Commission Delegated Regulation (EU) 2017/589 of 19 July 2016 supplementing Directive 2014/65/EU

Article 1

As part of its overall governance and decision making framework, an investment firm shall establish and monitor its trading systems and trading algorithms through a clear and formalised governance arrangement, having regard to the nature, scale and complexity of its business and setting out:

Article 2

1. An investment firm shall ensure that its compliance staff has at least a general understanding of how the algorithmic trading systems and trading algorithms of the investment firm operate. The compliance staff shall be in continuous contact with persons within the firm who have detailed technical knowledge of the firm's algorithmic trading systems and algorithms.

2. An investment firm shall also ensure that compliance staff have, at all times, contact with the person or persons within the investment firm who have access to the functionality referred to in Article 12 (‘kill functionality’) or direct access to that kill functionality and to those who are responsible for each trading system or algorithm.

3. Where the compliance function or elements thereof are outsourced to a third party, an investment firm shall provide the third party with the same access to information as it would to its own compliance staff. An investment firm shall ensure that through such external compliance function:

Article 3

1. An investment firm shall employ a sufficient number of staff with the necessary skills to manage its algorithmic trading systems and trading algorithms and with sufficient technical knowledge of:

2. An investment firm shall specify the necessary skills referred to in paragraph 1. The staff referred to in paragraph 1 shall have those necessary skills at the time of recruitment or shall acquire them through training after recruitment. The investment firm shall ensure that those staff's skills remain up-to-date through continuous training and shall evaluate their skills on a regular basis.

3. The staff training referred to in paragraph 2 shall be tailored to the experience and responsibilities of the staff, having regard to the nature, scale and complexity of the investment firms' activities. In particular, staff involved in order submission shall receive training on order submission systems and market abuse.

4. An investment firm shall ensure that the staff responsible for the risk and compliance functions of algorithmic trading have:

Article 4

1. An investment firm shall remain fully responsible for its obligations under this Regulation where it outsources or procures software or hardware used in algorithmic trading activities.

2. An investment firm shall have sufficient knowledge and the necessary documentation to ensure effective compliance with paragraph 1 in relation to any procured or outsourced hardware or software used in algorithmic trading.

Article 5

1. Prior to the deployment or substantial update of an algorithmic trading system, trading algorithm or algorithmic trading strategy, an investment firm shall establish clearly delineated methodologies to develop and test such systems, algorithms or strategies.

2. A person designated by the senior management of the investment firm shall authorise the deployment or substantial update of an algorithmic trading system, trading algorithm or algorithmic trading strategy.

3. The methodologies referred to in paragraph 1 shall address the design, performance, recordkeeping and approval of the algorithmic trading system, trading algorithm or algorithmic trading strategy. They shall also set out the allocation of responsibilities, the allocation of sufficient resources and the procedures to seek instructions within the investment firm.

4. The methodologies referred to in paragraph 1 shall ensure that the algorithmic trading system, trading algorithm or algorithmic trading strategy:

5. An investment firm shall adapt its testing methodologies to the trading venues and markets where the trading algorithm will be deployed. An investment firm shall undertake further testing if there are substantial changes to the algorithmic trading system or to the access to the trading venue in which the algorithmic trading system, trading algorithm or algorithmic trading strategy are to be used.

6. Paragraphs 2 to 5 shall only apply to trading algorithms leading to order execution.

7. An investment firm shall keep records of any material change made to the software used for algorithmic trading, allowing it to determine:

Article 6

1. An investment firm shall test the conformance of its algorithmic trading systems and trading algorithms with:

2. Conformance testing shall verify whether the basic elements of the algorithmic trading system or the trading algorithm operate correctly and in accordance with the requirements of the trading venue or the direct market access provider. For this purpose the testing shall verify that the algorithmic trading system or trading algorithm:

Article 7

1. An investment firm shall ensure that testing of compliance with the criteria laid down in Article 5(4)(a), (b) and (d) is undertaken in an environment that is separated from its production environment and that is used specifically for the testing and development of algorithmic trading systems and trading algorithms.

For the purposes of the first subparagraph, a production environment shall mean an environment where algorithmic trading systems effectively operate, and comprise software and hardware used by traders, order routing to trading venues, market data, dependent databases, risk control systems, data capture, analysis systems and post-trade processing systems.

2. An investment firm may comply with the testing requirements referred to in paragraph 1 by using its own testing environment or a testing environment provided by a trading venue, a DEA provider or a vendor.

3. An investment firm shall retain full responsibility for the testing of its algorithmic trading systems, trading algorithms or algorithmic trading strategies and for making any required changes to them.

Article 8

Before deployment of a trading algorithm, an investment firm shall set predefined limits on:

Article 9

1. An investment firm shall annually perform a self-assessment and validation process and on the basis of that process issue a validation report. In the course of that process the investment firm shall review, evaluate and validate the following:

The self-assessment shall also include at least an analysis of compliance with the criteria set out in Annex I to this Regulation.

2. The risk management function of the investment firm referred to in Article 23(2) of Commission Delegated Regulation (EU) 2017/565 (5), shall draw up the validation report and, for that purpose, involve staff with the necessary technical knowledge. The risk management function shall inform the compliance function of any deficiencies identified in the validation report.

3. The validation report shall be audited by the firm's internal audit function, where such function exists, and be subject to approval by the investment firm's senior management.

4. An investment firm shall remedy any deficiencies identified in the validation report.

5. Where an investment firm has not established a risk management function referred to in Article 23(2) of Delegated Regulation (EU) 2017/565, the requirements set out in relation to the risk management function in this Regulation shall apply to any other function established by the investment firm in accordance with Article 23(2) of Delegated Regulation (EU) 2017/565.

Article 10

As part of its annual self-assessment referred to in Article 9, an investment firm shall test that its algorithmic trading systems and the procedures and controls referred to in Articles 12 to 18 can withstand increased order flows or market stresses. The investment firm shall design such tests, having regard to the nature of its trading activity and its trading systems. The investment firm shall ensure that the tests are carried out in such a way that they do not affect the production environment. Those tests shall comprise:

Article 11

1. An investment firm shall ensure that any proposed material change to the production environment related to algorithmic trading is preceded by a review of that change by a person designated by senior management of the investment firm. The depth of the review shall be proportionate to the magnitude of the proposed change.

2. An investment firm shall establish procedures to ensure that any change to the functionality of its systems is communicated to traders in charge of the trading algorithm and to the compliance function and the risk management function.

Article 12

1. An investment firm shall be able to cancel immediately, as an emergency measure, any or all of its unexecuted orders submitted to any or all trading venues to which the investment firm is connected (‘kill functionality’).

2. For the purposes of paragraph 1, unexecuted orders shall include those originating from individual traders, trading desks or, where applicable, clients.

3. For the purposes of paragraph 1 and 2, an investment firm shall be able to identify which trading algorithm and which trader, trading desk or, where applicable, which client is responsible for each order that has been sent to a trading venue.

Article 13

1. An investment firm shall monitor all trading activity that takes place through its trading systems, including that of its clients, for signs of potential market manipulation as referred to in Article 12 of Regulation (EU) No 596/2014.

2. For the purposes of paragraph 1, the investment firm shall establish and maintain an automated surveillance system which effectively monitors orders and transactions, generates alerts and reports and, where appropriate, employs visualisation tools.

3. The automated surveillance system shall cover the full range of trading activities undertaken by the investment firm and all orders submitted by it. It shall be designed having regard to the nature, scale and complexity of the investment firm's trading activity, such as the type and volume of instruments traded, the size and complexity of its order flow and the markets accessed.

4. The investment firm shall cross-check any indications of suspicious trading activity that have been generated by its automated surveillance system during the investigation phase against other relevant trading activities undertaken by that firm.

5. The investment firm's automated surveillance system shall be adaptable to changes to the regulatory obligations and the trading activity of the investment firm, including changes to its own trading strategy and that of its clients.

6. The investment firm shall review its automated surveillance system at least once a year to assess whether that system and the parameters and filters employed by it are still adequate to the investment firm's regulatory obligations and trading activity, including its ability to minimise the generation of false positive and false negative surveillance alerts.

7. Using a sufficiently detailed level of time granularity, the investment firm's automated surveillance system shall be able to read, replay and analyse order and transaction data on an ex-post basis, with sufficient capacity to be able to operate in an automated low-latency trading environment where relevant. It shall also be able to generate operable alerts at the beginning of the following trading day or, where manual processes are involved, at the end of the following trading day. The investment firm's surveillance system shall have adequate documentation and procedures in place for the effective follow-up to alerts generated by it.

8. Staff responsible for monitoring the investment firm's trading activities for the purposes of paragraphs 1 to 7 shall report to the compliance function any trading activity that may not be compliant with the investment firm's policies and procedures or with its regulatory obligations. The compliance function shall assess that information and take appropriate action. Such action shall include reporting to the trading venue or submitting a suspicious transaction or order report in accordance with Article 16 of Regulation (EU) No 596/2014.

9. An investment firm shall ensure that its records of trade and account information are accurate, complete and consistent by reconciling as soon as practicable its own electronic trading logs with records provided by its trading venues, brokers, clearing members, central counterparties, data providers or other relevant business partners, where applicable and appropriate considering the nature, scale and complexity of the business.

Article 14

1. An investment firm shall have business continuity arrangements in place for its algorithmic trading systems which are appropriate to the nature, scale and complexity of its business. Those arrangements shall be documented in a durable medium.

2. Business continuity arrangements of an investment firm shall effectively deal with disruptive incidents and, where appropriate, ensure a timely resumption of the algorithmic trading. Those arrangements shall be adapted to the trading systems of each of the trading venue accessed and shall include the following:

3. An investment firm shall ensure that its trading algorithm or trading system can be shut down in accordance with its business continuity arrangements without creating disorderly trading conditions.

4. An investment firm shall review and test its business continuity arrangements on an annual basis and modify the arrangements in light of that review.

Article 15

1. An investment firm shall carry out the following pre-trade controls on order entry for all financial instruments:

2. An investment firm shall immediately include all orders sent to a trading venue into the calculation of the pre-trade limits referred to in paragraph 1.

3. An investment firm shall have in place repeated automated execution throttles which control the number of times an algorithmic trading strategy has been applied. After a pre-determined number of repeated executions, the trading system shall be automatically disabled until re-enabled by a designated staff member.

4. An investment firm shall set market and credit risk limits that are based on its capital base, its clearing arrangements, its trading strategy, its risk tolerance, experience and certain variables, such as the length of time the investment firm has been engaged in algorithmic trading and its reliance on third-party vendors. The investment firm shall adjust those market and credit risk limits to account for the changing impact of the orders on the relevant market due to different price and liquidity levels.

5. An investment firm shall automatically block or cancel orders from a trader if it becomes aware that that trader does not have permission to trade a particular financial instrument. An investment firm shall automatically block or cancel orders where those orders risk compromising the investment firm's own risk thresholds. Controls shall be applied, where appropriate, on exposures to individual clients, financial instruments, traders, trading desks or the investment firm as a whole.

6. An investment firm shall have procedures and arrangements in place for dealing with orders which have been blocked by the investment firm's pre-trade controls but which the investment firm nevertheless wishes to submit. Such procedures and arrangements shall be applied in relation to a specific trade on a temporary basis and in exceptional circumstances. They shall be subject to verification by the risk management function and authorisation by a designated individual of the investment firm.

Article 16

1. An investment firm shall, during the hours it is sending orders to trading venues, monitor in real time all algorithmic trading activity that takes place under its trading code, including that of its clients, for signs of disorderly trading, including trading across markets, asset classes, or products, in cases where the firm or its clients engage in such activities.

2. The real-time monitoring of algorithmic trading activity shall be undertaken by the trader in charge of the trading algorithm or algorithmic trading strategy, and by the risk management function or by an independent risk control function established for the purpose of this provision. That risk control function shall be considered to be independent, regardless of whether the real-time monitoring is conducted by a member of the staff of the investment firm or by a third party, provided that that function is not hierarchically dependent on the trader and can challenge the trader as appropriate and necessary within the governance framework referred to in Article 1.

3. Staff members in charge of the real-time monitoring shall respond to operational and regulatory issues in a timely manner and shall initiate remedial action where necessary.

4. An investment firm shall ensure that the competent authority, the relevant trading venues and, where applicable, DEA providers, clearing members and central counterparties can at all times have access to staff members in charge of real-time monitoring. For that purpose, the investment firm shall identify and periodically test its communication channels, including its contact procedures for out of trading hours, to ensure that in an emergency the staff members with the adequate level of authority may reach each other in time.

5. The systems for real-time monitoring shall have real-time alerts to assist staff in identifying unanticipated trading activities undertaken by means of an algorithm. An investment firm shall have a process in place to take remedial action as soon as possible after an alert has been generated, including, where necessary, an orderly withdrawal from the market. Those systems shall also provide alerts in relation to algorithms and DEA orders triggering circuit breakers of a trading venue. Real-time alerts shall be generated within five seconds after the relevant event.

Article 17

1. An investment firm shall continuously operate the post-trade controls that it has in place. Where a post-trade control is triggered, the investment firm shall undertake appropriate action, which may include adjusting or shutting down the relevant trading algorithm or trading system or an orderly withdrawal from the market.

2. Post-trade controls referred to in paragraph 1 shall include the continuous assessment and monitoring of market and credit risk of the investment firm in terms of effective exposure.

3. An investment firm shall keep records of trade and account information, which are complete, accurate and consistent. The investment firm shall reconcile its own electronic trading logs with information about its outstanding orders and risk exposures as provided by the trading venues to which it sends orders, by its brokers or DEA providers, by its clearing members or central counterparties and by its data providers or other relevant business partners. Reconciliation shall be made in real-time where the aforementioned market participants provide the information in real-time. An investment firm shall have the capability to calculate in real time its outstanding exposure and that of its traders and clients.

4. For derivatives, the post-trade controls referred to in paragraph 1 shall include controls regarding the maximum long and short and overall strategy positions, with trading limits to be set in units that are appropriate to the types of financial instruments involved.

5. Post-trade monitoring shall be undertaken by the traders responsible for the algorithm and the risk control function of the investment firm.

Article 18

1. An investment firm shall implement an IT strategy with defined objectives and measures which:

2. An investment firm shall set up and maintain appropriate arrangements for physical and electronic security that minimise the risks of attacks against its information systems and that includes effective identity and access management. Those arrangements shall ensure the confidentiality, integrity, authenticity, and availability of data and the reliability and robustness of the investment firm's information systems.

3. An investment firm shall promptly inform the competent authority of any material breaches of its physical and electronic security measures. It shall provide an incident report to the competent authority, indicating the nature of the incident, the measures taken following the incident and the initiatives taken to avoid similar incidents from recurring.

4. An investment firm shall annually undertake penetration tests and vulnerability scans to simulate cyber-attacks.

5. An investment firm shall ensure that it is able to identify all persons who have critical user access rights to its IT systems. The investment firm shall restrict the number of such persons and shall monitor their access to IT systems to ensure traceability at all times.

Article 19

A DEA provider shall establish policies and procedures to ensure that trading of its DEA clients complies with the trading venue's rules so as to ensure that the DEA provider meets the requirements in accordance with Article 17(5) of Directive 2014/65/EU.

Article 20

1. A DEA provider shall apply the controls laid down in Articles 13, 15 and 17 and the real-time monitoring laid down in Article 16 to the order flow of each of its DEA clients. Those controls and that monitoring shall be separate and distinct from the controls and monitoring applied by DEA clients. In particular, the orders of a DEA client shall always pass through the pre-trade controls that are set and controlled by the DEA provider.

2. A DEA provider may use its own pre-trade and post-trade controls, controls provided by a third party or controls offered by the trading venue and real time monitoring. In all circumstances, the DEA provider shall remain responsible for the effectiveness of those controls. The DEA provider shall also ensure that it is solely entitled to set or modify the parameters or limits of those pre-trade and post-trade controls and real time monitoring. The DEA provider shall monitor the performance of the pre-trade and post-trade controls on an on-going basis.

3. The limits of the pre-trade controls on order submission shall be based on the credit and risk limits which the DEA provider applies to the trading activity of its DEA clients. Those limits shall be based on the initial due diligence and periodic review of the DEA client by the DEA provider.

4. The parameters and limits of the controls applied to DEA clients using sponsored access shall be as stringent as those imposed on DEA clients using DMA.

Article 21

1. A DEA provider shall ensure that its trading systems enable it to:

2. A DEA provider shall have procedures to evaluate, manage and mitigate market disruption and firm-specific risks. The DEA provider shall be able to identify the persons to be notified in the event of an error resulting in violations of the risk profile or in potential violations of the trading venue's rules.

3. A DEA provider shall at all times be able to identify its different DEA clients and the trading desks and traders of those DEA clients, who submit orders through the DEA provider's systems, by assigning a unique identification code to them.

4. A DEA provider allowing a DEA client to provide its DEA access to its own clients (‘sub-delegation’) shall be able to identify the different order flows from the beneficiaries of such sub-delegation without being required to know the identity of the beneficiaries of such arrangement.

5. A DEA provider shall record data relating to the orders submitted by its DEA clients, including modifications and cancellations, the alerts generated by its monitoring systems and the modifications made to its filtering process.

Article 22

1. A DEA provider shall conduct a due diligence assessment of its prospective DEA clients to ensure that they meet the requirements set out in this Regulation and the rules of the trading venue to which it offers access.

2. The due diligence assessment referred to in paragraph 1 shall cover:

3. A DEA provider allowing sub-delegation shall ensure that a prospective DEA client, before granting that client access, has a due diligence framework in place that is at least equivalent to the one described in paragraphs 1 and 2.

Article 23

1. A DEA provider shall review its due diligence assessment processes annually.

2. A DEA provider shall carry out an annual risk-based reassessment of the adequacy of its clients' systems and controls, in particular taking into account changes to the scale, nature or complexity of their trading activities or strategies, changes to their staffing, ownership structure, trading or bank account, regulatory status, financial position and whether a DEA client has expressed an intention to sub-delegate the access it receives from the DEA provider.

Article 24

Any systems used by an investment firm acting as a general clearing member (‘clearing firm’) to support the provision of its clearing services to its clients shall be subject to appropriate due diligence assessments, controls and monitoring.

Article 25

1. A clearing firm shall make an initial assessment of a prospective clearing client, taking into account the nature, scale and complexity of the prospective clearing client's business. Each prospective clearing client shall be assessed against the following criteria:

2. A clearing firm shall annually review the on-going performance of its clearing clients against the criteria listed in paragraph 1. The binding written agreement referred to in Article 17(6) of Directive 2014/65/EU shall contain those criteria and set out the frequency at which the clearing firm shall review its clearing clients' performance against those criteria, where this review is to be conducted more than once a year. The binding written agreement shall set out the consequences for clearing clients that do not comply with those criteria.

Article 26

1. A clearing firm shall set out and communicate to its clearing clients appropriate trading and position limits to mitigate and manage its own counterparty, liquidity, operational and other risks.

2. A clearing firm shall monitor its clearing clients' positions against the limits referred to in paragraph 1 as close to real-time as possible and have appropriate pre-trade and post-trade procedures for managing the risk of breaches of the position limits, by way of appropriate margining practice and other appropriate means.

3. A clearing firm shall document in writing the procedures referred to in paragraph 2 and record whether the clearing clients comply with those procedures.

Article 27

1. A clearing firm shall publish the conditions under which it offers its clearing services. It shall offer those services on reasonable commercial terms.

2. A clearing firm shall inform its prospective and existing clearing clients of the levels of protection and of the costs associated with the different levels of segregation it provides. Information on the different levels of segregation shall include a description of the main legal effects of the respective levels of segregation offered, including information on the insolvency law applicable in the relevant jurisdiction.

Article 28

1. An investment firm that engages in a high-frequency algorithmic trading technique shall immediately after order submission record the details of each submitted order using the format set out in tables 2 and 3 of Annex II.

2. An investment firm that engages in a high-frequency algorithmic trading technique shall update the information referred to in paragraph 1 in the standards and formats specified in the fourth column of tables 2 and 3 of Annex II.

3. The records referred to in paragraphs 1 and 2 shall be kept for five years from the date of the submission of an order to a trading venue or to another investment firm for execution.

Article 29

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

It shall apply from 3 January 2018.