Risk Management Guidelines for Algorithmic Trading

Nov. 2014

＜Table of Contents＞

Ⅰ. Background ····························································································· 3

Ⅱ. Summary ································································································· 5

Ⅲ. Guidelines ································································································ 8

Chapter 1. General ······························································································· 8

1.1. Objective ················································································································· 8 1.2. Applicability ··········································································································· 8 1.3. Terminology ············································································································ 8

Chapter 2. Designing Member's Systems ························································ 10

2.1. Introduction and Implementation of Procedures to Install the Algorithmic Systems and Develop and Change the Programs ············································ 10 2.2. Ensuring Completeness of Algorithmic Trading Programs and Logic ·········· 11 2.3. Deployment of Functions in the Member’s System to Prevent a Misquotation in Algorithmic Trading ································································ 12 2.4. System and Program Architect’s Understanding of Related Regulations ····· 12 2.5. Traders’ Understanding of Algorithmic Trading System's Operations and Program Logic ····································································································· 13

Chapter 3. Testing Member's Systems ····························································· 14

3.1. Introduction of Testing Criteria and Procedures ·············································· 14 3.2. Types of Testing ································································································· 14 3.3. Conducting and Managing Tests ······································································· 15

Guidelines available from this English version do not warrant or assume any liability or responsibility for the accuracy, completeness or usefulness of any information. Only Korean version shall be deemed authentic.

Chapter 4. Risk Management ··········································································· 16

4.1. Management of Algorithmic Trading ································································ 16 4.2. Routing Algorithmic Trading Orders Received from Clients Through Security Device ··································································································· 17 4.3. Management of Order Limits ············································································· 19 4.4. Validation of Quotation ······················································································ 21 4.5. Member System’s Functions to Validate Accumulated Quotation Quantity Limit and Risk Exposure Limit, Cancel Orders in Batch, and Request to Activate the Kill Switch ···················································································· 22 4.6. Monitoring of Order Limits ··············································································· 24 4.7. Restriction of Access to Member's System ······················································ 25

Chapter 5. Initiating Algorithmic Trading, Responding to Incidents and Validation After the Incidents ·········································································· 26

5.1. Requirements upon Initiating Algorithmic Trading System After Development and Change ··················································································· 26 5.2. Preparation for Algorithmic Trading Incidents or Errors ······························· 27 5.3. Checking Member’s Systems for Algorithmic Trading ································· 28

Chapter 6. FEP Controls by Members ···························································· 30

6.1. FEP Management and Operations by Members ·············································· 30 6.2. Access to FEP Server by Members ·································································· 32 6.3. Turning On and Off of FEP Process by Members ······································ 33 6.4. Member’s Monitoring of the FEP Process ······················································· 33 6.5. Digital Certificate for Authentication and License for Encryption Module · 34 6.6. Verification of Number of Daily Order, Executions and RTT (Round Trip Time) ······························································································ 35 6.7. Keeping Logs of Orders and Executions Transmitted and Submission of the Logs ······················································································ 36 6.8. Identification of Superuser (root) ID and Password in the FEP server ······· 37 6.9. FEP Programs Maintenance ·············································································· 38

Ⅳ. Checklist ································································································ 40

- 3 -

Ⅰ. Background

Algorithmic trading in the securities and derivatives markets refers to "automated trading programmed to follow a pre-defined set of decision parameters such as identification of trading opportunities and generation and submission of quotes, without human intervention1)." Based on pre-programmed instructions, the algorithmic system automatically keeps a watch for live prices and puts in the orders in response to the market dynamics. Its inherent nature requires orders to be delivered and executed in the markets at a fast pace, making the process significantly complex. Its primary form is high-frequency trading, which arbitrages away the most infinitesimal price discrepancies.

The rapid growth of algorithmic trading in major financial markets has been driven by the markets’ computerization in tandem with technological development. It is also attributable to the emergence of ATS (Alternative Trading System)2), increasing market competition due to the implementation of Regulation NMS (National Market System)3) in the United States and MiFID (Markets in Financial Instruments Directive)4) in the European Union. In Korea, while algorithmic trading is not actively used in the cash equities trading, it accounts for significant volume in the derivatives market5) and is gradually on the rise.

Algorithmic trading increases liquidity and execution speed while reducing trading cost. However, the consequence of system errors or mistyped orders can cause substantial losses, jeopardizing a whole financial institution, or creating substantial market turmoil, as was the case with the Flash Crash6) in the US

1) Korea Exchange defines algorithmic trading in Article 156-3 of the Derivatives Market Business Regulation revised as of July 3, 2013.

2) Alternative Trading System (ATS) refers to non-exchange trading venues such as ECN, MTF and Dark Pool.

3) Securities Exchange Commission (SEC) adopted Regulation NMS in April 2005, to mandate the best execution where orders should be routed to other trading venues quoting the best price when it is not available in the US exchanges, eliminating disadvantages that ATS faces in quote competition.

4) The EU introduced the MiFID in Nov 2007, which allows electronic execution in the trading of all equities, to reduce trading costs.

5) Derivatives trades executed through the algorithmic trading systems, which was reported by the members of the Korea Exchange, account for 53.7% of KOSPI 200 futures trades and 46.2% of KOSPI 200 options trades, based on trading volume between January and September 2014..

- 4 -

on May 6, 2010. Erroneous orders sent through the algorithmic trading system are executed rapidly, incurring significant losses and increasing risks of settlement failure. This can affect market integrity.

Therefore, it is critical for each trading counterpart - whether a financial institution or an investor who uses an algorithmic trading system - to establish and implement effective internal controls to prevent erroneous algorithmic trading. Most of errors or incidents related to algorithmic trading in Korea over recent years could have been prevented or their losses significantly reduced if internal controls had been strictly enforced.

While different market participants in Korea including exchange members, institutional investors and foreign investors may have different internal control environments for algorithmic trading, key controls are often found to be lacking or poorly managed. We believe that putting a detailed and comprehensive regulation in place for all market participants is critical, in order to minimize the risks of trading errors.

To prevent algorithmic trading incidents, the Market Oversight Commission of the Korea Exchange ("the Exchange") has been preparing to introduce risk management guidelines since March 2014. It sought industry opinions through the task force team of financial investment experts. In addition to analyses of trends and trading incidents in and outside of Korea, it also assessed checklists of members’ risk management of algorithmic trading. As a result of these initiatives, it published the "Risk Management Guidelines for Algorithmic Trading" in November 2014.

While the guidelines apply to KRX members in general, part of the guidelines can apply to market participants who use algorithmic trading. The guidelines recommend controls for KRX members to ensure that the markets function in an orderly manner. It is subject to periodical review and modification as market conditions require.

6) On May 6, 2010, the Dow Jones Industrial Average plunged 998.50 points (9.2%) from the previous day’s close of 10,868.12 points only to quickly rebound to close the day down 347.80 points (3.2%) at 10,520.32 points

- 5 -

II. Summary

The guidelines define requirements for KRX members to meet when conducting algorithmic trading both on a proprietary basis and on a brokerage basis. It is designed to prevent errors and mitigate risks and ensure market stability and investor protection.

It clearly details out comprehensive controls for members and investors to satisfy at each stage, from designing and testing the member's systems7) for algorithmic trading to mitigating risks, initiating trading on the system, responding to incidents and validation after each incident. It also puts forth requirements associated with the members' and investors' control over the FEP8).

These guidelines are designed to help its users easily understand what each of the six chapters requires. The objective of each chapter is shown right below the title, along with the intent and expected outcome in the provisions that follow. The attached checklist will assist members and investors in performing their day-to-day work and self-assessing the associated risks.

Chapter 1. General

The guidelines apply to KRX members who trade securities and derivatives via algorithmic trading systems on a proprietary basis or on a brokerage basis.

Chapter 2. Designing Member's Systems

To prevent algorithmic trading incidents, errors of member's systems and programs

7) “Member's Systems” refer to a set of systems managed by the members, including algorithmic trading systems for the members' proprietary flows (client's algorithmic trading system is not included), trading ledgers, suspense trading ledgers, and FEP.

8) Article 2 (Definition) of the Korea Exchange's Guidelines on Connection to the Member's Systems (11) In this Guidelines, "Member’s Front End Processor" refers to a server that connects the members with the Exchange, which is member's communication and control system that sends and receives orders, execution information and quotations for trading financial investment products. (Note: if the server provides more functions than communication and control, only the programs that perform communication and control functions are applicable.)

- 6 -

should be eliminated at the design stage, ensuring the orderly functioning of the systems and programs. Necessary procedures should be adopted and implemented to validate components and operational requirements at each stage of installing the algorithmic trading system9), and developing and changing programs. Error testing should be conducted at the design stage to ensure that algorithmic trading programs and their logics are complete. Member's systems should be able to detect mistyped quotes that are submitted for algorithmic trading ("quotes for algorithmic trading"). System developers and programmers should keep abreast of all regulatory requirements on the quotes for algorithmic trading to ensure that their systems and programs reflect the requirements at all times. Traders should be aware of every change in the algorithmic trading system’s operational processes or its program’s logic, to prevent erroneous trades.

Chapter 3. Testing Member's Systems

Before the algorithmic trading is initiated, sufficient testing on the member's

systems and programs should be conducted to ensure that they are complete.

Testing criteria and processes must be established and quality assurance should

be performed accordingly. The appropriate department head should sign off on

the test results for validation and future reference. Members should make an

extra effort to ensure that system testing is conducted as it is fundamental to

the management of risks associated with algorithmic trading

Chapter 4. Risk Management

A lack of risk controls often leads to algorithmic trading errors, so pre-trade and post-trade risk controls in high risk areas should be implemented. Also, protective barriers such as real time monitoring of exposures should be in place. Members should meet regulatory requirements including those on management of their algorithmic trading, routing clients’ algorithmic trading

9) "Algorithmic trading system" refers to a system (member’s system only and client’s system is not applicable) that uses algorithms to drive trading decisions and generate quotes (only for the member’s proprietary trading.

- 7 -

orders through the security device, and checking validity of the quotes. Trade limit control is a critical risk management factor. Therefore, the systems should enable members to comprehensively manage risks associated with the trade limit by such means as setting restrictions on trading value and quantity and automatically rejecting trades that exceed a pre-defined limit.

Chapter 5. Initiating Algorithmic Trading, Responding to Incidents and Validation After Incidents

If proper risk control processes are not in place or lacking, algorithm trading both on a proprietary basis and on a brokerage basis is prone to errors. Therefore, it is important to put in place safeguards to enhance the internal risk controls, including validation upon the initiation of the algorithmic trading systems and programs, deploying a process to respond to incidents or errors and conducting periodic checks. For instance, for a certain time period after the algorithmic trading is initiated, quotes should be limited to a minimum, given the difference between the testing environment and real markets. Also, an incident response framework should be established such as operational manuals on trading errors and training of employees involved in the algorithmic trading.

Chapter 6. FEP Controls by Members

The FEP (Front End Processor) should be managed and operated by members10). Allowing their clients to manage the FEP and processing client’s trade orders preferentially via separate systems or facilities, (e.g. letting the client’s trade orders bypass the security device of the member’s systems, or installing the client’s order management program on the member’s FEP) is extremely risky and prohibited by regulation. In such cases, members cannot control certain risks such as misquotes, which may result in trading errors. Members should manage and control the FEP to prevent algorithmic trading errors and control risks.

10) Article 13 (System Management) of the Korea Exchange's Guidelines on Connection to the Member's Systems (1) Members themselves should manage the member's systems. If the member commissioned a third-party, except

its clients, to manage and operate the systems with the instructions from the member, pursuant to Article 42 of the Capital Market and Financial Investment Business Act, it is considered that the system is managed and operated directly by the member.

- 8 -

Ⅲ. Guidelines

Chapter 1. General

1.1. Objective

These guidelines set out requirements for members in both their proprietary and client agency businesses. It aims to prevent incidents and control risks associated with algorithmic trading, contributing to orderly market functioning and safeguarding investors.

1.2. Applicability

The guidelines apply to members conducting algorithmic trading both on a proprietary basis and on a brokerage basis in the securities and derivatives markets, except 2.1, 2.2, 2.4, and 2.5 under Chapter 2 and 5.1 under Chapter 5, which apply only to proprietary trading and 4.2 under Chapter 4, and 6.1.②

under Chapter 6, which apply only to agency trading conducted on behalf of the clients. Members may also encourage their investors including institutional ones involved in algorithmic trading to voluntarily apply part or all of the guidelines to mitigate the risks associated with algorithmic trading.

1.3. Terminology

① "Algorithmic trading" refers to automated trading programmed to follow pre-defined decision parameters that, for example, identify trading opportunities and create and send quotes without human intervention.

② "Algorithmic trading system" refers to a system (member’s system only and client’s system is not applicable) that uses algorithms to drive trading decisions and generate quotes (only for the member’s proprietary trading)

- 9 -

③ "Member’s Front End Processor (FEP)" refers to a server that connects the members with the Exchange, which is a communication and control system that transmit orders, execution information and market data for financial investment products between the member's systems and the Exchange's systems. (Note: if the server provides more functions than communication and control, only the programs that perform communication and control functions are applicable.)

④ "Member's systems" refers to a set of systems managed by the members, including algorithmic trading systems, trading ledger and suspense trading ledger, and FEP.

- 10 -

Chapter 2. Designing Member's Systems

Members’systems and programs should be designed to be error-free and to ensure their orderly functioning, preventing any market disruption and financial loss.

2.1. Introduction and Implementation of Procedures to Install the Algorithmic

Trading Systems and Develop and Change the Programs

To control algorithmic trading risks, adequate procedures must be in place to validate the components and operational requirements at each stage of installing algorithmic trading systems and developing and changing programs.

① For the installation of the algorithmic trading system on the member’s systems, members should establish and implement procedures to define its purpose, components, methodology, and internal approval process.

With the procedures in place, risk controls will be enhanced as the purpose of the proprietary algorithmic trading and the operational processes including the manual and authorizers should be clearly specified.

② For the development of the algorithmic trading system’s programs, members should establish and implement procedures to define its purpose, components, methodology, and internal approval process.

With the procedures in place, members will be able to ensure that the developed programs are complete and risk controls are enhanced as the purpose of developing algorithmic trading programs and the operational processes including the manual and authorizers should be clearly specified.

- 11 -

③ For the change of the algorithmic trading system’s programs, members should establish and implement procedures to define its purpose, components, methodology, and internal approval process.

With the procedures in place, members will be able to ensure that the changed programs are complete and risk controls are enhanced as the purpose of changing algorithmic trading programs, and the operational processes including the manual and authorizers should be clearly specified.

2.2. Ensuring Completeness of Algorithmic Trading Programs and Logic

The first step towards managing the risk of algorithmic trading is to detect errors of its program and logic and ensure that they are complete through validation at the design stage.

① Staff members of the applicable department should test the algorithmic programs to detect errors, based on the scenarios written by the trading desks.

Departments in charge of managing the algorithmic trading program (e.g.

IT department) which is used for the member's proprietary trading should test the programs, based on the scenarios written by the trading desks who are going to use the program, to detect the errors and verify and fine-tune the performance of the program before the implementation of the program.

② Test results should be signed off by the head of an appropriate department for record-keeping

The requirement for sign-off by a supervisor (head of an appropriate department) ensures that the testing is performed adequately. Records of the testing can be also used for reference in the development of solutions that address errors going forward.

- 12 -

2.3. Deployment of Functions in the Member’s Systems to Prevent a Misquotation in Algorithmic Trading

Member’s systems should have a function that validates submitted quotes and detects a mistyped quote to prevent erroneous trades.

For trading both on a proprietary basis and on a brokerage basis, erroneous trading caused by mistyped quotes can be prevented by deploying in the member’s systems a function that detects the mistyped quotes posted for algorithmic trading.

2.4. System and Program Architect’s Understanding of Related Regulations

Since quotes in algorithmic trading need to comply with applicable regulations, the system and program architects should understand all regulatory requirements on algorithmic trading quotes and observe them in the design of the systems and programs

① Compliance departments should provide training on applicable regulatory requirements for algorithmic trading system and program architects when regulation changes or a new architect joins the firm.

Algorithmic trading systems and programs should be designed to reflect regulatory requirements and changes. Therefore, compliance departments should require their architects to keep abreast of regulation through timely training when regulation changes or a new architect joins.

② Algorithmic trading system and program architects should clearly understand the regulatory requirements that are included in the compliance training.

Algorithmic trading system and program architects should clearly understand the regulatory requirements associated with algorithmic trading, so that they can reflect the requirements in their system and program design.

- 13 -

③ The head of an appropriate department should sign off on the records of the architect training described in ①.

The requirement to obtain sign-off from a supervisor (head of an appropriate department) ensures that the architects are trained adequately. Records of such training can be also used for reference in future training.

2.5. Traders’ Understanding of Algorithmic Trading System's Operations and Program Logic

Traders should fully understand the operations of the algorithmic system and the program logic, to reduce risks of trading errors.

① Algorithmic system and program architects should train traders on the operations of the trading system and program logic when the need arises.

The architects should keep the traders up-to-date on the latest change in the systems and programs as soon as any change is made.

② Traders should fully understand the algorithmic trading system’s operations and program logic.

Traders should clearly understand the system’s operations and program logic, to prevent trading errors caused by malfunction of the systems and programs.

③ The head of an appropriate department should sign off on the records of the trader training described in ①.

The requirement to obtain sign-off from a supervisor (head of an appropriate department) ensures that the traders are trained adequately. Records of the training can be also used for reference in future training.

- 14 -

Chapter 3. Testing Member's Systems

Systems should be sufficiently tested to prevent errors of member's systems, which are often attributed to algorithmic trading incidents. Testing validates completeness of the systems and programs, prior to the initiation of algorithmic trading. While testing of a member’s system is one of the basic requirements of algorithmic trading risk management, it is sometimes neglected. Therefore, members should ensure that their systems are indeed tested.

3.1 . Introduction of Testing Criteria and Procedures

For the testing of algorithmic trading systems and programs, members should introduce criteria and procedures to define the purpose, methodology, and approval matrix. A testing manual or scenario should be drafted accordingly.

Members should establish criteria and procedures to test their algorithmic trading systems and programs to ensure their completeness, and a testing manual or scenario should be prepared to ensure that testing is effective and seamless.

3.2 . Types of Testing

Testing for algorithmic trading systems and programs involves quality testing, testing of regulatory requirements, and testing of risk management functions.

① Quality testing refers to validation of the quality of member’s systems and programs.

Quality testing is conducted to eliminate errors of the member's systems and programs for algorithmic trading and it consists of stress testing11), network testing12), and back testing13).

11) Stress testing is deliberately intense testing beyond normal operational capacity to determine the stability and operability of a given system and program.

12) Network testing checks the condition of network connections between the member's FEP and the Exchange, and between the member's FEP and the order management server. (e.g. restarting FEP’s process to reconnect and check if the order placement process is still running)

13) Back testing is a process of observing the output generated by the new system and programs with historical data input e.g) inputting various investment securities and prices in test scenarios such as bullish, bearish, and flat markets and checking if any abnormal orders are generated.

- 15 -

② Testing of regulatory requirements validates that the regulatory requirements are properly reflected in the member’s systems and programs.

Quotes submitted by member’s systems and programs for algorithmic trading should comply with applicable regulations, and the regulatory changes should be immediately reflected in the systems.

③ Testing of risk management functions validates that the checks are properly performed without any delay, relative to its order execution speed and also in accordance with the classification of risk limits14) defined by members.

To minimize losses from trade errors, members should test the member's systems' function that checks the risk limits in real time. Each member should define what "real-time" means, given the time lag between sending orders and receiving execution information and prove that the risk limit check is completed within the pre-defined time frame.

3.3 . Conducting and Managing Tests

① Member’s trading desks or IT departments should conduct tests based on the testing manual or scenario

All tests should be performed according to the applicable criteria and procedures. The testing manual and scenario should be used for efficient testing.

② Upon completion of the testing, risk department or compliance department should review and validate the quality and results of the testing. A head of an appropriate department should sign off on the records.

The requirement to obtain sign-off from the head of an appropriate department ensures that the tests are conducted adequately. Records of the testing can also be used for reference in future training.

14) Risk limit refers to an internal limit defined by the member at a client or account level and includes risk exposure limit and accumulated quotation quantity limit.

- 16 -

Chapter 4. Risk Management

In algorithmic trading, violation of applicable laws and regulations and lack of monitoring often leads to risks of trading incidents. It is, therefore, critical to prevent incidents by establishing a thorough risk management framework on the algorithmic trading and introduce procedures to validate and monitor the risks associated with algorithmic trading.

4.1 . Management of Algorithmic Trading

Members should have appropriate controls in place when conducting algorithmic trading, to prevent the system from generating and sending erroneous trading orders, causing market disorder and massive financial loss.

① Members should be able to identify and manage risks that may occur during algorithmic trading.

Algorithmic trading incidents can cause great market turmoil and heavy financial losses. It is, therefore, important for members to identify risks and implement preventive measures.

② When members open, change, or close derivatives accounts involving algorithmic trading, they should notify the Exchange without any delay.

(Applicable regulation: Article 156-3(2)15) of the Derivatives Market Business Regulation)

Reporting derivatives trading account information including account number and contact point to the Exchange prior to the initiation of the trading will help members identify and manage certain algorithmic trading which may cause errors and excessive quotation.

15) Article 156-3 (Management of Algorithmic Trading) (2) of the KRX Derivatives Market Business Regulation : In case of opening, changing the details, or closing of derivatives account carrying out algorithmic trading, the member shall notify such fact to the Exchange without delay.

- 17 -

4.2 . Routing Algorithmic Trading Orders Received from Clients through Security Device

Algorithmic trading orders placed by a client should go through the member's security device to prevent electronic intrusions such as hacking. The security device will protect the algorithmic trading system from potential risks such as an unauthorized attempt to access the system, forgery, and unauthorized deletion of information

① When members receive orders from their clients to conduct algorithmic trading through computer systems or other similar electronic means, the orders should be routed through the security device stipulated in the Guidelines on Connection to Member System.16)

(Applicable regulations: Article 82(2) of the Securities Market Business Regulation. Article 39(2) of the KOSDAQ Market Business Regulation, Article 57(2) of the KONEX Market Business Regulation, Article 118(2) of the Derivatives Market Business Regulation)17)

16) Article 9 (Requirements for Security Device) of the Korea Exchange’s Guideline on Connection to Member's Systems (1) Refers to an information protection system stipulated in the Article 82(2) of Securities Market Business Regulation, Article 39(2) of the KOSDAQ Market Business Regulation, Article 57(2) of the KONEX Market Business Regulation, Article 118(2) of the Derivatives Market Business Regulation, Article 104(2) of the KRX Gold Market Business Regulation and Article 15(1)1 of the Regulation on Supervision of Electronic Financial Activities. (2) Members should install the information protection system aforementioned in Para(1) separately from other electronic facilities and always operate the intrusion-proof function. (3) When members install the information protection system aforementioned in Para(1), they should comply with each subparagraph in the Article 15(2) of the Regulation on Supervision of Electronic Financial Activities of the Financial Supervisory Service.

17) Article 82 (Methods to Receive Orders) of the Korea Exchange’s Securities Market Business Regulation (2) When members receive trading orders from clients, the orders should go through the security device defined in the Article 8-2.(1) of the Guideline on Connection to Member's Systems, except when the process of receiving and transmitting orders does not harm the secure transactions as stipulated in the Enforcement Rules.

Article 39 (Method of Receiving Trade Entrustment) of the Korea Exchange’s KOSDAQ Market Business Regulation (2) In case of receiving an order placed via electronic communication means, the member shall ensure that the order is routed through the security device specified in the Guidelines for Connection to Member's Systems noted in Article 7-3(1) However, this provision shall not be applied to the case specified in the Enforcement Rules, as it is deemed that there is no concern about damaging the transaction safety in the course of receiving and processing the order.

Article 57 (Method of Receiving Trade Entrustment) of the Korea Exchange’s KONEX Market Business Regulation (2) In case of receiving an order placed via electronic communication means, the member shall ensure that the order is routed through the security device specified in the

- 18 -

To ensure that member’s systems are protected, orders placed by clients through electronic means must go through the security device of the member's systems.

② Members should obtain sign-off from the head of an appropriate department, on the registration, change, and deletion of security policies18) for the security device. The sign-off record should be maintained for at least one year.

The sign-off from the head of an appropriate department should be obtained for the member’s security policies that have been registered, changed, or deleted, to protect the member's systems from electronic intrusions by external parties such as unauthorized access prohibited by the member's security policy. The record can be used for investigation into an incident and should be retained for at least one year.

③ The member’s security device should log a source IP address, source PORT, destination IP address, and destination PORT when connecting to and disconnecting from the session of a client’s order management server.19) The logs should be retained for at least one year and should match the ones that are registered in the security device.

The requirement on the security log will help members fully observe the policy to send clients’orders through the security device. The requirement to maintain the logs for at least one year will facilitate investigations into order entry errors.

Guidelines on Connection to Member System noted in Article 9(1). However, this provision shall not be applied to the case specified in the Enforcement Rules, as it is deemed that there is no concern about damaging the transaction safety in the course of receiving and processing the order.

Article 118 (Methods of Receiving Entrustment of Orders) of the Derivatives Market Business Regulation. (2) When receiving an order entrustment via an electronic communication method, the member shall make sure that the order is routed through the security device specified in the guidelines related to connection to member derivatives system noted in Article 8-2(1). However, this provision shall not be applied to the cases where there is no concern about harming the transaction security in the course of receiving and processing the order, which are specified in the Enforcement Rules

18) Refers to a policy that allows only the IP address and PORT that are registered on the member’s security device to protect the member's system from an unauthorized access.

19) Session refers to a logical link between the member's FEP and client’s order management server, or a link between the member's FEP and the KRX that electronically sends and receives quotations and execution information.

- 19 -

4.3 . Management of Order Limits

Limits on the orders that are set beyond a member’s settlement capacity increase the risks of settlement failure and financial losses in the event of errors in trading. To minimize the risks, limits should be properly defined and managed based on the financial soundness and credit ratings of the members and their clients.

① Order limits by amount should be pre-defined and set on the member’s trading system before quotations are submitted to the Exchange.

To mitigate the risk of errors in trading caused by the failure to set order limits by amount, members should define a set of order amount limits on the trading system, such as risk exposure limits and maximum amount per order, before initiating the algorithmic trading. The order limits by amount can be managed by client or account and can be set as daily limits or per order limits.

② Members should define an order limit by quantity on the system before submitting quotations.

To mitigate the risk of submitting quotations in large quantity by a system that lacks a function to control the order limit, members should define a set of order limits by quantity on the trading system, such as accumulated quotation quantity limit and maximum quantity per order, before initiating the algorithmic trading. The order limit by quantity can be managed by client or account, and the limit can be set as daily limits or per order limits.

③ The established order limit should be regularly reviewed, based on the client’s credit rating for the client flows (net operating capital in case of the proprietary flows)

The credit ratings and financial soundness of clients or members may change over time. If their order limits are not regularly checked, it may

- 20 -

increase risks of settlement failures. Validating the defined order limit on a regular basis is, therefore, crucial.

④ Orders above the amount limit should be automatically rejected.

As algorithmic trading generates a large number of split quotations within a short time, manually cancelling the orders that hit the amount limit is impossible. Such orders should, therefore, be automatically rejected.

⑤ Orders above the quantity limit should be automatically rejected.

As algorithmic trading generates a large number of split quotations within a short time, manually cancelling the orders that hit the quantity limit is impossible. Such orders should, therefore, be automatically rejected.

⑥ Orders that hit the limit (including rejected orders) should be reported to the client (or trader in case of proprietary flows)

Clients (or traders in case of proprietary flows) should be aware of such orders to mitigate the risks of trading errors and be on alert for risk management.

⑦ Orders that hit the limit should be immediately alerted to the staff member in charge of the matter, and the staff member should take an appropriate action such as identifying the cause.

To prevent incidents and control risks, the staff member in charge of the matter should be alerted immediately to the limit breach and take appropriate action such as identifying the cause.

⑧ Orders must be checked against the limit. If the limit is breached, it should be recorded and retained for 10 years.

Order limits should be strictly managed in algorithmic trading to prevent trading incidents. They should, therefore, be prudently checked, and any

- 21 -

order that exceeds the limit should be recorded and retained for 10 years, pursuant to the KRX Business Regulation, which requires order records to be retained for 10 years.

4.4. Validation of Quotation

Members can control risks and prevent errors in trading by validating quotations before submitting them.

① Quotations should be validated, pursuant to applicable regulations. (Applicable regulations: Article 11-2(1) of the Securities Markets Business

Regulation, Article 9(7) of the KOSDAQ Market Business Regulation, Article 10(3) of the KONEX Market Business Regulation, and Article 65(2) of the Derivatives Market Business Regulation.20)

Upon submitting quotations, members should validate details of the quotations including quantity, pursuant to the KRX Business Regulations, thereby preventing errors in trading and ensuring fairness among investors in terms of order execution speed.

20) Article 11-2 (Member’s Obligation to Screen Quotation In Advance, etc.) of the Korea Exchange’s Securities Markets Business Regulation (1) Before transmitting the quotation to the Exchange system, the members shall ensure the appropriateness of quotation, etc. by individually verifying (including the case where the work has been entrusted to the third party pursuant to Article 42 of the Act) the matters specified in the Enforcement Rules.

Article 9 (Submission of Quotation) of the Korea Exchange’s KOSDAQ Markets Business Regulation (7) Before transmitting the quotation to the KOSDAQ system, the members shall ensure the appropriateness of quotation, etc. by individually checking (including the case where the work has been entrusted to the third party pursuant to Article 42 of the Act) the matters specified in the Enforcement Rules, and those quotations for which the appropriateness has been acknowledged shall be transmitted to the Exchange system without delay.

Article 10 (Submission of Quotation) of the Korea Exchange’s KONEX Market Business Regulation (3) Before transmitting the quotation to the KONEX system, the members shall ensure the appropriateness of quotation, etc. by individually checking (including the case where the work has been entrusted to the third party pursuant to Article 42 of the Act) the matters specified in the Enforcement Rules, and those quotations for which the appropriateness has been acknowledged shall be transmitted to the Exchange system without delay.

Article 65 (Quotation Details to be inputted and Input Method) of the Korea Exchange’s Derivatives Market Business Regulation (2) Before inputting the quotation details into Exchange derivatives system, the member shall in person (including the case where the task has been entrusted to the third party pursuant to Article of the Act) verify the matters stipulated in the Enforcement Rules, including the suitability of quotation.

- 22 -

② Orders whose quotations are determined as invalid in the validation process should be recorded, and the records should be retained for 10 years.

Failure to validate quotations for the sake of prompt execution increases the risks of erroneous orders. Members should, therefore, validate their quotations and record those that are considered invalid to make sure all quotations are validated, which will mitigate the risks of errors in trading.

4.5. Member System’s Functions to Validate Accumulated Quotation Quantity Limit and Risk Exposure Limit, Cancel Orders in Batch, and Request to Activate the Kill Switch

Member's systems should have functions that allow members to mitigate the risks of submitting misquotations in algorithm trading. It should also have functions by which the members can take immediate actions in the event of misquotations to minimize market impact and investors’ losses.

① The systems should be able to monitor each quotation to maintain it

within the accumulated quotation quantity limit and reject it when its limit is breached.

(Applicable regulation: Article 71 of Derivatives Market Business Regulation21)

Member's systems should be able to check accumulated quotation quantity limit by account, to control and mitigate the risk of submitting quotations in large quantity due to trading system errors.

② The system should be able to calculate risk exposures and reject submission of quotations that go over the risk exposure limit.

(Applicable regulation: Article 133(2) of Derivatives Market Business Regulation)22)

21) Article 71 (Quotation Quantity Limit) of the Korea Exchange’s Derivatives Market Business Regulation: The quotation quantity limit (referring to the maximum quantity allowed to quotation. The same hereinafter), accumulated quotation quantity limit (referring to the maximum of accumulated quotation quantity allowed to submit per derivatives account: the same hereinafter) and other matters concerning the quotation quantity shall be stipulated in the Enforcement Rules.

22) Article 133 (Application and Administration of Ex-post Customer Margin) of the Korea Exchange’s

- 23 -

Member's systems should be able to check the intra-day risk exposure limits to mitigate risks of settlement failures of qualified institutional investors.

③ Member's systems should be able to cancel all quotations at once upon the request of clients (or traders in case of proprietary trading)

(Applicable regulation: Article 117-3(2)7 of the Derivatives Market Business Regulation)23)

To mitigate the risks of trading errors, member's systems should be able to immediately respond to a client’s request to cancel all orders before the stage where the Exchange activates the Kill Switch is reached.

④ Members should familiarize themselves with relevant procedures and including system functions to immediately request the Exchange to cancel all outstanding quotations and block any additional quotations submitted via the algorithm trading account associated with system disruption or error.

(Applicable regulation: Article 156-3(3) of the Derivatives Market Business Regulation)24)

To minimize the consequences of errors in algorithmic trading caused by misquotations, members should familiarize themselves with relevant

Derivatives Market Business Regulation (2) The member shall establish the risk exposure limits that the client can hold during the session for each ex-post customer margin account (hereinafter referred to as the "risk exposure limit"). In this case, the risk exposure limit shall not exceed the amount that is five (5) times the total deposit amount (it may include the sales amount of substitute securities for which the settlement deadline has not come; the same hereinafter in this Article)

23) Article 117-3 (Order Entrustment via Electronic Communication Method) of the Enforcement Rules of the Korea Exchange’s Derivatives Market Business Regulation (2) In case where the member receives an order entrustment via electronic communication method, it shall be using the member derivatives system meeting all requirements noted in each of the following items. 7. In case where the client requests, the member may submit all cancellation quotations noted in such request en bloc

24) Article 156-3 (Management of Algorithmic Trading) of the Korea Exchange’s Derivatives Market Business Regulation (3) In case where in relation to the algorithmic trading, an emergency situation arises due to the system failure, error, etc., the member may request the Exchange to take the measure (hereinafter referred to as the "quotation handling per account") corresponding to each of the following items for each of algorithm account (referring to the derivatives account for which the opening, change and closing has been reported pursuant to Para.(2): the same hereinafter):

1. To cancel the quotations all at once; and 2. To reject the quotation submitted additionally (excluding the quotations for negotiated block

trading)

- 24 -

processes to immediately request the Exchange to activate the Kill Switch which will cancel all outstanding quotations and block additional quotations submitted via the algorithm trading account associated with the error.

4.6. Monitoring of Order Limits

As opposed to the trade orders placed by traders, algorithmic trading is automated by the system, which makes it difficult to instantly catch errors in trading. Members should, therefore, have a process in place that allows them to monitor the trades and immediately respond to any errors.

① Member's systems should be able to automatically monitor the order limit, and the staff member responsible for monitoring the limit should always manage and monitor the order limit.

To manage the algorithmic trading system that automatically generates orders, members should exercise stringent preventive measures including monitoring the limit through their systems to catch erroneous orders before they are submitted.

② Orders that hit the limit should automatically create an alarm on the system such as a pop-up message to alert the staff member in charge of monitoring the trade.

The staff member tasked with the monitoring duty should be alerted to orders that hit the limit through an alarm such as a pop-up message and take immediate action to address the risks.

- 25 -

4.7. Restriction of Access to Member's Systems

Member’s systems should be accessible only by those responsible for related tasks such as traders and IT personnel, and they each should have their own ID25) and password. Registration, change, and deletion of the ID and password should be strictly managed, and the screen saver with a security feature should be implemented in the member's systems.

As algorithmic trading is conducted through an automated system, unauthorized access to the member's systems may expose the systems to the risks of errors and incidents. To prevent them, only those authorized personnel in charge of the matter should be able to access the member's systems.

25) User ID is a combination of alphabetical and numeric characters which authenticate the user’s identification.

- 26 -

Chapter 5. Initiating Algorithmic Trading, Responding to Incidents, and Validation After the Incidents

Algorithmic trades are prone to errors at the execution stage if not managed properly by the member through an appropriate process. Establishing a risk management framework which enables the member to validate the system and program upon their initiation, respond to incidents to minimize the loss, and exercise internal controls for regular checkups is, therefore, crucial.

5.1. Requirements Upon Initiating Algorithmic Trading Systems After Development and Change

Members should establish and implement procedures to continue to validate the algorithmic trading for a certain period of time after the initiation of the systems and programs, to make sure that they are properly working in the real trading environment, even after they were successfully validated in the testing environment before they go live.

① Once the algorithmic trading systems and programs are initiated, quotations should be kept at a minimum for a certain period of time to prevent errors in trading in large quantity.

Once the member's algorithmic trading systems and programs go live, unexpected situations might arise during the initial period of operation before the stability of the systems and programs is ensured, which may lead to significant errors in trading. Therefore, during the initial period of operation including the first day in the market, quotations should be kept at a minimum to prevent significant losses even if any error may occur while the system and programs are being validated.

- 27 -

② Both developers and traders should monitor quotations being submitted and orders executed in the market in real time during the initial period of operation of the algorithmic trading systems and programs, including the first day in the market.

Unexpected errors may occur during the initial period of running the systems and programs in the market. Both developers and traders should, therefore, monitor the quotations being submitted and trades being executed in real time during the initial period including the first day in the market and respond together to the unexpected errors without delay.

③ The head of an appropriate department should sign off on the records of the real-time monitoring.

The requirement to obtain sign-off from a supervisor ensures that the monitoring is conducted adequately. Records of monitoring can also be used for reference in future monitoring and training.

5.2. Preparation for Algorithmic Trading Incidents or Errors

Recovery will be delayed if the member does not have a process to respond to trading incidents or errors, in turn triggering further complications. The member should put in place a process to contain additional damage.

① To contain any additional damage of incidents or errors, each member should draft a scenario-based manual that specifies actions for each scenario.

Members should draft a manual for algorithmic trading incidents and errors. Staff members in charge of this matter should fully understand the manual so that they can immediately respond to incidents and errors and minimize any additional damage.

- 28 -

② Members should give training on prevention of algorithmic trading errors, risk mitigation, and effective response to incidents and errors. Staff members involved with algorithmic trading should undergo the training on the relevant regulations and incident response procedures at least once a year.

Some members are negligent in conducting training on algorithmic trading. It is important to note that training on algorithmic trading is the first step towards risk management and that it raises awareness among employees. Training should, therefore, be conducted regularly.

③ Employees involved with algorithmic trading should keep abreast of all applicable laws, regulations, and procedures to be well-prepared for algorithmic trading incidents and errors and effectively respond to them.

Employees of members should fully understand the regulatory requirements and procedures on algorithmic trading to prevent incidents or errors and minimize additional damage or disputes with clients. (e.g. employees’ failure to properly respond to clients in the event of errors in trading due to lack of understanding of the program to identify causes and correct the erroneous orders.)

5.3. Checking Member’s Systems for Algorithmic Trading

A member’s algorithmic trading system which is not regularly updated to reflect regulatory changes and checked for errors poses very high risks of incidents. The system should, therefore, be regularly checked to mitigate the risks.

① Member's systems associated with algorithmic trading should be checked for potential incidents or errors and vulnerabilities on a regular basis (at least once a year).

Checking the member’s systems associated with algorithmic trading is critical for risk management. The system going unchecked increases risks

- 29 -

of incidents. To prevent errors in trading, the system should be checked on an ad-hoc or regular basis (at least once a year).

② Results of the checks on the member’s algorithmic trading system should be recorded and retained for 5 years.

Pursuant to Article 60(1) (Keeping and Maintaining Records) of the Capital Market and Financial Investment Business Act and Article 62(1)4a of its Enforcement Decree, records on compliance matters such as internal controls and risk management should be retained for 5 years. In compliance with the requirement, records of checking a member’s algorithmic trading system should be retained for 5 years, and they can be used for the maintenance of the system and reference for incident prevention.

- 30 -

Chapter 6. FEP Controls by Members

The FEP (Front End Processor) should be managed and controlled by members. Allowing their clients to manage the FEP and processing client’s trade orders preferentially via separate systems or facilities, (e.g. letting the client’s trade orders bypass the security device of the member's systems, or installing the client’s order management program on the member’s FEP) is extremely risky and prohibited by applicable laws and regulations. In such cases, members cannot control certain risks associated with quotation validation and margin calculations, significantly increasing the likelihood of errors in trading. Members should manage and control the FEP directly to prevent algorithmic trading errors and control risks.

6.1. FEP Management and Operations by Members

Allowing clients to manage and operate the FEP, one of the member's systems, is prohibited by law. If members allow their clients to manage the FEP, they cannot control the FEP, increasing the risks of algorithmic trading incidents. Members should, therefore, manage and control the FEP to prevent such incidents.

① Members themselves should manage and operate the FEP and a senior manager in charge of the FEP should validate it and record the results of the annual validation and keep the records for three years. The only exception is a case where the FEP is managed and operated by a third-party with instructions from the member, pursuant to Article 42 of Capital Market and Financial Investment Business Act 26), based on

26) Article 42 (Entrustment of Affairs of Financial Investment Business Entity) of the Capital Market and Financial Investment Business Act (1) A financial investment business entity may entrust a third party with part of the affairs that the financial investment business entity carries on in relation to the business under each subparagraph of Article 40 and the incidental business under Article 41 (1): Provided, That the affairs specified by Presidential Decree as those that are likely to otherwise undermine the protection of investors or sound order in trading shall not be entrusted to a third

- 31 -

Article 13 (System Management) of the Guidelines on Connection to Member System. In such case, the system is considered managed and operated by the member, on the condition that the member complies with 6.2 through 6.9.27) An outsourcing contract should be signed with the third-party who is commissioned to manage and operate the FEP ("operator"). The contract should cover the scope of responsibilities, restricted activities of the operator, and the requirement to keep records of its duties performed. The operator should be responsible for managing and operating the system based on the member’s instructions and recording the duties performed.

In case the member outsources the management and operation of the FEP to a third-party (excluding clients), the member should be able to directly control the FEP. The third-party who is commissioned to manage and operate the FEP should follow the instructions and obtain necessary approvals from the member (e.g. a relevant department head of the member) in performing its duties (e.g. developing and changing programs).

② Members should physically restrict clients (investors) from managing and

operating the FEP and prohibit client’s trade orders from being processed preferentially via separate systems or facilities, (e.g. letting the client’s trade orders bypass the security device of the member's systems, or installing the client’s order management program on the member’s FEP). When an outsourcing contract is signed with an operator, pursuant to

party. (2) Any financial investment business entity that entrusts a third party with any of its affairs in accordance with the main sentence of paragraph (1) shall make an entrustment agreement that includes the following terms and conditions, and such agreement shall be reported to the Financial Services Commission in compliance with the method and procedure prescribed by Presidential Decree:

1. Scope of affairs entrusted; 2. Restrictions on the trustee’s activities; 3. Terms and conditions for maintaining records on entrusted affairs; and 4. Other matters specified by Presidential Decree as those necessary for the protection of investors

or sound order in trading (The rest is omitted)27) In case multiple members commission Koscom to manage and operate the FEP, the members'

compliance with 6-2, 6-3, 6-8,and 6-9(3) should be verified by the members’ instructions to Koscom on the FEP’s management and operation and Koscom’s performance of duties.

- 32 -

Paragraph (1), these requirements should be specified in the contract so that the operator meets them.

Processing client’s trade orders preferentially via separate systems or facilities (e.g. letting the client’s trade orders bypass the security device of the member's systems, or installing the client’s order management program on the member’s FEP) may lead to erroneous orders because quotations and margin calculations may not be validated. This is also unfair to investors who do not benefit from the special processing and is prohibited by law.

6.2. Access to FEP Server by Members

Members should be able to access the system to manage and monitor the FEP, and they should know the user ID and password of the FEP server and Operating System (OS)28). The user ID should be used only by authorized personnel (excluding clients), and the password should be regularly changed.

① Members should be able to access the FEP on-site or remotely

Members should be allowed to access the FEP directly or remotely (e.g. SSH)29) for risk management. Only when the FEP control and management duty is outsourced to an operator, the operator is permitted to access the FEP server under the member’s supervision.

② Members should know the user ID and password of the FEP operator and properly manage them.

Members should be able to access the system to manage and monitor the FEP. They should also properly manage their ID and password and change them regularly to prevent unauthorized access to the system.

28) Operating System refers to a program that allows users to use the computers by controlling the computers’ hardware and software

29) Short for Secure Shell, SSH, refers to a client-server program that allows users to control applications of a computer at a remote site and receive output via a local computer.

- 33 -

6.3. Turning On and Off of FEP Process30) by Members

Members should be able to directly turn on and off the FEP process which communicates with the Exchange’s server, each member’s order management’s server, and each client’s server when an abnormal event occurs in the FEP process (e.g. duplicated orders in large quantity, abnormal error codes etc.)

① Members should be able to directly turn on and off the process of sending orders and receiving executions via the FEP, which is connected to the Exchange’s server.

Members should be able to directly turn on or off the FEP process connected to the Exchange’s server when an abnormal event occurs.

② Members should be able to directly turn on and off the process of receiving orders and sending executions via the FEP, which is connected to each member’s order management server or a client’s server.

Members should be able to directly turn on or off the FEP process connected to the Exchange’s server, when an abnormal event occurs.

6.4. Member’s Monitoring of the FEP Process

Members should keep monitoring the FEP process at all times and take appropriate actions when an abnormal event occurs (e.g. terminated session, redundant data in large quantity, abnormal error codes etc.) in each PORT31) that connects the Exchange, members’ internal systems and clients and identify number of orders and executions.

30) Process refers to a program in the server, which connects a member’s FEP and the Exchange, or a member’s FEP and the order management server.

31) PORT refers to a service number of a logical link that physically connects the member’s FEP and the order management server or the member’s FEP and the Exchange.

- 34 -

① Members should keep track of the number of order PORTs that link the Exchange and the members’ FEP, and the number of orders sent by each order PORT, and executions received by each execution PORT.

Members should provide the same data, facilities, and services including speed for all clients. They should also make sure that the system has enough capacity to handle frequent orders for correction and cancellation. Members should keep monitoring the FEP process at all times to check the number of orders and executions that go through each PORT connecting the Exchange and members and take necessary actions when an abnormal situation occurs (e.g. terminated session, redundant data in large quantity, abnormal error codes etc.)

② Members should keep track of the number of orders and executions transmitted by each PORT that links the member’s FEP and the member’s or the client’s order management server.

Members should monitor the FEP process at all times to keep track of the number of transmitted and executed orders in each PORT that links with the member’s or the client’s order management server. When an abnormal event occurs (e.g. terminated session, redundant data in large quantity, abnormal error codes etc.), members should inform the clients of the event and take appropriate actions.

6.5. Digital Certificate for Authentication32) and License for Encryption Module

Orders and executions transmitted between the Exchange and the member’s FEP are encrypted. The encryption requires a digital certificate for the members’ authentication and the license. Therefore, members should know the relevant information.

32) Digital certificate for authentication refers to the certificate required for using Internet banking. It is needed for authentication upon logging on to the KRX system.

- 35 -

① Members should know the digital certificate’s location in the FEP server, in relation to the encryption module.

Orders and executions transmitted between the Exchange and the member’s FEP are encrypted. The encryption requires a digital certificate for the members’ authentication and the certificate is located in the FEP server. A digital certificate refers to a server certificate issued by authentication authorities and the certificate’s location in the FEP server should be set on the encryption module.

② Members should know the FEP server’s IP address registered in the license33) file.

Orders and executions transmitted between the Exchange and the member’s FEP are encrypted. The encryption module can be used only when the IP address registered in the license file matches the one in the FEP server. Therefore, the member should know the details of the registered IP address.

6.6. Verification of Number of Daily Order, Executions and RTT (Round Trip Time)34)

Members should verify the number of orders sent and executions received via the FEP on certain dates, the duration of each leg, and the volume and usage status to identify orders that took longer than usual and the causes of the delay.

① Members should be able to submit the number of orders delivered and executions received from the FEP on a certain date upon request.

33) A license-issuing organization issues the license required for using the encryption module along with the FEP server’s IP address to be delivered to the member. The digital certificate and license are located in the member’s FEP server and the member should know the exact location.

34) RTT (Round Trip Time) refers to a period of time, from when the point client’s order is received and transmitted to the Exchange and its matching engine, to the point the generated confirmation is delivered back to the client. Each trip is timed, and the round trip time shows how quickly the client’s order was delivered to the Exchange.

- 36 -

To prepare for any potential disputes with and complaints from the clients, members should be able to submit the number of orders delivered and executions received from the FEP on a certain date, through which usage status of the FEP, including its records can be verified.

② Members should keep track of the duration of each leg of the process from order receipt, transmission to the exchange, to the order confirmation and delivery back to the clients.

Members should be able to check the duration of each leg of the FEP process on a certain date, to provide the latency information and identify a log that experienced a delay.

6.7. Keeping Logs of Orders and Executions Transmitted35) and Submission of the Logs

Members should record information on orders and executions transmitted between the Exchange, the order management server, and the client via the FEP to prepare for any potential disputes with and complaints from the clients.

① Members should keep the order and execution logs transmitted via the FEP for 10 years.

The Exchange Business Regulation stipulates that received or recorded quotations should be logged in an auxiliary memory device such as a magnetic tape and magnetic disk and stored on it for 10 years from the date of registration or logging. In accordance with the requirement, members should keep the records of orders and executions transmitted between the Exchange, the order management server, and the client via the FEP to prepare for any potential disputes with and complaints from the clients and to respond to trading incidents.

35) Orders and executions transmitted refers to all order details transmitted between the member’s FEP, the Exchange, and the client. The data log should be kept while it is readable before the encryption.

- 37 -

② Members should be able to submit the log data for orders and executions transmitted via the FEP upon request.

Members should keep the data of orders and executions transmitted between the Exchange, the order management server, and the client via the FEP to submit it without delay in case of disputes with or complaints from the clients.

6.8. Identification of Superuser (root) ID36) and Password in the FEP server.

Members should clearly understand and manage the authorities as an administrator of the FEP server. They should know the server's basic information such as the Superuser ID and password and monitor them at all times.

① Members should know the superuser ID and password in the FEP server.

If the operator who manages and controls the FEP restricts the member’s access to the FEP due to a concern over the leakage of information on the algorithmic trading source codes37) and system configuration, the risks of incidents due to lack of risk controls by the members will significantly increase. Members should, therefore, know and properly manage the superuser ID and password to have complete control over the FEP server including rebooting and OS patch installation.

② Members should know the OS version38) of the FEP server.

Members should know and properly maintain the type of OS version, and specifications of the hardware in the FEP server.

36) Superuser ID refers to an ID with the highest authorities controlled by the system administrator, and the superuser ID can be used to disable processes of other accounts. A superuser’s password is commonly managed by the FEP server’s administrator, instead of the FEP operator.

37) Source codes refer to the logic of algorithmic trading in computer programming languages. Once the complete source codes are converted into machine languages that the computers can understand, then the software that can be implemented is created. The source codes include all relevant information on the structures and logics of related products.

38) OS version refers to a series of development stages and orders marked with a number.

- 38 -

③ Members should know all patch numbers39) of the FEP server’s OS.

Members should be able to apply patches40) in the event of urgent and important issues related to the OS and system utilities and know the latest version.

6.9. FEP Program41) Maintenance42)

The FEP program should be updated and maintained to upgrade the FEP’s performance, improve order delivery process, reflect policy changes, and respond to the emergency. Therefore, members should understand the maintenance procedures for its program and comply with them.

① For the maintenance of the FEP program developed by the members themselves or by external vendors, members should clearly understand relevant procedures and methodologies to change the program and records of the changes made, regardless of who performs the maintenance duties.

Members may develop and maintain programs to prevent incidents and manage risks or outsource the duty. In either case, members should understand relevant procedures and methodologies to change the program, and records of the changes should be made on a regular basis or when the need arises. They should also conduct a test on even minor changes made to the program to prevent any possible errors of the operating server.

39) Patch number refers to a series of numbers and versions to keep track of patch installations (improvements)

40) Patches refer to a process of updating the OS and software, identifying and resolving issues (errors), and applying the resolution.

41) A FEP program refers to a server program or application program created for certain functions in the server. It connects external organizations with order management servers, and it is classified by function such as data division.

42) The program’s maintenance requires the member’s FEP program to transmit the order data between the Exchange, the member FEP, and the order management server. For maintenance, members should be fully aware of the change procedures regardless of whether the FEP was developed by the member or an external vendor. Even if developed by a vendor, each member should fully understand the maintenance procedures.

- 39 -

② If the FEP programs are developed and maintained by external vendors, members should prepare and sign a maintenance contract that requires the external vendors to make a change to the program in accordance with the contractual requirements (request -> test -> verification). When the change applies to the operating server, they should comply with the internal approval procedures.

By signing a maintenance contract with an external vendor and changing the program accordingly, members can make sure that the FEP program’s maintenance can be performed in a timely manner, which will help them prevent incidents and mitigate risks.

③ Even when the FEP program is managed and operated by an external party, the operator should be able to change or improve the program when the members determine that it is necessary to do so. Members should also be able to directly respond to an emergency.

When the FEP program is managed and operated by an external party with the members’ instructions, members may fail to control the operation of the external party and thus quickly respond to incidents. To prevent such case, members should have an emergency call tree in place with the operator to supervise and manage the operator at all times and request them to immediately respond to an emergency. They should also fully understand countermeasures to tackle an emergency such as errors in trading, including suspending an account involved in the incident. By doing so, they can minimize the loss from the incident.

- 40 -

Category Check Items (Y/N) RemarksProp

Introduction and Implementation

of Procedures to Install the

Algorithmic Systems and

Develop and Change the

Programs

Do you have procedures in place to define the purpose, components,

methodology, and internal approval process for the installation of the

algorithmic trading system on the member's system?

Do you have procedures in place to define the purpose, components,

methodology, and internal approval process for the development of the

algorithmic trading system’s programs?

Do you have procedures in place to define the purpose, components,

methodology, and internal approval process for the change of the

algorithmic trading system’s programs?

Ensuring Completeness of

Algorithmic Trading Programs

and Logic

Do the trading desks write scenarios to identify errors in the algorithmic

trading program’s logic and design for the proprietary flows?

Do the staff members of the department responsible for the

algorithmic trading conduct tests to identify errors of the algorithmic

trading program’s logic and design for the proprietary flows?

Does the head of an appropriate department sign off on the test results?

Category Check Items(Y/N)

RemarksProp Client

Deployment of Functions in

the Member’s System to

Prevent a Misquotation in

Algorithmic Trading

Do the member's systems have a function that detects a mistyped quote

to prevent erroneous trades?

Category Check Items(Y/N)

RemarksProp

System and Program Architect’s

Understanding of Related

Regulations

Do compliance departments provide training on applicable regulatory

requirements for algorithmic system and program architects when

regulation changes or a new architect joins the firm?

Do algorithmic trading and program architects clearly understand the

regulatory requirements that are included in the compliance trading?

Does the head of an appropriate department sign off on the records of

the architect training?

Ⅳ. Checklist

<Mark ‘Y’ for yes, ‘N’ for no and ‘N/A’ for not applicable. >

□ Designing Member's Systems

- 41 -

Category Check Items (Y/N) RemarksProp

Traders’ Understanding of

Algorithmic Trading System's

Operations and Program Logic

Do the algorithmic system and program architects train traders on the

operations of the trading system and program logic when the need arises?

Do the traders fully understand the algorithmic trading system’s operations

and program logic?

Does the head of an appropriate department sign off on the records of

the trader training?

Category Check Items(Y/N)

RemarksProp Client

Introduction of Testing

Criteria and Procedures

Did you introduce criteria and procedures to define the purpose,

methodology, and approval matrix for the testing of algorithmic

trading systems and programs?

Do you draft a testing manual or scenario to conduct tests in

accordance with the criteria and procedures established to define the

purpose, methodology, and approval matrix?

Types of Testing Do you conduct quality testing? (Testing for the member's systems

and programs may involve stress testing, network testing, and back

testing etc.)

Are the regulatory requirements tested to validate that the regulatory

requirements are properly reflected in the member’s systems and

programs?

Do you conduct tests on risk management functions?

Conducting and Managing

Tests

Do your trading desks or IT departments conduct tests based on the

testing manual or scenario?

Does a department that conducts the test have the quality and results

of the testing reviewed and validated by the risk management

department or compliance department?

Does a department that conducts the test obtain sign-off from the

head of an appropriate department on the result upon its completion?

□ Testing Member's Systems

- 42 -

Category Check Items(Y/N)

RemarksProp Client

Management of Algorithmic

Trading

Do you identify and manage risks that may occur during the

algorithmic trading?

When you open, change, or close derivative accounts involving

algorithmic trades, do you notify the KRX with any delay?

Category Check Items (Y/N) RemarksClient

Routing Algorithmic Trading

Orders Received from Clients

through Security Device

When you receive orders from your clients to conduct algorithmic

trading through computer systems or other similar electronic means,

do you route the orders through the security device stipulated in the

Guidelines on Connection to Member System?

Do you obtain sign-off from the head of an appropriate department

on the registration, change, and deletion of security policies for the

security device?

Do you keep the records of the registration, change, and deletion of

security policies for the security device for at least one year?

Does your security device record the IP address, source PORT,

destination IP address, and destination PORT in relation to connecting

to and disconnecting from the server of client’s order management

system? Are the records retained for at least one year, and does the

information match the records registered in the security device?

Category Check Items(Y/N)

RemarksProp Client

Management of Order Limits Is the order limit by amount predefined and set on the member’s

trading system before quotations are submitted to the Exchange?

Do you define an order limit by quantity on the system before

submitting quotations?

Do you review established order limits regularly based on the client’s

credit rating for the client flows (net operating capital in case of the

proprietary flows)?

Are the orders that go above the amount limit automatically rejected?

Are the orders that go above the quantity limit automatically

rejected?

□ Risk Management

- 43 -

Category Check Items(Y/N)

RemarksProp Client

Management of Order Limits Are the orders that hit the limit (including rejected orders) reported to

the client (or trader in case of proprietary flows)?

Are the orders that hit the limit immediately alerted to the staff member

who is in charge of the matter, and does the staff member take an

appropriate action?

Does the staff member in charge of the matter check the order limit

and retain the records of the event for 10 years?

Validation of Quotation Are the quotations validated pursuance to applicable regulations?

Are the orders whose quotations are determined as invalid in the validation

process recorded? And is the record retained for 10 years?

Member System’s Functions

to Validate Accumulated

Quotation Quantity Limit

and Risk Exposure Limit,

Cancel Orders in Batch and

Request to Activate the Kill

Switch

Can the system monitor each quotation to maintain it within the accumulated

quantity limit and reject it when its limit is breached?

Can the system calculate risk exposures and reject submission of quotations

that go over the risk exposure limit?

Can the member's systems cancel all of outstanding quotations at once

upon the request of clients (or traders in case of proprietary trading)?

Are you familiar with relevant procedures including system functions

to immediately request the Exchange to cancel all outstanding quotations

and block any additional quotations submitted via the algorithm trading

account associated with the system disruption or error?

Monitoring of Order Limits Can the member's systems automatically monitor the order limit, and

does the staff member tasked with the monitoring duty always manage

and monitor the order limit?

Do the orders that hit the limit automatically create an alarm on the

system such as a pop-up message to alert the staff member in charge

of the duty to monitor the trade?

Restriction of Access to

Member's SystemDo the appropriate staff members have their own IDs and passwords

to the member's systems?

Is the registration, change, and deletion of the ID and password strictly

managed?

Do the member's systems have a screen saver with a security feature

that allows only authorized staff members (traders and IT personnel)

to access the system?

- 44 -

Category Check Items(Y/N)

RemarksProp

Requirements upon initiating

algorithmic trading system

after development and

change

Once the trading systems go live in the market, are the quotations

kept at a minimum for a certain period of time to prevent a large

quantity of errors in trading?

Do both the developers and traders monitor quotations being submitted

and orders executed in the market in real time during the initial period

of operation of the algorithmic trading system and programs, including

the first day in the market?

Does the head of an appropriate department sign off on the records of

the real-time monitoring?

Category Check Items (Y/N) RemarksProp Client

Preparation for Algorithmic

Trading Incidents or Errors

To contain any additional damage of incidents or errors, did you draft

a scenario-based manual that specifies actions for each scenario?

Do you conduct training on prevention of algorithmic trading errors,

risk mitigation, and effective response to incidents and errors that

occurred? Do you train the staff members involved with algorithmic

trading at least once a year?

Do employees involved with algorithmic trading keep abreast of all

applicable laws, regulations and procedures to be well-prepared for

algorithmic trading incidents and errors and effectively respond to them?

Checking Member’s Systems

for Algorithmic Trading

Are the member's systems associated with algorithmic trading checked

for potential incidents or errors and vulnerability on a regular basis (at

least once a year)?

Are the results of the checks on the member’s algorithmic trading

systems recorded and retained for 5 years?

□ Initiating Algorithmic Trading, Responding to Incidents and Validation After the Incidents

- 45 -

Category Check Items(Y/N)

RemarksProp Client

FEP Management and

Operations by Members

Do you manage and operate the FEP yourself, and does a senior

manager in charge of the FEP validate it and record the result of the

annual validation and retain it for 3 years? (except in a case where

the FEP is managed and operated by a third-party with instructions

from the member, pursuant to the Article 13 of the Guidelines on

Connection to Member System) Even when you outsourced the management and operation of the FEP to a

third party pursuant to the Article 13 (Management of System) of the Guidelines

on Connection to Member System, do you comply with 6.2 through 6.9?Is an outsourcing contract signed with a third-party who is commissioned

to manage and operate the FEP ("operator") and does the contract cover

the scope of responsibilities, restricted activities of the operator, and the

requirement to retain records of its duties performed? Is the operator required to manage and operate the system, based on

your instructions and record the duties performed?

Check Items (Y/N) RemarksClient

Do you prohibit clients (investors) from managing and operating the FEP?

Do you prohibit any clients’ trade orders from being processed preferentially

via separate systems or facilities (e.g. letting a client’s trade order bypass

the security device of the member's systems, or installing a client’s order

management program on the your FEP)? When an outsourcing contract is signed with an operator, do you

include requirements in the contract, such as physically restricting

clients (investors) from managing and operating the FEP and prohibiting

client’s trade orders from being processed preferentially via separate

systems or facilities?

Category Check Items(Y/N)

RemarksProp Client

Access to FEP Server by

Members Can you access the FEP on-site or remotely? Do you know the ID and password of the FEP operator and properly

manage them?Turning On and Off of FEP

Process by Members

Can you directly turn on and off the FEP process of sending orders and

receiving executions via the FEP, which is connected to the Exchange’s server?

Can you directly turn on and off the process of sending orders and

receiving executions via the FEP, which is connected to your order

management server or a client’s server?

□ FEP Control by Members

- 46 -

Category Check Items(Y/N)

RemarksProp Client

Member’s Monitoring of the

FEP Process

Do you keep track of the number of order PORTs that links the Exchange

and your FEP, the number of orders transmitted by each order PORT,

and the number of executions received by each execution PORT?

Do you keep track of the number of orders and executions by each PORT

that links your FEP and your or the client’s order management server?

Digital Certificate for

Authentication and License

for Encryption Module

Do you know the digital certificate’s location in the FEP server, in

relation to the encryption module?

Do you know the FEP server’s IP address which is registered in the license?

Verification of Number of

Daily Order, Executions and

RTT (Round Trip Time)

Can you submit the number of orders delivered and executions received

from the FEP on a certain date upon request?

Do you keep track of the duration of each leg of the process from

order receipt, transmission to the exchange, to the order confirmation

and delivery to the clients?

Keeping Logs of Orders and

Executions Transmitted and

Submission of the Logs

Do you keep the logs of the order execution transmitted via the FEP

for 10 years?Can you submit the log data for orders and executions transmitted via

the FEP upon request?

Identification of Superuser

(root) ID and Password in

the FEP server

Do you know the superuser ID and password in the FEP server?

Do you know the OS version of the FEP server?

Do you know all the patch numbers of the FEP server’s OS

FEP Program Maintenance For maintenance of the FEP program developed by you or by external

vendors, do you clearly understand relevant procedures and

methodologies to change the program and records of the changes

made, regardless of who performs the maintenance duties?

If the FEP programs are developed and maintained by external

vendors, do you prepare and sign a maintenance contract, make a

change to the program in accordance with the contractual requirements

(request -> test -> verification), and comply with the internal approval

procedures when the change applies to the operating server?

Even when the FEP program is managed and operated by an external

party, can the operator change or improve the program if you

determine that it is necessary to do so?

Even when the FEP program is managed and operated by an external

party, can you directly respond to an emergency?