IT Outages - Impact on Trading Market Participants

In the early hours of Friday 19th July, faced with widespread IT outages, most trading venues thankfully seemed to be resilient and trading as usual. But many market participants will undoubtedly have been affected, without access to key IT systems for trading, and this impact may take longer to manifest in the outside world, not until after the weekend.

How do exchange rules deal with such technological disruption among their members? In this article we will take the example of Euronext rules as an illustration; readers should always obtain their own specific legal advice, and the rules of other venues will vary.

Perhaps surprisingly, despite slews of regulator initiatives - several EU legislative developments entering into force in coming months; and a Cyber Security and Resilience Bill announced in the King’s speech – exchange rules typically do not yet expressly cater for an IT outage of a member or its participant counterparties. Trading venue documents may well have a clause dealing with IT outages (as it happens, the Euronext rules do not have such an express clause), but this is invariably limited to outages affecting the operator rather than the exchange participant.

Notification

The Euronext documents, like those of many venues, require ¹ a participant to notify the operator if there is an IT incident. This would be clearly triggered by current events. It is not specified what the operator will do following such a notification of outage; presumably they will be looking out for breaches of other rules.

If as a result of the IT outage, a venue member is also in breach of other exchange rules, they are typically (as is the case in the Euronext rulebook) obliged to notify the operator that they are (or are likely to become) in breach. Disciplinary measures for breach of the rules can include a warning notice, a fine, right up to suspension or termination of membership. These can be serious consequences for an IT outage which is outside the member’s control.

So at the same time as notifying the operator of an IT incident or rules breach, it may well be worth pre-emptively notifying the operator if the member believes the force majeure clause is triggered, with a view to excusing the member from disciplinary actions. Sometimes there is an express rule requiring a member to notify the operator if it believes the force majeure clause to be triggered; this is not the case in the Euronext rules.

Force majeure

The force majeure clause is usually in the member agreement with the operator, rather than the rules. Often (as with Euronext ² ) it is a mutual undertaking, in favour of each of the member and the operator. Sometimes IT outages are cited as force majeure events expressly, but often they are not. For example, the force majeure clause in the Euronext platform access agreement does not refer to IT systems at all – but it does cover “interruption of work”, which may arguably be applicable. And at Euronext, there is the usual mop-up clause relating to “other circumstances beyond the affected party’s reasonable control”.

Exchanges members may be able to dig out analysis of force majeure clauses which were widely scrutinised during closures and lockdowns during the Covid-19 pandemic. They typically function to exonerate the party relying on it from breaching any of its obligations. There may be some back and forth with operators as to whether the force majeure clause applies in this instance, depending on the exact wording of the clause.

Bilateral contracts

A minority of venues require members to have bilateral contracts with other members; the Euronext rulebook does not have such a provision. If there is a bilateral contract with a counterparty, this is also likely to have a force majeure clause, and the same notification issue will arise to hopefully head off any actions for breach of the bilateral agreement.

Breach of Rules

Which rules may a member be likely to breach, as a result of the IT outage?

Top of the list would be any specified settlement date; Euronext rules do not expressly mention a set settlement date, but the standard rule in the EU and UK is two business days after execution (the US, Canada and Mexico have recently moved to T+1 settlement). The saving grace here may be the weekend which could allow market participants to get systems up and running for settlement on Monday, within the usual timeframe. But this will not help trades that were due for settlement on Friday. (Equally, this is also an example of the operational pressures that come with moving to T+1 settlement.)

Repeated settlement failures may amount to breach of another rule; and there may be buy-in rules in respect of settlement failures. There are no such express rules in the Euronext documentation.

If a market participant is not able to use its normal trading systems, and reverts to voice broking and manually updating spreadsheet records, there are a number of considerations, not least regulatory record-keeping rules. Most exchange rulebooks include a governance requirement for the market participant to have systems and controls to monitor compliance with the rules. It is much harder (but not impossible) for such procedures to be effective when they are run by telephone and spreadsheets.

The Euronext rules require ³ members to have internal controls for pre- and post-trade risk management. They expressly envisage that such controls may be manual as well as electronic; this is an unusual, and helpful, provision. With any luck, these manual procedures will have been dusted down in the early days of the pandemic when some desks moved to working from home before systems were ready to function seamlessly remotely.

Another are where rules may be breached due to an IT outage, is where a liquidity provider is required to offer quotes on a stipulated number of positions. Again, the Euronext documentation has no such provision, but this is not uncommon.

Day of reckoning

It may well be several days before we see the consequences of this latest IT outage among trading venue participants. Venue members will seek to avoid penalties for breach of venue rules, by engaging with the operator and considering invocation of force majeure provisions. The greatest impact may be bilaterally with other market participants. Here members will seek to keep such consequences private, and deal with the matter with their counterparties – and with a view to keeping down any additional costs and damages claims.

¹ Trading Platform Access Agreement, Schedule B2.6.
² Trading Platform Access Agreement, Clause 20.
³ Rule 8106/3.