Annual System Audit for Stock Brokers — Type I, II & III Broker Classification Explained
SEBI's system audit framework categorises stock brokers into three types based on their technology usage, with different Terms of Reference and audit frequencies for each. The framework ensures that brokers using more complex technology infrastructure are subjected to more rigorous and frequent audits. This article explains the Type I, Type II, and Type III classification and the compliance obligations for each category.
The Regulatory Basis
SEBI Circular CIR/MRD/DMS/34/2013 dated November 6, 2013 prescribed the stock broker system audit framework and mandated stock exchanges to ensure conduct of system audit of its members as per the prescribed framework and monitor the same. The circular provides for a system audit framework for stock brokers / trading members including the system audit process, auditor selection norms and terms of reference.
The Three Categories of Stock Brokers
Type I Broker
Type I Brokers are those who trade through exchange-provided terminals such as NSE's NEAT, BSE's BOLT, MCX-SX's TWS, etc.. These brokers rely on the trading infrastructure provided directly by the exchange and do not use their own proprietary trading software or API-based systems.
Audit Frequency: Initially, Type I Brokers were required to conduct annual system audits. However, based on representations from stock exchanges, the Technical Advisory Committee (TAC) decided that such brokers may be exempted from system audit and the development of exchange-provided terminals be included in the scope of Annual System Audit of Exchanges.
Key Characteristics:
- Use exchange-provided terminals only.
- No proprietary trading software.
- No API-based trading systems.
- Typically smaller brokers with limited technology infrastructure.
Type II Broker
Type II Brokers are those who trade through API-based trading terminals like CTCL (Computer-to-Computer Link) or IML (Intermediate Messaging Layer) or IBT/DMA/STWT or SOR facility and who may also be TYPE I Brokers. These brokers use their own or third-party trading software to connect to the exchange.
Audit Frequency: Yearly.
Key Characteristics:
- Use CTCL / IML / IBT / DMA / STWT / SOR facilities.
- May also use exchange-provided terminals.
- Have proprietary or third-party trading software.
- Moderate technology infrastructure.
Terms of Reference (ToR): The ToR for Type II Brokers covers system controls and capabilities, software change management, risk management system, smart order routing, password security, session management, database security, network integrity, access controls, backup and recovery, BCP/DR, back office data, user management, IT infrastructure management, and software testing procedures.
Type III Broker
Type III Brokers are those who use Algorithmic Trading facility to trade and who may also be TYPE II Brokers. Algorithmic trading involves the use of automated execution logic to generate and route orders, which introduces additional technology risks.
Audit Frequency: Half-yearly.
Key Characteristics:
- Use algorithmic trading facilities.
- May also use CTCL / IML / IBT / DMA / STWT / SOR facilities.
- Advanced technology infrastructure.
- Higher risk profile due to automated trading.
Terms of Reference (ToR): The ToR for Type III Brokers covers all areas applicable to Type II Brokers, plus additional areas specific to algorithmic trading, including change management of approved algos, online risk management capability, risk parameters controls, information/data feed, checks for preventing loop or runaway situations, algo/co-location facility sub-letting, and audit trail for algorithmic orders.
Audit Frequency Summary
| Type | Description | Audit Frequency | Type I | Exchange-provided terminals only (NEAT, BOLT, TWS, etc.) | Exempted (covered in - Exchange audit) | Type II | CTCL / IML / IBT / DMA / STWT / SOR | Yearly | Type III | Algorithmic Trading | Half-yearly
Source: SEBI Circular CIR/MRD/DMS/34/2013 dated November 6, 2013
Auditor Qualification Requirements
For Type II and Type III Brokers, the system audit must be conducted by a system auditor who possesses any of the following certifications:
- CISA (Certified Information System Auditors) from ISACA.
- DISA (Post Qualification Certification in Information Systems Audit) from Institute of Chartered Accountants of India (ICAI).
- CISM (Certified Information Securities Manager) from ISACA.
- CISSP (Certified Information Systems Security Professional) from International Information Systems Security Certification Consortium (ISC)².
Reporting and Follow-up
- Submission: The audit report must be submitted to the stock exchange by the stock broker along with management comments, within one month of submission of report by the auditor.
- Corrective Action: For each non-conformity, specific time-bound corrective action must be taken and reported to the Stock Exchange within 3 months of submission of report.
- Follow-on Audit: If required, follow-on audit shall be scheduled within 6 months of submission of the audit report.
- Quarterly Tracking: Exchanges are instructed to keep track of findings of system audits of all brokers on a quarterly basis.
Common Pitfalls
- Misclassification. Incorrectly classifying the broker type can lead to wrong audit frequency and ToR application.
- Inadequate auditor qualifications. Using an auditor without the required certifications can lead to rejection of the audit report.
- Delayed corrective action. Failure to address audit findings within the prescribed timeline can lead to penalties.
- Non-submission of audit report. Failure to submit the audit report within the prescribed timeline is an event-based monitoring criterion.
How We Help
At Anuj Desai & Associates, we help stock brokers understand their system audit classification, select qualified system auditors, prepare for system audits, and ensure compliance with SEBI's requirements. If you need assistance with system audit compliance, reach out to our regulatory compliance desk.