1. Kaskad Technology Korrelera for Market Surveillance Candyce Edelen November 8, 2006

2. Slide 2November 8, 2006 Kaskad Technology The Problem  Impacts entire industry  Industry under extreme pressure to comply  Forcing changes in compliance and surveillance  Ever increasing market data volumes  Traditional database approaches ineffective  Batch-based processing not fast enough

3. Slide 3November 8, 2006 Kaskad Technology The Solution  Event stream processing engine  Handles data at line speed  Identifies events of interest  Creates events for further processing  Complex processing on in-flight messages  Detect trading patterns  Apply surveillance logic  Send alerts when violations are detected  Analyst workstation  Review alerts  Query data  Validate exceptions  Inject events  Operations dashboard  Monitor performance  Configure system  Start/stop components  Promote/demote RuleBots

4. Slide 4November 8, 2006 Kaskad Technology System Design  OnRamps  Adaptors consume data and publish to streams  High Speed Message Bus  Supports distributed system  Plug and play environment  Query Processing Elements  Perform primitive functions  Produce new streams  RuleBots  Business logic  Complex algorithms and pattern detection  Scanning forwards and backwards in stream  Looking for triggering events, precedents, and antecedents  OffRamps  Deliver data to downstream systems  Queuing and data management

5. Slide 5November 8, 2006 Kaskad Technology Korrelera Architecture

6. Slide 6November 8, 2006 Kaskad Technology Event Sources  Time-ordered event streams  18 event types from 28 unique sources  Streams  SIP/SIAC Quotes Prints Summaries  Internal Trading System Orders Trades Administrative messages Corporate actions

7. Slide 7November 8, 2006 Kaskad Technology Event Processing  Declarative rules using C++ and Python  Event correlation – trades with prints, orders, and quotes  Scanning backwards and forwards in a stream  Event validity  Event aggregation  Specialized streams produced by QPEs:  Transforming lower level data to higher level events  Enhanced NBBO stream  Enhanced tick stream  Quote montages

8. Slide 8November 8, 2006 Kaskad Technology Types of logic  Sample RuleBots  Trade Through – quote validity, exemption process  Short sales – dual tick tests  Wash sales – pattern detection  Front running – pattern matching  Unusual activity – pattern detection  Post close trading – simple timing algorithm  Locked/crossed markets – timing, causation

9. Slide 9November 8, 2006 Kaskad Technology Responses  Business logic continuously applied to streams  Potential violations generate alerts  Audible and visual alerts  Other events are triggered  Downstream applications notified  Dashboards  Custom surveillance application  Operations and monitoring dashboard

10. Slide 10November 8, 2006 Kaskad Technology Results  3 month implementation  1 engineer for Analyst Workstation custom application  2 engineers for RuleBot development  1 business analyst  Currently in final client QA  Benefits:  Regulate market real-time with instant results  Recreate market associated with historical events  Simplify violation review process  Add surveillance functionality as needed  Scale horizontally and vertically  Need more power, add another server