Free Site Registration

Risk Management: In the Eye of the Storm

Biggest Innovators on Wall Street in 2010 |  CASE STUDY: Goldman Sachs Electronic Trading |  After VaR: Q&A with Ron Papanek |  Europe's Challenge |  NSX Cuts In |  Keep Out, At Your Own Risk

Keep Out, At Your Own Risk

Why NYSE Euronext Wants to Make A Business Out of Rejecting Trades

December 15, 2010
By Tom Steinert-Threlkeld

Getting into the NYSE Euronext data center in Mahwah, N.J., is something of a physical feat.

Earth berms and ironwork fences surround the 400,000-square-foot facility. Its entrance is not at the address it uses or even on the same street. At its guard station, any vehicle entering must wait for the lowering of multiple, successive raised steel plates before it can proceed through the gateway.

Once onto the campus, there is only one set of doors into the facility. There are no windows or other openings.

The NYSE Euronext Mahwah data center has just one entry point.

And if you want to gain access to one of NYSE Euronext’s stock exchanges with orders that have gone through proper pre-trade checks with the lowest possible trip time, there is only one front door.

It’s a set of six computing cabinets that house the exchange operator’s Risk Management Gateway, that allows broker-dealers and their customers to get direct access to NYSE markets but pass their orders through risk filters first. This allows broker-dealers to control the amount and size of trading activity pursued by participants they sponsor.

The gateway sits in the same 20,000-square-foot computing “pod” in the Mahwah data center as NYSE’s matching engines for the equities markets of the New York Stock Exchange and NYSE Amex, now, and NYSE Arca, soon. No other risk filters sit in between these cabinets and those engines.

“Other risk management systems are not allowed in here,’’ said Kyle Tuskey, managing director for the Transaction Solutions business of NYSE Technologies, from the hallway outside the main two pods, where the NYSE exchanges are located. “We have an advantage in that area.”

The advantage may be only the length of the hallway, to a third pod where any customer can locate and can install any risk-control software it likes or has developed itself. But, in markets where microseconds matter, even that can be a competitive advantage as NYSE Euronext looks for new sources of revenue and profit from technologies spun out from its exchange expertise and operating knowledge. In transaction terms, every thousand feet of distance away from a matching engine adds one more millionth of a second to transit time.

Until Nov. 3, saving time on managing risks was not an issue. Until then, broker-dealers who sponsored direct trading by their customers did not have to worry about any delays introduced in high-speed strategies from filtering orders in advance for the chance that something might go awry and leave the dealer holding the bag. The checks could be performed after the trade. But Nov. 3 changed that. That’s the day the Securities and Exchange Commission banned so-called “naked access,’’ adopting a rule that required brokers and dealers to put in place controls to help prevent erroneous orders, ensure compliance with regulations and enforce pre-set credit or capital requirements.

“I have previously likened unfiltered access to giving your car keys to a friend who doesn’t have a license and letting him drive unaccompanied,” said SEC Chairman Mary L. Schapiro pointedly, in enacting the rule. “This rule requires that broker-dealers not only remain in the car, but also maintain control of it so we can all be assured the rules of the road will be observed before the car is ever put into drive.”

This, in effect, creates a business opportunity for suppliers of exchange and trading technology, such as NYSE Euronext or its rival, Nasdaq OMX Group, as well as independent suppliers of risk-management software or services, such as SunGard Data Systems, Progress Software or FTEN. Brokers and dealers can roll their own risk filters, acquire or rent it or commit some kind of combination.

NYSE’s investment in its Risk Management Gateway “was a move towards making sure that whatever quote came into their venue was legit,’’ said Sang Lee, co-founder and managing partner of research firm Aite Group. But then came the rise of high-speed trading, the May 6 Flash Crash and the ban on naked access, over the last 12 to 18 months.

“In light of the heightened interest in e-trade risk, I think exchanges have realized they can actually make this into a profitable business,’’ he said.CHECKING FIRST With the Risk Management Gateway, brokers and dealers get access to risk controls that help them comply with the proposed SEC rules, notes Dan Romanelli, a former Merrill Lynch employee who is now the managing director at NYSE Technologies’ Transaction Solutions unit, in charge of developing the RMG business.

“What’s new is simply the clarification about who has to have the control over the flow, which is a sponsoring broker,” said Romanelli. “It boils back to a sponsoring broker having the responsibility” for any trades that get executed – and the responsibility to check for risks before orders are sent in to exchanges.

With the Risk Management Gateway, brokers get use of such controls at a remotely controlled site for what he and Tuskey believe are reasonable and competitive fees.

The pricing is based on per-channel or “session” rates. The cost is $3,000 a month for the first session, which caps out at 1,000 inbound messages a second. These can be new orders, cancellations or replacements. Each additional pipe costs $1,000 a month.

But the rate card won’t be the lowest on the market. The National Stock Exchange, a 115-year-old operation once known as the Cincinnati Stock Exchange, is in the process of introducing an “Exchange in a Box” service that connects market participants to 10 market centers in New Jersey for $1,000 a month (see “NSX Cuts In,” page 7). Its chief information officer, Saro Jahani, is working on introducing an SEC-compliant set of pre-trade controls that he is considering rolling into the service, at no additional charge.

But, for most brokers, operating on a large scale, the amounts involved are not show-stoppers. “The price just isn’t a stress point,’’ said Bruce Boytim, vice president of Transaction Solutions at NYSE Technologies.

Users can send messages to the Mahwah gateway using a variety of forms of NYSE Euronext’s Secure Financial Transaction Infrastructure (SFTI) From outside the Mahwah data center, wide area network connections using Internet Protocol communications or a ‘virtual private network’ connection using a box placed at a remote site are offered. Inside the building, a local network version of SFTI employed.

“If they can provide this at reasonable cost, they’ll probably be fine,’’ said Aite Group’s Lee. “Because it’s easy for the brokers that are already in the [SFTI] network to use this.’’

FTEN or NSX may offer lower cost options. But apples-to-apples comparison are necessary, Lee said.

For instance, while the RMG provides the closest possible connection to NYSE Euronext matching engines, that is not the sole province of its risk controls. Orders, cancellations and replacements sent to it will pass through risk filters on the way to as many as 50 different trading venues in North America.


No set of risk filters will prevent all possible catastrophes. But here’s what you get with the NYSE gateway:

• Fat-finger checks. These apply to individual orders, where a typo can be destructive. This allows brokers to set, in advance, rejections of orders that exceed a defined value or a defined quantity; rejections of orders involving specific symbols or sides of a trade; or a price, when it’s outside a specified range.

• Regulatory checks. These, for instance, prevent the submission, amending or canceling of market or limit orders “at the close” within a specified time period; reject orders for symbols that are on a restricted list; and reject short-sale orders, if the stock involved is not on a pre-determined “easy to borrow” list.

• Overall checks, on a day’s worth of risk. These can reject orders that top a preset aggregate quantity of shares to be traded or preset threshold in a particular stock; or, similarly, exceed a threshold in the overall value to trade in a day in all transactions or in transactions involving a given stock or the like.

Alerts and rejections get sent directly to the trading party, without broker intervention.

The gateway can be supple, as well. The system, for instance, allows brokers to block intermarket sweep orders that are designed to “sweep” the best orders with the best prices from all National Market System venues – and document why they have routed orders to places that might not have the immediately obvious best price. Or, block the sending of market orders at the close at all, if fines are incurred for a cancellation of the order.

Custom checks, like those that support trading in multiple currencies, are developed and spread as needed for individual and then all customers.

These kinds of nuances are support for the argument for using an existing gateway because … it exists. In the case of this Risk Management Gateway, because it’s been around for more than a decade, increasing the number of risk filters that are available. And cutting down any causes of delay between order management systems, risk filters and the matching engines that ultimately execute on the instructions.

“The data structures we use in the risk management system are geared towards very short windows of time being spent on risk checks,’’ said Romanelli.

The risk checks, in this gateway’s approach, are stored in active memory, for instance, so they are live throughout the trading day and adjustable as needed. “The way we store risk checks in memory is something that we’ve done to optimize” efficacy and speed at the same time, said Tuskey.

The gateway also is set up to “know” all the risk checks ahead of time that match a particular client, Tuskey said. That means the system can then do a lookup for those checks quickly and run through them “at the machine speed.”

The system can also set itself apart by how it checks long strings of information, such as a list of stocks that a particular company that a broker is sponsoring is restricted from trading in. The gateway uses technology that can recognize long strings of characters, even if it relies on only a few to figure each out. This is akin to the T9 system and other predictive technologies used in cellphones to turn a minimum of typing into full messages.

All in all, the maximum delay, Tuskey and Romanelli say, at this point is under 100 millionths of a second and headed lower. Even at current rates, the time taken for risk checks “is incredibly small compared to overall latency” in trading systems, Boytim contends.

But it’s hard to compare exactly where to measure the trips. For Tuskey, the natural demarcation point is the time it takes for a message to hit the network interface card at the entry point of a risk gateway to the time the message hits the network interface card of a venue’s order-matching engine. No universal definition or standard, however, has been established.


Two incidents in the past year illustrate the hazards, however, of expecting a risk gateway to manage risk, on its own.

The first is the May 6 Flash Crash, where the value of the Dow Jones Industrial Average fell hundreds of points in a matter of minutes, in a series of events that took six months to start to untangle.

That series of events was triggered, the SEC and the Commodity Futures Trading Commission said, by a program launched by a “large fundamental trader” to sell a total of 75,000 E-Mini contracts valued at $4.1 billion. The automated algorithm was programmed to sell E-minis at a rate set to “9 percent of the trading volume calculated over the previous minute, but without regard to price or time. “

As a result, “the Sell Algorithm chosen by the large trader to only target trading volume, and neither price nor time, executed the sell program extremely rapidly in just 20 minutes,’’ the regulators said.

In this case, the Risk Management Gateway might have prevented the selloff at market-disrupting rates. But it just as easily might not have.

Because the gateway only follows instructions set by the broker or other party using it. If a broker sets limits on trade size, prices to be paid and the like, the gateway will execute the controls. If left open, they’re left open.

A second incident cited by SEC chairman Mary L. Schapiro at the Securities Industry and Financial Markets Association annual meeting in November involved an order that she said caused a “huge disruption” to equities markets, without the fanfare of the Flash Crash.

Without naming the stock or the date, she said the disruption was caused by an algorithm that tried to execute trades involving 10 percent of the average daily volume in a particular stock in just two seconds.

In this case, a disruption can be prevented fairly easily, using time and volume limits. “The broker sets that up,’’ said Tuskey. “We give them the tools to enforce that.”

In fact, the gateway not only fills broker needs’ for trading risk checks, the system helps them establish effective, documented procedures and controls.

“I could give you all the tools in the world, but if you don’t set them or use them right, I don’t think there’s anything I can build for you that if you don’t use it properly is going to work effectively,’’ said Boytim.

Risks are not managed for brokers only at Mahwah. Copies of the Risk Management Gateway have been put at the Savvis data center in Weehawken, N.J., which hosts the Z and Y exchanges of BATS Global Markets; the Equinix data center in Secaucus, which hosts the EDGA and EDGX exchanges of Direct Edge; and, a Verizon data center in Carteret, which hosts exchanges for Nasdaq OMX Group.

Plus, over the next two years, copies of the RMG will be installed at a variety of Savvis, Equinext, Telx and other data centers worldwide. As many as 40 “liquidity” hubs will rollout over that time, as extensions to the exchange operations housed in Mahwah and a sister center in Basildon, England, according to NYSE Technologies chief executive Stanley Young.


This kind of breadth allows NYSE Euronext to “aggregate” the risk being engaged in by a broker’s customer. A high-speed trader may well have order-transmitting servers co-located with those exchanges in each of those data centers If the broker has established a limit for trading by that trader of 10 million shares a day, say, the gateway, as a system, can stop the trading when the threshold is crossed.

The gateway also provides the broker with a series of trading tools that lets a broker watch the flow of orders that its clients with direct access to markets are sending out and search for particular orders, as needed. This helps monitor both risks and compliance. The broker, using a Web browser, can see an aggregate view of each participant’s trading activity as well as how various filters have been applied. Through the browser, limits can be set for different customers or even specific traders at a trading firm. And the controls, Boytim points out, can be updated within a trading day.

NYSE Euronext has invested $250 million in the Mahwah data center and, in theory, it could be used as an industry laboratory to test for market risks. After all, it’s been built to host and handle the activity for all existing national exchanges as well as all those that can be expected to be launched over the next 20 years, NYSE Euronext officials say.

NYSE Euronext already provides comprehensive data, charting and historical analysis tools for all National Market System-listed securities, through its SuperFeed of market data and historical information from OneTick.

Mahwah also is set up with plenty of space for adding storage and computing capacity through another two decades. Each pod can hold 600 cabinets of computing power, with each cabinet holding more processing power with each passing generation of microchip technology.

Even in flat markets, the number of messages generated by trading activity is soaring, notes Steve Rubinow, NYSE Euronext’s chief information officer. This is driving innovation in storage, which is now measured in petabytes, or quadrillions of numbers and characters.

But Tuskey said throwing present or past data at algos is not necessary, if risk controls are used properly. Defining what constitutes a “good” algorithm and a “bad” algorithm is hit or miss. Past conditions don’t necessarily predict how the math will perform in new circumstances. If a particular algo shows a propensity to get stuck in a loop, spitting out orders repeatedly, a risk gateway can simply stop orders that look very similar, in their tracks.

Defining algorithms could be “error prone,’’ said Tuskey. “Whereas, risk management, it’s defined.”

And manageable. “As long as everybody’s applying it,’’ he said.


Download the Complete IMPACT REPORT