The key to preferential access
A forensic report of NSE’s co-location facility (COLO) by Deloitte Touche Tohmatsu shows preferential access by brokers, like OPG Securities, to the exchange trading system ahead of other members. The report suggests that this was done with the active involvement of NSE brass.
For the express purpose of transparency and to highlight malfeasance in the functioning of the National Stock Exchange (NSE), we have decided to put out excerpts from the report by Deloitte in the public interest.
Co-location or co-hosting is a service offered by stock exchanges to their brokers/ members to locate their trading systems within the stock exchange’s premises. A significant order flow of NSE now passes through the co-location facility especially for Algorithmic Trading and Direct Market Access (DMA). The concept of co-location brings members’ systems closer to the exchange trading systems to meet the requirements of lower latencies and faster execution, particularly relevant to market participants who deploy latency sensitive strategies, such as high-frequency/ algorithmic traders and market makers. NSE launched its co-location facility in January 2010, which allowed members to rent rack space with low latency connectivity to the exchange with the mandatory power supply, cooling and security requirements of the industry.
The Deloitte report said that SEBI received certain complaints pertaining to NSE’s co-location facility, and in particular the TBT (tick by tick) dissemination system, which were forwarded to NSE for clarification in early 2015. SEBI advised NSE to examine the issues highlighted and furnish a report to SEBI after placing the same before the Standing Committee on Technology (SCT-NSE).
Why Deloitte was appointed:
Deloitte was appointed by the Board of NSE to examine the following with respect to the F&O (futures and options) segment:
n whether norms of fair access were breached, and
n whether some brokers were unduly benefited
n if so, whether this was because of any collusion/ misconduct by NSE employees (where possible)
Excerpts from the observations from the Deloitte review are detailed below.
Key observations:
The architecture of the TBT system was prone to manipulation
Review of TBT system architecture indicated data was disseminated to members in a sequential manner whereby the member who connected first to the POP server received the ticks (market feed) before the members who connected later. Hence, the system architecture of the TCP based TBT system was prone to manipulation. Our analyses highlighted trends for certain periods whereby members such as OPG Securities, Universal Stock Brokers Private Limited, and NYCE Securities & Derivatives appeared to be the first to connect to specific servers significantly more than the others.
Potential preferential treatment to certain members in terms of IP allocations and movements from one server to another:
In the course of our review, we also saw indications of potential preferential treatment to few members. During our discussions with the NSE team, we were made to understand that a sequential method of allocation of new IPs (internet protocol) across ports on existing servers was followed. It was stated by the NSE IT team that when the new servers were introduced in 2012, none of the IPs mapped to the existing servers were migrated to these. However, we reviewed certain emails which indicated that some IPs of a few members who had multiple connections were distributed to TBTCOLO (COLO is for co-location facilities) when it was introduced in January 2012.
Potential preferential access to multiple dissemination servers with regard to OPG Securities:
In our review, we came across an email where OPG wrote to Jagdish Joshi (Project Manager, COLO Support), requesting to be moved to a different TBT server, citing performance degradation. The email was only sent to Jagdish and not to COLO Support, the team tasked with handling members’ queries. Jagdish instructed the COLO Support team to move four of their IPs to a different server.
Despite resistance from the COLO Support team citing that there was neither proof of performance degradation nor approvals, Jagdish appears to insist that this was to be done in order to ‘mitigate risk’ by spreading the member’ IPs across all servers. Eventually, the PSM team deactivated IPs of another member which were mapped to the target server in order to accommodate the four OPG IPs on the server. Our analysis of server logs also indicated that after these IPs were migrated, OPG were successful in frequently establishing first five connections on this server.
Following are the key events to consider in this regard:
l Aman Kokrady of OPG addressed an email to Jagdish Joshi on February 13, 2012, stating that they were experiencing performance degradation on four IPs, and requesting to move them to a different TBT server. The email also stated that they would like to connect to the secondary server for those IPs so that they could check out performance issues if any, due to the ‘TBT sequence’. The COLO Support mailbox was not copied on the mail, who as per protocol handle members’ issues.
l On February 14, 2012, Jagdish Joshi forwarded this email to the PSM team with Mahesh Soparkar (then ASVP, Projects), Avadhut Gharat (Project Manager, COLO Support) and the COLO Support team in copy, requesting them to move the four IPs to ‘Server 23’. Sunny Sachdev of the PSM team replied to this on the same day, stating that they had clear instructions to not move any clients to other TBT servers without appropriate justification and approvals. He further requested Jagdish to ask the client to send across evidence of performance degradation 15.
l Jagdish responded to Sunny stating that since OPG had 20 IPs, they needed to be spread across all servers to ‘minimize the risk’. He went on to say that since OPG were currently on three servers in the FO segment after these four IPs are moved, the member would be equally distributed across all servers and the risk would be minimized.
l Sunny Sachdev responded to Jagdish Joshi, stating that a redistribution process for members with multiple IPs was underway, however in this case the client claimed performance degradation issues whereas that was not the case. He concluded that further requests to shift clients to other servers would not be entertained.
l We observed an email from Abhishek Soni (PSM) dated February 17, 2012 in response to all in the trailing email, stating that in order to create space on server 23, other IPs would need to be removed. He listed out six IPs of Open Futures stating that those IPs were currently logged into Server 26, and he would disable them from 23 at the end of the day18. From further communication, it appears that the Open Futures IPs were deactivated from Server 23, and the OPG IPs were accommodated on the server19.
l After this incident, on February 21, 2012, Sanjay Gupta of OPG Securities wrote to Jagdish Joshi, Mahesh Soparkar and Avadhut Gharat, thanking them and their teams for the excellent support in terms of prompt response as well as useful advice that helps them make their operations more efficient.
l Our analysis of server logs for the four OPG IPs migrated to Server 23 revealed that while three of IPs had been in use by OPG since October 2011, the number of first five connects to the server established by these IPs increased dramatically after they were migrated to Server 23.
l The immediate response to OPG’s request by Jagdish Joshi seems to contrast with the responsiveness received by other members, for example, Barclays Capital raised some queries on December 29, 2011 and followed up on January 30, 2012 since they had still not received a response. Jagdish Joshi then suggested a call, and missed the call both times that Barclays organized with them. The call was eventually held and the issue was resolved by moving an IP of the member to another server after a month of the member reaching out for assistance.
l The responsiveness to OPG’s request contrasts with the response time for Adroit Financial when they raised an issue pertaining to slow TBT feed on the new server to which they were allotted.
l It appears that there were instructions at various points of time on circumstances under which members could be moved from one server to another. We observed an instance in June 2013 when Pace Stock Broking specifically mentioned that TBT feed on a particular server and port was better than other servers, and requested to move their IP to such port. However this was denied by Jimish Kadakia of the PSM team who stated “We don’t change parameters on member request”.
Member(s) connecting first, second and third
Forensic Data Analysis38 on FO TBT server Market Data logs indicate that OPG securities was connecting first, second and third to this server for most part of the period January 2012 to May 2014. As per the attachment from Abhishek Soni’s email on 9 January 2012, OPG securities had six IPs assigned to port 10990 on TBT server It should be noted that while CNB Finwiz had ten IPs mapped to port 10990 on this server, OPG still had more first, second and third connections that CNB Finwiz. In the absence of availability of any logs or records related to how the initial connections each day was initiated, we are not able to comment whether this was coincidence, or if there was any manual intervention at any point.
However, this does indicate that member(s) having multiple logins to a single disseminating server through multiple IPs assigned could gain advantage by logging in first, second and third since flow of tick-by- tick data was sequential as per its architecture.
Preferential access to backup servers
We observed an email dated 8 August, 2012, whereby OPG wrote to Jagdish Joshi requesting to connect to the secondary TBT server for a few days for some analysis. The COLO Support team provided a confirmation to the member on 10 August, 2012 that the member was enabled on the secondary server for one week. This email trail indicates that there was a period when NSE had implemented some controls whereby the member could not connect to the secondary server without being enabled on the server by the NSE team. However, this information was not provided to us by the NSE team. Our analysis of the server logs for the fallback server (Server 27) revealed that OPG were connected on the fallback server with effect from 10 August 2012 till at least 31 August 2012, during which period they consistently established the first connection to the server.
It is pertinent to note that the logs for Server 27 evidence that with effect from 10 December 2012, barring seven days, OPG were the first to connect to Server 27 in all instances until 30 May 2014, i.e., a total of 357 days out of 364 consecutive days65. During these 364 days, we further observed that OPG established first, second and third connect on Server 27 on 34 days, two of first three connects on 314 days, and one of the first three connects on 15 days66. Since the previous mail trail discussed above indicates that in mid-2012 members had to be enabled on the secondary server by NSE to connect thereto, it appears that either this process was done away with, or that OPG were granted access to Server 27 by the NSE team, which allowed them to consistently logon first on this server. We have not come across any communication in this regard in December 2012.