a. Describe the written safeguards and written procedures to protect the confidential trading information of Subscribers to the NMS Stock ATS, including:
i. written standards controlling employees of the ATS that trade for employees' accounts; and
ii. written oversight procedures to ensure that the safeguards and procedures described above are implemented and followed.
| BACKGROUND AND SCOPE: ILLC's system comprises an integrated Core Messaging System with numerous applications providing, reading, and consuming data messages from the Core Messaging System. The ATS system (e.g., matching engine and associated applications) and ILLC's systems used to support its agency broker-dealer business run on the Core Messaging System. ILLC maintains policies and procedures designed to safeguard the confidential trading information of Subscribers as well as virtual barriers to prevent unauthorized access to such information.
ILLC's Core Messaging System is the conduit through which all firm-wide order information is processed (e.g., ATS and agency broker-dealer order and execution information). All orders routed to the ATS pass through the Core Messaging System. This information is processed by data messages which are readable only by the applications on the Core Messaging System that have been designed and permissioned by ILLC to do so.
Each application subscribes to different message types and is permissioned to subscribe only to the message types necessary for its designated function. For example, the Instinet Trading Products (Instinet Algorithms, SOR, and OMS/EMS) are subscribed to utilize messages regarding the orders routed by the relevant product, including where orders were routed and/or executed, which may include the ATS or any other market center. The Instinet Trading Products may not access data messages related to other ILLC functions, including data messages related to the ATS generally, Direct Subscriber orders, ATS order priority, or counterparty information.
The BlockCross ATS consists of standalone hardware comprising dedicated servers (collectively the ''BlockCross System'') and software applications separate from the ILLC systems described above.
The connection between the Core Messaging System and the BlockCross System is limited. Instinet Trading Products, housed on the Core Messaging System may access the BlockCross ATS and, by extension, the BlockCross System through FIX connections, similar to any external market center. Additionally, BlockCross order and execution information are periodically copied onto the Core Messaging System, as further discussed below.
EMPLOYEES WITH ACCESS TO SUBSCRIBER CONFIDENTIAL TRADING INFORMATION: Instinet does not have any employees solely responsible for the ATS. The employees described in response to Part II, Item 6(a) have access to Subscriber confidential trading information. These employees are prohibited from sharing any Subscriber confidential trading information with persons not expressly permissioned to receive such information under Instinet policy, as described in Part II, Item 7(a) of this form.
BLOCKCROSS SYSTEMS WITH ACCESS TO DIRECT SUBSCRIBER CONFIDENTIAL TRADING INFORMATION: SUPPORT TOOLS: ILLC maintains support tools (i.e., applications) specific to BlockCross (the ''Support Tools'') designed to allow permissioned employees the ability to view certain types of data necessary to the performance of the employee's job function. Permissioned employees with access to the Support Tools may only access BlockCross data and cannot use the Support Tools to access data from other Instinet ATSs. As discussed below, ILLC grants employees access to the Support Tools necessary to perform their responsibilities and in line with ILLC's Regulation ATS WSPs.
ILLC may permission employees with full access to the Support Tools. Full access allows a permissioned employee to view and manage all data on the BlockCross System, including open orders in the ATS. Permissioned employees will also have the ability to cancel orders in BlockCross. Permissioned employees may also view each order's status (e.g. whether the order has been matched, exposed via the Subscriber IOI functionality, or has been routed out of the ATS via an Instinet Algorithm). Permissioned employees may also edit standing instructions on how the BlockCross System should handle each order that a Subscriber submits. Full access to the Support Tools is limited to personnel supporting the operations of the BlockCross System and compliance supervisory personnel. Employees responsible for operating the BlockCross System include Operations and Technology Personnel.
ILLC may also permission employees with read-only access to the Support Tools. Such employees can view all data described in the preceding paragraph, but they may not cancel orders or make any changes to standing instructions. Read-only access to the Support Tools is limited to Operations, Compliance, Technology, and ETP Personnel.
DESKTOP APPLICATION: The Desktop Application can transmit Subscribers' confidential trading information to the extent orders or trading interest is entered into the Front End or receives executions in BlockCross. Users with access to the Desktop Application may only access BlockCross data and cannot use the Desktop Application to access data from other Instinet ATSs.
ILLC may permission employees may with live access to the Desktop Application on a client-by-client basis. Such permissioned employees may view client orders, including open orders in the ATS specific to a given client. Permissioned employees may also view each order's status (e.g. whether the order has been matched, exposed via the Subscriber IOI functionality, or has been routed out of the ATS via an Instinet Algorithm). Technology and ETP Personnel responsible for customer support as well as Operations and compliance personnel may be permissioned, on a client-by-client basis, to access Subscribers' confidential trading information in this manner. Such personnel provide clients technology and order routing and execution support and, accordingly, are responsible for addressing Subscriber inquiries related to orders or trading interest that has been submitted to the Front End or has been executed in BlockCross. Sales and Trading Personnel may also be permissioned, on a client-by-client basis, to access the Desktop Application to provide order and execution support and analytics to clients who request it.
ILLC may permission employees may to access the Desktop Application on a post-execution basis, which allows a permissioned employee to view orders that have been executed in BlockCross, including the identity of the parties to each trade. Access to the post-execution view is limited to Technology and ETP Personnel responsible for customer support as well as Operations and compliance personnel. Sales and Trading Personnel may also be permissioned to access the Executions Support Tool to provide post-execution support and analytics to clients who request it.
PHYSICAL ACCESS: The data on the BlockCross System is accessible through direct access to the BlockCross System servers and databases. ILLC limits physical access to the BlockCross System servers and data bases to employees responsible for operating the system and further limits access to employees performing necessary IT functions. The BlockCross System servers and databases are housed in locked rooms requiring keycard access. Entry and exit is monitored via video surveillance.
CONNECTION TO ILLC SYSTEMS: Drop copies of BlockCross orders and executions are sent to the Core Messaging System at the end of each day in a single large batch file delivered after the close of trading. Each copy contains all relevant trade data for each order. BlockCross order information that has been drop copied to the Core Messaging System. However, the BlockCross System uses a dedicated FIX connection to transmit BlockCross execution information to the Core Messaging System, in real time, for the purposes of the clearance and settlement of transactions occurring in BlockCross.
ILLC SYSTEMS WITH ACCESS TO DIRECT SUBSCRIBER CONFIDENTIAL TRADING INFORMATION: ILLC data messages are periodically written to a database for storage and retention (the ''Core Database''). BlockCross orders and executions that have been copied to the Core Messaging System will also be written to the Core Database. This information includes both Direct and Indirect Subscriber order and execution information, as well as other ILLC data. Instinet maintains a Core Web Graphical User Interface (''Core Web GUI''), which allows a user to query the Core Database for the purposes of monitoring, reporting, and testing the Instinet systems and applications, including the ATS.
Access to the full Core Database via the Core Web GUI is limited to personnel supporting the operations of the Core Messaging System and related databases and compliance supervisory personnel. Employees responsible for operating the Core Messaging System include Operations and Technology Personnel and ETP Personnel whose responsibilities include the operation of the ATS. Members of the Liquidity Venues Team are permissioned to access Subscriber order and execution information. ATS data, including Direct and Indirect Subscriber order and execution information, is a subset of the data retained on the Core Web Database. ILLC personnel whose responsibilities include the operations of the ATS and related systems or its compliance with applicable rules, may be permissioned to access Subscriber order and execution information via the Core Web GUI. Other ILLC personnel may be permissioned for access to the Core Web GUI, but will be prevented from accessing Subscriber confidential trading information. ILLC reviews and permissions employees for access to the Core Web GUI in accordance with the policies and procedures outlined in Part II, Item 7(a) (ii) below.
ILLC limits physical access to its servers and databases to employees responsible for operating the system and generally further limits access to employees performing necessary IT functions. Instinet servers and databases are housed in locked rooms requiring keycard access. Entry and exit is monitored via video surveillance. ILLC reviews and permissions employees for physical access to Instinet's servers and databases in accordance with the policies and procedures outlined in Part II, Item 7(a) (ii) below.
As stated in response to Part II, Item 6, AWS provides cloud storage and retention of certain ILLC data. This information includes Direct and Indirect Subscriber order and execution information from the ILLC Core Messaging System, as well as other ILLC data. Initially, such information will be periodically transmitted to AWS for storage and retention in tandem with ILLC's internal Core Database. The purpose of this tandem transmission is to explore the feasibility of a third-party solution and replace the Core Database hardware and inhouse support tools described herein.
During this initial period, access to the Core Database will remain as described in this Part II, Item 7. Access to ILLC's data through AWS will be limited to Technology and Operations Personnel for the purpose of testing and implementing ILLC's transition to a third party solution for data storage and retention.
ILLC SYSTEMS WITH ACCESS TO INDIRECT SUBSCRIBER CONFIDENTIAL TRADING INFORMATION: The Newport OMS and Instinet Algorithms can transmit Subscribers' confidential trading information to the extent orders are managed by the Newport OMS or routed through an Instinet Algorithm. Data related to Indirect Subscriber orders managed by the Newport OMS or routed through an Instinet Algorithm is accessible through certain GUIs that can disseminate information regarding the destination market center for a given order (e.g., the ATS) and whether a previously routed order was executed or cancelled.
Through the Newport OMS, Technology and ETP Personnel who support the Instinet Algorithms or the OMS utilized may access real-time and post-trade Indirect Subscriber order and execution information routed or managed through the relevant strategy or OMS (Direct Subscriber order and execution information will not pass through an Instinet OMS or the Instinet Algorithm). Sales and Trading Personnel may also be permissioned, based on client coverage, to access real-time and post-trade order and execution via the Newport OMS. Note, certain members of the Electronic Sales Trading component group of the ILLC trading desk are considered client coverage for all clients utilizing the Instinet Algorithms.
The information available to such support or trading personnel is provided by systems supporting the relevant strategy or OMS and does not include information regarding an order's priority or status in the ATS or another market center. Information regarding ATS orders and executions that do not relate to the relevant strategy or were not managed by the OMS is not transmitted by these systems.
SUBSCRIBER CONFIDENTIAL TRADING INFORMATION SAFEGUARDS: ILLC requires permissioned logins to access Instinet Systems. Additionally, Instinet's global cyber security efforts, including measures to detect and prevent unauthorized access to Instinet systems, apply to ILLC and its affiliates, including the operation of the ATS. Relevant Principals and Supervisors must approve employee access to Instinet systems, including the ATS and the applications with the ability to access Subscriber confidential trading information outlined above.
SEPARATION: ILLC has implemented virtual information barriers to separate ATS data from other ILLC data and, in turn, separate personnel and systems with access to Subscriber confidential trading information from those not permitted to access such information.
ACCESS TO DIRECT SUBSCRIBER INFORMATION: Employees seeking to access the systems that may transmit or disseminate Direct Subscriber information (see above section titled Systems with Access to Direct Subscriber Confidential Trading Information) must receive approval from the ATS Operations Principal. In reviewing such requests, the ATS Operations Principal considers factors including the employee's current role and whether the employee performs a function related to the operations of the ATS and related systems or its compliance with applicable rules that requires access to Direct Subscriber information. An employee's request for access may be denied if, based on the ATS Operations Principal's review: (1) the employee's stated job function does not relate to the operations of the ATS and related systems or its compliance with applicable rules, (2) the employee has requested a type of permissioning (see below) that is too broad for the employee's stated job function, or (3) the employee can perform their stated duties without such access.
If an employee changes roles, the ATS Operations Principal will adjust the employee's access to appropriately reflect the employee's new role. Based on this review, the ATS Operations Principal or delegate may revoke, suspend, or modify access.
Decisions to approve access are subject to a periodic review pursuant to ILLC's Regulation ATS written supervisory procedures (''WSPs'') described below. On a monthly basis, the ATS Operations Principal or delegate conducts a review to confirm the appropriateness of user access to Subscriber confidential trading information, including verification that users whose roles have changed and/or, employees who have been inactive, transferred or terminated have their permissioned access modified accordingly. Based on this review, the ATS Operations Principal or delegate may revoke, suspend, or modify access.
ACCESS TO INDIRECT SUBSCRIBER INFORMATION: Employees seeking to access the systems that may transmit or disseminate Indirect Subscriber information (see above section entitled Systems with Access to Indirect Subscriber Confidential Trading Information) may be permissioned to do so on an as needed basis.
PERSONAL TRADING RESTRICTIONS: Instinet Incorporated maintains an Employee Investment Policy (the ''EIP'') which covers employees of all U.S. subsidiaries, and includes employees supporting the ATS. The EIP is designed to encourage long-term investments and prohibits employees from engaging in day-trading activities. Instinet prohibits all employees, including those with access to Subscriber confidential trading information, from trading based on non-public, or other confidential information.
The EIP requires employees to maintain EIP covered accounts at specified brokers that have agreed to provide Instinet daily trading information for employee personal accounts. EIP covered securities are subject to a 15-day holding period.
Prior to entering any trades in a personal account covered by the EIP, employees must enter a trade approval request via the Personal Trading Control Center (''PTCC'') tool and receive an approval from both their supervisor and PTCC group. The PTCC tool requires the employee to certify that the employee: (1) is not in possession of any material non-public information concerning the security or commodity the employee proposes to buy or sell; (2) does not know of a pending customer trade nor of a pending research report in the security or commodity; (3) is not engaging in personal trading activity that violates Instinet's policies and procedures, including the Code of Ethics, or any duties owed to Instinet or its clients; (4) has reviewed Instinet's restricted list and the proposed transaction is not on the restricted list; (5) has confirmed that the proposed transaction meets the holding period requirement; (6) agrees that the proposed transaction must be effected on the same day on which approval is given; and (7) has confirmed that the proposed transaction(s) does not involve the purchase of an initial public offering (IPO) or any other type of new equity issue.
In approving or denying such a request, supervisors may review the employee's trades for any unusual activity, possible front-running customer trades or research, or conflicts with any of Instinet's businesses.
In addition, supervisors consider whether transactions are appropriate, given the employee's economic status and investment experience and whether the transactions are of such a frequency that they may distract the employee from his or her responsibilities at Instinet. Separately, the Compliance Department reviews personal trades daily and consults with managers if irregularities are identified. Generally, if an approval for an employee trade is given, it remains in force for the trading day in which it was received. Once an employee receives written confirmation approving a covered transaction, the employee may enter a trade in that symbol. Employee supervisors review each employee's trading activity on a post trade basis and check for irregularities and potential red flags. In the event any irregularities or red flags are discovered, supervisors are to escalate the matter to Instinet management and the ILLC Chief Compliance Officer. Instinet, in its discretion, may take any action against an employee found to have violated the EIP, up to and including termination.
CONFIDENTIAL INFORMATION AND INSIDER TRADING: Instinet Incorporated maintains a policy regarding confidential information and insider trading which covers employees of all U.S. subsidiaries, including employees supporting the ATS.
Employees must not disclose any confidential information to anyone who is not authorized by Instinet to receive it pursuant to these policies and may not use such information, other than in the course of their employment and in connection with the performance of the duties for which access to such information has been granted. Accordingly, employees may not use confidential information to: (1) trade securities for their own accounts, accounts in which they have a direct or indirect beneficial interest, or accounts over which they can exercise control; or (2) advise relatives, friends, or other persons about possible securities transactions. Nor may employees authorize anyone else to disclose or use confidential information in a manner that would violate these prohibitions.
WRITTEN PROCEDURES: ILLC's Regulation ATS WSPs provide specific guidelines for the initial review and approval process, as well as the ongoing evaluation of, employee access to ATS data. Prior to granting any employee access to Instinet's systems, including the ATS and the applications with the ability to access Subscriber confidential trading information must review and document each employee's level and type of access requested, the role and responsibilities of the employee, and the purpose for which access was requested. On a monthly basis, employee access is reviewed by the ATS Supervisor to determine whether their level of access to Instinet's systems, including the ATS and the applications with the ability to access Subscriber confidential trading information remains appropriate. The ATS Supervisor must document each review and the changes made, if any, to employee access.
Periodically, the Internal Audit group reviews the ATS operations generally. Such reviews typically include testing the ATS WSPs, assessing the ATS Supervisor's review of employee access, and confirming that each review has been properly documented. |