Running a matching engine or using a venue: the risk trade-off

Control comes with responsibility

The matching code is rarely the decisive cost. The decision is whether the firm wants to own the rules and failure modes that determine how orders meet, or delegate those functions to a venue and operate within its rulebook.

An internal engine can support bespoke order types, pricing and routing, and can reduce reliance on an external venue's release schedule. It does not automatically make the operator an exchange. The legal classification depends on the instruments, counterparties, activity and jurisdiction. A broker should settle that perimeter with counsel and its regulator before committing to a design.

Using a venue shifts matching, market surveillance and much of the market structure burden to the operator of that venue. It does not remove the broker's duties around client orders, access controls, best execution, records or supervision. The boundary matters: responsibility for a control is not always transferred with the matching function.

Compare the whole operating bill

Typical market ranges below are indicative, in USD, and vary by asset class, jurisdiction, scale and service level. Annual staff costs assume fully loaded specialist roles.

Venue access charges can include connectivity and market data; transaction fees depend on product, volume and maker-taker tier. They are not audited figures for any named provider.

These ranges describe common planning estimates, not a like-for-like quote. An internal engine may still depend on external venues for price formation, hedging or liquidity. Model that routing and its fees separately. For broader infrastructure context, Trading Technology's coverage follows the platforms and providers behind broker operations.

Execution risk moves with the design

With an owned engine, the firm defines matching priority, order validation, cancel behaviour, price bands and handling of stale market data. Each rule must be specified, tested and explained to clients and supervisors. A change to price-time priority, for example, can alter who trades first even if the change appears operationally small.

With a venue, the broker must understand the venue's order types, throttles, auction states, reject codes and outage procedures. Routing logic needs to account for those rules. A broker that blindly retries rejected orders can create duplicate exposure or overwhelm a recovering session.

For either model, the control set should cover:

• Pre-trade credit, position and size limits, with clear ownership of limit updates.
• Self-trade prevention and controls for duplicate or conflicting orders.
• Price collars, stale-feed checks and defined behaviour when reference prices disappear.
• Immutable order and decision logs, with clocks synchronised well enough to reconstruct event order.
• Kill switches that stop new risk without preventing operators from cancelling or managing live orders.

A best-execution review should compare the chosen route with the alternatives available at the time, not simply record that an order reached a venue. Retain the inputs used by routing decisions, including price, available size, latency and rejection data.

Compliance follows the activity

Surveillance is not a feature that can be switched on after launch. An operator matching orders may need to detect manipulation patterns such as spoofing, layering, wash trading or coordinated activity, subject to the rules that apply in its market. A broker routing to venues still needs controls over client behaviour and suspicious order flow.

Define which system generates alerts, who reviews them, what evidence is retained and how cases escalate. Typical operational requirements include searchable order and execution records, role-based access, tamper-evident audit trails, documented surveillance scenarios and a process for tuning false positives. Keep raw events as well as derived alerts. A revised model or threshold should not erase the basis for an earlier decision.

Regulatory labels vary. Depending on jurisdiction and instrument, an internal crossing system may be treated differently from an exchange, multilateral trading facility or alternative trading system. Check licensing, reporting, market data, record-retention and business-continuity requirements before treating an engine as a private technical component.

Failure handling is part of the product

An engine must preserve a consistent book through process restarts, network splits and failover. A typical design uses replicated state, sequence numbers, idempotent order commands and replayable event logs. Test what happens when the primary node acknowledges an order but fails before the secondary has recorded it. The recovery process must not accept the order twice or lose its cancellation.

A venue connection has different failure paths: session resets, sequence gaps, stale books, throttling and venue halts. Set explicit thresholds for declaring a feed unusable, and define whether the router pauses, cancels resting orders or moves flow elsewhere. A secondary venue is not a real failover route unless its instruments, limits, liquidity and risk checks are ready.

Run recovery tests against realistic peak bursts, not average message rates. Many firms plan for several times normal peak traffic, then verify that surveillance, risk checks and audit capture keep pace with matching. Record recovery time and lost or duplicated messages as operational measures, not just engine throughput.

Use a decision checklist

Before choosing, put the operating assumptions in writing. A short checklist can expose where the apparent savings depend on an unowned control or an untested dependency:

1. Map the regulatory perimeter for each instrument, client type and jurisdiction.
2. Estimate total annual cost, including staffing, surveillance, connectivity, clearing, market data and on-call cover.
3. Specify order priority, rejects, cancellations, throttles, kill switches and market-data failure behaviour.
4. Assign named operational ownership for alerts, incidents, venue escalation and client communications.
5. Prove recovery and reconciliation with fault injection, peak-load tests and replay of production-shaped event streams.
6. Review the decision when volumes, products or jurisdictions change, since each can alter both economics and obligations.

An owned engine makes sense where control over matching is strategically necessary and the firm can sustain the operational and compliance function. A venue is usually simpler where access to established liquidity and rule governance outweighs control over the matching layer. Many brokers end up with both, and inherit the integration work between them.

In trading, every saved dependency tends to become an internal system to operate.

#best execution #trading infrastructure #broker compliance #matching engine costs #venue connectivity #execution risk controls #market surveillance #exchange integration