Copyright 2011, The NASDAQ OMX Group, Inc. All rights reserved. LORNE CHAMBERS GLOBAL HEAD OF SALES, SMARTS INTEGRITY

AGENDA Identify market structure issues introduced by High Frequency Trading Market Fragmentation Direct Market Access Discuss their impacts on Market Surveillance at a practical level

SMARTS AND NASDAQ OMX NASDAQ OMX acquired SMARTS in July 2011 SMARTS is used by 26 market places and 8 regulators for market monitoring, market operations and market surveillance SMARTS is also a provider of Broker Compliance technology: Over 60 brokers in 50 countries covering 235 global subscriptions SMARTS is the market leader in running cross-market and cross-asset surveillance BM&FBovespa will be the first Latin America customer to roll out SMARTS NASDAQ OMX acquired FTEN in December 2010 for pre-trade risk management 4

MARKET SURVEILLANCE MUTUAL OBLIGATION We see market surveillance as the responsibility of Exchanges, Regulators and Participants Exchanges know their markets best, but may not have all the data Regulators have the powers to attain all the data, but may not have the technology Brokers have their own data, and are taking a greater interest in managing their risk. In some countries, brokers are leading the way in cross market surveillance and self reporting In some markets we see all 3 parties using the same technology opening up greater effectiveness in communications 5

WHAT IS HFT? Trading flow driven by computer algorithms, characterised by a short term focus and fast execution/decisions?? Market making Providing liquidity to buyers and sellers Maintaining tight spreads Statistical Arbitrage Enhance price discovery across venues and asset classes Typically take liquidity Other Algorithms Strategies that rely on speed of execution of an opportunity This is where Surveillance needs to focus

IMPACTS Spreads have tightened See more activity around the best prices as participants position themselves, or game other participants Depth has lessened Can see much wilder intraday price swings in short periods of time Impact on volatility? Message rates have increased Placing additional load on systems and their ability to keep up Trading engine latency has decreased Important to trading, but not as critical to surveillance which is human interpreted Trade sizes have reduced Harder to define what is a large trade a standard surveillance review

5000 SPREAD CHANGES IN A SECOND EXPLANATION PRICE DISCOVERY MECHANISM 8

DIRECT MARKET ACCESS Broker-dealers allowing other market participants to piggy back on their exchange membership and infrastructure to trade directly on the market Reduced trading costs, anonymity Typically, DMA users execute trading strategies using algorithms, which have not been vetted by the execution broker But it is the executing broker who is responsible for the order flow through their id We are seeing a greater usage of pre-trade risk management solutions to manage the risk of the executing broker 9

WHAT DOES IT MEAN FOR SURVEILLANCE? Looking for needle in a haystack, but the haystack got considerably bigger Similar size surveillance teams today, despite a 10-20 times increase in number of messages monitored Existing surveillance systems get slower, run out of capacity We have seen requirements go from 10-20m messages per day, to 100s of million and as high as 2 billion Existing surveillance algorithms lose relevance Spoofing algorithms needed to be reviewed New behaviour needs to be analysed Ability to impact two markets in an instant lead to new types of behaviour e.g. Dark pool gaming What was previously thought to be unusual becomes normal Greater need for guidance notes from regulators to clarify what is ok and what is not

WHAT IS SPOOFING? Definition and examples Entering orders with no intention of trading them, to impact other participants strategies Unusual proportion of orders deleted that did not execute and were valid for short period of time Presence of trades where participant is buyer (seller), but they are entering and deleting sell (buy) orders Some Examples of typical alerts Rapid Entry and Deletion pure order level alert lost relevance? Bait and Switch single large bait order to attract counterparties to trade Giving Up Priority constantly pulling your order from priority position lost relevance? Layering variation of Bait and Switch, using multiple orders to appear like multiple traders Ping Orders identify liquidity testing orders ahead of real strategy

LAYERING WHAT IS IT? Entering multiple buy (sell) orders across various prices, close to the best price, and trading against participants that better your prices. Our original layering alert works perfectly pre-hft and picked up the SWIFT TRADE case When applied to markets with mature HFT we expect it to pick up many cases will they be false positives? We have seen HFT firms with orders on both side of the book, potentially as market making strategies Often the HFT firm is trading in the opposite direction of what you might expect Conclusion - Surveillance algorithms may need to be adjusted Hone in on direction of trading i.e. trading against the layer. Consider whether the layered broker is active or passive in trading 12

WHAT IT LOOKS LIKE VISUALLY TIME SERIES

WHAT IT LOOKS LIKE VISUALLY ORDER BOOK 14

2 RECENT CASES SWIFT TRADE AND TRILLIUM UK - 8m fine January 2007 December 2007 Enter smaller limit orders at the touch Enter non-bona fide, large orders, just outside the touch Once Limit orders trade, cancel non-bona fide orders within seconds 58,000 alerts Est 1.75m profit US - $2.3m in penalties November 2006-January 2007 Enter Limit orders market improving or at best Enter non-bona fide orders, just outside the NBBO Once Limit orders trade, cancel non-bona fide orders within seconds 46,152 instances $575,765.17 profit $7,000 156,000 per trader 15

WHAT THE CASES DON T TELL US How many non bona-fide orders did the trader place on one side of the market? How much volume did the non bona-fide orders represent as a % of depth? How many winning trades were done compared to losing trades? How many times did they flip between buy and sell? With what frequency did they flip between buy and sell? How much profit was made on a per security per day basis? 16

HOW MIGHT I DETECT IT? Characteristics of one example examined Layered and flipped 35 times in the day Typically had 5 or more price steps covered on one side and 2 or less on the other Bought and sold 200k shares ~ 3.47 each = 700,000 Profit approx 1,800 on the day Turn it into an algorithm Phase 1 Look for 5 or more orders on the Bid (Ask) and 2 or less orders on the Ask (Bid) Look for a reversal of the current pattern so that they swap from bid to offer or vice versa Look for more than 20 cases of flipping and alert when 21 is reached Phase 2 Evaluate trades done while layered (selling when layered bid, buying when layered ask) Alert if profit exceeds $1000

FAST FORWARD FROM 2007 TO TODAY Has anything significant changed? YES! Rather than fooling traders watching screens, the aim is to fool other machines How much order depth is needed to signal a fictitious interest to other traders? Now I have multiple venues to play on in an interconnected, but unobserved network What could stand in the way of analysis? Different trading strategies coming down to the exchange from the same member firm How can you separate market making activity of a firm from DMA activity? Leads to false positives Is there a difference between initiating versus passive trading against the layer? Does a strategy have to be profitable for it to be manipulative? What if in the analysis, you find that when a layer is present, the resultant trades are profitable only 50% of the time? What if everyone is doing it? Do we redefine what is normal?

A NEW TYPE OF BEHAVIOUR SMALL BAIT AND SWITCH Is it possible to be a buyer and seller at the same price within a second? If I executed both as a single trade, that would be a wash sale What if I have the best bid, someone jumps in behind me, and I decide to then delete my bid and sell to them? That s now possible within a millisecond What was the new fundamental information that changed their investment decision? Do minimum order durations have merit?

CAN I MANIPULATE A DARK POOL? In Europe all dark orders execute at the mid-point of the lit market BBO Seems like very little opportunity to manipulate What if the lit spread is wider than the minimum tick size? Check the dark book for liquidity (Ping order), then simultaneously enter a market moving bid/offer in the lit, and a large order in the dark The dark book re-prices based on the updated lit book (need to know latency), and I get a better execution in the dark than before

QUOTE STUFFING Enter thousands of orders to impact downstream systems Disadvantage participants that have slower systems and cant digest the information quickly enough What might the quote stuffer be doing? They cant change the sequence of events Perhaps they can mask their behaviour for a second pulling more benefit out of a statistical arbitrage opportunity Sounds good, but does anyone have a practical example of this happening? The alert to identify high quote/order flow is very, very simple 21

MARKET FRAGMENTATION Market Fragmentation leads to: Multiple trading venues for a single security Within a country e.g. USA/Canada 1 regulator Within a region e.g. Europe/South America? multiple co-operating regulators Globally many regulators, not necessarily cooperating Greater challenges for surveillance to put all the pieces together Barriers to information sharing Opportunities to hide manipulation 22

MODELS OF SURVEILLANCE IN FRAGMENTED MARKETS Primary Listing Market handles surveillance Local experts for the listed securities with in-depth knowledge of trading profiles Government Regulator handles surveillance Local regulator takes challenge of consolidating data and operating market surveillance ASIC system hosted and operated by NASDAQ OMX Quasi-Regulator (SRO) handles surveillance Powers for surveillance delegated to an independent 3 rd party, who consolidates all data and performs surveillance IIROC system hosted and operated by IIROC, provided by NASDAQ OMX None of the above 23

24 PRACTICAL EXAMPLES OF THE IMPACT OF FRAGMENTATION ON SURVEILLANCE

PRACTICAL EXAMPLES UNUSUAL PRICE CHANGES How connected are the various market places? US REG NMS ensures that prices move together Europe loose best execution policies, arbitrage ensures prices move together What does a price movement on an exchange that does 10% of volume mean? Should they care? It is not possible for one venue to conclude who has caused the price movement without consolidating information. Conclusion consolidated information is required 25

PRACTICAL EXAMPLES UNUSUAL VOLUME CHANGES Surveillance cares about unusual volume because it may indicate information asymmetry However, the volumes across venues need to be considered as a whole, not the volume of a single venue Single venue volumes may fluctuate wildly as brokers move flow based on trading fee pricing schedules Conclusion consolidated information is required 26

PRACTICAL EXAMPLES FRONT RUNNING Broker trading for himself prior to executing a client order Broker previously had the opportunity to execute proprietary orders in substitutable instruments such as options, warrants and single stock futures Now they can execute those trades on behalf of the broker in the same instrument, but on a different venue Conclusion consolidated data is needed to identify front running 27

PRACTICAL EXAMPLES SPOOFING Layering Possible to place layered orders on one market and execute trades against the layer on another market Possible to enter multiple orders across multiple markets meaning that single market wouldn t detect the layer Bait and Switch Enter the large order onto one venue and then trade on another venue in the same security Conclusion Consolidated data is required to capture spoofing 28

SUMMARY DMA and HFT have altered the potential threat from those who would manipulate markets Market Fragmentation has made the detection job harder Prior to opening markets up to competition, analysis should be done to prevent unintended consequences Someone needs to have a consolidated view of trading, the technology to analyse it, the man power to interpret the analysis, and power to enforce regulations. Regulators, Exchanges and Brokers all have an important part to play in protecting market integrity 29

30 THANK YOU