Nicola Tavendale
Nicola Tavendale

Mitigating threats – new tools and strategies for managing risk in retail FX brokerage

Once viewed as only an institutional concern, the rising prominence of risk management in retail FX highlights the seismic changes taking place in the market as a whole. But how can brokers and technology providers tailor their solutions to the specific needs and unique demands of this sector? Nicola Tavendale writes.

First Published: e-Forex Magazine 74 / FX Brokerage Operations / January, 2017

Unprecedented market events, cyber-crime, operational failures and client fraud are not new challenges for the FX market, but as 2016 has effectively served to demonstrate they can pose a very real and dramatic threat to the unprepared. “You could say ‘risk management’ to most FX brokers or banks and they will immediately think of the positions they are building-up, if they are too high or if there is a risk of clients not being able to pay their margins,” says Tom Higgins, CEO and founder of Gold-i. “But the risks that they don’t think of are distributed denial-of-service (DDoS) attacks, cyber security threats, technology failures, hacking etc. Too often they don’t think of these until it’s too late.”

Tom Higgins

Tom Higgins

“A few years ago everyone just B booked everything and hoped, but now risk management is a very common conversation that we’re having with brokers.”

Essentially there are two primary forms of risk: market risk and customer risk, adds Shawn Dilkes, managing director, Forexware. Certainly the recent spate of black swan events such as the SNB flash crash, Brexit and the US election result have tested the resiliency of trading systems around the world. “Another example would be highly traded instruments where you have a large amount of offsetting flow making it easier to mitigate market risk,” Dilkes says. “Customer risk requires analysing many different factors such as trading styles, timing, frequency, risk, and order types.”

As a result, mitigating risk is now an essential consideration for any FX business. Indeed, without a complete set of risk management tools technology brokers may find it very difficult to run a competitive business in the current regulatory environment, adds Nick Mortimer, head of retail sales, MahiFX. Due in part to the impact of such sweeping regulatory changes, the nature of the retail FX market has changed considerably. “There are less market makers taking on less risk resulting in deep pockets of no liquidity,” Dilkes explains. “While the top of book may show a tight spread, it’s only available for 500k and the next price is 2-3 pips away. In this ever volatile market is more important than ever for brokers to manage their risk effectively.”

AN AGGREGATED APPROACH

But when done well, effective risk management tools may well provide retail brokers with a competitive edge by enabling them to provide an enhanced trading experience for customers and ultimately increase their overall revenues. “Having the ability to determine ‘good’ and ‘bad’ flow through detailed analytics, as well as access to a toolset that will engineer and manage flow, will undoubtedly increase profitability and allow a broker to invest in new staff, products, technology and the business as a whole,” Mortimer says. Increasingly, the strength of a broker’s risk management capabilities will be directly reflected in their bottom-line and the durability of their business.

David Hall, co-founder and CEO of Tapaas agrees, adding that for the retail FX broker, effective risk management facilitates taking aggressive positions with confidence. “The biggest risk/reward for the broker is managing warehoused risk,” he says. “Retail FX brokers face the same challenges that large banks and liquidity providers (LPs) face in managing risk. To be successful, they need to start adopting similar tools.”

Risk management can almost be viewed as a science
Risk management can almost be viewed as a science

Yet among the main challenges facing brokers is the need for effective risk mitigation across all aspects of their business – ranging from clients to LPs and even the technology itself. Furthermore, brokers need to be able to monitor threats in a variety of fields that are unique to their operations such as market prices, money processing and transfers, legal risks and exposures in dealing and execution, says Oded Shefer, founder and CEO of CPattern. “Risk is a multi-layer, 24/7 issue for brokers,” he adds. “They know that their stability relies on their ability to anticipate events and handle them effectively. But there is a lot of information to control and process.” In addition, FX brokers now face more stringent demands from both their clients and their regulators.

“On one side, clients are demanding more variety in front-end platforms, mobile solutions and access to a variety of asset classes,” says Andrew Ralich, CEO, oneZero. “At the same time, regulators are pushing for more transparency, better risk controls and consistency in execution.”

Solutions are emerging, however, that centralise the core business of the retail broker such as price discovery and access to front-ends, LPs and trade reporting. Brokers can no longer afford, or compete, with disparate solutions that create fragmented pools of risk, access, and trade reporting, warns Ralich. “We approached this problem head on at oneZero when we released our “Hub” solution, which allows brokers to manage multiple front-ends, multiple asset classes and multiple LPs all from a single point in their infrastructure,” he adds. In the past, it was also common to have a risk management tool per platform because they were all separate.

But this is far from ideal, according to Higgins. Instead, Gold-i developed one risk management tool, Visual Edge, which could look at trades from multiple sources and multiple servers, then combine the analytics together. “This shows you a net aggregate risk position across all the different platforms,” he adds.

Oded Shefer

Oded Shefer

“Risk managers need to be able to see the big picture and it is a very difficult task for a robot. Reality has so many variables and nuances.”

INSTITUTIONAL EXAMPLE

In addition, a number of brokers still only have a single LP connection for FX and perhaps also CFDs. But what if there is an issue and the LP cannot provide prices or their systems are down? “We built our Matrix system to counter this,” Higgins says. “And we are seeing a lot of interest in Matrix because of the technology issues some providers are having.” While it is possible to have multiple providers with primary/secondary set-ups, the secondary LP is likely to take issue to this. Instead, Gold-i’s Matrix enables brokers to direct some customers to one LP as their primary provider and some to the other. “So there is still trading with two LPs but they are backing each other up in case of a failure,” Higgins adds. “In FX, this is often already the case but it’s not common in CFDs due to different contract sizes etc. We have built in to Matrix a normalisation system so you can switch between primary and secondary LPs, or even aggregate them if you wanted to.”

Dilkes agrees that it is now vital to have the proper tools in place to aggregate all flow across instruments. “Forexware has been offering this for quite some time,” he adds. “Our risk management tools show brokers’ positions, instrument and currency risk and their P&L in a real time basis across all front-ends. This accurate information is not only useful for brokers to run their business but is a requirement from regulators.” Furthermore, these tools allow brokers to see available capital and manage their offsetting flow effectively to maximize profitability, Dilkes explains.

The ability to identify market shifts and develop a tailored solution is becoming increasingly vital due to the rapid pace of change taking place in the retail FX industry. 

And as it becomes increasingly sophisticated, the technologies and practices needed by retail brokers to manage risk converge more and more towards what the large banks and liquidity providers have been using for some time. “Those brokers that fail to adopt these will become the vulnerable dinosaurs of the industry,” Hall adds. “Risk policies need to be continually improved from experience. There are no standard policies which, if adopted, will protect your profits forever.” Instead, he believes that a mature business should be continually learning and actively refining its policies and practices.

Shawn Dilkes

Shawn Dilkes

“It is important to recognise that there is market risk and there is risk to being in the business.”

AUTOMATING OVERSIGHT

In addition, regulators will be placing ever increasing constraints on brokers to ensure that their retail clients are not endangered in case of adverse market circumstances. Having sound real-time risk management tools will be a prerequisite to doing business, not an optional extra, Hall argues. “At Tapaas, we have extensive experience building these technologies for some of the world’s largest banks and we have managed to assemble a similar risk management capability integrated into the retail broker ecosystem,” he says. “The most critical risk policy is to investigate loss incidents and the circumstances which lead to the incident. Then evaluate the incident with respect to the effectiveness of your existing policy, then amend the policy accordingly and apply it operationally. This is how algorithms are developed and refined.”

Ultimately, technology development may prove to be the easiest stage in developing an effective risk management strategy, Shefer warns. “First, you need to create a clear vision and develop a workable policy,” he says. “You need to hire the right person to monitor the data and make the right decisions. But before that you need to have a clear policy. It all starts from there.” Brokers need to be able to monitor possible risks in a number of areas through a variety of systems, such as PSPs, CRM, trading platforms etc. This requires synthesis of information and rapid decision making, according to Shefer. “The technological applications need to match these demands: they need to be able to reflect a clear dynamic picture in real time, with the ability to drill down from aggregated data to granular data,” he adds. “CPattern works with our clients to customise technology to their needs so that they receive a tailor-made solution.”

With so many different tools and strategies available for risk management it can almost be viewed as a science, argues Dilkes. “It’s not something that can be taken lightly and there is not one answer for all brokers,” he says. While a smaller broker is likely to offset all its risk, a larger broker may be able to take on more risk. Most who are in the middle have a model of how much risk they will keep and how much they need to offset, dependent on customer flow. “One of our products is an aggregated risk management solution which allows customers to see aggregated risk across all products,” Dilkes explains. “The system includes alerts on bad prints and circuit breakers to halt trading if there is extreme volatility, so customers don’t see bad pricing.” Forexware’s technology also enables brokers to aggregate up to a pre-defined position and then start offsetting, in addition to offering a suite of tools for automatically identifying aggressive traders and taking the broker’s preferred action.

Brokers are having to become more analytical in their approach to effectively manage risk
Brokers are having to become more analytical in their approach to effectively manage risk

NEXT GENERATION TECHNOLOGY

This rise in interest for automated risk management solutions is most likely due to the huge amount of trading information that is currently produced every minute, explains Shefer. Even to attempt monitoring this volume of data without automated tools would require a large department of analysts and costs would sky rocket. “It is much more costeffective for brokers to make as many automated processes as possible and use a human employee to monitor the data and make complex decisions,” Shefer adds. “But I also don’t believe humans should be taken out of the equation entirely, but rather they should be used for complicated decision making. Risk managers need to be able to see the big picture and it is a very difficult task for a robot. Reality has so many variables and nuances.”

“It astonishes us how many people don’t have risk management systems at all,” adds Higgins. Small and medium-sized brokers often think they do not have to worry about risk or believe that they are covered with their LP, he warns. “But there is significant risk and they will still have to pay their LP,” Higgins adds. “It’s an education exercise. Our tools are plug and play – they cost a few thousand pounds a month or so but can save you thousands in losses or protecting against traders who are taking profit away from you.”

Gold-i’s Visual Edge suite was developed to look at trade analytics in real-time and automatically identify what brokers consider to be bad trading habits. Higgins explains: “Our algos are looking for this and flag-up on dashboards who needs to be watched. We have a product called Scalper Watch which is a sub-set of Visual Edge. We found that some brokers wouldn’t look at Visual Edge as they just wanted to look for scalpers, but in the end they all buy the bigger Visual Edge product because they realise its value.” In fact, Gold-i has found there is much more of a focus on risk management, with Visual Edge currently ranking as its third best-selling product. “A few years ago everyone just B booked everything and hoped, but now risk management is a very common conversation that we’re having with brokers,” adds Higgins.

David Hall

David Hall

“Retail FX brokers face the same challenges that large banks and liquidity providers face in managing risk. To be successful, they need to start adopting similar tools.”

UNCOVERING THE DETAIL

MahiFX also launched its MFX Compass to meet demand from brokers for full transparency and control of their flow. “Through our analytics dashboard, the broker can identify optimal and sub-optimal behaviour on a client tag level,” says Mortimer. “If flow is identified as suboptimal, the broker is then able to appropriately deal with it by adjusting the spread or last-look settings to better optimise and mitigate specific trading risks.” Ultimately, brokers are only able to manage risk and optimise flow properly if they are fully in control, with access to every piece of relevant information, he argues. The MFX Compass dashboard achieves this, allowing the broker to monitor flow, risk, P&L and yield profiles. “In addition, spreads, pricing tiers and last-look are all easily configurable to an effective degree, therefore providing total authority over the entire business,” Mortimer adds.

This focus on identify tradingrelated risks, particularly with a view to stemming the rise of extreme, or ‘toxic’ behaviours, may be due to a growing realisation in the market of just how much revenue can be lost through undesirable account activity. In response, CPattern developed a module which focuses on trading-related risk, sending out alerts in real-time about suspicious behaviours and enabling the risk manager to respond immediately. Shefer explains: “Many brokers use daily reports of exposures, but CPattern enables brokers to respond to specific behaviours in real-time. This is already proving to make a huge difference because we have eliminated the delay in action on the part of the broker.” In addition, the arrival of next generation data visualisation tools is welcomed by Shefer, with many enabling brokers to view high-level aggregated information and then drill down to finer and finer levels of detail to track critical events. “These tools rely on new technologies that enable accumulation of data from a variety of sources to unified databases and can handle enormous amounts of data,” he adds. “Five years ago this was almost unachievable, but today it is now common practice.”

More sophisticated tools can also help highlight toxic traders, adds Hall. “Tapaas provides a post-trade price evolution curve visualisation for brokers which helps rapidly identify clients that may have unique speed or informational advantages,” he says.

More sophisticated tools can also help highlight toxic traders
More sophisticated tools can also help highlight toxic traders

A recent area of advance in visualisation tools has been coined ‘data discovery’. These tools no longer simply present preconceived views of information based on specifications, explains Hall. Instead, firms such as Tapaas can now provide interactive tools which offer risk managers, executives and traders the ability to switch dimensions, colours or to change other visual elements which help to uncover new insights. “Furthermore, our dashboards update continuously in realtime, so the risk exposure and P&L is updated immediately as trades occur or market prices change,” Hall adds. “Leading offerings like the Tapaas Risk Cube utilise real-time online analytical processing (OLAP) techniques to provide multiple pivoted views of these datasets, helping the broker to rapidly gain valuable insights from the ever-changing data.”

FAIL TO PLAN, PLAN TO FAIL

But visualisation on its own is insufficient to manage risk effectively, Hall warns, particularly as the market speeds up and/or broker volumes increase. Positions can swing rapidly and overwhelm the capacity of the dealer to react promptly. The broker needs to be able to take automated rule-based actions when various thresholds or parameters are breached. “For example, when a warehoused client starts enjoying significant profits, that risk needs to be rapidly offloaded and straight though processed (STP),” Hall says. “Placing that responsibility purely on the dealer is impractical and expensive. So at Tapaas, we believe that the more traditional historical analysis of client trading behaviours will increasingly be supplemented by more realtime decision making around warehousing decisions.”

Nick Mortimer

Nick Mortimer

“Having the ability to determine ‘good’ and ‘bad’ flow through detailed analytics will undoubtedly increase profitability and allow a broker to invest in new staff, products, technology and the business as a whole.”

Due to capital and regulatory constraints, brokers are also having to become more analytical in their approach to effectively manage risk and optimise profitability. This has seen the rise in the creation and use of tools to determine that the right flow is being placed in the right book, explains Mortimer. “By using MFX Compass, the broker has the ability to evaluate what flow is managed in the B book, on a client tag, trade size, currency pair basis. They can then effectively run the A book flow using the risk management tools to further maximise profitability.”

But in addition to trading or client-related risk, brokers are often not sufficiently aware of operational risk and its potential for significant cost – not to mention reputational damage. Most disaster recovery (DR) plans also do not work, claims Higgins, because most companies do not test their disaster recovery scenarios, their server and their software regularly, or at all. “Around 90% of DR invocations don’t work,” he adds. “You need to take a proactive stance in managing your disaster recovery.” Gold-i’s approach is to offer a software suite which replicates everything in realtime between the production site and the disaster recovery site. It is also not expensive, according to Higgins, especially when compared to the almost unlimited cost of losing your critical data, coupled with fines from the regulators when they discover a broker did not have adequate disaster recovery plans in place.

Andrew Ralich

Andrew Ralich

“Regulators are pushing for more transparency, better risk controls and consistency in execution.”

OVER-RELIANCE ON ROBOTS

A further threat on retail FX operations is the growing prevalence of DDoS attacks. “It’s something that is unfortunate with cloud services – they are rather open to DDoS attacks,” explains Higgins. “You need to be quite careful that you have protection in that case.” To solve this, Gold-i has developed a cloud based infrastructure where it can spin-up new IP addresses that have never been published. “The clients then connect to– points of presence (PoPs) around the world in different locations,” Higgins says. “If they get compromised, we can run up a new PoP to connect to in a matter of minutes so the client has no loss of service.”

A further function of robust, reactive risk management systems is the ability to deliver much needed insight during unprecedented market events. This has particularly come to the fore in the past two years, while the events of recent months have really put platforms to the test. “It is important to recognise that there is market risk and there is risk to being in the business,” warns Dilkes. “Having the best possible protection is important.” To sustain volatility in the current market conditions, brokers need a high performance, fully operational risk management system that manages P&L, positions and margin from liquidity providers, Dilkes adds. “Furthermore, while technology is important, we still need humans at the wheel to effectively process the information and manage it effectively.”

Most disaster recovery plans do not work
Most disaster recovery plans do not work

Shefer agrees, adding that it is not ultimately the responsibility of technology providers to be identifying market risks, but rather that this is the sole responsibility of the broker. However, following the Brexit referendum result this summer, for example, some platforms could not support such a deep drop in the GBP. “But I think technology should never be the entire story,” Shefer urges. “Let’s put the human back in trading.” He believes that the role of technology is to support the work of the risk manager, providing them with valid and reliable information at the right time and in a coherent way. “This match between technology and human is the secret formula everybody is seeking,” Shefer says.

FACING THE FUTURE

Indeed, many of the problems faced during the SNB event were the result of brokers only viewing risk mitigation technology as just a way to manage exposures, rather than looking at both exposure and pricing during volatility. “Tools such as MFX Compass offers the necessary risk management functionality to not only look at current exposure, but also the ability to deal with pricing models so the broker avoids taking on more exposure at wrong levels,” explains Mortimer. “FX is an increasingly fast-paced, evolving space in terms of technology. However, it’s fair to say that risk management technology has not kept the same pace with pricing and execution improvements in recent years.”

And whereas stringent change control, tightly restricted access and advanced security measures, such as firewalls or virtual private networks (VPN), were once merely optional in the retail FX market, all this has now changed. “Retail brokers need to look to the institutional players in the financial markets in order to understand how their infrastructure will need to evolve over the coming years,” warns Ralich. “Both clients and regulators will no longer accept loose security when it comes to their financial data, or the stability of the infrastructure that runs retail forex brokerages.”