Sponsored Access, a Signed Waiver, and a Stale Credit Limit
Your firm sponsors a hedge fund's direct market access to four exchanges. Orders pass through your gateway, which applies pre-trade controls: an aggregate $5 million gross notional credit limit per client, a 50,000-share per-order size cap, and a price collar of plus or minus 3% from the last consolidated sale. During a volatility spike the fund's algorithm fires 1,200 orders in 90 seconds; 340 are rejected by the size cap and collar. The fund's COO emails demanding that the collar be switched off 'just for the close' and that the size cap be raised to 250,000 shares, offering to sign a waiver and indemnity. The desk's largest block that day was 120,000 shares. Separately, you learn the credit limit is measured against a start-of-day notional figure supplied by the fund's prime broker.
1. Can you honor the request with a signed waiver and indemnity?
Read the worked answer
No. The waiver is worthless against the regulatory obligation.
- Rule 15c3-5 requires the broker-dealer to maintain pre-trade financial and regulatory risk controls that are under its direct and exclusive control. A customer cannot consent away a control, cannot be given the ability to configure around it, and cannot indemnify the firm into compliance. The liability stays with the firm and its CEO certification.
- Disabling the price collar would remove a market-access control the rule expressly contemplates (price and size parameters) during exactly the conditions - a volatility spike - in which it is most needed. That is close to a per se deficiency.
- Raising the per-order cap is not categorically forbidden, but only the firm can decide. It would require an independent determination that 250,000 shares is reasonable given the firm's capital, the client's creditworthiness, and the liquidity of the names traded, supported by data. A customer request plus an indemnity is not a basis for that determination.
- The right response is to decline or route the flow to manual review, document the request and the reasons for refusal, and tell the client what objective criteria would support a future limit change.
2. What is wrong with measuring the credit limit against a start-of-day notional figure, and what must the firm do?
Read the worked answer
The control is stale and therefore not reasonably designed to prevent the thing it exists to prevent.
- Financial risk management controls must be based on real-time data and recalculated intraday so the firm can block an order that would breach a credit or capital threshold at the moment it is entered. A start-of-day snapshot stops being accurate the first time the fund trades, and by midday it may bear no relation to actual exposure.
- The fix is to compute aggregate exposure from actual executions, open orders, and current market values across all four exchanges, compare it to the agreed limit before each release, and automatically reject - not merely flag - orders that would breach it. The limit itself should be re-examined against the fund's financials.
- Because the deficiency existed during a period of stressed flow, the firm should scope how much unprotected order flow was released, remediate, and document the review. The annual CEO certification is a representation that the controls are effective, so a known-and-unfixed gap undermines the certification itself.
3. A 45,000-share order clears the per-order size cap. The fund is already at $4.99 million of its $5 million limit and the order is worth $2.1 million. What should happen, and what does this reveal about control design?
Read the worked answer
The order must be blocked. Size caps alone do not satisfy Rule 15c3-5.
- The financial control is an aggregate exposure test, applied order by order. $4.99 million plus $2.1 million is $7.09 million against a $5 million limit. Passing the per-order size cap is irrelevant; the order breaches the credit threshold and must be rejected pre-trade, before it reaches any exchange.
- The episode also exposes a calibration problem. A $5 million aggregate limit paired with a 50,000-share cap is internally inconsistent: 50,000 shares of a $150 stock is $7.5 million, so a single order that satisfies the size control can by itself blow through the credit control. Controls must be designed as a set, with per-order size set below the aggregate limit at the highest plausible price for the names in scope.
- Operationally, the rejection should be logged, the client notified under the access agreement, and the incident fed into the periodic review of control effectiveness.