Starting a forex brokerage: the technology

A brokerage is a technology business that happens to be regulated. Its clients never see its office; they see the platform, the client area and the speed at which money moves. This part lists every system a brokerage needs, in two groups: what the clients touch and what connects the brokerage to the market. It ends with the standards regulators expect a trading system to meet.

What the client touches

The website

Ten to fifteen pages, written to answer the questions a trader has before opening an account: the instruments, the account types, the spreads and swaps, the regulation, the deposit and withdrawal methods, the risk warning. The website is the first thing a regulator and a payment provider review, so its terms, its risk disclosure and its licence details must match the application.

The client area (trader room)

The portal where a client registers, verifies identity, opens live and demo accounts, deposits, withdraws, moves money between accounts, downloads the platform and opens a support ticket. Identity verification, deposit limits and the audit trail of every money movement live here; it is the heart of the brokerage's compliance.

The CRM

The sales and support desk's view of every lead and client: where they came from, what they did, who spoke to them and what was promised. A brokerage without a CRM cannot run a sales team or a retention programme, and cannot prove to a regulator how it treated a client.

The partner (IB and affiliate) system

Introducing brokers and affiliates bring a large share of a retail brokerage's clients in exchange for a commission on volume or a payment per client. The partner system tracks referrals, calculates commissions down to several levels, and pays them. It is the brokerage's most effective acquisition channel and it needs to be auditable.

The trading platform

The software the client trades on: charts, orders, positions and account history. A brokerage licenses it from a platform provider rather than building it; MetaTrader 5 remains the most widely used, with cTrader, DXtrade, Match-Trader and others competing on execution, mobile apps and licensing terms. A white label of an existing broker's platform is the lower-cost way in; a full server licence is the independent one.

What connects the brokerage to the market

• The platform server: the broker-side half of the platform, hosted in a data centre close to the liquidity provider's, with a backup. It holds the accounts, prices and orders.
• The bridge or aggregator: the software between the platform server and the liquidity providers. It sends A-booked orders out for execution, feeds prices back and lets the broker switch providers, add markups and set which client groups are passed through.
• The FIX connection: the industry's protocol for orders and prices. Liquidity providers quote and execute over FIX; the bridge speaks it on the brokerage's behalf.
• The liquidity provider: a prime of prime or a bank that quotes the prices and executes the A-booked flow under a liquidity agreement, against a deposit.
• The risk engine: for a dealing desk or a hybrid, the software that watches exposure by client, instrument and book, and moves flow between the books or hedges it.
• Payment integrations: the gateway and the payment providers connected to the client area, so deposits arrive and withdrawals leave through cards, bank transfers and local methods.

The standards a trading system has to meet

The following checklist comes from the standards regulators set for electronic trading systems; the United States' National Futures Association wrote the clearest version, and every serious regulator expects the same. Run your platform against it before you apply for a licence.

1. Security

• Authentication: verify and test every method clients and staff use to log in, including two-factor authentication.
• Encryption: every connection between client, platform and server encrypted, and tested.
• Authorisation: access rights by role, so that a sales agent cannot touch a trade and a dealer cannot touch a withdrawal.
• Testing: penetration tests, password-strength checks and physical security at the data centre, with written procedures and trained staff.

2. Capacity

• Written procedures for timely order handling and execution, and for complaints about either.
• Capacity reviews at least once a year and whenever volume is expected to rise, with a stress test before launch.
• Disaster recovery and redundancy: a backup server, a plan for an outage, and a way to accept orders by phone if the system is down.
• Advance disclosure to clients of what can affect performance and how to reach the brokerage during an outage.
• Prompt notice of operational problems: on the website, by email and message, and by a recorded line.

3. Credit and risk controls

• Written procedures that stop clients entering trades beyond their equity or the brokerage's limits.
• Account controls that block orders over pre-set limits by equity, currency, size and order type, automatically.
• System controls that flag anomalies and patterns that suggest a malfunction.
• Monitoring of the brokerage's own positions, and of what a market move would do to its capital.

4. Record keeping

• Every order and account event recorded and kept for the period the regulator sets.
• Profit-and-loss reports by client, monthly and yearly, realised and unrealised, sortable by the person who introduced or manages the account.
• Daily trade reports: orders, executions, money managers, price adjustments and unusual events such as outages or fast markets.
• Month-end reports of the number and size of transactions for assessment fees where they apply.

5. Trade integrity

• Pricing: bids and offers that track the market, and spreads that stay as advertised unless the market is volatile.
• Slippage: based on real market conditions, symmetric, and rarer in stable pairs than in volatile ones.
• Settlement and rollovers: uniform settlement prices and a written policy for how overnight charges are calculated, naming the sources.

6. Periodic review

At least once a year, review the system's security, its risk controls, its records and its fairness of execution; write up the findings and the corrective actions; report them to senior management and the compliance officer; and keep the report for the regulator.

What comes next

Part 4 turns to the licence: where brokers apply, what the regulators ask for and how the tiers compare. The technology decisions here feed straight into that application, because the regulator reviews the platform, the bridge and the risk controls as part of it.