Law / European Union

MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6)

Directive 2014/65/EU, Article 17, supplemented by Commission Delegated Regulation (EU) 2017/589

In force since 3 Jan 2018.

An AI sector rules rule binding public and private bodies.

Obligation class

Governance, Reporting, Security

Audit expectation

periodic

Who audits it

Self

Where the report goes

Kept, Produced on request

As of 10 October 2026.

What it requires

• This Directive is addressed to the Member States (Article 97), which had to adopt and publish the measures necessary to comply with it by 3 July 2017 and apply them from 3 January 2018 (Article 93(1), as amended by Directive (EU) 2016/1034, Article 1, point (7)), so an investment firm meets Article 17 through each Member State's national law; Delegated Regulation (EU) 2017/589 is binding in its entirety and directly applicable in all Member States and applies from 3 January 2018 (Article 29).
• It reaches you if you are an investment firm that engages in algorithmic trading, meaning trading in financial instruments where a computer algorithm automatically determines individual parameters of orders such as whether to initiate the order, the timing, price or quantity of the order or how to manage the order after its submission, with limited or no human intervention; a system used only to route orders to one or more trading venues, to process orders involving no determination of any trading parameters, or to confirm orders or process executed transactions after the trade is outside that meaning (Directive 2014/65/EU, Article 4(1), point (39)). Have in place effective systems and risk controls suitable to the business you operate to ensure that your trading systems are resilient and have sufficient capacity, are subject to appropriate trading thresholds and limits, and prevent the sending of erroneous orders or the systems otherwise functioning in a way that may create or contribute to a disorderly market (Article 17(1)).
• Have in place effective systems and risk controls to ensure your trading systems cannot be used for any purpose that is contrary to Regulation (EU) No 596/2014 or to the rules of a trading venue to which you are connected, and effective business continuity arrangements to deal with any failure of your trading systems; ensure your systems are fully tested and properly monitored (Article 17(1)).
• Establish and monitor your trading systems and trading algorithms through a clear and formalized governance arrangement that sets out clear lines of accountability, including procedures to approve the development, deployment and subsequent updates of trading algorithms and to solve problems identified when monitoring them, effective procedures for the communication of information within the firm, and a separation of tasks and responsibilities of trading desks on the one hand and supporting functions, including risk control and compliance, on the other (Delegated Regulation (EU) 2017/589, Article 1).
• Ensure that your compliance staff has at least a general understanding of how your algorithmic trading systems and trading algorithms operate and is in continuous contact with the persons within the firm who have detailed technical knowledge of them (Article 2(1)), and employ a sufficient number of staff with the necessary skills to manage those systems and algorithms, with sufficient technical knowledge of the systems and algorithms, their monitoring and testing, the trading strategies you deploy through them and your legal obligations (Article 3(1)).
• Before deploying or substantially updating an algorithmic trading system, trading algorithm or algorithmic trading strategy, establish clearly delineated methodologies to develop and test it, have a person designated by senior management authorize the deployment or update, and design the methodologies to ensure that the system, algorithm or strategy does not behave in an unintended manner, complies with your obligations and the rules and systems of the trading venues you access, does not contribute to disorderly trading conditions and continues to work effectively in stressed market conditions; the authorization and the testing methodologies of Article 5(2) to (5) apply only to trading algorithms leading to order execution (Article 5(1), (2), (4) and (6)).
• Test the conformance of your algorithmic trading systems and trading algorithms with the system of the trading venue when you access it as a member, when you connect to it through a sponsored access arrangement for the first time, when there is a material change of the venue's systems, and before you deploy or materially update the system, algorithm or strategy, and with the system of the direct market access provider when you first access the venue through direct market access, when there is a material change affecting its direct market access functionality, and before you deploy or materially update the system, algorithm or strategy (Article 6(1)); run the testing of the criteria in Article 5(4), points (a), (b) and (d), in an environment that is separated from your production environment (Article 7(1)); and before deploying a trading algorithm set predefined limits on the number of financial instruments being traded, the price, value and numbers of orders, the strategy positions and the number of trading venues to which orders are sent (Article 8).
• Keep records of any material change made to the software used for algorithmic trading, allowing you to determine when a change was made, the person that made it, the person that approved it and the nature of the change (Article 5(7)); have a person designated by senior management review any proposed material change to the production environment related to algorithmic trading before it is made, and communicate any change to the functionality of your systems to the traders in charge of the trading algorithm and to the compliance and risk management functions (Article 11).
• Perform a self-assessment and validation process annually and on that basis issue a validation report that reviews, evaluates and validates your algorithmic trading systems, trading algorithms and strategies, your governance, accountability and approval framework, your business continuity arrangement and your overall compliance with Article 17 of Directive 2014/65/EU; have the risk management function draw up the report, have the internal audit function audit it where one exists, obtain the approval of senior management, and remedy any deficiencies it identifies (Article 9). As part of that self-assessment, test that your algorithmic trading systems and the controls in Articles 12 to 18 can withstand increased order flows or market stresses, with high messaging volume tests and high trade volume tests using the highest volumes of the previous six months multiplied by two, carried out in a way that does not affect the production environment (Article 10).
• Be able to cancel immediately, as an emergency measure, any or all of your unexecuted orders submitted to any or all trading venues to which you are connected, including orders originating from individual traders, trading desks or clients (kill functionality), and be able to identify which trading algorithm and which trader, trading desk or client is responsible for each order that has been sent to a trading venue (Article 12).
• Monitor all trading activity that takes place through your trading systems, including your clients' trading, for signs of potential market manipulation with an automated surveillance system that generates alerts and reports, covers the full range of your trading activities and all orders you submit, is reviewed at least once a year, and can generate operable alerts at the beginning of the following trading day or, where manual processes are involved, at the end of the following trading day (Article 13(1) to (3), (6) and (7)).
• Have business continuity arrangements for your algorithmic trading systems that are appropriate to the nature, scale and complexity of your business and documented in a durable medium, that deal with disruptive incidents and ensure a timely resumption of algorithmic trading, and review and test them annually (Article 14(1), (2) and (4)).
• Carry out pre-trade controls on order entry for all financial instruments, namely price collars, maximum order values, maximum order volumes and maximum messages limits, immediately include all orders sent to a trading venue in the calculation of those limits, and have repeated automated execution throttles that disable the trading system after a pre-determined number of repeated executions until a designated staff member re-enables it (Article 15(1) to (3)); set market and credit risk limits based on your capital base, clearing arrangements, trading strategy, risk tolerance, experience and certain variables (Article 15(4)).
• Monitor in real time, during the hours you are sending orders to trading venues, all algorithmic trading activity that takes place under your trading code, including that of your clients, for signs of disorderly trading, have the trader in charge of the algorithm and the risk management function or an independent risk control function carry out that monitoring, generate real-time alerts within five seconds after the relevant event, and take remedial action as soon as possible after an alert (Article 16(1), (2) and (5)). Continuously operate your post-trade controls, take appropriate action when one is triggered, keep complete, accurate and consistent records of trade and account information, and reconcile your own electronic trading logs with the information provided by trading venues, brokers, DEA providers, clearing members, central counterparties and data providers (Article 17(1) and (3)).
• Implement an IT strategy and arrangements for physical and electronic security that minimize the risks of attacks against your information systems, promptly inform the competent authority of any material breaches of your physical and electronic security measures with an incident report on the nature of the incident, the measures taken and the initiatives to avoid similar incidents, and annually undertake penetration tests and vulnerability scans (Article 18(1) to (4)).
• Notify the competent authorities of your home Member State and of the trading venue at which you engage in algorithmic trading as a member or participant that you engage in algorithmic trading in a Member State, and on request provide a description of the nature of your algorithmic trading strategies, details of the trading parameters or limits to which the system is subject, the key compliance and risk controls you have in place and details of the testing of your systems (Directive 2014/65/EU, Article 17(2)).
• Arrange for records to be kept in relation to those matters, sufficient to enable your competent authority to monitor compliance with the requirements of the Directive (Article 17(2)). If you engage in a high-frequency algorithmic trading technique, meaning a technique characterized by infrastructure intended to minimize network and other latencies, system-determination of order initiation, generation, routing or execution without human intervention for individual trades or orders, and high message intraday rates (Article 4(1), point (40)), store in an approved form accurate and time sequenced records of all your placed orders, including cancellations of orders, executed orders and quotations on trading venues, and make them available to the competent authority upon request (Article 17(2)); record the details of each submitted order immediately after submission in the format set out in tables 2 and 3 of Annex II and keep the records for five years from the date of the submission of the order (Delegated Regulation (EU) 2017/589, Article 28).
• If your algorithmic trading pursues a market making strategy, carry out that market making continuously during a specified proportion of the trading venue's trading hours, except under exceptional circumstances, enter into a binding written agreement with the trading venue that specifies your obligations, and have in place effective systems and controls to ensure that you fulfil your obligations under the agreement at all times (Directive 2014/65/EU, Article 17(3)). You are considered to pursue a market making strategy when, as a member or participant of one or more trading venues, your strategy, when dealing on own account, involves posting firm, simultaneous two-way quotes of comparable size and at competitive prices relating to one or more financial instruments on a single trading venue or across different trading venues, with the result of providing liquidity on a regular and frequent basis to the overall market (Article 17(4)).
• If you provide direct electronic access to a trading venue, have in place effective systems and controls that ensure a proper assessment and review of the suitability of clients using the service, that those clients are prevented from exceeding appropriate pre-set trading and credit thresholds, that their trading is properly monitored, and that appropriate risk controls prevent trading that may create risks to you or contribute to a disorderly market; direct electronic access without such controls is prohibited (Directive 2014/65/EU, Article 17(5)). Apply the controls of Articles 13, 15 and 17 and the real-time monitoring of Article 16 of Delegated Regulation (EU) 2017/589 to the order flow of each of your direct electronic access clients, conduct a due diligence assessment of prospective clients, and review your due diligence assessment processes and reassess your clients' systems and controls annually (Articles 20, 22 and 23).
• If you act as a general clearing member for other persons, have in place effective systems and controls to ensure clearing services are only applied to persons who are suitable and meet clear criteria, and a binding written agreement with each such person on the essential rights and obligations arising from the service (Directive 2014/65/EU, Article 17(6)); subject the systems you use to support your clearing services to appropriate due diligence assessments, controls and monitoring (Delegated Regulation (EU) 2017/589, Article 24).

Who enforces it

What it makes you log

When LexLint raises it

When your app profile says your app provides financial services.

Back to the example  ·  Lint your app