Operational resilience of trading venues

Many venues had established committee structures to help the board oversee resilience risks, incidents and remediation. However, some had limited evidence that their boards had reviewed, challenged or approved resilience activities and remediation plans. Venues should define and document their escalation procedures, so that senior management and staff understand them and can raise significant issues quickly and consistently.

When a venue is part of a wider group of firms, the UK regulated entity is responsible for the resilience of its UK activities. This still applies when the venue uses group engineering, security or operational teams. Some venues had not clearly defined this responsibility; they can demonstrate it by having:

• Defined roles and individual responsibilities.
• Documented governance arrangements.
• Clear service level agreements.
• Reporting that allows senior managers to oversee the resilience of group dependencies and challenge weaknesses or decisions where necessary.

Several venues relied on frontline teams to identify, assess and test resilience risks. While these teams often had the best understanding of business services and processes, venues did not always provide sufficient independent challenge and assurance over these resilience risks. In some cases, venues lacked the expertise or oversight frameworks needed to do this effectively.

Many venues used management information, including key risk indicators and regular risk reporting. The most mature venues used it for an end-to-end view of important business services and their dependencies. They used dashboards to identify issues and the impact they could have across systems, processes and third parties. This helped them understand their resilience risks and make more effective decisions, during business-as-usual operations as well as incidents.

Trading venues generally understood their core services, but some did not have a complete view of the people and technology that deliver them, including third parties. Their mapping sometimes failed to consider wider group dependencies – so the venues could not fully understand how disruption elsewhere in the group could affect the UK regulated entity’s important business services.

Some venues did not know the dependencies between third parties supporting important business services, and had a limited understanding of their concentration risk. This made it hard to assess how a third-party failure could affect services across the business. Our Operational resilience: insights and observations[4] publication explains how venues can identify and document these dependencies and strengthen their oversight. Venues should judge their remediation by how it improves resilience, rather than simply whether they have completed the exercise.

While third-party contractual arrangements were generally in place, venues’ due diligence, contractual standards and exit plans were not always suited to the importance of the service.  

Some venues only assessed their suppliers’ resilience after issues arose, and only had limited monitoring of resilience risks. Material third-party providers were not always included in resilience testing. This meant venues could not always spot weaknesses before they affected important business services and could not be confident about recovering services end-to-end.

Venues often only had high-level exit strategies for third-party providers, with limited evidence of how they would maintain or restore important business services without them. Exit strategies should include documented plans for:

• Moving to another provider.
• Bringing services in-house.
• Identifying key dependencies.
• Assessing the resources and time the venue would need to support an orderly transition.

Trading venues should consider whether they can implement their exit strategy effectively during an incident. Relying solely on contractual provisions does not give venues full assurance that they could recover from a disruption.

Venues had set impact tolerances and metrics for their important business services. More developed approaches had clearer rationales and considered potential harm to clients and markets more fully. Venues usually thought about market integrity, but they did not always see operational incidents as a distinct potential source of intolerable market harm.

Most venues had worked on how to limit the impact of a disruption and which aspects of important business services they should prioritise for recovery. However, they did not always link this to their impact tolerances, or have clear information for staff about how the recovery would work in practice. Venues should make sure their proposed recovery measures are clearly justified by the intended outcomes, and have evidence that they would limit intolerable harm.

Most venues regularly tested their business continuity and disaster recovery plans. Some used a wider range of severe-but-plausible scenarios, including third-party failure and physical events such as power or utility disruption. This helped them to assess whether services could remain within their impact tolerances and refine their plans.

Venues did not always test whether they could recover services as part of their change activities. They focused on whether a change had been implemented successfully, rather than what would happen if it caused disruption. In some cases, they only had limited evidence that they had tested dependencies or validated their rollback plans.

Some venues relied heavily on predefined severity ratings and escalation thresholds to assess incidents. These can help them take a consistent approach, but all venues should also consider the wider impact on important business services, market participants and recovery objectives. Effective approaches combine thresholds with management’s judgement. This helps venues respond proportionately and focus on how to minimise disruption.

Some venues relied on informal processes to escalate issues, such as staff group chats, without keeping governance records. These can be useful ways to convene decision-makers and address urgent actions, but venues must record the decision-making process properly. They should have formal processes for detecting and escalating incidents so that decisions and actions are documented and auditable, including ‘lessons learned’ reviews.

Venues investigated root causes and had controls to capture the information they needed to review incidents. They also tested fixes before restarting systems. However, it was not always clear from venues’ risk frameworks how lessons from incidents informed their remediation practices.

In our consultation CP26/30 on Equity Market Transparency and market structure developments[5], we proposed clearer expectations for how trading venues prepare for and manage disruption. These include communications with market participants and arrangements to support orderly trading.