Complying with the Markets in Financial Instruments Directive II

MiFID II time drift

The MiFID II best execution principle states that firms must "take all sufficient steps to obtain, when executing orders, the best possible result for their clients taking into account price, costs, speed, likelihood of execution and settlement, size, nature or any other consideration relevant to the execution of the order." Hosts that have a large time drift may effect best execution. You need to monitor for time drift.

Use a script to contact an NTP server on a host every N minutes and capture the results to a file. A script such as echo `sntp time_server` `hostname` might be enough.

|lookup <NTP data by host>
|sort - date
|where drift<-0.1 OR drift>+0.1

MiFID II time drift impact on buy and sell orders

Hosts that have a large time drift may have business impact on buy and sell orders. You want to see any impacted transactions by listing out the volume and monetary amount that was recorded on that host at the time of intolerable time drifting.

Use a script to contact an NTP server on a host every N minutes and capture the results to a file. A script such as echo `sntp time_server` `hostname` might be enough.

|lookup <NTP data by host>
|sort - date
|where drift<-0.1 OR drift>+0.1
|lookup <transaction data lookup file> host, date
|table date, host, drift, amount, volume
|eval amount=tostring(round(amount, 2),"commas")

MiFID II best execution buy and sell violations

The MiFID II best execution principle states that firms must "take all sufficient steps to obtain, when executing orders, the best possible result for their clients taking into account price, costs, speed, likelihood of execution and settlement, size, nature or any other consideration relevant to the execution of the order." You need to correlate trade logs with pricing databases to see if a trade met best execution for a buyer or if a lower price was found. If the exchange price is lower, it is a violation, and violating best execution may result in penalties.

|sourcetype=<buy and sell order data source>
|lookup <commodity reference data> _time, symbol OUTPUT exchangeA exchangeB exchangeC
|where (action="buy") AND (amount>exchangeA OR amount>exchangeB OR amount>exchangeC)