PRACTICAL IMPACTS ON SURVEILLANCE

HIGH FREQUENCY TRADING

MARKET FRAGMENTATION

DIRECT MARKET ACCESS

AGENDA

Identify market structure issues introduced by

• High Frequency Trading

• Market Fragmentation

• Direct Market Access

Discuss their impacts on Market Surveillance at a practical level

MARKET SURVEILLANCE – MUTUAL OBLIGATION

We see market surveillance as the responsibility of Exchanges, Regulators and Participants

Exchanges know their markets best, but may not have all the data

Regulators have the powers to attain all the data, but may not have the technology

Brokers have their own data, and are taking a greater interest in managing their risk. In some

countries, brokers are leading the way in cross market surveillance

In some markets we see all 3 parties using the same technology opening up greater

effectiveness in communications

4

WHAT IS HFT

Trading flow driven by computer algorithms, characterised by a short term focus and fast execution/decisions

• Market making

• Providing liquidity to buyers and seller

• Maintain tight spreads

• Statistical Arbitrage

• Enhance price discovery across venues and asset classes

• Typically take liquidity

• Other

• Algorithmic strategies that are neither market making nor arbitrage, but rely on speed to execute the strategy

• This is where Surveillance needs to focus

IMPACTS

• Spreads have tightened

• See more activity around the best prices as participants position themselves, or game other participants

• Depth has lessened

• Can see much wilder intraday price swings in short periods of time

• Message rates have increased

• Placing additional load on systems and their ability to keep up

• Trading engine latency has decreased

• Important to trading, but not as critical to surveillance which is human interpreted

• Trade sizes have reduced

• Harder to define what is a large trade – a standard surveillance review

7

5000 spread

changes in second!

Price Discovery??

DIRECT MARKET ACCESS

Broker-dealers allowing other market participants (e.g. Buy side) to piggy back on their exchange membership and infrastructure to trade directly on the market

• reduced trading costs, anonymity

Typically, DMA users execute trading strategies using algorithms, which have not been vetted by the execution broker

• but it is the executing broker who is responsible for the order flow through their id

We are seeing a greater usage of pre-trade risk management solutions to manage the risk of the executing broker

8

WHAT DOES IT MEAN FOR ME?

• Looking for needle in a haystack, but the haystack got considerably bigger

• Similar size surveillance teams today, despite a 10-20 times increase in number of messages monitored

• Existing surveillance systems get slower, run out of capacity

• We have seen requirements go from 10-20m messages per day, to 100s of million and as high as 2 billion

• Existing surveillance algorithms lose relevance

• Spoofing algorithms needed to be reviewed

• New behaviour to be analysed

• Ability to impact two markets in an instant lead to new types of behaviour e.g. Dark pool gaming

• What was previously thought to be unusual becomes normal

• Greater need for guidance notes from regulators to clarify what is ok and what is not

WHAT IS SPOOFING ? SOME EXAMPLES

Entering orders with no intention of trading them, to impact other participants strategies

• Unusual proportion of orders deleted that did not execute and were valid for short period of time

• Presence of trades where participant is buyer (seller), but they are entering and deleting sell (buy) orders

Some Examples of typical alerts

• Rapid Entry and Deletion – pure order level alert – lost relevance?

• Bait and Switch – single large bait order to attract counterparties to trade

• Giving Up Priority – constantly pulling your order from priority position – lost relevance?

• Layering – variation of Bait and Switch, using multiple orders to appear like multiple traders

• Ping Orders – identify liquidity testing orders ahead of real strategy

LAYERING – WHAT IS IT

11

• Entering multiple buy (sell) orders across various prices, close to the best price, and trading against participants

that better your prices.

• Our original layering alert works perfectly pre-HFT and picked up the SWIFT TRADE case

• When applied to markets with mature HFT we expect it to pick up many cases – will they be false positives?

• We have seen HFT firms with orders on both side of the book, potentially as market making strategies

• Often the HFT firm is trading in the opposite direction of what you might expect

• Conclusion - Surveillance algorithms may need to be adjusted

• Hone in on direction of trading– i.e. trading against the layer.

• Consider whether the layered broker is active or passive in trading

WHAT IT LOOKS LIKE VISUALLY – TIME SERIES

WHAT IT LOOKS LIKE VISUALLY - ORDERBOOK

13

2 RECENT CASES – SWIFT TRADE AND TRILLIUM

14

US - $2.3m in penalties

• November 2006-January 2007

• Enter Limit orders – market improving or at best

• Enter non-bona fide orders, just outside the NBBO

• Once Limit orders trade, cancel non-bona fide

orders within seconds

• 46,152 instances

• $575,765.17 profit

• $7,000 – 156,000 per trader

UK - £8m fine

• January 2007 December 2007

• Enter smaller limit orders – at the touch

• Enter non-bona fide, large orders, just outside the

touch

• Once Limit orders trade, cancel non-bona fide

orders within seconds

• 58,000 alerts

• Est £1.75m profit

WHAT THE CASES DON’T TELL US

How many non bona-fide orders did the trader place on one side of the market?

How much volume did the non bona-fide orders represent as a % of depth?

How many winning trades were done compared to losing trades?

How many times did they flip between buy and sell?

With what frequency did they flip between buy and sell?

How much profit was made on a per security per day basis?

15

HOW MIGHT I DETECT IT?

•Characteristics of one example examined:

• Layered and flipped 35 times in the day

• Typically had 5 or more price steps covered on one side and 2 or less on the other

• Bought and sold 200k shares ~ £3.47 each = £700,000

• Profit approx £1,800 on the day

•Turn it into an algorithm

• Phase 1

• Look for X or more orders on the Bid (Ask) and Y or less orders on the Ask (Bid)

• Look for a reversal of the current pattern so that they swap from bid to offer or vice versa

• Look for more than Z cases of flipping and alert when Z is reached

• Phase 2

• Evaluate trades done while layered (selling when layered bid, buying when layered ask)

• Alert if profit exceeds $$

FAST FORWARD FROM 2007 TO TODAY

• Has anything significant changed?

• YES! Rather than fooling traders watching screens, the aim is to fool other machines

• How much order depth is needed to “signal” a fictitious interest to other traders?

• Now I have multiple venues to play on in an interconnected, but unobserved network

• What could stand in the way of analysis

• Different trading strategies coming down to the exchange from the same member firm

• How can you separate market making activity of a firm from DMA activity? Leads to false positives

• Is there a difference between initiating versus passive trading against the layer?

• Does a strategy have to be profitable for it to be manipulative?

• What if in the analysis, you find that when a “layer” is present, the resultant trades are profitable

only 50% of the time?

• What if everyone is doing it? Do we redefine what is normal?

A NEW TYPE OF BEHAVIOUR – SMALL BAIT AND SWITCH

• Is it possible to be a buyer and seller at the same price within a second?

• If I executed both as a single trade, that would be a wash sale

• What if I have the best bid, someone jumps in behind me, and I decide to then delete

my bid and sell to them?

• That’s now possible within a millisecond

• What was the new fundamental information that changed their investment decision?

• Do minimum order durations have merit?

CAN I MANIPULATE A DARK POOL?

• In Europe all dark orders execute at the mid-point of the lit market BBO

• Seems like very little opportunity to manipulate

• What if the lit spread is wider than the minimum tick size?

• Check the dark book for liquidity (Ping order), then simultaneously

enter a market moving bid/offer in the lit, and a large order in the dark

• The dark book re-prices based on the updated lit book (need to know

latency), and I get a better execution in the dark than before

QUOTE STUFFING

20

• Enter thousands of orders to impact downstream systems

• Disadvantage participants that have slower systems and cant digest the information quickly

enough

• What might the quote stuffer be doing?

• They cant change the sequence of events

• Perhaps they can mask their behaviour for a second pulling more benefit out of a stat-arb

opportunity

•Sounds good, but does anyone have a practical example of this happening?

•The alert to identify high quote/order flow is very, very simple

MARKET FRAGMENTATION

Market Fragmentation leads to:

• Multiple trading venues for a single security

• Within a country e.g. USA/Canada – 1 regulator

• Within a region e.g. Europe/South America? – multiple co-operating regulators?

• Globally – many regulators, not necessarily cooperating

• Greater challenges for surveillance to put all the pieces together

• Barriers to information sharing

• Opportunities to hide manipulation

21

MODELS OF SURVEILLANCE IN FRAGMENTED MARKETS

Primary Listing Market handles surveillance

• local experts for the listed securities with in-depth knowledge of trading profiles

Government Regulator handles surveillance

• local regulator takes challenge of consolidating data and operating market surveillance

• ASIC – system hosted and operated by NASDAQ OMX

Quasi-Regulator handles surveillance

• powers for surveillance delegated to an independent 3rd party, who consolidates all data and performs surveillance

• IIROC – system hosted and operated by IIROC, provided by NASDAQ OMX

None of the above

22

PRACTICAL EXAMPLES – UNUSUAL PRICE CHANGES

How connected are the various market places?

• US REG NMS ensures that prices move together

• Europe – loose best execution policies, arbitrage ensures prices move together

What does a price movement on an exchange that does 10% of volume mean? Should they care?

It is not possible for one venue to conclude who has caused the price movement without consolidating information.

Conclusion – consolidated information is required

23

PRACTICAL EXAMPLES – UNUSUAL VOLUME CHANGES

Surveillance cares about unusual volume because it may indicate information asymmetry

However, the volumes needs to be considered as a whole, not the volume of a single

venue

Single venue volumes may fluctuate wildly as brokers move flow based on trading fee

pricing schedules

Conclusion – consolidated information is required

24

PRACTICAL EXAMPLES – FRONT RUNNING

Broker trading for himself prior to executing a client order

Broker previously had the opportunity to execute proprietary orders in substitutable

instruments such as options, warrants and single stock futures

Now they can execute those trades on behalf of the broker in the same instrument, but on

a different venue

Conclusion – consolidated data is needed to identify front running

25

PRACTICAL EXAMPLES - SPOOFING

Layering

• possible to place layered orders on one market and execute trades against the layer on another market

• Possible to enter multiple orders across multiple markets meaning that single market wouldn’t detect the layer

Bait and Switch

• Enter the large order onto one venue and then trade on another venue in the same security

Conclusion – Consolidated data is required to capture spoofing

26

SUMMARY

DMA and HFT have increased the potential threat from those who would manipulate markets

Market Fragmentation has made the detection job harder

Prior to opening markets up to competition, analysis should be done to prevent unintended consequences

Someone needs to have a consolidated view of trading, the technology to analyse it, the man power to interpret the analysis, and power to enforce regulations.

Regulators, Exchanges and Brokers all have an important part to play in protecting market integrity

27