Direct and Exclusive Control and Its One Exception

This paragraph is the one the market access rule was written to fix. Before it, a firm could rely on the customer whose orders it was supposed to be filtering to build and run the filters.

What Does "Direct and Exclusive Control" Require?

The financial and regulatory risk management controls and supervisory procedures the rule describes must be under the direct and exclusive control of the broker or dealer that is subject to the general duty. The duty and the control sit on the same firm.

Staff read the phrase operationally. The firm must have the ability to directly monitor, and the exclusive ability to adjust, as appropriate, the operation of those controls in real time. Outside the one allocation the rule permits, a firm may not give an affiliated broker-dealer control over them.

The release puts the negative side plainly: the firm with market access "could not delegate the oversight of, or power to adjust, its controls to a third party". Its working example is that only the firm providing market access can make intra-day adjustments to manage a customer's credit limit.

The provision exists to end a practice. The Commission describes firms relying on "its customer, a third party service provider, or others, to establish and maintain the applicable risk controls", which lets a market access customer "in effect" police itself.

Exam Tip: Gotchas

• An affiliate is a third party for this purpose. Common ownership does not merge two firms into the one that holds direct and exclusive control, though an affiliated customer that is a registered broker-dealer can still receive an allocation of specific regulatory controls under the written-contract exception.
• Real time is part of the standard. Monitoring that arrives at the end of the day is not the direct monitoring staff describe, because intra-day adjustment must remain possible.

What May a Firm Allocate, and to Whom?

Start from what does not change. Where a firm with market access has an arrangement with a broker-dealer customer, staff confirm it must still implement controls reasonably designed to ensure compliance with all regulatory requirements applicable in connection with the access provided to that customer. A regulated customer does not shrink the duty.

Staff name two pieces of that duty in the same answer: preventing the entry of orders unless there has been compliance with all regulatory requirements that must be satisfied on a pre-order entry basis, and assuring that appropriate surveillance personnel receive immediate post-trade execution reports.

The rule then opens with "notwithstanding the foregoing" and permits one narrow allocation. A firm subject to the general duty may reasonably allocate control over specific regulatory controls and supervisory procedures to a customer that is a registered broker or dealer.

Two conditions and one proviso attach.

The allocation reaches the regulatory controls only. The financial controls are never allocable, and staff put it as an absolute: financial risk management controls and supervisory procedures "must always remain under the direct and exclusive control of the broker-dealer providing market access."

Staff add one further condition on every allocation. Control may be allocated "only if such broker dealer customer is not trading for its own account."

The release names three families of function that turn on knowledge of the ultimate customer the allocating firm does not have, and says the list is not exhaustive.

• Obligations under suitability and other know-your-customer rules, because the firm with the direct customer relationship may have better access to that customer's financial resources and investment objectives
• The mechanism for preventing the ultimate customer from trading securities it is restricted from trading
• Surveillance for manipulation or fraud in the ultimate customer's account, such as wash sales, marking the close, and insider trading, because the allocating firm may see only aggregate trading by the broker-dealer customer in an omnibus or other account, and not trading at the individual customer account level

The release names three things it expects of a firm that allocates.

• A thorough due diligence review establishing the reasonable basis and the customer's capability to implement the controls specifically allocated to it
• A written contract that clearly articulates the scope of the arrangement and the specific responsibilities of each party, and that specifies the controls over which control is allocated
• A system the firm must establish, document, and maintain to regularly review the customer's performance under that contract and the effectiveness of the allocated controls, promptly addressing any performance weaknesses, including termination of the arrangement if warranted

Staff warn that an existing clearing agreement likely does not address the allocation with sufficient specificity to do this work.

The reasonable basis is not a private conclusion. In all cases the firm providing market access must be prepared to demonstrate that basis for the specific function over which control is allocated, because the rule accommodates allocation in those circumstances where, and only where, another registered broker-dealer is better positioned to implement the function.

Two further points attach where the customer is a registered broker-dealer. Only the first depends on an allocation.

Where control over those functions is allocated, the Commission expects the allocating firm to immediately provide its registered broker-dealer customer with the post-trade execution reports it receives from exchanges and alternative trading systems (ATSs), so the customer can effectively surveil for fraud and manipulation in the ultimate customers' accounts.

Separately, and in accordance with the requirements of Regulation SHO, a firm providing market access may rely on a registered broker-dealer customer's compliance with the locate requirement in the locate and borrow rule, unless the firm providing market access contractually undertook responsibility for that compliance.

Exam Tip: Gotchas

• Only regulatory controls move, and only to a registered broker-dealer customer. A non-broker-dealer customer can never be an allocatee, however sophisticated it is.
• The written contract and the due diligence are both conditions, not alternatives. The rule requires the allocation to be by written contract and after a thorough due diligence review.
• The reliance on a customer's locate compliance can be contracted away. If the firm providing market access undertook responsibility for the locate requirement in the contract, it cannot then rely on the customer.

What Does the Allocating Firm Still Owe?

An allocation is not a hand-off. The Commission emphasizes that the allocating firm "may not merely rely on another broker-dealer's attestation that it has implemented appropriate controls or procedures, or has agreed to be responsible for the same".

Instead it should independently review, on an ongoing basis, the effectiveness of the controls or procedures allocated, and promptly address any weaknesses.

The rule itself closes the loop. An allocation does not relieve the allocating firm from any obligation under this section, including the overall responsibility to establish, document, and maintain a system of risk management controls and supervisory procedures reasonably designed to manage the financial, regulatory, and other risks of market access.

The release says the same in the other direction: the firm providing market access remains ultimately responsible for the performance of any regulatory control or procedure for which control is allocated. Staff repeat it three separate times, that notwithstanding the allocation provisions, the firm with or providing market access is ultimately responsible for the efficacy of the regulatory risk management controls.

The Commission also believes the firm providing market access should retain ultimate responsibility for trading activity that occurs by virtue of its market participant identifier (MPID).

Exam Tip: Gotchas

• An attestation from the allocatee is not compliance. The allocating firm owes its own ongoing review of whether the allocated controls actually work.
• Allocation moves control, not responsibility. The allocating firm keeps every obligation under the rule, including the overall duty to build and maintain the system.

Can a Firm Use Someone Else's Risk Technology?

Yes, within limits. Staff say a firm may use risk management tools or technology provided by third parties independent of the customer, including exchanges and ATSs, to satisfy the financial and regulatory control requirements, so long as the firm has direct and exclusive control over those tools or technology. A vendor arrangement is consistent with the direct and exclusive control requirement rather than an exception to it.

The release spells out what an independent third party may do.

• Design and build the risk management tools or technology for the firm, so long as the firm performs appropriate due diligence as to their effectiveness
• Perform routine maintenance and implement technology upgrades, so long as the firm performs its own due diligence on the changes and their implementation
• Host the tools at its own facilities, so long as the firm can directly monitor their operation and has the exclusive ability to adjust the controls
• Supplement the firm's own monitoring of the operation of its controls
• Make an adjustment as agent for the firm, but only in response to specific direction from the firm on a case-by-case basis rather than pursuant to standing instructions

Using a third party does not move the responsibility. The release states that in all circumstances, the broker-dealer with market access would remain fully responsible for the effectiveness of the risk management controls.

The release also names who can be that independent third party: another broker-dealer, an exchange or ATS, a service bureau, or other entity that is not an affiliate of, and is otherwise independent of, the market access customer. An affiliate for this purpose includes any person that, directly or indirectly, controls, is under common control with, or is controlled by, the customer.

Independence is judged on substance, not corporate form. A provider that is technically not an affiliate is still not independent if it has a material business or other relationship with the customer which could interfere with providing effective risk management technology to the firm.

What the firm may not do is rely on risk management technology that is designed, built, maintained or otherwise under the control of the customer or its affiliates.

The firm must perform appropriate due diligence to assure the provided controls are reasonably designed, effective, and otherwise consistent with the rule. It may not rely merely on representations of the technology provider, even an exchange or other regulated entity, and simple reliance on the customer's own representation of independence is insufficient.

What counts as appropriate due diligence depends on the individual facts and circumstances, and staff say there may well be multiple approaches. The steps they offer are examples rather than a checklist, and they might include the following.

• A review of publicly available information about the ownership and material business relationships of the third-party technology provider and the customer
• Following up on any information that may indicate a lack of independence
• Requesting the technology provider and the customer to certify their independence from each other

Two boundaries run the other way. The rule does not preclude the customer from having its own risk management controls that exceed those under the firm's direct and exclusive control. And for controls other than those the rule requires, a firm is not precluded from using risk management technology over which it does not have direct and exclusive control.

Staff treat location and coordination as conditions rather than bars. Putting the firm's controls on the customer's premises "would not necessarily be inconsistent" with the direct and exclusive control requirement, but staff say it may complicate compliance and would require a rigorous assessment and ongoing monitoring of the integrity and security of the controls to assure the firm retains exclusive control over them.

Where a firm uses multiple stand-alone control systems across several exchanges and ATSs, "the disaggregated controls would have to be coordinated to ensure compliance with applicable regulatory and financial requirements".

Exam Tip: Gotchas

• A vendor may build and host the controls without breaking the standard. What it may not do is hold the power to adjust them on standing instructions or on its own initiative.
• Independence is judged on substance rather than corporate form. A material business relationship with the customer defeats independence even where no affiliation exists.
• A customer may run additional controls of its own. The rule bars reliance on customer-controlled technology for the required controls, not the customer's own extra safeguards.

What Should You Check on Exam Day?

• Confirm the financial controls stayed with the firm; only regulatory controls can move, and only to a registered broker-dealer customer.
• Look for both the written contract and the thorough due diligence review before treating an allocation as valid.
• Check whether the allocatee is trading for its own account, because staff bar the allocation in that case.
• Treat any reliance on an attestation, a clearing agreement, or a customer's own independence representation as insufficient on its own.
• Ask who holds the exclusive ability to adjust the controls in real time; a vendor acting as agent on case-by-case direction, or an allocatee under the one written-contract exception, does not break the standard.