Trading Venues: Are Your Processes and Controls Fit for Purpose?

13 Oct

Insight | Risk & Regulation

Background

Trading venue governance remains an area of significant regulatory focus.

The regulatory expectation is straightforward. Firms must understand where and how they trade, ensure that activity is appropriately authorised and controlled, and be able to demonstrate that relevant orders and transactions are captured within their surveillance framework.

The practical challenge is considerably more complex.

Trading activity can take place across regulated markets, MTFs, OTFs, systematic internalisers, broker platforms, web-based execution platforms, direct and sponsored market access arrangements and other electronic execution channels. Connectivity can range from fully integrated electronic order flows to relatively standalone web-based GUIs. Unless these channels are identified, inventoried and connected to the firm's control environment, gaps can arise.

This is not a new concern. In Market Watch 68, the FCA highlighted gaps in firms' ability to capture and monitor orders placed through web-based platforms, particularly orders which did not result in an execution. Market Watch 79 subsequently highlighted cases where firms believed order and trade data was feeding into surveillance systems when, in fact, it was not.

Recent enforcement action demonstrates the potential consequences.

In March 2024, US regulators fined JPMorgan Chase a combined $348.2m following deficiencies in its trade surveillance programme. The OCC found that the bank had gaps in trading venue coverage and inadequate data controls, resulting in billions of instances of trading activity across at least 30 global trading venues not being subject to appropriate surveillance. The OCC's action went as far as requiring regulatory non-objection before the bank onboarded new trading venues.

In the UK, Citigroup Global Markets was fined a combined £61.6m by the FCA and PRA following failures in its trading systems and controls. The most significant incident arose after a trader intending to sell a US$58m basket of equities accidentally created a US$444bn basket. Controls blocked part of the order, but US$189bn was passed to the trading algorithm and US$1.4bn was ultimately executed across European exchanges before the order was cancelled.

More recently, in March 2026, the FCA fined Dinosaur Merchant Bank £338,000 for market abuse surveillance failures. Following the introduction of a new order system, approximately $3.05bn of underlying trading activity took place between June and October 2024 without the associated orders and trades being captured by the firm's automated surveillance system.

Taken together, these cases reinforce an important point. Having a surveillance system is not sufficient. Firms need to demonstrate that the population being surveilled is complete.

What should firms be considering?

Venue definition and control perimeter

Firms should maintain a clear definition of what constitutes a Trading Venue for the purposes of their control framework.

This should distinguish between the formal regulatory definition of a Trading Venue and the firm's broader operational control perimeter.

The latter may need to capture platforms which do not technically fall within the regulatory definition but through which the firm can place orders, submit quotes, provide market access or execute transactions. If the definition is too narrow, the inventory and the controls that flow from it will also be too narrow.

A single, authoritative Venue Inventory

A comprehensive Venue Inventory should sit at the centre of the framework.

Trading Venue Inventory: sixteen attributes including venue and legal operator, regulatory classification, jurisdiction, MIC codes, legal entities, approved products, connectivity method, approved algorithms, data availability, surveillance coverage, pre-trade controls, rulebook ownership, regulatory reporting, control owners, onboarding status and review dates.

The inventory should not simply be a reference database. It should drive downstream controls.

There should be a formal handshake between the Venue Inventory and surveillance, market abuse risk assessments, algorithm inventories, market access controls, regulatory reporting and other relevant systems. A venue recorded as active in one environment but absent from another should generate challenge.

New venue and product onboarding

Firms should operate a clearly defined process for onboarding new venues and adding new products, businesses, connectivity methods or algorithms to existing venues.

Approval should include appropriate representation from the Front Office, Compliance, Risk, Operations and Technology, with requirements determined by the nature of the access.

Importantly, controls should apply not only when a completely new venue is introduced. A change to connectivity, a new order management system, the introduction of sponsored access, a new algorithm or the expansion of an existing venue into a new asset class can materially alter the control environment.

The FCA's 2025 review of algorithmic trading controls found that many firms appropriately subjected an existing algorithm being deployed into a new market to the same level of review and approval as a new algorithm. The same principle should apply more broadly to venue management.

Completeness, accuracy and reconciliation

The Venue Inventory should be subject to ongoing completeness and accuracy controls.

Firms should identify independent and repeatable data sources capable of identifying venue activity and reconcile these against the inventory. Depending on the organisation, this might include transaction and order data, exchange fees, broker and vendor records, network connections, static data, regulatory reporting, Front Office systems and surveillance feeds.

The objective should be to identify both known venues with incomplete attributes and venues being used outside the approved process.

Periodic Front Office attestation can support the framework, but it should not be the primary completeness control.

Surveillance coverage and data lineage

The ability to demonstrate complete surveillance coverage has become particularly important.

Market Watch 79 highlighted examples where surveillance systems appeared to be operating normally and were generating alerts, but particular data feeds were absent. In one case, sponsored DMA activity associated with a venue was not being ingested into surveillance for several years. The presence of valid alerts from other activity gave the firm false comfort that its surveillance population was complete.

Firms should therefore be able to trace order and transaction data from the point of origination through to surveillance and demonstrate that the population received is complete.

This requires controls over data lineage, feed monitoring, reconciliation and surveillance model testing, rather than reliance on alert volumes as evidence that a surveillance platform is operating effectively.

The Venue Inventory provides a logical starting point against which that completeness can be assessed.

Preventative and detective access controls

Controls should prevent unauthorised use of Trading Venues and identify instances where access has occurred outside the approved process.

This should include appropriate management of user access, trader permissions, system connectivity, legal entity permissions, product permissions and algorithm access.

Detective controls should independently identify venue activity and compare it with the approved inventory rather than relying solely on preventative access controls having worked as intended.

Trading algorithms

The Venue Inventory and algorithm inventory should be linked.

Firms should understand which algorithms are approved for use on which venues, markets and products and ensure that appropriate conformance testing, pre-trade controls, monitoring and surveillance are in place.

The FCA's August 2025 review of algorithmic trading controls emphasised detailed algorithm inventories, defined ownership, conformance testing, simulation testing, controlled deployment and appropriately calibrated pre and post-trade controls. It also highlighted the importance of Compliance having sufficient understanding and oversight of those controls.

For firms operating in the EU, ESMA's February 2026 supervisory briefing provides further emphasis on governance, pre-trade controls, testing and outsourcing of algorithmic trading systems. It also begins to address the use of AI within algorithmic trading, demonstrating how the supervisory perimeter continues to evolve alongside technology.

Trading Venue rulebooks

Trading Venue rulebooks create contractual and regulatory obligations which can differ substantially between venues.

Firms should maintain a clear process for identifying applicable rulebooks, allocating ownership and assessing changes.

Material rule changes should be distributed to the relevant Front Office, Compliance, Risk, Operations and Technology teams, with evidence that required changes to controls, processes and systems have been assessed and implemented.

The Venue Inventory can again act as the control point, identifying which rulebooks apply to which businesses and who owns the resulting obligations.

Direct and sponsored market access

Direct electronic access and sponsored access introduce additional risks because the firm may be responsible for activity entering a market without passing through its traditional execution architecture.

Controls should address client approval, credit and capital thresholds, erroneous order controls, market abuse surveillance, access permissions and ongoing review.

In the US, SEC Rule 15c3-5 continues to require broker-dealers providing market access to maintain financial and regulatory risk controls, including pre-trade controls designed to prevent orders exceeding defined limits or appearing erroneous. The responsibility for those controls remains with the broker-dealer providing market access.

The surveillance risks are equally important. Both the JPMorgan enforcement action and the example of sponsored DMA highlighted in FCA Market Watch 79 demonstrate why firms need to understand not simply who has market access, but where the resulting order data is captured and how it reaches surveillance.

Pre-trade and "fat finger" controls

The Citigroup incident provides a particularly clear reminder of the importance of preventative controls.

Firms should assess both venue-provided controls and internally configured controls, including price, quantity, value, credit and capital limits. Controls should be calibrated to the nature of the product and trading strategy rather than relying on generic thresholds.

Ownership should also be clear. The FCA's 2025 algorithmic trading review identified instances where ownership of pre and post-trade controls was poorly defined or where Compliance had insufficient oversight of how those controls operated.

The objective should not simply be to demonstrate that limits exist, but that they are appropriately calibrated, independently reviewed and capable of preventing a clearly erroneous order from reaching the market.

Governance and regulatory change

Venue Management should have clear senior ownership and an established governance structure.

Management information should provide visibility of the overall venue population, new and pending venues, inventory exceptions, outstanding rulebook changes, surveillance gaps, control breaches, algorithm deployments and overdue remediation.

Regulatory horizon scanning should form part of this governance.

The regulatory landscape continues to change. For example, the FCA's reformed UK commodity derivatives framework came into force on 6 July 2026 and includes enhanced surveillance requirements for relevant trading venues. The FCA has also now finalised significant changes to the UK transaction reporting regime, with the revised regime scheduled to take effect from 3 April 2028 and further technical consultation due in October 2026.

Firms therefore need a process for identifying changes, determining which venues and businesses are affected and ensuring that the control framework is updated accordingly.

How should firms manage Trading Venue controls?

For larger or more complex firms, Venue Management should be treated as a defined control capability rather than a collection of disconnected responsibilities.

A central or globally coordinated Venue Management function can own the control framework, maintain the Venue Inventory, coordinate onboarding, oversee reconciliations, manage rulebook obligations and provide governance and management information.

Responsibilities can remain distributed across Front Office, Compliance, Risk, Operations and Technology, but the framework needs a clearly identified owner capable of demonstrating that the component parts join together.

The Venue Inventory should sit at the centre of this model.

The question firms should ultimately be able to answer is simple:

Can we demonstrate that we know every venue and execution channel we use, that its use has been approved, and that every relevant order and transaction is subject to the controls and surveillance we expect?

Increasingly, regulators are testing the evidence behind that answer.

How can New Link Consulting help?

New Link Consulting combines regulatory expertise with practical Front Office, Risk, Operations, Data and Technology experience.

We can help firms define their Trading Venue control perimeter; design, build and reconcile a strategic Venue Inventory; assess existing venue onboarding and change processes; review surveillance coverage and data completeness; assess operating models and governance; review algorithmic trading and pre-trade controls; perform Trading Venue rulebook reviews; assess DMA and sponsored access arrangements; design management information and control testing; and support remediation where weaknesses have been identified.

Our approach is practitioner-led and focused on ensuring that the control framework works in practice, not simply that the required policies exist.

New Link Consulting has worked with a number of clients to design and deliver Trading Venue solutions and can support organisations from initial current-state assessment through to implementation and remediation.

For further information on how New Link Consulting can assist with Trading Venue controls within your organisation, please contact Tom Masters, Mark Adams and Andy Hovell for more info.

Tom Masters

Partner

Tom has been a partner since 2014, specialising in organisational structure and strategy, risk and control, banking regulation and financial crime.
Delivered complex regulatory change programmes globally alongside occupying senior interim COO and KYC/AML roles where clients require.
Prior to NLC, spent five years at RBS leading large-scale, front-to-back transformation and regulatory implementation.

Mark Adams

Director

Mark has nearly 40-years of experience across Retail, Corporate, Investment and Custody Banking. He has worked with New Link Consulting since 2017, and as a Director since 2021.
Has been retained by clients on successive long-term engagements, keen to leverage his broad experience and trusted ability to successfully deliver across a wide range of regulatory and strategic change projects in both the First and Second Lines of Defence.
Fully proficient in the performance of impact assessments and gap analysis, facilitating delivery of remedial actions, undertaking risk assessments and design of appropriate mitigating controls, Target Operating Model design and robust project governance execution.

Andrew Hovell