The FCA and PRA publish coordinated papers focused on risk management and governance in respect of algorithmic trading

On 12 February 2018, the UK Financial Conduct Authority (FCA) and the Prudential Regulatory Authority (PRA) each published papers outlining their respective regulatory governance and compliance expectations in respect of algorithmic trading (whether used to make automated investment decisions or optimise order execution processes).

This article considers whether the proposed regulatory burden imposed on firms making use of algorithmic trading, and those working in senior management and control functions within them, whilst well-intentioned, may in certain respects prove difficult to implement in practice.

MiFID II and beyond

Both the FCA’s report (summarising findings of good and bad practice from its cross-firm compliance reviews of algorithmic trading in the wholesale markets) and the PRA’s consultation paper (inviting feedback on the PRA’s proposed expectations regarding firms’ governance and risk management of algorithmic trading) follow the implementation of the Markets in Financial Instruments Directive (MiFID II) on 3 January 2018.

MiFID II requires firms engaged in algorithmic trading to have appropriate and effective systems and controls in place. In a number of material respects, the FCA’s examples of good practice and the PRA’s proposed supervisory expectations go beyond the minimum requirements imposed by MiFID II and increase the regulatory burden on those working in senior management and control functions at firms who engage in algorithmic trading, as well as on the firms themselves. Four such examples are listed below:

1. Both the FCA and PRA documents require the creation and maintenance of a single comprehensive inventory of all algorithms and corresponding risk controls across the business;
2. The PRA expects firms to identify the relevant Senior Management Function(s) with responsibility for algorithmic trading and for this to be included in their Statement of Responsibility;
3. The Risk Management function, under the PRA’s proposals, is expected to assess intra-day exposure stemming from algorithmic trading and respond accordingly, ensuring that the firm’s risk exposure remains within its appetite; and
4. Most significantly, the FCA report stresses how important it is that a firm’s oversight functions, including compliance and risk management, ‘keep pace with technological advancements’, extending this obligation to senior management who, together with compliance and risk management, ‘must have the requisite skills, knowledge, and expertise to provide suitable challenge to frontline’ staff. The most effective compliance teams reviewed by the FCA, ‘were involved at every key milestone of the algorithm development process, acting as an independent check.’ This is reinforced by the PRA’s expectation that the risk management and control functions have the necessary, ‘expertise to challenge the front office.’

An unbearable burden?

The requirement for the relevant senior management and control functions to fully understand a firm’s algorithmic trading such that they are competent to provide effective challenge across the business is a particularly onerous one. ‘Fluent in algorithm’ should now be added to the list of core technical competencies required for the relevant compliance personnel and senior managers working at firms engaged in algorithmic trading. The problem is that such competency is currently found in a relatively shallow, though growing, pool of traders, quantitative researchers and software developers who are compensated for their expertise with generous salaries, whilst at the same time avoiding the regulatory spotlight of performing a senior management function. This casts serious doubts on the ability of firms to find and recruit candidates into their risk and senior management teams with the necessary technical expertise.

Whilst few would contest that the rapid speed of algorithmic trading renders it able to dangerously amplify existing market risks or that firms engaged in such trading should be obliged to establish an appropriate regime of governance and risk controls to manage those risks, the obligations envisioned by the PRA and FCA risk imposing a compliance burden on firms that they (and those they recruit) are unable (or unwilling) to shoulder.