Algorithmic trading has become a cornerstone of modern financial markets, driving efficiency, liquidity, and innovation. But as algorithms grow in complexity and speed, the risks associated with weak governance or insufficient testing have become increasingly significant. Although the review focused on Principal Trading Firms, its findings apply broadly to any firm that develops or deploys algorithmic trading strategies, particularly those subject to RTS 6 obligations.
While many firms demonstrate a solid understanding of their responsibilities, the FCA’s latest multi-firm review highlights persistent weaknesses in:
- Governance
- Testing
- Deployment
- Market abuse surveillance
These gaps raise critical questions about how firms manage risk and maintain market integrity in an increasingly automated environment.
Key findings from the FCA’s 2025 review
The FCA’s multi-firm review draws on both RTS 6, which sets a minimum compliance baseline, and the PRA’s SS5/18, which outlines prudential and operational expectations. By combining conduct, surveillance, and operational risk management, the FCA is effectively holding principal trading firms to standards comparable to those applied to PRA-regulated financial institutions.
The review uncovered a wide disparity in how firms approach algorithmic trading controls. While many firms showed a reasonable understanding of their regulatory obligations under RTS 6 and SS5/18, the depth, consistency, and rigour of implementation varied significantly across the sector.
Governance
- Some firms lacked formal governance and accountability, with outdated policies and unclear processes.
- Others addressed RTS 6 requirements comprehensively, but inconsistently — highlighting the need for thorough and regular compliance assessments.
- Firms that commissioned external audits of their self-assessments typically demonstrated strong technical expertise, maintained formalised compliance monitoring plans, and developed comprehensive algorithmic inventories outlining objectives, ownership, approval processes, and risk parameters.
Development and testing
- In some cases, development and testing processes lacked sophistication, with limited consideration of market scenarios and inadequate documentation.
- To prevent disorderly trading and mitigate conduct risks, firms must rigorously test algorithms before deployment. This includes embedding conduct risk assessments throughout the development lifecycle and adopting a structured approach to testing that reflects the complexity and potential impact of algorithmic strategies.
- Simulation testing proved critical for some firms, which committed meaningful resources to conducting thorough evaluations across a range of stress scenarios. These firms proactively selected stressed market data and continuously updated it with new events, helping ensure algorithms remained reliable and resilient under volatile market conditions.
Risk controls
- Firms must establish clear accountability for managing both pre-trade and post-trade controls, ensuring responsibilities are well-defined and understood across relevant teams.
- Compliance staff should have sufficient oversight and a deep understanding of how these controls operate to effectively monitor trading activity and respond to potential issues in real time.
- Some firms implemented pre-trade controls within their algorithmic trading systems, calibrated according to the type of algorithm and asset class. Embedded at the server level, these controls prevented order execution when thresholds were breached — helping maintain orderly trading and reduce risk.
Market abuse surveillance
- Many firms’ market surveillance systems were unable to keep pace with the scale and speed of their trading activities. This led to delays in investigating and closing market abuse alerts, placing pressure on resources and exposing firms to potential regulatory and reputational risks.
- By contrast, some firms customised their surveillance systems to better align with the nature and scale of their trading activities, enabling more effective monitoring of market abuse risks.
- These firms also established efficient procedures for handling alerts, supported by formal escalation policies and governance structures that ensured timely and consistent responses.
What firms should do next
The FCA’s findings deliver a clear message: algorithmic trading controls must evolve in line with the growing complexity of markets and technology. To meet regulatory expectations and safeguard market integrity, firms should focus on four key areas:
1. Governance must be active, not passive
Governance should be a dynamic process, actively maintained and embedded into the firm’s culture — not a box-ticking exercise.
Senior management and boards must take ownership of governance frameworks, ensuring they include clear accountability for algorithm ownership, risk classification, and testing history.
Management information should go beyond deployment logs to provide insights into performance, incidents, and control breaches, enabling effective oversight at the highest level.
2. Testing frameworks need urgent attention
A comprehensive testing lifecycle should include unit, integration, user acceptance, stress, and regression testing, using both historical and synthetic data. Simulation testing, which helps firms understand how algorithms behave under stress or volatile conditions, remains underdeveloped across much of the industry.
Deployment processes often lack clear ownership or sign-off protocols, and conduct risk assessments are rarely integrated into the testing lifecycle, leaving firms exposed to operational and reputational risks.
3. Surveillance must be tailored and integrated
The FCA found that many firms’ surveillance capabilities were not keeping pace with their trading operations, resulting in delays and inadequate alert handling. Firms should ensure that alert logic is calibrated and reviewed regularly, and that governance around alert investigation is formalised with clear escalation procedures. Adequate resourcing is essential to manage alert volumes effectively, and integration between first- and second-line surveillance functions is critical to ensure timely detection and response.
4. Booking models and cross-border oversight
Firms operating across multiple jurisdictions must be mindful of the risks associated with complex booking arrangements. These models should be transparent, aligned with risk, and subject to centralised governance. Without clear oversight, firms risk regulatory breaches and operational inconsistencies.
A call to act, not react
Ultimately, the FCA’s review is a call to act, not react. Strong algorithmic trading controls are essential to maintaining market integrity While many firms are making progress, there is still work to be done to achieve consistent, high-quality compliance across the sector.
By addressing these issues now, firms can not only meet regulatory expectations but also build more resilient and trustworthy trading operations.
If you’d like to discuss further how to support your firm in strengthening its algorithmic trading controls, contact Kantilal Pithia or Paul Young.
