lnternet Trading Guidelines are dealt with under the following main headings:

Transcription

1 INTERNET TRADING GUIDELINES lnternet Trading Guidelines are dealt with under the following main headings: 1. General Requirements 2. Application System Requirements 3. lnfrastructure Requirements 4. Service Requirements 5. lnternet Trading Activity Log For the purposes of these Guidelines; 'Internet Order Management System' (Application System) means: A computer application used for submitting trading orders, which shall operate in accordance with the specifications determined by the Colombo Stock Exchange (CSE) from time to time. 'Internet Trading Infrastructure 1 means: The computer hardware, the computer communication network and the security protocols used to support and ensure reliability of the Application System. 'Client 1 means: A Client of the Member Firmrrrading Member (Stockbroker) who has entered into an agreement with the Stockbroker in order to route orders to the Automated Trading System of the CSE (ATS) via the Application System. 1. GENERAL REQUIREMENTS 1.1 The Stockbroker shall enter into a written agreement with each client who intends to route orders to the ATS via the Application System. The agreement shall set out the rights and obligations between the Stockbroker and the Client. The agreement shall additionally state that the Application System shall be used solely for the purpose of operating the CDS account of the Client and shall not be used to operate the CDS accounts of any other parties by the client, except in instances set out in Guideline 1.5. The Stockbroker shall ensure that such agreements entered into with Clients comply with the Rules of the CSEICDS and any relevant guidelines and/or circulars as may be prescribed from time to time by the CSE. The CSE may require the Stockbroker to incorporate any applicable terms and conditions and/or clauses in the agreement from time to time. The Stockbroker shall ensure that such requirement(s) islare incorporated in the agreement. The Application System and the lnternet Trading Infrastructure shall be in compliance with these lnternet Trading Guidelines, as amended and any other guidelines and/or circulars issued by the CSE from time to time.

2 1.4 The Application System and lnternet Trading Infrastructure shall be subject to inspections by the CSE and the SEC in order to ensure compliance with relevant rules, directives, guidelines andlor circulars of CSEISEC as may be issued from time to time. 1.5 The Stockbroker shall ensure that the User ID and password assigned to a particular Client is unique to such Client. The Stockbroker shall not disclose the User ID and password to any other person or permit any other person to carry out trading activities using such User IDIpassword: However, the above restriction to assign a common password in order to access multiple CDS accounts will not be applicable in the following instances: a. in respect of joint CDS Accounts with the consent of the respective joint account holderls where the consent is renewed annually; b. in respect of CDS Accounts where the beneficial owner would be the same (eg. client's individual account and a company account in which the Client is the beneficial owner); c. in respect of a CDS Account of the spouse with the consent of such spouse where the consent is renewed annually; d. in respect of Fund Managers of Unit Trust Managing Companies and Investment Management Companies registered with the SEC managing either more than one fund or investor accounts. 1.6 The Stockbroker shall be responsible for all orders routed via the Application System and entered into and accepted by the ATS through the Stockbroker. The Stockbroker shall indemnify and not hold the CSE liable for any claims made by any party as a result of the lnternet Trading lnfrastructure and its functions. 1.7 The Stockbroker shall provide a link to the Clients to enable them to access the CSE RulesICDS Rules. 1.8 The employees of the Stockbroker who deal with Clients are bound by these lnternet Trading Guidelines, wherever applicable. 1.9 The Stockbroker shall ensure that the confidentiality of clients' personal and trading information is strictly maintained. Such information shall be disclosed only to the CSE andlor SEC The Stockbroker shall ensure that an audit on the Application System is carried out by an independent auditor at least once in every two (2) years. 2. APPLICATION SYSTEM REQUIREMENTS 2.1 The Stockbroker shall issue to the Client an Application System Specification Manual, which shall be made available to the CSEISEC for inspection.

3 2.2 The Application System Specification Manual shall include, inter alia: a. The process of installing the Application System in the Client's computer b. An explanation of order entering, amending and cancelling c. An explanation of the manner to use the available features d. An explanation of the procedure to view client statements and portfolio statements e. The details of the personnel in the Stockbroker firm to contact in the case of an Application System failure or other malfunction The Stockbroker shall provide an online help facility to the Clients. The Stockbroker shall test the Application System with the CSE test environment prior to implementation. Any modification to the Application System shall be immediately brought to the notice of the CSE and tested prior to implementation. The Stockbroker shall ensure that the lnternet Trading Infrastructure and its functions are reliable and accurate. The Application System should be able to provide Orderltrade confirmations to the Client immediately upon acknowledgement by the ATS regarding the relevant Orderttrade. The Application System shall have built in risk management controls such as determining trading limits for the clients when placing orders to ensure compliance with the CSE Stockbroker Rules. The Stockbroker shall ensure that the employees of the Stockbroker who use the Application System to deal with Clients have a system based control on the trading limits of the Clients with whom such employees dealt with. Users 2.10 Administrators The Stockbroker shall issue to each user a unique 'user identification' which shall be used to sign on to access the Application System. The Stockbroker shall ensure that the Application System automatically signs off the user after a predefined period of inactivity. The Stockbroker shall maintain an up to date list of all users of the Application System together with the User ID, username and CDS registration ID (where applicable). Administrators shall be the only person(s) designated by the Stockbroker to be responsible for the administration of the lnternet Trading Infrastructure/Application System. The Stockbroker shall issue to each Administrator a unique Administrator ID, which shall be used to sign on to access the lnternet Trading InfrastructurelApplication System.

4 c. Administrators shall not be granted with any access privileges to the Application System in order to place orders or modifylcancel orders placed by the users. Order Entry a. The Clients shall be allowed to carry out the following functions via the Application System; - Place an Order to buy or sell - Cancellation of orders - Amendment of orders Orders placedlamended by Clients shall be routed on a first-in, first-out basis to the ATS. INFRASTRCUTURE REQUIREMENTS 3.1 The following security features are required for the Application System and Internet Trading Infrastructure; a. User ID b. lndustry standard Password for the first login and the mandatory requirement to change the password in the first login (This shall be in addition to other logins that may be available for users to access the websites of the Stockbroker) c. Automatic expiry of passwords at the end of a reasonable duration. d. Account lockout after a number of unsuccessful attempts. e. lndustry standard security for server access through the internet (i.e. SSL) f. Industry standard firewall to protect the Application System. g. lndustry standard virus guard with the facility of periodically updating virus definitions. h. Use of licensed software for internet application/infrastructure. 3.2 The Application System shall have the following facilities to ensure proper controls in submission of orders by routing the internet order through the Stockbroker's back office system: a. Verify the availability of credit limit of the Client. b. Whether the Client has sufficient Securities to sell on submission of a sell Order. c. Valid Client ID. d. Valid security code. 3.3 The Stockbroker shall ensure availability of service to the Client in the event that the site is not reachable, and if there is no possibility to trade or to get or give real-time information.

5 4. SERVICE REQUIREMENTS The Stockbroker shall; 4.1 Safeguard the integrity of the service including controls to prevent; Any non-compliance with applicable laws, rules, regulations and guidelines leading to illegal transactions, fraud or malpractice. False presentation or the use of incomplete information for transactions. Manipulation of data. Viruses leading to, inter alia, loss of data, unauthorized access to or manipulation of data or threat of unavailability of systems. Cyber extortion, selling or provision of data stolen from service providers. 4.2 Ensure that the identity of the person or system accessing the service is properly verified by the use of PINS, passwords or such other approved mechanisms, so as to exclude unauthorized access. 4.3 Ensure that the Application System and the infrastructure have sufficient bandwidth and processing capacity to avoid delays in processing orders. 5. INTERNET TRADING ACTIVITY LOG 5.1 A detailed internet trading activity log with time stamps on all Application System activity shall be maintained by the Stockbroker. The internet trading activity log shall include the following: User ID CDS Account Number of the Client Name, quantity and price of the security Time of placing the order The activities of all users and Administrators Change in status of orders from order creation to confirmation of order and execution of order. The details of granting, modifying and revoking Client access privileges to the Application System in the activity log. 5.2 The internet trading activity log shall be maintained by the Stockbroker for a minimum period of one (1) year. 5.3 Access to the internet trading activity log shall be permitted only to the Administrators and any other authorized person(s) as designated by the Stockbroker.