Responses to Frequently Asked Questions Concerning Risk Management Controls for Brokers or Dealers with Market Access

Division of Trading and Markets:

April 15, 2014

Responses to these frequently asked questions on Rule 15c3-5 under the Securities Exchange Act of 1934 (“Exchange Act”) were prepared by and represent the views of the staff of the Division of Trading and Markets (“Staff”).  They are not rules, regulations, or statements of the Securities and Exchange Commission (“Commission”).  Further, the Commission has neither approved nor disapproved these interpretive answers.  Additional information on Rule 15c3-5 can be found in the Commission’s adopting release, available at:  http://www.sec.gov/rules/final/2010/34-63241.pdf.

For further information contact:  John C. Roeser, Assistant Director, at (202) 551-5500, Division of Trading and Markets, Securities and Exchange Commission, 100 F Street, NE, Washington, DC 20549-7010.

Background

In November 2010, the U.S. Securities and Exchange Commission adopted Securities Exchange Act Rule 15c3-5 – Risk Management Controls for Brokers or Dealers with Market Access.^[1]  In adopting this Rule, the Commission stated that the Rule is designed to “reduce the risks faced by broker-dealers, as well as the markets and the financial system as a whole, as a result of various market access arrangements, by requiring effective financial and regulatory risk management controls reasonably designed to limit financial exposure and ensure compliance with applicable regulatory requirements to be implemented on a market-wide basis.”^[2]  In addition, the Commission stated that the Rule is “designed to ensure that broker-dealers appropriately control the risks associated with market access, so as not to jeopardize their own financial condition, that of other market participants, the integrity of trading on the securities markets, and the stability of the financial system.”^[3]  Broker-dealers with market access are obligated under this Rule to establish, document, and maintain a system of risk management controls and supervisory procedures reasonably designed to manage financial, regulatory, and other risks of this business activity.

In particular, Rule 15c3-5 requires that financial risk management controls and supervisory procedures be reasonably designed to systematically limit the financial exposure of the broker-dealer that could arise as a result of market access.  This includes:

• preventing the entry of orders that exceed appropriate pre-set credit or capital thresholds in the aggregate for each customer and the broker-dealer; and
   
• preventing the entry of erroneous orders, by rejecting orders that exceed appropriate price or size parameters, on an order-by-order basis or over a short period of time, or that indicate duplicative orders.

In addition, Rule 15c3-5 requires that regulatory risk management controls and supervisory procedures be reasonably designed to ensure compliance with all regulatory requirements that are applicable in connection with market access, including being reasonably designed to:

• prevent the entry of orders unless there has been compliance with all regulatory requirements that must be satisfied on a pre-order entry basis;
   
• prevent the entry of orders for securities that the broker-dealer or customer is restricted from trading;
   
• restrict market access technology and systems to authorized persons; and
   
• assure appropriate surveillance personnel receive immediate post-trade execution reports.

Rule 15c3-5 further requires that these risk management controls and supervisory procedures be (a) under the direct and exclusive control of the broker-dealer subject to the obligations (subject to certain limited exceptions), and (b) reviewed regularly for effectiveness. Rule 15c3-5 requires, among other things, that a broker-dealer, on at least an annual basis, review its business activity in connection with its market access to assure the overall effectiveness of its risk management controls and supervisory procedures.  The broker-dealer’s Chief Executive Officer, or equivalent officer, must on an annual basis certify that the broker-dealer’s controls and procedures comply with the requirements of Rule 15c3-5.

Division Staff note that under the Rule these risk management controls are required for all orders^[4], whether entered manually by a trader or generated automatically by a computer according to a pre-programmed set of instructions.  Given the high speeds at which many market participants can presently generate and process orders, any errors in automated processes can rapidly compound.  Furthermore, the interlinked nature of many market participants entering orders across a variety of trading venues means that errors generated by one system or firm can quickly propagate across the marketplace, resulting in a cascade of further error-related activities.

In recent years, the Commission, the national securities exchanges, and FINRA have pursued a number of initiatives designed to limit the impact of potentially erroneous activities, such as the single-stock circuit breaker and new limit up-limit down mechanisms, the clarification of clearly erroneous execution rules, and the elimination of stub quotes.  However, the prevention of such erroneous activity before orders enter the markets, as one of the primary focuses of Rule 15c3-5, is critically important to maintaining fair, orderly, and efficient markets, supporting the protection of investors, and maintaining investor confidence.

Question 1:  Does Rule 15c3-5 apply to quotes? 

Answer:  Yes. Rule 15c3-5 applies to all orders, including market maker quotes, for securities traded on an exchange or alternative trading system (“ATS”), that are submitted by or through broker-dealers with market access.  Rule 15c3-5 does not provide any exclusion for market maker quotes. The term “order” includes any firm indication of a willingness to buy or sell a security, as either principal or agent, including any bid or offer quotation, market order, limit order, or other priced order.^[5]  Accordingly, market makers must implement the pre-trade and other risk controls required by Rule 15c3-5 with respect to all of their quoting activity.  Among other things, such controls should be reasonably designed to prevent a market maker’s electronic quoting system from inadvertently entering excessive quotes into the market.

Question 2:  Does Rule 15c3-5 apply when a broker-dealer provides clearing services, but does not provide market access.

Answer:  No. Rule 15c3-5 applies only to broker-dealers with market access (i.e., access to trading in securities on an exchange or ATS as a result of being a member of the exchange or a subscriber to the ATS).  If a broker-dealer does not have, or is not providing, market access, Rule 15c3-5 does not apply.  Of course, a broker-dealer providing clearing services may be subject to other regulatory or contractual requirements relating to its risk management practices.

Question 3:  Does Rule 15c3-5 apply to a broker-dealer that enters orders on an exchange or ATS solely through another broker-dealer with market access?

Answer:  No. Rule 15c3-5 applies only to the broker-dealer with access, or providing access, to an exchange or ATS, as a result of being a member or subscriber thereof.  However, pursuant to Rule 15c3-5(d)(1), a broker-dealer that provides market access may allocate control, by written contract, over specific regulatory risk management controls and supervisory procedures to a broker-dealer customer based on that broker-dealer customer’s position in the transaction and relationship with the ultimate customer.  Control over regulatory risk management controls and supervisory procedures may only be allocated if the broker-dealer providing market access determines that the broker-dealer customer is better situated, by virtue of its relationship with the ultimate customer and access to trading information, to more effectively implement the specified controls or procedures.^[6]  As noted in the Market Access Rule Adopting Release, notwithstanding the allocation provisions, the broker-dealer with, or providing, market access is ultimately responsible for the efficacy of the regulatory risk management controls.^[7]

Question 4:  Does Rule 15c3-5 apply to security futures products traded on an exchange or an ATS? 

Answer:  Yes.  Rule 15c3-5 applies to all securities, including any security futures, traded on an exchange or ATS.  The Rule does not apply to any futures contracts or options on futures contracts.  In addition, the Rule only applies to broker-dealers subject to Section 15(c)(3) of the Exchange Act.  Notice-registered security futures broker-dealers that trade security futures are exempt from Section 15(c)(3) of the Exchange Act and therefore are not subject to Rule 15c3-5.^[8]   

Question 5:  May a broker-dealer with market access utilize financial and regulatory risk management controls provided by an ATS or exchange? 

Answer: Yes. A broker-dealer subject to Rule 15c3-5 may use risk management tools or technology provided by third parties independent of the customer, including exchanges and ATSs, to satisfy the requirements under paragraphs (c)(1) and (c)(2) of Rule 15c3-5 regarding financial and regulatory risk management controls, so long as the broker-dealer has direct and exclusive control over those tools or technology.^[9]  Among other things, the broker-dealer with market access must perform appropriate due diligence to assure the exchange- or ATS-provided controls are reasonably designed to be effective, and otherwise consistent with the Rule.  Broker-dealers may not rely merely on representations of the technology provider, even if an exchange or other regulated entity, to meet this due diligence standard. 

The staff notes that if a broker-dealer has, or provides, market access to multiple exchanges and ATSs, and it utilizes multiple, stand-alone risk management control systems, the disaggregated controls would have to be coordinated to ensure compliance with applicable regulatory and financial requirements.^[10]

Question 6:  Can a broker-dealer satisfy the Rule 15c3-5 pre-trade risk management control requirements for orders that are handled on a purely manual basis (i.e., without the use of any electronics or automation) by utilizing manual controls? 

Answer: Yes. If an order is handled on a purely manual basis and results in a manual execution, with no involvement of electronic systems prior to execution, then the requirements of Rule 15c3-5 can be satisfied by implementing manual pre-trade controls that are reasonably designed to ensure compliance with all financial and regulatory requirements that must be satisfied on a pre-order entry basis.  For example, an order that a Floor Broker receives by telephone, writes on a paper ticket, and trades manually may be subject only to manual pre-trade controls.  However, if any electronic system is involved in effecting an execution, then the broker-dealer with market access must utilize automated pre-trade controls.^[11] Accordingly, if a trade is negotiated manually on an exchange floor, but the orders are entered into a trading system to effect an execution, automated pre-trade controls must be used at the point that the orders are systematized.

Question 7:  When a broker-dealer with market access operates as an order flow consolidator for broker-dealer customers that may be trading on either an agency basis or for their own account, how does the broker-dealer with market access determine who the customer is for the purpose of establishing appropriate pre-trade credit thresholds under Rule 15c3-5(c)(1)?  Is the customer the broker-dealer client or the customer of such broker-dealer client?

Answer:  Under Rule 15c3-5, a broker-dealer is required to set appropriate pre-trade credit thresholds for each customer for which it provides market access, including broker-dealer customers, and an appropriate capital threshold for trading by the broker-dealer for its own account.  In the scenario described above, the “customer” for purposes of establishing and implementing pre-trade credit thresholds is the firm’s broker-dealer client rather than the customer of such broker dealer client.  As provided in the Adopting Release, the broker-dealer providing market access to broker-dealer customers may supplement the credit limit it places on its customers with assurances from these customers that they have implemented controls reasonably designed to assure that trading by their individual customers remains within appropriate pre-set credit thresholds.^[12]

Question 8:  How should a broker-dealer with market access determine appropriate credit or capital thresholds?  What factors should a broker-dealer consider in determining such thresholds?  Is there a distinction between the terms “credit” and “capital” under the Rule? 

Answer:  Rule 15c3-5 requires broker-dealers with market access to implement risk management controls and supervisory procedures reasonably designed to systematically limit the financial exposure of the broker-dealer that could arise as a result of market access, including preventing the entry of orders that exceed appropriate pre-set credit or capital thresholds. The selection of a particular dollar amount as an appropriate credit or capital threshold necessarily will require the exercise of reasonable business judgment on the part of the broker-dealer with market access. As noted in the Adopting Release, “the Commission expects broker-dealers will make such determinations based on appropriate due diligence as to the customer’s business, financial condition, trading patterns, and other matters, and document that decision.  In addition, the Commission expects the broker-dealer will monitor on an ongoing basis whether the credit thresholds remain appropriate, and promptly make adjustments to them, and its controls and procedures, as warranted.”^[13]  Accordingly, while broker-dealers will have flexibility in exercising reasonable business judgment as to an appropriate credit or capital threshold for a particular customer or its own business for purposes of Rule 15c3-5, the broker-dealer should be prepared to show why it selected a particular threshold, how that threshold meaningfully limits the financial exposure potentially generated by the customer or its own trading activity, and the process by which it monitors the continued appropriateness of those thresholds on an ongoing basis.

The staff notes that under Rule 15c3-5 the term “credit” is generally used to refer to a broker-dealer’s customer activity, and the term “capital” is generally used to refer to a broker-dealer’s activity for its own account. 

Question 9:  Where a broker-dealer with market access has an arrangement with a broker-dealer customer, is the broker-dealer with market access required to implement risk management controls and supervisory procedures reasonably designed to ensure compliance with all regulatory requirements that are applicable in the connection with the market access provided to that broker-dealer customer? 

Answer: Yes. Rule 15c3-5(c)(2)(i) requires a broker-dealer to implement risk management controls and supervisory procedures that are reasonably designed to ensure compliance with all regulatory requirements^[14] that are applicable in connection with market access.  This includes preventing the entry of orders unless there has been compliance with all regulatory requirements that must be satisfied on a pre-order entry basis.^[15] 

Rule 15c3-5(c)(2)(iv) requires broker-dealers to implement risk management controls and supervisory procedures that are reasonably designed to assure that appropriate surveillance personnel receive immediate post-trade execution reports that result from market access.  Taken together, these provisions are intended to ensure compliance with all regulatory requirements that are applicable in connection with market access. 

However, pursuant to Rule 15c3-5(d)(1), a broker-dealer that provides market access may allocate control, by written contract, over specific regulatory risk management controls and supervisory procedures to a broker-dealer customer based on that broker-dealer customer’s position in the transaction and relationship with the ultimate customer.  Control over regulatory risk management controls and supervisory procedures may only be allocated if the broker-dealer providing market access determines that the broker-dealer customer is better situated, by virtue of its relationship with the ultimate customer and access to trading information, to more effectively implement the specified controls or procedures, and only if such broker dealer customer is not trading for its own account.^[16]  As noted in the Market Access Rule Adopting Release, notwithstanding these allocation provisions, the broker-dealer with, or providing, market access is ultimately responsible for the efficacy of the regulatory risk management controls.^[17]

Question 10:  May a broker-dealer that provides market access to an affiliated broker-dealer permit the affiliate to have control over its risk management controls and supervisory procedures? 

Answer: No.  Paragraph (d) of Rule 15c3-5 generally requires that the financial and regulatory risk management controls and supervisory procedures be under the direct and exclusive control of the broker-dealer providing market access.  Among other things, the broker-dealer providing market access must have the ability to directly monitor, and the exclusive ability to adjust, as appropriate, the operation of the financial and regulatory risk management controls in real time.  For example, as noted in the Adopting Release, only the broker-dealer providing market access can make intra-day adjustments to risk management controls to appropriately manage a customer’s credit limit.^[18]  The only exception to this general rule is where the broker-dealer has reasonably allocated, by written contract and after a thorough due diligence review, control over specific regulatory risk management controls and supervisory procedures to a broker-dealer customer, provided that such broker or dealer has a reasonable basis for determining that such customer has better access to the ultimate customer and its trading information such that it can more effectively implement the specified controls or procedures, as further described in paragraph (d)(1).^[19]  As noted in the Market Access Rule Adopting Release, notwithstanding the allocation provisions, the broker-dealer with, or providing, market access is ultimately responsible for the efficacy of the regulatory risk management controls.^[20]

Question 11:  If an ATS operator has only broker-dealer subscribers, and the broker-dealer subscribers provide market access to non-broker-dealer customers, would the ATS operator have any responsibilities under Rule 15c3-5 for the non-broker-dealer customers that are being provided market access by the broker-dealer subscribers?

Answer: No.  The ATS operator has responsibilities under Rule 15c3-5 only if it provides market access to non-broker-dealer subscribers.  When an ATS operator accepts non-broker-dealers as subscribers, the ATS operator is required, among other things, to establish, document, and maintain a system of risk management controls and supervisory procedures reasonably designed to manage the financial, regulatory, and other risks of this business activity. In the scenario above, it is the responsibility of the broker-dealer subscribers that provide the market access to the ATS to comply with Rule 15c3-5. 

Question 12:  Where broker-dealers provide market access and clearing services for a broker-dealer customer, are existing clearing agreements sufficient to satisfy the requirement under Rule 15c3-5 that certain regulatory risk management controls be reasonably allocated to a broker-dealer customer?

Answer:  Paragraph (d)(1) of Rule 15c3-5 permits a broker-dealer with market access to reasonably allocate, by written contract, after a thorough due diligence review, control over specific  regulatory risk management controls and supervisory procedures to a registered broker-dealer customer.  As noted in the Adopting Release, the written contract, among other things, must specify the regulatory risk management controls and supervisory procedures over which control is being allocated, and clearly articulate the scope of the arrangement and the specific responsibilities of each party.^[21]  This can only be done after a thorough due diligence review to establish a reasonable basis for determining that the registered broker-dealer customer to which control has been allocated has the capability and, based on its position in the transaction and relationship with the ultimate customer, has better access to the ultimate customer than the broker-dealer with market access and can more effectively implement the allocated controls.  In addition, pursuant to paragraph (e) of Rule 15c3-5, the allocating broker-dealer must establish, document, and maintain a system to regularly review the performance of the broker-dealer customer to which control has been allocated under the written contract, and promptly address any performance weaknesses, including termination of the allocation arrangement if warranted.  Existing clearing agreements likely do not address with sufficient specificity the details of the allocation arrangement permitted by Rule 15c3-5, as discussed above and in the Adopting Release.  

Question 13:  Does Rule 15c3-5 change the existing responsibilities of entities to which the Rule does not directly apply, such as clearing brokers that do not provide market access to an exchange or ATS?

Answer: No. Rule 15c3-5 does not change the existing responsibilities of entities that do not provide market access to an exchange or ATS, provided that an entity’s responsibilities will change if it is allocated regulatory responsibilities by a broker-dealer with market access, pursuant to Rule 15c3-5.

Question 14:  Although Rule 15c3-5 requires the financial and regulatory risk management controls and supervisory procedures to be under the direct and exclusive control of the broker-dealer providing market access, the Adopting Release indicated that broker-dealers would have the flexibility to seek out risk management technology and software that is developed by third parties, so long as it is “independent” of the market access customer or any of its affiliates.  What type of due diligence should a broker-dealer conduct with respect to third-party technology or software to assure its independence from a market access customer or any of its affiliates?

Answer: As noted in the Adopting Release, a broker-dealer relying on third-party technology or software should perform appropriate due diligence to assure that its controls and procedures are consistent with Rule 15c3-5, including with respect to the independence of the developer from the market access customer or its affiliates.^[22]  The independent third party could be another broker-dealer, an exchange or ATS, a service bureau, or other entity that is not an affiliate, and is otherwise independent, of the market access customer.^[23]  An affiliate includes any person that, directly or indirectly, controls, is under common control with, or is controlled by, the customer. When evaluating whether a technology provider is independent of a customer, the Commission will look at the substance rather than the form of the relationship.^[24]  For example, the Commission would not consider a third party independent from a customer just because it is unaffiliated in terms of corporate ownership if it has a material business or other relationship with the customer which could interfere with the provision of effective risk management technology to the broker-dealer.^[25]  In the Adopting Release, the Commission expressed the belief that simple reliance by the broker-dealer on a representation of independence by its customer is insufficient due diligence.^[26]  Similarly, mere reliance on representations of the third-party technology developer – even if an exchange or other regulated entity – would be insufficient to meet the due diligence standard.^[27]  The details of the additional efforts that would be required to constitute “appropriate” due diligence, however, will depend on the individual facts or circumstances, and there may very well be multiple approaches to achieve this goal.  These might include, for example, a review of publicly available information about the ownership and material business relationships of the third-party technology provider and the customer, following up on any information that may indicate a lack of independence, and requesting the technology provider and customer to certify their independence from each other.

Question 15:  Rule 15c3-5 requires financial risk management controls and supervisory procedures that, among other things, are reasonably designed to “prevent the entry of orders that exceed appropriate pre-set credit or capital thresholds in the aggregate for each customer and the broker or dealer.”  Should these credit or capital limits take into account only orders in securities that are routed to exchanges or ATSs, or should they also reflect orders in other products (e.g., futures or swaps) or routed to other trading centers (e.g., OTC market makers)?  For example, if a broker-dealer sets an aggregate client credit limit at $5 million, should the broker-dealer decrement the available limit only when the client routes an order in securities to an exchange or ATS, or also when it routes orders in other products or to other trading centers?

Answer:  In establishing an appropriate credit or capital threshold, a broker-dealer should conduct appropriate due diligence with respect to the customer’s or its own business, financial condition, trading patterns, and other matters, and in so doing should take into account trading activity across all markets and products.^[28]  The specific dollar limit selected for the credit or capital threshold, however, should reflect an appropriate level of potential exposure for the customer or broker-dealer generated through “market access” (i.e., through the submission of orders in securities to exchanges or ATSs).  Similarly, for purposes of compliance with Rule 15c3-5, the broker-dealer only need decrement that appropriate credit or capital threshold as orders in securities are submitted to exchanges or ATSs.

Question 16:  Rule 15c3-5 requires financial risk management controls and supervisory procedures that, among other things, are reasonably designed to “prevent the entry” of orders that exceed appropriate pre-set credit or capital thresholds, and of erroneous orders. Are risk management controls that do not reject orders exceeding the applicable credit or capital limit or erroneous order parameters, but instead “scramble” them in a manner designed to prevent their being processed by an exchange or ATS, or utilize a “chase and cancel” functionality where a cancellation of the violative order is immediately submitted to the exchange or ATS, consistent with this standard?

Answer:  No.  The required controls and procedures must be reasonably designed to prevent the entry of orders on an exchange or ATS that exceed the relevant limits or parameters set by the broker-dealer with market access.  Accordingly, controls and procedures that permit malformed orders to be entered on an exchange or ATS, or orders to be entered with an attempt to quickly cancel, would not be reasonably designed to prevent entry, and thus could not only create a risk of execution but also potentially create operational difficulties for the exchange or ATS.  As noted in the Adopting Release, “because the controls and procedures must be reasonably designed to prevent the entry of orders that exceed the applicable credit or capital thresholds by rejecting them, the broker-dealer’s controls must be applied on an automated, pre-trade basis before orders are routed to the exchange or ATS”^[29]  [emphasis added].   

Question 17:  May a broker-dealer that provides customers with market access apply the required pre-trade controls to systems that are located on the customers’ premises?

Answer. Rule 15c3-5 requires broker-dealers providing market access, among other things, to implement risk management controls and supervisory procedures reasonably designed to (1) systematically limit the financial exposure of the broker-dealer that could arise as a result of market access and (2) ensure compliance with all regulatory requirements.  Rule 15c3-5 further requires that these risk management controls and supervisory procedures be (a) under the direct and exclusive control of the broker-dealer providing market access (subject to certain limited exceptions), and (b) reviewed regularly for effectiveness.  Rule 15c3-5 requires, among other things, that a broker-dealer, on at least an annual basis, review its business activity in connection with its market access to assure the overall effectiveness of its risk management controls and procedures. The broker-dealer’s Chief Executive Officer, or equivalent officer, must on an annual basis certify that the broker-dealer’s controls and procedures comply with the requirements of Rule 15c3-5.  While locating the broker-dealer’s risk management controls at its customer’s premises would not necessarily be inconsistent with the Rule’s “direct and exclusive control” requirement, it may complicate compliance and, among other things, would require a rigorous assessment and ongoing monitoring of the integrity and security of the controls to assure that the broker-dealer retains exclusive control over them.  Furthermore, while Rule 15c3-5 does provide for allocation of regulatory risk management controls and supervisory procedures under certain limited circumstances, financial risk management controls and supervisory procedures must always remain under the direct and exclusive control of the broker-dealer providing market access.

Question 18:  May the credit or capital thresholds set in connection with Rule 15c3-5 be adjusted after they are triggered?

Answer: Yes, in appropriate circumstances. The risk management controls and supervisory procedures required by Rule 15c3-5 must, among other things, be reasonably designed to systematically limit the financial exposure of the broker-dealer that could arise as a result of market access, including preventing the entry of orders that exceed appropriate pre-set credit or capital thresholds.  Once such credit or capital threshold is met, and subsequent orders in excess of that threshold are blocked, the broker-dealer may evaluate whether it is appropriate under the particular circumstances to modify the relevant threshold, and, if appropriate, do so in accordance with supervisory procedures. The reasons for any such modification should be appropriately documented and retained as part of the broker-dealer’s books and records, as required by Rule 15c3-5.

Question 19:  Aside from the risk management controls required by Rule 15c3-5, may a broker-dealer use third-party risk management controls that are not under its direct and exclusive control as part of its overall risk management strategy?

Answer: Yes.  Paragraph (d) of Rule 15c3-5 generally requires that the financial and regulatory risk management controls and supervisory procedures provided by third parties be under the direct and exclusive control of the broker-dealer providing market access.  However, with respect to risk management controls other than those required under (c)(1) and (c)(2) of Rule 15c3-5, a broker-dealer is not precluded from using risk management technology over which it does not have direct and exclusive control.