Hong Kong SAR – HKMA expectations on algo-trading

Over the last two years, the HKMA has been working with banks in Hong Kong SAR to understand the extent of their current and planned usage of algorithmic trading (algo-trading). In light of the various findings, the HKMA has published a letter and annex which set out its supervisory expectations around algo-trading.

Next Steps

Authorised Institutions (AIs) must review the latest publication as the HKMA expects AIs that are engaged in, or planning to engage in, algo-trading activities to give due consideration to these supervisory expectations and sound practices when developing their risk management framework. AIs should have regard to the nature, scale and complexity of their algo-trading activities when introducing or amending their risk management frameworks. The annex includes details of some of the sound practices observed during the thematic examinations of AIs carrying out algorithmic trading which took place in 2019, and therefore provides practical examples to be considered when assessing the controls and procedures which should accompany algo-trading activities.

Sound risk management practices for algorithmic trading

The annex which accompanies the HKMA’s letter provides a clear list of expectations over four areas. Unsurprisingly these expectations concentrate on ensuring there is a proper understanding of what algo-trading is, at all levels of the institution. There also needs to be clear and effective governance, the ability to control and monitor the activities, thorough and regular testing and auditing. We have summarised the main points below.

Governance and oversight

1.  Proper governance and risk management frameworks

• for overseeing and managing the risks associated with algo-trading activities and ensuring that these risks are within their risk appetite. Examples of good practice include dedicated governance bodies comprising representatives from all the major functions involved in algo-trading, and specific, regular training for the different functions to establish a deep understanding of algo-trading.

2.  Effective and independent control function

• acts as the second line of defence independent of the front office, to manage the risks associated with algo-trading activities. The HKMA notes that in more advanced institutions the control function plays a proactive role in the key processes throughout the life cycle of the algorithms, and is staffed with algo-trading experts who are given sufficient authority to challenge the front office and equipped with the tools needed to properly discharge their duties.

3.  Regular reviews of algorithms and relevant governance and controls

• first and second line of defence should conduct reviews at least once a year. Some AIs carry out reviews which cover all the key processes throughout the life cycle of the algorithms and are guided by the governance bodies overseeing algo-trading activities. The results are discussed by governance bodies and information is provided up the management chain, potentially also to headquarter entities.

4.  Regular internal audit reviews 

• internal audit should also perform regular reviews as the third line of defence. In advanced AIs, algo-trading is treated as a separate business area from general treasury activities in their regular audit programme and a tailor-made scope of review is developed to cater for the specific risks associated with algo-trading.

Development, testing and approval

5.  Effective framework governing development and testing of algorithms 

• to ensure they behave as intended, and comply with the relevant regulatory requirements and the institutions’ internal policies, all to be overseen by experienced staff. Advanced AIs test under stressed market conditions, and any changes to current algorithms are tested as if they were new algorithms.

6.  Robust algorithm approval policy and procedures 

• algorithms should be subject to approval before activation. Good practice includes standardised approval templates are used providing consistent information to staff with approval authority. A good practice highlighted by the HKMA is permitting extra steps during the approval process to ensure the evaluations are adequate, such as additional expert reviews to assess the appropriateness of complex algorithms.

Risk management and controls

7.  Comprehensive and prudent pre-trade controls 

• to ensure risks are managed prudently. For the more advanced institutions, the pre-trade controls are more granular, reviewed regularly and take account of the latest market conditions.

8.  Robust pre-trade controls 

• front office and independent control function to conduct real time monitoring of the algo-trading activities. The systems should be able to identify abnormal trading, suspicious activities and conduct issues.

9.  Proper kill functionality to suspend trading 

• an emergency measure to suspend the use of an algorithm and cancel part or all of the unexecuted orders immediately in case of need. There should be a robust framework governing the activation of the kill functionality and the subsequent re-enablement of algo-trading. More advanced institutions have kill-switches which can be activated at various levels (e.g. at the system, algorithm, trader and client level), which can minimise the disruptions to other algo-trading activities.

10.  Effective BCP 

• which should be subject to regular testing. For the more advanced institutions, tailor-made business continuity plan covering a wide range of scenarios is developed for each major type of algorithm.

11.  Adequate controls on access rights 

• AIs should put in place proper security controls on the physical and electronic access to algo-trading systems to ensure that only authorised staff are given access to these systems.

12.  Robust incident handling policy and procedures 

• incidents and the associated remedial actions should be properly escalated. For the more advanced institutions, incidents related to algo-trading are investigated thoroughly and the results of the investigation are extensively discussed by the governance bodies.

Documentation

13.  Proper documentation for audit trails 

• on the key processes throughout the life cycle of algorithms. For the more advanced institutions, clear documentation standards and templates have been developed for the development, testing and approval processes, and stored in a centralised database which is accessible only to authorised personnel.

14.  Comprehensive inventory of algorithms 

• to document all the algorithms implemented and the relevant key information.