---
title: "Regulators and Licences"
book: "The Desk and the Firm"
subject: quant
language: en
chapter: 17
exercises: 8
source: https://one-course.com/books/quant/16/en/chapter/17-regulators-and-licences
---

# Chapter 17 — Regulators and Licences

A firm that trades only its own money need not be a client of anyone, and it has no clients of its own. Whether it needs a licence is another matter. The second Markets in Financial Instruments Directive keeps an exemption for firms dealing on their own account in the European Union, and then takes it away from almost every firm this series describes: from market makers, from members of a trading venue and firms with direct electronic access to one, and from any firm that applies a high-frequency algorithmic trading technique, however small it is and although it has no clients. Where a firm may trade, and what it must be to do so, is set by rules that differ by country and by activity, and the map of them is part of the firm’s design.

## 17.1 Why a trading firm needs permission

Regulation follows activities, not firms. The same firm can be unregulated for one thing it does, registered for another and licensed for a third, and a new desk, product or office can move it across a line it did not know was there.

**Definition 17.1 (Regulatory perimeter, authorisation).**

The *regulatory perimeter* of a jurisdiction is the boundary between the activities that require permission from a regulator and those that do not, drawn by the legislation’s definitions of regulated activities and its exemptions. *Authorisation* is the permission, granted by a regulator on application, to carry on specified regulated activities, with the conditions, capital and supervision that go with it.

**Definition 17.2 (Dealing on own account, investment firm).**

*Dealing on own account* is trading against proprietary capital that results in transactions in financial instruments. An *investment firm* is, in European law, a legal person whose regular occupation or business is providing investment services to third parties or performing investment activities on a professional basis; dealing on own account is one of those activities.

The chapter’s working tool is a map of these rules as data, each row naming a jurisdiction, an activity, the regime it touches, the legal reference, the statutory decision period where there is one, the month it was checked and the ledger rows that source it ([Listing 17.1](#lst-fm-regulators-and-licences-map)). The map is information about where the rules are; whether a particular firm is inside a perimeter is a question for its lawyers and its regulator.

```python
def check(rows):
    problems = []
    for i, r in enumerate(rows):
        missing = [k for k in FIELDS if k not in r]
        if missing:
            problems.append((i, "missing " + ", ".join(missing)))
            continue
        for k in ("reference", "as_of", "source"):
            if not r[k]:
                problems.append((i, f"empty {k}"))
        if r["status"] not in STATUSES:
            problems.append((i, f"bad status {r['status']}"))
        if len(r["as_of"]) != 7 or r["as_of"][4] != "-":
            problems.append((i, "as_of not YYYY-MM"))
    return problems


def query(rows, profile):
    """profile: iterable of (jurisdiction, activity)."""
    p = set(profile)
    return [r for r in rows if (r["jurisdiction"], r["activity"]) in p]


def regimes(rows):
    return sorted({(r["jurisdiction"], r["regime"]) for r in rows})

```

***Listing 17.1.** The regulatory map’s schema check, and the query of a firm’s profile of activities and jurisdictions. code/firm/regmap/firm_regmap.py*

## 17.2 The United States: the SEC, the CFTC and the self-regulatory organisations

The United States divides the field by instrument. Securities fall to the Securities and Exchange Commission, futures, options on futures and swaps to the Commodity Futures Trading Commission; each delegates much of the registration and day-to-day supervision to a membership body.

**Definition 17.3 (Self-regulatory organisation).**

A *self-regulatory organisation* is a membership body, such as a securities association or an exchange, that writes and enforces rules for its members under the supervision of a government regulator, and to which registered firms are required to belong.

**Definition 17.4 (Swap dealer, commodity pool operator, introducing broker).**

A *swap dealer* holds itself out as a dealer in swaps, makes a market in them, or regularly enters into swaps with counterparties for its own account in the ordinary course of business. A *commodity pool operator* operates a pool that combines funds from several persons to trade futures, options on futures or swaps, and solicits funds for it. An *introducing broker* solicits or accepts orders in futures, options on futures or swaps but does not accept money or other assets from customers to support them.

**As of September 2026 — US registration.**

**Securities.** A broker or dealer must register with the SEC to effect securities transactions (Exchange Act s. 15(a)); within 45 days of an application the SEC grants registration or opens proceedings, which must end within 120 days, extendable by up to 90 (s. 15(b)(1)). A registered broker-dealer must also join a registered securities association unless it trades solely on exchanges of which it is a member (s. 15(b)(8)); Rule 15b9-1, as amended in September 2023, limits that exemption to exchange members with no customer accounts that trade solely on their exchanges, with narrow exceptions. An investment adviser must register under the Advisers Act (s. 203(a)), on the same 45-day timetable. **Derivatives.** The Commodity Exchange Act requires certain firms to register with the CFTC, which has delegated registration to the National Futures Association; with few exceptions registered firms must be NFA members. The categories include futures commission merchants, [introducing brokers](#def-fm-regulators-and-licences-cftc), [commodity pool operators](#def-fm-regulators-and-licences-cftc), commodity trading advisors and [swap dealers](#def-fm-regulators-and-licences-cftc).

![The US division of the field: the SEC for securities and the CFTC for derivatives, each with a membership body to which registered firms must belong. Schematic of the rules in the dated box.](https://one-course.com/images/onecourse/chapters/quant-16/fm-regulators-and-licences/fig-86dd8ae6fe9b.svg)

***Figure 17.1.** The US division of the field: the SEC for securities and the CFTC for derivatives, each with a membership body to which registered firms must belong. Schematic of the rules in the dated box.*

For a proprietary trading firm the 2023 amendment is the hook in American form: a firm that trades off-exchange, even for itself, now needs the securities association’s membership and its rulebook. Market access (Rule 15c3-5, Book 11) adds pre-trade controls whoever sponsors the firm’s orders.

## 17.3 Europe and the United Kingdom

**Definition 17.5 (Passporting).**

*Passporting* is the right of a firm authorised in one member state of the European Union or the European Economic Area to provide the services its [authorisation](#def-fm-regulators-and-licences-perimeter) covers in the others, on notification to its home regulator, without a further [authorisation](#def-fm-regulators-and-licences-perimeter).

**As of September 2026 — EU authorisation under MiFID II.**

Directive 2014/65/EU requires prior [authorisation](#def-fm-regulators-and-licences-perimeter) for investment services and activities performed as a regular occupation (art. 5), and the regulator must decide within six months of a complete application (art. 7(3)); an authorised firm may provide its services in other member states (art. 34). Firms dealing only on own account are exempt (art. 2(1)(d)) unless they are market makers, members or participants of a regulated market or MTF, have direct electronic access to a trading venue, apply a high-frequency algorithmic trading technique, or deal on own account when executing client orders. A firm engaged in algorithmic trading must have effective systems and risk controls, business continuity and tested systems (art. 17(1)), and must notify the authorities of its home state and of the venues where it trades (art. 17(2)).

**As of September 2026 — UK permission.**

Under the Financial Services and Markets Act 2000 no person may carry on a regulated activity in the United Kingdom unless authorised or exempt (s. 19, the general prohibition). An application for permission must be determined within six months of the regulator receiving it complete, and an incomplete one within twelve months (s. 55V). The UK’s exemptions for own-account dealing are its own and are not restated here: the map marks the UK rows as checks.

The European exemption is worded so that almost no electronic trading firm meets it. A proprietary firm that is a member of an exchange, or that reaches one through direct electronic access, is out; one that co-locates, generates its orders without human intervention and sends many messages is applying a high-frequency technique (Book 10’s definition in the directive’s words, article 4(1)(40)) and is out again. What it gains in return is the passport.

![The own-account exemption of MiFID II for a firm trading financial instruments other than commodity derivatives, as the directive words it. Almost every electronic trading firm answers yes to the second question. Schematic of the legal text, not advice.](https://one-course.com/images/onecourse/chapters/quant-16/fm-regulators-and-licences/fig-a0c0c82e70aa.svg)

***Figure 17.2.** The own-account exemption of MiFID II for a firm trading financial instruments other than commodity derivatives, as the directive words it. Almost every electronic trading firm answers yes to the second question. Schematic of the legal text, not advice.*

## 17.4 Asia-Pacific

Asia’s markets are regulated country by country. In Hong Kong a corporation carrying on a business in a regulated activity needs a licence from the Securities and Futures Commission; the Securities and Futures Ordinance lists thirteen types, among them dealing in securities (type 1), dealing in futures contracts (type 2), providing automated trading services (type 7) and asset management (type 9). Whether a firm trading only its own money is carrying on such a business turns on the ordinance’s definitions and exemptions, so the map marks it as a check, not a requirement. Singapore, Japan and Australia each have their own licences; this chapter’s map carries only the rows it has sourced, and says so.

## 17.5 Rules for algorithmic trading

Once inside the perimeter, an electronic firm carries obligations specific to algorithms. They are the controls of Book 11’s chapter on risk controls, written into law: in the European Union, article 17 of MiFID II and its technical standards; in the United States, the market access rule for the broker whose connection the firm uses ([Table 17.1](#tab-fm-regulators-and-licences-algo)).

| where | obligation | reference |
| --- | --- | --- |
| EU | systems and risk controls, limits, no erroneous orders | Directive 2014/65/EU art. 17(1) |
| EU | business continuity; tested and monitored systems | Directive 2014/65/EU art. 17(1) |
| EU | notify home and venue authorities | Directive 2014/65/EU art. 17(2) |
| EU | detailed organisational requirements | Delegated Regulation (EU) 2017/589 (Book 11) |
| US | pre-trade risk controls for market access | Rule 15c3-5 (Book 11) |

***Table 17.1.** The algorithmic-trading checklist of `firm.regmap.ALGO_CHECKLIST`, each item with its reference.*

## 17.6 Tutorial: three offices

**Goal.** Query the map for a proprietary high-frequency firm that starts in London and adds offices in Chicago and Hong Kong. **End state:** the regimes each step touches ([Table 17.2](#tab-fm-regulators-and-licences-profiles)) and the statutory decision periods on the path ([Figure 17.4](#fig-fm-regulators-and-licences-periods)).

1. **The map.** `fm_regmap.rows()` loads the 20 rows of `data/desk/regmap.csv` (four jurisdictions, ten regimes) and `firm.regmap.check` confirms that every row has a reference, an as-of month and a source.
2. **The profiles.** London: own-account exchange trading with a high-frequency technique. Chicago adds the same in US securities. Hong Kong adds own-account exchange trading there.
3. **The queries.** `fm_regmap.profiles()` lists the rows, the distinct regimes and the longest statutory decision period.
4. **The upkeep.** `firm.regmap.stale(rows, today, 12)` lists rows not checked for a year.

| profile | rows | regimes | required | to check | longest decision |
| --- | --- | --- | --- | --- | --- |
| London | 2 | 1 | 0 | 2 | 6 months (UK) |
| London and Chicago | 5 | 4 | 2 | 2 | 6 months (UK) |
| London, Chicago and Hong Kong | 6 | 5 | 2 | 3 | 6 months (UK) |

***Table 17.2.** The regulatory map queried for a firm adding offices (the Chicago step also adds one obligation, the market access rule). Information, not advice. Data: `fm_regmap.profiles`.*

![Rows of the regulatory map a firm touches as it adds offices, by status. Each office adds regimes, and each check row is a question for the firm’s lawyers. Data: fm_regmap.profiles.](https://one-course.com/images/onecourse/chapters/quant-16/fm-regulators-and-licences/fig-5f2f6a491b6e.svg)

***Figure 17.3.** Rows of the regulatory map a firm touches as it adds offices, by status. Each office adds regimes, and each check row is a question for the firm’s lawyers. Data: `fm_regmap.profiles`.*

![Statutory maximum periods for a regulator’s decision on an application, in days (six months counted as 183): UK permission, EU investment-firm authorisation, and US broker-dealer registration. Data: fm_regmap.PERIODS; sources in the chapter’s ledger.](https://one-course.com/images/onecourse/chapters/quant-16/fm-regulators-and-licences/fig-524c2e6b3054.svg)

***Figure 17.4.** Statutory maximum periods for a regulator’s decision on an application, in days (six months counted as 183): UK permission, EU investment-firm [authorisation](#def-fm-regulators-and-licences-perimeter), and US broker-dealer registration. Data: `fm_regmap.PERIODS`; sources in the chapter’s ledger.*

The London firm touches one regime, a set of checks on the UK’s general prohibition; Chicago adds three (broker-dealer registration, association membership unless it trades only on its own exchanges, and the market access rule); Hong Kong adds a licence check. The longest statutory decision on the path is the UK’s six months for a complete application, twelve for an incomplete one; the US broker-dealer decision is 45 days, or up to 210 if the SEC opens proceedings and extends them. The statutory periods start when the application is complete: the months spent writing the programme of operations, hiring the approved persons and capitalising the entity come first, and the periods are the part of the path a firm does not control.

**Remark 17.6 (Keeping the map true).**

Every row of the map is a dated fact about a law that changes. The map’s value is in its upkeep: an owner for each jurisdiction, a review date for each row, and a stale-row report that the compliance function reads. A year after this chapter’s check, every row will be stale.

## 17.7 Build: the regulatory map

**Purpose.** No build in the running-project sense: the subject is law. The analytical tool keeps the map as data, checked and queried.

**Interface.** `firm.regmap`: `load`, `check`, `query`, `regimes`, `stale`, `longest_decision`, `ALGO_CHECKLIST`; data in `data/desk/regmap.csv`.

**Rules.** Every row has a reference, an as-of month and a source; statuses are required, obligation or check; nothing is inferred beyond the rows.

**Acceptance tests.** `code/firm/regmap/tests/`: queries, regimes and longest periods on a three-row map; the schema check and the stale report.

**Stretch.** Rows for Singapore, Japan and Australia with their sources; capital requirements per row (chapter 2); a diff between two versions of the map.

Sources and further reading

- Directive 2014/65/EU (MiFID II), articles 2, 4, 5, 7, 17 and 34.
- Financial Services and Markets Act 2000, sections 19 and 55V.
- Securities Exchange Act of 1934, section 15; 17 CFR 240.15b9-1; Investment Advisers Act of 1940, section 203; NFA, registration categories.
- Securities and Futures Commission, licensing: types of regulated activity.

## 17.8 Exercises

**Exercise 17.1 ★.**

A firm deals only on its own account in EU equities, through a broker, with no direct electronic access and no algorithm. Is it within the MiFID II exemption? What changes if it becomes a member of the exchange?

**Solution of Exercise 17.1.**

On the text of article 2(1)(d), yes, if it is not a market maker, provides no other investment service and does not deal on own account when executing client orders. Membership of the exchange is one of the listed exceptions: it would then need [authorisation](#def-fm-regulators-and-licences-perimeter).

**Exercise 17.2 ★.**

Name the three features of a high-frequency algorithmic trading technique in MiFID II.

**Solution of Exercise 17.2.**

Latency-minimising infrastructure (co-location, proximity hosting or high-speed direct electronic access); system-determined order initiation, generation, routing or execution without human intervention; high message intraday rates.

**Exercise 17.3 ★.**

What is the longest period the SEC can take on a broker-dealer application under section 15(b)(1)?

**Solution of Exercise 17.3.**

45 days to grant or open proceedings; proceedings concluded within 120 days of filing, extendable by up to 90: 210 days in all.

**Exercise 17.4 ★★.**

What does the 2023 amendment of Rule 15b9-1 change for a proprietary firm that trades on an exchange and also off-exchange?

**Solution of Exercise 17.4.**

The exemption from securities-association membership now requires trading solely on exchanges of which the firm is a member; off-exchange trading, beyond the narrow exceptions, brings association membership and its rules.

**Exercise 17.5 ★★.**

A US firm runs a futures fund for outside investors and gives trading advice. Which CFTC categories does the map point to, and through whom does it register?

**Solution of Exercise 17.5.**

[Commodity pool operator](#def-fm-regulators-and-licences-cftc) for the fund and commodity trading advisor for the advice; registration with the CFTC through the NFA, with NFA membership.

**Exercise 17.6 ★★.**

Why does the map mark the UK and Hong Kong own-account rows as checks rather than requirements?

**Solution of Exercise 17.6.**

The general prohibition and the licensing requirement apply to regulated activities carried on as a business; whether own-account trading is one depends on definitions and exemptions the map does not restate, so the row points to the rule and says it must be checked.

**Exercise 17.7 ★★★.**

*Coding.* Query the map for an EU market maker using a high-frequency technique. How many rows and regimes, and what is the longest statutory decision?

**Solution of Exercise 17.7.**

Three rows ([authorisation](#def-fm-regulators-and-licences-perimeter) as a market maker, [authorisation](#def-fm-regulators-and-licences-perimeter) for the high-frequency technique, and the article 17 obligations), two regimes, and a six-month decision period.

**Exercise 17.8 ★★★.**

*Find the flaw.* “We only trade our own money, so we don’t need a licence anywhere.”

**Solution of Exercise 17.8.**

Regulation follows activities, not clients: in the EU exchange membership, direct electronic access or a high-frequency technique removes the own-account exemption; in the US off-exchange trading brings association membership; elsewhere the definitions must be checked.

## 17.9 Problem: Three Offices

**Problem 17.1.**

Weekend problem — three offices

A London proprietary firm plans offices in Chicago and Hong Kong and asks its chief operating officer for the regulatory path.

**Part I — The perimeter.**

1. Define the [regulatory perimeter](#def-fm-regulators-and-licences-perimeter) and [authorisation](#def-fm-regulators-and-licences-perimeter) .
2. Define [dealing on own account](#def-fm-regulators-and-licences-own) and an [investment firm](#def-fm-regulators-and-licences-own) .
3. State the MiFID II own-account exemption and its exceptions.
4. Define [passporting](#def-fm-regulators-and-licences-passport) and say what it gives an EU-authorised firm.

**Part II — The United States.**

5. Define a [self-regulatory organisation](#def-fm-regulators-and-licences-sro) and name two.
6. State the broker-dealer registration and membership rules and their timetable.
7. Define a [swap dealer](#def-fm-regulators-and-licences-cftc) , a [commodity pool operator](#def-fm-regulators-and-licences-cftc) and an [introducing broker](#def-fm-regulators-and-licences-cftc) .
8. What does the market access rule add?

**Part III — The map.**

9. What does each row of the map carry, and why?
10. Query the three profiles and give rows and regimes.
11. Give the statutory decision periods on the path.
12. What does the stale-row report show a year later?
13. What does the map not tell the firm?

**Part IV — The plan.**

14. What obligations follow for the firm’s algorithms in the EU?
15. What must be done before an application’s statutory clock starts?
16. Which step of the path does the firm control, and which not?
17. How would you keep the map up to date?
18. Why is Hong Kong a check and not a requirement in the map?
19. State the *named result* : the regimes the firm’s activities touch as it adds a second and a third jurisdiction, and the longest statutory decision period on its path to trading.
20. In two sentences, write the plan.

**Solution of Problem 17.1.**

1. See [Definition 17.1](#def-fm-regulators-and-licences-perimeter) .
2. See [Definition 17.2](#def-fm-regulators-and-licences-own) .
3. See [Box 17.2](#dat-fm-regulators-and-licences-eu) .
4. See [Definition 17.5](#def-fm-regulators-and-licences-passport) ; the right to provide its authorised services in other member states.
5. See [Definition 17.3](#def-fm-regulators-and-licences-sro) ; a registered securities association and the NFA.
6. See [Box 17.1](#dat-fm-regulators-and-licences-us) : 45 days, up to 120 plus 90 with proceedings.
7. See [Definition 17.4](#def-fm-regulators-and-licences-cftc) .
8. Pre-trade risk controls and supervisory procedures on the broker’s market access.
9. Jurisdiction, activity, status, regime, category, reference, decision period, as-of month and source: so that each statement can be checked and dated.
10. 2, 5 and 6 rows; 1, 4 and 5 regimes.
11. Six months in the UK (twelve if incomplete), six months in the EU, 45 to 210 days for a US broker-dealer.
12. Every row stale, since each was checked in September 2026.
13. Whether the firm is inside a perimeter, what its application must contain, and what the regulator will ask: questions for its lawyers.
14. Systems and risk controls, business continuity, testing, notification to the home and venue authorities, and the technical standards.
15. The programme of operations, the governance and approved persons, the capital, and the systems and controls the application describes.
16. It controls the preparation; it does not control the regulator’s period, which starts from a complete application.
17. An owner per jurisdiction, a review date per row, and a stale-row report read by compliance.
18. Licensing depends on carrying on a business in a regulated activity, and the map does not restate the ordinance’s definitions.
19. One regime in London, four with Chicago, five with Hong Kong; the longest statutory decision is six months (UK, complete application).
20. Prepare complete applications in each jurisdiction, UK first since its decision period is longest, with algorithmic controls documented for all three; keep the map dated and reviewed, with legal advice on every check row.

## 17.10 Interview questions

**Interview question 17.1 ★ trader.**

Why does a proprietary trading firm that has no clients need a licence in the EU?

**Solution of Interview question 17.1.**

Because the exemption for own-account dealing is lost by exchange members, firms with direct electronic access and firms using a high-frequency technique, which covers almost every electronic trading firm.

*What the interviewer is looking for: the exceptions to the exemption.*

**Interview question 17.2 ★ developer.**

What does it mean, legally, for your firm to engage in algorithmic trading in the EU?

**Solution of Interview question 17.2.**

The firm must have effective systems and risk controls, business continuity and tested systems, and must notify its home and venue authorities, who may ask for descriptions of its strategies and controls.

*What the interviewer is looking for: article 17.*

**Interview question 17.3 ★★ risk.**

Your firm wants to trade swaps with banks for its own account. What would you check in the US?

**Solution of Interview question 17.3.**

Whether its swap activity makes it a [swap dealer](#def-fm-regulators-and-licences-cftc) (holding out, making a market, regularly entering swaps in the ordinary course of business), and if so CFTC registration through the NFA.

*What the interviewer is looking for: the dealer definition.*

**Interview question 17.4 ★★ developer.**

Design a data model for a regulatory map that can be audited.

**Solution of Interview question 17.4.**

Rows with jurisdiction, activity, status, regime, reference, decision period, as-of date and source; append-only versions with a diff; a schema check and a stale report.

*What the interviewer is looking for: sources and dates on every row.*

**Interview question 17.5 ★★ trader, risk.**

What is [passporting](#def-fm-regulators-and-licences-passport), and what happens to it when a country leaves the single market?

**Solution of Interview question 17.5.**

The right of an authorised firm to serve other member states on its home [authorisation](#def-fm-regulators-and-licences-perimeter); it rests on the directive, so a firm authorised only in a state outside the single market no longer has it and needs [authorisation](#def-fm-regulators-and-licences-perimeter) within it.

*What the interviewer is looking for: the passport’s legal basis.*

**Interview question 17.6 ★★★ risk.**

Plan the regulatory path for a firm moving from trading its own money to managing outside money, in the US and the EU.

**Solution of Interview question 17.6.**

US: investment adviser registration, and CPO or CTA registration for futures; EU: [authorisation](#def-fm-regulators-and-licences-perimeter) for portfolio management or a fund manager’s regime; both with timetables, capital and compliance functions, and legal advice on each.

*What the interviewer is looking for: activities mapped to regimes.*