CFTC Proposes Rulemaking Regarding Automated Trading

Transcription

1 CFTC Proposes Rulemaking Regarding Automated Trading CFTC Proposes Regulation AT to Impose Registration, Pre-Trade Risk Control and System Safeguard Requirements for Automated Trading Firms and Related Obligations for Clearing Members and Exchanges INTRODUCTION On November 24, 2015, the Commodity Futures Trading Commission (the CFTC or Commission ) voted unanimously to issue proposed rules to implement a framework of registration, compliance, recordkeeping and reporting rules for market participants engaging in algorithmic (or automated) trading activity. The proposal would also impose algorithmic trading compliance and oversight obligations on clearing member futures commission merchants ( clearing member FCMs ) and designated contract markets ( DCMs or exchanges ) and would impose a range of new requirements on DCMs. The proposed algorithmic trading rules (collectively, proposed Regulation AT ), which would largely codify a range of existing industry best practices, follows the CFTC s September 2013 Concept Release on Risk Controls and System Safeguards for Automated Trading Environments, in which the Commission originally solicited public comments on how best to address the transition to an automated and interconnected trading environment. Regulation AT includes proposed definitions for several previously undefined terms, notably including algorithmic trading, an AT Person (as used herein, AT Person ), and direct electronic access (or DEA ). The proposal does not define high-frequency trading, and instead is designed to apply to all algorithmic or automated trading, regardless of the speed of trading. Regulation AT would also require firms that are not otherwise registered with the CFTC in some other capacity, and that trade via DEA, to register with the CFTC as floor traders. New York Washington, D.C. Los Angeles Palo Alto London Paris Frankfurt Tokyo Hong Kong Beijing Melbourne Sydney

2 With respect to trading firms that are AT Persons and engaged in algorithmic trading on a DCM, Regulation AT would (1) introduce mandatory requirements for pre-trade and other risk controls, such as message throttles, maximum order size limits and order cancellation capacities, (2) require the development, testing and monitoring of algorithmic trading systems ( ATSs ) and the designation and training of algorithmic trading personnel, and (3) require policies and procedures and books and records, including a source code repository, related to their automated trading activity to be prepared and maintained (and subject to inspection and review by the CFTC and potentially certain other regulators). Clearing member FCMs would similarly be required to (1) implement risk controls for algorithmic trading orders from their customers that are AT Persons, and (2) submit compliance reports to the DCMs describing their program for complying with Regulation AT. DCMs would be required to (1) implement risk controls for both algorithmic trading orders and manually submitted orders, (2) receive and review risk control compliance reports from AT Persons and their clearing member FCMs, (3) provide test environments for AT Persons and their ATSs, and (4) establish risk controls for algorithmic orders submitted to DCMs by AT Persons using DEA. Regulation AT would also impose new requirements on any registered futures association ( RFA ) (i.e., the National Futures Association ( NFA )) to adopt membership rules for algorithmic trading and would require all AT Persons to become members of at least one RFA. The CFTC s proposal would separately require DCMs to (1) disclose any attributes of an electronic matching platform or trade execution facility that are not readily apparent to a market participant and materially impact market participant orders, (2) provide disclosures, via rule filings, regarding their market maker trading incentive programs, and (3) establish self-trade prevention tools. The Commission notes that the rules it seeks to impose via proposed Regulation AT are principles-based and would provide market participants with flexibility regarding the design and calibration of compliance efforts. Nonetheless, the proposal represents a substantial expansion of the formal compliance obligations that will apply to trading firms, clearing member FCMs and exchanges that are engaged in or facilitate algorithmic trading. Moreover, if adopted as proposed, Regulation AT would give the CFTC the authority to pursue enforcement actions against algorithmic and other automated traders, even without evidence of fraud, manipulation or other similar misconduct, provided that the CFTC determines that the traders did not comply with Regulation AT requirements. That is, while proposed Regulation AT is characterized as a principles-based and largely procedural regulatory framework, the more consequential potential impact is the creation of an independent basis for enforcement actions against trading firms even in the absence of fraud, manipulation or other forms of trading misconduct. The proposal identifies 164 specific requests for public comment, and comments are due 90 days after the date the proposal is published in the Federal Register. -2-

3 REGULATORY CONTEXT Regulation AT is part of a broader series of measures undertaken by the Commission in response to the development of automated trading environments and concerns raised by the Commission and other regulators regarding the impact of automated trading on the markets and its effect on volatility, among other market factors. In particular, the Commission and other regulators have expressed the view that automated trading has caused or exacerbated market disruption events and periods of market stress, and should be subject to some greater level of regulation. In recent years, the Commission has adopted regulations with respect to both DCMs and swap execution facilities (SEFs), requiring exchanges to implement risk control mechanisms to prevent the disruption of markets. 1 These regulations have not been directed specifically or exclusively at automated trading, but apply generally to market participants, including those engaged in automated trading, and have been motivated in part by such trading. Among other measures, the Commission has enacted requirements for DCMs that permit DEA by customers to have in place effective systems and controls reasonably designed to facilitate the FCM s management of financial risk. 2 The Commission requires clearing members to establish risk-based limits in their proprietary account and in each customer account based on position size, order size, margin requirements, or other similar factors, 3 and to use automated means to screen orders for compliance with the risk-based limits. 4 Clearing members must further have safeguards against the placement of erroneous orders, 5 and policies and procedures pertaining to the use, supervision, maintenance, testing and inspection of trading programs. 6 The Commission has also implemented rules concerning its authority to prohibit manipulative and deceptive devices and price manipulation. 7 The Securities Exchange Commission ( SEC ) also requires brokers and dealers to have risk controls before they can provide their customers with access to the market, such as the ability to prevent the entry of erroneous orders or orders exceeding certain credit or capital thresholds. 8 The SEC also requires certain registered entities to implement policies and procedures regarding the administration of their See Core Principles and Other Requirements for Designated Contract Markets, 77 FR 36612, (June 19, 2012); Core Principles and Other Requirements for Swap Execution Facilities, 78 FR 33476, (June 4, 2013). 17 CFR CFR 1.73(a)(1); see also (a)(1). 17 CFR (a)(2)(i); see also 1.73(a)(2)(i). 17 CFR 1.11(e)(3)(ii). 17 CFR (d)(9); 17 CFR 1.11(e)(3)(ii). See 17 CFR and See Risk Management Controls for Brokers or Dealers with Market Access; Final Rule, 75 FR (Nov. 15, 2010) at

4 technological systems. 9 Similarly, the Financial Industry Regulatory Authority ( FINRA ), the securities industry self-regulatory organization, is currently developing rules addressing the competency requirements of persons involved in the design and development of algorithmic trading, and European regulators are implementing and, in some instances, have already implemented measures similar to those of U.S. agencies. Regulation AT is being proposed in the context of these prior regulatory initiatives. PROPOSED DEFINITIONS Proposed Regulation AT would incorporate several new definitions into the CFTC s rules. The definitions are referenced throughout the substantive requirements of the proposed Regulation AT rule framework, and the key definitions are provided below, as proposed: A. ALGORITHMIC TRADING The proposal would define algorithmic trading as: B. AT PERSON [T]rading in any commodity interest as defined in CFTC Rule 1.3(yy)[ 10 ] on or subject to the rules of a designated contract market, where: The proposal would define an AT Person as: (1) One or more computer algorithms or systems determines whether to initiate, modify, or cancel an order, or otherwise makes determinations with respect to an order, including but not limited to: the product to be traded; the venue where the order will be placed; the type of order to be placed; the timing of the order; whether to place the order; the sequencing of the order in relation to other orders; the price of the order; the quantity of the order; the partition of the order into smaller components for submission; the number of orders to be placed; or how to manage the order after submission; and (2) Such order, modification or order cancellation is electronically submitted for processing on or subject to the rules of a designated contract market; provided, however, that Algorithmic Trading does not include an order, modification, or order cancellation whose every parameter or attribute is manually entered into a front-end system by a natural person, with no further discretion by any computer system or algorithm, prior to its electronic submission for processing on or subject to the rules of a designated contract market See Regulation Systems Compliance and Integrity; Final Rule, 79 FR (Dec. 5, 2014). Per Regulation 1.3 (yy), commodity interest means: (1) Any contract for the purchase or sale of a commodity for future delivery; (2) Any contract, agreement or transaction subject to a Commission regulation under section 4c or 19 of the Act; (3) Any contract, agreement or transaction subject to Commission jurisdiction under section 2(c)(2) of the Act; and (4) Any swap as defined in the Act, by the Commission, or jointly by the Commission and the Securities and Exchange Commission. -4-

5 [A]ny person registered or required to be registered as a C. DIRECT ELECTRONIC ACCESS (1) Futures commission merchant, floor broker, swap dealer, major swap participant, commodity pool operator, commodity trading advisor, or introducing broker that engages in Algorithmic Trading on or subject to the rules of a designated contract market; or (2) Floor trader [pursuant to the expanded floor trader registration requirement set forth as part of the CFTC s Regulation AT proposal, as described in greater detail below]. The proposal would define direct electronic access ( DEA ) as: [A]n arrangement where a person electronically transmits an order to a designated contract market, without the order first being routed through a separate person who is a member of a derivatives clearing organization to which the designated contract market submits transactions for clearing. The proposal also includes proposed definitions for the following terms: algorithmic trading compliance issue (generally, an event at an AT Person that has caused any algorithmic trading of that entity to operate in violation of the Commodity Exchange Act or the rules and regulations thereunder, or of other rules and requirements applicable to that AT Person s algorithmic trading); algorithmic trading disruption (generally, an event originating with an AT Person that disrupts or materially degrades its algorithmic trading, the operation of the DCM on which such AT Person is trading, or the ability of other market participants to trade on the DCM on which such AT Person is trading); algorithmic trading event (generally, an event at an AT Person that constitutes an algorithmic trading compliance issue or an algorithmic trading disruption); and AT order message (generally, each new order or quote submitted through algorithmic trading to a DCM by an AT Person, and each change or deletion submitted through algorithmic trading by an AT Person with respect to such an order or quote). AT PERSONS AND REGULATION AT Regulation AT would impose three general categories of compliance obligations on AT Persons: (1) risk controls, (2) system safeguards, and (3) recordkeeping and compliance reporting (including submitting an annual compliance report). In addition, market participants that engage in algorithmic trading via DEA and are not otherwise registered with the CFTC would be required to register as floor traders. A. PRE-TRADE AND OTHER RISK CONTROLS FOR AT PERSONS Proposed Regulation AT would require AT Persons to implement pre-trade risk controls, order cancellation systems, system connectivity requirements, algorithmic trading notifications, self-trade prevention tools and periodic reviews of each of these requirements. -5-

6 1. Pre-Trade Risk Controls The proposal would require AT Persons to implement pre-trade risk controls that include message throttles (i.e., maximum order message and execution frequency limits for a set time period), and order price parameters and maximum order size limits. The proposal also provides that pre-trade risk controls must be set at the AT Person or firm level, or at a more granular level (to be decided by the AT Person), such as by product, account, or one or more identifiers of natural persons associated with an algorithmic trading order message. In addition, the proposal would require the pre-trade risk control system to promptly alert natural person monitors at the AT Person when any pre-trade risk control parameters are breached. 2. Order Cancellation Systems AT Persons would be required to have systems that have the ability to immediately disengage algorithmic trading, cancel selected (or all) resting orders when system or market conditions require, and prevent the submission of new algorithmic trading messages or orders. In addition, prior to an AT Person s initial use of algorithmic trading to submit a message or order to a DCM s trading platform, the AT Person must notify that DCM as to whether all of its resting orders should either be cancelled or suspended in the event that the AT Person s ATS disconnects with the trading platform. 3. System Connectivity Requirements An AT Person would be required to implement systems to indicate on an ongoing basis whether they have proper connectivity with the DCM s trading platform and any systems used by a DCM to provide the AT Person with market data. 4. Algorithmic Trading Notifications to Exchanges Prior to an AT Person s initial use of algorithmic trading to submit a message or order to a DCM s trading platform, an AT Person would be required to notify its clearing member and the DCM of the fact that it will engage in algorithmic trading. 5. Self-Trade Prevention Tools AT Persons would be required to calibrate or take such other action as is necessary to utilize a DCM s self-trade prevention tools, which are the safeguards that many DCMs already provide, and which Regulation AT would now require, in order to prevent accounts with common beneficial ownership or common control from trading with each other. 6. Periodic Reviews of Pre-Trade and Other Risk Controls Regulation AT would also require an AT Person to periodically review its compliance with the requirements of Regulation AT and to determine whether it has effectively implemented sufficient measures reasonably designed to prevent an algorithmic trading event. In addition, AT Persons would be required take prompt action to remedy any deficiencies that are identified. -6-

7 B. SYSTEM SAFEGUARDS FOR AT PERSONS Proposed Regulation AT would require AT Persons to implement standards regarding the development, monitoring and compliance of ATSs, as well as the designation and training of AT staff. All policies and procedures would be required to be periodically reviewed for effectiveness and AT Persons would be required to take prompt action to document and remedy any deficiencies. 1. Development and testing of ATSs AT Persons would be required to implement written policies and procedures regarding the development and testing of their ATSs, and the policies and procedures must include, at a minimum: Maintaining a development environment (i.e., a set of processes and programming tools used to develop and test the ATSs) that is adequately isolated from the actual trading environment (referred to as production trading environment in Regulation AT). Regulation AT specifies that the development environment may include computers, networks and databases, and that it should be used by software engineers while developing, modifying and testing source code. Testing all software code and related systems used for algorithmic trading and any changes to such code and systems before they are implemented, including identifying circumstances that may contribute to future algorithmic trading events. AT Persons would be required to conduct testing both internally and on each DCM on which they will engage in algorithmic trading. Regular back-testing of algorithmic trading using historical transaction, order and message data to identify circumstances that may contribute to future algorithmic trading events. Regular stress tests of ATSs to verify their ability to operate in the manner intended under a variety of market conditions. Procedures to document the strategy and design of the proprietary algorithmic trading software used by an AT Person, as well as any changes to the software if the changes are implemented in a production environment. Maintaining a source code repository to manage source code access, persistence (i.e., its ability to not be deleted, or to be deleted only when it is expected to be deleted), copies of all code used in the production environment and changes to such code. The AT Person would be required to maintain in the source code repository an audit trail of material changes to source code that would allow it to determine, for each material change, who made the change, when the change was made and the coding purpose of the change. AT Persons would be required to keep the source code repository for five years and make it available for inspection by the Commission or the Department of Justice ( DOJ ) in accordance with CFTC rule Note that Regulation AT does not impose a specific or mandatory standard for how the repository must be structured or maintained, beyond requiring that it feature an audit trail and be made available for inspection upon request. 2. Monitoring of ATSs AT Persons would also be required to implement policies and procedures reasonably designed to ensure that each of their ATSs is subject to continuous real-time monitoring by knowledgeable and qualified staff while the ATS is engaged in trading. The policies and procedures would be required to include, require or provide, at a minimum: Continuous real-time monitoring of algorithmic trading to identify potential algorithmic trading events. -7-

8 Automated alerts when the AT order message of an ATS breaches design parameters, upon loss of network connectivity or data feeds or when market conditions approach the boundaries within which the ATS is intended to operate, to the extent applicable. The ability and authority of monitoring staff (via dashboards and control panels to monitor and interact with ATSs for which they are responsible) to disengage an ATS and to cancel resting orders when it is required by system or market conditions, including the ability to contact staff of the applicable DCM and clearing firm, as applicable, to seek information and cancel orders. Procedures enabling AT Persons to track which monitoring staff is responsible for an ATS during trading hours. 3. Compliance of ATSs AT Persons would also be required to implement written policies and procedures reasonably designed to ensure that their ATSs operate in a manner that complies with the Commodity Exchange Act and the rules and regulations thereunder. These policies and procedures must require: Staff of the AT Person to review ATSs to detect potential algorithmic trading compliance issues by being familiar with the Commodity Exchange Act and the rules and regulations thereunder, the rules of any DCM to which such AT Person submits AT order messages, the rules of any RFA of which the AT Person is a member, the AT Person s own internal requirements and the requirements of the AT Person s clearing member, in each case as applicable. A plan of internal coordination and communication regarding the design, changes, testing and controls of algorithm trading between compliance staff of the AT Person and staff of the AT Person responsible for algorithmic trading. 4. Designation and training of algorithmic trading staff AT Persons would be required to implement written policies and procedures to designate and train their staff responsible for algorithmic trading. These policies and procedures, at a minimum, would be required to include: Procedures for designating and training all staff involved in designating, testing and monitoring algorithmic trading, and documenting training events. At a minimum, training must cover design and testing standards, algorithmic trading event communication procedures and requirements for notifying staff of the applicable DCM when algorithmic trading events occur. Training policies reasonably designed to ensure that natural person monitors (i.e., designated and trained staff at the AT Person) are adequately trained for each algorithmic trading system or strategy, or material changes to the system or strategy, for which they are responsible. Training must cover, at a minimum, the trading strategy for the algorithmic trading, the automated and non-automated risk controls applicable to the algorithmic trading, design and testing standards, algorithmic trading event communication procedures and requirements for notifying staff of the applicable DCM when algorithmic trading events occur. Escalation procedures to notify senior staff of the AT Person as soon as algorithmic trading events are identified. C. AT PERSON COMPLIANCE REPORTS TO DCMS; RECORDKEEPING As proposed, Regulation AT would require AT Persons to prepare annually, and submit, a report, by June 30, to each DCM at which the AT Person engaged in algorithmic trading. The AT Person report must -8-

9 cover May 1 of the prior year to April 30 of the year for which the report is being submitted. The content of the report must include (1) a description of the pre-trade risk controls required by Regulation AT, including a description of each item enumerated in the pre-trade risk controls summary above, and a description of all parameters and the specific quantitative settings used by the AT Person for such pretrade risk controls; and (2) a certification by the chief executive officer or chief compliance officer of the AT Person that, to the best of his or her knowledge and reasonable belief, the information contained in the report is accurate and complete. In addition to the annual DCM compliance report, AT Persons would be required to keep, and provide upon request to each DCM at which the AT Person engaged in algorithmic trading, books and records regarding the AT Person s compliance with the requirements of Regulation AT. As noted above, AT Persons would also be required to maintain a source code repository to manage source code access and persistence (i.e., its ability to not be deleted, or to be deleted only when it is expected to be deleted), as well as all code used in the production environment and changes to the code and an audit trail of material changes to source code that would allow a reviewer to determine who made the material change, when it was made and the coding purpose of the change. As also noted above, source code repositories would be required to be made available for inspection by the Commission or the DOJ, upon request. Although this new requirement has sparked controversy due to concerns regarding intellectual property and cybersecurity and the ability of the CFTC or other regulators to protect the confidentiality of this type of information, the CFTC has historically asked market participants to produce trading source code and other similar types of highly confidential records for inspection, when relevant in the context of certain investigations. D. EXPANDED FLOOR TRADER REGISTRATION REQUIREMENT FOR ENGAGING IN ALGORITHMIC TRADING VIA DIRECT ELECTRONIC ACCESS Proposed Regulation AT would also expand the CFTC s floor trader registration requirement so that any person that is not otherwise registered with the CFTC as an FCM, floor broker, swap dealer, major swap participant, commodity pool operator, commodity trading advisor or introducing broker and that is using DEA to engage in algorithmic trading on a DCM on a proprietary basis would be required to register as a floor trader. CLEARING MEMBER FCMS AND REGULATION AT As summarized above, Regulation AT would impose two general categories of compliance obligations on clearing member FCMs risk controls for their AT Person customers and compliance reporting obligations to DCMs. A. PRE-TRADE AND OTHER RISK CONTROLS FOR CLEARING MEMBER FCMS For any algorithmic trading message or order originating from an AT Person, Proposed Regulation AT would require clearing member FCMs to impose pre-trade risk controls on an AT Person client that are -9-

10 reasonably designed to prevent or mitigate an algorithmic trading disruption (i.e., an event originating with an AT Person that disrupts or materially degrades its algorithmic trading, the operation of the DCM on which such AT Person is trading, or the ability of other market participants to trade on the DCM on which such AT Person is trading). The CFTC clarified that these pre-trade risk controls would include, at a minimum, message throttles (i.e., maximum order message and execution frequency limits over a set time period), and order price parameters and maximum order size limits. The rules for clearing member FCM risk controls mirror the pre-trade risk control requirements for AT Persons, as described above, permitting the clearing member FCM to set risk controls at either the AT Person or firm level, or at a more granular level, and separately requiring policies and procedures reasonably designed to ensure that natural person monitors at the clearing member FCM are promptly alerted when pre-trade risk control parameters are breached. Clearing member FCMs would be required to use the same order cancellation systems as are required of AT Persons. For clearing member FCM customers that engage in algorithmic trading via DEA, the CFTC has proposed to permit the clearing member FCM to rely on the DCM to meet its pre-trade and other risk controls (other than for the requirement to ensure that natural person monitors at the clearing member FCM are promptly alerted when pre-trade risk control parameters are breached), while for non-dea customers, the clearing member FCM itself would need to establish and maintain the required pre-trade risk controls and order cancellation systems. B. CLEARING MEMBER FCM COMPLIANCE REPORTS TO DCMS; RECORDKEEPING As proposed, Regulation AT would require clearing member FCMs to prepare and submit an annual report, by June 30, to each DCM at which an AT Person customer of the clearing member FCM engaged in algorithmic trading. The clearing member FCM report must cover May 1 of the prior year to April 30 of the year for which the report is being submitted. The content of the report must include (1) a description of the clearing member FCM s program for establishing and maintaining the pre-trade risk controls required for its AT Persons at the DCM to which the report is being submitted, and (2) a certification by the chief executive officer or chief compliance officer of the clearing member FCM that, to the best of his or her knowledge and reasonable belief, the information contained in the report is accurate and complete. In addition to the annual DCM compliance report, clearing member FCMs would be required to keep, and provide upon request to each DCM at which an AT Person customer of the clearing member FCM engaged in algorithmic trading, books and records regarding the clearing member FCM s compliance with the requirements of Regulation AT. DESIGNATED CONTRACT MARKETS AND REGULATION AT As summarized above, Regulation AT would impose four general categories of compliance obligations on DCMs. Regulation AT would require DCMs to (1) implement risk controls for both algorithmic trading orders and manually submitted orders, (2) receive and review risk control compliance reports from AT -10-

11 Persons and their clearing member FCMs, (3) provide test environments for AT Persons to test ATSs, and (4) establish risk controls for algorithmic orders submitted to DCMs by AT Persons using DEA. A. DCM RISK CONTROLS 1. Risk controls for both algorithmic trading orders and manually submitted orders Proposed Regulation AT would require DCMs to impose pre-trade risk controls reasonably designed to prevent or mitigate (1) an algorithmic trading disruption in connection with any algorithmic trading message or order originating from an AT Person, (2) any similar disruption resulting from manual orders or other non-algorithmic trading, and (3) any algorithmic compliance issue. The Commission clarified in the proposal that these pre-trade risk controls would include, at a minimum, the pre-trade risk controls required of AT Persons (described above). The rules for DCM risk controls would require that the DCM set risk controls at the level of each AT Person and evaluate whether to establish risk controls at a more granular level. DCMs would also be required to have policies and procedures reasonably designed to ensure that natural person monitors at the DCM are promptly alerted when pre-trade risk control parameters are breached. DCMs would also be required to use the same order cancellation systems that are required of AT Persons (described above), and DCMs would be required to be able to cancel or suspend all resting orders from AT Persons in the event that the AT Person disconnects from the trading platform. Under the proposal, DCMs would similarly be required to have systems enabling the systems of an AT Person with DEA to indicate to the AT Person whether it has proper connectivity with the DCM s trading platform and any systems used by the DCM to provide the AT Person with market data. 2. Risk controls for algorithmic orders submitted to DCMs by AT Persons using DEA Under proposed Regulation AT, for AT order messages that originate with an AT Person and that are submitted to a DCM through DEA, the DCM would be required to make available, to the clearing member FCM for the AT Person in question, systems and controls that are effective and reasonably designed to facilitate: The clearing member FCM s management of the risks arising from algorithmic trading using DEA. At a minimum, these systems and controls must include the pre-trade risk controls for AT Persons that are described above. The clearing member FCM s ability to make use of order cancellation systems, as described above. The DCM DEA risk controls must enable the clearing member FCM to set the controls at the level of each AT Person and one or more identifiers of natural persons associated with an AT order message. In addition, DCMs permitting DEA must also require clearing member FCMs to use these systems and controls with respect to all AT order messages that originate with their AT Person customers and that are submitted through DEA. -11-

12 B. RECEIVING AND REVIEWING COMPLIANCE REPORTS Regulation AT would require DCMs to require AT Persons and clearing member FCMs to submit compliance reports (described above) by June 30 of each year covering the period between May 1 of the previous year to April 30 of the current year. DCMs would also be required to establish a program to review and evaluate these reports effectively and periodically. Notably, the review and evaluation program must include measures reasonably designed to identify and remediate any insufficient mechanisms, policies and procedures described in these reports, including inadequate quantitative settings or calibrations of pre-trade risk controls required of AT Persons. Regulation AT would also require DCMs to implement rules requiring AT Persons and clearing member FCMs to keep books and records regarding their compliance with the requirements of Regulation AT. A DCM would be required to implement measures that are reasonably designed to identify and remediate insufficient compliance mechanisms, policies and procedures identified by the DCM. C. TEST ENVIRONMENTS Regulation AT would require a DCM to provide a test environment enabling AT Persons to simulate actual trading (referred to as production trading in Regulation AT). The test environment must provide access to historical transaction, order and message data and must enable AT Persons to conduct testing to verify whether their ATSs comply with the requirements under Regulation AT. REGISTERED FUTURES ASSOCIATIONS AND REGULATION AT As summarized above, Regulation AT would require any RFA (i.e., NFA) to adopt membership rules for its members engaged in algorithmic trading and would separately require all AT Persons to become members of an RFA. Each RFA would also be required to establish and maintain a program for the prevention of fraudulent and manipulative acts and practices and the protection of the public interest in connection with algorithmic trading. Each RFA would further be required to adopt algorithmic trading rules for each category of DCM members, requiring pre-trade risk controls, standards for the development, testing, monitoring and compliance of ATSs, designation and training of algorithmic trading staff, and operational risk management standards for clearing member FCMs regarding customer orders that originate with ATSs. COMMISSIONER GIANCARLO S COMMENTS ON PROPOSED REGULATION AT In his November 24 remarks and accompanying statement, Commissioner Giancarlo noted that, through Regulation AT, the Commission simply codifies industry best practices in many respects, but does not go as far as current industry efforts. He noted that market participants already have incentives to use risk controls to prevent the loss of their capital and being forced out of business, while Regulation AT imposes upon them heavy compliance burdens. In particular, as algorithmic trading is defined very -12-

13 broadly under Regulation AT, it may capture small proprietary trading firms and commodity trading advisors, who would incur costs to hire new employees to monitor ATSs and to ensure the firm is compliant, as well as costs to implement risk controls and to satisfy the different registration requirements. Regarding source code repositories, Commissioner Giancarlo expressed reservations, stating that [s]ource code is the intellectual property of AT Persons representing their current and future trading strategies. It reveals what positions the firm intends to buy or sell in the future upon specified market events. Noting that the Commission is currently required to obtain a subpoena to obtain this information, Commissioner Giancarlo questioned whether the use of automated trading technology makes a trading firm more likely to engage in criminal behavior than a manual trading operation. He therefore expressed his preference that AT Person source code be kept confidential (and not subject to Commission or DOJ access) due to the possibility of cyberattacks and data breaches, among other reasons. OTHER REQUIREMENTS FOR DESIGNATED CONTRACT MARKETS The CFTC s proposal would also impose a series of new requirements on DCMs that are related to, but separate from, the provisions of Regulation AT. The proposals address the design and details of a DCM s trade matching system, market maker incentive programs and self-match prevention tools. A. DISCLOSURE AND TRANSPARENCY IN TRADE MATCHING SYSTEMS Regulation AT require DCMs to disclose information about rules and specifications pertaining to: any known attributes of the electronic matching platform that materially affect the time, priority, price or quantity of execution of orders by market participants; the ability to cancel, modify or limit display of their orders; the dissemination of real-time market data to market participants; and the dissemination of market data. Regulation AT further specifies that all information that must be disclosed to the public under this rule must be made available on the DCM s website no later than ten business days following the identification of or changes to such attributes. B. MARKET MAKER AND TRADING INCENTIVE PROGRAMS 1. Additional public information required for programs Under Regulation AT, DCMs would be required to disclose information to the public regarding market maker and trading incentive programs via rule filings that must include the following information: the name of the program; the date on which it is scheduled to begin and terminate (if applicable); an explanation of the program s specific purpose and a list of all products or services to which the program applies; -13-

14 a description of any eligibility criteria or categories of market participants who may participate in the program and, if relevant, an explanation of why it is limited by certain eligibility criteria or to certain categories of market participants, and an explanation of how the limitation complies with the impartial access principle and comparable fee structure requirements; an explanation of how eligible persons may apply to participate and how the DCM will evaluate eligibility; a description of any payments, incentives, discounts, considerations, inducements or other benefits that may be received by the program participants (including non-financial incentives), and a description of the obligations, benchmarks or other measures that a program participant must meet to receive the benefits; and a description of any legal affiliation between the DCM and an entity acting as a market maker or participating in a market maker program. Regulation AT would require that a DCM ensure that this information be easily located on its website from the time it begins accepting program participants through the time it ceases operation of the program. A DCM would also be required to notify the Commission if a market maker or trading incentive program terminates prior to the previously disclosed termination date. Further, if a program is extended beyond its original termination date, a DCM would be required to file a new rule. 2. Information request from the Commission or the Director of the Division of Market Oversight; prohibited payment for trades between commonly owned accounts Under the proposed Regulation AT, a DCM would also be required to provide information and data requested by the Commission or the Director of the CFTC s Division of Market Oversight regarding participation in any market maker or trading incentive programs that it offers, including the program agreements, participant names, benchmarks achieved by program participants and payments or benefits conferred upon participants. Regulation AT proposes that DCMs implement policies and procedures reasonably designed to prevent payments being made as part of market maker or trading incentive program for trades or other activities that occur between accounts under common ownership. 3. Surveillance of market maker and trading incentive programs Proposed Regulation AT also requires that a DCM review all benefits accorded to program participants to ensure that they are not earned through abusive practices. C. SELF-TRADE PREVENTION TOOLS Regulation AT would require DCMs to implement reasonably designed rules and tools to prevent selftrading or self-matching by market participants (i.e., wash trades ) and either apply the tools themselves or provide the tools to market participants and require the use of such tools in connection with all orders on its electronic trade matching platform. Self-trading, under Regulation AT, would be defined as the matching of orders for accounts with common beneficial ownership or under common control. The determination of which accounts are accounts with common beneficial ownership or under common control (i.e., accounts that may not trade with each other) could be made by the DCM itself or the DCM could require market participants to identify such accounts. Regulation AT nonetheless would provide -14-

15 that the DCM would be allowed to permit trading between accounts with common beneficial ownership when the orders are initiated by independent decision makers or when the orders comply with the DCM s cross-trade, minimum exposure requirements or similar rules, and are for accounts that are not under common beneficial ownership. However, any such self-trading may only be permitted if (1) the DCM requires the compliance or other senior officer of market participants to request approval from the DCM to not apply self-trade prevention tools with respect to specific accounts that are under common beneficial ownership or control, and (2) the DCM requires market participants to withdraw or amend an approval request if any change occurs and causes the information provided in the approval request to be no longer accurate or complete. On a quarterly basis and for all products and expiration months traded on a DCM in the previous quarter, a DCM would be required to prominently display on its website the percentage of trades and volume of trading, by product and including all expiration months, representing self-trading approved by the DCM. The DCM would also be required to identify the ratio or percentage of orders, by product and expiration month, with respect to which matching was prevented by the self-trade prevention tools required under Regulation AT. CALL FOR PUBLIC COMMENTS The Commission s proposal includes 164 specific requests for public comment, and comments will be due 90 days after the publication of the proposal in the Federal Register. * * * Copyright Sullivan & Cromwell LLP

16 ABOUT SULLIVAN & CROMWELL LLP Sullivan & Cromwell LLP is a global law firm that advises on major domestic and cross-border M&A, finance, corporate and real estate transactions, significant litigation and corporate investigations, and complex restructuring, regulatory, tax and estate planning matters. Founded in 1879, Sullivan & Cromwell LLP has more than 800 lawyers on four continents, with four offices in the United States, including its headquarters in New York, three offices in Europe, two in Australia and three in Asia. CONTACTING SULLIVAN & CROMWELL LLP This publication is provided by Sullivan & Cromwell LLP as a service to clients and colleagues. The information contained in this publication should not be construed as legal advice. Questions regarding the matters discussed in this publication may be directed to any of our lawyers listed below, or to any other Sullivan & Cromwell LLP lawyer with whom you have consulted in the past on similar matters. If you have not received this publication directly from us, you may obtain a copy of any past or future related publications from Stefanie S. Trilling ( ; trillings@sullcrom.com) in our New York office. CONTACTS New York Whitney A. Chatterjee chatterjeew@sullcrom.com David J. Gilberg gilbergd@sullcrom.com Kenneth M. Raisler raislerk@sullcrom.com Rebecca J. Simmons simmonsr@sullcrom.com John M. Miller millerjo@sullcrom.com Ryne V. Miller millerry@sullcrom.com Christine Trent Parker parkerc@sullcrom.com Washington, D.C. Dennis C. Sullivan sullivand@sullcrom.com -16- SC1: