RISKS DISCLOSED TO THE CLIENTS

• These regulations shall be called “Internet Trading Regulations” of the Pakistan Stock Exchange Limited.
• These Regulations shall apply to all the TREC Holders, their Authorized Representatives and the facilities or services established by the Members for providing Internet Based Trading Services in the securities listed on the Pakistan Stock Exchange Limited.
• These Regulations shall come into force on publication in the Official Gazette of Pakistan.
• Members already engaged in providing Internet Based Trading Services, shall evidence their compliance with all requirements of these regulations to the Pakistan Stock Exchange Limited within six months from the date of gazette notification of these Regulations.

• “Board” means the Board of Directors of the Exchange;
• “Broker” means any Member of the Exchange engaged in the business of executing transactions in securities for the account of others and for his own account and is registered with the Commission under the Brokers and Agents Registration Rules, 2001;
• “Commission” means the Securities and Exchange Commission of Pakistan;
• “Configuration Management” means a process in which the service provider has to undertake a change or add new functionality to the system or the infrastructure;
• “Exchange” means the Pakistan Stock Exchange Limited;
• “Internet Based Trading Services” means services associated with internet based trading for the purpose of routing orders to KATS through an automated order routing system as provided for under these regulations;
• “KATS or Karachi Automated Trading System” means the securities automated trading system introduced by the Exchange;
• “Member” means a Member of the Exchange; and
  • “Operational Capacity” means the number of clients supported by the solution and infrastructure, usually assessed by the number of parallel requests served per seconds.

The Hours of Operation for Internet Trading through KATS shall be notified from time to time by the Exchange with the approval of the Board.

The above procedures should be in writing and made available on the Member’s website for easy access by the clients.

• have minimum net worth of Rs. 25 million as per the latest audited financial statements;
• have adequate infrastructure including functional website, internal control procedures and technological and human resources to facilitate the operations of IBTS in an effective and efficient manner on an ongoing basis;
• have well-defined procedures for allowing clients’ access to IBTS which shall inter-alia cover the following aspects:
  • Agreement with the Broker;
  • Assigning of trading limits;
  • Placement and execution of clients’ orders;
  • Mode and timing of reporting of trade confirmation to the clients;
  • Margin requirement (Initial, maintenance and other applicable margins) and margin calls;

• The Broker desirous of providing IBTS may submit an application to the Exchange to provide IBTS in the format as may be prescribed by the Exchange from time to time for seeking formal permission. The Broker shall also provide further information or documents as and when required for disposal of the application.
• The Broker shall undertake all the certification procedures as specified by the Exchange from time to time. A completion certificate shall also be submitted to the Exchange prior to the commencement of IBTS which may be scrutinized by the Exchange as and when deemed appropriate in accordance with its procedures.
• Upon completion of the certification requirement by a Member who also fulfills the above eligibility conditions, the Exchange shall, in writing either grant approval or reject the application as the case may be, within 30 calendar days of the date of submission of the application to the Exchange.
• The Broker may after obtaining permission for installation and maintenance of the system for IBTS, deposit the requisite fees with the Exchange. The Exchange shall decide the amount of the installation and maintenance fees from time to time.
• The Exchange shall display the list of Brokers eligible for providing IBTS on its website and update the same upon any addition and/or deletion therein.

In addition to the above, the Broker shall also disclose to clients the information relating to UIS Services of NCCPL and SMS, IVR and Investor Account services of CDC.

• The Broker shall have an agreement with the client to whom it offers IBTS, which would contain appropriate disclosures highlighting the risks associated with internet trading.
• The Broker shall have appropriate arrangements in place to assess a client’s suitability to undertake internet based trading and have sufficient and verifiable information of each client for risk evaluation purposes.
• The Broker providing IBTS shall provide access to the clients on all the applicable rules, regulations, guidelines of the Exchange and Commission, information regarding the rights and obligations of the investors and the Broker; investor’s guides issued by the Exchange and the Commission, relevant legal provisions for investor protection and the complaint handling and arbitration procedures.
• The Broker shall disclose to its clients availing IBTS the Service Level Agreements and the infrastructure provided by the third-party vendor, if any.
• The Broker shall keep in record for the period of at-least five years all IBTS information relating to client orders and communications with the clients along with proper security measures to prevent such record from any potential misuse.

• Satisfactory arrangements are in place so that it can at all times uniquely identify each and every order during the different stages of processing.
• Orders placed through its systems are fairly allocated in accordance with the rules /regulations /procedures of the Exchange.
• Effective audit trail is maintained to address risks arising from:
  • the opening, modification or closing of a client account;
  • Any transaction with significant financial consequences;
  • Any authorization granted to a client to exceed a limit;
  • Any granting, modification or revocation of systems access rights or privileges.
• Adequate risk management systems are in place for controlling product-wise trading limits and exposure of clients availing IBTS. The system shall be capable of monitoring trading activities of such clients in leverage and derivative products offered through IBTS.
• Internet trading system is capable of assessing the risk of the client on real-time basis at order entry level. The client shall be informed of acceptance/rejection of the order instantaneously. In case an order is rejected due to the system based controls because of client having exceeded limits etc., the system may allow a review and release facility for enabling the order to pass through.
• Provision of user manual of IBTS containing complete system and interfaces documentation on its website.
• System based reports on margin requirements; payment and delivery obligations etc. are disseminated to the client in a timely manner.
• Any error or omission in the system shall not indemnify the Broker from the responsibility of settling any trade.

• The internet trading system is in compliance with the information security policy of the Exchange and the service provider/broker.
• The encryption technology applies for all client orders entered into the system and for all other confidential information the system is capable to uniquely identify each client of the Broker. For this purpose, appropriate technical and administrative controls are also implemented to protect the clients against identity theft and related compromises.
• Firewalls are in place to prevent intrusions by unauthorized persons. The firewall policy shall be adequately defined, maintained and reviewed periodically.
• The system is configurable to allow auto-logoff in case of inactivity of the trading terminal and/or the trading website.
• Implementation of first and second level passwords and PIN requirement at order placement level are implemented.
• Functionality of automatic expiry of passwords at the end of a reasonable duration and re-initialization of access on entering fresh passwords are implemented.
• All transaction logs with proper audit facilities are maintained in the system.
• Appropriate technical controls are in place against:
  • Presentation of incorrect data, intentionally or malevolently;
  • False presentation or the use of incomplete information for transactions;
  • Manipulation of any data;
  • Viruses/Malware, leading to any loss of data, unauthorized access to data, or threat of unavailability of systems;
  • Cyber extortion (distributed denial of services/distributed agent-based attacks).

• The Broker providing IBTS shall ensure that its Operational Capacity is evaluated regularly and that it maintains the log of evidences of such activities which shall include but not be limited to the following:
  • Details of the procedures for undertaking such an evaluation;
  • The time at which such evaluation is undertaken;
  • A copy of the results of such evaluation.
  • The Broker providing IBTS shall continuously update and enhance the Operational Capacity in line with the increasing quantum of trades being generated through IBTS.

• Availability of the service in the following events:
  • Website is not accessible thereby barring from trading, receiving or providing information;
  • Particular section(s) of the website are not accessible due to either denial of service or lack of capacity or inability of the service providers to provide timely access to website;
• Satisfactory alternative arrangements and contingency plans are in place to make sure that IBTS can continue in the event of a large-scale disruption (Disaster Recovery Planning/Business Continuity Planning).
• Appropriate arrangements are in place where disruption of service is witnessed on the part of vendor.
• Information regarding any disruption in the online trading services either on part of the Broker or the third-party vendor, is immediately disclosed on its website and to its clients.

• Number of users of the system as at the end of the month;
• Daily average number of transactions (of all types) processed by the system during the month and the highest number of transactions processed by the system on a single day during the month;
• Percentage of the scheduled time for availability for which the service was not available;
• Number of incidences in which the system remained partially or fully inaccessible for trading
• Reason for non-availability, if any; and
• System modifications, if any, and its impact on the existing services.

• The Broker shall ensure that its IBTS systems, controls and procedures are audited and penetration tested independently, once in every two years, by an audit firm approved by the Exchange.
• The Broker shall submit report of the auditor to the Exchange within two months of the date of the close of its periodic vulnerability assessment, if not assessed by the Exchange itself.

• The Broker providing IBTS shall ensure that its website contains following information in plain English and Urdu language and in an easily accessible form:
  • A basic explanation of securities trading; including definitions of common terms used on the trading screen;
  • A general statement and information regarding the manner, in which orders are accepted, processed, settled and cleared via the internet;
  • Disclosure of various risks of securities trading, including the risk of systems outages and failures and any alternative means of placing orders;
  • Procedures to cancel pending orders during a system failure;
  • Rules and regulations affecting inter alia client broker relationship, arbitration procedures and any other useful information from the perspective of investor protection;
  • Hyperlink to the websites/page on the websites of the Exchange and the Commission displaying relevant rules, regulations, guidelines of the Exchange and Commission, information regarding the rights and obligations of the investors and the Broker; investor’s guidelines issued by the Exchange and the Commission, relevant legal provisions for investor protection and the complaint handling and arbitration procedures etc.
  • Hyperlink to the websites/page on the websites showing information relating to UIS Services of NCCPL and SMS, IVR and Investor Account services of CDC.
• The Broker providing IBTS shall ensure that the ticker/quote/order book displayed on its website displays the time stamp as well as the source of information against any given information.
• The Exchange shall have system available to ensure on real time basis that all the information as prescribed under these regulations are properly disclosed and updated from time to time by the Broker on its website.

• The Exchange shall assess the effectiveness of systems and processes of the Broker providing IBTS in accordance with the procedures devised from time to time and approved by the Board.
• The Exchange may suspend the Internet Trading Certificate of a Broker if it violates any of the regulations, and such suspension shall continue until and unless the Broker complies with the regulations it has violated or removes the cause of suspension in the manner as prescribed by the Exchange.
• The Broker may appeal to the Exchange for the revival of the Internet Trading Certificate.