Internal Matching Engine for Institutional Capital Markets

Matched trades within the internal venue had to be automatically formatted into regulatory sub-millisecond messaging — specifically OSE's MO76 Two-Sided Transaction message — and routed to the exchange's clearing adapter (Tostnet/J-NET) to register the clearing house as the central counterparty to both sides.

This required building a bespoke clearing venue adapter capable of handling both real-time novation during market hours and asynchronous persistence during exchange downtime, with guaranteed delivery and zero trade loss.

Positions opened on the internal market had to be completely fungible and interchangeable with the primary exchange. A trader needed the ability to buy an instrument internally and close the position out via a sell order on the live primary exchange — and vice versa — with real-time risk reflecting the combined exposure across both venues.

This required continuous, real-time synchronisation of position data between the internal matching engine and the live primary exchange feeds, with risk limits enforced across the combined exposure view.

The system required a continuous, real-time pricing engine to calculate dynamic daily price bands — Max/Min ceilings — based on primary exchange risk prices (Settlement Price, Closing Price, Last Trade Price, and Opening Price) to prevent trade rejections from out-of-range market movements.

These price limits had to update in real time as primary exchange reference prices changed throughout the trading day, with automatic circuit breaker triggers that halted matching if the venue price moved outside permissible bands.

We implemented precise Price/Time priority continuous matching via a Central Limit Order Book (CLOB). The engine supports essential institutional order types — Limit orders with Minimum Fill Quantities — and time-in-force parameters (Good for Day / GFD), with internal automated cancel-on-disconnect protection to shield algorithmic traders from connection drops.

A high-frequency Smart Order Router compares internal and primary market prices in real time, routing retail flow to the venue offering best execution. For institutional block orders, the system routes to the internal dark pool first to avoid market impact on the lit exchange.

Orders placed on the internal venue are instantly routed through a multi-level pre-trade risk engine. Positions are dynamically validated against the client's current open positions on the primary exchange — combining internal and external exposure into a single risk matrix.

• Gross, net, short, and long position limits enforced across both venues in real time
• One-shot order size limits with automatic rejection on breach
• Tick-level price validation before the order touches the book
• Dynamic circuit breakers triggered by primary exchange price band updates

To handle off-market hours and bank holidays, we engineered an asynchronous transaction queue. If the internal engine creates a fill while the primary clearing house is closed, the post-trade Trade Registration Requests (TRR) are safely persisted across database nodes — with guaranteed delivery and no message loss.

As soon as the primary venue opens, the Clearing Adapter automates novation: safely registering clearing codes and Give-Up members, formatting and transmitting MO76 messages, and confirming receipt before clearing the queue. Each step is logged with a complete audit trail.

The matching engine was deployed as a distributed hub topology designed for highly regulated environments. High-volume connections are throttled at a strict per-connection rate limit (100 messages/sec) to optimise matching equity across all participants.

To prevent data loss from physical hardware failures, all active states, order logs, and execution steps are replicated synchronously to a standby failover node. In the event of primary node failure, the standby promotes automatically — guaranteeing zero dropped orders and no position gaps.