4
Testing and deployment
4.1
The PRA expects all algorithms (including those provided by external vendors) and risk controls to be tested prior to deployment. Testing should assess their design and implementation.
- 30/06/2018
4.2
The PRA expects a firm periodically to re-validate algorithms and risk controls. The reviews should be carried out at a frequency and with a level of rigour commensurate with the risks the firm could be exposed to if algorithms or risk controls are not operating as intended.
- 30/06/2018
4.3
The PRA expects all relevant functions (including Front Office, Risk Management and Other Systems and Controls) to ensure that automated risk controls relevant to that function operate as intended. This involves authorising the design of tests and signing off the results of such tests to ensure the automated risk controls operate as intended.
- 30/06/2018
4.4
Any variation of an algorithm (for example, regional variation) should be classified as a new algorithm and therefore subject to separate testing and approval. Minimum testing requirements should be clearly documented for all cases (new and variation of algorithms).
- 30/06/2018
4.5
The PRA expects testing to be undertaken:
(a) by a competent team that was not involved in the development (including implementation) of the code; and
(b) with material differences between the test environment and the production environment being included in the testing documentation.
- 30/06/2018
4.6
Prior to deployment, the PRA expects, at a minimum, a firm to assess:
(a) the latency8 of the algorithmic trading system. The algorithmic trading system is the infrastructure used for algorithmic trading, including infrastructure used to oversee and manage algorithmic trading, for example the firm’s risk management systems;
(b) the latency between different parts of the algorithmic trading system where there are dependencies. The firm should ensure that the latency does not adversely impact operations, including the intended operation of the risk controls; and
(c) system capacity, including the number of orders that can be processed per second, both under normal and severe but plausible market conditions. The firm should detail the contingency plan to be followed if system capacity appears likely to be exhausted under normal and severe but plausible market conditions.9
Footnotes
- 8. Latency is the speed at which an action occurs following the issuing of an instruction. That is, the time it takes for an instruction to be sent from point A and received at point B and for B to then to start to act on the instruction.
- 9. The head-room capacity, which is the capacity that is not utilised under normal market conditions, should be known to those involved in operating and overseeing algorithmic trading.
- 30/06/2018
4.7
The PRA expects a firm, where it is connected to a trading venue, to assess the operational arrangements at the trading venue and determine whether actions should be taken to ensure that the algorithmic trading system operates as intended and, if necessary, what these actions should be.
- 30/06/2018
4.8
The PRA expects a firm, where it is using infrastructure provided by an external vendor, to assess whether actions should be taken to ensure that the algorithmic trading system operates as intended and, if necessary, what these actions should be.
- 30/06/2018
4.9
When deficiencies or errors are identified during the testing process, the firm should take remedial action. In particular, the use of the algorithm could be prohibited or limited via controls. The firm should have a process for managing identified issues that includes the tracking and documenting of outstanding issues to an auditable standard.
- 30/06/2018