Identifying Pre-Trade Risk Controls

Three of the four regulatory controls act at or before order entry. The fourth runs after execution, and reading its timing correctly is the most reliable point of separation on this topic.

What Must the Regulatory Controls Achieve?

The regulatory half of the required controls must be reasonably designed to ensure compliance with all regulatory requirements, including being reasonably designed to do four things.

The first control is written as a conditional. It does not require the firm to test every order against every rule; it requires the firm to stop an order unless the pre-order entry requirements have been met.

Exam Tip: Gotchas

• The regulatory standard is compliance with all regulatory requirements, not with the four listed items. The four are named as examples of what the controls must be reasonably designed to do, introduced by "including".
• The restricted-securities control names three persons. A restricted list scoped only to customers leaves out the firm itself and any other person trading through the arrangement.

Which Requirements Must Be Satisfied Before an Order Is Entered?

The release defines the category functionally. Requirements that must be satisfied on a pre-trade basis "are those requirements that can effectively be complied with only before an order is entered on an exchange or alternative trading system (ATS)".

It then names examples where pre-trade compliance is required on an order-by-order basis. Two of them are SEC rule families, Regulation SHO and the national market system rules of Regulation NMS, and two are venue rules.

• The marking and locate requirements of Regulation SHO
• The conditions Regulation NMS sets before an order can be marked an intermarket sweep order (ISO)
• Various exchange rules applicable to particular order types
• Compliance with trading halts

The release names the pre-trade category more than once, and where it names the category most fully it adds odd-lot orders. There it says the pre-trade controls "must, for example, be reasonably designed to assure compliance with exchange trading rules relating to special order types, trading halts, odd-lot orders, SEC rules under Regulation SHO and Regulation NMS". The staff responses list the same set.

Because the control is phrased as "prevent the entry", the release says the rule "would have the effect of requiring the broker-dealer's controls be applied on an automated, pre-trade basis, before orders route to the exchange or ATS".

Staff carve out one narrow case. An order handled and executed purely manually, with no electronic system involved before execution, may be subject only to manual pre-trade controls, which must still be reasonably designed to ensure compliance with all financial and regulatory requirements that must be satisfied on a pre-order entry basis. The lesson on the purpose of credit and capital limits covers that carve-out.

Not every regulatory requirement is a pre-trade one. The release acknowledges post-trade obligations, such as surveillance for manipulation, fraud and other illegal activity, and says the rule imposes no new substantive obligation either way.

The locate requirement itself is covered in the unit on handling and executing short sales, and intermarket sweep orders in the unit on Regulation NMS.

Exam Tip: Gotchas

• Odd-lot orders belong on the pre-trade list. The statements that name the pre-trade category most fully put odd-lot orders alongside exchange trading rules for special order types and trading halts, and the SEC rules under Regulation SHO and Regulation NMS.
• The test is not whether a requirement is important. It is whether the requirement can effectively be complied with only before the order is entered on an exchange or alternative trading system.
• Post-trade obligations gain no new substance from this rule. Surveillance for manipulation and fraud sits outside the pre-trade category; the rule adds a controls duty over existing requirements, not a new substantive one.

Who Can Be Restricted From Trading a Security?

The restricted-securities control runs in both directions, and the release illustrates each.

Where the firm itself is restricted, for example because it is not qualified to trade options, its controls must be reasonably designed to automatically prevent it from entering options orders either for its own account or as agent for a customer. Being restricted does not become an agency problem the customer can solve.

Where the firm is obligated to restrict a customer from a particular security, its controls must be reasonably designed to prevent orders in that security from being submitted to an exchange or ATS for that customer's account.

Exam Tip: Gotchas

• A firm restricted from a product cannot route around the restriction as agent. The control must block the order for the firm's own account and for a customer alike.
• The control blocks entry, not settlement or reporting. It works at the point the order would be submitted to the exchange or alternative trading system.

Who May Reach the Trading Systems?

The system-access control requires the firm to restrict access to trading systems and technology that provide market access to persons and accounts pre-approved and authorized by the broker or dealer.

The release names three elements it expects those controls to include.

• An effective process for vetting and approving the persons at the broker-dealer or the customer, as applicable, who will be permitted to use the trading systems or other technology
• Maintaining those trading systems or that technology in a physically secure manner
• Restricting access to them through effective mechanisms that validate identity

The purpose the release gives is that effective security procedures help assure only authorized, appropriately trained personnel reach the firm's trading systems. That in turn minimizes the risk that order entry errors, or other inappropriate or malicious trading activity, might occur.

Exam Tip: Gotchas

• Vetting reaches the customer's people as well as the firm's. The release names persons at the broker-dealer or customer, as applicable, who will use the systems.
• Physical security is one of the three expected elements. A control built only on logical identity validation leaves out one of the elements the Commission expects, maintaining those trading systems or that technology in a physically secure manner.

Who Receives the Execution Reports, and How Fast?

The fourth control requires the firm to assure that appropriate surveillance personnel receive immediate post-trade execution reports that result from market access. The Commission expects the firm to be able to identify the applicable customer associated with each such execution report.

The purpose covers both risk families the rule addresses. The release says the requirement that the firm providing market access receive immediate post-trade execution reports "is designed to assure the broker-dealer has the information immediately available to effectively control both its financial and regulatory risks".

On the regulatory side, immediate reports give surveillance personnel important information about potential regulatory violations, and better enable them to investigate, report, or halt suspicious or manipulative trading activity.

On the financial side, they give the firm more definitive data regarding the financial exposure faced by it at a given point in time, which the release calls a valuable supplement to the systematic pre-trade risk controls and other supervisory procedures the rule requires.

The word "immediate" attaches to the report, not to the analysis. The release says the provision "does not require, however, that post-trade surveillances for manipulation, fraud, and other matters occur immediately", and that those surveillances "should occur in a timely fashion as warranted by the facts and circumstances".

Because only appropriate surveillance personnel are entitled to the reports, the Commission expects firms to establish appropriate safeguards to assure that customer trading information is kept confidential and available only to appropriate personnel for regulatory compliance purposes.

Exam Tip: Gotchas

• Immediate reporting does not mean immediate surveillance. The reports arrive immediately; the manipulation and fraud reviews they feed occur in a timely fashion as warranted by the facts and circumstances.
• This is the one regulatory control that runs after execution. The other three operate at or before order entry, so a question about timing usually turns on which of the four it names.
• The recipients are named narrowly. The reports go to appropriate surveillance personnel, which is why the Commission pairs the requirement with confidentiality safeguards.

What Should You Check on Exam Day?

• Sort the four regulatory controls by timing: three act at or before order entry, and only the execution-report control acts after execution.
• On a pre-trade example, look for marking and locate, intermarket sweep order conditions, exchange rules for particular order types, trading halts, and odd-lot orders.
• Read the restricted-securities control against all three persons named: the broker or dealer, the customer, or any other person.
• Check a system-access answer for all three expected elements, including keeping the systems physically secure.
• Separate the immediacy of the execution report from the timing of the surveillance work it supports.