2A portfolio-wide limit on lossesRXNoYesOverusing the worst-screenEquitycase result per underlyingalert,from two of theEmaildefined custom scenarios.alert.LargestA limit per underlying (withRXNoYesIssuerrelated instrumentsscreenLoss 1offsetting). Up to ten of thealert,Overcustom scenarios are used toEmailEquityanalyze the maximum theoreticalalert.loss possible in an underlyingversus trader equity.LargestA limit per underlying (withRXNoYesIssuerrelated instrumentsscreenLoss 1offsetting). Up to ten of thealert,Overcustom scenarios are used toEmailEquityanalyze the maximum theoreticalalert.loss possible in an underlyingversus trader equity.
Open Order Risk Checks
RX can also track the risk of a trader's portfolio plus risk from open orders. When an order is submitted to the gateway, it consumes credit from a pool shared across all gateways connected to RX. If there is not enough credit for the order, then it is rejected before being routed to a exchange.
Risk Checks

ActionVisibleRiskOninVisibleCheckDescriptionBreachRiskwayin RXOpenA limit on a trader'sRXNoYesBuyingexecuted BuyingscreenPowerPower, plus all TIMS valuedalert,Limitopen orders times aEmaildiscount coefficient.alert.OpenLimit to the GMV of aRXNoYesGMVportfolio plus ascreenLimitdiscounted amountalert,for open orders.Emailalert.OpenA limit on the value of allRXNoYesLeverageheld positions plus ascreenLimitdiscounted amount for openalert,orders, divided by traderEmailequity.alert.
Gateway Configuration Checks

Order entry gateways in the TradeGuard system can be configured to enforce these checks. These are performed pre-trade at the gateway without any interaction with the RX.

ActionVisibleRiskOninVisibleCheckDescriptionBreachRiskwayin RXTime inOrder is checked for restrictedOrder isNoNoForcetimes in force.rejected.VerifyVerifies that order has anOrder isNoNoLendingactive locate flagrejected.Brokeridentifying valid lending broker.OrderOrder is checked forOrder isNoNoTyperestricted order typesrejected.Checks(e.g., Iceberg, ISO).MOC/LOCOrders are validated againstOrder isNoNoRulesexchange MOC/LOC rules.rejected.Tag ScriptOrders can be filtered based onOrder isNoNothe contents of any FIX field.rejected.Penny/Orders for securities aboveOrder isNoNoSub-one dollar must be inrejected.Pennyincrements of one penny.PricingOrders forConstraintssecurities below one dollarcan increment by aone hundredth of a penny.CanadianOrders for CanadianOrder isNoNoBoardsecurities must incrementrejected.Lotin units determined by theValidationsecurities previous closing price.

ActionRiskOnVisible inVisibleCheckDescriptionBreachRiskwayin RXMaximum theoreticalloss possible in anunderlying versustrader equity

Risk checks, such as one or more of the examples above, enable the risk analysis computer system to monitor capital usage and manage limits across accounts.

The above description sets forth specific details, such as particular embodiments for purposes of explanation and not limitation. It will be appreciated by one skilled in the art that other embodiments may be employed apart from these specific details. In some instances, detailed descriptions of well-known methods, nodes, interfaces, circuits, and devices have been omitted so as not obscure the description with unnecessary detail. Those skilled in the art will appreciate that the functions described may be implemented in one or more nodes using optical components, electronic components, hardware circuitry (e.g., analog and/or discrete logic gates interconnected to perform a specialized function, ASICs, PLAs, etc.), and/or using software programs and data in conjunction with one or more digital microprocessors or general purpose computers. Moreover, certain aspects of the technology may additionally be considered to be embodied entirely within any form of computer-readable memory, such as, for example, solid-state memory, magnetic disk, optical disk, etc. containing an appropriate set of computer instructions that may be executed by a processor to carry out the techniques described herein.

The term “signal” (e.g., a data signal, a data packet signal, etc.) is used herein to encompass any signal that transfers information from one position or region to another in an electrical, electronic, electromagnetic, optical, or magnetic form. Signals may be conducted from one position or region to another by electrical, optical, or magnetic conductors including via waveguides, but the broad scope of signals also includes light and other electromagnetic forms of signals (e.g., infrared, radio, etc.) and other signals transferred through non-conductive regions due to electrical, electronic, electromagnetic, or magnetic effects, e.g., wirelessly. In general, the broad category of electrical signals includes both analog and digital signals and both wired and wireless mediums. An analog signal includes information in the form of a continuously variable physical quantity, such as voltage; a digital signal, in contrast, includes information in the form of discrete values of a physical characteristic, which could also be, for example, voltage.

Unless the context indicates otherwise, the terms “circuitry” and “circuit” refer to structures in which one or more electronic components have sufficient electrical connections to operate together or in a related manner. In some instances, an item of circuitry can include more than one circuit. A “processor” is a collection of electrical circuits that may be termed as a processing circuit or processing circuitry and may sometimes include hardware and software components. In this context, software refers to stored or transmitted data that controls operation of the processor or that is accessed by the processor while operating, and hardware refers to components that store, transmit, and operate on the data. The distinction between software and hardware is not always clear-cut, however, because some components share characteristics of both. A given processor-implemented software component can often be replaced by an equivalent hardware component without significantly changing operation of circuitry, and a given hardware component can similarly be replaced by equivalent processor operations controlled by software.

Hardware implementations of certain aspects of the technology described above may include or encompass, without limitation, digital signal processor (DSP) hardware, a reduced instruction set processor, hardware (e.g., digital or analog) circuitry including but not limited to application specific integrated circuit(s) (ASIC) and/or field programmable gate array(s) (FPGA(s)), and (where appropriate) state machines capable of performing such functions.

Circuitry above is described structurally based on its configured operation or other characteristics. For example, circuitry that is configured to perform control operations may be referred to herein as control circuitry and circuitry that is configured to perform processing operations may be referred to as processing circuitry.

In terms of computer implementation, a computer is generally understood to comprise one or more processors or one or more controllers, and the terms computer, processor, and controller may be employed interchangeably. When provided by a computer, processor, or controller, the functions may be provided by a single dedicated computer or processor or controller, by a single shared computer or processor or controller, or by a plurality of individual computers or processors or controllers, some of which may be shared or distributed.

The term “system” as used herein means a computer system.

The terms “automatic” and “automatically” as used herein mean performed by or under the control of a computer.

Although various embodiments have been shown and described in detail, the claims are not limited to any particular embodiment or example. None of the above description should be read as implying that any particular element, step, range, or function is essential. All structural and functional equivalents to the elements of the above-described preferred embodiment that are known to those of ordinary skill in the art are expressly incorporated herein by reference and are intended to be encompassed. Moreover, it is not necessary for a device or method to address each and every problem sought to be solved by the present invention, for it to be encompassed by the invention. No embodiment, feature, component, or step in this specification is intended to be dedicated to the public.