Brokerage Infrastructure

Learning outcomes

Most people picture a broker as an app with a buy button. Under that button sits one of the most heavily regulated, ledger-intensive, and operationally unforgiving systems in all of finance. A broker holds other people’s money and other people’s securities, promises to give them back on demand, routes their orders into markets that move in microseconds, and settles the resulting obligations through a clearing chain it does not fully control. Get the infrastructure right and a customer never thinks about it. Get it wrong and customers lose access to their own assets, the regulator arrives, and in the worst case the firm fails and takes client property with it.

After studying this page, you can:

• Describe a broker-dealer as a layered system: front office, middle office, back office, and the ledger that ties them together, and say which obligation each layer carries.
• Distinguish an introducing broker from a clearing broker, explain self-clearing versus correspondent clearing, and read a fully-disclosed clearing relationship.
• Explain cash versus margin accounts in terms of who owns what and what the broker is permitted to do with customer property in each.
• Explain why customer cash and securities must be segregated, walk the SEC Rule 15c3-3 reserve formula at a conceptual level, and say what the reserve bank account is for.
• Explain net capital under Rule 15c3-1 as a liquidity cushion, and connect a capital requirement to a concrete engineering and operational decision.
• Explain payment for order flow, why it exists, and exactly where it collides with the duty of best execution.
• Reason about how a broker fails, including the 2021 meme-stock collateral spike, and separate the fundamental obligations every broker shares from the conventions a particular firm happens to adopt.

Before we dive in

You do not need a securities licence to follow this page. We will define each term the first time it appears, and we will keep the vocabulary small.

A broker-dealer is a firm registered to do two related jobs: act as a broker, arranging trades as an agent for customers, and act as a dealer, trading for its own account as a principal. Most retail firms are both, which is why the law treats them as one category. A customer is anyone whose money or securities the firm holds. A position is how much of a given security an account holds, long (owned) or short (borrowed and sold). Settlement is the final exchange of cash for securities that completes a trade; in US equities this currently happens one business day after the trade, a timing convention written as T+1. A custodian is whoever actually holds the securities; for most US securities the ultimate custodian is a central depository, not the broker itself.

Two regulators recur. The SEC (Securities and Exchange Commission) writes the federal rules. FINRA (the Financial Industry Regulatory Authority) is the self-regulatory organization that examines and enforces against broker-dealers day to day. We will also meet the DTCC (Depository Trust and Clearing Corporation) and its subsidiaries, the plumbing through which US trades clear and settle, and SIPC (the Securities Investor Protection Corporation), which insures customers if a broker fails.

Hold one picture through everything that follows: a broker is a custodian with a trading desk attached. Almost every rule below exists because the firm is holding property that is not its own, and the law is determined that the customer gets it back.

Mental Model

The wrong model is that your money and your shares sit inside your broker, in something like a labelled box with your name on it, and that when you buy a share the broker goes out, fetches that specific share, and tucks it into your box. People reason from this model to the conclusion that a broker failing is like a shop closing: annoying, but your stuff is your stuff and you can collect it.

That model is wrong in two important ways, and the truth changes how you read every control on this page.

First, your securities are almost never registered in your name. They sit in street name: legally held by the broker (or its nominee), with the broker keeping a record that says you are the beneficial owner, the one truly entitled to them. The actual certificates, to the extent they exist at all, are immobilized at the central depository and held in fungible bulk. You own a claim, recorded on the broker’s books, not a numbered object in a box.

Second, because positions are fungible book entries, the integrity of your ownership depends entirely on the broker’s books and records being accurate and on the broker being legally forbidden from treating your property as its own. So the right model is this: a broker is a ledger that promises. Your assets are entries the broker is obligated to honor, and the entire regulatory apparatus, segregation, the reserve formula, net capital, SIPC, exists to make that promise enforceable even when the firm itself is failing. The infrastructure is not there to move shares around a warehouse. It is there to keep a promise honest. Once you see the broker as a promising ledger rather than a warehouse, the customer protection rules stop looking like bureaucracy and start looking like the load-bearing walls they are.

Breaking it down

The teaching runs in eleven steps. The first five build the broker as a working system, front to back. The next three are the obligations that constrain that system: segregation, net capital, and best execution. The last three are the engineering choices, the failure modes, and the line between what every broker must do and what a particular firm merely chooses to do.

1. What a broker-dealer actually is as a system

Strip away the app and a broker-dealer is three offices and a ledger.

The front office faces the customer and the market. It is account opening, the trading screens, the order entry, the market data, and the routing logic that decides where an order goes. Its job is to capture intent correctly and get it to a market fast.

The middle office is risk and control. It checks that a customer has the buying power or the shares to do what they asked, it values positions, it computes margin, and it watches exposure in real time. Its job is to stop the firm and the customer from doing something they cannot afford.

The back office is operations: clearing, settlement, asset servicing (dividends, splits, proxies), reconciliation, and the books and records. It is the least glamorous and the most important, because this is where the promise to give the customer their property back is actually kept. When people say a broker is an operations business wearing a technology coat, this is the office they mean.

Underneath all three sits the ledger: a double-entry record of every customer’s cash and every customer’s position, plus the firm’s own accounts. Every action in any office eventually becomes entries here. A broker that cannot trust its own ledger cannot trust anything, because the ledger is the only place the firm knows what it owes and to whom.

flowchart LR
  CUST["Customer"] --> FO["Front office<br/>account, orders,<br/>routing, market data"]
  FO --> MO["Middle office<br/>buying power, margin,<br/>risk, valuation"]
  MO --> MKT["Market venue<br/>exchange or<br/>wholesaler"]
  MKT --> BO["Back office<br/>clearing, settlement,<br/>asset servicing, recon"]
  BO --> LED["Ledger<br/>customer cash and positions,<br/>firm accounts"]
  FO --> LED
  MO --> LED

The crucial point is that these are not separate products you can ship independently. A trade that the front office captures must flow through risk, reach a venue, come back to be cleared and settled, and land correctly in the ledger, or the firm has an open obligation it is not tracking. The whole reason brokerage is hard is that this loop has to close, exactly, every time, for every trade, across millions of accounts, with property that is not the firm’s to lose.

2. Introducing versus clearing brokers and the clearing relationship

Not every broker does every job. The industry splits the work into two roles that can live in one firm or in two firms tied by contract.

An introducing broker faces the customer: it opens accounts, takes orders, and owns the relationship. A clearing broker (also called the clearing firm or carrying firm) does the heavy operational lifting behind the scenes: it carries the customer accounts on its own books, settles the trades, holds the cash and securities, computes margin, sends the statements, and interfaces with the depository. In a fully-disclosed clearing arrangement, the customer is told who the clearing firm is and the clearing firm carries the account in the customer’s name; the introducing broker is essentially a front office renting an entire back office.

Why split it? Because clearing is enormously expensive to build and to be allowed to do. A clearing firm needs membership at the DTCC subsidiaries, large amounts of capital, deep operational staff, and the systems to run segregation and the reserve formula correctly. A new brokerage cannot build all of that on day one and should not try. So it introduces its customers to an established clearing firm and pays a per-trade or per-account fee. The introducing broker keeps the customer relationship and the brand; the clearing firm keeps the regulatory and operational burden of actually holding the assets.

flowchart LR
  C["Retail customer"] --> IB["Introducing broker<br/>account relationship,<br/>order capture"]
  IB --> CB["Clearing broker<br/>carries accounts, settles,<br/>holds assets, computes margin"]
  CB --> DTCC["DTCC subsidiaries<br/>central clearing<br/>and settlement"]
  CB --> CUSTODY["Depository custody<br/>street-name securities"]

The other model is self-clearing: the firm does both jobs itself, becoming its own clearing broker. This is correspondent clearing seen from the other side, where a large clearing firm carries the accounts of many smaller correspondent introducing brokers. A growing brokerage often starts fully-disclosed, builds scale and capital, and then decides whether to become self-clearing. That decision is one of the biggest in the life of a broker, and we return to it under build versus buy.

The economics drive the choice. Clearing through someone else is a variable cost: you pay per trade and per account, and you give up margin you could have earned on customer balances and securities lending. Self-clearing is a large fixed cost in people, systems, and capital, but it converts that variable cost into your own revenue and gives you control over the customer experience end to end. Below a certain volume, paying a clearing firm is obviously right. Above a certain volume, the fixed cost amortizes and self-clearing wins. The hard part is the middle, and the migration itself is a multi-year operational project that can break a firm if mistimed.

3. Account types cash and margin and what they oblige

A brokerage account is not just a balance. Its type defines who owns what and what the broker is allowed to do with the customer’s property, and those permissions cascade into segregation and capital. The two foundational types are cash and margin.

In a cash account, the customer must pay in full for everything they buy, with their own settled money. They cannot borrow from the broker. Because the customer has fully paid, the securities are fully paid (or excess margin) securities, which the broker must hold for the customer and generally may not lend or pledge for its own purposes without explicit permission. A cash account is the simplest custodial relationship: the customer’s stuff is the customer’s stuff, and the broker is close to a pure custodian.

In a margin account, the customer can borrow from the broker to buy securities, using the securities themselves as collateral. The borrowed money is a loan the customer pays interest on (the margin loan, recorded as a debit balance). This single permission changes the legal picture profoundly. Securities a customer has not fully paid for are margin securities, and the broker is generally permitted to rehypothecate them: to pledge them to a lender to fund the very loan it extended to the customer, up to regulatory limits. The customer’s property is now working for the firm’s financing, which is exactly why margin securities are treated differently from fully paid ones in every protection rule that follows.

Margin also imports a risk dimension the cash account never had. Because the customer is leveraged, a fall in the position can wipe out the customer’s equity and start eating the broker’s loaned money. So a margin account carries a maintenance margin requirement: a minimum equity percentage that, if breached, triggers a margin call demanding the customer add funds or sell. If they do not, the broker liquidates the position to protect its loan. This is the mechanism behind most violent broker-customer disputes, and the engineering of it (real-time valuation, accurate equity computation, fair and timely liquidation) is some of the most consequential code a broker writes.

4. The books and records the security master and positions

If the ledger is the heart of a broker, the books and records are the legally mandated form that heart must take. A broker-dealer is required to keep specific records in specific ways, and examiners will ask to see them. Three pieces matter most for understanding the system.

The security master is the reference database of every instrument the firm can touch: its identifiers (ticker, CUSIP, ISIN), its type (equity, option, bond, fund), its issuer, its corporate-action history, its trading and settlement conventions, and its current and historical pricing. Almost everything else depends on it. A trade cannot be booked, a position cannot be valued, margin cannot be computed, and a dividend cannot be paid without a correct security master entry. A wrong CUSIP or a missed stock split here propagates into wrong positions, wrong valuations, and wrong customer statements, which is why the security master is treated as critical reference data and not as an afterthought.

Positions are the per-account holdings: for each account and each security, how many units the account is long or short, and at what cost basis. Positions are derived from the trade and settlement record, the same way a ledger balance is derived from postings: you do not store a position as a number you edit, you compute it from the immutable history of trades, transfers, and corporate actions. This is the double-entry discipline applied to securities rather than only to cash.

The stock record is the broker’s master ledger of securities: for every security, who the firm holds it for (the long side, the customers and accounts entitled to it) and where the firm actually has it (the short side, at the depository, at a clearing corporation, in transit, loaned out). The stock record must balance, security by security: the total the firm owes out must equal the total the firm holds. When it does not, the difference is a break, and a security in transit or unaccounted for triggers strict rules about buying it in or borrowing to cover. The stock record is the securities-world twin of a cash trial balance, and reconciling it is a daily, non-negotiable discipline.

flowchart TB
  SM["Security master<br/>identifiers, type, prices,<br/>corporate actions"]
  TR["Trade and settlement<br/>immutable activity record"]
  POS["Positions<br/>per account, per security,<br/>long or short, cost basis"]
  SR["Stock record<br/>who we hold it FOR<br/>vs where we HAVE it"]
  SM --> POS
  TR --> POS
  POS --> SR
  SM --> SR
  SR --> RECON["Daily reconciliation<br/>longs must equal shorts<br/>per security"]

The lesson that carries forward: a broker does not store balances and positions as editable numbers. It stores activity and derives state, then reconciles that derived state against the outside world (the depository, the clearing firm, the bank) every day. The security master makes the derivation meaningful, positions are the derivation for one account, and the stock record is the derivation for the whole firm. Reconciliation is the control that proves the derivation matches reality.

5. Order flow routing and the back office

Now follow a single order from tap to settled, because the path reveals where every obligation bites. The reader should watch the full structure from the first frame: the main path from order to settlement, the risk branch that can reject or pause an order, and the back-office subpath that clears and reconciles after execution.

Three things in that flow deserve emphasis. First, pre-trade risk is not optional politeness; it is the firm protecting itself and the customer from an order that cannot be afforded, and it must run in the order’s critical path, in milliseconds, before the order leaves the building. Second, routing is a decision, not a wire: the broker chooses where to send the order, and that choice is governed by the duty of best execution we cover in step eight. Third, the back office subpath (clearing, settlement, ledger, reconciliation) runs after execution but is where the actual obligations are finalized. A fill is a promise; settlement is when the promise is kept; reconciliation is the proof it was kept correctly.

The back office is also where asset servicing lives. When a stock pays a dividend, splits, or holds a vote, the broker must allocate the right amount or the right new shares or the right ballot to every beneficial owner on its books, using the security master and the positions as of the right dates. Customers never see this machinery when it works, and they are furious when it does not, because a missed dividend or a botched split is the broker visibly failing at the one job it has: keeping the customer’s claim accurate.

6. Segregation and the customer protection rule

Here is the obligation that defines the entire business. A broker holds customer cash and customer securities, and the law is absolute that the firm may not finance its own operations with that property and then fail, leaving customers with nothing. The controlling federal rule is SEC Rule 15c3-3, the customer protection rule, and it does two things: it requires the broker to physically segregate fully-paid customer securities, and it requires the broker to keep enough cash or qualified securities in a special bank account to cover its net cash obligations to customers.

Start with securities. Customers’ fully paid and excess margin securities must be in the firm’s possession or control, meaning held free of any lien at the depository, in a vault, or in another control location, not pledged to the firm’s lenders. The broker may use margin securities (the unpaid-for ones in margin accounts) to fund customer margin loans, but the fully-paid securities of customers must sit untouched, ready to be returned. This is why account type mattered so much in step three: it decides which securities the firm may put to work and which it must leave alone.

Now the cash side, the famous reserve formula. The intuition is a balance: on one side, the cash the firm effectively owes to or because of customers (customer credit balances, money from lending customer securities, and similar credits); on the other, the cash that customers effectively owe the firm or that is properly financing customer activity (customer margin loans, securities the firm has borrowed to deliver, and similar debits). If the customer-related credits exceed the customer-related debits, the difference is customer money that is not being used for customers, and the firm must deposit that excess into a Special Reserve Bank Account for the Exclusive Benefit of Customers, segregated from the firm’s own funds. The computation is done at least weekly (some large firms compute daily), and the deposit must be made promptly.

flowchart LR
  subgraph CR["Credits: cash owed to / because of customers"]
    A["Customer free credit balances"]
    B["Proceeds from lending<br/>customer securities"]
  end
  subgraph DR["Debits: cash owed by / financing customers"]
    C["Customer margin loans<br/>(debit balances)"]
    D["Securities borrowed<br/>to make deliveries"]
  end
  CR --> COMP["Reserve computation<br/>credits minus debits"]
  DR --> COMP
  COMP --> RES["If credits exceed debits:<br/>deposit the excess into the<br/>Special Reserve Bank Account"]

The deep point is that the reserve formula turns an abstract promise into a concrete, auditable cash deposit. Without it, a firm could take customers’ idle cash, use it for its own trading, and have nothing left when customers asked for it back. With it, the moment the firm is holding more customer-related cash than it is properly deploying for customers, that surplus is locked away in a bank account the firm cannot touch for its own purposes. The rule does not trust the firm to be honest; it forces the segregation into a separate account that an examiner and a SIPC trustee can find. When a broker fails and customers are made whole quickly, it is usually because this rule was followed: the property was there, segregated, waiting.

7. Net capital and why a broker carries a cushion

Segregation protects the customer’s property. Net capital protects against the firm running out of liquidity while it still holds that property. The controlling rule is SEC Rule 15c3-1, the net capital rule, and its purpose is to ensure a broker-dealer keeps enough liquid assets that, if it had to wind down, it could meet its obligations to customers and counterparties without a fire sale or a default.

The mechanism is deliberately conservative. The firm computes its net capital by starting from net worth, then subtracting illiquid assets entirely (they cannot be turned into cash quickly in a crisis, so they do not count), and then applying haircuts to the market value of the securities it does hold. A haircut is a percentage reduction that assumes the security might have to be sold at a loss under stress: more volatile or less liquid securities take bigger haircuts. What remains is a measure of the firm’s genuinely available liquidity. The firm must keep this above a minimum, computed under one of two methods (a flat dollar floor or a percentage of aggregate customer-related obligations, whichever binds), and it must monitor it continuously, not just at quarter end.

Why does this rule exist? Because a broker can be solvent on paper (assets exceed liabilities) and still fail, if its assets are illiquid and its obligations come due now. A customer asking for their cash back does not wait for the firm to sell a building. Net capital forces the firm to hold a liquidity cushion sized to how risky its holdings are, so that a sudden demand or a market shock does not turn a paper-solvent firm into a defaulting one. The haircuts make the cushion bigger precisely when the firm is holding the kind of assets that lose value fastest under stress.

This is where regulation becomes engineering. A net capital requirement that must hold continuously means the firm needs real-time or near-real-time computation of its capital position, its haircuts, and its customer obligations. It means risk systems that can value the book under stress. And it means that certain product and growth decisions are gated by capital: offering a riskier product, taking larger positions, or onboarding a flood of new customers all consume capital, and the firm’s systems must show, before it acts, that it will still be above the line. A capital rule on paper becomes a set of real-time invariants in code.

The slider makes the trade-off tangible: the larger the haircut, the less of a position’s market value the firm may count toward the capital it must keep, so riskier inventory forces the firm to hold more genuine liquidity elsewhere. That is the rule working as intended. It does not forbid risk; it makes risk expensive in capital, which is exactly the incentive a custodian of other people’s property should face.

8. Payment for order flow and the best execution tension

When a retail customer places an order, the broker decides where to route it. One common destination is a wholesaler (also called a market maker or internalizer): a large firm that pays the broker to send it retail orders, then fills those orders from its own inventory. The payment is payment for order flow (PFOF). It is why many retail brokers can advertise zero commissions: the customer pays no explicit fee, and the broker earns its money from the wholesaler instead.

Why would a wholesaler pay for orders? Because retail order flow is, on average, profitable to trade against. Retail orders are usually small and not driven by inside information, so a wholesaler can fill them at a price slightly better than the public exchange quote (a small price improvement to the customer) and still capture the spread on the other side. Everyone in the chain can be better off than trading on the lit exchange: the customer gets a touch of price improvement, the broker gets paid, and the wholesaler keeps the rest. This is the genuine economic argument for PFOF, and it is not nothing.

Here is the tension, and a senior person must hold both sides honestly. The broker owes every customer a duty of best execution: it must seek the most favorable terms reasonably available for the customer’s order, considering price, speed, and likelihood of execution. PFOF creates a conflict, because the broker is paid by the destination it is choosing. A broker could, in principle, route to whoever pays it the most rather than to whoever fills the customer best. Best execution is the legal obligation that this conflict must not be resolved against the customer: the duty runs to the customer, and the payment the broker receives cannot be the reason an order is routed somewhere worse. Regulators require brokers to monitor and document execution quality and to disclose their routing and PFOF arrangements, precisely because the conflict is real and the only defense is measurement and transparency.

flowchart LR
  CUST["Retail customer<br/>places order"] --> BRK["Broker<br/>routing decision<br/>(owes best execution)"]
  BRK -->|routes order| WS["Wholesaler / internalizer<br/>fills from inventory"]
  WS -->|payment for order flow| BRK
  WS -->|price improvement| CUST
  BRK -.must monitor.-> BE["Execution quality<br/>price, speed, fill rate"]

The engineering consequence is that a broker cannot honestly run PFOF without execution-quality measurement built into its infrastructure: capturing the prevailing market quote at the moment of routing, comparing the fill the customer actually received, and aggregating that across venues and over time to prove that the routing choice served the customer. A broker that takes PFOF and does not measure execution quality is not just risking an enforcement action; it has no way to know whether it is meeting its core duty. The lesson is that an economic arrangement (getting paid by the venue) forces a control (measuring whether the customer was nonetheless well served), and the control has to live in the systems, not in a policy memo.

9. Build versus buy and the vendor ecosystem

A new brokerage faces a decision on every component: build it, or buy it from a vendor. Almost no firm builds everything, and almost none buys everything, because the right answer differs by layer and changes as the firm grows.

The strongest case to buy is clearing and settlement and the core books and records. As step two showed, becoming a clearing firm requires depository memberships, capital, and deep operational maturity. A startup that introduces to an established clearing firm gets a working back office, regulatory cover, and a faster path to launch, in exchange for per-trade fees and less control. Many successful brokers run fully-disclosed for years. The strongest case to build is usually the front office and the customer experience: the app, the onboarding, the data, and increasingly the routing logic, because that is where the firm differentiates and where a vendor’s generic product cannot express the firm’s specific edge.

The middle is genuinely hard and genuinely consequential. Some firms buy a packaged back-office and books-and-records platform and customize it; others, once large enough, build their own ledger and operations stack to control cost, latency, and behavior. The forces pulling toward build are scale economics (vendor fees that grow with volume eventually exceed the cost of owning the system), control (you cannot fix a vendor’s bug or extend its data model on your timeline), and differentiation. The forces pulling toward buy are time to market, regulatory complexity already solved by the vendor, and the simple fact that a ledger holding customer property is one of the least forgiving things to build from scratch.

There is no universally right answer, and the honest framing is a build-versus-buy curve that bends with scale. The discipline a senior engineer brings is to decide layer by layer, to be ruthless about not building the regulated, capital-heavy parts before the firm can carry them, and to be equally clear that the parts which define the firm (and the ledger the firm must ultimately trust) are usually worth owning once the volume justifies it. Buying is not a failure and building is not a virtue; matching the decision to the firm’s stage is the skill.

10. Failure modes settlement defaults and the 2021 collateral spike

A broker fails in characteristic ways, and the controls on this page map onto them. Walking the failure modes is the best test of whether you understand why the obligations exist.

A settlement default is the back office failing to deliver cash or securities when due. A customer sells, the buyer’s cash is owed, and somewhere in the chain a party cannot deliver. In a centrally cleared market the central counterparty (the CCP, here the National Securities Clearing Corporation, a DTCC subsidiary) stands between buyers and sellers and guarantees settlement, which is precisely why it demands collateral from its members. The CCP is absorbing the risk that a member defaults, so it insists each member post margin sized to that member’s risk. That margin requirement is usually a quiet background cost. Under stress it becomes the thing that can break a broker.

This is exactly what happened in the 2021 meme-stock episode. When trading in a small set of heavily shorted stocks went vertical and enormously volatile, the CCP’s risk models did what they are designed to do: they demanded far more collateral from clearing members carrying large, concentrated, volatile positions in those names. For at least one large retail broker, the clearinghouse collateral requirement spiked by an order of magnitude effectively overnight, into the billions, far beyond what the firm had on hand. The firm could either post collateral it did not have, default to the clearinghouse (catastrophic), or reduce the position it was clearing by restricting customers from opening new positions in the affected stocks. It chose the last, and the resulting trading restrictions became a public firestorm.

The episode is the single best illustration of how the layers on this page connect. A market reality (extreme volatility in a few stocks) drove a clearing reality (the CCP’s risk model demanding more collateral) which drove a liquidity reality (the broker had to find billions fast) which drove an operational and product decision (restrict trading) which drove a customer and reputational and regulatory reality (outrage, hearings, lawsuits). No layer acted in isolation. The collateral spike was not a bug or a conspiracy; it was the settlement guarantee working as designed, transmitted up through a firm that had not capitalized for that tail.

sequenceDiagram
  participant C as Customers
  participant B as Broker
  participant CCP as Central counterparty
  C->>B: Surge of orders in volatile stocks
  B->>CCP: Clears concentrated, volatile positions
  CCP->>B: Risk model spikes collateral demand
  Note over B: Required collateral jumps by an<br/>order of magnitude, into the billions
  B->>B: Cannot post that much immediately
  B->>C: Restrict opening new positions to cut cleared risk
  B->>CCP: Reduced risk lowers the collateral demand
  Note over C,CCP: Trading resumes, the chain held, but the broker tail was exposed

The other failure modes rhyme with this. Under-segregation (a firm using customer property it should have locked away) is what Rule 15c3-3 prevents and what turns a failure into a catastrophe when it is violated. Insufficient net capital is a firm that cannot meet obligations under stress, which is what Rule 15c3-1 forces a cushion against. Reconciliation breaks that go unresolved are the firm losing track of who owns what, which is why the stock record must balance daily. Margin liquidation failures, where a leveraged customer’s losses exceed their equity and start eating the firm’s capital faster than liquidation can cover, are the margin-account risk of step three realized. Every named control on this page exists because some firm, at some point, failed in exactly the way the control now prevents.

11. Fundamental obligations versus firm-specific conventions

The last skill is telling the difference between what every broker must do and what a particular firm happens to do, because confusing the two is how engineers cargo-cult another firm’s choices into requirements they are not.

The fundamental obligations are non-negotiable and roughly identical across all US broker-dealers, because they come from federal rules and the structure of the markets. Segregating fully-paid customer securities and reserving surplus customer cash under Rule 15c3-3. Maintaining net capital under Rule 15c3-1. Owing best execution to customers. Keeping accurate, prescribed books and records, including a balancing stock record. Settling through the central clearing and depository system on the market’s settlement cycle. Honoring the SIPC framework. These do not vary by firm; they vary only as the regulators change the rules, which is rare and slow and applies to everyone at once.

The firm-specific conventions are choices a firm makes within those obligations, and they vary enormously. Whether to self-clear or introduce. Whether to build or buy each layer. Which clearing firm, which vendors, which routing destinations and PFOF arrangements (within the best-execution duty). How accounts and positions are modeled in the firm’s own ledger schema. How often the reserve formula is computed beyond the regulatory minimum (weekly is the floor; many large firms do it daily for safety). What margin policies to set above the regulatory minimums. The internal names for accounts, the technology stack, the operational runbooks. None of these is dictated by law; each is a design decision the firm owns.

The discipline is to keep the two cleanly separated in your head and in your systems. When you read how another broker is built, ask of each detail: is this the rule, or is this their choice? The rules tell you the invariants your system must never violate. Their choices are just one point in a large design space, instructive but not binding. A senior engineer designs to the fundamental obligations as hard constraints and treats every convention, including their own firm’s, as a decision that could have been made differently and may need to change as the firm scales.

Mastery Questions

1. A startup brokerage is deciding between introducing to an established clearing firm and self-clearing from day one. The founders argue that self-clearing captures more revenue per trade and gives full control of the customer experience. As the engineer in the room, how do you frame the decision, and what would make you push back on self-clearing now?

   Answer. The founders are describing the end state of a successful self-clearing firm, not the path to it. Self-clearing does capture securities-lending and interest economics and gives end-to-end control, but it requires depository memberships, large amounts of regulatory capital, deep operations staff, and correct implementations of Rule 15c3-3 and Rule 15c3-1, all of which a startup lacks on day one. Introducing to an established clearing firm buys a working, regulated back office immediately, with the clearing firm carrying the capital and operational burden, in exchange for per-trade fees and less control. The decision is a build-versus-buy curve that bends with scale: below a volume threshold the variable clearing fee is far cheaper than the fixed cost of owning clearing, and only above that threshold does self-clearing amortize. I would push back hard on self-clearing now, because the firm cannot yet carry the capital or run segregation and net capital correctly, and because the migration to self-clearing is itself a multi-year operational project that can break a firm if attempted too early. The right framing is to introduce first, build the customer-facing differentiation we own, and revisit self-clearing when volume justifies the fixed cost, not before.

2. Your firm offers commission-free trading funded by payment for order flow. A regulator asks you to demonstrate that you are meeting your best-execution duty. What must your infrastructure already be doing for you to answer honestly, and why is policy alone not enough?

   Answer. Best execution is a duty owed to the customer to seek the most favorable terms reasonably available, considering price, speed, and likelihood of execution, and PFOF creates a real conflict because the firm is paid by the venue it routes to. A policy that says we will not let payment override the customer’s interest is necessary but proves nothing on its own. To answer the regulator honestly, the infrastructure must already be measuring execution quality: capturing the prevailing market quote at the moment each order is routed, recording the fill the customer actually received, and aggregating price improvement, speed, and fill rates across venues and over time. Only that data lets the firm show that routing decisions served the customer rather than the firm’s PFOF revenue. The reason policy alone is insufficient is that the conflict is structural: the firm is paid by the destination it chooses, so the only credible defense is measurement and transparency built into the systems, not an assurance. If the firm takes PFOF but does not measure execution quality, it cannot even know whether it is meeting its core duty, let alone prove it.

3. During a period of extreme volatility, your clearinghouse demands an order of magnitude more collateral overnight on the positions your firm is clearing, far beyond your available liquidity. Walk through why this happens, what your options are, and which controls on this page should have reduced the chance you are in this position.

   Answer. It happens because the central counterparty guarantees settlement and therefore demands collateral from each clearing member sized to that member’s risk. When a few stocks become extremely volatile and your customers concentrate positions in them, the CCP’s risk model correctly demands far more margin to cover the larger tail risk you are bringing to the guarantee. This is the settlement guarantee working as designed, not a malfunction. The immediate options are stark: post the collateral if you can find it, default to the clearinghouse (catastrophic and effectively firm-ending), or reduce the cleared position by restricting customers from opening new positions in the affected names, which lowers the collateral demand but causes a customer and reputational crisis, as the 2021 meme-stock episode showed. The controls that should have reduced the chance of being cornered are net capital and liquidity planning under Rule 15c3-1, which force a cushion sized to the riskiness of the book and should have been stress-tested against exactly this kind of concentrated, volatile tail; real-time risk and margin systems that would have flagged the building concentration before it became unmanageable; and prudent firm-specific margin and concentration policies set above the regulatory minimums. The deep lesson is that a market reality propagated through clearing into liquidity and then into a product and reputational crisis, and the firm’s only real defense was to have capitalized and risk-managed for the tail before it arrived.