FCA Multi-Firm Review of Algorithmic Trading Controls: What it Says, Why it Matters, and What Firms Should Do Now

On 21 August 2025, the Financial Conduct Authority (FCA) published the results of its Multi-Firm Review of Algorithmic Trading Controls. The findings set out how principal trading firms (PTFs) are currently complying with the UK’s regulatory framework for algorithmic trading.

While the FCA made clear that this publication does not introduce new rules, the tone of the review is unambiguous: firms should expect ongoing supervisory scrutiny and be ready to demonstrate compliance with MiFID II RTS 6 (onshored in the UK) and related MAR 7A Handbook provisions.

This review builds on the FCA’s earlier 2018 work and reflects growing regulatory concern that weaknesses in algo systems could undermine market integrity, investor protection, and operational resilience—especially as firms experiment with AI-driven trading strategies.

Who Needs to Pay Attention?

• Principal Trading Firms (PTFs) and any firms developing or deploying algorithmic trading strategies (including those relying on vendor algos).

• Senior Managers under SMCR, particularly those responsible for trading, risk, technology, and compliance.

• Boards and risk committees, given the FCA’s emphasis on governance and oversight.

The Regulatory Framework in Brief

Firms engaged in algo trading must comply with UK on shored RTS 6 (originally Commission Delegated Regulation (EU) 2017/589). Key obligations include:

• Annual self-assessments validated and reviewed by senior management (Article 9).

• Conformance testing with venues and brokers offering direct electronic access (Article 6).

• Simulation and stress testing under extreme but plausible market conditions (Article 10).

• Effective kill switches for immediate order withdrawal (Article 12).

These sit alongside FCA MAR 7A, which sets conduct standards for algo trading, DEA, and market-making, including surveillance obligations aligned with the UK’s Market Abuse Regulation.

What the FCA Found

Governance & Oversight

• Improved but uneven: some firms had robust self-assessments; others relied on outdated or incomplete documentation.

• Compliance capability varied: in strong firms, compliance could challenge algo design and deployment. In weaker firms, involvement was superficial.

• Algorithm inventories: best practice included detailed, integrated inventories; weaker firms held sparse, incomplete records.

Development & Testing

• Conformance testing: often done, but with variable rigour. Strong firms documented and exceeded venue requirements.

• Stress testing: robust firms integrated realistic scenarios, including recent volatility. Others applied narrow tests or lacked documentation.

• Deployment governance: most had sign-off and cautious rollouts, but some operated with outdated policies or unclear ownership.

Risk Controls

• Pre-trade controls were common and often well-calibrated. Server gateway controls were praised. However, responsibilities were not always clearly documented.

Market Abuse Surveillance

• Best practice: tailored surveillance aligned with a Market Abuse Risk Assessment (MARA), frequent calibration, and strong QA (e.g., random alert sampling).

• Weak practice: generic, under-resourced systems. Some firms tasked only a handful of staff with processing huge alert volumes.

Why This Matters

1. Supervisory Priority – Algo trading remains firmly on the FCA’s radar. Attestations have already been demanded from some firms.

2. Senior Management Accountability – Boards and SMFs must own algo governance, not just risk and compliance teams.

3. Broader Themes – Algo trading failures tie directly into operational resilience, AI oversight, and market abuse detection.

   
   

What Firms Should Do Now

We suggest a 90-day response cycle:

Immediate (0–30 days):

• Present the FCA publication and latest RTS 6 self-assessment to the board or risk committee.

• Confirm assessments are up-to-date, complete, and independently validated.

Next 60 days:

• Review testing frameworks: ensure conformance testing is repeatable and documented.

• Refresh stress scenarios to include recent market disruption.

• Confirm deployment governance: clear ownership, escalation, and sign-off paths.

By 90 days:

• Run and document kill-switch drills.

• Assess whether surveillance systems are adequately resourced and quality-assured.

• Train compliance teams to build technical understanding of algo design and operation.

• Review vendor contracts for testing rights and transparency into algo design.

Our View

The FCA’s August 2025 review is not about new rules—it is about raising the bar on expectations. For algo-trading firms, the message is clear:

• Maintain robust controls,

• Keep documentation current and comprehensive, and

• Ensure active governance from board to front office.

Those that treat this as a “compliance-only” exercise risk falling behind. Those that embed good practice into governance, testing, and surveillance will not only reduce regulatory risk but also strengthen resilience and protect market integrity.