You might need to run a regular report that shows which trades have violated buy and sell execution compliance when doing the following:
In order to execute this procedure in your environment, the following data, services, or apps are required:
The MiFID II best execution principle states that firms must "take all sufficient steps to obtain, when executing orders, the best possible result for their clients taking into account price, costs, speed, likelihood of execution and settlement, size, nature or any other consideration relevant to the execution of the order." You need to correlate trade logs with pricing databases to see if a trade met best execution for a buyer or if a lower price was found.
To optimize the search shown below, you should specify a time range. You may also need to adjust fields to match what is available in your data source.
- Run the following search:
|sourcetype=<buy and sell order data source>
|lookup <commodity reference data> _time, symbol OUTPUT exchangeA exchangeB exchangeC
|where (action="buy") AND (amount>exchangeA OR amount>exchangeB OR amount>exchangeC)
The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.
||sourcetype=<buy and sell order data source>||Search only buy and sell order data.|
||lookup <commodity reference data> _time, symbol OUTPUT exchangeA exchangeB exchangeC||
Look up all trade prices from exchanges for each symbol. Compare the trade price with an exchange price. If the exchange price is lower, it is a violation.
You may have a business service data source that pulls this information into your Splunk deployment.
||where (action="buy") AND (amount>exchangeA OR amount>exchangeB OR amount>exchangeC)||
Compare the trade price with an exchange price.
Change the action to "sell", if needed.
If the exchange price is lower, it is a violation, and violating best execution may result in penalties. Investigate to avoid future issues and run this compliance report on a regular basis.